man.dnssec-keyfromlabel.html revision 1fdd2470b625a58b57d0b155e6caf8c4fc0afe8a
59602f2a7c4e4809941583bed3e94cd26e628f1aTinderbox User - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
19558a04decde0e7261d489d92d04ad88104217bTinderbox User - Permission to use, copy, modify, and distribute this software for any
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - purpose with or without fee is hereby granted, provided that the above
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - copyright notice and this permission notice appear in all copies.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
287a6a8f9040dc43560cd69cddf83bfc0f53b76fTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - PERFORMANCE OF THIS SOFTWARE.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<!-- $Id: man.dnssec-keyfromlabel.html,v 1.34 2009/01/08 01:11:50 tbox Exp $ -->
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<table width="100%" summary="Navigation header">
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<th width="60%" align="center">Manual pages</th>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews gets keys with the given label from a crypto hardware and builds
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt key files for DNSSEC (Secure DNS), as defined in RFC 2535
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and RFC 4034.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Selects the cryptographic algorithm. The value of
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <code class="option">algorithm</code> must be one of RSAMD5 (RSA)
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews These values are case insensitive.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews algorithm, and DSA is recommended.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Note 2: DH automatically sets the -k flag.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
294e9d4c34462d29a3e766c88f452b46aeb3702fTinderbox User Specifies the label of keys in the crypto hardware
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User (PKCS#11 device).
294e9d4c34462d29a3e766c88f452b46aeb3702fTinderbox User<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt Specifies the owner type of the key. The value of
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt <code class="option">nametype</code> must either be ZONE (for a DNSSEC
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt a host (KEY)),
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User These values are
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User case insensitive.
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Indicates that the DNS record containing the key should have
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User the specified class. If not specified, class IN is used.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Set the specified flag in the flag field of the KEY/DNSKEY record.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User The only recognized flag is KSK (Key Signing Key) DNSKEY.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Prints a short summary of the options and arguments to
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <span><strong class="command">dnssec-keygen</strong></span>.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt Generate KEY records rather than DNSKEY records.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Sets the protocol value for the generated key. The protocol
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt is a number between 0 and 255. The default is 3 (DNSSEC).
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Other possible values for this argument are listed in
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User RFC 2535 and its successors.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt Indicates the use of the key. <code class="option">type</code> must be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User is AUTHCONF. AUTH refers to the ability to authenticate
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson data, and CONF the ability to encrypt data.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Sets the debugging level.
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews<a name="id2604060"></a><h2>GENERATED KEY FILES</h2>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User successfully,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews to the standard output. This is an identification string for
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont the key files it has generated.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<li><p><code class="filename">nnnn</code> is the key name.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<li><p><code class="filename">aaa</code> is the numeric representation
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews<li><p><code class="filename">iiiii</code> is the key identifier (or
7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User creates two files, with names based
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews contains the public key, and
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The <code class="filename">.key</code> file contains a DNS KEY record
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User can be inserted into a zone file (directly or with a $INCLUDE
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The <code class="filename">.private</code> file contains algorithm
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews fields. For obvious security reasons, this file does not have
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User general read permission.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<p><span class="corpauthor">Internet Systems Consortium</span>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<table width="100%" summary="Navigation footer">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater<span class="application">dnssec-dsfromkey</span>�</td>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>