Section 8: administration and privileged commands
TPM Management – tpm_revokeek Name tpm_revokeek – revokes the Endorsement Key Pair of the TPM Synopsis tpm_revokeek [OPTION] Description tpm_revokeek clears the TPM revocable Endorsement Key Pair (via the TPM_RevokeEndorsementKey API). This command erases all counters (except the base one), erases the Ek, the SRK, the owner auth and any NVRAM locked to the owner…
TPM Management – tpm_restrictpubek Name tpm_restrictpubek – restrict the ability to display the public portion of the Endorsement Key to the owner Synopsis tpm_restrictpubek [OPTION] Description tpm_restrictpubek reports the status of who can display the public portion of the Endorsement Key. This is the default behavior and also available with the –status option. This operation…
TPM Management – tpm_resetdalock Name tpm_resetdalock – reset the dictionary attack lock for the user (require owner authentication) Synopsis tpm_resetdalock Description tpm_resetdalock resets the dictionary attack lock. It prompts for owner authentication and, if password is correct, calls ‘tpmSetStatus’ which does necessary action to reset dictionary attack lock. -h, –help Display command usage info. -v,…
TPM Quote Tools Programs tpm_mkuuid, tpm_mkaik, tpm_loadkey, tpm_unloadkey, tpm_getpcrhash, tpm_updatepcrhash, tpm_getquote, tpm_verifyquote Description TPM Quote Tools is a collection of programs that provide support for TPM based attestation using the TPM quote operation. A TPM contains a set of Platform Configuration Registers (PCRs). In a well configured machine, some of these registers are set to…
tpm_nvwrite Synopsis tpm_nvwrite [OPTIONS] Description tpm_nvwrite writes data to an NVRAM area. The user must provide the index of the NVRAM area as well as the data to write into the NVRAM area. Optionally an offset into the NVRAM area can be given where the writing of the data is to start. Similarly the use…
tpm_nvrelease Synopsis tpm_nvrelease [OPTIONS] Description tpm_nvrelease releases an NVRAM area. The user must provide the index of the NVRAM area. If owner authentication is required then the user must provide the owner password. Note that some areas cannot be released since they are permanent. Others can be release only after a reboot of the system….
tpm_nvread Synopsis tpm_nvread [OPTIONS] Description tpm_nvread reads data from an NVRAM area and either displays them or writes them into a file. The user must provide the index of the NVRAM area. If the user provided the number of bytes to read then this will be the maximum number of bytes that will be read…
tpm_nvinfo Synopsis tpm_nvinfo [OPTIONS] Description tpm_nvinfo displays information about defined NVRAM areas. The user may restrict it to display only a single NVRAM area by providing an index or may choose ton only list available NVRAM areas indices without displaying the NVRAM areas’ detailed information. The following options are supported: -h, –help Display command usage…
tpm_nvdefine Synopsis tpm_nvdefine [OPTIONS] Description tpm_nvdefine defines a new NVRAM area at the given index and of given size. The user has to provide the permissions that control access to the NVRAM area. Owner authentication is necessary once the NVRAM area 0xFFFFFFFF has been defined. The owner password may be provided on the command line…
tpm_mkuuid Synopsis tpm_uuid [-hv] UUID-FILE Description The program generates a TPM UUID and stores it in the file UUID-FILE. -h Display command usage info. -v Display command version info. See Also tpm_quote_tools(8)
tpm_mkaik Synopsis tpm_mkaik [-zuhv] BLOB-FILE PUBKEY-FILE Description The program generates a TPM Attestation Identity Key and stores it in the file BLOB-FILE. The public key is stored in the file PUBKEY-FILE. The public key is DER encoded. -z Use the well known secret used as the owner secret. -u Use TSS UNICODE encoding for passwords….
tpm_loadkey Synopsis tpm_loadkey [-r HOST] [-hv] BLOB-FILE UUID-FILE Description The program loads the key in BLOB-FILE into persistent storage and registers it using the UUID in UUID-FILE. -r HOST Perform operation on remote HOST. -h Display command usage info. -v Display command version info. See Also tpm_quote_tools(8), tpm_mkuuid(8), tpm_mkaik(8), tpm_unloadkey(8)
tpm_getquote Synopsis tpm_getquote [-r HOST] [-p PCR-VALUES-FILE] [-hv] UUID-FILE NONCE-FILE QUOTE-FILE PCRS Description The program returns the signature produced by a TPM quote in the file QUOTE-FILE. PCRS is a sequence of integers that specify the Platform Configuration Registers used to produce the signature. The key used for the operation is the one registered under…
TPM Management – tpm_getpubek Name tpm_getpubek – display the public portion of the TPM’s Endorsement Key Synopsis tpm_getpubek [OPTION] Description tpm_getpubek requests the TPM’s public portion of the Endorsement Key (via the TPM_ReadPubek API). This operation can be restricted to require owner authorization, in that case the command will prompt for the owner password and…
tpm_getpcrhash Synopsis tpm_getpcrhash [-r HOST] [-hv] UUID-FILE HASH-FILE PCR-VALUE-FILE PCRS Description The program returns the signed data produced by a TPM quote in the file HASH-FILE and the list of Platform Configuration Register values in the file PCR-VALUE-FILE. PCRS is a sequence of integers that specify the Platform Configuration Registers used to produce the signed…
TPM Management – tpm_createek Name tpm_createek – create an Endorsement Key Pair on the TPM Synopsis tpm_createek [OPTION] Description tpm_createek creates and Endorsement Key Pair on the TPM (via the TPM_CreateEndorsementKeyPair API). This should rarely be required as the Endorsement Key is normally installed as part of manufacturing. However, you might need to run this…
TPM Management – tpm_clear Name tpm_clear – return the TPM to the default state (unowned, disabled, inactive) Synopsis tpm_clear [OPTION] Description tpm_clear requests that the system’s TPM perform a clear (via the TPM_OwnerClear API) wiping out all ownership information, in effect invalidaing all keys and data tied to the TPM, as well as disabling and…
TPM Management – tpm_changeownerauth Name tpm_changeownerauth – change the authorization data associated with the owner or SRK Synopsis tpm_changeownerauth [OPTION] Description tpm_changeownerauth allows for changing the authorization data for the TPM owner or the TPM’s Storage Root Key (via the TPM_ChangeAuthOwner API). This operation prompts for current password, followed by the new password and a…
tosh1800-smcinit – initialize the IrDA controler on Toshiba laptops Synopsis tosh1800-smcinit [OPTION] Description IrDA configurator for laptops with ALI1533 bridge (LPC47N227 SuperIO), smc-ircc and not initializing BIOS (tested on Toshiba Satellite 1800-514, Toshiba Satellite 5100 and Toshiba Tecra 9100) to be used with Linux kernel. Toshiba Satellite 1800 laptops are provided with a SMCS LPC47N227…
torsocks — Library for intercepting outgoing network connections and redirecting them through the Tor SOCKS proxy. Description Torsocks library overloads the libc symbols use for Internet communication such as connect(2) system call. Using that technique, the library sends everything through the Tor network including DNS resolution done by the application. For DNS, gethostbyname(3) family functions…