security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity

doc: add documentation for gpg's keytotpm command

Browse Source 
--
The tpm2d patches introduced a new --edit-key command: keytotpm.  Add
a descriptive entry explaining what it does and how it works.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
This commit is contained in:
James Bottomley 2021-03-12 07:59:17 -08:00 committed by Werner Koch
parent 5732e7a8e9
commit 4997838c7b
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/gpg.texi
View File

@ -1002,6 +1002,26 @@ signing.
select 2 to restore as encryption key. You will first be asked to enter select 2 to restore as encryption key. You will first be asked to enter
the passphrase of the backup key and then for the Admin PIN of the card. the passphrase of the backup key and then for the Admin PIN of the card.
@item keytotpm
@opindex keyedit:keytotpm
Transfer the selected secret subkey (or the primary key if no subkey
has been selected) to TPM form. The secret key in the keyring will
be replaced by the TPM representation of that key, which can only be
read by the particular TPM that created it (so the keyfile now
becomes locked to the laptop containing the TPM). Only certain key
types may be transferred to the TPM (all TPM 2.0 systems are
mandated to have the rsa2048 and nistp256 algorithms but newer TPMs
may have more). Note that the key itself is not transferred into the
TPM, merely encrypted by the TPM in-place, so if the keyfile is
deleted, the key will be lost. Once transferred to TPM
representation, the key file can never be converted back to non-TPM
form and the key will die when the TPM does, so you should first
have a backup on secure offline storage of the actual secret key
file before conversion. It is essential to use the physical system
TPM that you have rw permission on the TPM resource manager device
(/dev/tpmrm0). Usually this means you must be a member of the tss
group.
@item delkey @item delkey
@opindex keyedit:delkey @opindex keyedit:delkey
Remove a subkey (secondary key). Note that it is not possible to retract Remove a subkey (secondary key). Note that it is not possible to retract