dnssec-dsfromkey.html revision 6f1205897504b8f50b1785975482c995888dd630
bf52162f2d05c1fb1a107c7ef108de73f739b3edpquerna - Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
bf52162f2d05c1fb1a107c7ef108de73f739b3edpquerna - Permission to use, copy, modify, and/or distribute this software for any
df46ff21c57d00f6addccaaf9b1484f2b56b8577pquerna - purpose with or without fee is hereby granted, provided that the above
7f4ac5a4cd99a9cae866b5908e358bd932736307chrisd - copyright notice and this permission notice appear in all copies.
1c03114a0f0315ed19a05f654021da9f66005897rjung - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
89691c9bd17f5f53fa0aa8d3fe2e1faee5a5d984rpluem - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
89691c9bd17f5f53fa0aa8d3fe2e1faee5a5d984rpluem - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
89691c9bd17f5f53fa0aa8d3fe2e1faee5a5d984rpluem - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
89691c9bd17f5f53fa0aa8d3fe2e1faee5a5d984rpluem - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
3e9c0665b06e44cf776528c6954ed3ca34a77c7fsctemme - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
51a475d92e7d68ee6d7b57aa7fd6e73b2712ce31sctemme - PERFORMANCE OF THIS SOFTWARE.
019f2b58acb34e31ea3a062bdb5e6c863cd82d66trawick<!-- $Id$ -->
6707208ba4e9a5841ca1ab830830fd286ea5b7c5trawick<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
832853bb93c1831daf24e4727c5ca0e1b1786e83lars<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
832853bb93c1831daf24e4727c5ca0e1b1786e83lars<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
d2696ac6757b3d8bdaa27634a141ac8c8a045e08fielding<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
d2696ac6757b3d8bdaa27634a141ac8c8a045e08fielding<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
1782dcd420de504978945e6b812523eeae6d56a2lars<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<p><span><strong class="command">dnssec-dsfromkey</strong></span>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem outputs the Delegation Signer (DS) resource record (RR), as defined in
cf8d02ea0c91653917b044529f3133c5a1bb9200fielding RFC 3658 and RFC 4509, for the given key(s).
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Use SHA-1 as the digest algorithm (the default is to use
d4ee4552489641d35d1195bbbd6021351c4b79aarjung both SHA-1 and SHA-256).
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Use SHA-256 as the digest algorithm.
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Select the digest algorithm. The value of
382d14411b582d97075a836190d74c778977505fcovener <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem SHA-256 (SHA256), GOST or SHA-384 (SHA384).
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem These values are case insensitive.
06e6657fd0f376a16db696876f9bff5927cc3cb0trawick<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Specifies the TTL of the DS records.
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Look for key files (or, in keyset mode,
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Zone file mode: in place of the keyfile name, the argument is
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem the DNS domain name of a zone master file, which can be read
df46ff21c57d00f6addccaaf9b1484f2b56b8577pquerna from <code class="option">file</code>. If the zone name is the same as
df46ff21c57d00f6addccaaf9b1484f2b56b8577pquerna <code class="option">file</code>, then it may be omitted.
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem the zone data is read from the standard input. This makes it
a5cce34e21a5b472f3806b4526043887bcb7e9eajim possible to use the output of the <span><strong class="command">dig</strong></span>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem command as input, as in:
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
6824182b3b8e045db97a228d3127bdfcbdfeb0bcniq Include ZSK's when generating DS records. Without this option,
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem only keys which have the KSK flag set will be converted to DS
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem records and printed. Useful only in zone file mode.
0c26d213d85bc40fc05963c63bf670b42b352d25niq<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Generate a DLV set instead of a DS set. The specified
92357fb76d3ad043e29ba2ba2041a7bdb8d13390niq <code class="option">domain</code> is appended to the name for each
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem record in the set.
9f07b6dc343a4e3eba5f4c47050a77441723ce89nd The DNSSEC Lookaside Validation (DLV) RR is described
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem in RFC 4431.
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem Keyset mode: in place of the keyfile name, the argument is
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem the DNS domain name of a keyset file.
abc69b39766c0de3eaf99e9016ea3f35e23c116drpluem<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
8d574b3ac4185e4f71c8b9aae76e7122a78201c4rpluem Specifies the DNS class (default is IN). Useful only
8d574b3ac4185e4f71c8b9aae76e7122a78201c4rpluem in keyset or zone file mode.
7f4ac5a4cd99a9cae866b5908e358bd932736307chrisd<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
8d574b3ac4185e4f71c8b9aae76e7122a78201c4rpluem Sets the debugging level.
0e2a2eae9b72ac099aa25d7419e55af13b004be9minfrin Prints usage information.
66b8ec445dced7a2036bcd3b87b6fc3f08a1ab24jorton Prints version information.
0e2a2eae9b72ac099aa25d7419e55af13b004be9minfrin To build the SHA-256 DS RR from the
0e2a2eae9b72ac099aa25d7419e55af13b004be9minfrin <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
8d574b3ac4185e4f71c8b9aae76e7122a78201c4rpluem keyfile name, the following command would be issued:
6f33babce8f8bc723f0b2c755aef049cd509504fpquerna<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
0a12339f39799193ac6866fce812a1deb8f4a1abpquerna The command would print something like:
3fb118bc4e1a634f71c1fa509819ceac36c79dcbpquerna<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna The keyfile can be designed by the key identification
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna <span class="refentrytitle">dnssec-keygen</span>(8).
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna The keyset file name is built from the <code class="option">directory</code>,
a91a59d0b0ceed7cd5621fe8757eda5ff6a043a8pquerna the string <code class="filename">keyset-</code> and the
19e5deda3a29d71ac1cc4bfecce39f96ea3ab55dcovener A keyfile error can give a "file not found" even if the file exists.
3ec1e3a35106ec4c8bcf8fae6a20cb623aed0b62pquerna<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
97f7daaffd9b6c1031302d7e551d5279fa0d0d72pquerna <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
97f7daaffd9b6c1031302d7e551d5279fa0d0d72pquerna <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
527fc83e2bf315b2026a9ac6b1e6ce83143609bbcovener<p><span class="corpauthor">Internet Systems Consortium</span>