RSA(1)                                                     RSA(1)

     NAME
          dsagen, rsagen, rsafill, asn12dsa, asn12rsa, dsa2pub,
          rsa2csr, rsa2pub, dsa2ssh, rsa2ssh, rsa2x509 - generate and
          format dsa and rsa keys

     SYNOPSIS
          dsagen [ -t tag ]

          rsagen [ -b nbits ] [ -t tag ]

          rsafill [ file ]

          asn12dsa [ -t tag ] [ file ]

          asn12rsa [ -t tag ] [ file ]

          dsa2pub [ file ]

          rsa2pub [ file ]

          dsa2ssh [ file ]

          rsa2ssh [ -2 ] [ file ]

          rsa2x509 [ -e expiretime ] certinfo [ file ]

          rsa2csr certinfo [ file ]

     DESCRIPTION
          Plan 9 represents DSA and RSA keys as attribute-value pair
          lists prefixed with the string key; this is the generic key
          format used by factotum(4). A full DSA private key has the
          following attributes:

          proto
               must be dsa

          p    prime public modulus

          q    prime group order; divides p-1

          alpha
               group generator

          key  alpha^!secret mod p

          !secret
               the secret exponent

          A full RSA private key has the following attributes:

     RSA(1)                                                     RSA(1)

          proto
               must be rsa

          size the number of significant bits in n

          ek   the encryption exponent

          n    the product of !p and !q

          !dk  the decryption exponent

          !p   a large prime

          !q   another large prime

          !kp, !kq, !c2
               parameters derived from the other attributes, cached to
               speed decryption

          All the numbers in both keys are in hexadecimal except RSA's
          size , which is decimal.  A public key omits the attributes
          beginning with `! .'  A key may have other attributes as
          well (for example, a service attribute identifying how this
          key is typically used), but to these utilities such
          attributes are merely comments.

          For example, a very small (and thus insecure) private key
          and corresponding public key might be:

               key proto=rsa size=8 ek=7 n=8F !dk=67 !p=B !q=D !kp=3 !kq=7 !c2=6
               key proto=rsa size=8 ek=7 n=8F

          Note that the order of the attributes does not matter.

          Dsagen prints a randomly generated DSA private key using the
          NIST-recommended algorithm.  If tag is specified, it is
          printed between key and proto=dsa; typically, tag is a
          sequence of attribute-value comments describing the key.

          Rsagen prints a randomly generated RSA private key whose n
          has exactly nbits (default 1024) significant bits.

          Rsafill reads a private key, recomputes the !kp, !kq, and
          !c2 attributes if they are missing, and prints a full key.

          Asn12dsa reads an DSA private key stored as ASN.1 encoded in
          the binary Distinguished Encoding Rules (DER) and prints a
          Plan 9 DSA key, inserting tag exactly as dsagen does.
          ASN.1/DER is a popular key format on Unix and Windows; it is
          often encoded in text form using the Privacy Enhanced Mail
          (PEM) format in a section labeled as an ``DSA PRIVATE KEY.''
          The command:

     RSA(1)                                                     RSA(1)

               pemdecode 'DSA PRIVATE KEY' | asn12dsa

          extracts the key section from a textual ASN.1/DER/PEM key
          into binary ASN.1/DER format and then converts it to a Plan
          9 DSA key.

          Asn12rsa is similar but operates on RSA keys.

          Dsa2pub reads a Plan 9 DSA public or private key, removes
          the private attributes, and prints the resulting public key.
          Comment attribtes are preserved.

          Rsa2pub is similar but operates on RSA keys.

          Dsa2ssh reads a Plan 9 DSA public or private key and prints
          the public portion in the format used by SSH version 2 (ver-
          sion 1 did not support DSA).  If the key has a comment
          attribute, that comment is appended to the key.

          Rsa2ssh is similar but operates on RSA keys.  It decides
          whether to print in version 1 or version 2 format by
          inspecting the service attribute.

          Dsa2ssh and rsa2ssh are useful for generating SSH's
          authorized_keys file.

          Rsa2x509 reads a Plan 9 RSA private key and writes a self-
          signed X.509 certificate encoded in ASN.1/DER format to
          standard output.  (Note that ASN.1/DER X.509 certificates
          are different from ASN.1/DER private keys).  The certificate
          uses the current time as its start time and expires
          expiretime seconds (default 3 years) later.  It contains the
          public half of the key and includes certinfo as the
          issuer/subject string (also known as a ``Distinguished
          Name'').  This info is typically in the form:

               C=US ST=NJ L=07974 O=Lucent OU='Bell Labs' CN=G.R.Emlin

          The X.509 ASN.1/DER format is often encoded in text using a
          PEM section labeled as a ``CERTIFICATE.''  The command:

               rsa2x509 'C=US OU=''Bell Labs''' file |
               pemencode CERTIFICATE

          generates such a textual certificate.  Applications that
          serve TLS-encrypted sessions typically expect certificates
          in ASN.1/DER/PEM format.

          Rsa2csr is like rsa2x509 but writes an X.509 certificate
          request.

     EXAMPLES

     RSA(1)                                                     RSA(1)

          Generate a fresh key and use it to start the Plan 9 TLS-
          enabled web server:

               rsagen -t 'service=tls owner=*' >key
               rsa2x509 'C=US CN=*.cs.bell-labs.com' key |
                    pemencode CERTIFICATE >cert
               cat key >/mnt/factotum/ctl
               ip/httpd/httpd -c cert

          Generate a fresh set of SSH keys (only one is necessary),
          load them into factotum, and configure a remote Unix system
          to allow those keys for logins:

               rsagen -t 'service=ssh role=decrypt' >rsa1
               rsagen -t 'service=ssh-rsa role=sign' >rsa2
               dsagen -t 'service=ssh-dss role=sign' >dsa2

          Convert existing Unix SSH version 2 keys instead of generat-
          ing new ones:

               cd $HOME/.ssh
               pemdecode 'DSA PRIVATE KEY' id_dsa | asn12dsa >dsa2
               pemdecode 'RSA PRIVATE KEY' id_rsa | asn12rsa >rsa2

          Load those keys into factotum:

               cat rsa1 rsa2 dsa2 | 9p write -l factotum/ctl
               Allow use of those keys for logins on other systems:

               rsa2ssh rsa1 >auth.keys
               rsa2ssh rsa2 >>auth.keys
               dsa2ssh dsa2 >>auth.keys
               scp auth.keys unix:.ssh/authorized_keys

     SOURCE
          /src/cmd/auth

     SEE ALSO
          factotum(4), pem(1), ssh(1)

     BUGS
          There are too many key formats.

          There is no program to convert SSH version 1 RSA private
          keys.