---
name: "tpm2-totp"
section: "3"
platform: "linux"
package: "tpm2-totp"
version: "0.3.0-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/tpm2-totp"
---

# tpm2-totp(3)

libtpm2-totp

## NAME

tpm2-totp - libtpm2-totp

## SYNOPSIS

### Functions

int **tpm2totp\_generateKey** (uint32\_t pcrs, uint32\_t banks, const char \*password, TSS2\_TCTI\_CONTEXT \*tcti\_context, uint8\_t \*\*secret, size\_t \*secret\_size, uint8\_t \*\*keyBlob, size\_t \*keyBlob\_size)\
 int **tpm2totp\_reseal** (const uint8\_t \*keyBlob, size\_t keyBlob\_size, const char \*password, uint32\_t pcrs, uint32\_t banks, TSS2\_TCTI\_CONTEXT \*tcti\_context, uint8\_t \*\*newBlob, size\_t \*newBlob\_size)\
 int **tpm2totp\_storeKey\_nv** (const uint8\_t \*keyBlob, size\_t keyBlob\_size, uint32\_t nv, TSS2\_TCTI\_CONTEXT \*tcti\_context)\
 int **tpm2totp\_loadKey\_nv** (uint32\_t nv, TSS2\_TCTI\_CONTEXT \*tcti\_context, uint8\_t \*\*keyBlob, size\_t \*keyBlob\_size)\
 int **tpm2totp\_deleteKey\_nv** (uint32\_t nv, TSS2\_TCTI\_CONTEXT \*tcti\_context)\
 int **tpm2totp\_calculate** (const uint8\_t \*keyBlob, size\_t keyBlob\_size, TSS2\_TCTI\_CONTEXT \*tcti\_context, time\_t \*nowp, uint64\_t \*otp)\
 int **tpm2totp\_getSecret** (const uint8\_t \*keyBlob, size\_t keyBlob\_size, const char \*password, TSS2\_TCTI\_CONTEXT \*tcti\_context, uint8\_t \*\*secret, size\_t \*secret\_size)\

## Detailed Description

Attest the trustworthiness of a device against a human using time-based one-time passwords.

## Function Documentation

### int tpm2totp\_calculate (const uint8\_t \* keyBlob, size\_t keyBlob\_size, TSS2\_TCTI\_CONTEXT \* tcti\_context, time\_t \* nowp, uint64\_t \* otp)

Calculate a time-based one-time password for a key.

**Parameters**

*keyBlob* Key to generate the TOTP. \
 *keyBlob\_size* Size of the key. \
 *tcti\_context* Optional TCTI context to select TPM to use. \
 *nowp* Current time. \
 *otp* Calculated TOTP.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_deleteKey\_nv (uint32\_t nv, TSS2\_TCTI\_CONTEXT \* tcti\_context)

Delete a key from a NV index.

**Parameters**

*nv* NV index to delete. \
 *tcti\_context* Optional TCTI context to select TPM to use.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_generateKey (uint32\_t pcrs, uint32\_t banks, const char \* password, TSS2\_TCTI\_CONTEXT \* tcti\_context, uint8\_t \*\* secret, size\_t \* secret\_size, uint8\_t \*\* keyBlob, size\_t \* keyBlob\_size)

Generate a key.

**Parameters**

*pcrs* PCRs the key should be sealed against. \
 *banks* PCR banks the key should be sealed against. \
 *password* Optional password to recover or reseal the secret. \
 *tcti\_context* Optional TCTI context to select TPM to use. \
 *secret* Generated secret. \
 *secret\_size* Size of the secret. \
 *keyBlob* Generated key. \
 *keyBlob\_size* Size of the generated key.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_getSecret (const uint8\_t \* keyBlob, size\_t keyBlob\_size, const char \* password, TSS2\_TCTI\_CONTEXT \* tcti\_context, uint8\_t \*\* secret, size\_t \* secret\_size)

Recover a secret from a key.

**Parameters**

*keyBlob* Key to recover the secret from. \
 *keyBlob\_size* Size of the key. \
 *password* Password of the key. \
 *tcti\_context* Optional TCTI context to select TPM to use. \
 *secret* Recovered secret. \
 *secret\_size* Size of the secret.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *-10* on empty password. \
 *-20* when no password-protected recovery copy of the secret has been stored. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_loadKey\_nv (uint32\_t nv, TSS2\_TCTI\_CONTEXT \* tcti\_context, uint8\_t \*\* keyBlob, size\_t \* keyBlob\_size)

Load a key from a NV index.

**Parameters**

*nv* NV index of the key. \
 *tcti\_context* Optional TCTI context to select TPM to use. \
 *keyBlob* Loaded key. \
 *keyBlob\_size* Size of the key.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_reseal (const uint8\_t \* keyBlob, size\_t keyBlob\_size, const char \* password, uint32\_t pcrs, uint32\_t banks, TSS2\_TCTI\_CONTEXT \* tcti\_context, uint8\_t \*\* newBlob, size\_t \* newBlob\_size)

Reseal a key to new PCR values.

**Parameters**

*keyBlob* Original key. \
 *keyBlob\_size* Size of the key. \
 *password* Password of the key. \
 *pcrs* PCRs the key should be sealed against. \
 *banks* PCR banks the key should be sealed against. \
 *tcti\_context* Optional TCTI context to select TPM to use. \
 *newBlob* New key. \
 *newBlob\_size* Size of the new key.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *-10* on empty password. \
 *-20* when no password-protected recovery copy of the secret has been stored. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

### int tpm2totp\_storeKey\_nv (const uint8\_t \* keyBlob, size\_t keyBlob\_size, uint32\_t nv, TSS2\_TCTI\_CONTEXT \* tcti\_context)

Store a key in a NV index.

**Parameters**

*keyBlob* Key to store to NVRAM. \
 *keyBlob\_size* Size of the key. \
 *nv* NV index to store the key. \
 *tcti\_context* Optional TCTI context to select TPM to use.

**Return values**

*0* on success. \
 *-1* on undefined/general failure. \
 *TSS2\_RC* response code for failures relayed from the TSS library.

## Author

Generated automatically by Doxygen for tpm2-totp from the source code.