| genpkey.1 (331638) | genpkey.1 (337982) |
|---|---|
| 1.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.35) | 1.\" Automatically generated by Pod::Man 4.09 (Pod::Simple 3.35) |
| 2.\" 3.\" Standard preamble: 4.\" ======================================================================== 5.de Sp \" Vertical space (when we can't use .PP) 6.if t .sp .5v 7.if n .sp 8.. 9.de Vb \" Begin verbatim text --- 114 unchanged lines hidden (view full) --- 124. ds Th \o'LP' 125. ds ae ae 126. ds Ae AE 127.\} 128.rm #[ #] #H #V #F C 129.\" ======================================================================== 130.\" 131.IX Title "GENPKEY 1" | 2.\" 3.\" Standard preamble: 4.\" ======================================================================== 5.de Sp \" Vertical space (when we can't use .PP) 6.if t .sp .5v 7.if n .sp 8.. 9.de Vb \" Begin verbatim text --- 114 unchanged lines hidden (view full) --- 124. ds Th \o'LP' 125. ds ae ae 126. ds Ae AE 127.\} 128.rm #[ #] #H #V #F C 129.\" ======================================================================== 130.\" 131.IX Title "GENPKEY 1" |
| 132.TH GENPKEY 1 "2018-03-27" "1.0.2o" "OpenSSL" | 132.TH GENPKEY 1 "2018-08-14" "1.0.2p" "OpenSSL" |
| 133.\" For nroff, turn off justification. Always turn off hyphenation; it makes 134.\" way too many mistakes in technical documents. 135.if n .ad l 136.nh 137.SH "NAME" 138openssl\-genpkey, 139genpkey \- generate a private key 140.SH "SYNOPSIS" 141.IX Header "SYNOPSIS" 142\&\fBopenssl\fR \fBgenpkey\fR 143[\fB\-out filename\fR] 144[\fB\-outform PEM|DER\fR] 145[\fB\-pass arg\fR] | 133.\" For nroff, turn off justification. Always turn off hyphenation; it makes 134.\" way too many mistakes in technical documents. 135.if n .ad l 136.nh 137.SH "NAME" 138openssl\-genpkey, 139genpkey \- generate a private key 140.SH "SYNOPSIS" 141.IX Header "SYNOPSIS" 142\&\fBopenssl\fR \fBgenpkey\fR 143[\fB\-out filename\fR] 144[\fB\-outform PEM|DER\fR] 145[\fB\-pass arg\fR] |
| 146[\fB\-cipher\fR] | 146[\fB\-\f(BIcipher\fB\fR] |
| 147[\fB\-engine id\fR] 148[\fB\-paramfile file\fR] 149[\fB\-algorithm alg\fR] 150[\fB\-pkeyopt opt:value\fR] 151[\fB\-genparam\fR] 152[\fB\-text\fR] 153.SH "DESCRIPTION" 154.IX Header "DESCRIPTION" 155The \fBgenpkey\fR command generates a private key. 156.SH "OPTIONS" 157.IX Header "OPTIONS" 158.IP "\fB\-out filename\fR" 4 159.IX Item "-out filename" 160the output filename. If this argument is not specified then standard output is 161used. 162.IP "\fB\-outform DER|PEM\fR" 4 163.IX Item "-outform DER|PEM" | 147[\fB\-engine id\fR] 148[\fB\-paramfile file\fR] 149[\fB\-algorithm alg\fR] 150[\fB\-pkeyopt opt:value\fR] 151[\fB\-genparam\fR] 152[\fB\-text\fR] 153.SH "DESCRIPTION" 154.IX Header "DESCRIPTION" 155The \fBgenpkey\fR command generates a private key. 156.SH "OPTIONS" 157.IX Header "OPTIONS" 158.IP "\fB\-out filename\fR" 4 159.IX Item "-out filename" 160the output filename. If this argument is not specified then standard output is 161used. 162.IP "\fB\-outform DER|PEM\fR" 4 163.IX Item "-outform DER|PEM" |
