nvme-keys-check-kxchap-secret(1)

# nvme-keys-check-kxchap-secret(1) Manual Page

## NAME

nvme-keys-check-kxchap-secret - Check a host KX-HMAC-CHAP secret

## SYNOPSIS

    nvme [<global-options>] keys check-kxchap-secret [--keydata=<secret> | -d <secret>]
                            [--keyring=<name> | -k <name>]
                            [--keytype=<type> | -t <type>]
                            [--identity=<identity> | -i <identity>]

## DESCRIPTION

Checks if the given string is a valid KX-HMAC-CHAP host secret of the form: DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: and prints the hash algorithm it records, the secret length, and the CRC.

If --keydata is not given the secret is read from stdin, which also allows checking a secret stored in a file, e.g. nvme keys check-kxchap-secret < keyfile.

If --identity is given the specified keyring is also checked for a secret already stored under that identity (as inserted by nvme-keys-import(1)); the result (not loaded, loaded and matching, or loaded but different) is reported. This command never modifies the keyring.

Looking up a secret requires the kxchap keyring key type, which is not yet provided by any released Linux kernel; see nvme-keys-import(1) for details.

## OPTIONS

-d <secret>
--keydata=<secret>

  Secret to be checked. If not given, the secret is read from stdin.

-k <name>
--keyring=<name>

  Name of the keyring to check for an already loaded secret. Default is .nvme.

-t <type>
--keytype=<type>

  Key type of the secret to look up. Default is kxchap.

-i <identity>
--identity=<identity>

  Identity to look up in the keyring to check if the secret is already loaded. If not given, only the secret format is validated.

## GLOBAL OPTIONS

The following options are defined at the top-level `nvme` command and are available to this subcommand:

--dry-run

  Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

  Disable probing for 64-bit IOCTL support.

--no-retries

  Disable retry logic on transient errors.

-o <fmt>
--output-format=<fmt>

  Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

  Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

  Set the timeout for the command in milliseconds.

-v
--verbose

  Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

## EXAMPLES

No Examples

## NVME

Part of the nvme-user suite