Merge d46624f into 8abf473

man/man8/swtpm_setup.8

@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm_setup 8"
-.TH swtpm_setup 8 "2020-05-01" "swtpm" ""
+.TH swtpm_setup 8 "2020-05-04" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -277,18 +277,27 @@ A file to copy \s-1TCSD\s0's system_ps_file to. The system_ps_file contains the
 needed by \s-1TCSD\s0 for key related functions.
 .Sp
 This option is only useful with \s-1TPM 1.2\s0 and in if ownership is taken.
+.IP "\fBrsa-keysize <keysize\fR> (since v0.4)" 4
+.IX Item "rsa-keysize <keysize> (since v0.4)"
+This option allows to pass the size of a \s-1TPM 2 RSA EK\s0 key, such as 2048
+or 3072. The supported keysizes for a \s-1TPM 2\s0 can be queried for using
+the \fI\-\-print\-capabilities\fR option. The default size is 2048 bits for
+both \s-1TPM 1.2\s0 and \s-1TPM 2.\s0 If 'max' is passed, the largest possible key
+size is used.
 .IP "\fB\-\-print\-capabilities\fR (since v0.2)" 4
 .IX Item "--print-capabilities (since v0.2)"
-Print capabilities that were added to swtpm_setup after version 0.1. The output
-contains the following:
+Print capabilities that were added to swtpm_setup after version 0.1.
+The output may contain the following:
 .Sp
-.Vb 8
+.Vb 10
 \&    {
 \&      "type": "swtpm_setup",
 \&      "features": [
 \&        "cmdarg\-keyfile\-fd",
 \&        "cmdarg\-pwdfile\-fd",
-\&        "no\-tpm12\-tools"
+\&        "no\-tpm12\-tools",
+\&        "tpm2\-rsa\-keysize\-2048",
+\&        "tpm2\-rsa\-keysize\-3072"
 \&      ]
 \&    }
 .Ve
@@ -306,6 +315,10 @@ The \fI\-\-pwdfile\-fd\fR option is supported.
 \&\s-1TPM 1.2\s0 tools cannot be found in the \s-1PATH.\s0 This means that no certificates can
 be created since they cannot be written into the \s-1NVRAM\s0 and the \s-1NVRAM\s0 cannot be
 locked. Among the \s-1TPM 1.2\s0 setup parameters only \fI\-\-createek\fR can be passed.
+.IP "\fBtpm2\-rsa\-keysize\-2048, ...\fR" 4
+.IX Item "tpm2-rsa-keysize-2048, ..."
+The shown \s-1RSA\s0 key sizes are supported for a \s-1TPM 2\s0's \s-1EK\s0 key. If none of the
+tpm2\-rsa\-keysize verbs is shown then only \s-1RSA 2048\s0 bit keys are supported.
 .RE
 .RS 4
 .RE

man/man8/swtpm_setup.pod

@@ -173,17 +173,27 @@ needed by TCSD for key related functions.
 
 This option is only useful with TPM 1.2 and in if ownership is taken.
 
+=item B<rsa-keysize <keysize>> (since v0.4)
+
+This option allows to pass the size of a TPM 2 RSA EK key, such as 2048
+or 3072. The supported keysizes for a TPM 2 can be queried for using
+the I<--print-capabilities> option. The default size is 2048 bits for
+both TPM 1.2 and TPM 2. If 'max' is passed, the largest possible key
+size is used.
+
 =item B<--print-capabilities> (since v0.2)
 
-Print capabilities that were added to swtpm_setup after version 0.1. The output
-contains the following:
+Print capabilities that were added to swtpm_setup after version 0.1.
+The output may contain the following:
 
     {
       "type": "swtpm_setup",
       "features": [
         "cmdarg-keyfile-fd",
         "cmdarg-pwdfile-fd",
-        "no-tpm12-tools"
+        "no-tpm12-tools",
+        "tpm2-rsa-keysize-2048",
+        "tpm2-rsa-keysize-3072"
       ]
     }
 
@@ -205,6 +215,11 @@ TPM 1.2 tools cannot be found in the PATH. This means that no certificates can
 be created since they cannot be written into the NVRAM and the NVRAM cannot be
 locked. Among the TPM 1.2 setup parameters only I<--createek> can be passed.
 
+=item B<tpm2-rsa-keysize-2048, ...>
+
+The shown RSA key sizes are supported for a TPM 2's EK key. If none of the
+tpm2-rsa-keysize verbs is shown then only RSA 2048 bit keys are supported.
+
 =back
 
 =item B<--help, -h>

src/swtpm_setup/swtpm_setup.c

@@ -74,6 +74,7 @@ const char *one_arg_params[] = {
     "--swtpm_ioctl",
     "--pcr-banks",
     "--tcsd-system-ps-file",
+    "--rsa-keysize",
     NULL
 };