dnssec-keygen.docbook revision 207cee019eb5cbbe7c905f7c52f7b5d11f8c0305
49fcdcd940274fedcb9cf943f0ee8144369527fdMark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
49fcdcd940274fedcb9cf943f0ee8144369527fdMark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
49fcdcd940274fedcb9cf943f0ee8144369527fdMark Andrews [<!ENTITY mdash "—">]>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - Copyright (C) 2004, 2005, 2007-2011 Internet Systems Consortium, Inc. ("ISC")
93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
600cbd1fcea3c9cc9706dc1ff8fc0d0034ebdeacTatuya JINMEI 神明達哉 - Permission to use, copy, modify, and/or distribute this software for any
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - purpose with or without fee is hereby granted, provided that the above
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - copyright notice and this permission notice appear in all copies.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d3fc633c344e15179480d887aeecf4a6263baeabMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
73d74334741756eab4a9afd8d3c4e7c08da9a844Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - PERFORMANCE OF THIS SOFTWARE.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉<!-- $Id: dnssec-keygen.docbook,v 1.38 2011/03/17 23:47:29 tbox Exp $ -->
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <refentryinfo>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </refentryinfo>
0b1da8124c817270f5dfe46cd0211b993c931a91Mark Andrews <refentrytitle><application>dnssec-keygen</application></refentrytitle>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <refname><application>dnssec-keygen</application></refname>
da34d92aeee25dedd6affd69623dc7d0aba2cc23Mark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>
2f025ec6fe68421d942330afaf1980b7a4976e30Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <refsynopsisdiv>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
0451757ad8f7c49a0d3dcdf7fbdd4ea64fcec298Mark Andrews <arg ><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
cc6271e46c775592f39a1e8b4e2cb1ff457e2f89Mark Andrews <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg>
a4b3e51a8f1c9742c0f7d9f7d70f1ad926985145Mark Andrews <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
c282d16311ce06b6bcb594be716cde4ad5c40af9Mark Andrews <arg><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
f488b1c311f2fc09ae8e45f7893185e608b17edeMark Andrews <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
4bb16c5856e5c6b05ac43c60f9f9376641bdcccfMark Andrews <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-S <replaceable class="parameter">key</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
c676c1b4978bfe2d00bdf5085fd44544067f9de4Mark Andrews <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
ffdfae8e4188c143297393f80f22134503372452Mark Andrews </cmdsynopsis>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </refsynopsisdiv>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 and RFC 4034. It can also generate keys for use with
743ffc91bdd462be6f91b3bab8f440c6a69f0770Mark Andrews TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 (Transaction Key) as defined in RFC 2930.
072e21c2bbf0907706b18a4a3857913e79d380fbMark Andrews The <option>name</option> of the key is specified on the command
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 line. For DNSSEC keys, this must match the name of the zone for
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 which the key is being generated.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <variablelist>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-a <replaceable class="parameter">algorithm</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Selects the cryptographic algorithm. For DNSSEC keys, the value
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512 or ECCGOST.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 case insensitive.
edfcbabd60f8479b72d91bcc2d2082a36ace4003Mark Andrews If no algorithm is specified, then RSASHA1 will be used by
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 default, unless the <option>-3</option> option is specified,
f95231835fdcd8d5f58486c9f9993602f27fe157Mark Andrews in which case NSEC3RSASHA1 will be used instead. (If
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <option>-3</option> is used and an algorithm is specified,
21f1794606dce19928cf455029e173321f166380Mark Andrews that algorithm will be checked for compatibility with NSEC3.)
0cb25226fba18befbe40156c93845f2fc9bf3524Mark Andrews Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
7a857bdb6828e75eec5a7080e4670ce199875922Mark Andrews Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 automatically set the -T KEY option.
