The command would print a string of the form: .+003+26160

To generate a 768-bit DSA key for the domain, the followingĬommand would be issued: dnssec-keygen -a DSA -b 768 -n ZONE private files are generated for symmetric encryption algorithm suchĪs HMAC-MD5, even though the public and private key are equivalent. For obvious security reasons, thisįile does not have general read permission.īoth. private file contains algorithm specific fields. Into a zone file (directly or with a $INCLUDE statement). key file contains a DNS KEY record that can be inserted The dnssec-keygen utility creates two files, with names based on the printed Iiiii is the key identifier (or footprint). This is an identification string for the keyĪaa is the numeric representation of the algorithm. When dnssec-keygen completes successfully, it prints a string of the form K nnnn.+ aaa+ iiiii AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data. type must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The strength argument is a number between 0 and 15, and currently has no defined purpose in DNSSEC. The special value “ keyboard” indicates that keyboard input should be used. randomdev specifies the name of a character device or file containing random data to be used instead of the default. If the operating system does not provide a /dev/random or equivalent device, the default source of randomness is keyboard input. The default is 3 (DNSSEC) Other possible values for this argument are listed in RFC 2535 and its successors. The protocol argument is a number between 0 and 255. Set the protocol value for the generated key. The value of nametype must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)), or OTHER (DNSKEY). Generate KEY records rather than DNSKEY records. Print a short summary of the options and arguments to dnssec-keygen. If no generator is specified, a known prime from RFC 2539 will be used if possible otherwise the default is 2. Use this generator if generating a Diffie Hellman key. The only recognized flag is KSK (Key Signing Key) DNSKEY. Set the specified flag in the flag field of the KEY/DNSKEY record. Use a large exponent if generating an RSAMD5 or RSASHA1 key. Indicate that the DNS record containing the key should have the specified class. HMAC-MD5 keys must be between 1 and 512 bits.

DSA keys must be between 5 bits and an exact multiple of 64. Diffie-Hellman keys must be between 1 bits. RSAMD5 and RSASHA1 keys must be between 5 bits. The choice of key size depends on the algorithm used. Note - HMAC-MD5 and DH automatically set the -k flag.

E prime 2 0 keygen software