1.\" $NetBSD: ssh-keygen.1,v 1.10 2013/03/29 16:19:45 christos Exp $ 2.\" $OpenBSD: ssh-keygen.1,v 1.115 2013/01/19 07:13:25 jmc Exp $ 3.\" 4.\" -*- nroff -*- 5.\" 6.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 7.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 8.\" All rights reserved 9.\" 10.\" As far as I am concerned, the code I have written for this software 11.\" can be used freely for any purpose. Any derived versions of this 12.\" software must be clearly marked as such, and if the derived work is 13.\" incompatible with the protocol description in the RFC file, it must be 14.\" called by a name other than "ssh" or "Secure Shell". 15.\" 16.\" 17.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 18.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 19.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 20.\" 21.\" Redistribution and use in source and binary forms, with or without 22.\" modification, are permitted provided that the following conditions 23.\" are met: 24.\" 1. Redistributions of source code must retain the above copyright 25.\" notice, this list of conditions and the following disclaimer. 26.\" 2. Redistributions in binary form must reproduce the above copyright 27.\" notice, this list of conditions and the following disclaimer in the 28.\" documentation and/or other materials provided with the distribution. 29.\" 30.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 31.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 32.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 33.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 34.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 35.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 36.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 37.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 38.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 39.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 40.\" 41.Dd January 19 2013 42.Dt SSH-KEYGEN 1 43.Os 44.Sh NAME 45.Nm ssh-keygen 46.Nd authentication key generation, management and conversion 47.Sh SYNOPSIS 48.Bk -words 49.Nm ssh-keygen 50.Op Fl q 51.Op Fl b Ar bits 52.Fl t Ar type 53.Op Fl N Ar new_passphrase 54.Op Fl C Ar comment 55.Op Fl f Ar output_keyfile 56.Nm ssh-keygen 57.Fl p 58.Op Fl P Ar old_passphrase 59.Op Fl N Ar new_passphrase 60.Op Fl f Ar keyfile 61.Nm ssh-keygen 62.Fl i 63.Op Fl m Ar key_format 64.Op Fl f Ar input_keyfile 65.Nm ssh-keygen 66.Fl e 67.Op Fl m Ar key_format 68.Op Fl f Ar input_keyfile 69.Nm ssh-keygen 70.Fl y 71.Op Fl f Ar input_keyfile 72.Nm ssh-keygen 73.Fl c 74.Op Fl P Ar passphrase 75.Op Fl C Ar comment 76.Op Fl f Ar keyfile 77.Nm ssh-keygen 78.Fl l 79.Op Fl f Ar input_keyfile 80.Nm ssh-keygen 81.Fl B 82.Op Fl f Ar input_keyfile 83.Nm ssh-keygen 84.Fl D Ar pkcs11 85.Nm ssh-keygen 86.Fl F Ar hostname 87.Op Fl f Ar known_hosts_file 88.Op Fl l 89.Nm ssh-keygen 90.Fl H 91.Op Fl f Ar known_hosts_file 92.Nm ssh-keygen 93.Fl R Ar hostname 94.Op Fl f Ar known_hosts_file 95.Nm ssh-keygen 96.Fl r Ar hostname 97.Op Fl f Ar input_keyfile 98.Op Fl g 99.Nm ssh-keygen 100.Fl G Ar output_file 101.Op Fl v 102.Op Fl b Ar bits 103.Op Fl M Ar memory 104.Op Fl S Ar start_point 105.Nm ssh-keygen 106.Fl T Ar output_file 107.Fl f Ar input_file 108.Op Fl v 109.Op Fl a Ar num_trials 110.Op Fl J Ar num_lines 111.Op Fl j Ar start_line 112.Op Fl K Ar checkpt 113.Op Fl W Ar generator 114.Nm ssh-keygen 115.Fl s Ar ca_key 116.Fl I Ar certificate_identity 117.Op Fl h 118.Op Fl n Ar principals 119.Op Fl O Ar option 120.Op Fl V Ar validity_interval 121.Op Fl z Ar serial_number 122.Ar 123.Nm ssh-keygen 124.Fl L 125.Op Fl f Ar input_keyfile 126.Nm ssh-keygen 127.Fl A 128.Nm ssh-keygen 129.Fl k 130.Fl f Ar krl_file 131.Op Fl u 132.Op Fl s Ar ca_public 133.Op Fl z Ar version_number 134.Ar 135.Nm ssh-keygen 136.Fl Q 137.Fl f Ar krl_file 138.Ar 139.Ek 140.Sh DESCRIPTION 141.Nm 142generates, manages and converts authentication keys for 143.Xr ssh 1 . 