dnssec-keygen
- [-a ]
- [algorithm-b ]
- [keysize-n ]
[nametype-3]
[-A ]
+ [date/offset-a ]
+ [algorithm-b ]
[keysize-C]
[-c ]
[class-D ]
@@ -52,6 +51,7 @@
[date/offset-K ]
[directory-k]
[-L ]
+ [ttl-n ]
[nametype-P ]
[date/offset-P sync ]
[date/offset-p ]
@@ -62,7 +62,6 @@
[protocol-t ]
[type-V]
[-v ]
- [level-z]
{name}
+ Use an NSEC3-capable algorithm to generate a DNSSEC key. + If this option is used with an algorithm that has both + NSEC and NSEC3 versions, then the NSEC3 version will be + used; for example, dnssec-keygen -3a RSASHA1 + specifies the NSEC3RSASHA1 algorithm. +
+algorithm@@ -130,11 +139,9 @@
Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSA keys must be - between 1024 and 2048 bits. Diffie Hellman keys must be between - 128 and 4096 bits. DSA keys must be between 512 and 1024 - bits and an exact multiple of 64. HMAC keys must be - between 1 and 512 bits. Elliptic curve algorithms don't need - this parameter. + between 1024 and 4096 bits. Diffie Hellman keys must be between + 128 and 4096 bits. Elliptic curve algorithms don't need this + parameter.
If the key size is not specified, some algorithms have
@@ -144,36 +151,15 @@
-f KSK) default to 2048 bits.
nametype
- Specifies the owner type of the key. The value of
- nametype must either be ZONE (for a DNSSEC
- zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
- with a host (KEY)), USER (for a key associated with a
- user(KEY)) or OTHER (DNSKEY). These values are case
- insensitive. Defaults to ZONE for DNSKEY generation.
-
- Use an NSEC3-capable algorithm to generate a DNSSEC key. - If this option is used with an algorithm that has both - NSEC and NSEC3 versions, then the NSEC3 version will be - used; for example, dnssec-keygen -3a RSASHA1 - specifies the NSEC3RSASHA1 algorithm. -
-
- Compatibility mode: generates an old-style key, without
- any metadata. By default, dnssec-keygen
- will include the key's creation date in the metadata stored
- with the private key, and other dates may be set there as well
- (publication date, activation date, etc). Keys that include
- this data may be incompatible with older versions of BIND; the
+ Compatibility mode: generates an old-style key, without any
+ timing metadata. By default, dnssec-keygen
+ will include the key's creation date in the metadata stored with
+ the private key, and other dates may be set there as well
+ (publication date, activation date, etc). Keys that include this
+ data may be incompatible with older versions of BIND; the
-C option suppresses them.
- Deprecated in favor of -T KEY. -
-ttl
@@ -253,13 +233,24 @@
or none is the same as leaving it unset.
nametype
+ Specifies the owner type of the key. The value of
+ nametype must either be ZONE (for a DNSSEC
+ zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+ with a host (KEY)), USER (for a key associated with a
+ user(KEY)) or OTHER (DNSKEY). These values are case
+ insensitive. Defaults to ZONE for DNSKEY generation.
+
protocol
- Sets the protocol value for the generated key. The protocol
- is a number between 0 and 255. The default is 3 (DNSSEC).
- Other possible values for this argument are listed in
- RFC 2535 and its successors.
+ Sets the protocol value for the generated key, for use
+ with -T KEY. The protocol is a number between 0
+ and 255. The default is 3 (DNSSEC). Other possible values for
+ this argument are listed in RFC 2535 and its successors.
-
-
- Specifying any TSIG algorithm (HMAC-* or DH) with
- -a forces this option to KEY.
-
type
- Indicates the use of the key. type must be
- one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
- is AUTHCONF. AUTH refers to the ability to authenticate
- data, and CONF the ability to encrypt data.
-
level
- Sets the debugging level.
+ Indicates the use of the key, for use with -T
+ KEY. type must be one of AUTHCONF,
+ NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+ refers to the ability to authenticate data, and CONF the ability
+ to encrypt data.
level+ Sets the debugging level. +
+
- To generate an ECDSAP256SHA256 key for the domain
- example.com, the following command would be
- issued:
+ To generate an ECDSAP256SHA256 zone-signing key for the zone
+ example.com, issue the command:
dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com
+
+ dnssec-keygen -a ECDSAP256SHA256 example.com
The command would print a string of the form:
@@ -515,6 +501,12 @@
and
Kexample.com.+013+26160.private.
+ To generate a matching key-signing key, issue the command: +
+
+ dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com
+
BIND 9.14.0rc1 (Stable Release)
+BIND 9.14.0rc2 (Stable Release)