man.pkcs11-keygen.html revision bfb7b680bf88c1fdd9949197b71c512c532280a4
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
e64031e20c39650a7bc902a3e1aba613b9415deevboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<link rel="prev" href="man.pkcs11-list.html" title="pkcs11-list">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<link rel="next" href="man.pkcs11-tokens.html" title="pkcs11-tokens">
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<tr><th colspan="3" align="center"><span class="application">pkcs11-keygen</span></th></tr>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<a accesskey="p" href="man.pkcs11-list.html">Prev</a>�</td>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.pkcs11-tokens.html">Next</a>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<a name="man.pkcs11-keygen"></a><div class="titlepage"></div>
bae3590d00fff0ea0bb2d7f81e1b24137a0c7f21vboxsync — generate keys on a PKCS#11 device
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync {-a <em class="replaceable"><code>algorithm</code></em>}
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync [<code class="option">-i <em class="replaceable"><code>id</code></em></code>]
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync [<code class="option">-m <em class="replaceable"><code>module</code></em></code>]
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync [<code class="option">-p <em class="replaceable"><code>PIN</code></em></code>]
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync [<code class="option">-s <em class="replaceable"><code>slot</code></em></code>]
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync <span class="command"><strong>pkcs11-keygen</strong></span> causes a PKCS#11 device to generate
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync a new key pair with the given <code class="option">label</code> (which must be
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync unique) and with <code class="option">keysize</code> bits of prime.
f428c820be00a88cb87e3f70f666ca7b3513fd82vboxsync <div class="variablelist"><dl class="variablelist">
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync Specify the key algorithm class: Supported classes are RSA,
f3a33ad348f1f84e6a558fc99f3519c48dd7009fvboxsync DSA, DH, ECC and ECX. In addition to these strings, the
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync <code class="option">algorithm</code> can be specified as a DNSSEC
f3a33ad348f1f84e6a558fc99f3519c48dd7009fvboxsync signing algorithm that will be used with this key; for
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync example, NSEC3RSASHA1 maps to RSA, ECDSAP256SHA256 maps
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync to ECC, and ED25519 to ECX. The default class is "RSA".
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync Create the key pair with <code class="option">keysize</code> bits of
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync prime. For ECC keys, the only valid values are 256 and 384,
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync and the default is 256. For ECX kyes, the only valid values
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync are 256 and 456, and the default is 256.
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync For RSA keys only, use a large exponent.
5045ab9ca39fa0b301f4020b7a072406eb0ecea2vboxsync<dt><span class="term">-i <em class="replaceable"><code>id</code></em></span></dt>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync Create key objects with id. The id is either
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync an unsigned short 2 byte or an unsigned long 4 byte number.
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<dt><span class="term">-m <em class="replaceable"><code>module</code></em></span></dt>
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync Specify the PKCS#11 provider module. This must be the full
5045ab9ca39fa0b301f4020b7a072406eb0ecea2vboxsync path to a shared library object implementing the PKCS#11 API
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync for the device.
5045ab9ca39fa0b301f4020b7a072406eb0ecea2vboxsync Set the new private key to be non-sensitive and extractable.
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync The allows the private key data to be read from the PKCS#11
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync device. The default is for private keys to be sensitive and
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync non-extractable.
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync<dt><span class="term">-p <em class="replaceable"><code>PIN</code></em></span></dt>
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync Specify the PIN for the device. If no PIN is provided on
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync the command line, <span class="command"><strong>pkcs11-keygen</strong></span> will
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync prompt for it.
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync Quiet mode: suppress unnecessary output.
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync For Diffie-Hellman (DH) keys only, use a special prime of
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync 768, 1024 or 1536 bit size and base (aka generator) 2.
b15225a0fbecfdf7060f6d3743d57ad08b11250dvboxsync If not specified, bit size will default to 1024.
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<dt><span class="term">-s <em class="replaceable"><code>slot</code></em></span></dt>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync Open the session with the given PKCS#11 slot. The default is
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync <span class="refentrytitle">pkcs11-destroy</span>(8)
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync <span class="refentrytitle">pkcs11-tokens</span>(8)
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync <span class="refentrytitle">dnssec-keyfromlabel</span>(8)
783e463acf52ae50e2c72c01713f5e1e9fbf41advboxsync<a accesskey="p" href="man.pkcs11-list.html">Prev</a>�</td>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<td width="40%" align="right">�<a accesskey="n" href="man.pkcs11-tokens.html">Next</a>
73c8df0bad5bf7cf318d301c2e32de3aa9e3c550vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<td width="40%" align="right" valign="top">�<span class="application">pkcs11-tokens</span>
566a7d17a29255ad2b0740df1234a0a2b5a0f687vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2</p>