Update documentation

[openssl.git] / doc / apps / pkcs8.pod

diff --git a/doc/apps/pkcs8.pod b/doc/apps/pkcs8.pod
index e946cbdfaf041c25da50fb4f9efdb592b96d7af2..8d28a123a167d22196fa22a61aa88e84eb47f464 100644 (file)
--- a/doc/apps/pkcs8.pod
+++ b/doc/apps/pkcs8.pod
@@ -7,6 +7,7 @@ pkcs8 - PKCS#8 format private key conversion tool
 =head1 SYNOPSIS
 
 B<openssl> B<pkcs8>
+[B<-help>]
 [B<-topk8>]
 [B<-inform PEM|DER>]
 [B<-outform PEM|DER>]
@@ -17,13 +18,14 @@ B<openssl> B<pkcs8>
 [B<-iter count>]
 [B<-noiter>]
 [B<-nocrypt>]
-[B<-nooct>]
-[B<-embed>]
-[B<-nsdb>]
 [B<-v2 alg>]
 [B<-v2prf alg>]
 [B<-v1 alg>]
 [B<-engine id>]
+[B<-scrypt>]
+[B<-scrypt_N N>]
+[B<-scrypt_r r>]
+[B<-scrypt_p p>]
 
 =head1 DESCRIPTION
 
@@ -35,6 +37,10 @@ format with a variety of PKCS#5 (v1.5 and v2.0) and PKCS#12 algorithms.
 
 =over 4
 
+=item B<-help>
+
+Print out a usage message.
+
 =item B<-topk8>
 
 Normally a PKCS#8 private key is expected on input and a traditional format
@@ -63,7 +69,7 @@ prompted for.
 =item B<-passin arg>
 
 the input file password source. For more information about the format of B<arg>
-see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
 
 =item B<-out filename>
 
@@ -75,13 +81,13 @@ filename.
 =item B<-passout arg>
 
 the output file password source. For more information about the format of B<arg>
-see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
 
 =item B<-iter count>
 
-When creating new PKCS#8 containers, use a given number of iterations on the password
-in deriving the encryption key for the PKCS#8 output. High values increase the time
-required to brute-force a PKCS#8 container.
+When creating new PKCS#8 containers, use a given number of iterations on
+the password in deriving the encryption key for the PKCS#8 output.
+High values increase the time required to brute-force a PKCS#8 container.
 
 =item B<-nocrypt>
 
@@ -92,26 +98,6 @@ This option does not encrypt private keys at all and should only be used
 when absolutely necessary. Certain software such as some versions of Java
 code signing software used unencrypted private keys.
 
-=item B<-nooct>
-
-This option generates RSA private keys in a broken format that some software
-uses. Specifically the private key should be enclosed in a OCTET STRING
-but some software just includes the structure itself without the
-surrounding OCTET STRING.
-
-=item B<-embed>
-
-This option generates DSA keys in a broken format. The DSA parameters are
-embedded inside the PrivateKey structure. In this form the OCTET STRING
-contains an ASN1 SEQUENCE consisting of two structures: a SEQUENCE containing
-the parameters and an ASN1 INTEGER containing the private key.
-
-=item B<-nsdb>
-
-This option generates DSA keys in a broken format compatible with Netscape
-private key databases. The PrivateKey contains a SEQUENCE consisting of
-the public and private keys respectively.
-
 =item B<-v2 alg>
 
 This option enables the use of PKCS#5 v2.0 algorithms. Normally PKCS#8
@@ -144,6 +130,17 @@ to attempt to obtain a functional reference to the specified engine,
 thus initialising it if needed. The engine will then be set as the default
 for all available algorithms.
 
+=item B<-scrypt>
+
+uses the B<scrypt> algorithm for private key encryption using default
+parameters: currently N=16384, r=8 and p=1 and AES in CBC mode with a 256 bit
+key. These parameters can be modified using the B<-scrypt_N>, B<-scrypt_r>,
+B<-scrypt_p> and B<-v2> options.
+
+B<-scrypt_N N> B<-scrypt_r r> B<-scrypt_p p>
+
+sets the scrypt B<N>, B<r> or B<p> parameters.
+
 =back
 
 =head1 NOTES
@@ -261,7 +258,11 @@ the old format at present.
 
 =head1 SEE ALSO
 
-L<dsa(1)|dsa(1)>, L<rsa(1)|rsa(1)>, L<genrsa(1)|genrsa(1)>,
-L<gendsa(1)|gendsa(1)> 
+L<dsa(1)>, L<rsa(1)>, L<genrsa(1)>,
+L<gendsa(1)> 
+
+=head1 HISTORY
+
+The B<-iter> option was added to OpenSSL 1.1.0.
 
 =cut