831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt [<!ENTITY mdash "&#8212;">]>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refentry id="man.dnssec-keyfromlabel">

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refentryinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <date>February 8, 2008</date>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </refentryinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refmeta>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refentrytitle><application>dnssec-keyfromlabel</application></refentrytitle>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <manvolnum>8</manvolnum>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refmiscinfo>BIND9</refmiscinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </refmeta>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refnamediv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refname><application>dnssec-keyfromlabel</application></refname>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refpurpose>DNSSEC key generation tool</refpurpose>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </refnamediv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <docinfo>

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox User <copyright>

f70a10508f030b097a9b8afe907a06f9a1e2c4d4Tinderbox User <year>2008</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <year>2009</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <year>2010</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <year>2011</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <year>2012</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <year>2014</year>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </copyright>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </docinfo>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refsynopsisdiv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <command>dnssec-keyfromlabel</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg choice="req">-l <replaceable class="parameter">label</replaceable></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-3</option></arg>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-G</option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-k</option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-y</option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg choice="req">name</arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </refsynopsisdiv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <title>DESCRIPTION</title>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para><command>dnssec-keyfromlabel</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt gets keys with the given label from a crypto hardware and builds

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt key files for DNSSEC (Secure DNS), as defined in RFC 2535

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt and RFC 4034.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt The <option>name</option> of the key is specified on the command

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt line. This must match the name of the zone for which the key is

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt being generated.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <title>OPTIONS</title>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <variablelist>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <term>-a <replaceable class="parameter">algorithm</replaceable></term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt Selects the cryptographic algorithm. The value of

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <option>algorithm</option> must be one of RSAMD5, RSASHA1,

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt ECDSAP256SHA256 or ECDSAP384SHA384.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt These values are case insensitive.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt If no algorithm is specified, then RSASHA1 will be used by

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt default, unless the <option>-3</option> option is specified,

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt in which case NSEC3RSASHA1 will be used instead. (If

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <option>-3</option> is used and an algorithm is specified,

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt that algorithm will be checked for compatibility with NSEC3.)

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt algorithm, and DSA is recommended.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Note 2: DH automatically sets the -k flag.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <term>-3</term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt Use an NSEC3-capable algorithm to generate a DNSSEC key.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt If this option is used and no algorithm is explicitly

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt set on the command line, NSEC3RSASHA1 will be used by

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt default.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-E <replaceable class="parameter">engine</replaceable></term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Specifies the cryptographic hardware to use.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt When BIND is built with OpenSSL PKCS#11 support, this defaults

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt to the string "pkcs11", which identifies an OpenSSL engine

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt that can drive a cryptographic accelerator or hardware service

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt module. When BIND is built with native PKCS#11 cryptography

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt (--enable-native-pkcs11), it defaults to the path of the PKCS#11

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt provider library specified via "--with-pkcs11".

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-l <replaceable class="parameter">label</replaceable></term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Specifies the label for a key pair in the crypto hardware.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt When <acronym>BIND</acronym> 9 is built with OpenSSL-based

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt PKCS#11 support, the label is an arbitrary string that

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt identifies a particular key. It may be preceded by an

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt optional OpenSSL engine name, followed by a colon, as in

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt "pkcs11:<replaceable>keylabel<replaceable>".

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt When <acronym>BIND</acronym> 9 is built with native PKCS#11

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt support, the label is a PKCS#11 URI string in the format

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt "pkcs11:<option>keyword</option>=<replaceable>value</replaceable><optional>;<option>keyword</option>=<replaceable>value</replaceable>;...</optional>"

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Keywords include "token", which identifies the HSM; "object", which

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt identifies the key; and "pin-source", which identifies a file from

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt which the HSM's PIN code can be obtained. The label will be

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt stored in the on-disk "private" file.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt If the label contains a

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <option>pin-source</option> field, tools using the generated

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt key files will be able to use the HSM for signing and other

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt operations without any need for an operator to manually enter

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt a PIN. Note: Making the HSM's PIN accessible in this manner

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt may reduce the security advantage of using an HSM; be sure

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt this is what you want to do before making use of this feature.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-n <replaceable class="parameter">nametype</replaceable></term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Specifies the owner type of the key. The value of

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <option>nametype</option> must either be ZONE (for a DNSSEC

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt a host (KEY)),

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt These values are case insensitive.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-C</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Compatibility mode: generates an old-style key, without

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt any metadata. By default, <command>dnssec-keyfromlabel</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt will include the key's creation date in the metadata stored

