5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

b0e8629055a766d4555a005a283c2889a5974945Mark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews [<!ENTITY mdash "&#8212;">]>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<refentry id="man.dnssec-keygen">

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <date>June 30, 2000</date>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmeta>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refentrytitle><application>dnssec-keygen</application></refentrytitle>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <manvolnum>8</manvolnum>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmiscinfo>BIND9</refmiscinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refmeta>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refnamediv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refname><application>dnssec-keygen</application></refname>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refnamediv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <docinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2004</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2005</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2007</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2008</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2009</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2000</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2001</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2002</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2003</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <holder>Internet Software Consortium.</holder>

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews </copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </docinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <refsynopsisdiv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <cmdsynopsis>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <command>dnssec-keygen</command>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg ><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-3</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-C</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-e</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-G</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-h</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-k</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-z</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg choice="req">name</arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </cmdsynopsis>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refsynopsisdiv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsect1>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <title>DESCRIPTION</title>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para><command>dnssec-keygen</command>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews generates keys for DNSSEC (Secure DNS), as defined in RFC 2535

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews and RFC 4034. It can also generate keys for use with

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (Transaction Key) as defined in RFC 2930.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

2f8d63983c297c62630044d28a6f66676b4d339dMark Andrews The <option>name</option> of the key is specified on the command

2f8d63983c297c62630044d28a6f66676b4d339dMark Andrews line. For DNSSEC keys, this must match the name of the zone for

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews which the key is being generated.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refsect1>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsect1>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <title>OPTIONS</title>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <variablelist>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-a <replaceable class="parameter">algorithm</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Selects the cryptographic algorithm. For DNSSEC keys, the value

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews of <option>algorithm</option> must be one of RSAMD5, RSASHA1,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews DSA, NSEC3RSASHA1, or NSEC3DSA. For TSIG/TKEY, the value must

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews case insensitive.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If no algorithm is specified, then RSASHA1 will be used by

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews default, unless the <option>-3</option> option is specified,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in which case NSEC3RSASHA1 will be used instead.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews mandatory.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews automatically set the -T KEY option.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-b <replaceable class="parameter">keysize</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Specifies the number of bits in the key. The choice of key

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews between 512 and 2048 bits. Diffie Hellman keys must be between

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 128 and 4096 bits. DSA keys must be between 512 and 1024

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews bits and an exact multiple of 64. HMAC-MD5 keys must be

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews between 1 and 512 bits.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The key size does not need to be specified if using a default

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews algorithm. The default key size is 1024 bits for zone signing

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews keys (ZSK's) and 2048 bits for key signing keys (KSK's,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews generated with <option>-f KSK</option>). However, if an

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews algorithm is explicitly specified with the <option>-a</option>,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews then there is no default key size, and the <option>-b</option>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews must be used.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-n <replaceable class="parameter">nametype</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Specifies the owner type of the key. The value of

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <option>nametype</option> must either be ZONE (for a DNSSEC

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews a host (KEY)),

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews These values are case insensitive. Defaults to ZONE for DNSKEY

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews generation.

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-3</term>

90153b6536f7a5078e1c157c980110dbcd7fe205Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Use an NSEC3-capable algorithm to generate a DNSSEC key.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If this option is used and no algorithm is explicitly

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews set on the command line, NSEC3RSASHA1 will be used by

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews default.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-C</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews Compatibility mode: generates an old-style key, without

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews any metadata. By default, <command>dnssec-keygen</command>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews will include the key's creation date in the metadata stored

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews with the private key, and other dates may be set there as well

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (publication date, activation date, etc). Keys that include

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews this data may be incompatible with older versions of BIND; the

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <option>-C</option> option suppresses them.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-c <replaceable class="parameter">class</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <para>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews Indicates that the DNS record containing the key should have

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the specified class. If not specified, class IN is used.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-E <replaceable class="parameter">engine</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Uses a crypto hardware (OpenSSL engine) for random number

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews and, when supported, key generation. When compiled with PKCS#11

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews support it defaults to pcks11, the empty name resets it to

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews no engine.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-e</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If generating an RSAMD5/RSASHA1 key, use a large exponent.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <term>-f <replaceable class="parameter">flag</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Set the specified flag in the flag field of the KEY/DNSKEY record.

