d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

71cef386fae61275b03e203825680b39fedaa8c6Tinderbox User [<!ENTITY mdash "&#8212;">]>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<refentry id="man.dnssec-keyfromlabel">

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <date>February 8, 2008</date>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmeta>

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater <refentrytitle><application>dnssec-keyfromlabel</application></refentrytitle>

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater <manvolnum>8</manvolnum>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmiscinfo>BIND9</refmiscinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refmeta>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refnamediv>

fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <refname><application>dnssec-keyfromlabel</application></refname>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </refnamediv>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <docinfo>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <copyright>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <year>2008</year>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <year>2009</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2010</year>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </copyright>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </docinfo>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsynopsisdiv>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <cmdsynopsis>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <command>dnssec-keyfromlabel</command>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg choice="req">-l <replaceable class="parameter">label</replaceable></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-3</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-G</option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-k</option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg><option>-y</option></arg>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <arg choice="req">name</arg>

7e71f05d8643aca84914437c900cb716444507e4Tinderbox User </cmdsynopsis>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </refsynopsisdiv>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsect1>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <title>DESCRIPTION</title>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para><command>dnssec-keyfromlabel</command>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews gets keys with the given label from a crypto hardware and builds

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt key files for DNSSEC (Secure DNS), as defined in RFC 2535

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and RFC 4034.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The <option>name</option> of the key is specified on the command

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews line. This must match the name of the zone for which the key is

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt being generated.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </refsect1>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <refsect1>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <title>OPTIONS</title>

7e71f05d8643aca84914437c900cb716444507e4Tinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <variablelist>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-a <replaceable class="parameter">algorithm</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Selects the cryptographic algorithm. The value of

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <option>algorithm</option> must be one of RSAMD5, RSASHA1,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews These values are case insensitive.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If no algorithm is specified, then RSASHA1 will be used by

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt default, unless the <option>-3</option> option is specified,

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in which case NSEC3RSASHA1 will be used instead. (If

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <option>-3</option> is used and an algorithm is specified,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews that algorithm will be checked for compatibility with NSEC3.)

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </para>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews algorithm, and DSA is recommended.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <para>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Note 2: DH automatically sets the -k flag.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-3</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Use an NSEC3-capable algorithm to generate a DNSSEC key.

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If this option is used and no algorithm is explicitly

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews set on the command line, NSEC3RSASHA1 will be used by

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt default.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User <term>-E <replaceable class="parameter">engine</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User Specifies the name of the crypto hardware (OpenSSL engine).

b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User When compiled with PKCS#11 support it defaults to "pkcs11".

281ed127e3ed6c7e07792c19c3bc4562f71cfa90Tinderbox User </para>

281ed127e3ed6c7e07792c19c3bc4562f71cfa90Tinderbox User </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-l <replaceable class="parameter">label</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User Specifies the label of the key pair in the crypto hardware.

b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User The label may be preceded by an optional OpenSSL engine name,

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User separated by a colon, as in "pkcs11:keylabel".

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-n <replaceable class="parameter">nametype</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Specifies the owner type of the key. The value of

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <option>nametype</option> must either be ZONE (for a DNSSEC

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews a host (KEY)),

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User These values are case insensitive.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-C</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Compatibility mode: generates an old-style key, without

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews any metadata. By default, <command>dnssec-keyfromlabel</command>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User will include the key's creation date in the metadata stored

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User with the private key, and other dates may be set there as well

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt (publication date, activation date, etc). Keys that include

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt this data may be incompatible with older versions of BIND; the

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <option>-C</option> option suppresses them.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-c <replaceable class="parameter">class</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Indicates that the DNS record containing the key should have

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the specified class. If not specified, class IN is used.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-f <replaceable class="parameter">flag</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Set the specified flag in the flag field of the KEY/DNSKEY record.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The only recognized flags are KSK (Key Signing Key) and REVOKE.

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-G</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Generate a key, but do not publish it or sign with it. This

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt option is incompatible with -P and -A.

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-h</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Prints a short summary of the options and arguments to

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <command>dnssec-keyfromlabel</command>.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-K <replaceable class="parameter">directory</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Sets the directory in which the key files are to be written.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7e71f05d8643aca84914437c900cb716444507e4Tinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-k</term>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Generate KEY records rather than DNSKEY records.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-p <replaceable class="parameter">protocol</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Sets the protocol value for the key. The protocol

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews is a number between 0 and 255. The default is 3 (DNSSEC).

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Other possible values for this argument are listed in

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User RFC 2535 and its successors.

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </para>

7e71f05d8643aca84914437c900cb716444507e4Tinderbox User </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <term>-t <replaceable class="parameter">type</replaceable></term>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <para>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Indicates the use of the key. <option>type</option> must be

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User is AUTHCONF. AUTH refers to the ability to authenticate

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User data, and CONF the ability to encrypt data.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </varlistentry>

7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Sets the debugging level.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User </varlistentry>

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-y</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews <para>

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews Allows DNSSEC key files to be generated even if the key ID

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews would collide with that of an existing key, in the event of

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater either key being revoked. (This is only safe to use if you

9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater are sure you won't be using RFC 5011 trust anchor maintenance

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews with either of the keys involved.)

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

350e5eecadfc5ee72b11b2cc46828c9a0bcd717cTinderbox User </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </variablelist>

</refsect1>

<refsect1>

<title>TIMING OPTIONS</title>

<para>

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

If the argument begins with a '+' or '-', it is interpreted as

an offset from the present time. For convenience, if such an offset

is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

then the offset is computed in years (defined as 365 24-hour days,

ignoring leap years), months (defined as 30 24-hour days), weeks,

days, hours, or minutes, respectively. Without a suffix, the offset

is computed in seconds.

</para>

<variablelist>

<varlistentry>

<term>-P <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which a key is to be published to the zone.

After that date, the key will be included in the zone but will

not be used to sign it. If not set, and if the -G option has

not been used, the default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be activated. After that

date, the key will be included in the zone and used to sign

it. If not set, and if the -G option has not been used, the

default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be revoked. After that

date, the key will be flagged as revoked. It will be included

in the zone and will be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-U <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be retired. After that

date, the key will still be included in the zone, but it

will not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be deleted. After that

date, the key will no longer be included in the zone. (It

may remain in the key repository, however.)

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>GENERATED KEY FILES</title>

<para>

When <command>dnssec-keyfromlabel</command> completes

successfully,

it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>

to the standard output. This is an identification string for

the key files it has generated.

</para>

<itemizedlist>

<listitem>

<para><filename>nnnn</filename> is the key name.

</para>

</listitem>

<listitem>

<para><filename>aaa</filename> is the numeric representation

of the algorithm.

</para>

</listitem>

<listitem>

<para><filename>iiiii</filename> is the key identifier (or

footprint).

</para>

</listitem>

</itemizedlist>

<para><command>dnssec-keyfromlabel</command>

creates two files, with names based

on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>

contains the public key, and

<filename>Knnnn.+aaa+iiiii.private</filename> contains the

private key.

</para>

<para>

The <filename>.key</filename> file contains a DNS KEY record

that

can be inserted into a zone file (directly or with a $INCLUDE

statement).

</para>

<para>

The <filename>.private</filename> file contains

algorithm-specific

fields. For obvious security reasons, this file does not have

general read permission.

</para>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 4034</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--