Provided by: tpm2-tools_2.1.0-1build1_amd64 
NAME
tpm2_getpubak - Generate attestation key with given algorithm under endorsement hierarchy, make it
persistent with given ak handle, and return pub AK and AK name, if any passwd option is missing, assume
NULL, default type/alg is 0x1(RSA), default digestAlg is 0xb(SHA256), default signAlg is 0x14(RSASSA) for
RSA, 0x18(ECDSA) for ECC
SYNOPSIS
tpm2_getpubak[ COMMON OPTIONS ] [ TCTI OPTIONS ] [
--endorsePasswd|--akPasswd|--ownerPasswd|--ekHandle|--akHandle|--alg|--digestAlg|--signAlg|--file|--akName|--passwdInHex|
]
Generate attestation key with given algorithm under endorsement hierarchy, make it persistent with given
ak handle, and return pub AK and AK name, if any passwd option is missing, assume NULL, default type/alg
is 0x1(RSA), default digestAlg is 0xb(SHA256), default signAlg is 0x14(RSASSA) for RSA, 0x18(ECDSA) for
ECC
DESCRIPTION
tpm2_getpubak Generate attestation key with given algorithm under endorsement hierarchy, make it
persistent with given ak handle, and return pub AK and AK name, if any passwd option is missing, assume
NULL, default type/alg is 0x1(RSA), default digestAlg is 0xb(SHA256), default signAlg is 0x14(RSASSA) for
RSA, 0x18(ECDSA) for ECC
OPTIONS
-e ,--endorsePasswd
specifies current endorsement password (string,optional,default:NULL).
-P ,--akPasswd
specifies the AK password when created (string,optional,default:NULL).
-o ,--ownerPasswd
specifies current owner password (string,optional,default:NULL).
-E ,--ekHandle
specifies the handle of EK (hex).
-k ,--akHandle
specifies the handle used to make AK persistent (hex).
-g ,--alg
specifies the algorithm type of AK (default:0x01/TPM_ALG_RSA): TPM_ALG_RSA 0x0001
TPM_ALG_KEYEDHASH 0x0008 TPM_ALG_ECC 0x0023
-D ,--digestAlg
specifies the algorithm of digest. 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C
TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256
-s ,--signAlg
specifies the algorithm of sign. 0x0005 TPM_ALG_HMAC 0x0014 TPM_ALG_RSASSA 0x0016
TPM_ALG_RSAPSS 0x0018 TPM_ALG_ECDSA 0x001A TPM_ALG_ECDAA 0x001B TPM_ALG_SM2 0x001C
TPM_ALG_ECSCHNORR
-f ,--file
specifies the file used to save the public portion of AK.
-n ,--akName
specifies the file used to save the ak name.
-X ,--passwdInHex
passwords given by any options are hex format.
[COMMON OPTIONS ]
This collection of options are common to many programs and provide information that many users may
expect.
-h, --help
Display a manual describing the tool and its usage.
-v, --version
Display version information for this tool.
-V, --verbose
Increase the information that the tool prints to the console during its execution.
[TCTI OPTIONS ]
This collection of options are used to configure the varous TCTI modules available.
-T, --tcti
Select the TCTI used for communication with the next component down the TSS stack. In most
configurations this will be the TPM but it could be a simulator or proxy. Supported TCTIs are or
“device” or “socket” .
-d, --device-file
Specify the TPM device file for use by the device TCTI. The default is /dev/tpm0.
-R, --socket-address
Specify the domain name or IP address used by the socket TCTI. The default is 127.0.0.1.
-p, --socket-port
Specify the port number used by the socket TCTI. The default is 2321.
ENVIRONMENT: TCTI
This collection of environment variables that may be used to configure the varous TCTI modules
available. The values passed through these variables can be overridden on a per-command basis
using the available command line options.
TPM2TOOLS_TCTI_NAME
Select the TCTI used for communication with the next component down the TSS stack. In most
configurations this will be the TPM but it could be a simulator or proxy. See 'OPTIONS' section
for the names of supported TCTIs.
TPM2TOOLS_DEVICE_FILE
Specify the TPM device file for use by the device TCTI.
TPM2TOOLS_SOCKET_ADDRESS
Specify the domain name or IP address used by the socket TCTI.
TPM2TOOLS_SOCKET_PORT
Specify the port number used by the socket TCTI.
EXAMPLES
tpm2_getpubak
tpm2_getpubak -e abc123 -P abc123 -o passwd -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name
tpm2_getpubak -e 1a1b1c -P 123abc -o 1a1b1c -X -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name