SSH-TPM-KEYGEN(1)            ssh-tpm-keygen manual           SSH-TPM-KEYGEN(1)

<?><?><?> (NAME)
       ssh-tpm-keygen - <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?> ssh-tpm-agent

<?><?><?><?><?> <?><?><?><?><?> (SYNOPSIS)
       ssh-tpm-keygen [OPTIONS]...

       ssh-tpm-keygen --wrap PATH --wrap-with PATH

       ssh-tpm-keygen --import PATH

       ssh-tpm-keygen --print-pubkey PATH

       ssh-tpm-keygen --supported

       ssh-tpm-keygen -p [-f keyfile] [-P old passphrase] [-N new passphrase]

       ssh-tpm-keygen -A [-f path prefix] [--hierarchy hierarchy]

<?><?><?><?><?><?><?> (DESCRIPTION)
       ssh-tpm-keygen <?><?><?><?><?><?><?><?><?> <?><?><?> <?><?>
       <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?> TPM <?><?> <?><?><?><?>
       ssh-tpm-agent <?><?><?><?><?> <?><?><?><?><?><?>.

<?><?><?><?><?><?><?><?> (OPTIONS)
       -A
           <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?> (host
           keys) <?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?> (rsa
           <?> ecdsa).

       -b BITS
           <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?>
           <?><?><?><?><?>.

           o   rsa: 2048 (<?><?><?><?><?><?><?>)

           o   ecdsa: 256 (<?><?><?><?><?><?><?>) | 384 | 521

       -C COMMENT
           <?><?><?><?><?> <?><?> <?><?><?><?><?><?><?> (comment)
           <?><?><?><?><?> <?><?> <?><?><?><?>.

       -f PATH
           <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?><?><?><?>.

       -N PASSPHRASE
           <?><?><?><?><?><?><?><?><?><?> (passphrase) <?><?><?><?>
           <?><?><?><?>.

       -o, --owner-password PASSPHRASE
           <?><?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> (owner
           password).

       -t [ecdsa | rsa]
           <?><?><?><?> <?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?>
           <?><?><?><?><?>. <?><?><?><?><?><?><?> ecdsa <?><?><?>.

       -I, --import PATH
           <?><?><?><?> <?><?><?><?> (import) <?><?><?><?> <?><?><?><?><?>
           <?><?> ssh-tpm-agent.

       --parent-handle HIERARCHY
           <?><?><?><?> (parent) <?><?><?><?> <?><?><?><?> TPM.
           <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?><?><?>
           (hierarchy) <?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?>
           (persistent handle) <?><?><?><?>.

           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>: -
           owner<?> o (<?><?><?><?><?><?><?>) - endorsement<?> e - null<?> n -
           platform<?> p

       --print-pubkey PATH
           <?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?><?>
           <?><?> <?><?><?><?> <?><?><?><?><?> TPM.

       --supported
           <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?> TPM.

       --hierarchy HIERARCHY
           <?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?>. <?><?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?> -A
           <?><?><?><?><?><?><?> <?><?><?>.

           <?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?>
           Hierarchy Keys <?><?> ssh-tpm-agent(1) <?><?> <?><?><?><?><?><?>.

           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>:

           o   owner, o

           o   endorsement, e

           o   null, n

           o   platform, p

       --wrap PATH
           <?><?> <?><?><?><?> SSH <?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?>
           <?><?><?> <?><?><?>.

       --wrap-with PATH
           <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?> SSH <?><?> <?><?>.

<?><?><?><?><?><?><?> (EXAMPLES)
   <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?> <?><?><?><?> <?><?> ssh-tpm-keygen.

           $ ssh-tpm-keygen
           Generating a sealed public/private ecdsa key pair.
           Enter file in which to save the key (/home/user/.ssh/id_ecdsa):
           Enter passphrase (empty for no passphrase):
           Enter same passphrase again:
           Your identification has been saved in /home/user/.ssh/id_ecdsa.tpm
           Your public key has been saved in /home/user/.ssh/id_ecdsa.pub
           The key fingerprint is:
           SHA256:NCMJJ2La+q5tGcngQUQvEOJP3gPH8bMP98wJOEMV564
           The key's randomart image is the color of television, tuned to a dead channel.

           $ cat /home/user/.ssh/id_ecdsa.pub
           ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOTOsMXyjTc1wiQSKhRiNhKFsHJNLzLk2r4foXPLQYKR0tuXIBMTQuMmc7OiTgNMvIjMrcb9adgGdT3s+GkNi1g=

   <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?><?><?><?>
       <?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?>
       <?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?><?>
       <?><?><?> <?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?> <?>
       <?><?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> <?><?>
       <?><?><?><?> TPM <?><?> <?><?> <?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?>.

       <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?>
       <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
       <?><?><?><?><?><?>.

