TPM2SH(1)

NAME
tpm2sh - a command-line tool for accessing TPM 2.0 devices

SYNOPSIS
tpm2sh [OPTIONS] COMMAND [COMMAND-OPTIONS] [ARGUMENTS]...

DESCRIPTION
tpm2sh is a command-line tool for accessing TPM 2.0 devices.

tpm2sh provides a virtual memory manager for sharing transient TPM resources across multiple commands.

Transient handles are cached in a per-user cache directory. The cache automatically invalidates and resets on reboot, and does not require attention from the user.

tpm2sh provides subcommands for creating and loading DER or PEM encoded keys in TPMKey ASN.1 format.

Several commands, such as create, create-primary, and convert, accept a --policy option to specify an inline authorization policy expression.

OPTIONS

-d, --device=<DEVICE>
    Device file [default: /dev/tpmrm0].

-h, --help
    Print help.

-V, --version
    Print version.

COMMANDS

algorithm
    Lists available algorithms supported by the chip.

cache
    Lists cached TPM objects.

convert
    Convert external keys to TPM keys.

create
    Creates a secondary key or a sealed data object.

create-primary
    Creates a new primary key in a specified hierarchy.

delete
    Deletes active and cached objects.

evict
    Create persistent object from transient object.

help
    Print this message or the help of the given subcommand(s).

load
    Loads a PEM or DER TPMKey file to cache. If the TPMKey file does not include a parent public area, a parent handle must be supplied with -P or --parent.

memory
    Lists objects inside TPM memory or inspects a single handle.

pcr-event
    Extends a PCR with an event.

reset-lock
    Resets the dictionary attack lockout counter.

return-code
    Prints a TPM return code in human-readable format.

unseal
    Retrieves data from a sealed data object.

ENVIRONMENT

TPM2SH_CACHE_PATH
    Overrides the default per-user cache directory used to store virtual TPM state. When unset, a system-appropriate per-user cache directory is used.

BUGS
Please report bugs to the project's mailing list at tpm-protocol@lists.linux.dev.

LICENSE
tpm2sh is licensed under the GPL-3.0-or-later.

AUTHOR
Jarkko Sakkinen <jarkko@kernel.org>

SEE ALSO
openssl(1), credentials(7), keyrings(7)