Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 11. tkstool (Managing Token Keys)

The TKS utility, tkstool, manages keys, including keys stored on tokens, the TKS master key, and related keys and databases.

11.1. Syntax
Copiar enlace

The tkstool can be used to manage certificates and keys in several different ways. The syntax for these different operations is as follows:
  • Deleting a key from a token. 
    tkstool -D -n keyname -d dbdir [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Inputting shares to generate a new transport key. 
    tkstool -I -n keyname -d dbdir [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Displaying the key check value (KCV) of the specified key. 
    tkstool -K -n keyname -d dbdir [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Listing a specified key or all keys. 
    tkstool -L -n keyname -d dbdir [-h all | -h token_name]
 [-p dbprefix] [-f pwfile] [-x]
    Copy to Clipboard Toggle word wrap
  • Generating a new master key. 
    tkstool -M -n keyname -d dbdir [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Creating a new key database. 
    tkstool -N -d dbdir [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Changing the key database password. 
    tkstool -P -d dbdir [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Renaming a symmetric key. 
    tkstool -R -n keyname -r new_keyname -d dbdir [-h token_name]
 [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Listing all security modules. 
    tkstool -S -d dbdir [-p dbprefix] [-x]
    Copy to Clipboard Toggle word wrap
  • Generating a new transport key. 
    tkstool -T -n keyname -d dbdir [-h token_name]
 [-p dbprefix] [-f pwfile] [-z noiseFile]
    Copy to Clipboard Toggle word wrap
  • Unwrapping a wrapped master key. 
    tkstool -U -n keyname -d dbdir -t transport_keyname -i inputFile
 [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap
  • Wrapping a new master key. 
    tkstool -W -n keyname -d dbdir -t transport_keyname -o outputFile
 [-h token_name] [-p dbprefix] [-f pwfile]
    Copy to Clipboard Toggle word wrap

Note

Chrysalis-ITS version 2.3 is required to support version 1.0 of the -R option of the tkstool.
Transport keys residing on Chrysalis-ITS hardware tokens created by an earlier version of tkstool cannot have their KCV values determined with the -K option of the tkstool because the CKA_ENCRYPT and CKF_ENCRYPT bits were not set when they were created by the previous tool.
The tkstool options are as follows:
Expand
Option Description
D Deletes a key from the token.
d Required. Gives the security module database (HSM, if allowed for that operation) or the key database directory (software).
f Gives the path and filename of the password file, if one is used.
h Gives the token name for the toke which contains the key to be managed. Some operations allow an all option to manage all keys in the token.
I Inputs shares to generate a new transport key.
i Required with -U. Gives the path and filename of the input file which contains the wrapped master key.
K Displays the KCV of the specified key.
L Lists the specified key or all keys.
M Generates a new master key.
N Creates a new key database (software).
n Required for every operation except -N, -P, and -S. Gives the name of the key being managed.
o Required with -W. Gives the path and filename for the file to which to output the new wrapped master key.
P Changes the key database password (software).
p Gives the prefix to the key database directory.
R Renames a symmetric key.
r Required with -R. Gives the new key name.
S Lists all security modules.
T Generates a new transport key.
t Required with -U and -W. Gives the name of the transport key being managed.
U Unwraps the wrapped master key.
W Wraps the new master key.
x Forces the database to be read/write.
z Gives the path and filename of the noise file to generate the key.
There are two additional options which can be used with tkstool to get more information about the utility.
Expand
Option Description
H Displays the extended help information.
V Display the version number of the tkstool tool.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat