5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

c92c50783e4e93699f2a42643b8f200b9b719c87Automatic Updater "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews [<!ENTITY mdash "&#8212;">]>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<refentry id="man.dnssec-keygen">

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <date>June 30, 2000</date>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refentryinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmeta>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refentrytitle><application>dnssec-keygen</application></refentrytitle>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <manvolnum>8</manvolnum>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refmiscinfo>BIND9</refmiscinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refmeta>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refnamediv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refname><application>dnssec-keygen</application></refname>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refpurpose>DNSSEC key generation tool</refpurpose>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refnamediv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <docinfo>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2004</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2005</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2007</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2008</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2009</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2000</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2001</year>

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater <year>2002</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <year>2003</year>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <holder>Internet Software Consortium.</holder>

ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User </copyright>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </docinfo>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <refsynopsisdiv>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <cmdsynopsis>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <command>dnssec-keygen</command>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg ><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-3</option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-C</option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-e</option></arg>

d856585f5fe37cc2ea82115c10339578d2b517b1Automatic Updater <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-G</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-g <replaceable class="parameter">generator</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-h</option></arg>

ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews <arg><option>-k</option></arg>

f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>

f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews <arg><option>-q</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg><option>-z</option></arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <arg choice="req">name</arg>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </cmdsynopsis>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refsynopsisdiv>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsect1>

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater <title>DESCRIPTION</title>

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater <para><command>dnssec-keygen</command>

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater generates keys for DNSSEC (Secure DNS), as defined in RFC 2535

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater and RFC 4034. It can also generate keys for use with

d85c83c4144116fbc2734a6a623a888fea1a307fAutomatic Updater TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (Transaction Key) as defined in RFC 2930.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <para>

d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews The <option>name</option> of the key is specified on the command

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews line. For DNSSEC keys, this must match the name of the zone for

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews which the key is being generated.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refsect1>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <refsect1>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <title>OPTIONS</title>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <variablelist>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-a <replaceable class="parameter">algorithm</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User Selects the cryptographic algorithm. For DNSSEC keys, the value

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews of <option>algorithm</option> must be one of RSAMD5, RSASHA1,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews For TSIG/TKEY, the value must

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews case insensitive.

ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews If no algorithm is specified, then RSASHA1 will be used by

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews default, unless the <option>-3</option> option is specified,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in which case NSEC3RSASHA1 will be used instead. (If

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <option>-3</option> is used and an algorithm is specified,

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews that algorithm will be checked for compatibility with NSEC3.)

ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews mandatory.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews automatically set the -T KEY option.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </listitem>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-b <replaceable class="parameter">keysize</replaceable></term>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <listitem>

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews <para>

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews Specifies the number of bits in the key. The choice of key

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews size depends on the algorithm used. RSA keys must be

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews between 512 and 2048 bits. Diffie Hellman keys must be between

4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews 128 and 4096 bits. DSA keys must be between 512 and 1024

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews bits and an exact multiple of 64. HMAC keys must be

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews between 1 and 512 bits.

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <para>

5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The key size does not need to be specified if using a default

algorithm. The default key size is 1024 bits for zone signing

keys (ZSK's) and 2048 bits for key signing keys (KSK's,

generated with <option>-f KSK</option>). However, if an

algorithm is explicitly specified with the <option>-a</option>,

then there is no default key size, and the <option>-b</option>

must be used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-n <replaceable class="parameter">nametype</replaceable></term>

<listitem>

<para>

Specifies the owner type of the key. The value of

<option>nametype</option> must either be ZONE (for a DNSSEC

zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with

a host (KEY)),

USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).

These values are case insensitive. Defaults to ZONE for DNSKEY

generation.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-3</term>

<listitem>

<para>

Use an NSEC3-capable algorithm to generate a DNSSEC key.

If this option is used and no algorithm is explicitly

set on the command line, NSEC3RSASHA1 will be used by

default. Note that RSASHA256 and RSASHA512 algorithms

are NSEC3-capable.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-C</term>

<listitem>

<para>

Compatibility mode: generates an old-style key, without

any metadata. By default, <command>dnssec-keygen</command>

will include the key's creation date in the metadata stored

with the private key, and other dates may be set there as well

(publication date, activation date, etc). Keys that include

this data may be incompatible with older versions of BIND; the

<option>-C</option> option suppresses them.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-c <replaceable class="parameter">class</replaceable></term>

<listitem>

<para>

Indicates that the DNS record containing the key should have

the specified class. If not specified, class IN is used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-E <replaceable class="parameter">engine</replaceable></term>

<listitem>

<para>

Uses a crypto hardware (OpenSSL engine) for random number

and, when supported, key generation. When compiled with PKCS#11

support it defaults to pcks11, the empty name resets it to

no engine.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-e</term>

<listitem>

<para>

If generating an RSAMD5/RSASHA1 key, use a large exponent.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-f <replaceable class="parameter">flag</replaceable></term>

<listitem>

<para>

Set the specified flag in the flag field of the KEY/DNSKEY record.

The only recognized flags are KSK (Key Signing Key) and REVOKE.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-G</term>

<listitem>

<para>

Generate a key, but do not publish it or sign with it. This

option is incompatible with -P and -A.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-g <replaceable class="parameter">generator</replaceable></term>

<listitem>

<para>

If generating a Diffie Hellman key, use this generator.

