1. Manuals
  2. Tumbleweed
  3. nvme-cli
  4. nvme-keys-gen-tls(1)

Scroll to navigation

NVME-KEYS-GEN-TLS(1) NVMe Manual NVME-KEYS-GEN-TLS(1)

NAME

nvme-keys-gen-tls - Generate a NVMe TLS PSK

SYNOPSIS

nvme [<global-options>] keys gen-tls [--keyring=<name> | -k <name>]


                        [--keytype=<type> | -t <type>]


                        [--hostnqn=<nqn> | -n <nqn>]


                        [--subsysnqn=<nqn> | -c <nqn>]


                        [--hmac=<hmac-id> | -m <hmac-id>]


                        [--identity=<id-vers> | -I <id-vers>]


                        [--secret=<secret> | -s <secret>]


                        [--insert | -i]


                        [--compat | -C]


                        [--keyfile=<keyfile> | -f <keyfile>]

DESCRIPTION

Generate a base64-encoded NVMe TLS pre-shared key (PSK). The resulting key is either printed in the PSK interchange format NVMeTLSkey-1:01:<base64 encoded data>: or inserted as a retained key into the specified keyring if the --insert option is given. When the PSK should be inserted into the keyring a retained key is derived from the secret key material using the HKDF-Expand-Label algorithm from RFC 8446. The resulting retained key is stored with the identity NVMe0R0<hmac> <host NQN> <subsystem NQN> (for identity version 0) or NVMe1R0<hmac> <host NQN> <subsystem NQN> <PSK hash> (for identity version 1) in the keyring. The retained key is derived from the secret key material, the specified subsystem NQN, and the host NQN. Once the retained key is stored in the keyring the original secret key material cannot be retrieved.

OPTIONS

-k <name>, --keyring=<name>

Name of the keyring into which the retained TLS key should be stored. Default is .nvme.

-t <type>, --keytype=<type>

Type of the key for resulting TLS key. Default is psk.

-n <nqn>, --hostnqn=<nqn>

Host NVMe Qualified Name (NQN) to be used to derive the retained TLS key

-c <nqn>, --subsysnqn=<nqn>

Subsystem NVMe Qualified Name (NQN) to be used to derive the retained TLS key

-m <hmac-id>, --hmac=<hmac-id>

Select a HMAC algorithm to use. Possible values are: 1 - SHA-256 (default) 2 - SHA-384

-I <vers>, --identity=<id-vers>

Select the TLS identity to use. Possible values are: 0 - Original NVMe TLS 1.0c identity 1 - NVMe TLS 2.0 (TP8018) identity

-s <secret>, --secret=<secret>

Secret value (in hexadecimal) to be used for the key. If none are provided a random value is used.

-i, --insert

Insert the resulting TLS key into the keyring without printing out the key in PSK interchange format.

-C, --compat

Use the original non-RFC 8446 compliant algorithm when deriving TLS keys for compatibility with older implementations.

-f <keyfile>, --keyfile=<keyfile>

Append the resulting TLS key to keyfile. This command line option depends on --insert.

GLOBAL OPTIONS

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run

Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

Disable probing for 64-bit IOCTL support.

--no-retries

Disable retry logic on transient errors.

-o <fmt>, --output-format=<fmt>

Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

Set the timeout for the command in milliseconds.

-v, --verbose

Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

EXAMPLES

No Examples

NVME

Part of the nvme-user suite

07/31/2026 NVMe