| 164This specifies the output format \s-1DER\s0 or \s-1PEM.\s0 | 164This specifies the output format \s-1DER\s0 or \s-1PEM.\s0 The default format is \s-1PEM.\s0 |
| 165.IP "\fB\-pass arg\fR" 4 166.IX Item "-pass arg" | 165.IP "\fB\-pass arg\fR" 4 166.IX Item "-pass arg" |
| 167the output file password source. For more information about the format of \fBarg\fR | 167The output file password source. For more information about the format of \fBarg\fR |
| 168see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). | 168see the \fB\s-1PASS PHRASE ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1). |
| 169.IP "\fB\-cipher\fR" 4 | 169.IP "\fB\-\f(BIcipher\fB\fR" 4 |
| 170.IX Item "-cipher" 171This option encrypts the private key with the supplied cipher. Any algorithm 172name accepted by \fIEVP_get_cipherbyname()\fR is acceptable such as \fBdes3\fR. 173.IP "\fB\-engine id\fR" 4 174.IX Item "-engine id" | 170.IX Item "-cipher" 171This option encrypts the private key with the supplied cipher. Any algorithm 172name accepted by \fIEVP_get_cipherbyname()\fR is acceptable such as \fBdes3\fR. 173.IP "\fB\-engine id\fR" 4 174.IX Item "-engine id" |
| 175specifying an engine (by its unique \fBid\fR string) will cause \fBgenpkey\fR | 175Specifying an engine (by its unique \fBid\fR string) will cause \fBgenpkey\fR |
| 176to attempt to obtain a functional reference to the specified engine, 177thus initialising it if needed. The engine will then be set as the default 178for all available algorithms. If used this option should precede all other 179options. 180.IP "\fB\-algorithm alg\fR" 4 181.IX Item "-algorithm alg" | 176to attempt to obtain a functional reference to the specified engine, 177thus initialising it if needed. The engine will then be set as the default 178for all available algorithms. If used this option should precede all other 179options. 180.IP "\fB\-algorithm alg\fR" 4 181.IX Item "-algorithm alg" |
| 182public key algorithm to use such as \s-1RSA, DSA\s0 or \s-1DH.\s0 If used this option must | 182Public key algorithm to use such as \s-1RSA, DSA\s0 or \s-1DH.\s0 If used this option must |
| 183precede any \fB\-pkeyopt\fR options. The options \fB\-paramfile\fR and \fB\-algorithm\fR | 183precede any \fB\-pkeyopt\fR options. The options \fB\-paramfile\fR and \fB\-algorithm\fR |
| 184are mutually exclusive. | 184are mutually exclusive. Engines may add algorithms in addition to the standard 185built-in ones. 186.Sp 187Valid built-in algorithm names for private key generation are \s-1RSA\s0 and \s-1EC.\s0 188.Sp 189Valid built-in algorithm names for parameter generation (see the \fB\-genparam\fR 190option) are \s-1DH, DSA\s0 and \s-1EC.\s0 191.Sp 192Note that the algorithm name X9.42 \s-1DH\s0 may be used as a synonym for the \s-1DH\s0 193algorithm. These are identical and do not indicate the type of parameters that 194will be generated. Use the \fBdh_paramgen_type\fR option to indicate whether PKCS#3 195or X9.42 \s-1DH\s0 parameters are required. See \*(L"\s-1DH\s0 Parameter Generation Options\*(R" 196below for more details. |
| 185.IP "\fB\-pkeyopt opt:value\fR" 4 186.IX Item "-pkeyopt opt:value" | 197.IP "\fB\-pkeyopt opt:value\fR" 4 198.IX Item "-pkeyopt opt:value" |
