Linux in a Nutshell, Fifth Edition

dnssec-keygen | 125

Linux

Commands

This is the Title of the Book, eMatter Edition

Copyright © 2006 O’Reilly & Associates, Inc. All rights reserved.

dnssec-keygen

dnssec-keygen [options] domain-name

System administration command. Generate encrypted Secure DNS

(DNSSEC) or Transaction Signatures (TSIG) keys for domain-

name. When the key is completed, dnssec-keygen prints the key

identifier to standard output and creates public and private keyfiles

whose names are based on the key identifier and the filename

extensions .key and .private. It creates both files even when using

an asymmetric algorithm, such as HMAC-MD5. For more informa-

tion on Secure DNS, see DNS and BIND (O’Reilly), or read RFC

2535.

Options

-a algorithm

Specify the cryptographic algorithm to use. Accepted values

are RSAMD5, RSA, DSA, DH,orHMAC-MD5. DSA or RSA

should be used for Secure DNS, and HMAC-MD5 for TSIG.

-b bitsize

Specify the key bitsize. Accepted values depend on the encryp-

tion algorithm used, but, in general, a larger key size means

stronger encryption. 128 bits is usually considered reasonably

secure, and 512 quite good.

-c class

The domain record for which the key is being generated

should contain class. When this option is not given, a class of

IN is assumed.

-e Use a large exponent when generating an RSA key.

-g generator

Specify the number to use as a generator when creating a DH

(Diffie Hellman) key. Accepted values are 2 and ...