nvme-keys-check-kxchap-secret(1)
================================

NAME
----
nvme-keys-check-kxchap-secret - Check a host KX-HMAC-CHAP secret

SYNOPSIS
--------
[verse]
'nvme' [<global-options>] 'keys check-kxchap-secret' [--keydata=<secret> | -d <secret>]
			[--keyring=<name> | -k <name>]
			[--keytype=<type> | -t <type>]
			[--identity=<identity> | -i <identity>]

DESCRIPTION
-----------
Checks if the given string is a valid KX-HMAC-CHAP host secret of the form:
DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:
and prints the hash algorithm it records, the secret length, and the CRC.

If '--keydata' is not given the secret is read from stdin, which also allows
checking a secret stored in a file, e.g. 'nvme keys check-kxchap-secret < keyfile'.

If '--identity' is given the specified keyring is also checked for a secret
already stored under that identity (as inserted by
linknvme:nvme-keys-import[1]); the result (not loaded, loaded and
matching, or loaded but different) is reported. This command never
modifies the keyring.

Looking up a secret requires the 'kxchap' keyring key type, which is not yet
provided by any released Linux kernel; see linknvme:nvme-keys-import[1]
for details.

OPTIONS
-------
-d <secret>::
--keydata=<secret>::
	Secret to be checked. If not given, the secret is read from stdin.

-k <name>::
--keyring=<name>::
	Name of the keyring to check for an already loaded secret.
	Default is '.nvme'.

-t <type>::
--keytype=<type>::
	Key type of the secret to look up.
	Default is 'kxchap'.

-i <identity>::
--identity=<identity>::
	Identity to look up in the keyring to check if the secret is already
	loaded. If not given, only the secret format is validated.

include::global-options.txt[]

EXAMPLES
--------
No Examples

NVME
----
Part of the nvme-user suite