| 187set the public key algorithm option \fBopt\fR to \fBvalue\fR. The precise set of | 199Set the public key algorithm option \fBopt\fR to \fBvalue\fR. The precise set of |
| 188options supported depends on the public key algorithm used and its | 200options supported depends on the public key algorithm used and its |
| 189implementation. See \fB\s-1KEY GENERATION OPTIONS\s0\fR below for more details. | 201implementation. See \*(L"\s-1KEY GENERATION OPTIONS\*(R"\s0 and 202\&\*(L"\s-1PARAMETER GENERATION OPTIONS\*(R"\s0 below for more details. |
| 190.IP "\fB\-genparam\fR" 4 191.IX Item "-genparam" | 203.IP "\fB\-genparam\fR" 4 204.IX Item "-genparam" |
| 192generate a set of parameters instead of a private key. If used this option must 193precede and \fB\-algorithm\fR, \fB\-paramfile\fR or \fB\-pkeyopt\fR options. | 205Generate a set of parameters instead of a private key. If used this option must 206precede any \fB\-algorithm\fR, \fB\-paramfile\fR or \fB\-pkeyopt\fR options. |
| 194.IP "\fB\-paramfile filename\fR" 4 195.IX Item "-paramfile filename" 196Some public key algorithms generate a private key based on a set of parameters. 197They can be supplied using this option. If this option is used the public key 198algorithm used is determined by the parameters. If used this option must 199precede and \fB\-pkeyopt\fR options. The options \fB\-paramfile\fR and \fB\-algorithm\fR 200are mutually exclusive. 201.IP "\fB\-text\fR" 4 202.IX Item "-text" 203Print an (unencrypted) text representation of private and public keys and 204parameters along with the \s-1PEM\s0 or \s-1DER\s0 structure. 205.SH "KEY GENERATION OPTIONS" 206.IX Header "KEY GENERATION OPTIONS" 207The options supported by each algorith and indeed each implementation of an 208algorithm can vary. The options for the OpenSSL implementations are detailed 209below. | 207.IP "\fB\-paramfile filename\fR" 4 208.IX Item "-paramfile filename" 209Some public key algorithms generate a private key based on a set of parameters. 210They can be supplied using this option. If this option is used the public key 211algorithm used is determined by the parameters. If used this option must 212precede and \fB\-pkeyopt\fR options. The options \fB\-paramfile\fR and \fB\-algorithm\fR 213are mutually exclusive. 214.IP "\fB\-text\fR" 4 215.IX Item "-text" 216Print an (unencrypted) text representation of private and public keys and 217parameters along with the \s-1PEM\s0 or \s-1DER\s0 structure. 218.SH "KEY GENERATION OPTIONS" 219.IX Header "KEY GENERATION OPTIONS" 220The options supported by each algorith and indeed each implementation of an 221algorithm can vary. The options for the OpenSSL implementations are detailed 222below. |
| 210.SH "RSA KEY GENERATION OPTIONS" 211.IX Header "RSA KEY GENERATION OPTIONS" | 223.SS "\s-1RSA\s0 Key Generation Options" 224.IX Subsection "RSA Key Generation Options" |
