---
name: "simple-tpm-pk11"
section: "7"
platform: "linux"
package: "simple-tpm-pk11"
version: "0.06-5+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/simple-tpm-pk11"
---

# simple-tpm-pk11(7)

Simple PKCS11 provider for TPM chips

## NAME

simple-tpm-pk11 - Simple PKCS11 provider for TPM chips

## DESCRIPTION

*simple-tpm-pk11* Is a PKCS11 provider for TPM chips. Its primary purpose is to protect SSH client keys so that they can’t be copied or stolen if the machine they’re on gets compromised.

## OPTIONS

Since PKCS11 modules are .so files loaded by other binaries, they don’t take command line options. Instead *simple-tpm-pk11* options can be set up environment variables.

- **SIMPLE\_TPM\_PK11\_DEBUG**

  If set, enables debug level logging.

- **SIMPLE\_TPM\_PK11\_CONFIG**=/path/to/config

  Override default config location. Default is ~/.simple-tpm-pk11/config.

- **SIMPLE\_TPM\_PK11\_LOG\_STDERR**

  If set, copies all log output to STDERR.

## CONFIGURATION FILE

Configuration options are of the key/value variety, with comments lines starting with "#".

- key *key file*

  Full path to key file, or relative to ~/.simple-tpm-pk11. This the only required configuration option.

- debug

  Enable debug level logging.

- srk\_pin *PIN*

  Set SRK PIN. Default is the Well Known Secret (20 nulls).

- key\_pin *PIN*

  Set key PIN.

- log *log file*

  Full path to log file, or relative to ~/.simple-tpm-pk11.

## EXAMPLES

```

# Load key from ~/.simple-tpm-pk11/my.key.
key my.key
```

\# Load key from /keys/foo/my.key, and the empty string as SRK PIN. key /keys/foo/my.key srk\_pin

## TPM-TROUBLESHOOTING

TODO.

## DIAGNOSTICS

Most errors will probably be related to interacting with the TPM chip. Resetting the TPM chip and taking ownership should take care of most of them. See the *TPM-TROUBLESHOOTING* section.

## BUGS

The password is read from stdin without turning off echo. It should be read from the terminal without echo.

## SEE ALSO

**[stpm-keygen(1)](/stpm-keygen/1.md)**, **[stpm-sign(1)](/stpm-sign/1.md)**

## AUTHOR

Simple-TPM-PK11 was written By Thomas Habets \<habets@google.com\> / \<thomas@habets.se\>.

git clone https://github.com/ThomasHabets/simple-tpm-pk11.git