diff options
| author | Lennart Poettering <lennart@poettering.net> | 2023-10-11 10:47:01 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-11 10:47:01 +0200 |
| commit | 98d8c3759598eec437d27779238164887b628294 (patch) | |
| tree | e62c9f72008544c6ab5b7213fda01ecaa2a8bb5b /man | |
| parent | sd-gpt: add defines for big-endian MIPS/MIPS64 (diff) | |
| parent | tpm2: don't use GetCapability() to check transient handles (diff) | |
| download | systemd-98d8c3759598eec437d27779238164887b628294.tar.xz systemd-98d8c3759598eec437d27779238164887b628294.zip | |
Merge pull request #29427 from ddstreet/cryptenroll_specify_handle_index
Cryptenroll specify handle index
Diffstat (limited to 'man')
| -rw-r--r-- | man/systemd-cryptenroll.xml | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml index cd01791acf..836538be4c 100644 --- a/man/systemd-cryptenroll.xml +++ b/man/systemd-cryptenroll.xml @@ -412,6 +412,28 @@ </varlistentry> <varlistentry> + <term><option>--tpm2-seal-key-handle=</option><replaceable>HANDLE</replaceable></term> + + <listitem><para>Configures which parent key to use for sealing, using the TPM handle (index) of the + key. This is used to "seal" (encrypt) a secret and must be used later to "unseal" (decrypt) the + secret. Expects a hexadecimal 32bit integer, optionally prefixed with + <literal>0x</literal>. Allowable values are any handle index in the persistent + (<literal>0x81000000</literal>-<literal>0x81ffffff</literal>) or transient + (<literal>0x80000000</literal>-<literal>0x80ffffff</literal>) ranges. Since transient handles are + lost after a TPM reset, and may be flushed during TPM context switching, they should not be used + except for very specific use cases, e.g. testing.</para> + + <para>The default is the Storage Root Key (SRK) handle index <literal>0x81000001</literal>. A value + of 0 will use the default. For the SRK handle, a new key will be created and stored in the TPM if one + does not already exist; for any other handle, the key must already exist in the TPM at the specified + handle index.</para> + + <para>This should not be changed unless you know what you are doing.</para> + + <xi:include href="version-info.xml" xpointer="v255"/></listitem> + </varlistentry> + + <varlistentry> <term><option>--tpm2-pcrs=</option><arg rep="repeat">PCR</arg></term> <listitem><para>Configures the TPM2 PCRs (Platform Configuration Registers) to bind to when |