man.dnssec-keygen.html revision 852ccdd42a71550c974111b49415204ffeca6573
1633838b8255282d10af15c5c84cee5a51466712Bob Halley<!--
70e5a7403f0e0a3bd292b8287c5fed5772c15270Automatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence -
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater - Permission to use, copy, modify, and distribute this software for any
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - purpose with or without fee is hereby granted, provided that the above
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - copyright notice and this permission notice appear in all copies.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence -
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
1633838b8255282d10af15c5c84cee5a51466712Bob Halley-->
9a4ce0c25809073f31226faa6ed94c70474cf363Bob Halley<!-- $Id: man.dnssec-keygen.html,v 1.117 2009/06/10 01:12:51 tbox Exp $ -->
70e5a7403f0e0a3bd292b8287c5fed5772c15270Automatic Updater<html>
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence<head>
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley<title>dnssec-keygen</title>
9a4ce0c25809073f31226faa6ed94c70474cf363Bob Halley<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
9a4ce0c25809073f31226faa6ed94c70474cf363Bob Halley<link rel="prev" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
9a4ce0c25809073f31226faa6ed94c70474cf363Bob Halley</head>
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
9c4f33b6718407e94d50dbfb4977e16d3f83de9dDavid Lawrence<div class="navheader">
9c4f33b6718407e94d50dbfb4977e16d3f83de9dDavid Lawrence<table width="100%" summary="Navigation header">
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-keygen</span></th></tr>
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews<tr>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<td width="20%" align="left">
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<a accesskey="p" href="man.dnssec-keyfromlabel.html">Prev</a>�</td>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<th width="60%" align="center">Manual pages</th>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson</td>
d1dc805692ff816e28849396577affa9b4890e41Andreas Gustafsson</tr>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson</table>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<hr>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson</div>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<div class="refentry" lang="en">
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
9afcd92352224325ed65919f69f7f58282fc6623Andreas Gustafsson<div class="refnamediv">
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley<h2>Name</h2>
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley<p><span class="application">dnssec-keygen</span> &#8212; DNSSEC key generation tool</p>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein</div>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<div class="refsynopsisdiv">
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<h2>Synopsis</h2>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington</div>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<div class="refsect1" lang="en">
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<a name="id2606836"></a><h2>DESCRIPTION</h2>
01956482905dd861a9b07d417d469955466b728dDamien Neil<p><span><strong class="command">dnssec-keygen</strong></span>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil and RFC 4034. It can also generate keys for use with
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil TSIG (Transaction Signatures), as defined in RFC 2845.
b2a6ebf1bd4dad1410afba9012a61d87090f03adDamien Neil </p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil</div>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<div class="refsect1" lang="en">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="id2606850"></a><h2>OPTIONS</h2>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="variablelist"><dl>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<p>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington Selects the cryptographic algorithm. The value of
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington <code class="option">algorithm</code> must be one of RSAMD5 (RSA) or RSASHA1,
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil DSA, NSEC3RSASHA1, NSEC3DSA, DH (Diffie Hellman), or HMAC-MD5.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil These values are case insensitive.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil </p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff mandatory.
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff </p>
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff<p>
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley Note 2: HMAC-MD5 and DH automatically set the -k flag.
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews </p>
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews</dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff<dd><p>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington Specifies the number of bits in the key. The choice of key
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington between
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil 512 and 2048 bits. Diffie Hellman keys must be between
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington 128 and 4096 bits. DSA keys must be between 512 and 1024
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley bits and an exact multiple of 64. HMAC-MD5 keys must be
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley between 1 and 512 bits.
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley </p></dd>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dd><p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Specifies the owner type of the key. The value of
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil <code class="option">nametype</code> must either be ZONE (for a DNSSEC
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil a host (KEY)),
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley These values are case insensitive. Defaults to ZONE for DNSKEY
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley generation.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil </p></dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dd><p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Indicates that the DNS record containing the key should have
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil the specified class. If not specified, class IN is used.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil </p></dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-e</span></dt>
f671a5c51cc59e266620c0c4026b054908fdd80cBob Halley<dd><p>
e4b9761b0ef03597c35d1ef1d86e12514c621f90Michael Graff If generating an RSAMD5/RSASHA1 key, use a large exponent.
f671a5c51cc59e266620c0c4026b054908fdd80cBob Halley </p></dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dd><p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Set the specified flag in the flag field of the KEY/DNSKEY record.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil The only recognized flag is KSK (Key Signing Key) DNSKEY.