| 212.IP "\fBrsa_keygen_bits:numbits\fR" 4 213.IX Item "rsa_keygen_bits:numbits" 214The number of bits in the generated key. If not specified 1024 is used. 215.IP "\fBrsa_keygen_pubexp:value\fR" 4 216.IX Item "rsa_keygen_pubexp:value" 217The \s-1RSA\s0 public exponent value. This can be a large decimal or 218hexadecimal value if preceded by \fB0x\fR. Default value is 65537. | 225.IP "\fBrsa_keygen_bits:numbits\fR" 4 226.IX Item "rsa_keygen_bits:numbits" 227The number of bits in the generated key. If not specified 1024 is used. 228.IP "\fBrsa_keygen_pubexp:value\fR" 4 229.IX Item "rsa_keygen_pubexp:value" 230The \s-1RSA\s0 public exponent value. This can be a large decimal or 231hexadecimal value if preceded by \fB0x\fR. Default value is 65537. |
| 219.SH "DSA PARAMETER GENERATION OPTIONS" 220.IX Header "DSA PARAMETER GENERATION OPTIONS" | 232.SS "\s-1EC\s0 Key Generation Options" 233.IX Subsection "EC Key Generation Options" 234The \s-1EC\s0 key generation options can also be used for parameter generation. 235.IP "\fBec_paramgen_curve:curve\fR" 4 236.IX Item "ec_paramgen_curve:curve" 237The \s-1EC\s0 curve to use. OpenSSL supports \s-1NIST\s0 curve names such as \*(L"P\-256\*(R". 238.IP "\fBec_param_enc:encoding\fR" 4 239.IX Item "ec_param_enc:encoding" 240The encoding to use for parameters. The \*(L"encoding\*(R" parameter must be either 241\&\*(L"named_curve\*(R" or \*(L"explicit\*(R". The default value is \*(L"named_curve\*(R". 242.SH "PARAMETER GENERATION OPTIONS" 243.IX Header "PARAMETER GENERATION OPTIONS" 244The options supported by each algorithm and indeed each implementation of an 245algorithm can vary. The options for the OpenSSL implementations are detailed 246below. 247.SS "\s-1DSA\s0 Parameter Generation Options" 248.IX Subsection "DSA Parameter Generation Options" |
| 221.IP "\fBdsa_paramgen_bits:numbits\fR" 4 222.IX Item "dsa_paramgen_bits:numbits" | 249.IP "\fBdsa_paramgen_bits:numbits\fR" 4 250.IX Item "dsa_paramgen_bits:numbits" |
| 223The number of bits in the generated parameters. If not specified 1024 is used. 224.SH "DH PARAMETER GENERATION OPTIONS" 225.IX Header "DH PARAMETER GENERATION OPTIONS" | 251The number of bits in the generated prime. If not specified 1024 is used. 252.IP "\fBdsa_paramgen_q_bits:numbits\fR" 4 253.IX Item "dsa_paramgen_q_bits:numbits" 254The number of bits in the q parameter. Must be one of 160, 224 or 256. If not 255specified 160 is used. 256.IP "\fBdsa_paramgen_md:digest\fR" 4 257.IX Item "dsa_paramgen_md:digest" 258The digest to use during parameter generation. Must be one of \fBsha1\fR, \fBsha224\fR 259or \fBsha256\fR. If set, then the number of bits in \fBq\fR will match the output size 260of the specified digest and the \fBdsa_paramgen_q_bits\fR parameter will be 261ignored. If not set, then a digest will be used that gives an output matching 262the number of bits in \fBq\fR, i.e. \fBsha1\fR if q length is 160, \fBsha224\fR if it 224 263or \fBsha256\fR if it is 256. 264.SS "\s-1DH\s0 Parameter Generation Options" 265.IX Subsection "DH Parameter Generation Options" |
| 226.IP "\fBdh_paramgen_prime_len:numbits\fR" 4 227.IX Item "dh_paramgen_prime_len:numbits" | 266.IP "\fBdh_paramgen_prime_len:numbits\fR" 4 267.IX Item "dh_paramgen_prime_len:numbits" |