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews The only recognized flags are KSK (Key Signing Key) and REVOKE.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-G</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews Generate a key, but do not publish it or sign with it. This

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews option is incompatible with -P and -A.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-g <replaceable class="parameter">generator</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If generating a Diffie Hellman key, use this generator.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Allowed values are 2 and 5. If no generator

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews is specified, a known prime from RFC 2539 will be used

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews if possible; otherwise the default is 2.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews <varlistentry>

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews <term>-h</term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Prints a short summary of the options and arguments to

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <command>dnssec-keygen</command>.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

</listitem>

</varlistentry>

<varlistentry>

<term>-K <replaceable class="parameter">directory</replaceable></term>

<listitem>

<para>

Sets the directory in which the key files are to be written.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-k</term>

<listitem>

<para>

Deprecated in favor of -T KEY.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-p <replaceable class="parameter">protocol</replaceable></term>

<listitem>

<para>

Sets the protocol value for the generated key. The protocol

is a number between 0 and 255. The default is 3 (DNSSEC).

Other possible values for this argument are listed in

RFC 2535 and its successors.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-r <replaceable class="parameter">randomdev</replaceable></term>

<listitem>

<para>

Specifies the source of randomness. If the operating

system does not provide a <filename>/dev/random</filename>

or equivalent device, the default source of randomness

is keyboard input. <filename>randomdev</filename>

specifies

the name of a character device or file containing random

data to be used instead of the default. The special value

<filename>keyboard</filename> indicates that keyboard

input should be used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-s <replaceable class="parameter">strength</replaceable></term>

<listitem>

<para>

Specifies the strength value of the key. The strength is

a number between 0 and 15, and currently has no defined

purpose in DNSSEC.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-T <replaceable class="parameter">rrtype</replaceable></term>

<listitem>

<para>

Specifies the resource record type to use for the key.

<option>rrtype</option> must be either DNSKEY or KEY. The

default is DNSKEY when using a DNSSEC algorithm, but it can be

overridden to KEY for use with SIG(0).

<para>

</para>

Using any TSIG algorithm (HMAC-* or DH) forces this option

to KEY.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-t <replaceable class="parameter">type</replaceable></term>

<listitem>

<para>

Indicates the use of the key. <option>type</option> must be

one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default

is AUTHCONF. AUTH refers to the ability to authenticate

data, and CONF the ability to encrypt data.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-v <replaceable class="parameter">level</replaceable></term>

<listitem>

<para>

Sets the debugging level.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>TIMING OPTIONS</title>

<para>

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

If the argument begins with a '+' or '-', it is interpreted as

an offset from the present time. For convenience, if such an offset

is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

then the offset is computed in years (defined as 365 24-hour days,

ignoring leap years), months (defined as 30 24-hour days), weeks,

days, hours, or minutes, respectively. Without a suffix, the offset

is computed in seconds.

</para>

<variablelist>

<varlistentry>

<term>-P <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which a key is to be published to the zone.

After that date, the key will be included in the zone but will

not be used to sign it. If not set, and if the -G option has

not been used, the default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be activated. After that

date, the key will be included and the zone and used to sign

it. If not set, and if the -G option has not been used, the

default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be revoked. After that

date, the key will be flagged as revoked. It will be included

in the zone and will be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-I <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be retired. After that

date, the key will still be included in the zone, but it

will not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be deleted. After that

date, the key will no longer be included in the zone. (It

may remain in the key repository, however.)

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>GENERATED KEYS</title>

<para>

When <command>dnssec-keygen</command> completes

successfully,

it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>

to the standard output. This is an identification string for

the key it has generated.

</para>

<itemizedlist>

<listitem>

<para><filename>nnnn</filename> is the key name.

</para>

</listitem>

<listitem>

<para><filename>aaa</filename> is the numeric representation

of the

algorithm.

</para>

</listitem>

<listitem>

<para><filename>iiiii</filename> is the key identifier (or

footprint).

</para>

</listitem>

</itemizedlist>

<para><command>dnssec-keygen</command>

creates two files, with names based

on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>

contains the public key, and

<filename>Knnnn.+aaa+iiiii.private</filename> contains the

private

key.

</para>

<para>

The <filename>.key</filename> file contains a DNS KEY record

that

can be inserted into a zone file (directly or with a $INCLUDE

statement).

</para>

<para>

The <filename>.private</filename> file contains

algorithm-specific

fields. For obvious security reasons, this file does not have

general read permission.

</para>

<para>

Both <filename>.key</filename> and <filename>.private</filename>

files are generated for symmetric encryption algorithms such as

HMAC-MD5, even though the public and private key are equivalent.

</para>

</refsect1>

<refsect1>

<title>EXAMPLE</title>

<para>

To generate a 768-bit DSA key for the domain

<userinput>example.com</userinput>, the following command would be

issued:

</para>

<para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>

</para>

<para>

The command would print a string of the form:

</para>

<para><userinput>Kexample.com.+003+26160</userinput>

</para>

<para>

In this example, <command>dnssec-keygen</command> creates

the files <filename>Kexample.com.+003+26160.key</filename>

and

<filename>Kexample.com.+003+26160.private</filename>.

</para>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 2539</citetitle>,

<citetitle>RFC 2845</citetitle>,

<citetitle>RFC 4033</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--