pkcs11-keygen.docbook revision 78608b0a454246d0e1e0169f1d671b8427e48199
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg - Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - This Source Code Form is subject to the terms of the Mozilla Public
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - License, v. 2.0. If a copy of the MPL was not distributed with this
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - file, You can obtain one at http://mozilla.org/MPL/2.0/.
4da61833a1cbbca94094f9653fd970582b97a72etrawick<!-- Converted by db4-upgrade version 1.0 -->
4da61833a1cbbca94094f9653fd970582b97a72etrawick<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.pkcs11-keygen">
4789804be088bcd86ae637a29cdb7fda25169521jailletc <refentryinfo>
4789804be088bcd86ae637a29cdb7fda25169521jailletc <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
e50c3026198fd496f183cda4c32a202925476778covener </refentryinfo>
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin <refentrytitle><application>pkcs11-keygen</application></refentrytitle>
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic <refnamediv>
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic <refname><application>pkcs11-keygen</application></refname>
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavic <refpurpose>generate keys on a PKCS#11 device</refpurpose>
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavic </refnamediv>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <copyright>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza </copyright>
d58a848a016d401b965111e50ef829e1641f7834minfrin <refsynopsisdiv>
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf <arg choice="req" rep="norepeat">-a <replaceable class="parameter">algorithm</replaceable></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="opt" rep="norepeat"><option>-e</option></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">id</replaceable></option></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="opt" rep="norepeat"><option>-m <replaceable class="parameter">module</replaceable></option></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="opt" rep="norepeat"><option>-P</option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">PIN</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg choice="opt" rep="norepeat"><option>-q</option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg choice="opt" rep="norepeat"><option>-S</option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">slot</replaceable></option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic </cmdsynopsis>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic </refsynopsisdiv>
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener <command>pkcs11-keygen</command> causes a PKCS#11 device to generate
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener a new key pair with the given <option>label</option> (which must be
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener unique) and with <option>keysize</option> bits of prime.
44ff304057225e944e220e981d434a046d14cf06covener </refsection>
5d1ba75b8794925e67591c209085a49279791de9covener <variablelist>
5d1ba75b8794925e67591c209085a49279791de9covener <varlistentry>
5d1ba75b8794925e67591c209085a49279791de9covener <term>-a <replaceable class="parameter">algorithm</replaceable></term>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand Specify the key algorithm class: Supported classes are RSA,
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand DSA, DH, ECC and ECX. In addition to these strings, the
caad2986f81ab263f7af41467dd622dc9add17f3ylavic <option>algorithm</option> can be specified as a DNSSEC
caad2986f81ab263f7af41467dd622dc9add17f3ylavic signing algorithm that will be used with this key; for
caad2986f81ab263f7af41467dd622dc9add17f3ylavic example, NSEC3RSASHA1 maps to RSA, ECDSAP256SHA256 maps
caad2986f81ab263f7af41467dd622dc9add17f3ylavic to ECC, and ED25519 to ECX. The default class is "RSA".
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton </listitem>
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton </varlistentry>
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem <varlistentry>
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem <term>-b <replaceable class="parameter">keysize</replaceable></term>
1e2d421a36999d292042a5539971070d54aa6c63ylavic Create the key pair with <option>keysize</option> bits of
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh prime. For ECC keys, the only valid values are 256 and 384,
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh and the default is 256. For ECX kyes, the only valid values
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh are 256 and 456, and the default is 256.
0b67eb8568cd58bb77082703951679b42cf098actrawick </listitem>
0b67eb8568cd58bb77082703951679b42cf098actrawick </varlistentry>
5ef3c61605a3a021ff71f488983cb0065f8e1a79covener <varlistentry>
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic For RSA keys only, use a large exponent.
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic </listitem>
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic </varlistentry>
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc <varlistentry>
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc <term>-i <replaceable class="parameter">id</replaceable></term>
457468b82e59d01eba00dd9d0817309c8f5e414ejim Create key objects with id. The id is either
457468b82e59d01eba00dd9d0817309c8f5e414ejim an unsigned short 2 byte or an unsigned long 4 byte number.
