NAME

       generate - Generates a new key

SYNOPSIS

       generate [-u|--userid] [-c|--cipher-suite] [--with-password] [--creation-time] [--expires]
       [--expires-in] [--can-sign] [--cannot-sign]  [--can-authenticate]  [--cannot-authenticate]
       [--can-encrypt] [--cannot-encrypt] [-e|--export] [--rev-cert] [-h|--help]

DESCRIPTION

       Generates a new key

       Generating  a  key  is  the  prerequisite  to  receiving  encrypted  messages and creating
       signatures.  There are a few  parameters  to  this  process,  but  we  provide  reasonable
       defaults for most users.

       When  generating  a  key,  we also generate a revocation certificate.  This can be used in
       case the key is superseded, lost, or compromised.  It is a good idea to  keep  a  copy  of
       this in a safe place.

       After  generating a key, use "sq key extract-cert" to get the certificate corresponding to
       the key.  The key must be kept secure, while the  certificate  should  be  handed  out  to
       correspondents, e.g. by uploading it to a keyserver.

OPTIONS

       -u, --userid=EMAIL
              Adds a userid to the key

       -c,   --cipher-suite=CIPHER-SUITE  [default:  cv25519]  [possible  values:  rsa3k,  rsa4k,
       cv25519]
              Selects the cryptographic algorithms for the key

       --with-password
              Protects the key with a password

       --creation-time=CREATION_TIME
              Sets the key's creation  time  to  TIME.   TIME  is  interpreted  as  an  ISO  8601
              timestamp.  To set the creation time to June 9, 2011 at midnight UTC, you can do:

              $ sq key generate --creation-time 20110609 --export noam.pgp

              To  include  a  time,  add  a  T, the time and optionally the timezone (the default
              timezone is UTC):

              $ sq key generate --creation-time 20110609T1938+0200 --export noam.pgp

       --expires=TIME
              Makes the key expire at TIME (as ISO 8601). Use "never" to create keys that do  not
              expire.

       --expires-in=DURATION
              Makes the key expire after DURATION. Either "N[ymwds]", for N years, months, weeks,
              days, seconds, or "never".

       --can-sign
              Adds a signing-capable subkey (default)

       --cannot-sign
              Adds no signing-capable subkey

       --can-authenticate
              Adds an authentication-capable subkey (default)

       --cannot-authenticate
              Adds no authentication-capable subkey

       --can-encrypt=PURPOSE [possible values: transport, storage, universal]
              Adds an encryption-capable subkey. Encryption-capable  subkeys  can  be  marked  as
              suitable   for   transport  encryption,  storage  encryption,  or  both.  [default:
              universal]

       --cannot-encrypt
              Adds no encryption-capable subkey

       -e, --export=OUTFILE
              Writes the key to OUTFILE

       --rev-cert=FILE or -
              Writes the revocation certificate to FILE. mandatory if OUTFILE is  "-".  [default:
              <OUTFILE>.rev]

       -h, --help
              Print help information

EXAMPLES

        First, this generates a key

               sq key generate --userid "<juliet@example.org>" --export juliet.key.pgp

        Then, this extracts the certificate for distribution

               sq key extract-cert --output juliet.cert.pgp juliet.key.pgp

        Generates a key protecting it with a password

               sq key generate --userid "<juliet@example.org>" --with-password

        Generates a key with multiple userids

               sq key generate --userid "<juliet@example.org>" --userid "Juliet Capulet"

SEE ALSO

       For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

       sq(1)  sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1)
       sq-inspect(1)       sq-key(1)       sq-key-adopt(1)        sq-key-attest-certifications(1)
       sq-key-extract-cert(1)  sq-key-password(1)  sq-key-userid(1) sq-keyring(1) sq-keyserver(1)
       sq-packet(1) sq-revoke(1) sq-sign(1) sq-verify(1) sq-wkd(1)