0N/A<!
DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 0N/A [<!ENTITY mdash "—">]>
0N/A - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") 0N/A - Copyright (C) 2000-2003 Internet Software Consortium. 0N/A - Permission to use, copy, modify, and distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 0N/A - copyright notice and this permission notice appear in all copies. 0N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/A <
date>June 30, 2000</
date>
0N/A <
refentrytitle><
application>dnssec-keygen</
application></
refentrytitle>
0N/A <
manvolnum>8</
manvolnum>
0N/A <
refmiscinfo>BIND9</
refmiscinfo>
0N/A <
refname><
application>dnssec-keygen</
application></
refname>
0N/A <
refpurpose>DNSSEC key generation tool</
refpurpose>
0N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
0N/A <
holder>Internet Software Consortium.</
holder>
0N/A <
command>dnssec-keygen</
command>
0N/A <
arg choice="req">-a <
replaceable class="parameter">algorithm</
replaceable></
arg>
0N/A <
arg choice="req">-b <
replaceable class="parameter">keysize</
replaceable></
arg>
0N/A <
arg choice="req">-n <
replaceable class="parameter">nametype</
replaceable></
arg>
0N/A <
arg><
option>-c <
replaceable class="parameter">class</
replaceable></
option></
arg>
0N/A <
arg><
option>-e</
option></
arg>
0N/A <
arg><
option>-f <
replaceable class="parameter">flag</
replaceable></
option></
arg>
0N/A <
arg><
option>-g <
replaceable class="parameter">generator</
replaceable></
option></
arg>
0N/A <
arg><
option>-h</
option></
arg>
0N/A <
arg><
option>-k</
option></
arg>
0N/A <
arg><
option>-p <
replaceable class="parameter">protocol</
replaceable></
option></
arg>
0N/A <
arg><
option>-r <
replaceable class="parameter">randomdev</
replaceable></
option></
arg>
0N/A <
arg><
option>-s <
replaceable class="parameter">strength</
replaceable></
option></
arg>
0N/A <
arg><
option>-t <
replaceable class="parameter">type</
replaceable></
option></
arg>
0N/A <
arg><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
0N/A <
arg choice="req">name</
arg>
0N/A <
title>DESCRIPTION</
title>
0N/A <
para><
command>dnssec-keygen</
command>
0N/A generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
0N/A and RFC 4034. It can also generate keys for use with
0N/A TSIG (Transaction Signatures), as defined in RFC 2845.
0N/A <
title>OPTIONS</
title>
0N/A <
term>-a <
replaceable class="parameter">algorithm</
replaceable></
term>
0N/A Selects the cryptographic algorithm. The value of
0N/A <
option>algorithm</
option> must be one of RSAMD5 (RSA) or RSASHA1,
0N/A DSA, DH (Diffie Hellman), or HMAC-MD5. These values
0N/A are case insensitive.
0N/A Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
0N/A and DSA is recommended. For TSIG, HMAC-MD5 is mandatory.
0N/A Note 2: HMAC-MD5 and DH automatically set the -k flag.
0N/A <
term>-b <
replaceable class="parameter">keysize</
replaceable></
term>
0N/A Specifies the number of bits in the key. The choice of key
0N/A size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
0N/A 512 and 2048 bits. Diffie Hellman keys must be between
0N/A 128 and 4096 bits. DSA keys must be between 512 and 1024
0N/A bits and an exact multiple of 64. HMAC-MD5 keys must be
0N/A between 1 and 512 bits.
0N/A <
term>-n <
replaceable class="parameter">nametype</
replaceable></
term>
0N/A Specifies the owner type of the key. The value of
0N/A <
option>nametype</
option> must either be ZONE (for a DNSSEC
0N/A zone key (
KEY/
DNSKEY)), HOST or ENTITY (for a key associated with
0N/A USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
0N/A <
term>-c <
replaceable class="parameter">class</
replaceable></
term>
0N/A Indicates that the DNS record containing the key should have
0N/A the specified class. If not specified, class IN is used.
0N/A <
term>-f <
replaceable class="parameter">flag</
replaceable></
term>
0N/A Set the specified flag in the flag field of the
KEY/
DNSKEY record.