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil </p></dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dd><p>
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley If generating a Diffie Hellman key, use this generator.
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley Allowed values are 2 and 5. If no generator
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley is specified, a known prime from RFC 2539 will be used
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil if possible; otherwise the default is 2.
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley </p></dd>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dt><span class="term">-h</span></dt>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dd><p>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington Prints a short summary of the options and arguments to
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington <span><strong class="command">dnssec-keygen</strong></span>.
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington </p></dd>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dt><span class="term">-k</span></dt>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dd><p>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington Generate KEY records rather than DNSKEY records.
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington </p></dd>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil<dd><p>
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Sets the protocol value for the generated key. The protocol
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil is a number between 0 and 255. The default is 3 (DNSSEC).
e9453d609db9aed9efd2bb4fd287ff3ad11da0b2Damien Neil Other possible values for this argument are listed in
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington RFC 2535 and its successors.
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington </p></dd>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington<dd><p>
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff Specifies the source of randomness. If the operating
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff system does not provide a <code class="filename">/dev/random</code>
8f7b56e275abdaaec08ccac32ffc6174841ae60eMichael Graff or equivalent device, the default source of randomness
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington is keyboard input. <code class="filename">randomdev</code>
26d20cd51c968e111b4122536825368a17b5ca82Brian Wellington specifies
18d0b5e54be891a1aa938c165b6d439859121ec8Mark Andrews the name of a character device or file containing random
bf6d2e39124ab3d51c253f7acad9a4abef059be6Bob Halley data to be used instead of the default. The special value
<code class="filename">keyboard</code> indicates that keyboard
input should be used.
</p></dd>
<dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
<dd><p>
Specifies the strength value of the key. The strength is
a number between 0 and 15, and currently has no defined
purpose in DNSSEC.
</p></dd>
<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
<dd><p>
Indicates the use of the key. <code class="option">type</code> must be
one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
is AUTHCONF. AUTH refers to the ability to authenticate
data, and CONF the ability to encrypt data.
</p></dd>
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
<dd><p>
Sets the debugging level.
</p></dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
<a name="id2607193"></a><h2>GENERATED KEYS</h2>
<p>
When <span><strong class="command">dnssec-keygen</strong></span> completes
successfully,
it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
to the standard output. This is an identification string for
the key it has generated.
</p>
<div class="itemizedlist"><ul type="disc">
<li><p><code class="filename">nnnn</code> is the key name.
</p></li>
<li><p><code class="filename">aaa</code> is the numeric representation
of the
algorithm.
</p></li>
<li><p><code class="filename">iiiii</code> is the key identifier (or
footprint).
</p></li>
</ul></div>
<p><span><strong class="command">dnssec-keygen</strong></span>
creates two files, with names based
on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
contains the public key, and
<code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
private
key.
</p>
<p>
The <code class="filename">.key</code> file contains a DNS KEY record
that
can be inserted into a zone file (directly or with a $INCLUDE
statement).
</p>
<p>
The <code class="filename">.private</code> file contains
algorithm-specific
fields. For obvious security reasons, this file does not have
general read permission.
</p>
<p>
Both <code class="filename">.key</code> and <code class="filename">.private</code>
files are generated for symmetric encryption algorithms such as
HMAC-MD5, even though the public and private key are equivalent.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id2607301"></a><h2>EXAMPLE</h2>
<p>
To generate a 768-bit DSA key for the domain
<strong class="userinput"><code>example.com</code></strong>, the following command would be
issued:
</p>
<p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
</p>
<p>
The command would print a string of the form:
</p>
<p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
</p>
<p>
In this example, <span><strong class="command">dnssec-keygen</strong></span> creates
the files <code class="filename">Kexample.com.+003+26160.key</code>
and
<code class="filename">Kexample.com.+003+26160.private</code>.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id2609064"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 2539</em>,
<em class="citetitle">RFC 2845</em>,
<em class="citetitle">RFC 4033</em>.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id2609095"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="man.dnssec-keyfromlabel.html">Prev</a>�</td>
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
</td>
</tr>
<tr>
<td width="40%" align="left" valign="top">
<span class="application">dnssec-keyfromlabel</span>�</td>
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>
</td>
</tr>
</table>
</div>
</body>
</html>