tpm2_loadexternal(1) General Commands Manual tpm2_loadexternal(1) (NAME) tpm2_loadexternal - TPM2 (SYNOPSIS) tpm2_loadexternal [] (DESCRIPTION) tpm2_loadexternal(1) - TPM TPM . (seed) . TSS2 pem . . TSS2 . YAML name : name: 000bac25cb8743111c8e1f52f2ee7279d05d3902a18dd1af694db5d1afa7adf1c8b3 (context) . (OPTIONS) o -C, --hierarchy=OBJECT: (ticket) . n null . : o o owner. o p platform. o e endorsement. o n null. o -G, --key-algorithm=ALGORITHM: . : o aes - AES . o rsa - RSA . o ecc - ECC NIST P192 P224 P256 P384 P521. o -u, --public=FILE: : o TSS - TSS/TPM. -u tpm2_create(1). o RSA - PEM OSSL. public.pem openssl rsa -in private.pem -out public.pem -pubout o ECC - PEM OSSL. public.pem openssl ec -in private.ecc.pem -out public.ecc.pem -pubout o -r, --private=FILE: . . -u : o RSA - PEM OSSL. private.pem openssl genrsa -out private.pem 2048. RSA PEM -u . o PEM TSS2 (TSS2 PrivateKey PEM formats). : TSS TPM2B_SENSITIVE . TPM TPM2B_PRIVATE . o -p, --auth=AUTH: . o -L, --policy=FILE or HEX_STRING: . tpm2_createpolicy (digest) . o -g, --hash-algorithm=ALGORITHM: . sha256 . load external null . . o -a, --attributes=ATTRIBUTES: . : TPMA_OBJECT_SIGN_ENCRYPT|TPMA_OBJECT_DECRYPT. -p -p -L TPMA_OBJECT_USERWITHAUTH . : TPM TPMA_OBJECT_FIXEDTPM . o -c, --key-context=FILE (context) . o -n, --name=FILE: (binary hash) . -g . o --passin=OSSL_PEM_FILE_PASSWORD OpenSSL (OSSL). -passin OSSL pass file env fd plain openssl . ( man(1) openssl ). o -e, --rsa_exponent_zero: RSA TPM . (References) (Context Object Format) (handle) : o (transient) TPM . o : o owner: (owner hierarchy) o platform: (platform hierarchy) o endorsement: (endorsement hierarchy) o lockout: (lockout control persistent object) o ( 0x81010013) . (Authorization Formatting) TPM 2.0 : 1. (Password) 2. HMAC 3. (Sessions) : " (EMPTY PASSWORD) ". (auth values) HMAC . . . HMAC ( tpm2_startauthsession(1) ). (Passwords) . : . (String) "str:" ( ) . (Examples) foobar str:foobar (Hex-string) "hex:" . (Example) hex:1122334455667788 (File) "file:" "-" (stdin) . . (Examples) # file:- # file:path/to/password/file # stdin echo: echo foobar | tpm2_tool -p file:- # here-string stdin: tpm2_tool -p file:- <<< foobar (Sessions) session . tpm2_startauthsession(1) . ( ) + (Passwords) . (Examples) session.ctx: session:session.ctx session.ctx mypassword: session:session.ctx+mypassword session.ctx 0x11223344: session:session.ctx+hex:11223344 PCR (PCR Authorizations) "pcr:" (minilanguage) PCR PCR . PCR : = PCR " PCR (PCR bank specifiers)" . raw-pcr-file PCR tpm2_pcrread(1) . PCR. (Examples) PCR sha256 : pcr:sha256:0,1,2,3 AUTH. (Algorithm Specifiers) " (nice-names)" . : . TPM . (Simple specifiers) . . " " . (Asymmetric) o rsa o ecc (Symmetric) o aes o camellia o sm4 (Hashing Algorithms) o sha1 o sha256 o sha384 o sha512 o sm3_256 o sha3_256 o sha3_384 o sha3_512 (Keyed Hash) o hmac o xor (Signing Schemes) o rsassa o rsapss o ecdsa o ecdaa o ecschnorr o sm2 (Asymmetric Encryption Schemes) o oaep o rsaes o ecdh (Modes) o ctr o ofb o cbc o cfb o ecb (Misc) o null (Complex Specifiers) TPM (type) (scheme) . : :: (Type Specifiers) . . o aes - AES: aes128 o aes128 - AES (ctr|ofb|cbc|cfb|ecb). null . o aes192 - aes128 . o aes256 - aes128 . o sm4 - SM4: sm4128 o sm4128 sm4_128 - SM4 (ctr|ofb|cbc|cfb|ecb). null . o ecc - (Elliptical Curve) ecc256 . o ecc192 ecc_nist_p192 - ECC