dnssec-keygen.docbook revision b0c15bd9792112fb47f6d956e580e4369e92f4e7
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2001, 2002 Internet Software Consortium.
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User - Permission to use, copy, modify, and distribute this software for any
ba9e87b35e561bc7354ce3f4b9685b747b7be507Tinderbox User - purpose with or without fee is hereby granted, provided that the above
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews - copyright notice and this permission notice appear in all copies.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
59663800d2ec04777dae2791dd92aa563faf94c8Evan Hunt - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
1ca2cf024391992fe14b2df7d3ae0f575d074452Evan Hunt - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
0726d872f6f36901ea09321df57084614e5bb6faTinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
1ca2cf024391992fe14b2df7d3ae0f575d074452Evan Hunt - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<!-- $Id: dnssec-keygen.docbook,v 1.6 2003/01/18 02:40:58 marka Exp $ -->
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <refentryinfo>
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews </refentryinfo>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <refentrytitle><application>dnssec-keygen</application></refentrytitle>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <refnamediv>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <refname><application>dnssec-keygen</application></refname>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User </refnamediv>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <refsynopsisdiv>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews <cmdsynopsis>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <arg choice="req">-a <replaceable class="parameter">algorithm</replaceable></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg choice="req">-b <replaceable class="parameter">keysize</replaceable></arg>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <arg choice="req">-n <replaceable class="parameter">nametype</replaceable></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews </cmdsynopsis>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews </refsynopsisdiv>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt <command>dnssec-keygen</command> generates keys for DNSSEC
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (Secure DNS), as defined in RFC 2535. It can also generate
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews keys for use with TSIG (Transaction Signatures), as
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defined in RFC 2845.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <variablelist>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <term>-a <replaceable class="parameter">algorithm</replaceable></term>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Selects the cryptographic algorithm. The value of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <option>algorithm</option> must be one of RSAMD5 or RSA,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews DSA, DH (Diffie Hellman), or HMAC-MD5. These values
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews are case insensitive.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User Note that for DNSSEC, DSA is a mandatory to implement algorithm,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and RSA is recommended. For TSIG, HMAC-MD5 is mandatory.
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews </varlistentry>
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User <varlistentry>
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews <term>-b <replaceable class="parameter">keysize</replaceable></term>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews Specifies the number of bits in the key. The choice of key
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews size depends on the algorithm used. RSA keys must be between
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User 512 and 2048 bits. Diffie Hellman keys must be between
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt 128 and 4096 bits. DSA keys must be between 512 and 1024
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User bits and an exact multiple of 64. HMAC-MD5 keys must be
3ccf87473f7cf6d9faac156df38a935a238f96fdTinderbox User between 1 and 512 bits.
551e6d2414c4f47d58a9bb0b37f206f915a4f5acTinderbox User </varlistentry>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <varlistentry>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <term>-n <replaceable class="parameter">nametype</replaceable></term>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Specifies the owner type of the key. The value of
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User <option>nametype</option> must either be ZONE (for a DNSSEC
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews zone key), HOST or ENTITY (for a key associated with a host),
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User or USER (for a key associated with a user). These values are
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User case insensitive.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson </varlistentry>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <varlistentry>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <term>-c <replaceable class="parameter">class</replaceable></term>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews Indicates that the DNS record containing the key should have
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the specified class. If not specified, class IN is used.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews </varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews If generating an RSA key, use a large exponent.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews </varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <varlistentry>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <term>-f <replaceable class="parameter">flag</replaceable></term>
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User Set the specified flag in the flag field of the key record.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The only recognized flag is KSK (Key Signing Key).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews </varlistentry>
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews <varlistentry>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont <term>-g <replaceable class="parameter">generator</replaceable></term>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont If generating a Diffie Hellman key, use this generator.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Allowed values are 2 and 5. If no generator
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User is specified, a known prime from RFC 2539 will be used
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews if possible; otherwise the default is 2.
