
DNSKEYGEN(1)            FreeBSD General Commands Manual           DNSKEYGEN(1)

NNAAMMEE
     ddnnsskkeeyyggeenn - generate public, private, and shared secret keys for DNS

SSYYNNOOPPSSIISS
     ddnnsskkeeyyggeenn [--[DDHHRR] _s_i_z_e] [--FF] --[zzhhuu] [--aa] [--cc] [--pp _n_u_m] [--ss _n_u_m] --nn _n_a_m_e

DDEESSCCRRIIPPTTIIOONN
     DDnnsskkeeyyggeenn (DNS Key Generator) is a tool to generate and maintain keys for
     DNS Security within the DNS (Domain Name System).  DDnnsskkeeyyggeenn can generate
     public and private keys to authenticate zone data, and shared secret keys
     to be used for Request/Transaction signatures.

     --DD          Dnskeygen will generate a DDSSAA//DDSSSS key.  ``size'' must be one
                 of [512, 576, 640, 704, 768, 832, 896, 960, 1024].

     --HH          Dnskeygen will generate an HHMMAACC--MMDD55 key.  ``size'' must be
                 between 128 and 504.

     --RR          Dnskeygen will generate an RRSSAA key.  ``size'' must be between
                 512 and 4096.

     --FF          ((RRSSAA oonnllyy)) Use a large exponent for key generation.

     --zz --hh --uu    These flags define the type of key being generated: Zone (DNS
                 validation) key, Host (host or service) key or User (e.g.
                 email) key, respectively.  Each key is only allowed to be one
                 of these.

     --aa          Indicates that the key CCAANNNNOOTT be used for authentication.

     --cc          Indicates that the key CCAANNNNOOTT be used for encryption.

     --pp _n_u_m      Sets the key's protocol field to _n_u_m ; the default is 33
                 (DNSSEC) if ``--zz'' or ``--hh'' is specified and 22 (EMAIL) oth-
                 erwise.  Other accepted values are 11 (TLS), 44 (IPSEC), and
                 225555 (ANY).

     --ss _n_u_m      Sets the key's strength field to _n_u_m_; the default is 00..

     --nn _n_a_m_e     Sets the key's name to _n_a_m_e_.

   DDEETTAAIILLSS
     DDnnsskkeeyyggeenn stores each key in two files: _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._p_r_i_v_a_t_e
     and _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._k_e_y The file
     _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._p_r_i_v_a_t_e contains the private key in a portable
     format.  The file _K_<_n_a_m_e_>_+_<_a_l_g_>_+_<_f_o_o_t_p_r_i_n_t_>_._k_e_y contains the public key
     in the DNS zone file format:

           _<_n_a_m_e_> _I_N _K_E_Y _<_f_l_a_g_s_> _<_a_l_g_o_r_i_t_h_m_> _<_p_r_o_t_o_c_o_l_> _<_e_x_p_o_n_e_n_t_|_m_o_d_u_l_u_s_>

EENNVVIIRROONNMMEENNTT
     No environmental variables are used.

SSEEEE AALLSSOO
     _R_F_C _2_0_6_5 on secure DNS and the _T_S_I_G Internet Draft.

AAUUTTHHOORR
     Olafur Gudmundsson (ogud@tis.com).

AACCKKNNOOWWLLEEDDGGMMEENNTTSS
     The underlying cryptographic math is done by the DNSSAFE and/or Founda-
     tion Toolkit libraries.

BBUUGGSS
     None are known at this time

4th Berkeley Distribution      December 2, 1998                              2
