1 '\" te

     2 .\" Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")

     3 .\" Permission to use, copy, modify, and/or distribute this software for any purpose  with or without fee is hereby granted, provided that the above copyright notice  and this permission notice appear in all copies.  THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING  FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE  USE OR PERFORMANCE OF THIS SOFTWARE.

     4 .\" Portions Copyright (c) 2010, Sun Microsystems, Inc. All Rights Reserved.

     5 .TH dnssec-keygen 8 "19 Oct 2015" "SunOS 5.12" "System Administration Commands"

     6 .SH NAME

     7 dnssec-keygen \- DNSSEC key generation tool

     8 .SH SYNOPSIS

     9 .LP

    10 .nf

    11 \fBdnssec-keygen\fR \fB-a\fR \fIalgorithm\fR \fB-b\fR \fIkeysize\fR \fB-n\fR \fInametype\fR [\fB-ehk\fR] 

    12      [\fB-c\fR \fIclass\fR] [\fB-f\fR \fIflag\fR] [\fB-g\fR \fIgenerator\fR] [\fB-p\fR \fIprotocol\fR] 

    13      [\fB-r\fR \fIrandomdev\fR] [\fB-s\fR \fIstrength\fR] [\fB-t\fR \fItype\fR] [\fB-v\fR \fIlevel\fR] \fIname\fR

    14 .fi

    15 

    16 .SH DESCRIPTION

    17 .sp

    18 .LP

    19 The \fBdnssec-keygen\fR utility generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.

    20 .SH OPTIONS

    21 .sp

    22 .LP

    23 The following options are supported:

    24 .sp

    25 .ne 2

    26 .mk

    27 .na

    28 \fB\fB-a\fR \fIalgorithm\fR\fR

    29 .ad

    30 .sp .6

    31 .RS 4n

    32 Select the cryptographic algorithm. The value of algorithm must be one of RSAMD5 (RSA) or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, \fBDH\fR (Diffie-Hellman), or HMAC-MD5. These values are case insensitive.

    33 .sp

    34 For DNSSEC, RSASHA1 is a mandatory-to-implement algorithm and DSA is recommended. For TSIG, HMAC-MD5 is mandatory.

    35 .LP

    36 Note - 

    37 .sp

    38 .RS 2

    39 HMAC-MD5 and DH automatically set the \fB-k\fR flag.

    40 .RE

    41 .RE

    42 

    43 .sp

    44 .ne 2

    45 .mk

    46 .na

    47 \fB\fB-b\fR \fIkeysize\fR\fR

    48 .ad

    49 .sp .6

    50 .RS 4n

    51 Specify the number of bits in the key. The choice of key size depends on the algorithm used. RSAMD5 and RSASHA1 keys must be between 512 and 2048 bits. Diffie-Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC-MD5 keys must be between 1 and 512 bits.

    52 .RE

    53 

    54 .sp

    55 .ne 2

    56 .mk

    57 .na

    58 \fB\fB-c\fR \fIclass\fR\fR

    59 .ad

    60 .sp .6

    61 .RS 4n

    62 Indicate that the DNS record containing the key should have the specified class. If not specified, class IN is used.

    63 .RE

    64 

    65 .sp

    66 .ne 2

    67 .mk

    68 .na

    69 \fB\fB-e\fR\fR

    70 .ad

    71 .sp .6

    72 .RS 4n

    73 Use a large exponent if generating an RSAMD5 or RSASHA1 key.

    74 .RE

    75 

    76 .sp

    77 .ne 2

    78 .mk

    79 .na

    80 \fB\fB-f\fR \fIflag\fR\fR

    81 .ad

    82 .sp .6

    83 .RS 4n

    84 Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flag is KSK (Key Signing Key) DNSKEY.

    85 .RE

    86 

    87 .sp

    88 .ne 2

    89 .mk

    90 .na

    91 \fB\fB-g\fR \fIgenerator\fR\fR

    92 .ad

    93 .sp .6

    94 .RS 4n

    95 Use this \fIgenerator\fR if generating a Diffie Hellman key. Allowed values are 2 and 5. If no generator is specified, a known prime from RFC 2539 will be used if possible; otherwise the default is 2.

    96 .RE

    97 

    98 .sp

    99 .ne 2

   100 .mk

   101 .na

   102 \fB\fB-h\fR\fR

   103 .ad

   104 .sp .6

   105 .RS 4n

   106 Print a short summary of the options and arguments to \fBdnssec-keygen\fR.

   107 .RE

   108 

   109 .sp

   110 .ne 2

   111 .mk

   112 .na

   113 \fB\fB-k\fR\fR

   114 .ad

   115 .sp .6

   116 .RS 4n

   117 Generate KEY records rather than DNSKEY records.

   118 .RE

   119 

   120 .sp

   121 .ne 2

   122 .mk

   123 .na

   124 \fB\fB-n\fR \fInametype\fR\fR

   125 .ad

   126 .sp .6

   127 .RS 4n

   128 Specify the owner type of the key. The value of \fInametype\fR must either be \fBZONE\fR (for a DNSSEC zone key (KEY/DNSKEY)), \fBHOST\fR or \fBENTITY\fR (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)), or \fBOTHER\fR (DNSKEY). These values are case insensitive. Defaults to ZONE for DNSKEY generation.

   129 .RE

   130 

   131 .sp

   132 .ne 2

   133 .mk

   134 .na

   135 \fB\fB-p\fR \fIprotocol\fR\fR

   136 .ad

   137 .sp .6

   138 .RS 4n

   139 Set the protocol value for the generated key. The \fIprotocol\fR argument is a number between 0 and 255. The default is 3 (DNSSEC) Other possible values for this argument are listed in RFC 2535 and its successors.