NIST o ecc224 ecc_nist_p224 - ECC NIST o ecc256 ecc_nist_p256 - ECC NIST o ecc384 ecc_nist_p384 - ECC NIST o ecc521 ecc_nist_p521 - ECC NIST o ecc_sm2 ecc_sm2_p256 - SM2 o rsa - RSA: rsa2048 o rsa1024 - RSA . o rsa2048 - RSA . o rsa3072 - RSA . o rsa4096 - RSA . (Scheme Specifiers) . (Signing Schemes) (Asymmetric Encryption Schemes) . . sha256 . . (Hash Optional Scheme Specifiers) : oaep-sha256. o oaep o ecdh o rsassa o rsapss o ecdsa o ecschnorr o sm2 (Multiple Option Scheme Specifiers) ( UINT16) (-) . * ecdaa : ecdaa4-sha256. . (No Option Scheme Specifiers) . * rsaes (Symmetric Details Specifiers) (type) . (Symmetric) (Type Specifiers) . aes128cfb . (Examples) rsa2048 rsaes tpm2_create -C parent.ctx -G rsa2048:rsaes -u key.pub -r key.priv ecc256 ecdaa sha384 /tpm2_create -C parent.ctx -G ecc256:ecdaa4-sha384 -u key.pub -r key.priv ALGORITHM. (Object Attributes) (Object Attributes) . (raw bitfield mask) " (nice-names)" . TPM 2.0 : TPMA_OBJECT_ . TPMA_OBJECT_FIXEDTPM fixedtpm . (bitwise or) "|" . TPMA_OBJECT_FIXEDTPM TPMA_OBJECT_NODA TPMA_OBJECT_SIGN_ENCRYPT : fixedtpm|noda|sign ATTRIBUTES. (COMMON OPTIONS) . o -h, --help=[man|no-man]: . (manpager) . "man" "man" man (stderr) . "no-man" man (stdout) . manpages MANPATH man(1) . o -v, --version: TCTI . o -V, --verbose: . . o -Q, --quiet: (stdout). o -Z, --enable-errata: (errata fixups). TPM . TPM2TOOLS_ENABLE_ERRATA . o -z, --pwd-session: HMAC . TPM . (unsalted) OpenSSL FIPS . (auth values) . o -R, --autoflush: (autoflush) . . TPM2TOOLS_AUTOFLUSH yes true . . TCTI (TCTI Configuration) TCTI ( "Transmission Interface") TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM . TPM (off-tpm) TCTI . TCTI . "none" . : : . TCTI (TCTI Defaults) TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI (Custom TCTIs) TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI (device) TPM TCTI . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI mssim IP (port) . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - `,' . `=' . o TCTI abrmd : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system' . tcti tabrmd bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . TCTI . (NOTES) o null null NULL . o null TPM . (EXAMPLES) TPM owner tpm2_createprimary -c primary.ctx tpm2_create -C primary.ctx -u pub.dat -r priv.dat tpm2_loadexternal -C o -u pub.dat -c pub.ctx name: 000b9be4d7c6193a57e1bfc86a42a6b03856a91d2f9e77c6cbdb796a783d52d4b3b9 RSA owner openssl genrsa -out private.pem 2048 openssl rsa -in private.pem -out public.pem -outform PEM -pubout tpm2_loadexternal -C o -Grsa -u public.pem -c key.ctx name: 000b7b91d304d16995d42792b57d0fb25df7abe5fdd8afe9950730e00dc5b934ddbc RSA null openssl genrsa -out private.pem 2048 tpm2_loadexternal -C n -Grsa -r private.pem -c key.ctx name: 000b635ea220b6c62ec1d02343859dd203c8ac5dad82ebc5b124e407d2502f88691f AES null dd if=/dev/urandom of=sym.key bs=1 count=16 tpm2_loadexternal -C n -Gaes -r sym.key -c key.ctx name: 000bfc4d8dd7e4f921bcc9dca4b04f49564243cd9def129a3740002bfd4b9e966d34 TSS2 null tpm2_loadexternal -r tss_privkey.pem -c tss_privkey.ctx name: 000bc5a216702aca9ba226af1214c50dc4dc33ce6269677aa581ea6d9eec7f27000d (Returns) : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - . tpm2_testparams. (BUGS) (Github Issues) (HELP) (Mailing List) (LICENSE) . (CC BY 4.0) . tpm2-tools tpm2_loadexternal(1)