| 228The number of bits in the prime parameter \fBp\fR. | 268The number of bits in the prime parameter \fBp\fR. The default is 1024. 269.IP "\fBdh_paramgen_subprime_len:numbits\fR" 4 270.IX Item "dh_paramgen_subprime_len:numbits" 271The number of bits in the sub prime parameter \fBq\fR. The default is 256 if the 272prime is at least 2048 bits long or 160 otherwise. Only relevant if used in 273conjunction with the \fBdh_paramgen_type\fR option to generate X9.42 \s-1DH\s0 parameters. |
| 229.IP "\fBdh_paramgen_generator:value\fR" 4 230.IX Item "dh_paramgen_generator:value" | 274.IP "\fBdh_paramgen_generator:value\fR" 4 275.IX Item "dh_paramgen_generator:value" |
| 231The value to use for the generator \fBg\fR. | 276The value to use for the generator \fBg\fR. The default is 2. 277.IP "\fBdh_paramgen_type:value\fR" 4 278.IX Item "dh_paramgen_type:value" 279The type of \s-1DH\s0 parameters to generate. Use 0 for PKCS#3 \s-1DH\s0 and 1 for X9.42 \s-1DH.\s0 280The default is 0. |
| 232.IP "\fBdh_rfc5114:num\fR" 4 233.IX Item "dh_rfc5114:num" | 281.IP "\fBdh_rfc5114:num\fR" 4 282.IX Item "dh_rfc5114:num" |
| 234If this option is set then the appropriate \s-1RFC5114\s0 parameters are used | 283If this option is set, then the appropriate \s-1RFC5114\s0 parameters are used |
| 235instead of generating new parameters. The value \fBnum\fR can take the 236values 1, 2 or 3 corresponding to \s-1RFC5114 DH\s0 parameters consisting of 2371024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup 238and 2048 bit group with 256 bit subgroup as mentioned in \s-1RFC5114\s0 sections | 284instead of generating new parameters. The value \fBnum\fR can take the 285values 1, 2 or 3 corresponding to \s-1RFC5114 DH\s0 parameters consisting of 2861024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup 287and 2048 bit group with 256 bit subgroup as mentioned in \s-1RFC5114\s0 sections |
| 2392.1, 2.2 and 2.3 respectively. 240.SH "EC PARAMETER GENERATION OPTIONS" 241.IX Header "EC PARAMETER GENERATION OPTIONS" 242.IP "\fBec_paramgen_curve:curve\fR" 4 243.IX Item "ec_paramgen_curve:curve" 244the \s-1EC\s0 curve to use. | 2882.1, 2.2 and 2.3 respectively. If present this overrides all other \s-1DH\s0 parameter 289options. 290.SS "\s-1EC\s0 Parameter Generation Options" 291.IX Subsection "EC Parameter Generation Options" 292The \s-1EC\s0 parameter generation options are the same as for key generation. See 293\&\*(L"\s-1EC\s0 Key Generation Options\*(R" above. |
| 245.SH "GOST2001 KEY GENERATION AND PARAMETER OPTIONS" 246.IX Header "GOST2001 KEY GENERATION AND PARAMETER OPTIONS" 247Gost 2001 support is not enabled by default. To enable this algorithm, 248one should load the ccgost engine in the OpenSSL configuration file. 249See \s-1README\s0.gost file in the engines/ccgost directiry of the source 250distribution for more details. 