SYNOPSIS

nvme [<global-options>] keys check-kxchap-secret [--keydata=<secret> | -d <secret>]
                        [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--identity=<identity> | -i <identity>]

DESCRIPTION

Checks if the given string is a valid KX-HMAC-CHAP host secret of the form: DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: and prints the hash algorithm it records, the secret length, and the CRC.

If --keydata is not given the secret is read from stdin, which also allows checking a secret stored in a file, e.g. nvme keys check-kxchap-secret < keyfile.

If --identity is given the specified keyring is also checked for a secret already stored under that identity (as inserted by linknvme-keys-import[1]); the result (not loaded, loaded and matching, or loaded but different) is reported. This command never modifies the keyring.

Looking up a secret requires the kxchap keyring key type, which is not yet provided by any released Linux kernel; see linknvme-keys-import[1] for details.

OPTIONS

-d <secret>
--keydata=<secret>

Secret to be checked. If not given, the secret is read from stdin.

-k <name>
--keyring=<name>

Name of the keyring to check for an already loaded secret. Default is .nvme.

-t <type>
--keytype=<type>

Key type of the secret to look up. Default is kxchap.

-i <identity>
--identity=<identity>

Identity to look up in the keyring to check if the secret is already loaded. If not given, only the secret format is validated.

GLOBAL OPTIONS

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run

Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

Disable probing for 64-bit IOCTL support.

--no-retries

Disable retry logic on transient errors.

-o <fmt>
--output-format=<fmt>

Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

Set the timeout for the command in milliseconds.

-v
--verbose

Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

EXAMPLES

No Examples

NVME

Part of the nvme-user suite