man.dnssec-keyfromlabel.html revision cd3ee12f1d34107678bde7be68b1d7f0f45cf2c9
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - Copyright (C) 2000-2003 Internet Software Consortium.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - Permission to use, copy, modify, and distribute this software for any
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - purpose with or without fee is hereby granted, provided that the above
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - copyright notice and this permission notice appear in all copies.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica - PERFORMANCE OF THIS SOFTWARE.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<!-- $Id: man.dnssec-keyfromlabel.html,v 1.25 2008/10/18 01:11:39 tbox Exp $ -->
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica gets keys with the given label from a crypto hardware and builds
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica key files for DNSSEC (Secure DNS), as defined in RFC 2535
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica and RFC 4034.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Selects the cryptographic algorithm. The value of
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <code class="option">algorithm</code> must be one of RSAMD5 (RSA)
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica These values are case insensitive.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica algorithm, and DSA is recommended.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Note 2: DH automatically sets the -k flag.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Specifies the label of keys in the crypto hardware
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica (PKCS#11 device).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Specifies the owner type of the key. The value of
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <code class="option">nametype</code> must either be ZONE (for a DNSSEC
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica a host (KEY)),
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica These values are
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica case insensitive.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Indicates that the DNS record containing the key should have
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica the specified class. If not specified, class IN is used.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Set the specified flag in the flag field of the KEY/DNSKEY record.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica The only recognized flag is KSK (Key Signing Key) DNSKEY.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Prints a short summary of the options and arguments to
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <span><strong class="command">dnssec-keygen</strong></span>.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Generate KEY records rather than DNSKEY records.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Sets the protocol value for the generated key. The protocol
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica is a number between 0 and 255. The default is 3 (DNSSEC).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Other possible values for this argument are listed in
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica RFC 2535 and its successors.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Indicates the use of the key. <code class="option">type</code> must be
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica is AUTHCONF. AUTH refers to the ability to authenticate
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica data, and CONF the ability to encrypt data.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica Sets the debugging level.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica successfully,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica to the standard output. This is an identification string for
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica the key files it has generated.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<li><p><code class="filename">nnnn</code> is the key name.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<li><p><code class="filename">aaa</code> is the numeric representation
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica algorithm.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<li><p><code class="filename">iiiii</code> is the key identifier (or
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica footprint).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica creates two files, with names based
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica contains the public key, and
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica The <code class="filename">.key</code> file contains a DNS KEY record
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica can be inserted into a zone file (directly or with a $INCLUDE
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica statement).
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica The <code class="filename">.private</code> file contains algorithm
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica fields. For obvious security reasons, this file does not have
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica general read permission.
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<p><span class="corpauthor">Internet Systems Consortium</span>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01rica<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>