a22f967b7e3589dab640d2cc65fd202d077a9d90Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
1a4d687359d89ff3b3e4e3f7acc4b6b8d8c982e9Mark Andrews <term>-b <replaceable class="parameter">keysize</replaceable></term>
051706a29a73416fbae116952dd6b6bdda765538Mark Andrews Specifies the number of bits in the key. The choice of key
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 size depends on the algorithm used. RSA keys must be
051706a29a73416fbae116952dd6b6bdda765538Mark Andrews between 512 and 2048 bits. Diffie Hellman keys must be between
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 128 and 4096 bits. DSA keys must be between 512 and 1024
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 bits and an exact multiple of 64. HMAC keys must be
f5af519ab547bc80c51387529103e4e852a1171eMark Andrews between 1 and 512 bits.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 The key size does not need to be specified if using a default
b0c2141b236832664119c9c7c647359b0c7fead4Mark Andrews algorithm. The default key size is 1024 bits for zone signing
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 keys (ZSK's) and 2048 bits for key signing keys (KSK's,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 generated with <option>-f KSK</option>). However, if an
182a34004c7c48e2c1626f3ce7e787f413955126Mark Andrews algorithm is explicitly specified with the <option>-a</option>,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 then there is no default key size, and the <option>-b</option>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
8ff31bab2f51b171a8eab3a0b8415c64529e116eMark Andrews <term>-n <replaceable class="parameter">nametype</replaceable></term>
07a849ba02aba7e8e869bc82c360fcc4b27eb009Mark Andrews Specifies the owner type of the key. The value of
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <option>nametype</option> must either be ZONE (for a DNSSEC
806c235ecf533b98d068b3f8df9d7abbe1e30cf9Mark Andrews zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 a host (KEY)),
935000aa6e2b9d08f363b2e698a258a458a5a7cfMark Andrews USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 These values are case insensitive. Defaults to ZONE for DNSKEY
2fd63cf561135572339d4e2ff0c06695e3dcf1baMark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Use an NSEC3-capable algorithm to generate a DNSSEC key.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 If this option is used and no algorithm is explicitly
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 set on the command line, NSEC3RSASHA1 will be used by
7ec0f55f1542d8bb9475bbe93e911d7520f043caMark Andrews default. Note that RSASHA256, RSASHA512 and ECCGOST algorithms
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 are NSEC3-capable.
ea6fe0d54f36754c195b3b8dac47c81f7993677eMark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
0c2509b0b9f9e455fa9d347d08f6ba9abd86d418Mark Andrews Compatibility mode: generates an old-style key, without
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 any metadata. By default, <command>dnssec-keygen</command>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 will include the key's creation date in the metadata stored
8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews with the private key, and other dates may be set there as well
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 (publication date, activation date, etc). Keys that include
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews this data may be incompatible with older versions of BIND; the
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <option>-C</option> option suppresses them.
6a2f7bba6f4df137ab3f781fe07b0b88e72e0b19Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-c <replaceable class="parameter">class</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Indicates that the DNS record containing the key should have
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 the specified class. If not specified, class IN is used.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-E <replaceable class="parameter">engine</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Uses a crypto hardware (OpenSSL engine) for random number
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 and, when supported, key generation. When compiled with PKCS#11
888bb8bf68ba1a2b032a64122efd9125a9155ad7Mark Andrews support it defaults to pkcs11; the empty name resets it to
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 If generating an RSAMD5/RSASHA1 key, use a large exponent.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
ee84964a7d29ae88769f67326a65256731769ea7Mark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-f <replaceable class="parameter">flag</replaceable></term>
ee84964a7d29ae88769f67326a65256731769ea7Mark Andrews Set the specified flag in the flag field of the KEY/DNSKEY record.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 The only recognized flags are KSK (Key Signing Key) and REVOKE.
c3ea698877cdde327f2bf6a8e97347798fead2d4Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Generate a key, but do not publish it or sign with it. This
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 option is incompatible with -P and -A.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-g <replaceable class="parameter">generator</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 If generating a Diffie Hellman key, use this generator.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Allowed values are 2 and 5. If no generator
22a9cd54c072545d13788ceead759911fe8cfe34Mark Andrews is specified, a known prime from RFC 2539 will be used
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 if possible; otherwise the default is 2.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Prints a short summary of the options and arguments to
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
a207a2835e37de52e11d4c143c0425e749409c46Mark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-K <replaceable class="parameter">directory</replaceable></term>
838d608e6f37038f2fb43980a7a9d6b6a490db36Mark Andrews Sets the directory in which the key files are to be written.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Deprecated in favor of -T KEY.
9bd478a5e6df956a79bbdb5c182d5b44763786ceMark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews <term>-L <replaceable class="parameter">ttl</replaceable></term>
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews Sets the default TTL to use for this key when it is converted
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 into a DNSKEY RR. If the key is imported into a zone,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 this is the TTL that will be used for it, unless there was
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews already a DNSKEY RRset in place, in which case the existing TTL
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 would take precedence. Setting the default TTL to
bf7f253e306d0ced8ae24d7a0598773950da11f4Mark Andrews <literal>0</literal> or <literal>none</literal> removes it.
051706a29a73416fbae116952dd6b6bdda765538Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-p <replaceable class="parameter">protocol</replaceable></term>
c86eed4bdecad9df12f992f9d743dfee3a6c5bdcMark Andrews Sets the protocol value for the generated key. The protocol
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 is a number between 0 and 255. The default is 3 (DNSSEC).
12ff7274fe2ea531ecca6a71fb9f7e1ae92da389Mark Andrews Other possible values for this argument are listed in
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 RFC 2535 and its successors.