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User </varlistentry>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <varlistentry>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Prints a short summary of the options and arguments to
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews </varlistentry>
b625bdae12277225b076a002dd4af80902529181Tinderbox User <varlistentry>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <term>-p <replaceable class="parameter">protocol</replaceable></term>
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User Sets the protocol value for the generated key. The protocol
415d630b6309922caee8469384a6fab75cf05032Mark Andrews is a number between 0 and 255. The default is 3 (DNSSEC).
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater Other possible values for this argument are listed in
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews RFC 2535 and its successors.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews </varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <varlistentry>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <term>-r <replaceable class="parameter">randomdev</replaceable></term>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews Specifies the source of randomness. If the operating
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User system does not provide a <filename>/dev/random</filename>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews or equivalent device, the default source of randomness
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews is keyboard input. <filename>randomdev</filename> specifies
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User the name of a character device or file containing random
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews data to be used instead of the default. The special value
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <filename>keyboard</filename> indicates that keyboard
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater input should be used.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User </varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <varlistentry>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <term>-s <replaceable class="parameter">strength</replaceable></term>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User Specifies the strength value of the key. The strength is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a number between 0 and 15, and currently has no defined
415d630b6309922caee8469384a6fab75cf05032Mark Andrews purpose in DNSSEC.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews </varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <term>-t <replaceable class="parameter">type</replaceable></term>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Indicates the use of the key. <option>type</option> must be
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is AUTHCONF. AUTH refers to the ability to authenticate
415d630b6309922caee8469384a6fab75cf05032Mark Andrews data, and CONF the ability to encrypt data.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews </varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <varlistentry>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Sets the debugging level.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User </varlistentry>
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User </variablelist>
fab54780409846f7c71f6026d665f18c77c649efTinderbox User When <command>dnssec-keygen</command> completes successfully,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User to the standard output. This is an identification string for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the key it has generated. These strings can be used as arguments
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <itemizedlist>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <filename>aaa</filename> is the numeric representation of the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <filename>iiiii</filename> is the key identifier (or footprint).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews </itemizedlist>
c317b09bf112121245fafe61f38b95dc6e96acabTinderbox User <command>dnssec-keygen</command> creates two file, with names based
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews contains the public key, and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <filename>Knnnn.+aaa+iiiii.private</filename> contains the private
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <filename>.key</filename> file contains a DNS KEY record that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews can be inserted into a zone file (directly or with a $INCLUDE
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <filename>.private</filename> file contains algorithm specific
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews fields. For obvious security reasons, this file does not have
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews general read permission.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Both <filename>.key</filename> and <filename>.private</filename>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews files are generated for symmetric encryption algorithm such as
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews HMAC-MD5, even though the public and private key are equivalent.
2b7254075b883d70852a2757210793603085a0f1Tinderbox User To generate a 768-bit DSA key for the domain
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <userinput>example.com</userinput>, the following command would be
e5c7ef08d1bf9f8388de8174a47da78b9eeb7e5cTinderbox User <userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
2ca9cf1582ae972f8edc2b03bd846973b05dee6bTinderbox User The command would print a string of the form:
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User <userinput>Kexample.com.+003+26160</userinput>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews In this example, <command>dnssec-keygen</command> creates
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the files <filename>Kexample.com.+003+26160.key</filename> and
076e51f1ff9497ae61a99994189ed8bf5a0d3472Tinderbox User <filename>Kexample.com.+003+26160.private</filename>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <citerefentry>
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User <refentrytitle>dnssec-makekeyset</refentrytitle>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User </citerefentry>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <citerefentry>
8ac5ddf659a81ed668579818981fc1a5f28405d1Tinderbox User <refentrytitle>dnssec-signkey</refentrytitle>
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User </citerefentry>,
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt <citerefentry>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <refentrytitle>dnssec-signzone</refentrytitle>
3857cb6fcabeb79d85de4b3e3e4ab99912b701f8Mark Andrews </citerefentry>,
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <corpauthor>Internet Software Consortium</corpauthor>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont - Local variables:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - mode: sgml