11.6. Basic NBDE and TPM2 encryption-client operations

Encryption client bound to a Tang server

• To check that a Clevis encryption client binds to a Tang server, use the clevis encrypt tang sub-command:

  $ clevis encrypt tang '{"url":"http://tang.srv:port"}' < input-plain.txt > secret.jwe
  The advertisement contains the following signing keys:
  
  _OsIk0T-E2l6qjfdDiwVmidoZjA
  
  Do you wish to trust these keys? [ynYN] y

  Change the http://tang.srv:port URL in the previous example to match the URL of the server where tang is installed. The secret.jwe output file contains your encrypted cipher text in the JWE format. This cipher text is read from the input-plain.txt input file.

  Alternatively, if your configuration requires a non-interactive communication with a Tang server without SSH access, you can download an advertisement and save it to a file:

  $ curl -sfg http://tang.srv:port/adv -o adv.jws

  Use the advertisement in the adv.jws file for any following tasks, such as encryption of files or messages:

  $ echo 'hello' | clevis encrypt tang '{"url":"http://tang.srv:port","adv":"adv.jws"}'

• To decrypt data, use the clevis decrypt command and provide the cipher text (JWE):

  $ clevis decrypt < secret.jwe > output-plain.txt

Encryption client using TPM 2.0

• To encrypt using a TPM 2.0 chip, use the clevis encrypt tpm2 sub-command with the only argument in form of the JSON configuration object:

  $ clevis encrypt tpm2 '{}' < input-plain.txt > secret.jwe

  To choose a different hierarchy, hash, and key algorithms, specify configuration properties, for example:

  $ clevis encrypt tpm2 '{"hash":"sha256","key":"rsa"}' < input-plain.txt > secret.jwe

• To decrypt the data, provide the ciphertext in the JSON Web Encryption (JWE) format:

  $ clevis decrypt < secret.jwe > output-plain.txt