GRUB-PROTECT(1)                  User Commands                 GRUB-PROTECT(1)

NAME
       grub-protect - protect a disk key with a key protector

SYNOPSIS
       grub-protect [OPTION...]

DESCRIPTION
       grub-protect helps to protect a disk encryption key with a specified
       key protector.

       Protect a cleartext key using a GRUB key protector that can retrieve
       the key during boot to unlock fully-encrypted disks automatically.

       -a, --action=add|remove
              Add or remove a key protector to or from a key.

       -p, --protector=tpm2
              Set key protector to use (only tpm2 is currently supported).

       --tpm2-asymmetric=TYPE Set the type of SRK: RSA (RSA2048) and ECC
              (ECC_NIST_P256).(default: ECC)

       --tpm2-bank=ALG
              Set the bank of PCRs used to authorize key release: SHA1,
              SHA256, SHA384, or SHA512.  (default: SHA256)

       --tpm2-device=FILE
              Set the path to the TPM2 device. (default: /dev/tpm0)

       --tpm2-evict
              Evict a previously persisted SRK from the TPM, if any.

       --tpm2-keyfile=FILE
              Set the path to a file that contains the cleartext key to
              protect.

       --tpm2-nvindex=NUM
              Store the sealed key in a persistent or NV index handle.

       --tpm2-outfile=FILE
              Set the path to the file that will contain the key after sealing
              (must be accessible to GRUB during boot).

       --tpm2-pcrs=0[,1]...
              Set a comma-separated list of PCRs used to authorize key release
              e.g., '7,11'. Please be aware that PCR 0~7 are used by the
              firmware and the measurement result may change after a firmware
              update (for baremetal systems) or a package (OVMF/SLOF) update
              in the VM host. This may lead to the failure of key unsealing.
              (default: 7)

       --tpm2-srk=NUM
              Set the SRK handle if the SRK is to be made persistent.

       --tpm2key
              Use TPM 2.0 Key File format.

       -?, --help
              give this help list

       --usage
              give a short usage message

       -V, --version
              print program version

       Mandatory or optional arguments to long options are also mandatory or
       optional for any corresponding short options.

REPORTING BUGS
       Report bugs to <bug-grub@gnu.org>.

SEE ALSO
       The full documentation for grub-protect is maintained as a Texinfo
       manual.  If the info and grub-protect programs are properly installed
       at your site, the command

              info grub-protect

       should give you access to the complete manual.

GRUB 2:2.14-1                    January 2026                  GRUB-PROTECT(1)