man.dnssec-keyfromlabel.html revision 0a7ed88633a680bb881868b75ded4d09a7bbbc50
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - Copyright (C) 2000-2003 Internet Software Consortium.
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - Permission to use, copy, modify, and/or distribute this software for any
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - purpose with or without fee is hereby granted, provided that the above
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - copyright notice and this permission notice appear in all copies.
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
94ba4820927b906b333e39445c1508a29387c3aaTimo Sirainen - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
8732bdd21579472feb40da8ffc99b8fd3b341417Timo Sirainen - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
f23baa3b53b1dd4eb19729e99a43937fa3c7f309Timo Sirainen - PERFORMANCE OF THIS SOFTWARE.
7f098e28ddad259d9fbe76e18347c722bb005189Timo Sirainen<!-- $Id: man.dnssec-keyfromlabel.html,v 1.57 2009/07/19 04:27:55 tbox Exp $ -->
8732bdd21579472feb40da8ffc99b8fd3b341417Timo Sirainen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
8732bdd21579472feb40da8ffc99b8fd3b341417Timo Sirainen<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<table width="100%" summary="Navigation header">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<th width="60%" align="center">Manual pages</th>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen gets keys with the given label from a crypto hardware and builds
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen key files for DNSSEC (Secure DNS), as defined in RFC 2535
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen and RFC 4034.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Selects the cryptographic algorithm. The value of
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <code class="option">algorithm</code> must be one of RSAMD5 (RSA)
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen These values are case insensitive.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen algorithm, and DSA is recommended.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Note 2: DH automatically sets the -k flag.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Specifies the label of keys in the crypto hardware
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen (PKCS#11 device).
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Specifies the owner type of the key. The value of
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <code class="option">nametype</code> must either be ZONE (for a DNSSEC
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen a host (KEY)),
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen These values are
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen case insensitive.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Indicates that the DNS record containing the key should have
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen the specified class. If not specified, class IN is used.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Set the specified flag in the flag field of the KEY/DNSKEY record.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen The only recognized flag is KSK (Key Signing Key) DNSKEY.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Prints a short summary of the options and arguments to
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <span><strong class="command">dnssec-keygen</strong></span>.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Sets the directory in which the key files are to be written.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Generate KEY records rather than DNSKEY records.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Sets the protocol value for the generated key. The protocol
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen is a number between 0 and 255. The default is 3 (DNSSEC).
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Other possible values for this argument are listed in
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen RFC 2535 and its successors.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Indicates the use of the key. <code class="option">type</code> must be
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen is AUTHCONF. AUTH refers to the ability to authenticate
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen data, and CONF the ability to encrypt data.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen Sets the debugging level.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<a name="id2606215"></a><h2>GENERATED KEY FILES</h2>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen successfully,
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen to the standard output. This is an identification string for
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen the key files it has generated.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<li><p><code class="filename">nnnn</code> is the key name.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<li><p><code class="filename">aaa</code> is the numeric representation
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<li><p><code class="filename">iiiii</code> is the key identifier (or
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen creates two files, with names based
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen contains the public key, and
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen The <code class="filename">.key</code> file contains a DNS KEY record
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen can be inserted into a zone file (directly or with a $INCLUDE
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen The <code class="filename">.private</code> file contains algorithm
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen fields. For obvious security reasons, this file does not have
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen general read permission.
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<p><span class="corpauthor">Internet Systems Consortium</span>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<table width="100%" summary="Navigation footer">
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<span class="application">dnssec-dsfromkey</span>�</td>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
cdf294e5cceee81d58c8477c7c28d9ad6b55c36aTimo Sirainen<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>