1 '\" te

     2 .\" Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")

     3 .\" Permission to use, copy, modify, and/or distribute this software for any purpose  with or without fee is hereby granted, provided that the above copyright notice  and this permission notice appear in all copies.  THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING  FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE  USE OR PERFORMANCE OF THIS SOFTWARE.

     4 .\" Portions Copyright (c) 2010, Sun Microsystems, Inc. All Rights Reserved.

     5 .TH dnssec-keyfromlabel 8 "19 Oct 2015" "SunOS 5.12" "System Administration Commands"

     6 .SH NAME

     7 dnssec-keyfromlabel \- DNSSEC key generation tool

     8 .SH SYNOPSIS

     9 .LP

    10 .nf

    11 \fBdnssec-keyfromlabel\fR \fB-a\fR \fIalgorithm\fR \fB-l\fR \fIlabel\fR [\fB-c\fR \fIclass\fR] [\fB-f\fR \fIflag\fR] [\fB-k\fR]

    12      [\fB-n\fR \fInametype\fR] [\fB-p\fR \fIprotocol\fR] [\fB-t\fR \fItype\fR] [\fB-v\fR \fIlevel\fR] \fIname\fR

    13 .fi

    14 

    15 .SH DESCRIPTION

    16 .sp

    17 .LP

    18 \fBdnssec-keyfromlabel\fR retrieves keys with a specified label from a crypto hardware device and builds key files for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034.

    19 .SH OPTIONS

    20 .sp

    21 .LP

    22 The following options are supported:

    23 .sp

    24 .ne 2

    25 .mk

    26 .na

    27 \fB\fB-a\fR \fIalgorithm\fR\fR

    28 .ad

    29 .sp .6

    30 .RS 4n

    31 Selects the cryptographic algorithm. The value of \fIalgorithm\fR must be one of \fBRSAMD5\fR (RSA) or \fBRSASHA1\fR, \fBDSA\fR, \fBNSEC3RSASHA1\fR, \fBNSEC3DSA\fR, or \fBDH\fR (Diffie-Hellman). These values are case-insensitive.

    32 .sp

    33 Note that for \fBDNSSEC\fR, \fBRSASHA1\fR is a mandatory-to-implement algorithm, and DSA is recommended. Note also that \fBDH\fR automatically sets the \fB-k\fR flag.

    34 .RE

    35 

    36 .sp

    37 .ne 2

    38 .mk

    39 .na

    40 \fB\fB-l\fR \fIlabel\fR\fR

    41 .ad

    42 .sp .6

    43 .RS 4n

    44 Specifies the label of keys in the crypto hardware (PKCS#11) device.

    45 .RE

    46 

    47 .sp

    48 .ne 2

    49 .mk

    50 .na

    51 \fB\fB-n\fR \fInametype\fR\fR

    52 .ad

    53 .sp .6

    54 .RS 4n

    55 Specifies the owner type of the key. The value of \fInametype\fR must either be \fBZONE\fR (for a \fBDNSSEC\fR zone key (\fBKEY\fR/\fBDNSKEY\fR)), \fBHOST\fR or \fBENTITY\fR (for a key associated with a host (\fBKEY\fR)), \fBUSER\fR (for a key associated with a user (\fBKEY\fR)), or \fBOTHER\fR (\fBDNSKEY\fR). These values are case-insensitive.

    56 .RE

    57 

    58 .sp

    59 .ne 2

    60 .mk

    61 .na

    62 \fB\fB-c\fR \fIclass\fR\fR

    63 .ad

    64 .sp .6

    65 .RS 4n

    66 Indicates that the DNS record containing the key should have the specified class. If not specified, class \fBIN\fR is used.

    67 .RE

    68 

    69 .sp

    70 .ne 2

    71 .mk

    72 .na

    73 \fB\fB-f\fR \fIflag\fR\fR

    74 .ad

    75 .sp .6

    76 .RS 4n

    77 Set the specified flag in the flag field of the \fBKEY\fR/\fBDNSKEY\fR record. The only recognized flag is \fBKSK\fR (Key Signing Key) \fBDNSKEY\fR.

