dnssec-keygen.docbook revision 704e6c8876907aac0bf7380effca8bca400d4acd
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major<!--
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major - Copyright (C) 2000-2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major -
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major - This Source Code Form is subject to the terms of the Mozilla Public
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major - License, v. 2.0. If a copy of the MPL was not distributed with this
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major - file, You can obtain one at http://mozilla.org/MPL/2.0/.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major-->
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major<!-- Converted by db4-upgrade version 1.0 -->
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-keygen">
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <info>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <date>2014-02-06</date>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </info>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refentryinfo>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <date>August 21, 2015</date>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <corpname>ISC</corpname>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </refentryinfo>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refmeta>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refentrytitle><application>dnssec-keygen</application></refentrytitle>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <manvolnum>8</manvolnum>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refmiscinfo>BIND9</refmiscinfo>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </refmeta>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refnamediv>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refname><application>dnssec-keygen</application></refname>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refpurpose>DNSSEC key generation tool</refpurpose>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </refnamediv>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <docinfo>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <copyright>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2000</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2001</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2002</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2003</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2004</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2005</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2007</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2008</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2009</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2010</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2011</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2012</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2014</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2015</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <year>2016</year>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </copyright>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </docinfo>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refsynopsisdiv>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <cmdsynopsis sepchar=" ">
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <command>dnssec-keygen</command>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-3</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-C</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-G</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-g <replaceable class="parameter">generator</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-h</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-k</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-q</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-V</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="opt" rep="norepeat"><option>-z</option></arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <arg choice="req" rep="norepeat">name</arg>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </cmdsynopsis>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </refsynopsisdiv>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refsection><info><title>DESCRIPTION</title></info>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para><command>dnssec-keygen</command>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major and RFC 4034. It can also generate keys for use with
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major (Transaction Key) as defined in RFC 2930.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major The <option>name</option> of the key is specified on the command
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major line. For DNSSEC keys, this must match the name of the zone for
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major which the key is being generated.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </refsection>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <refsection><info><title>OPTIONS</title></info>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <variablelist>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-a <replaceable class="parameter">algorithm</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Selects the cryptographic algorithm. For DNSSEC keys, the value
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major ECDSAP256SHA256 or ECDSAP384SHA384.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major For TSIG/TKEY, the value must
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major case insensitive.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major If no algorithm is specified, then RSASHA1 will be used by
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major default, unless the <option>-3</option> option is specified,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major in which case NSEC3RSASHA1 will be used instead. (If
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <option>-3</option> is used and an algorithm is specified,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major that algorithm will be checked for compatibility with NSEC3.)
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major mandatory.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major automatically set the -T KEY option.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-b <replaceable class="parameter">keysize</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Specifies the number of bits in the key. The choice of key
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major size depends on the algorithm used. RSA keys must be
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major between 512 and 2048 bits. Diffie Hellman keys must be between
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major 128 and 4096 bits. DSA keys must be between 512 and 1024
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major bits and an exact multiple of 64. HMAC keys must be
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major between 1 and 512 bits. Elliptic curve algorithms don't need
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major this parameter.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major The key size does not need to be specified if using a default
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major algorithm. The default key size is 1024 bits for zone signing
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major keys (ZSKs) and 2048 bits for key signing keys (KSKs,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major generated with <option>-f KSK</option>). However, if an
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major algorithm is explicitly specified with the <option>-a</option>,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major then there is no default key size, and the <option>-b</option>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major must be used.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-n <replaceable class="parameter">nametype</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Specifies the owner type of the key. The value of
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <option>nametype</option> must either be ZONE (for a DNSSEC
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major a host (KEY)),
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major These values are case insensitive. Defaults to ZONE for DNSKEY
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major generation.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-3</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Use an NSEC3-capable algorithm to generate a DNSSEC key.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major If this option is used and no algorithm is explicitly
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major set on the command line, NSEC3RSASHA1 will be used by
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major default. Note that RSASHA256, RSASHA512, ECCGOST,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major are NSEC3-capable.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-C</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Compatibility mode: generates an old-style key, without
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major any metadata. By default, <command>dnssec-keygen</command>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major will include the key's creation date in the metadata stored
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major with the private key, and other dates may be set there as well
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major (publication date, activation date, etc). Keys that include
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major this data may be incompatible with older versions of BIND; the
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <option>-C</option> option suppresses them.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-c <replaceable class="parameter">class</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Indicates that the DNS record containing the key should have
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major the specified class. If not specified, class IN is used.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-E <replaceable class="parameter">engine</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Specifies the cryptographic hardware to use, when applicable.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major When BIND is built with OpenSSL PKCS#11 support, this defaults
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major to the string "pkcs11", which identifies an OpenSSL engine
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major that can drive a cryptographic accelerator or hardware service
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major module. When BIND is built with native PKCS#11 cryptography
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major (--enable-native-pkcs11), it defaults to the path of the PKCS#11
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major provider library specified via "--with-pkcs11".
