ipsec-rsasigkey - Man Page

ipsec rsasigkey [--verbose] [--nssdir directory] [--nsspw password] [--seeddev device] [--seedbits bits]
[--hostname hostname] [nbits]

rsasigkey generates an RSA public/private key pair, suitable for digital signatures, of (exactly) nbits bits (that is, two primes each of exactly nbits/2 bits, and related numbers) and emits it on standard output as ASCII (mostly hex) data​. nbits must be a multiple of 16​.

The public exponent is forced to the value 3, which has important speed advantages for signature checking​. Beware that the resulting keys have known weaknesses as encryption keys and should not be used for that purpose​.

The --verbose option makes rsasigkey give a running commentary on standard error​. By default, it works in silence until it is ready to generate output​.

The --seeddev option specifies a source for random bits used to seed the crypto library's RNG​. The default is /dev/random (see random(4))​. FreeS/WAN and Openswan without NSS support used this option to specify the random source used to directly create keys​. Libreswan only uses it to seed the NSS crypto libraries RNG​. Under Linux with hardware random support, special devices might show up as /dev/*rng* devices​. However, these should never be accessed directly using this option, as hardware failures could lead to extremely non-random values (streams of zeroes have been observed in the wild)

The --seedbits option specifies how many seed bits are pulled from the random device to seed the NSS PRNG​. The default of 480bit comes from FIPS requirements​. Seed bits are rounded up to a multiple of 8​.

The use of a different random device or a reduction of seedbits from the default value is prevented when the system is running in FIPS mode​.

The --nssdir option specifies the directory to use for the nss database​. This is the directory where the NSS certificate, key and security modules databases reside​. The default value is /var/lib/ipsec/nss​.

The --password option specifies the nss cryptographic module authentication password if the NSS module has been configured to require it​. A password is required by hardware tokens and also by the internal software token module when configured to run in FIPS mode​. If the argument is /etc/ipsec.d/nsspassword, the password comes from that file; otherwise argument is the password​.

The US patent on the RSA algorithm expired 20 Sept 2000​.

ipsec rsasigkey --verbose 4096

/dev/random, /dev/urandom

random(4), rngd(8), ipsec-showhostkey(8), Applied Cryptography, 2nd​. ed​., by Bruce Schneier, Wiley 1996, RFCs 2537, 2313, GNU MP, the GNU multiple precision arithmetic library, edition 2​.0​.2, by Torbj Granlund

Originally written for the Linux FreeS/WAN project <https://www​.freeswan​.org> by Henry Spencer​. Updated for the Libreswan Project by Paul Wouters​.

The --round and --noopt options were obsoleted as these were only used with the old non-library crypto code

The --random device is only used for seeding the crypto library, not for direct random to generate keys

There is an internal limit on nbits, currently 20000​.

rsasigkey's run time is difficult to predict, since /dev/random output can be arbitrarily delayed if the system's entropy pool is low on randomness, and the time taken by the search for primes is also somewhat unpredictable​. Specifically, embedded systems and most virtual machines are low on entropy​. In such a situation, consider generating the RSA key on another machine, and copying ipsec​.secrets and the /var/lib/ipsec/nss directory tree to the embedded platform​. Note that NSS embeds the full path in the DB files, so the path on proxy machine must be identical to the path on the destination machine​.

Andrew Cagney, Daniel Kahn Gillmor, D​. Hugh Redelmeier, Harald Jenny, Jose Quaresma, Michael Richardson, Paul Wouters, Simon Deziel, Tuomo Soini

ipsec(8), ipsec-briefconnectionstatus(8), ipsec-briefstatus(8), ipsec-certutil(8), ipsec-checknflog(8), ipsec-checknss(8), ipsec.conf(5), ipsec-connectionstatus(8), ipsec-crlutil(8), ipsec-delete(8), ipsec-down(8), ipsec-fetchcrls(8), ipsec-fipsstatus(8), ipsec-globalstatus(8), ipsec-import(8), ipsec-initnss(8), ipsec-listall(8), ipsec-listcacerts(8), ipsec-listcerts(8), ipsec-listcrls(8), ipsec-listen(8), ipsec-listpubkeys(8), ipsec-modutil(8), ipsec-newhostkey(8), ipsec-pk12util(8), ipsec-purgeocsp(8), ipsec-redirect(8), ipsec-replace(8), ipsec-rereadall(8), ipsec-rereadcerts(8), ipsec-rereadsecrets(8), ipsec-restart(8), ipsec.secrets(5), ipsec-showhostkey(8), ipsec-showstates(8), ipsec-shuntstatus(8), ipsec-start(8), ipsec-status(8), ipsec-stop(8), ipsec-trafficstatus(8), ipsec-unroute(8), ipsec-up(8), ipsec-vfychain(8).