dnssec-dsfromkey.docbook revision e17cb80d7cebc23a4de75376155f2231dea193e6
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews [<!ENTITY mdash "—">]>
06140f733a711340d20650b9b096efe234d6ebcbAutomatic Updater - Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - purpose with or without fee is hereby granted, provided that the above
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - copyright notice and this permission notice appear in all copies.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - PERFORMANCE OF THIS SOFTWARE.
b1c6de5456a5287b442de5620282902da39a4968Mark Andrews<!-- $Id: dnssec-dsfromkey.docbook,v 1.3 2008/11/07 03:43:20 marka Exp $ -->
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refentryinfo>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </refentryinfo>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refentrytitle><application>dnssec-dsfromkey</application></refentrytitle>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refnamediv>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refname><application>dnssec-dsfromkey</application></refname>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refpurpose>DNSSEC DS RR generation tool</refpurpose>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </refnamediv>
dde8659175c5798267fb0fdefd7576e4efe271b3Automatic Updater <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refsynopsisdiv>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <cmdsynopsis>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </cmdsynopsis>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <cmdsynopsis>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <arg><option>-d <replaceable class="parameter">dir</replaceable></option></arg>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </cmdsynopsis>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refsynopsisdiv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt outputs the Delegation Signer (DS) resource record RR, as defined in
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt RFC 3658 and RFC 4509, for the given key(s).
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <variablelist>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Use SHA-1 as the digest algorithm (the default is to use
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews both SHA-1 and SHA-256).
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Use SHA-256 as the digest algorithm.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <term>-a <replaceable class="parameter">algorithm</replaceable></term>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Select the digest algorithm. The value of
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <option>algorithm</option> must be one of SHA-1 (SHA1) or
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews SHA-256 (SHA256). These values are case insensitive.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>
37dee1ff94960a61243f611c0f87f8c316815c53Mark Andrews Sets the debugging level.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <varlistentry>
b1c6de5456a5287b442de5620282902da39a4968Mark Andrews Keyset mode: in place of the keyfile name, the argument is
b1c6de5456a5287b442de5620282902da39a4968Mark Andrews the DNS domain name of a keyset file. Following options make sense
b1c6de5456a5287b442de5620282902da39a4968Mark Andrews only in this mode.
b1c6de5456a5287b442de5620282902da39a4968Mark Andrews </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <term>-c <replaceable class="parameter">class</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Specifies the DNS class (default is IN), useful only
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt in the keyset mode.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-d <replaceable class="parameter">directory</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <option>directory</option> as the directory, ignored when
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt not in the keyset mode.
fdc2d31c00280488df9ee7bd1e1e7410d3e30388Mark Andrews </varlistentry>
0a82492610e2424bb999946bd6e5a13c83f453b4Mark Andrews </variablelist>
0a82492610e2424bb999946bd6e5a13c83f453b4Mark Andrews To build the SHA-256 DS RR from the
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt keyfile name, the following command would be issued:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt The command would print something like:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt The keyfile can be designed by the key identification
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt <filename>Knnnn.+aaa+iiiii</filename> or the full file name
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt <filename>Knnnn.+aaa+iiiii.key</filename> as generate by
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
35490da6150316932957908f2f85109ecf9f7c59Jeremy Reed The keyset file name is built from the <option>directory</option>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews A keyfile error can give a "file not found" even if the file exists.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews </citerefentry>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <citerefentry>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </citerefentry>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <para><corpauthor>Internet Systems Consortium</corpauthor>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - Local variables:
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - mode: sgml
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews [<!ENTITY mdash "—">]>