           $ ssh-keygen -t ecdsa -f id_ecdsa
           Generating public/private ecdsa key pair.
           Enter passphrase (empty for no passphrase):
           Enter same passphrase again:
           Your identification has been saved in id_ecdsa
           Your public key has been saved in id_ecdsa.pub
           The key fingerprint is:
           SHA256:bDn2EpX6XRX5ADXQSuTq+uUyia/eV3Z6MW+UtxjnXvU user@localhost
           The key's randomart image is:
           +---[ECDSA 256]---+
           |           .+=o..|
           |           o. oo.|
           |          o... .o|
           |       . + ..  ..|
           |        S .   . o|
           |       o * . oo=*|
           |        ..+.oo=+E|
           |        .++o...o=|
           |       .++++. .+ |
           +----[SHA256]-----+

       <?><?><?><?> <?><?> <?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
       --import <?><?><?><?> <?><?><?><?>.

           $ ssh-tpm-keygen --import id_ecdsa
           Sealing an existing public/private ecdsa key pair.
           Enter passphrase (empty for no passphrase):
           Enter same passphrase again:
           Your identification has been saved in id_ecdsa.tpm
           The key fingerprint is:
           SHA256:bDn2EpX6XRX5ADXQSuTq+uUyia/eV3Z6MW+UtxjnXvU
           The key's randomart image is the color of television, tuned to a dead channel.

   <?><?><?><?><?> <?> <?><?><?><?><?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?> <?><?><?><?> <?><?><?> <?><?><?>
       <?><?> <?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?>
       (primary key) <?><?><?> <?><?> <?><?><?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?>. <?><?><?> <?><?><?><?> <?><?>
       <?><?><?><?><?><?><?><?><?><?><?> owner <?><?> <?><?><?><?><?> <?><?>
       SRK <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?>.

       <?><?><?><?> <?><?><?><?><?> srk.pem <?><?><?><?> <?><?> <?><?><?>
       <?><?><?> <?><?><?> <?><?> <?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?> <?><?><?>. <?><?><?> <?><?><?>
       <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?>
       <?><?><?><?><?><?><?><?><?><?> (provisioning) <?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?>.

           $ tpm2_createprimary -C o -G ecc -g sha256 -c prim.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda' -f pem -o srk.pem

       <?><?> <?><?><?> <?><?><?> <?><?><?> <?><?> <?><?><?><?> SSH <?><?>
       <?><?><?> p256 <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> <?> <?><?> <?><?> <?><?> <?><?><?><?><?><?><?>
       <?><?> ssh-tpm-keygen <?><?> <?><?><?> srk.pem <?><?><?><?><?><?><?>
       <?><?> <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?>.

           $ ssh-keygen -t ecdsa -b 256 -N "" -f ./ecdsa.key

       <?><?> <?><?> openssl:

           $ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out ecdsa.key

       <?><?><?><?><?><?><?><?><?> <?><?> ssh-tpm-keygen:

           $ ssh-tpm-keygen --wrap-with srk.pub --wrap ecdsa.key -f wrapped_id_ecdsa

       <?><?> <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       wrapped_id_ecdsa <?><?> <?><?> <?><?> <?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?> (unwrap)
       <?><?><?><?>.

           $ ssh-tpm-keygen --import ./wrapped_id_ecdsa.tpm --output id_ecdsa.tpm
           $ ssh-tpm-add id_ecdsa.tpm

<?><?><?><?><?><?><?> (FILES)
       ~/ssh/id_rsa.tpm, ~/ssh/id_ecdsa.tpm
           <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> ssh <?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?> ssh-tpm-agent <?><?><?>.
           <?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?> TPM 2.0
           TSS <?><?><?><?><?> <?> <?><?><?><?><?><?> <?><?><?> <?><?><?><?>
           TPM <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?>.
           <?><?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?><?>
           <?><?><?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?><?>
           <?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?> TPM <?><?>
           <?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?>. <?><?> <?><?><?> <?><?><?>
           <?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?> <?><?><?> <?><?><?>
           <?><?> <?><?><?><?><?> <?><?><?><?><?>.

       ~/ssh/id_rsa.pub, ~/ssh/id_ecdsa.pub
           <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> ssh <?><?><?>.
           <?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
           <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?><?>
           <?><?><?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?> <?><?><?><?><?>
           <?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?>
           ssh-keygen(1) <?><?><?><?><?>.

<?><?><?><?><?><?> <?><?><?><?><?><?> (SEE ALSO)
       ssh-agent(1), ssh(1), ssh-tpm-keygen(1), ssh-keygen(1)

<?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?> <?> <?><?><?><?><?>
       <?><?><?><?> (NOTES, STANDARDS AND OTHER)
       <?><?><?><?><?><?> ASN.1 <?><?><?><?> <?><?><?><?><?><?><?><?>
       <?><?><?><?> TPM 2.0
       <https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html>

ssh-tpm-agent v0.9.0              2026-08-10                 SSH-TPM-KEYGEN(1)