   140 .RE

   141 

   142 .sp

   143 .ne 2

   144 .mk

   145 .na

   146 \fB\fB-r\fR \fIrandomdev\fR\fR

   147 .ad

   148 .sp .6

   149 .RS 4n

   150 Specify the source of randomness. If the operating system does not provide a \fB/dev/random\fR or equivalent device, the default source of randomness is keyboard input. \fIrandomdev\fR specifies the name of a character device or file containing random data to be used instead of the default. The special value "\fBkeyboard\fR" indicates that keyboard input should be used.

   151 .RE

   152 

   153 .sp

   154 .ne 2

   155 .mk

   156 .na

   157 \fB\fB-s\fR \fIstrength\fR\fR

   158 .ad

   159 .sp .6

   160 .RS 4n

   161 Specify the strength value of the key. The \fIstrength\fR argument is a number between 0 and 15, and currently has no defined purpose in DNSSEC.

   162 .RE

   163 

   164 .sp

   165 .ne 2

   166 .mk

   167 .na

   168 \fB\fB-t\fR \fItype\fR\fR

   169 .ad

   170 .sp .6

   171 .RS 4n

   172 Indicate the use of the key. \fBtype\fR must be one of \fBAUTHCONF\fR, \fBNOAUTHCONF\fR, \fBNOAUTH\fR, or \fBNOCONF\fR. The default is \fBAUTHCONF\fR. \fBAUTH\fR refers to the ability to authenticate data, and \fBCONF\fR the ability to encrypt data.

   173 .RE

   174 

   175 .sp

   176 .ne 2

   177 .mk

   178 .na

   179 \fB\fB-v\fR \fIlevel\fR\fR

   180 .ad

   181 .sp .6

   182 .RS 4n

   183 Set the debugging level.

   184 .RE

   185 

   186 .SH GENERATED KEYS

   187 .sp

   188 .LP

   189 When \fBdnssec-keygen\fR completes successfully, it prints a string of the form \fBK\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR\fR to the standard output. This is an identification string for the key it has generated.

   190 .RS +4

   191 .TP

   192 .ie t \(bu

   193 .el o

   194 \fInnnn\fR is the key name.

   195 .RE

   196 .RS +4

   197 .TP

   198 .ie t \(bu

   199 .el o

   200 \fIaaa\fR is the numeric representation of the algorithm.

   201 .RE

   202 .RS +4

   203 .TP

   204 .ie t \(bu

   205 .el o

   206 \fIiiiii\fR is the key identifier (or footprint).

   207 .RE

   208 .sp

   209 .LP

   210 The \fBdnssec-keygen\fR utility creates two files, with names based on the printed string. 

   211 .RS +4

   212 .TP

   213 .ie t \(bu

   214 .el o

   215 \fBK\fR\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR.\fBkey\fR contains the public key.

   216 .RE

   217 .RS +4

   218 .TP

   219 .ie t \(bu

   220 .el o

   221 \fBK\fR\fInnnn\fR.+\fIaaa\fR+\fIiiiii\fR.\fBprivate\fR contains the private key.

   222 .RE

   223 .sp

   224 .LP

   225 The \fB\&.key\fR file contains a DNS \fBKEY\fR record that can be inserted into a zone file (directly or with a \fB$INCLUDE\fR statement).

   226 .sp

   227 .LP

   228 The \fB\&.private\fR file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission.

   229 .sp

   230 .LP

   231 Both \fB\&.key\fR and \fB\&.private\fR files are generated for symmetric encryption algorithm such as HMAC-MD5, even though the public and private key are equivalent.

   232 .SH EXAMPLES

   233 .LP

   234 \fBExample 1 \fRGenerating a 768-bit DSA Key

   235 .sp

   236 .LP

   237 To generate a 768-bit DSA key for the domain \fBexample.com\fR, the following command would be issued:

   238 

   239 .sp

   240 .in +2

   241 .nf

   242 dnssec-keygen -a DSA -b 768 -n ZONE example.com

   243 .fi

   244 .in -2

   245 .sp

   246 

   247 .sp

   248 .LP

   249 The command would print a string of the form:

   250 

   251 .sp

   252 .in +2

   253 .nf

   254 Kexample.com.+003+26160

   255 .fi

   256 .in -2

   257 .sp

   258 

   259 .sp

   260 .LP

   261 The following files would be created:

   262 

   263 .sp

   264 .in +2

   265 .nf

   266 Kexample.com.+003+26160.key

   267 Kexample.com.+003+26160.private

   268 .fi

   269 .in -2

   270 .sp

   271 

   272 .SH ATTRIBUTES

   273 .sp

   274 .LP

   275 See \fBattributes\fR(5) for descriptions of the following attributes:

   276 .sp

   277 

   278 .sp

   279 .TS

   280 tab() box;

   281 cw(2.75i) |cw(2.75i) 

   282 lw(2.75i) |lw(2.75i) 

   283 .

   284 ATTRIBUTE TYPEATTRIBUTE VALUE

   285 _

   286 Availabilityservice/network/dns/bind

   287 _

   288 Interface StabilityVolatile

   289 .TE

   290 

   291 .SH SEE ALSO

   292 .sp

   293 .LP

   294 \fBdnssec-signzone\fR(8), \fBattributes\fR(5)

   295 .sp

   296 .LP

   297 \fIRFC 2539\fR, \fIRFC 2845\fR, \fIRFC 4033\fR

   298 .sp

   299 .LP

   300 See the BIND 9 \fIAdministrator's Reference Manual\fR. As of the date of publication of this man page, this document is available at https://www.isc.org/software/bind/documentation\&.