.\" Copyright 2024 IBM Corp.
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\"

.TH "PVSECRET-CREATE-RETRIEVABLE" "1" "2024-12-19" "s390-tools" "UV-Secret Manual"
.nh
.ad l
.SH NAME
pvsecret-create-retrievable \- Create a retrievable secret
.SH SYNOPSIS
.nf
.fam C
pvsecret create retrievable [OPTIONS] --secret <SECRET-FILE> --type <TYPE> <NAME>
pvsecret create retr [OPTIONS] --secret <SECRET-FILE> --type <TYPE> <NAME>
.fam C
.fi
.SH DESCRIPTION
A retrievable secret is stored in the per\-guest storage of the Ultravisor. A
SE\-guest can retrieve the secret at runtime and use it. All retrievable
secrets, but the plaintext secret, are retrieved as wrapped/protected key
objects and only usable inside the current, running SE\-guest instance.
.SH OPTIONS
.PP
<NAME>
.RS 4
String that identifies the new secret. The actual secret is set with
\fB\-\-secret\fR. The name is saved in `NAME.yaml` with white\-spaces mapped to
`_`.
.RE
.RE

.PP
\-\-stdout
.RS 4
Print the hashed name to stdout. The hashed name is not written to `NAME.yaml`
.RE
.RE
.PP
\-\-secret <SECRET-FILE>
.RS 4
Use SECRET\-FILE as retrievable secret.
.RE
.RE
.PP
\-\-type <TYPE>
.RS 4
Specify the secret type. Limitations to the input data apply depending on the
secret type.

Possible values:
.RS 4
\- \fBplain\fP: A plaintext secret. Can be any file up to 8190 bytes long.

\- \fBaes\fP: An AES key. Must be a plain byte file 128, 192, or 256 bit long.

\- \fBaes-xts\fP: An AES-XTS key. Must be a plain byte file 512, or 1024 bit long.

\- \fBhmac-sha\fP: A HMAC-SHA key. Must be a plain byte file 512, or 1024 bit long.

\- \fBec\fP: An elliptic curve private key. Must be a PEM or DER file.

.RE
.RE
.PP
\-h, \-\-help
.RS 4
Print help (see a summary with \fB\-h\fR).
.RE
.RE

.SH "SEE ALSO"
.sp
\fBpvsecret\fR(1) \fBpvsecret-create\fR(1)