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-f <replaceable class="parameter">flag</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Set the specified flag in the flag field of the KEY/DNSKEY record.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major The only recognized flags are KSK (Key Signing Key) and REVOKE.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-G</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Generate a key, but do not publish it or sign with it. This
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major option is incompatible with -P and -A.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-g <replaceable class="parameter">generator</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major If generating a Diffie Hellman key, use this generator.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Allowed values are 2 and 5. If no generator
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major is specified, a known prime from RFC 2539 will be used
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major if possible; otherwise the default is 2.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-h</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Prints a short summary of the options and arguments to
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <command>dnssec-keygen</command>.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-K <replaceable class="parameter">directory</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Sets the directory in which the key files are to be written.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-k</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Deprecated in favor of -T KEY.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-L <replaceable class="parameter">ttl</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Sets the default TTL to use for this key when it is converted
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major into a DNSKEY RR. If the key is imported into a zone,
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major this is the TTL that will be used for it, unless there was
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major already a DNSKEY RRset in place, in which case the existing TTL
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major would take precedence. If this value is not set and there
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major is no existing DNSKEY RRset, the TTL will default to the
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major SOA TTL. Setting the default TTL to <literal>0</literal>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major or <literal>none</literal> is the same as leaving it unset.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-p <replaceable class="parameter">protocol</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Sets the protocol value for the generated key. The protocol
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major is a number between 0 and 255. The default is 3 (DNSSEC).
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Other possible values for this argument are listed in
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major RFC 2535 and its successors.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-q</term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Quiet mode: Suppresses unnecessary output, including
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major progress indication. Without this option, when
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <command>dnssec-keygen</command> is run interactively
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major to generate an RSA or DSA key pair, it will print a string
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major of symbols to <filename>stderr</filename> indicating the
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major progress of the key generation. A '.' indicates that a
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major random number has been found which passed an initial
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major sieve test; '+' means a number has passed a single
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major round of the Miller-Rabin primality test; a space
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major means that the number has passed all the tests and is
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major a satisfactory key.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-r <replaceable class="parameter">randomdev</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Specifies the source of randomness. If the operating
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major system does not provide a <filename>/dev/random</filename>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major or equivalent device, the default source of randomness
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major is keyboard input. <filename>randomdev</filename>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major specifies
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major the name of a character device or file containing random
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major data to be used instead of the default. The special value
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <filename>keyboard</filename> indicates that keyboard
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major input should be used.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-S <replaceable class="parameter">key</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Create a new key which is an explicit successor to an
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major existing key. The name, algorithm, size, and type of the
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major key will be set to match the existing key. The activation
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major date of the new key will be set to the inactivation date of
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major the existing one. The publication date will be set to the
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major activation date minus the prepublication interval, which
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major defaults to 30 days.
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major </varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <varlistentry>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <term>-s <replaceable class="parameter">strength</replaceable></term>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <listitem>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major <para>
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major Specifies the strength value of the key. The strength is
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major a number between 0 and 15, and currently has no defined
fb379c70e3fd8a537f311b99be4759ae41e02750Peter Major purpose in DNSSEC.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-T <replaceable class="parameter">rrtype</replaceable></term>
<listitem>
<para>
Specifies the resource record type to use for the key.
<option>rrtype</option> must be either DNSKEY or KEY. The
default is DNSKEY when using a DNSSEC algorithm, but it can be
overridden to KEY for use with SIG(0).