0N/A The only recognized flag is KSK (Key Signing Key) DNSKEY.
0N/A <
term>-g <
replaceable class="parameter">generator</
replaceable></
term>
0N/A If generating a Diffie Hellman key, use this generator.
0N/A Allowed values are 2 and 5. If no generator
0N/A is specified, a known prime from RFC 2539 will be used
0N/A if possible; otherwise the default is 2.
0N/A Prints a short summary of the options and arguments to
0N/A <
command>dnssec-keygen</
command>.
0N/A Generate KEY records rather than DNSKEY records.
0N/A <
term>-p <
replaceable class="parameter">protocol</
replaceable></
term>
0N/A Sets the protocol value for the generated key. The protocol
0N/A is a number between 0 and 255. The default is 3 (DNSSEC).
0N/A Other possible values for this argument are listed in
0N/A RFC 2535 and its successors.
0N/A <
term>-r <
replaceable class="parameter">randomdev</
replaceable></
term>
0N/A Specifies the source of randomness. If the operating
0N/A or equivalent device, the default source of randomness
0N/A is keyboard input. <
filename>randomdev</
filename>
0N/A the name of a character device or file containing random
0N/A data to be used instead of the default. The special value
0N/A <
filename>keyboard</
filename> indicates that keyboard
0N/A input should be used.
0N/A <
term>-s <
replaceable class="parameter">strength</
replaceable></
term>
0N/A Specifies the strength value of the key. The strength is
0N/A a number between 0 and 15, and currently has no defined
0N/A <
term>-t <
replaceable class="parameter">type</
replaceable></
term>
0N/A Indicates the use of the key. <
option>type</
option> must be
0N/A one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
0N/A is AUTHCONF. AUTH refers to the ability to authenticate
0N/A data, and CONF the ability to encrypt data.
0N/A <
term>-v <
replaceable class="parameter">level</
replaceable></
term>
0N/A Sets the debugging level.
0N/A <
title>GENERATED KEYS</
title>
0N/A When <
command>dnssec-keygen</
command> completes
0N/A it prints a string of the form <
filename>Knnnn.+aaa+iiiii</
filename>
0N/A to the standard output. This is an identification string for
0N/A the key it has generated.
0N/A <
para><
filename>nnnn</
filename> is the key name.
0N/A <
para><
filename>aaa</
filename> is the numeric representation
0N/A <
para><
filename>iiiii</
filename> is the key identifier (or
0N/A <
para><
command>dnssec-keygen</
command>
0N/A creates two files, with names based
0N/A on the printed string. <
filename>Knnnn.+aaa+
iiiii.key</
filename>
0N/A contains the public key, and
0N/A The <
filename>.key</
filename> file contains a DNS KEY record
0N/A can be inserted into a zone file (directly or with a $INCLUDE
0N/A The <
filename>.private</
filename> file contains
0N/A fields. For obvious security reasons, this file does not have
0N/A general read permission.
0N/A Both <
filename>.key</
filename> and <
filename>.private</
filename>
0N/A files are generated for symmetric encryption algorithms such as
0N/A HMAC-MD5, even though the public and private key are equivalent.
0N/A <
title>EXAMPLE</
title>
0N/A To generate a 768-bit DSA key for the domain
0N/A <
para><
userinput>dnssec-keygen -a DSA -b 768 -n ZONE
example.com</
userinput>
0N/A The command would print a string of the form:
0N/A In this example, <
command>dnssec-keygen</
command> creates
0N/A <
title>SEE ALSO</
title>
0N/A <
para><
citerefentry>
0N/A <
refentrytitle>dnssec-signzone</
refentrytitle><
manvolnum>8</
manvolnum>
0N/A <
citetitle>BIND 9 Administrator Reference Manual</
citetitle>,
0N/A <
citetitle>RFC 2535</
citetitle>,
0N/A <
citetitle>RFC 2845</
citetitle>,
0N/A <
citetitle>RFC 2539</
citetitle>.
0N/A <
title>AUTHOR</
title>
0N/A <
para><
corpauthor>Internet Systems Consortium</
corpauthor>