767fd19da4b699aae46959d834f53af0e1166e80Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
5b76a09697bfc76f5acefd65d5b37b1214d271a8Mark Andrews Quiet mode: Suppresses unnecessary output, including
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 progress indication. Without this option, when
6388dcf8e661687c30a5d52f149d193ce86748a8Mark Andrews <command>dnssec-keygen</command> is run interactively
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 to generate an RSA or DSA key pair, it will print a string
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 of symbols to <filename>stderr</filename> indicating the
93e353425a81da7793dde3776f4caca658f57c11Mark Andrews progress of the key generation. A '.' indicates that a
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 random number has been found which passed an initial
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 sieve test; '+' means a number has passed a single
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 round of the Miller-Rabin primality test; a space
49a940dc68b30d9e4f9e1bd3c0503d8b90bb1726Mark Andrews means that the number has passed all the tests and is
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 a satisfactory key.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-r <replaceable class="parameter">randomdev</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Specifies the source of randomness. If the operating
1c75ea91cdb49dac65f0f592ddbf66bfdfc4a2d7Mark Andrews system does not provide a <filename>/dev/random</filename>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 or equivalent device, the default source of randomness
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 is keyboard input. <filename>randomdev</filename>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 the name of a character device or file containing random
99776003811a413457a2c35a808ad860df877d24Mark Andrews data to be used instead of the default. The special value
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <filename>keyboard</filename> indicates that keyboard
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 input should be used.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-S <replaceable class="parameter">key</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Create a new key which is an explicit successor to an
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 existing key. The name, algorithm, size, and type of the
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 key will be set to match the existing key. The activation
52fc1457e44c476a81ec9dee6a664958cb64b8e2Mark Andrews date of the new key will be set to the inactivation date of
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 the existing one. The publication date will be set to the
6526fd032fc418411da3af4201214e95c113d3e2Mark Andrews activation date minus the prepublication interval, which
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 defaults to 30 days.
757bf8a1e5d85806c648d7a6267da8d49a8ab822Tatuya JINMEI 神明達哉 </varlistentry>
be0e075ac2c10ade3e80edef7fa14ac0fda92690Mark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-s <replaceable class="parameter">strength</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Specifies the strength value of the key. The strength is
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 a number between 0 and 15, and currently has no defined
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 purpose in DNSSEC.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-T <replaceable class="parameter">rrtype</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Specifies the resource record type to use for the key.
ca70688bf60b4f50c4e3ec7d40567341c9962fafMark Andrews <option>rrtype</option> must be either DNSKEY or KEY. The
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 default is DNSKEY when using a DNSSEC algorithm, but it can be
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 overridden to KEY for use with SIG(0).
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Using any TSIG algorithm (HMAC-* or DH) forces this option
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-t <replaceable class="parameter">type</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Indicates the use of the key. <option>type</option> must be
75ace6601e66840436f52e61353ee0d400577b55Mark Andrews one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 is AUTHCONF. AUTH refers to the ability to authenticate
75ace6601e66840436f52e61353ee0d400577b55Mark Andrews data, and CONF the ability to encrypt data.
75ace6601e66840436f52e61353ee0d400577b55Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
ba4aec8c1853a1deda8eb43ffeaac4d764c8d39eMark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>
550085fed1d0af54ba5b2f588898afec158195deMark Andrews Sets the debugging level.
f411c2e81cbfcf89ee073a0e31ac902a42fc8f22Mark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </variablelist>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 If the argument begins with a '+' or '-', it is interpreted as
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 an offset from the present time. For convenience, if such an offset
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
1b5b46942d149f891bb91e90c6f52944b77c8a68Mark Andrews then the offset is computed in years (defined as 365 24-hour days,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 ignoring leap years), months (defined as 30 24-hour days), weeks,
6b25d2f7f7a1125508f8d225a8fef94e1db83555Mark Andrews days, hours, or minutes, respectively. Without a suffix, the offset
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 is computed in seconds.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <variablelist>
39fe146f2ab82cb8e49caa319a3345174fa2d69aMark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-P <replaceable class="parameter">date/offset</replaceable></term>
ab5d8edc1bd391a1b306db68114fac303484b30fMark Andrews Sets the date on which a key is to be published to the zone.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 After that date, the key will be included in the zone but will
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 not be used to sign it. If not set, and if the -G option has
8689f943a4859a8f68344236a1dcb81299a98347Mark Andrews not been used, the default is "now".
2434ccfde7efa30b6fedf4630e5036eeb5d647d0Mark Andrews </varlistentry>
d8ec783e6dc0bd16a80b30d9888306b1faae6037Mark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-A <replaceable class="parameter">date/offset</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Sets the date on which the key is to be activated. After that
8bcb0f297b50e80e3c7aab1a41b94d937acf4dc0Mark Andrews date, the key will be included in the zone and used to sign
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 it. If not set, and if the -G option has not been used, the
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 default is "now".
