AutoGen Definitions options;

prog-name     = tpmtool;

prog-title    = "GnuTLS TPM tool";

prog-desc     = "Program to handle TPM as a cryptographic device.\n";

detail    = "Program that allows handling cryptographic data from the TPM chip.";

short-usage   = "tpmtool [options]\ntpmtool --help for usage instructions.\n";

explain       = "";

#define  OUTFILE_OPT   1

#define  INFILE_OPT   1

#include args-std.def

flag = {

    name      = generate-rsa;

    descrip   = "Generate an RSA private-public key pair";

    doc = "Generates an RSA private-public key pair in the TPM chip. 

The key may be stored in file system and protected by a PIN, or stored (registered)

in the TPM chip flash.";

};

flag = {

    name      = register;

    descrip   = "Any generated key will be registered in the TPM";

    flags_must = generate-rsa;

    doc = "";

};

flag = {

    name      = signing;

    descrip   = "Any generated key will be a signing key";

    flags_must = generate-rsa;

    flags_cant = legacy;

    doc = "";

};

flag = {

    name      = legacy;

    descrip   = "Any generated key will be a legacy key";

    flags_must = generate-rsa;

    flags_cant = signing;

    doc = "";

};

flag = {

    name      = user;

    descrip   = "Any registered key will be a user key";

    flags_must = register;

    flags_cant = system;

    doc = "The generated key will be stored in a user specific persistent storage.";

};

flag = {

    name      = system;

    descrip   = "Any registered key will be a system key";

    flags_must = register;

    flags_cant = user;

    doc = "The generated key will be stored in system persistent storage.";

};

flag = {

    name      = pubkey;

    arg-type  = string;

    arg-name  = "url";

    descrip   = "Prints the public key of the provided key";

    doc = "";

};

flag = {

    name      = list;

    descrip   = "Lists all stored keys in the TPM";

    doc = "";

};

flag = {

    name      = delete;

    arg-type  = string;

    arg-name  = "url";

    descrip   = "Delete the key identified by the given URL (UUID).";

    doc      = "";

};

flag = {

    name      = test-sign;

    arg-type  = string;

    arg-name  = "url";

    descrip   = "Tests the signature operation of the provided object";

    doc = "It can be used to test the correct operation of the signature operation.

This operation will sign and verify the signed data.";

};

flag = {

    name      = sec-param;

    arg-type  = string;

    arg-name  = "Security parameter";

    descrip   = "Specify the security level [low, legacy, medium, high, ultra].";

    doc      = "This is alternative to the bits option. Note however that the

values allowed by the TPM chip are quantized and given values may be rounded up.";

};

flag = {

    name      = bits;

    arg-type  = number;

    descrip   = "Specify the number of bits for key generate";

    doc      = "";

};

flag = {

    name      = inder;

    descrip   = "Use the DER format for keys.";

    disabled;

    disable   = "no";

    doc       = "The input files will be assumed to be in the portable

DER format of TPM. The default format is a custom format used by various

TPM tools";

};

flag = {

    name      = outder;

    descrip   = "Use DER format for output keys";

    disabled;

    disable   = "no";

    doc       = "The output will be in the TPM portable DER format.";

};

flag = {

    name      = srk-well-known;

    descrip   = "SRK has well known password (20 bytes of zeros)";

};

doc-section = {

  ds-type = 'SEE ALSO';

  ds-format = 'texi';

  ds-text   = <<-_EOT_

    p11tool (1), certtool (1)

_EOT_;

};

doc-section = {

  ds-type = 'EXAMPLES';

  ds-format = 'texi';

  ds-text   = <<-_EOT_

To generate a key that is to be stored in file system use:

@example

$ tpmtool --generate-rsa --bits 2048 --outfile tpmkey.pem

@end example

To generate a key that is to be stored in TPM's flash use:

@example

$ tpmtool --generate-rsa --bits 2048 --register --user

@end example

To get the public key of a TPM key use:

@example

$ tpmtool --pubkey tpmkey:uuid=58ad734b-bde6-45c7-89d8-756a55ad1891;storage=user \

          --outfile pubkey.pem

@end example

or if the key is stored in the file system:

@example

$ tpmtool --pubkey tpmkey:file=tmpkey.pem --outfile pubkey.pem

@end example

To list all keys stored in TPM use:

@example

$ tpmtool --list

@end example

_EOT_;

};