    78 .RE

    79 

    80 .sp

    81 .ne 2

    82 .mk

    83 .na

    84 \fB\fB-h\fR\fR

    85 .ad

    86 .sp .6

    87 .RS 4n

    88 Displays a short summary of the options and arguments to \fBdnssec-keyfromlabel\fR.

    89 .RE

    90 

    91 .sp

    92 .ne 2

    93 .mk

    94 .na

    95 \fB\fB-k\fR \fI\fR\fR

    96 .ad

    97 .sp .6

    98 .RS 4n

    99 Generate \fBKEY\fR records rather than \fBDNSKEY\fR records.

   100 .RE

   101 

   102 .sp

   103 .ne 2

   104 .mk

   105 .na

   106 \fB\fB-p\fR \fIprotocol\fR\fR

   107 .ad

   108 .sp .6

   109 .RS 4n

   110 Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is \fB3\fR (\fBDNSSEC\fR). Other possible values for this argument are listed in RFC 2535 and its successors.

   111 .RE

   112 

   113 .sp

   114 .ne 2

   115 .mk

   116 .na

   117 \fB\fB-t\fR \fItype\fR\fR

   118 .ad

   119 .sp .6

   120 .RS 4n

   121 Indicates the use of the key. \fItype\fR must be one of \fBAUTHCONF\fR, \fBNOAUTHCONF\fR, \fBNOAUTH\fR, or \fBNOCONF\fR. The default is \fBAUTHCONF\fR. \fBAUTH\fR refers to the ability to authenticate data, and \fBCONF\fR the ability to encrypt data.

   122 .RE

   123 

   124 .sp

   125 .ne 2

   126 .mk

   127 .na

   128 \fB\fB-v\fR \fIlevel\fR\fR

   129 .ad

   130 .sp .6

   131 .RS 4n

   132 Sets the debugging level.

   133 .RE

   134 

   135 .SH GENERATED KEY FILES

   136 .sp

   137 .LP

   138 When \fBdnssec-keyfromlabel\fR completes successfully, it displays a string of the form \fBK\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR\fR to the standard output. This is an identification string for the key files it has generated, which translates as follows.

   139 .RS +4

   140 .TP

   141 .ie t \(bu

   142 .el o

   143 \fInnnn\fR is the key name.

   144 .RE

   145 .RS +4

   146 .TP

   147 .ie t \(bu

   148 .el o

   149 \fIaaa\fR is the numeric representation of the algorithm.

   150 .RE

   151 .RS +4

   152 .TP

   153 .ie t \(bu

   154 .el o

   155 \fIiiiii\fR is the key identifier (or footprint).

   156 .RE

   157 .sp

   158 .LP

   159 \fBdnssec-keyfromlabel\fR creates two files, with names based on the displayed string.  \fBK\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR.key\fR contains the public key, and \fBK\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR.private\fR contains the private key.

   160 .sp

   161 .LP

   162 The first file contains a \fBDNS\fR \fBKEY\fR record that can be inserted into a zone file (directly or with an \fB$INCLUDE\fR statement).

   163 .sp

   164 .LP

   165 The second file contains algorithm-specific fields. For obvious security reasons, this file does not have general read permission.

   166 .SH ATTRIBUTES

   167 .sp

   168 .LP

   169 See \fBattributes\fR(5) for descriptions of the following attributes:

   170 .sp

   171 

   172 .sp

   173 .TS

   174 tab() box;

   175 cw(2.75i) |cw(2.75i) 

   176 lw(2.75i) |lw(2.75i) 

   177 .

   178 ATTRIBUTE TYPEATTRIBUTE VALUE

   179 _

   180 Availabilityservice/network/dns/bind

   181 _

   182 Interface StabilityVolatile

   183 .TE

   184 

   185 .SH SEE ALSO

   186 .sp

   187 .LP

   188 \fBdnssec-keygen\fR(8), \fBdnssec-signzone\fR(8), \fBattributes\fR(5)

   189 .sp

   190 .LP

   191 \fIRFC 2539\fR, \fIRFC 2845\fR, \fIRFC 4033\fR

   192 .sp

   193 .LP

   194 See the BIND 9 \fIAdministrator's Reference Manual\fR. As of the date of publication of this man page, this document is available at https://www.isc.org/software/bind/documentation\&.