X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fapps%2Fgenpkey.pod;h=1611b5ca78be18bfcae34e73a01a0b4664d85514;hp=8ca5dca283dd89a73b1b158e684f09564a409681;hb=7e0de9e8a6ac931f4e4ad2dfdd5b03dc2a66e9a6;hpb=5ce60a20f20147f08e1e383628d779c824722c4e diff --git a/doc/apps/genpkey.pod b/doc/apps/genpkey.pod index 8ca5dca283..1611b5ca78 100644 --- a/doc/apps/genpkey.pod +++ b/doc/apps/genpkey.pod @@ -47,14 +47,17 @@ name accepted by EVP_get_cipherbyname() is acceptable such as B. =item B<-engine id> -specifying an engine (by it's unique B string) will cause B +specifying an engine (by its unique B string) will cause B to attempt to obtain a functional reference to the specified engine, thus initialising it if needed. The engine will then be set as the default -for all available algorithms. +for all available algorithms. If used this option should precede all other +options. =item B<-algorithm alg> -public key algorithm to use such as RSA, DSA or DH. +public key algorithm to use such as RSA, DSA or DH. If used this option must +precede any B<-pkeyopt> options. The options B<-paramfile> and B<-algorithm> +are mutually exclusive. =item B<-pkeyopt opt:value> @@ -64,13 +67,21 @@ implementation. See B below for more details. =item B<-genparam> -generate a set of parameters instead of a private key. +generate a set of parameters instead of a private key. If used this option must +precede and B<-algorithm>, B<-paramfile> or B<-pkeyopt> options. =item B<-paramfile filename> Some public key algorithms generate a private key based on a set of parameters. -They can be supplied using this option. If this option is used the public -key algorithm used is determined by the parameters. +They can be supplied using this option. If this option is used the public key +algorithm used is determined by the parameters. If used this option must +precede and B<-pkeyopt> options. The options B<-paramfile> and B<-algorithm> +are mutually exclusive. + +=item B<-text> + +Print an (unencrypted) text representation of private and public keys and +parameters along with the PEM or DER structure. =back @@ -127,6 +138,37 @@ the EC curve to use. =back +=head1 GOST2001 KEY GENERATION AND PARAMETER OPTIONS + +Gost 2001 support is not enabled by default. To enable this algorithm, +one should load the ccgost engine in the OpenSSL configuration file. +See README.gost file in the engines/ccgost directiry of the source +distribution for more details. + +Use of a parameter file for the GOST R 34.10 algorithm is optional. +Parameters can be specified during key generation directly as well as +during generation of parameter file. + +=over 4 + +=item B + +Specifies GOST R 34.10-2001 parameter set according to RFC 4357. +Parameter set can be specified using abbreviated name, object short name or +numeric OID. Following parameter sets are supported: + + paramset OID Usage + A 1.2.643.2.2.35.1 Signature + B 1.2.643.2.2.35.2 Signature + C 1.2.643.2.2.35.3 Signature + XA 1.2.643.2.2.36.0 Key exchange + XB 1.2.643.2.2.36.1 Key exchange + test 1.2.643.2.2.35.0 Test purposes + +=back + + + =head1 NOTES The use of the genpkey program is encouraged over the algorithm specific @@ -137,15 +179,15 @@ can be used. Generate an RSA private key using default parameters: - openssl genpkey -algoritm RSA -out key.pem + openssl genpkey -algorithm RSA -out key.pem Encrypt output private key using 128 bit AES and the passphrase "hello": - openssl genpkey -algoritm RSA -out key.pem -aes-128-cbc -pass pass:hello + openssl genpkey -algorithm RSA -out key.pem -aes-128-cbc -pass pass:hello Generate a 2048 bit RSA key using 3 as the public exponent: - openssl genpkey -algoritm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048 \ + openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048 \ -pkeyopt rsa_keygen_pubexp:3 Generate 1024 bit DSA parameters: