'\" t
.\"     Title: nvme-keys-check-tls-psk
.\"    Author: [FIXME: author] [see http://www.docbook.org/tdg5/en/html/author]
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\"      Date: 09/07/2026
.\"    Manual: NVMe Manual
.\"    Source: NVMe
.\"  Language: English
.\"
.TH "NVME\-KEYS\-CHECK\-T" "1" "09/07/2026" "NVMe" "NVMe Manual"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
nvme-keys-check-tls-psk \- Check a NVMe TLS PSK
.SH "SYNOPSIS"
.sp
.nf
\fInvme\fR [<global\-options>] \fIkeys check\-tls\-psk\fR [\-\-keyring=<name> | \-k <name>]
                        [\-\-keytype=<type> | \-t <type>]
                        [\-\-hostnqn=<nqn> | \-n <nqn>]
                        [\-\-subsysnqn=<nqn> | \-c <nqn>]
                        [\-\-keydata=<key> | \-d <key>]
                        [\-\-identity=<id\-vers> | \-I <id\-vers>]
                        [\-\-compat | \-C]
.fi
.SH "DESCRIPTION"
.sp
Checks if the key is a valid NVMe TLS configured PSK in the PSK interchange format \fINVMeTLSkey\-1:<hmac>:<base64\-encoded data>:\fR and prints the hash function it records and the length of the PSK\&.
.sp
If \fI\-\-keydata\fR is not given the configured PSK is read from stdin, which also allows reading it from a file, e\&.g\&. \fInvme keys check\-tls\-psk < keyfile\fR\&.
.sp
If \fI\-\-subsysnqn\fR is given the TLS PSK identity of the key is also printed, and the specified keyring is checked for a TLS PSK already stored under that identity; the result (loaded or not, with its serial number if loaded) is reported\&. This command never modifies the keyring; to insert a TLS PSK use \fBnvme-keys-insert-tls-psk\fR(1)\&.
.SH "OPTIONS"
.PP
\-k <name>, \-\-keyring=<name>
.RS 4
Name of the keyring to check for an already loaded TLS PSK\&. Default is
\fI\&.nvme\fR\&.
.RE
.PP
\-t <type>, \-\-keytype=<type>
.RS 4
Key type of the TLS PSK to look up\&. Default is
\fIpsk\fR\&.
.RE
.PP
\-n <nqn>, \-\-hostnqn=<nqn>
.RS 4
Host NVMe Qualified Name (NQN) to be used when checking whether the TLS PSK is already loaded\&. Only used together with \-\-subsysnqn\&. Defaults to the host NQN of the system, read from /etc/nvme/hostnqn or, if that file does not exist, generated from the host ID\&.
.RE
.PP
\-c <nqn>, \-\-subsysnqn=<nqn>
.RS 4
Subsystem NVMe Qualified Name (NQN) to be used when checking whether the TLS PSK is already loaded\&. If not given, only the configured PSK format is validated\&.
.RE
.PP
\-d <key>, \-\-keydata=<key>
.RS 4
Configured PSK to be checked\&. If not given, it is read from stdin\&.
.RE
.PP
\-I <id\-vers>, \-\-identity=<id\-vers>
.RS 4
TLS PSK identity version of the identity to look up;
\fI0\fR
(the default) is obsolete and defined in the NVMe TCP Transport Specification 1\&.0,
\fI1\fR
is TLS 1\&.3 with the PSK digest in the PSK identity\&.
.RE
.PP
\-C, \-\-compat
.RS 4
Use the original non\-RFC 8446 compliant algorithm when deriving the TLS PSK identity for compatibility with older implementations\&. Has no effect with identity version
\fI0\fR, whose identity does not embed the PSK digest\&.
.RE
.SH "GLOBAL OPTIONS"
.sp
The following options are defined at the top\-level nvme command and are available to this subcommand:
.PP
\-\-dry\-run
.RS 4
Print the command that would be executed, but do not actually execute it\&.
.RE
.PP
\-\-no\-ioctl\-probing
.RS 4
Disable probing for 64\-bit IOCTL support\&.
.RE
.PP
\-\-no\-retries
.RS 4
Disable retry logic on transient errors\&.
.RE
.PP
\-o <fmt>, \-\-output\-format=<fmt>
.RS 4
Set the reporting format to
\fInormal\fR,
\fItabular, \*(Aqjson\fR, or
\fIbinary\fR\&. Only one output format may be used at a time\&.
.RE
.PP
\-\-output\-format\-version=<version>
.RS 4
Select the output format version\&. Version
\fI1\fR
uses the original field naming, while version
\fI2\fR
(default) provides more consistent and script\-friendly field names\&.
.RE
.PP
\-\-timeout=<ms>
.RS 4
Set the timeout for the command in milliseconds\&.
.RE
.PP
\-v, \-\-verbose
.RS 4
Increase the level of detail in the output\&. May be specified multiple times to further increase verbosity\&.
.RE
.sp
These options can also be set as machine\-wide defaults in nvme\-cli\&.conf(5)\&. A command\-line flag always overrides the file\&.
.SH "EXAMPLES"
.sp
No Examples
.SH "NVME"
.sp
Part of the nvme\-user suite