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton </listitem>
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton </varlistentry>
15660979a30d251681463de2e0584853890082accovener <varlistentry>
15660979a30d251681463de2e0584853890082accovener <term>-m <replaceable class="parameter">module</replaceable></term>
cfd9415521847b2f9394fad04fb701cfb955f503rjung Specify the PKCS#11 provider module. This must be the full
cfd9415521847b2f9394fad04fb701cfb955f503rjung path to a shared library object implementing the PKCS#11 API
cfd9415521847b2f9394fad04fb701cfb955f503rjung for the device.
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe </listitem>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe </varlistentry>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe <varlistentry>
63b9f1f5880391261705f696d7d65507bbe9ace3covener Set the new private key to be non-sensitive and extractable.
49dacedb6c387b786b7911082ff35121a45f414bcovener The allows the private key data to be read from the PKCS#11
49dacedb6c387b786b7911082ff35121a45f414bcovener device. The default is for private keys to be sensitive and
49dacedb6c387b786b7911082ff35121a45f414bcovener non-extractable.
3c990331fc6702119e4f5b8ba9eae3021aea5265jim </listitem>
3c990331fc6702119e4f5b8ba9eae3021aea5265jim </varlistentry>
3c990331fc6702119e4f5b8ba9eae3021aea5265jim <varlistentry>
fc42512879dd0504532f52fe5d0d0383dda96a1eniq <term>-p <replaceable class="parameter">PIN</replaceable></term>
fc42512879dd0504532f52fe5d0d0383dda96a1eniq <listitem>
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq Specify the PIN for the device. If no PIN is provided on
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq prompt for it.
983528026996668ea295be95aedb9c7a346af470ylavic </listitem>
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc </varlistentry>
06b8f183140c8e02e0974e938a05078b511d1603covener <varlistentry>
259878293a997ff49f5ddfc53d3739cbdc25444ecovener Quiet mode: suppress unnecessary output.
259878293a997ff49f5ddfc53d3739cbdc25444ecovener </listitem>
259878293a997ff49f5ddfc53d3739cbdc25444ecovener </varlistentry>
b54b024c06a19926832d77d40ba35ad8c41e4d3dminfrin <varlistentry>
65967d05f839dbf27cf91d91fa79585eeae19660minfrin For Diffie-Hellman (DH) keys only, use a special prime of
65967d05f839dbf27cf91d91fa79585eeae19660minfrin 768, 1024 or 1536 bit size and base (aka generator) 2.
65967d05f839dbf27cf91d91fa79585eeae19660minfrin If not specified, bit size will default to 1024.
8152945ae46857b170cb227e79bb799f4fc7710dminfrin </listitem>
8152945ae46857b170cb227e79bb799f4fc7710dminfrin </varlistentry>
75f5c2db254c0167a0e396254460de09b775d203trawick <varlistentry>
75f5c2db254c0167a0e396254460de09b775d203trawick <term>-s <replaceable class="parameter">slot</replaceable></term>
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph Open the session with the given PKCS#11 slot. The default is
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick </listitem>
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick </varlistentry>
54d750a84a175d8e338880514d440773eb986b50covener </variablelist>
54d750a84a175d8e338880514d440773eb986b50covener </refsection>
54d750a84a175d8e338880514d440773eb986b50covener <citerefentry>
54d750a84a175d8e338880514d440773eb986b50covener <refentrytitle>pkcs11-destroy</refentrytitle><manvolnum>8</manvolnum>
7a3aa12f0eda24793ee26d6a179bd53132e9dae8covener </citerefentry>,
54d750a84a175d8e338880514d440773eb986b50covener <citerefentry>
54d750a84a175d8e338880514d440773eb986b50covener <refentrytitle>pkcs11-list</refentrytitle><manvolnum>8</manvolnum>
83b50288fa7d306324bba68832011ea08f5c7832covener </citerefentry>,
4e30ef014533a7e93c92d88306291f5e49c9692ftrawick <citerefentry>
83b50288fa7d306324bba68832011ea08f5c7832covener <refentrytitle>pkcs11-tokens</refentrytitle><manvolnum>8</manvolnum>
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick </citerefentry>,
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick <citerefentry>
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick <refentrytitle>dnssec-keyfromlabel</refentrytitle><manvolnum>8</manvolnum>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener </citerefentry>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener </refsection>