1. Manuals
  2. Tumbleweed
  3. nvme-cli
  4. nvme-keys-check-kxchap(1)

Scroll to navigation

NVME-KEYS-CHECK-K(1) NVMe Manual NVME-KEYS-CHECK-K(1)

NAME

nvme-keys-check-kxchap - Check a host KX-HMAC-CHAP key

SYNOPSIS

nvme [<global-options>] keys check-kxchap [--keydata=<key> | -d <key>]


                        [--keyring=<name> | -k <name>]


                        [--keytype=<type> | -t <type>]


                        [--identity=<identity> | -i <identity>]

DESCRIPTION

Checks if the key is a valid KX-HMAC-CHAP host key of the form: DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: and prints the resulting HMAC algorithm, key length, and CRC.

If --keydata is not given the key is read from stdin, which also allows checking a key stored in a file, e.g. nvme keys check-kxchap < keyfile.

If --identity is given the specified keyring is also checked for a key already stored under that identity (as inserted by linknvme-keys-import[1]); the result (not loaded, loaded and matching, or loaded but different) is reported. This command never modifies the keyring.

Looking up a key requires the kxchap keyring key type, which is not yet provided by any released Linux kernel; see linknvme-keys-import[1] for details.

OPTIONS

-d <key>, --keydata=<key>

Key to be checked. If not given, the key is read from stdin.

-k <name>, --keyring=<name>

Name of the keyring to check for an already loaded key. Default is .nvme.

-t <type>, --keytype=<type>

Type of the key to look up. Default is kxchap.

-i <identity>, --identity=<identity>

Identity to look up in the keyring to check if the key is already loaded. If not given, only the key format is validated.

GLOBAL OPTIONS

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run

Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

Disable probing for 64-bit IOCTL support.

--no-retries

Disable retry logic on transient errors.

-o <fmt>, --output-format=<fmt>

Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

Set the timeout for the command in milliseconds.

-v, --verbose

Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

EXAMPLES

No Examples

NVME

Part of the nvme-user suite

07/31/2026 NVMe