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt with the private key, and other dates may be set there as well

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt (publication date, activation date, etc). Keys that include

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt this data may be incompatible with older versions of BIND; the

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <option>-C</option> option suppresses them.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <term>-c <replaceable class="parameter">class</replaceable></term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt Indicates that the DNS record containing the key should have

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt the specified class. If not specified, class IN is used.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <varlistentry>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <term>-f <replaceable class="parameter">flag</replaceable></term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt <para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt Set the specified flag in the flag field of the KEY/DNSKEY record.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt The only recognized flags are KSK (Key Signing Key) and REVOKE.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-G</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Generate a key, but do not publish it or sign with it. This

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt option is incompatible with -P and -A.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-h</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Prints a short summary of the options and arguments to

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <command>dnssec-keyfromlabel</command>.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-K <replaceable class="parameter">directory</replaceable></term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Sets the directory in which the key files are to be written.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <term>-k</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt Generate KEY records rather than DNSKEY records.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt </varlistentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

<varlistentry>

<term>-L <replaceable class="parameter">ttl</replaceable></term>

<listitem>

<para>

Sets the default TTL to use for this key when it is converted

into a DNSKEY RR. If the key is imported into a zone,

this is the TTL that will be used for it, unless there was

already a DNSKEY RRset in place, in which case the existing TTL

would take precedence. Setting the default TTL to

<literal>0</literal> or <literal>none</literal> removes it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-p <replaceable class="parameter">protocol</replaceable></term>

<listitem>

<para>

Sets the protocol value for the key. The protocol

is a number between 0 and 255. The default is 3 (DNSSEC).

Other possible values for this argument are listed in

RFC 2535 and its successors.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-t <replaceable class="parameter">type</replaceable></term>

<listitem>

<para>

Indicates the use of the key. <option>type</option> must be

one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default

is AUTHCONF. AUTH refers to the ability to authenticate

data, and CONF the ability to encrypt data.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-v <replaceable class="parameter">level</replaceable></term>

<listitem>

<para>

Sets the debugging level.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-y</term>

<listitem>

<para>

Allows DNSSEC key files to be generated even if the key ID

would collide with that of an existing key, in the event of

either key being revoked. (This is only safe to use if you

are sure you won't be using RFC 5011 trust anchor maintenance

with either of the keys involved.)

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>TIMING OPTIONS</title>

<para>

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

If the argument begins with a '+' or '-', it is interpreted as

an offset from the present time. For convenience, if such an offset

is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

then the offset is computed in years (defined as 365 24-hour days,

ignoring leap years), months (defined as 30 24-hour days), weeks,

days, hours, or minutes, respectively. Without a suffix, the offset

is computed in seconds. To explicitly prevent a date from being

set, use 'none' or 'never'.

</para>

<variablelist>

<varlistentry>

<term>-P <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which a key is to be published to the zone.

After that date, the key will be included in the zone but will

not be used to sign it. If not set, and if the -G option has

not been used, the default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be activated. After that

date, the key will be included in the zone and used to sign

it. If not set, and if the -G option has not been used, the

default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be revoked. After that

date, the key will be flagged as revoked. It will be included

in the zone and will be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-I <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be retired. After that

date, the key will still be included in the zone, but it

will not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be deleted. After that

date, the key will no longer be included in the zone. (It

may remain in the key repository, however.)

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>GENERATED KEY FILES</title>

<para>

When <command>dnssec-keyfromlabel</command> completes

successfully,

it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>

to the standard output. This is an identification string for

the key files it has generated.

</para>

<itemizedlist>

<listitem>

<para><filename>nnnn</filename> is the key name.

</para>

</listitem>

<listitem>

<para><filename>aaa</filename> is the numeric representation

of the algorithm.

</para>

</listitem>

<listitem>

<para><filename>iiiii</filename> is the key identifier (or

footprint).

</para>

</listitem>

</itemizedlist>

<para><command>dnssec-keyfromlabel</command>

creates two files, with names based

on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>

contains the public key, and

<filename>Knnnn.+aaa+iiiii.private</filename> contains the

private key.

</para>

<para>

The <filename>.key</filename> file contains a DNS KEY record

that

can be inserted into a zone file (directly or with a $INCLUDE

statement).

</para>

<para>

The <filename>.private</filename> file contains

algorithm-specific

fields. For obvious security reasons, this file does not have

general read permission.

</para>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 4034</citetitle>,

<citetitle>The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13)</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--