man.dnssec-keygen.html revision 6bf6622b7b9053dc52527478473b572f042c4b5b
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2000-2003 Internet Software Consortium.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Permission to use, copy, modify, and distribute this software for any
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - purpose with or without fee is hereby granted, provided that the above
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - copyright notice and this permission notice appear in all copies.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - PERFORMANCE OF THIS SOFTWARE.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<!-- $Id: man.dnssec-keygen.html,v 1.29 2006/06/04 23:38:17 marka Exp $ -->
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="prev" href="man.host.html" title="host">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<table width="100%" summary="Navigation header">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<tr><th colspan="3" align="center"><span class="application">dnssec-keygen</span></th></tr>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a accesskey="p" href="man.host.html">Prev</a>�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<th width="60%" align="center">Manual pages</th>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><span class="application">dnssec-keygen</span> — DNSSEC key generation tool</p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><span><strong class="command">dnssec-keygen</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and RFC <TBA\>. It can also generate keys for use with
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster TSIG (Transaction Signatures), as defined in RFC 2845.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Selects the cryptographic algorithm. The value of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">algorithm</code> must be one of RSAMD5 (RSA) or RSASHA1,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster DSA, DH (Diffie Hellman), or HMAC-MD5. These values
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster are case insensitive.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and DSA is recommended. For TSIG, HMAC-MD5 is mandatory.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Note 2: HMAC-MD5 and DH automatically set the -k flag.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Specifies the number of bits in the key. The choice of key
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster 512 and 2048 bits. Diffie Hellman keys must be between
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster 128 and 4096 bits. DSA keys must be between 512 and 1024
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster bits and an exact multiple of 64. HMAC-MD5 keys must be
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster between 1 and 512 bits.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Specifies the owner type of the key. The value of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">nametype</code> must either be ZONE (for a DNSSEC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a host (KEY)),
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster These values are
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster case insensitive.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Indicates that the DNS record containing the key should have
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the specified class. If not specified, class IN is used.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster If generating an RSAMD5/RSASHA1 key, use a large exponent.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Set the specified flag in the flag field of the KEY/DNSKEY record.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The only recognized flag is KSK (Key Signing Key) DNSKEY.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster If generating a Diffie Hellman key, use this generator.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Allowed values are 2 and 5. If no generator
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster is specified, a known prime from RFC 2539 will be used
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if possible; otherwise the default is 2.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Prints a short summary of the options and arguments to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span><strong class="command">dnssec-keygen</strong></span>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Generate KEY records rather than DNSKEY records.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Sets the protocol value for the generated key. The protocol
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster is a number between 0 and 255. The default is 3 (DNSSEC).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Other possible values for this argument are listed in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster RFC 2535 and its successors.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Specifies the source of randomness. If the operating
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster system does not provide a <code class="filename">/dev/random</code>