1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
|
.\" Copyright (c) 1996 by Internet Software Consortium
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
.\" SOFTWARE.
.\"
.\" $Id: dnskeygen.1,v 8.2 1997/03/14 02:29:41 vixie Exp $
.\"
.Dd October 25, 1996
.Dt DNSKEYGEN @CMD_EXT_U@
.Os BSD 4
.Sh NAME
.Nm dnskeygen
.Nd generate and display public and private RSA keys for DNS
.Sh SYNOPSIS
.Nm dnskeygen
.Bo Fl g Ns Op Ar size
.Op Fl f
.Bc
.Bo Fl z
|
.Fl e
|
.Fl u
.Bc
.Op Fl i
.Op Fl m
.Op Fl p Ns Ar #
.Op Fl s Ns Ar #
.Op Fl x
.Ar name
.Sh DESCRIPTION
.Ic Dnskeygen
(DNS Key Generator) is a tool to generate and maintain RSA keys
for DNS (Domain Name System).
.Bl -tag -width Fl
.It Fl g Ns Op Ar size
.Ic Dnskeygen
will generate a new key when
the
.Dq Fl g
flag is specified. If the
.Dq Fl g
flag is not specified, then it
will attempt to display an existing key that is stored in the current
directory. If no
.Ar size
is specified after the
.Dq Fl g
flag, a key of 512 bits
will be generated; otherwise,
.Ar size
is the size of the modulus in the newly-generated key.
.It Fl f
flag can only be specified with the
.Dq Fl g
flag; this changes the
exponent used on the key. If
.Dq Fl f
is specified, the exponent is 65537,
which is suitable for encryption keys. If
.Dq Fl f
is not specified,
the exponent is 3, which is suitable for signatures and
verification of public data such as DNS records. Signing and
verifying with exponent of 65537 takes significantly more CPU time than
with exponent of 3.
.It Fl z Fl e Fl u
These flags define the type of key being generated: Zone (DNS
validation) key, End Entity (host or service) key or User (e.g. email) key,
respectively.
Each key is only allowed to be one of these. When
keys are displayed, the type of key can be changed.
.It Fl i
Indicates that the key can be used for IPSEC (Internet Protocol Security
services).
.It Fl m
Indicates that the key can be used for secure email.
.It Fl p Ns Ar #
Indicates that the key can be used for protocol number
.Ar # .
A value of
.Ar 0
denies the use of the key for
.Em any
protocol (other than those specified by other option flags like
.Fl m ) .
A value of
.Ar 255
allows it to be used with
.Em all
protocols.
These protocol numbers will be assigned in the latest Assigned Numbers
RFC from the Internet Assigned Numbers Authority (IANA).
.It Fl s Ns Ar #
Strength value; this value is only used when key is signing.
Interpretation of this field is to be specified later. Default value is 7.
.It Fl x
Experimental key. This indicates that software should not assume
that it should use secure protocols when talking to this zone, host, or user.
Instead, the key is being published experimentally, to debug the software
to be used to run the secure protocols, for example.
Data signed by Experimental keys will not be treated as trusted by DNS servers.
.It Ar name
The DNS name the key is for. This can be any valid DNS name.
.El
.Ss DETAILS
.Ic Dnskeygen
uses two files for each key:
.Pa <name>.priv
and
.Pa <name>.public .
File
.Pa <name>.public
contains the public key in the pubkey format:
.Pp
.D1 Ar <flags> <algorithm> <protocol> <exponent|modulus>
.Pp
.Ic Dnskeygen
.Ar name
displays the public key in both DNS RR format and pubkey format.
.Ic Dnskeygen
can display the key with different flags on subsequent runs.
The contents of the public key file will not be changed.
.Pa <name>.priv
stores the private key, in either a password-protected
format file or in a open file. The advantage of
a password-protected file is that it is harder to use the key if the file is
stolen. The disadvantage is that the password has to be given each time
the key is read. If the key is to be stored in a safe off-line place,
and only used for signing zones, then local policy may allow storing the
key in an unencrypted format.
.Sh ENVIRONMENT
No environmental variables are used.
.Sh SEE ALSO
RSAREF documentation,
.Em RFC 2065
on secure DNS.
.Sh AUTHOR
Olafur Gudmundsson (ogud@tis.com).
.Sh ACKNOWLEDGMENTS
The underlying cryptographic math is done by the RSAREF or BSAFE libraries.
.Sh BUGS
.Ic Dnskeygen
renames old keys in such a way that only one
.Dq previous
key for a given name is kept; older keys are overwritten. (For example,
the third time a key is generated for a given name, the second key is kept
as the
.Dq previous
key, while the first key is lost. If a key is generated
.Em again
for this name--i.e., if the fourth key is generated--then the third key
will become the
.Dq previous
key and the second key will be lost.)
.Ic Dnskeygen
will not overwrite existing keys.
Only one key for each name can be stored in the current directory. If you
want to keep your old keys, rename the files before running
.Ic dnskeygen .
Otherwise you must delete them before running
.Ic dnskeygen .
.Pp
Portability of Private key file must be better tested between
different implementations of RSA.
|
