NAME

       shib-seckeygen - Rotate the keys of a Versioned DataSealer

SYNOPSIS

       shib-seckeygen [-o output-dir] [-f filename]
           [-h history-length] [-b key-size]
           [-u user] [-g group]

DESCRIPTION

       The Versioned <DataSealer> type is designed for production use and obtains its key
       material from a simple flat file that allows a history of several keys to be kept to
       decrypt older data and continuously rotate the encryption key on a regular basis, usually
       daily.

       The flat file format consists of lines of the form <name>:<key>, where the name is
       typically a number for record keeping but can be any label, and the key is base64-encoded.
       The key length dictates which AES-GCM algorithm is used, among the supported key sizes
       (128,192,256). The "default" key used for new operations is the last line in the file.

       This script provides a simple means of rotating the key, and the Service Provider software
       will typically detect when the file changes and reload it.

OPTIONS

       -b key-size
           Number of random bits in the newly generated key.  See above for the supported sizes.
           The default is 128.

       -g group
           Change the group ownership of the key file to this group.  The default is "_shibd".

       -h history-length
           The maximum number of keys to keep in the file.  The default is 14.

       -f filename
           The name of the file containing the keys in output-dir.  The default is "sealer.keys".

       -o output-dir
           The key file and a temporary key file are created in this directory.  The default is
           "/etc/shibboleth".

       -u user
           Change the ownership of the key file to this user.  The default is "_shibd".

FILES

       /etc/shibboleth/sealer.keys
           The default key file rotated by this script.

AUTHOR

       This manual page was written by Ferenc Wágner for Debian GNU/Linux using the text on
       https://wiki.shibboleth.net/confluence/display/SP3/VersionedDataSealer.

COPYRIGHT

       Copyright 2018 Shibboleth Project.  License: Creative Commons Attribution-ShareAlike 3.0.