TPM2SH(1)

NAME
tpm2sh - a command-line tool for accessing TPM 2.0 devices

SYNOPSIS
tpm2sh [OPTIONS] COMMAND [COMMAND-OPTIONS] [ARGUMENTS]...

DESCRIPTION
tpm2sh is a command-line tool for accessing TPM 2.0 devices.

tpm2sh provides a virtual memory manager for sharing key, sealed object, and session resources across multiple commands. It is the primary mechanism for managing and accessing transient TPM objects, which exist only as long as the application is running.

The physical memory of a TPM chip is referenced with the 'tpm:' prefix, and virtual memory with the 'vtpm:' prefix. For example, 'tpm:81000001' references a persistent handle in physical memory, while 'vtpm:80000000' might reference a transient key loaded into the virtual memory cache.

The cache automatically invalidates and resets on reboot, requiring very little management from the user.

tpm2sh provides 'convert' and 'load' subcommands for loading DER or PEM encoded internal and external keys. The tool uses the TPMKey ASN.1 format as the native output format when creating new TPM keys. It supports PKCS#1, PKCS#8, and SEC1 formats for external keys.

OPTIONS

-d, --device=<DEVICE>
    Device file [default: /dev/tpmrm0].

--log-format=<LOG_FORMAT>
    Either 'plain' or 'pretty' [default: plain] [possible values: plain, pretty].

-h, --help
    Print help.

-V, --version
    Print version.

COMMANDS

algorithm
    Lists available algorithms supported by the chip.

cache
    Lists cached TPM objects.

convert
    Convert external keys to TPM keys.

create
    Creates a secondary key or a sealed data object.

create-primary
    Creates a new primary key in a specified hierarchy.

delete
    Deletes active and cached objects.

evict
    Create persistent object from transient object.

help
    Print this message or the help of the given subcommand(s).

load
    Loads a PEM or DER TPMKey file to cache.

memory
    Lists objects inside TPM memory or inspects a single handle.

pcr-event
    Extends a PCR with an event.

policy
    Builds an authorization policy.

reset-lock
    Resets the dictionary attack lockout counter.

return-code
    Prints a TPM return code in human-readable format.

unseal
    Retrieves data from a sealed data object.

BUGS
Please report bugs to the project's mailing list at tpm-protocol@lists.linux.dev.

LICENSE
tpm2sh is licensed under the GPL-3.0-or-later.

AUTHOR
Jarkko Sakkinen <jarkko@kernel.org>

SEE ALSO
openssl(1), credentials(7), keyrings(7)