dnssec-keygen.docbook revision f5d30e2864e048a42c4dc1134993ae7efdb5d6c3
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
c78c39caab4cf8b5daefc9c65878f7f5ed3eb7a0Tinderbox User [<!ENTITY mdash "—">]>
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
7c1468ed500356839a4a222517364e6ce18cb1a2Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews - Permission to use, copy, modify, and distribute this software for any
287a6a8f9040dc43560cd69cddf83bfc0f53b76fTinderbox User - purpose with or without fee is hereby granted, provided that the above
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - copyright notice and this permission notice appear in all copies.
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<!-- $Id: dnssec-keygen.docbook,v 1.12 2005/05/13 01:35:39 marka Exp $ -->
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews <refentryinfo>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </refentryinfo>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <refentrytitle><application>dnssec-keygen</application></refentrytitle>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <refnamediv>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <refname><application>dnssec-keygen</application></refname>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </refnamediv>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews </copyright>
16f6050f29b6b0422cee858e609f65e474e70ef2Tinderbox User <holder>Internet Software Consortium.</holder>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <refsynopsisdiv>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt <cmdsynopsis>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <arg choice="req">-a <replaceable class="parameter">algorithm</replaceable></arg>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <arg choice="req">-b <replaceable class="parameter">keysize</replaceable></arg>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <arg choice="req">-n <replaceable class="parameter">nametype</replaceable></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
16f6050f29b6b0422cee858e609f65e474e70ef2Tinderbox User <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews </cmdsynopsis>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews </refsynopsisdiv>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt and RFC <TBA\>. It can also generate keys for use with
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt TSIG (Transaction Signatures), as defined in RFC 2845.
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt <variablelist>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt <varlistentry>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt <term>-a <replaceable class="parameter">algorithm</replaceable></term>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Selects the cryptographic algorithm. The value of
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User <option>algorithm</option> must be one of RSAMD5 (RSA) or RSASHA1,
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User DSA, DH (Diffie Hellman), or HMAC-MD5. These values
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews are case insensitive.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews and DSA is recommended. For TSIG, HMAC-MD5 is mandatory.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Note 2: HMAC-MD5 and DH automatically set the -k flag.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </varlistentry>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <term>-b <replaceable class="parameter">keysize</replaceable></term>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Specifies the number of bits in the key. The choice of key
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User 512 and 2048 bits. Diffie Hellman keys must be between
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 128 and 4096 bits. DSA keys must be between 512 and 1024
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User bits and an exact multiple of 64. HMAC-MD5 keys must be
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson between 1 and 512 bits.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </varlistentry>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <varlistentry>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <term>-n <replaceable class="parameter">nametype</replaceable></term>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Specifies the owner type of the key. The value of
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <option>nametype</option> must either be ZONE (for a DNSSEC
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews a host (KEY)),
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User These values are
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User case insensitive.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User </varlistentry>
fd972434c29fc1169d66594e4cc7697d33036c2bTinderbox User <varlistentry>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont <term>-c <replaceable class="parameter">class</replaceable></term>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Indicates that the DNS record containing the key should have
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the specified class. If not specified, class IN is used.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews </varlistentry>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <varlistentry>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User If generating an RSAMD5/RSASHA1 key, use a large exponent.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews </varlistentry>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <varlistentry>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <term>-f <replaceable class="parameter">flag</replaceable></term>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Set the specified flag in the flag field of the KEY/DNSKEY record.
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews The only recognized flag is KSK (Key Signing Key) DNSKEY.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <varlistentry>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <term>-g <replaceable class="parameter">generator</replaceable></term>
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater If generating a Diffie Hellman key, use this generator.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Allowed values are 2 and 5. If no generator
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is specified, a known prime from RFC 2539 will be used
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User if possible; otherwise the default is 2.
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User </varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <varlistentry>
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater Prints a short summary of the options and arguments to
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews </varlistentry>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Generate KEY records rather than DNSKEY records.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </varlistentry>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <term>-p <replaceable class="parameter">protocol</replaceable></term>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Sets the protocol value for the generated key. The protocol
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is a number between 0 and 255. The default is 3 (DNSSEC).
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Other possible values for this argument are listed in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews RFC 2535 and its successors.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User </varlistentry>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <varlistentry>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <term>-r <replaceable class="parameter">randomdev</replaceable></term>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Specifies the source of randomness. If the operating
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews system does not provide a <filename>/dev/random</filename>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User or equivalent device, the default source of randomness
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is keyboard input. <filename>randomdev</filename>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the name of a character device or file containing random
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews data to be used instead of the default. The special value
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews <filename>keyboard</filename> indicates that keyboard
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User input should be used.
933799f3641f4f78445d015008bad0038900a82aTinderbox User </varlistentry>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews <varlistentry>
7ca715ad1587a68a531ea1cdea07515d7232567eTinderbox User <term>-s <replaceable class="parameter">strength</replaceable></term>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies the strength value of the key. The strength is
bac4435d473c9a0281507524f084480c34aa942aTinderbox User a number between 0 and 15, and currently has no defined
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews purpose in DNSSEC.
933799f3641f4f78445d015008bad0038900a82aTinderbox User </varlistentry>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <varlistentry>
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater <term>-t <replaceable class="parameter">type</replaceable></term>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Indicates the use of the key. <option>type</option> must be
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is AUTHCONF. AUTH refers to the ability to authenticate
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews data, and CONF the ability to encrypt data.
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User </varlistentry>
933799f3641f4f78445d015008bad0038900a82aTinderbox User <varlistentry>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <term>-v <replaceable class="parameter">level</replaceable></term>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater Sets the debugging level.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater </varlistentry>
39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User </variablelist>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When <command>dnssec-keygen</command> completes
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to the standard output. This is an identification string for
4cda4fd158d6ded5586bacea8c388445d99611eaAutomatic Updater the key it has generated. These strings can be used as arguments
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <itemizedlist>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <para><filename>nnnn</filename> is the key name.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User <para><filename>aaa</filename> is the numeric representation
933799f3641f4f78445d015008bad0038900a82aTinderbox User <para><filename>iiiii</filename> is the key identifier (or
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User </itemizedlist>
757ff043760e4743dda1a10e7d58349275934902Tinderbox User creates two file, with names based
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User contains the public key, and
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews <filename>Knnnn.+aaa+iiiii.private</filename> contains the
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson The <filename>.key</filename> file contains a DNS KEY record
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews can be inserted into a zone file (directly or with a $INCLUDE
bac4435d473c9a0281507524f084480c34aa942aTinderbox User The <filename>.private</filename> file contains algorithm
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User fields. For obvious security reasons, this file does not have
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User general read permission.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Both <filename>.key</filename> and <filename>.private</filename>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User files are generated for symmetric encryption algorithm such as
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews HMAC-MD5, even though the public and private key are equivalent.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User To generate a 768-bit DSA key for the domain
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <userinput>example.com</userinput>, the following command would be
dcad2ea9d36f03b1e5dbec881478dfa4aaed1bc0Tinderbox User <para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The command would print a string of the form:
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <para><userinput>Kexample.com.+003+26160</userinput>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews In this example, <command>dnssec-keygen</command> creates
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews the files <filename>Kexample.com.+003+26160.key</filename>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <filename>Kexample.com.+003+26160.private</filename>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater </citerefentry>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <para><corpauthor>Internet Systems Consortium</corpauthor>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - Local variables:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews - mode: sgml