Document the new SHA256 and SHA512 password generation options

[openssl.git] / doc / apps / passwd.pod

diff --git a/doc/apps/passwd.pod b/doc/apps/passwd.pod
index 0df9252981974846dafff9ed0de26b903285796d..fa11f630cf5f50a4a358ed952088f177b297ee9e 100644 (file)
--- a/doc/apps/passwd.pod
+++ b/doc/apps/passwd.pod
@@ -7,34 +7,76 @@ passwd - compute password hashes
 =head1 SYNOPSIS
 
 B<openssl passwd>
+[B<-help>]
 [B<-crypt>]
-[B<-salt string>]
+[B<-1>]
+[B<-apr1>]
+[B<-5>]
+[B<-6>]
+[B<-salt> I<string>]
+[B<-in> I<file>]
+[B<-stdin>]
+[B<-noverify>]
 [B<-quiet>]
 [B<-table>]
-{B<password>}
+{I<password>}
 
 =head1 DESCRIPTION
 
-The B<passwd> command computes the hashes of a list of passwords
-passed on the command line, or the hash of a password typed at run-time.
-Currently only the Unix standard algorithm B<crypt>
-is implemented.
+The B<passwd> command computes the hash of a password typed at
+run-time or the hash of each password in a list.  The password list is
+taken from the named file for option B<-in file>, from stdin for
+option B<-stdin>, or from the command line, or from the terminal otherwise.
+The Unix standard algorithm B<crypt> and the MD5-based BSD password
+algorithm B<1> and its Apache variant B<apr1> are available.
 
 =head1 OPTIONS
 
 =over 4
 
+=item B<-help>
+
+Print out a usage message.
+
 =item B<-crypt>
 
 Use the B<crypt> algorithm (default).
 
-=item B<-salt string>
+=item B<-1>
+
+Use the MD5 based BSD password algorithm B<1>.
+
+=item B<-apr1>
+
+Use the B<apr1> algorithm (Apache variant of the BSD algorithm).
+
+=item B<-5>
+
+=item B<-6>
+
+Use the B<SHA256> / B<SHA512> based algorithms defined by Ulrich Drepper.
+See L<https://www.akkadia.org/drepper/SHA-crypt.txt>.
+
+=item B<-salt> I<string>
 
 Use the specified salt.
+When reading a password from the terminal, this implies B<-noverify>.
+
+=item B<-in> I<file>
+
+Read passwords from I<file>.
+
+=item B<-stdin>
+
+Read passwords from B<stdin>.
+
+=item B<-noverify>
+
+Don't verify when reading a password from the terminal.
 
 =item B<-quiet>
 
-Don't output warnings when passwords are truncated.
+Don't output warnings when passwords given at the command line are truncated.
 
 =item B<-table>
 
@@ -43,8 +85,21 @@ to each password hash.
 
 =back
 
-=head1 EXAMPLE
+=head1 EXAMPLES
+
+B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>.
+
+B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.>.
+
+B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>.
+
+=head1 COPYRIGHT
+
+Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
 
-B<openssl passwd -salt xx password> prints B<xxj31ZMTZzkVA>.
+Licensed under the OpenSSL license (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
 
 =cut