LearnLinux › cmds › commands

tpm2-tools

Command-line utilities for interacting with a TPM 2.0 (Trusted Platform Module).

Category: Security TPM 2.0 crypto hardware measured-boot

Install

# RHEL / Alma / Rocky
sudo dnf install tpm2-tools

# Debian / Ubuntu
sudo apt install tpm2-tools

# openSUSE
sudo zypper install tpm2-tools

# Arch
sudo pacman -S tpm2-tools

What it is

tpm2-tools is a suite of commands for managing TPM 2.0 devices. It supports key generation, encryption, sealing/unsealing data, PCR (Platform Configuration Register) operations, and attestation workflows.

How it works (mechanical)

  • Communicates with TPM via kernel driver (/dev/tpm0 or resource manager).
  • Uses TPM2 Software Stack (TSS) libraries.
  • Keys can be created inside TPM and never leave hardware.
  • Supports PCR binding for measured boot scenarios.
  • Operations often require proper TPM ownership/configuration.

Quick Start

# Check TPM presence
tpm2_getcap properties-fixed

# List supported algorithms
tpm2_getcap algorithms

10 Practical Examples

# 1) Get TPM capabilities
tpm2_getcap properties-fixed
# 2) Read PCR values
tpm2_pcrread
# 3) Create primary key
tpm2_createprimary -C o -g sha256 -G rsa -c primary.ctx
# 4) Create key pair
tpm2_create -C primary.ctx -G rsa -u key.pub -r key.priv
# 5) Load key into TPM
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
# 6) Encrypt data
tpm2_rsaencrypt -c key.ctx -o secret.enc secret.txt
# 7) Decrypt data
tpm2_rsadecrypt -c key.ctx -o decrypted.txt secret.enc
# 8) Seal data to PCR state
tpm2_create -C primary.ctx -L pcr:sha256:0 -i secret.txt -u seal.pub -r seal.priv
# 9) Unseal data
tpm2_unseal -c seal.ctx
# 10) Clear TPM (requires ownership auth)
tpm2_clear

Notes & Gotchas

  • Requires TPM 2.0 hardware or emulator.
  • Some systems use tpm2-abrmd or resource manager daemon.
  • Clearing TPM can erase keys permanently.
  • Used in secure boot, disk encryption (LUKS), and attestation.
  • TPM policies can restrict key usage conditions.

Historical Context

TPM 2.0 expanded on TPM 1.2 with improved cryptographic flexibility. tpm2-tools became the standard Linux interface for interacting with modern TPM hardware.

Modern Equivalent

Many enterprise systems use TPM for measured boot and disk encryption. Cloud providers and secure enclaves rely on similar hardware-root-of-trust models.

Related Commands

  • openssl — general cryptography toolkit.
  • clevis — TPM-bound disk unlocking.
  • cryptsetup — LUKS disk encryption.
  • fwupd — firmware updates.
  • setcap — Linux capabilities.