mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
84 lines
3.6 KiB
Groff
84 lines
3.6 KiB
Groff
.\" Copyright 2022 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
.TH pvattest-create 1 "07 June 2022" "s390-tools" "Attestation Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
\fBpvattest [OPTION?] create [OPTIONS] \fP- create an attestation measurement request
|
|
\fB
|
|
.SH DESCRIPTION
|
|
Prepare attestation measurement requests for an IBM Secure Execution guest.
|
|
Only prepare attestation requests in a trusted environment, such as your workstation.
|
|
The 'pvattest create' command creates a randomly generated key to protect the attestation request.
|
|
This key is only valid for this specific request. In order to avoid compromising the attestation,
|
|
do not publish the protection key and delete it after verification.
|
|
Every 'create' command generates a new, random protection key.
|
|
.SH OPTIONS
|
|
.TP
|
|
.B
|
|
\fB-h\fP, \fB--help\fP
|
|
Prints usage information, then exits.
|
|
.TP
|
|
.B
|
|
\fB-k\fP, \fB--host-key-document\fP=\fBFILE\fP
|
|
Specify one or more host key documents. At least one is required.
|
|
Specify this option multiple times to create an attestation request control block that is usable on multiple hosts.
|
|
.TP
|
|
.B
|
|
\fB-C\fP, \fB--cert\fP=\fBFILE\fP
|
|
Specifies the certificate that is used to establish a chain of trust for the verification of the host-key documents. Specify this option twice to specify the IBM Z signing key and the intermediate CA certificate (signed by the root CA). Required. Ignored when \fB--no-verify\fP is specified.
|
|
.TP
|
|
.B
|
|
\fB--crl\fP=\fBFILE\fP
|
|
Specifies the revocation list that is used to check whether a certificate of the chain of trust is
|
|
revoked. Specify this option multiple times to use multiple CRLs (optional).
|
|
.TP
|
|
.B
|
|
\fB--root-ca\fP=\fBFILE\fP
|
|
Specifies the root CA certificate for the verification. If omitted,
|
|
the system wide root CAs installed on the system are used. Use
|
|
this only if you trust the specified certificate. Optional.
|
|
.TP
|
|
.B
|
|
\fB-o\fP, \fB--output\fP=\fBFILE\fP
|
|
\fBFILE\fP specifies the output for the attestation request control block.
|
|
.TP
|
|
.B
|
|
\fB-a\fP, \fB--arpk\fP=\fBFILE\fP
|
|
Save the protection key as GCM-AES256 key in \fBFILE\fP Do not publish this key, otherwise your attestation is compromised.
|
|
.TP
|
|
.B
|
|
\fB--no-verify\fP
|
|
Disable the host-key document verification. Does not require the host-key documents to be valid. Do
|
|
not use for a production request unless you verified the host-key document before (optional).
|
|
.TP
|
|
.B
|
|
\fB--offline\fP
|
|
Specifies offline mode, in which no attempt is made to download CRLs. (optional).
|
|
.TP
|
|
.B
|
|
\fB-V\fP, \fB--verbose\fP
|
|
Provide more detailed output (optional).
|
|
.SH EXAMPLE
|
|
Create an attestation request with the protection key 'arp.key', write the request to 'arcb.bin', and verify the host-key document using the CA-signed key 'DigiCertCA.crt' and the intermediate key 'IbmSigningKey.crt'.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
pvattest create -k hkd.crt --arpk arp.key -o attreq.bin --cert DigiCertCA.crt --cert IbmSigningKey.crt
|
|
|
|
.fam T
|
|
.fi
|
|
Create an attestation request with the protection key 'arp.key', write the request to 'arcb.bin', verify the host-key document using the CA-signed key 'DigiCertCA.crt' and the intermediate key 'IbmSigningKey.crt', and instead of downloading the certificate revocation list use certificate revocation lists 'DigiCertCA.crl', 'IbmSigningKey.crl', and 'rootCA.crl'.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
pvattest create -k hkd.crt --arpk arp.key -o attreq.bin --cert DigiCertCA.crt --cert IbmSigningKey.crt --offline --crl DigiCertCA.crl --crl IbmSigningKey.crl --crl rootCA.crl
|
|
|
|
|
|
.fam T
|
|
.fi
|
|
.SH SEE ALSO
|
|
\fBpvattest\fP(1), \fBpvattest-verify\fP(1), \fBpvattest-perform\fP(1)
|