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-R <replaceable class="parameter">date/offset</replaceable></term>
1feb76edcbb8ee97d1757f73115b7c4a71de6e0eMark Andrews Sets the date on which the key is to be revoked. After that
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 date, the key will be flagged as revoked. It will be included
4c342614f80d867bba23e63795ec6ee79dd6395dMark Andrews in the zone and will be used to sign it.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <varlistentry>
6c6673405c7e29c1d91d07b326d0fe1d7b52e478Mark Andrews <term>-I <replaceable class="parameter">date/offset</replaceable></term>
bb6936058eb88eadff030462a347c10895c61a9aMark Andrews Sets the date on which the key is to be retired. After that
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 date, the key will still be included in the zone, but it
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 will not be used to sign it.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </varlistentry>
7c5d5a7932b8ac27281eeff64506dff8220bb3eaMark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-D <replaceable class="parameter">date/offset</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Sets the date on which the key is to be deleted. After that
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 date, the key will no longer be included in the zone. (It
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 may remain in the key repository, however.)
3cea35d9159b36eac43d32082a0b98f2cd82fc2eDanny Mayer </varlistentry>
53f1312c61fa8618852584bcdf9f35530282eb08Mark Andrews <varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <term>-i <replaceable class="parameter">interval</replaceable></term>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 Sets the prepublication interval for a key. If set, then
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 the publication and activation dates must be separated by at least
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 this much time. If the activation date is specified but the
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 publication date isn't, then the publication date will default
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 to this much time before the activation date; conversely, if
1431917c7cddbac7442cb910e83cb058fea59fb5Mark Andrews the publication date is specified but activation date isn't,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 then activation will be set to this much time after publication.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 If the key is being created as an explicit successor to another
012a2b979e011b13ba0d291c279dc65a167c039eMark Andrews key, then the default prepublication interval is 30 days;
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 otherwise it is zero.
ec3984e9df6fd9b7811daa0dacb1b3dd1423ebf3Mark Andrews As with date offsets, if the argument is followed by one of
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 interval is measured in years, months, weeks, days, hours,
b972ff033b3efd52e747683face674dc4d2e431bMark Andrews or minutes, respectively. Without a suffix, the interval is
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 measured in seconds.
f0471ca4b7bca6e907130ec84e36cf69f2b79a5aMark Andrews </varlistentry>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </variablelist>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 When <command>dnssec-keygen</command> completes
051706a29a73416fbae116952dd6b6bdda765538Mark Andrews successfully,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 to the standard output. This is an identification string for
0b75a2dd3bd81a69e2d68fe446cacb46be04c1f1Mark Andrews the key it has generated.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <itemizedlist>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <para><filename>nnnn</filename> is the key name.
4d9f3f00d93fcb8743b1105e8cf82e862be220d1Mark Andrews <para><filename>aaa</filename> is the numeric representation
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <para><filename>iiiii</filename> is the key identifier (or
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </itemizedlist>
320d6ee24ea59c0dbcb2c08038586ef03c6a191dMark Andrews creates two files, with names based
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 contains the public key, and
475fe52dc33d8d8344e8b1e48fa7bb6643f7ca66Mark Andrews <filename>Knnnn.+aaa+iiiii.private</filename> contains the
0f8f42a09eb102fa88e4d2caacdafbeda931f94cMark Andrews The <filename>.key</filename> file contains a DNS KEY record
8d77066ba0feb1353a7c85f929c365c5103f3976Mark Andrews can be inserted into a zone file (directly or with a $INCLUDE
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 The <filename>.private</filename> file contains
3e7b37e01ba3efc873486140734fd24788092a30Mark Andrews algorithm-specific
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 fields. For obvious security reasons, this file does not have
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 general read permission.
020f7361a49c5b1cda91927cf8206c1283fc7496Mark Andrews Both <filename>.key</filename> and <filename>.private</filename>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 files are generated for symmetric encryption algorithms such as
1c0927d8a091effcf9b2dc5baa533927c113bd5cMark Andrews HMAC-MD5, even though the public and private key are equivalent.
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 To generate a 768-bit DSA key for the domain
33c538015323f4576679e427088372eea614feebMark Andrews <userinput>example.com</userinput>, the following command would be
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 The command would print a string of the form:
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <para><userinput>Kexample.com.+003+26160</userinput>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 In this example, <command>dnssec-keygen</command> creates
051706a29a73416fbae116952dd6b6bdda765538Mark Andrews the files <filename>Kexample.com.+003+26160.key</filename>
0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews <filename>Kexample.com.+003+26160.private</filename>.
93da96c1cfd5f3c47169855867dd18db00c8a386Mark Andrews <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 </citerefentry>,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 <para><corpauthor>Internet Systems Consortium</corpauthor>
54f68aeb5cb37e48df51dc5224917beaeda040cfTatuya JINMEI 神明達哉 - Local variables: