NAME¶

tpm2_activatecredential - Verify that the given content is protected with given keyHandle for given handle, and then decrypt and return the secret, if any passwd option is missing, assume NULL. Currently only support using TCG profile compliant EK as the keyHandle.

SYNOPSIS¶

tpm2_activatecredential[ COMMON OPTIONS ] [ TCTI OPTIONS ] [ --handle|--context|--keyHandle|--keyContext|--Password|--endorsePasswd|--inFile|--outFile|--passwdInHex| ]

Verify that the given content is protected with given keyHandle for given handle, and then decrypt and return the secret, if any passwd option is missing, assume NULL. Currently only support using TCG profile compliant EK as the keyHandle.

DESCRIPTION¶

tpm2_activatecredential Verify that the given content is protected with given keyHandle for given handle, and then decrypt and return the secret, if any passwd option is missing, assume NULL. Currently only support using TCG profile compliant EK as the keyHandle.

OPTIONS¶

-H ,--handle

Handle of the object associated with the created certificate by CA

-c ,--context

filename for handle context

-k ,--keyHandle

Loaded key used to decrypt the the random seed

-C ,--keyContext

filename for keyHandle context

-P ,--Password

the handle's password, optional

-e ,--endorsePasswd

the endorsement password, optional

-f ,--inFile

Input file path, containing the two structures needed by tpm2_activatecredential function

-o ,--outFile

Output file path, record the secret to decrypt the certificate

-X ,--passwdInHex

passwords given by any options are hex format.

[COMMON OPTIONS ]

This collection of options are common to many programs and provide information that many users may expect.

-h, --help

Display a manual describing the tool and its usage.

-v, --version

Display version information for this tool.

-V, --verbose

Increase the information that the tool prints to the console during its execution.

[TCTI OPTIONS ]

This collection of options are used to configure the varous TCTI modules available.

-T, --tcti

Select the TCTI used for communication with the next component down the TSS stack. In most configurations this will be the TPM but it could be a simulator or proxy. Supported TCTIs are or “device” or “socket” .

-d, --device-file

Specify the TPM device file for use by the device TCTI. The default is /dev/tpm0.

-R, --socket-address

Specify the domain name or IP address used by the socket TCTI. The default is 127.0.0.1.

-p, --socket-port

Specify the port number used by the socket TCTI. The default is 2321.

ENVIRONMENT: TCTI

This collection of environment variables that may be used to configure the varous TCTI modules available. The values passed through these variables can be overridden on a per-command basis using the available command line options.

TPM2TOOLS_TCTI_NAME

Select the TCTI used for communication with the next component down the TSS stack. In most configurations this will be the TPM but it could be a simulator or proxy. See 'OPTIONS' section for the names of supported TCTIs.

TPM2TOOLS_DEVICE_FILE

Specify the TPM device file for use by the device TCTI.

TPM2TOOLS_SOCKET_ADDRESS

Specify the domain name or IP address used by the socket TCTI.

TPM2TOOLS_SOCKET_PORT

Specify the port number used by the socket TCTI.

EXAMPLES¶

tpm2_activatecredential

tpm2_activatecredential -H 0x81010002 -k 0x81010001 -P abc123 -e abc123 -f <filePath> -o <filePath>
tpm2_activatecredential -c ak.context -C ek.context -P abc123 -e abc123 -f <filePath> -o <filePath>
tpm2_activatecredential -H 0x81010002 -k 0x81010001 -P 123abc -e 1a1b1c -X -f <filePath> -o <filePath>