251.PP 252Use of a parameter file for the \s-1GOST R 34.10\s0 algorithm is optional. --- 35 unchanged lines hidden (view full) --- 288.PP 289Generate a 2048 bit \s-1RSA\s0 key using 3 as the public exponent: 290.PP 291.Vb 2 292\& openssl genpkey \-algorithm RSA \-out key.pem \-pkeyopt rsa_keygen_bits:2048 \e 293\& \-pkeyopt rsa_keygen_pubexp:3 294.Ve 295.PP | 294.SH "GOST2001 KEY GENERATION AND PARAMETER OPTIONS" 295.IX Header "GOST2001 KEY GENERATION AND PARAMETER OPTIONS" 296Gost 2001 support is not enabled by default. To enable this algorithm, 297one should load the ccgost engine in the OpenSSL configuration file. 298See \s-1README\s0.gost file in the engines/ccgost directiry of the source 299distribution for more details. 300.PP 301Use of a parameter file for the \s-1GOST R 34.10\s0 algorithm is optional. --- 35 unchanged lines hidden (view full) --- 337.PP 338Generate a 2048 bit \s-1RSA\s0 key using 3 as the public exponent: 339.PP 340.Vb 2 341\& openssl genpkey \-algorithm RSA \-out key.pem \-pkeyopt rsa_keygen_bits:2048 \e 342\& \-pkeyopt rsa_keygen_pubexp:3 343.Ve 344.PP |
| 296Generate 1024 bit \s-1DSA\s0 parameters: | 345Generate 2048 bit \s-1DSA\s0 parameters: |
| 297.PP 298.Vb 2 299\& openssl genpkey \-genparam \-algorithm DSA \-out dsap.pem \e | 346.PP 347.Vb 2 348\& openssl genpkey \-genparam \-algorithm DSA \-out dsap.pem \e |
| 300\& \-pkeyopt dsa_paramgen_bits:1024 | 349\& \-pkeyopt dsa_paramgen_bits:2048 |
| 301.Ve 302.PP 303Generate \s-1DSA\s0 key from parameters: 304.PP 305.Vb 1 306\& openssl genpkey \-paramfile dsap.pem \-out dsakey.pem 307.Ve 308.PP | 350.Ve 351.PP 352Generate \s-1DSA\s0 key from parameters: 353.PP 354.Vb 1 355\& openssl genpkey \-paramfile dsap.pem \-out dsakey.pem 356.Ve 357.PP |
| 309Generate 1024 bit \s-1DH\s0 parameters: | 358Generate 2048 bit \s-1DH\s0 parameters: |
| 310.PP 311.Vb 2 312\& openssl genpkey \-genparam \-algorithm DH \-out dhp.pem \e | 359.PP 360.Vb 2 361\& openssl genpkey \-genparam \-algorithm DH \-out dhp.pem \e |
| 313\& \-pkeyopt dh_paramgen_prime_len:1024 | 362\& \-pkeyopt dh_paramgen_prime_len:2048 |
| 314.Ve 315.PP | 363.Ve 364.PP |
| 365Generate 2048 bit X9.42 \s-1DH\s0 parameters: 366.PP 367.Vb 3 368\& openssl genpkey \-genparam \-algorithm DH \-out dhpx.pem \e 369\& \-pkeyopt dh_paramgen_prime_len:2048 \e 370\& \-pkeyopt dh_paramgen_type:1 371.Ve 372.PP |
|
| 316Output \s-1RFC5114 2048\s0 bit \s-1DH\s0 parameters with 224 bit subgroup: 317.PP 318.Vb 1 319\& openssl genpkey \-genparam \-algorithm DH \-out dhp.pem \-pkeyopt dh_rfc5114:2 320.Ve 321.PP 322Generate \s-1DH\s0 key from parameters: 323.PP 324.Vb 1 325\& openssl genpkey \-paramfile dhp.pem \-out dhkey.pem 326.Ve | 373Output \s-1RFC5114 2048\s0 bit \s-1DH\s0 parameters with 224 bit subgroup: 374.PP 375.Vb 1 376\& openssl genpkey \-genparam \-algorithm DH \-out dhp.pem \-pkeyopt dh_rfc5114:2 377.Ve 378.PP 379Generate \s-1DH\s0 key from parameters: 380.PP 381.Vb 1 382\& openssl genpkey \-paramfile dhp.pem \-out dhkey.pem 383.Ve |
| 384.PP 385Generate \s-1EC\s0 key directly: 386.PP 387.Vb 3 388\& openssl genpkey \-algorithm EC \-out eckey.pem \e 389\& \-pkeyopt ec_paramgen_curve:P\-384 \e 390\& \-pkeyopt ec_param_enc:named_curve 391.Ve 392.SH "HISTORY" 393.IX Header "HISTORY" 394The ability to use \s-1NIST\s0 curve names, and to generate an \s-1EC\s0 key directly, 395were added in OpenSSL 1.0.2. |
|