DNSKEYGEN(1) BSD Reference Manual DNSKEYGEN(1) NNAAMMEE ddnnsskkeeyyggeenn - generate public, private, and shared secret keys for DNS SSYYNNOOPPSSIISS ddnnsskkeeyyggeenn [--[DDHHRR] _s_i_z_e] [--FF] --[zzhhuu] [--aa] [--cc] [--pp _n_u_m] [--ss _n_u_m] --nn _n_a_m_e DDEESSCCRRIIPPTTIIOONN DDnnsskkeeyyggeenn (DNS Key Generator) is a tool to generate and maintain keys for DNS Security within the DNS (Domain Name System). DDnnsskkeeyyggeenn can generate public and private keys to authenticate zone data, and shared secret keys to be used for Request/Transaction signatures. --DD Dnskeygen will generate a DDSSAA//DDSSSS key. ``size'' must be one of [512, 576, 640, 704, 768, 832, 896, 960, 1024]. --HH Dnskeygen will generate an HHMMAACC--MMDD55 key. ``size'' must be between 128 and 504. --RR Dnskeygen will generate an RRSSAA key. ``size'' must be between 512 and 4096. --FF ((RRSSAA oonnllyy)) Use a large exponent for key generation. --zz --hh --uu These flags define the type of key being generated: Zone (DNS validation) key, Host (host or service) key or User (e.g. email) key, respectively. Each key is only allowed to be one of these. --aa Indicates that the key CCAANNNNOOTT be used for authentication. --cc Indicates that the key CCAANNNNOOTT be used for encryption. --pp _n_u_m Sets the key's protocol field to _n_u_m ; the default is 33 (DNSSEC) if ``--zz'' or ``--hh'' is specified and 22 (EMAIL) oth- erwise. Other accepted values are 11 (TLS), 44 (IPSEC), and 225555 (ANY). --ss _n_u_m Sets the key's strength field to _n_u_m_; the default is 00.. --nn _n_a_m_e Sets the key's name to _n_a_m_e_. DDEETTAAIILLSS DDnnsskkeeyyggeenn stores each key in two files: _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._p_r_i_v_a_t_e and _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._k_e_y The file _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._p_r_i_v_a_t_e contains the private key in a portable format. The file _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._k_e_y contains the public key in the DNS zone file format: _<_n_a_m_e_> _I_N _K_E_Y _<_f_l_a_g_s_> _<_a_l_g_o_r_i_t_h_m_> _<_p_r_o_t_o_c_o_l_> _<_e_x_p_o_n_e_n_t_|_m_o_d_u_l_u_s_> EENNVVIIRROONNMMEENNTT No environmental variables are used. SSEEEE AALLSSOO _R_F_C _2_0_6_5 on secure DNS and the _T_S_I_G Internet Draft. AAUUTTHHOORR Olafur Gudmundsson (ogud@tis.com). AACCKKNNOOWWLLEEDDGGMMEENNTTSS The underlying cryptographic math is done by the DNSSAFE and/or Founda- tion Toolkit libraries. BBUUGGSS None are known at this time 4th Berkeley Distribution December 2, 1998 2