Allowed values are 2 and 5. If no generator

is specified, a known prime from RFC 2539 will be used

if possible; otherwise the default is 2.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-h</term>

<listitem>

<para>

Prints a short summary of the options and arguments to

<command>dnssec-keygen</command>.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-K <replaceable class="parameter">directory</replaceable></term>

<listitem>

<para>

Sets the directory in which the key files are to be written.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-k</term>

<listitem>

<para>

Deprecated in favor of -T KEY.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-p <replaceable class="parameter">protocol</replaceable></term>

<listitem>

<para>

Sets the protocol value for the generated key. The protocol

is a number between 0 and 255. The default is 3 (DNSSEC).

Other possible values for this argument are listed in

RFC 2535 and its successors.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-q</term>

<listitem>

<para>

Quiet mode: Suppresses unnecessary output, including

progress indication. Without this option, when

<command>dnssec-keygen</command> is run interactively

to generate an RSA or DSA key pair, it will print a string

of symbols to <filename>stderr</filename> indicating the

progress of the key generation. A '.' indicates that a

random number has been found which passed an initial

sieve test; '+' means a number has passed a single

round of the Miller-Rabin primality test; a space

means that the number has passed all the tests and is

a satisfactory key.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-r <replaceable class="parameter">randomdev</replaceable></term>

<listitem>

<para>

Specifies the source of randomness. If the operating

system does not provide a <filename>/dev/random</filename>

or equivalent device, the default source of randomness

is keyboard input. <filename>randomdev</filename>

specifies

the name of a character device or file containing random

data to be used instead of the default. The special value

<filename>keyboard</filename> indicates that keyboard

input should be used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-s <replaceable class="parameter">strength</replaceable></term>

<listitem>

<para>

Specifies the strength value of the key. The strength is

a number between 0 and 15, and currently has no defined

purpose in DNSSEC.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-T <replaceable class="parameter">rrtype</replaceable></term>

<listitem>

<para>

Specifies the resource record type to use for the key.

<option>rrtype</option> must be either DNSKEY or KEY. The

default is DNSKEY when using a DNSSEC algorithm, but it can be

overridden to KEY for use with SIG(0).

<para>

</para>

Using any TSIG algorithm (HMAC-* or DH) forces this option

to KEY.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-t <replaceable class="parameter">type</replaceable></term>

<listitem>

<para>

Indicates the use of the key. <option>type</option> must be

one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default

is AUTHCONF. AUTH refers to the ability to authenticate

data, and CONF the ability to encrypt data.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-v <replaceable class="parameter">level</replaceable></term>

<listitem>

<para>

Sets the debugging level.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>TIMING OPTIONS</title>

<para>

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

If the argument begins with a '+' or '-', it is interpreted as

an offset from the present time. For convenience, if such an offset

is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

then the offset is computed in years (defined as 365 24-hour days,

ignoring leap years), months (defined as 30 24-hour days), weeks,

days, hours, or minutes, respectively. Without a suffix, the offset

is computed in seconds.

</para>

<variablelist>

<varlistentry>

<term>-P <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which a key is to be published to the zone.

After that date, the key will be included in the zone but will

not be used to sign it. If not set, and if the -G option has

not been used, the default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be activated. After that

date, the key will be included in the zone and used to sign

it. If not set, and if the -G option has not been used, the

default is "now".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be revoked. After that

date, the key will be flagged as revoked. It will be included

in the zone and will be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-I <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be retired. After that

date, the key will still be included in the zone, but it

will not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be deleted. After that

date, the key will no longer be included in the zone. (It

may remain in the key repository, however.)

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>GENERATED KEYS</title>

<para>

When <command>dnssec-keygen</command> completes

successfully,

it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>

to the standard output. This is an identification string for

the key it has generated.

</para>

<itemizedlist>

<listitem>

<para><filename>nnnn</filename> is the key name.

</para>

</listitem>

<listitem>

<para><filename>aaa</filename> is the numeric representation

of the

algorithm.

</para>

</listitem>

<listitem>

<para><filename>iiiii</filename> is the key identifier (or

footprint).

</para>

</listitem>

</itemizedlist>

<para><command>dnssec-keygen</command>

creates two files, with names based

on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>

contains the public key, and

<filename>Knnnn.+aaa+iiiii.private</filename> contains the

private

key.

</para>

<para>

The <filename>.key</filename> file contains a DNS KEY record

that

can be inserted into a zone file (directly or with a $INCLUDE

statement).

</para>

<para>

The <filename>.private</filename> file contains

algorithm-specific

fields. For obvious security reasons, this file does not have

general read permission.

</para>

<para>

Both <filename>.key</filename> and <filename>.private</filename>

files are generated for symmetric encryption algorithms such as

HMAC-MD5, even though the public and private key are equivalent.

</para>

</refsect1>

<refsect1>

<title>EXAMPLE</title>

<para>

To generate a 768-bit DSA key for the domain

<userinput>example.com</userinput>, the following command would be

issued:

</para>

<para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>

</para>

<para>

The command would print a string of the form:

</para>

<para><userinput>Kexample.com.+003+26160</userinput>

</para>

<para>

In this example, <command>dnssec-keygen</command> creates

the files <filename>Kexample.com.+003+26160.key</filename>

and

<filename>Kexample.com.+003+26160.private</filename>.

</para>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 2539</citetitle>,

<citetitle>RFC 2845</citetitle>,

<citetitle>RFC 4034</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--