<para>
</para>
Using any TSIG algorithm (HMAC-* or DH) forces this option
to KEY.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-t <replaceable class="parameter">type</replaceable></term>
<listitem>
<para>
Indicates the use of the key. <option>type</option> must be
one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
is AUTHCONF. AUTH refers to the ability to authenticate
data, and CONF the ability to encrypt data.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-v <replaceable class="parameter">level</replaceable></term>
<listitem>
<para>
Sets the debugging level.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-V</term>
<listitem>
<para>
Prints version information.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsection>
<refsection><info><title>TIMING OPTIONS</title></info>
<para>
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
an offset from the present time. For convenience, if such an offset
is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
then the offset is computed in years (defined as 365 24-hour days,
ignoring leap years), months (defined as 30 24-hour days), weeks,
days, hours, or minutes, respectively. Without a suffix, the offset
is computed in seconds. To explicitly prevent a date from being
set, use 'none' or 'never'.
</para>
<variablelist>
<varlistentry>
<term>-P <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which a key is to be published to the zone.
After that date, the key will be included in the zone but will
not be used to sign it. If not set, and if the -G option has
not been used, the default is "now".
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which CDS and CDNSKEY records that match this
key are to be published to the zone.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-A <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which the key is to be activated. After that
date, the key will be included in the zone and used to sign
it. If not set, and if the -G option has not been used, the
default is "now". If set, if and -P is not set, then
the publication date will be set to the activation date
minus the prepublication interval.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-R <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which the key is to be revoked. After that
date, the key will be flagged as revoked. It will be included
in the zone and will be used to sign it.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-I <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which the key is to be retired. After that
date, the key will still be included in the zone, but it
will not be used to sign it.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-D <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which the key is to be deleted. After that
date, the key will no longer be included in the zone. (It
may remain in the key repository, however.)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
<listitem>
<para>
Sets the date on which the CDS and CDNSKEY records that match this
key are to be deleted.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-i <replaceable class="parameter">interval</replaceable></term>
<listitem>
<para>
Sets the prepublication interval for a key. If set, then
the publication and activation dates must be separated by at least
this much time. If the activation date is specified but the
publication date isn't, then the publication date will default
to this much time before the activation date; conversely, if
the publication date is specified but activation date isn't,
then activation will be set to this much time after publication.
</para>
<para>
If the key is being created as an explicit successor to another
key, then the default prepublication interval is 30 days;
otherwise it is zero.
</para>
<para>
As with date offsets, if the argument is followed by one of
the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
interval is measured in years, months, weeks, days, hours,
or minutes, respectively. Without a suffix, the interval is
measured in seconds.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsection>
<refsection><info><title>GENERATED KEYS</title></info>
<para>
When <command>dnssec-keygen</command> completes
successfully,
it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
to the standard output. This is an identification string for
the key it has generated.
</para>
<itemizedlist>
<listitem>
<para><filename>nnnn</filename> is the key name.
</para>
</listitem>
<listitem>
<para><filename>aaa</filename> is the numeric representation
of the
algorithm.
</para>
</listitem>
<listitem>
<para><filename>iiiii</filename> is the key identifier (or
footprint).
</para>
</listitem>
</itemizedlist>
<para><command>dnssec-keygen</command>
creates two files, with names based
on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>
contains the public key, and
<filename>Knnnn.+aaa+iiiii.private</filename> contains the
private
key.
</para>
<para>
The <filename>.key</filename> file contains a DNS KEY record
that
can be inserted into a zone file (directly or with a $INCLUDE
statement).
</para>
<para>
The <filename>.private</filename> file contains
algorithm-specific
fields. For obvious security reasons, this file does not have
general read permission.
</para>
<para>
Both <filename>.key</filename> and <filename>.private</filename>
files are generated for symmetric cryptography algorithms such as
HMAC-MD5, even though the public and private key are equivalent.
</para>
</refsection>
<refsection><info><title>EXAMPLE</title></info>
<para>
To generate a 768-bit DSA key for the domain
<userinput>example.com</userinput>, the following command would be
issued:
</para>
<para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
</para>
<para>
The command would print a string of the form:
</para>
<para><userinput>Kexample.com.+003+26160</userinput>
</para>
<para>
In this example, <command>dnssec-keygen</command> creates
the files <filename>Kexample.com.+003+26160.key</filename>
and
<filename>Kexample.com.+003+26160.private</filename>.
</para>
</refsection>
<refsection><info><title>SEE ALSO</title></info>
<para><citerefentry>
<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citetitle>BIND 9 Administrator Reference Manual</citetitle>,
<citetitle>RFC 2539</citetitle>,
<citetitle>RFC 2845</citetitle>,
<citetitle>RFC 4034</citetitle>.
</para>
</refsection>
</refentry>