**NAME**

ipsec rsasigkey - generate RSA signature key

**SYNOPSIS**

ipsecrsasigkey[--verbose] [--randomfilename ]\[--roundsnr ] [--hostnamehost ] [--noopt] nbitsipsecrsasigkey[--verbose] [--hostnamehost ]\[--noopt]--oldkeyfile

**DESCRIPTION**

Rsasigkeygenerates an RSA public/private key pair, suitable for digital signatures, of (exactly)nbitsbits (that is, two primes each of exactlynbits/2 bits, and related numbers) and emits it on standard output as ASCII (mostly hex) data.nbitsmust be a multiple of 16. The public exponent is forced to the value3, which has important speed advantages for signature checking. Beware that the resulting keys have known weaknesses as encryption keysandshouldnotbeusedforthatpurpose. The--verboseoption makesrsasigkeygive a running commentary on standard error. By default, it works in silence until it is ready to generate output. The--randomoption specifies a source for random bits. The default is/dev/random(seerandom(4)). Normally,rsasigkeyreads exactlynbitsrandom bits from the source; in extremely-rare circumstances it may need more. The--roundsoption specifies the number of rounds to be done by thempz_probab_prime_pprobabilistic primality checker. The default, 30, is fairly rigorous and should not normally have to be overridden. The--hostnameoption specifies what host name to use in the first line of the output (see below); the default is whatgethostname(2) returns. The--nooptoption suppresses an optimization of the private key (to be precise, setting of the decryption exponent tolcm(p-1,q-1)rather than(p-1)*(q-1)) which speeds up operations on it slightly but can cause it to flunk a validity check in old RSA implementations (notably, obsolete versions ofipsec_pluto(8)). The--oldkeyoption specifies that rather than generate a new key,rsasigkeyshould read an old key from thefile(the name-means ‘‘standard input’’) and use that to generate its output. Input lines which do not look likersasigkeyoutput are silently ignored. This permits updating old keys to the current format. The output format looks like this (with long numbers trimmed down for clarity): # RSA 2048 bits xy.example.com Sat Apr 15 13:53:22 2000 # for signatures only, UNSAFE FOR ENCRYPTION #pubkey=0sAQOF8tZ2NZt...Y1P+buFuFn/ Modulus: 0xcc2a86fcf440...cf1011abb82d1 PublicExponent: 0x03 # everything after this point is secret PrivateExponent: 0x881c59fdf8...ab05c8c77d23 Prime1: 0xf49fd1f779...46504c7bf3 Prime2: 0xd5a9108453...321d43cb2b Exponent1: 0xa31536a4fb...536d98adda7f7 Exponent2: 0x8e70b5ad8d...9142168d7dcc7 Coefficient: 0xafb761d001...0c13e98d98 The first (comment) line, indicating the nature and date of the key, and giving a host name, is used byipsec_showhostkey(8) when generating some forms of key output. The commented-outpubkey=line contains the public key—the public exponent and the modulus—combined in approximately RFC 2537 format (the one deviation is that the combined value is given with a0sprefix, rather than in unadorned base-64), suitable for use in theipsec.conffile. TheModulus,PublicExponent, andPrivateExponentlines give the basic signing and verification data. ThePrime1andPrime2lines give the primes themselves (akapandq), largest first. TheExponent1andExponent2lines give the private exponent modp-1andq-1respectively. TheCoefficientline gives the Chinese Remainder Theorem coefficient, which is the inverse ofq, modp. These additional numbers (which must all be kept as secret as the private exponent) are precomputed aids to rapid signature generation. No attempt is made to break long lines. The US patent on the RSA algorithm expired 20 Sept 2000.

**EXAMPLES**

ipsecrsasigkey--verbose2192>mykeygenerates a 2192-bit signature key and puts it in the filemykey, with running commentary on standard error. The file contents can be inserted verbatim into a suitable entry in theipsec.secretsfile (seeipsec.secrets(5)), and the public key can then be extracted and edited into theipsec.conffile (seeipsec.conf(5)).ipsecrsasigkey--verbose--oldkeyoldie>latesttakes the old signature key from fileoldieand puts a version in the current format into the filelatest, with running commentary on standard error.

**FILES**

/dev/random

**SEE** **ALSO**

random(4), ipsec_showhostkey(8)AppliedCryptography, 2nd. ed., by Bruce Schneier, Wiley 1996. RFCs 2537, 2313.GNUMP,theGNUmultipleprecisionarithmeticlibrary,edition2.0.2, by Torbj Granlund.

**HISTORY**

Written for the Linux FreeS/WAN project <http://www.freeswan.org> by Henry Spencer.

**BUGS**

There is an internal limit onnbits, currently 20000.Rsasigkey’s run time is difficult to predict, since/dev/randomoutput can be arbitrarily delayed if the system’s entropy pool is low on randomness, and the time taken by the search for primes is also somewhat unpredictable. A reasonably typical time for a 1024-bit key on a quiet 200MHz Pentium MMX with plenty of randomness available is 20 seconds, almost all of it in the prime searches. Generating a 2192-bit key on the same system usually takes several minutes. A 4096-bit key took an hour and a half of CPU time. The--oldkeyoption does not check its input format as rigorously as it might. Corruptedrsasigkeyoutput may confuse it. 22 July 2001 IPSEC_RSASIGKEY(8)