man.dnssec-keygen.html 12 KB
Newer Older
Mark Andrews's avatar
gregen  
Mark Andrews committed
1
<!--
Mark Andrews's avatar
regen  
Mark Andrews committed
2
 - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
Mark Andrews's avatar
gregen  
Mark Andrews committed
3 4 5 6 7 8 9 10 11 12 13 14 15 16
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 - 
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->
Mark Andrews's avatar
regen  
Mark Andrews committed
17
<!-- $Id: man.dnssec-keygen.html,v 1.65 2008/01/27 06:10:24 marka Exp $ -->
Mark Andrews's avatar
gregen  
Mark Andrews committed
18 19 20 21
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>dnssec-keygen</title>
Mark Andrews's avatar
regen  
Mark Andrews committed
22
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
Mark Andrews's avatar
gregen  
Mark Andrews committed
23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
<link rel="prev" href="man.host.html" title="host">
<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center"><span class="application">dnssec-keygen</span></th></tr>
<tr>
<td width="20%" align="left">
<a accesskey="p" href="man.host.html">Prev</a> </td>
<th width="60%" align="center">Manual pages</th>
<td width="20%" align="right"> <a accesskey="n" href="man.dnssec-signzone.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
<div class="refentry" lang="en">
<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
<div class="refnamediv">
<h2>Name</h2>
<p><span class="application">dnssec-keygen</span> &#8212; DNSSEC key generation tool</p>
</div>
<div class="refsynopsisdiv">
<h2>Synopsis</h2>
<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
53
<a name="id2598818"></a><h2>DESCRIPTION</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
54 55
<p><span><strong class="command">dnssec-keygen</strong></span>
      generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
Mark Andrews's avatar
regen  
Mark Andrews committed
56
      and RFC 4034.  It can also generate keys for use with
Mark Andrews's avatar
gregen  
Mark Andrews committed
57 58 59 60
      TSIG (Transaction Signatures), as defined in RFC 2845.
    </p>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
61
<a name="id2598832"></a><h2>OPTIONS</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
<dd>
<p>
            Selects the cryptographic algorithm.  The value of
            <code class="option">algorithm</code> must be one of RSAMD5 (RSA) or RSASHA1,
            	      DSA, DH (Diffie Hellman), or HMAC-MD5.  These values
            are case insensitive.
          </p>
<p>
            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
            algorithm,
            and DSA is recommended.  For TSIG, HMAC-MD5 is mandatory.
          </p>
<p>
            Note 2: HMAC-MD5 and DH automatically set the -k flag.
          </p>
</dd>
<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
<dd><p>
            Specifies the number of bits in the key.  The choice of key
            size depends on the algorithm used.  RSAMD5 / RSASHA1 keys must be
            between
            512 and 2048 bits.  Diffie Hellman keys must be between
            128 and 4096 bits.  DSA keys must be between 512 and 1024
            bits and an exact multiple of 64.  HMAC-MD5 keys must be
            between 1 and 512 bits.
          </p></dd>
<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
<dd><p>
            Specifies the owner type of the key.  The value of
            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
            a host (KEY)),
            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
Mark Andrews's avatar
regen  
Mark Andrews committed
97 98
            These values are case insensitive.  Defaults to ZONE for DNSKEY
	    generation.
Mark Andrews's avatar
gregen  
Mark Andrews committed
99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
          </p></dd>
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
<dd><p>
            Indicates that the DNS record containing the key should have
            the specified class.  If not specified, class IN is used.
          </p></dd>
<dt><span class="term">-e</span></dt>
<dd><p>
            If generating an RSAMD5/RSASHA1 key, use a large exponent.
          </p></dd>
<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
<dd><p>
            Set the specified flag in the flag field of the KEY/DNSKEY record.
            		The only recognized flag is KSK (Key Signing Key) DNSKEY.
          </p></dd>
<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
<dd><p>
            If generating a Diffie Hellman key, use this generator.
            Allowed values are 2 and 5.  If no generator
            is specified, a known prime from RFC 2539 will be used
            if possible; otherwise the default is 2.
          </p></dd>
<dt><span class="term">-h</span></dt>
<dd><p>
            Prints a short summary of the options and arguments to
            <span><strong class="command">dnssec-keygen</strong></span>.
          </p></dd>
<dt><span class="term">-k</span></dt>
<dd><p>
            Generate KEY records rather than DNSKEY records.
          </p></dd>
<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
<dd><p>
            Sets the protocol value for the generated key.  The protocol
            is a number between 0 and 255.  The default is 3 (DNSSEC).
            Other possible values for this argument are listed in
            RFC 2535 and its successors.
