NAME

       stpm-keygen - Generate key pair for use with simple-tpm-pk11

SYNOPSIS

       stpm-keygen [ -hps ] -o output file

DESCRIPTION

       stpm-keygen  generates a 2048 RSA key inside the TPM chip, and saves the public key and the SRK-encrypted
       private key (the "blob") in the output file.

OPTIONS

       -h     Show usage info.

       -o output file
              Output file, where the public key and key blob will be written.

       -p     Create the key with a PIN / password. The password will be prompted for inteactively.

       -s     Ask for the SRK password interactively. By default the "Well Known Secret" (20 nulls) is used. The
              SRK password is an access token that must be presented for the TPM to perform any  operation  that
              involves the TPM, and an actual secret password is usually not required or useful.

       -S     Generate  key  in software instead of hardware.  The choice between generating the key in software
              and hardware is not an obvious one. It’s hard to verify the quality of keys generated in  hardware
              (e.g.  bugs  or  backdoors),  but  software  keys  have  existed in RAM at some point. And because
              software generated keys have to be generated as migratable keys, they can be extracted by  someone
              who knows the TPM owner password. The recommended choice is to generate in hardware, which is also
              the default.

EXAMPLES

       stpm-keygen -o ~/.simple-tpm-pk11/my.key

       stpm-keygen -p -o ~/.simple-tpm-pk11/my.key
       Enter key PIN: my secret password here

       stpm-keygen -sp -o ~/.simple-tpm-pk11/my.key
       Enter SRK PIN: 12345678
       Enter key PIN: my secret password here

DIAGNOSTICS

       Most errors will probably be related to interacting with the TPM chip.  Resetting the TPM chip and taking
       ownership should take care of most of them. See the TPM-TROUBLESHOOTING section of simple-tpm-pk11(7).

SEE ALSO

       simple-tpm-pk11(7), stpm-sign(1).

       http://blog.habets.se/2013/11/Should-I-generate-my-keys-in-software-or-hardware

AUTHOR

       Simple-TPM-PK11 was written By Thomas Habets <habets@google.com> / <thomas@habets.se>.

       git clone https://github.com/ThomasHabets/simple-tpm-pk11.git

simple-tpm-pk11                                1th December, 2013                                 stpm-keygen(1)