          </p></dd>
<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
<dd><p>
            Specifies the source of randomness.  If the operating
            system does not provide a <code class="filename">/dev/random</code>
            or equivalent device, the default source of randomness
            is keyboard input.  <code class="filename">randomdev</code>
            specifies
            the name of a character device or file containing random
            data to be used instead of the default.  The special value
            <code class="filename">keyboard</code> indicates that keyboard
            input should be used.
          </p></dd>
<dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
<dd><p>
            Specifies the strength value of the key.  The strength is
            a number between 0 and 15, and currently has no defined
            purpose in DNSSEC.
          </p></dd>
<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
<dd><p>
            Indicates the use of the key.  <code class="option">type</code> must be
            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
            is AUTHCONF.  AUTH refers to the ability to authenticate
            data, and CONF the ability to encrypt data.
          </p></dd>
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
<dd><p>
            Sets the debugging level.
          </p></dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
169
<a name="id2599312"></a><h2>GENERATED KEYS</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
170 171 172 173 174
<p>
      When <span><strong class="command">dnssec-keygen</strong></span> completes
      successfully,
      it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
      to the standard output.  This is an identification string for
Mark Andrews's avatar
regen  
Mark Andrews committed
175
      the key it has generated.
Mark Andrews's avatar
gregen  
Mark Andrews committed
176 177 178 179 180 181 182 183 184 185 186 187 188
    </p>
<div class="itemizedlist"><ul type="disc">
<li><p><code class="filename">nnnn</code> is the key name.
        </p></li>
<li><p><code class="filename">aaa</code> is the numeric representation
          of the
          algorithm.
        </p></li>
<li><p><code class="filename">iiiii</code> is the key identifier (or
          footprint).
        </p></li>
</ul></div>
<p><span><strong class="command">dnssec-keygen</strong></span> 
Mark Andrews's avatar
regen  
Mark Andrews committed
189
      creates two files, with names based
Mark Andrews's avatar
gregen  
Mark Andrews committed
190 191 192 193 194 195 196 197 198 199 200 201 202
      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
      contains the public key, and
      <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
      private
      key.
    </p>
<p>
      The <code class="filename">.key</code> file contains a DNS KEY record
      that
      can be inserted into a zone file (directly or with a $INCLUDE
      statement).
    </p>
<p>
Mark Andrews's avatar
regen  
Mark Andrews committed
203 204
      The <code class="filename">.private</code> file contains
      algorithm-specific
Mark Andrews's avatar
gregen  
Mark Andrews committed
205 206 207 208 209
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
<p>
      Both <code class="filename">.key</code> and <code class="filename">.private</code>
Mark Andrews's avatar
regen  
Mark Andrews committed
210
      files are generated for symmetric encryption algorithms such as
Mark Andrews's avatar
gregen  
Mark Andrews committed
211 212 213 214
      HMAC-MD5, even though the public and private key are equivalent.
    </p>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
215
<a name="id2600921"></a><h2>EXAMPLE</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231
<p>
      To generate a 768-bit DSA key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
      issued:
    </p>
<p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
    </p>
<p>
      The command would print a string of the form:
    </p>
<p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
    </p>
<p>
      In this example, <span><strong class="command">dnssec-keygen</strong></span> creates
      the files <code class="filename">Kexample.com.+003+26160.key</code>
      and
Mark Andrews's avatar
regen  
Mark Andrews committed
232
      <code class="filename">Kexample.com.+003+26160.private</code>.
Mark Andrews's avatar
gregen  
Mark Andrews committed
233 234 235
    </p>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
236
<a name="id2600978"></a><h2>SEE ALSO</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
237 238 239 240 241 242 243 244
<p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 2535</em>,
      <em class="citetitle">RFC 2845</em>,
      <em class="citetitle">RFC 2539</em>.
    </p>
</div>
<div class="refsect1" lang="en">
Mark Andrews's avatar
regen  
Mark Andrews committed
245
<a name="id2601009"></a><h2>AUTHOR</h2>
Mark Andrews's avatar
gregen  
Mark Andrews committed
246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262
<p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="man.host.html">Prev</a> </td>
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
<td width="40%" align="right"> <a accesskey="n" href="man.dnssec-signzone.html">Next</a>
</td>
</tr>
<tr>
<td width="40%" align="left" valign="top">host </td>
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
Mark Andrews's avatar
regen  
Mark Andrews committed
263 264
<td width="40%" align="right" valign="top"> <span class="application">dnssec-signzone</span>
</td>
Mark Andrews's avatar
gregen  
Mark Andrews committed
265 266 267 268 269
</tr>
</table>
</div>
</body>
</html>