144.Nm 145can create RSA keys for use by SSH protocol version 1 and DSA, ECDSA or RSA 146keys for use by SSH protocol version 2. 147The type of key to be generated is specified with the 148.Fl t 149option. 150If invoked without any arguments, 151.Nm 152will generate an RSA key for use in SSH protocol 2 connections. 153.Pp 154.Nm 155is also used to generate groups for use in Diffie-Hellman group 156exchange (DH-GEX). 157See the 158.Sx MODULI GENERATION 159section for details. 160.Pp 161Finally, 162.Nm 163can be used to generate and update Key Revocation Lists, and to test whether 164given keys have been revoked by one. 165See the 166.Sx KEY REVOCATION LISTS 167section for details. 168.Pp 169Normally each user wishing to use SSH 170with public key authentication runs this once to create the authentication 171key in 172.Pa ~/.ssh/identity , 173.Pa ~/.ssh/id_ecdsa , 174.Pa ~/.ssh/id_dsa 175or 176.Pa ~/.ssh/id_rsa . 177Additionally, the system administrator may use this to generate host keys, 178as seen in 179.Pa /etc/rc.d/sshd . 180.Pp 181Normally this program generates the key and asks for a file in which 182to store the private key. 183The public key is stored in a file with the same name but 184.Dq .pub 185appended. 186The program also asks for a passphrase. 187The passphrase may be empty to indicate no passphrase 188(host keys must have an empty passphrase), or it may be a string of 189arbitrary length. 190A passphrase is similar to a password, except it can be a phrase with a 191series of words, punctuation, numbers, whitespace, or any string of 192characters you want. 193Good passphrases are 10-30 characters long, are 194not simple sentences or otherwise easily guessable (English 195prose has only 1-2 bits of entropy per character, and provides very bad 196passphrases), and contain a mix of upper and lowercase letters, 197numbers, and non-alphanumeric characters. 198The passphrase can be changed later by using the 199.Fl p 200option. 201.Pp 202There is no way to recover a lost passphrase. 203If the passphrase is lost or forgotten, a new key must be generated 204and the corresponding public key copied to other machines. 205.Pp 206For RSA1 keys, 207there is also a comment field in the key file that is only for 208convenience to the user to help identify the key. 209The comment can tell what the key is for, or whatever is useful. 210The comment is initialized to 211.Dq user@host 212when the key is created, but can be changed using the 213.Fl c 214option. 215.Pp 216After a key is generated, instructions below detail where the keys 217should be placed to be activated. 218.Pp 219The options are as follows: 220.Bl -tag -width Ds 221.It Fl A 222For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys 223do not exist, generate the host keys with the default key file path, 224an empty passphrase, default bits for the key type, and default comment. 225This is used by 226.Pa /etc/rc 227to generate new host keys. 228.It Fl a Ar trials 229Specifies the number of primality tests to perform when screening DH-GEX 230candidates using the 231.Fl T 232command. 233.It Fl B 234Show the bubblebabble digest of specified private or public key file. 235.It Fl b Ar bits 236Specifies the number of bits in the key to create. 237For RSA keys, the minimum size is 768 bits and the default is 2048 bits. 238Generally, 2048 bits is considered sufficient. 239DSA keys must be exactly 1024 bits as specified by FIPS 186-2. 240For ECDSA keys, the 241.Fl b 242flag determines the key length by selecting from one of three elliptic 243curve sizes: 256, 384 or 521 bits. 244Attempting to use bit lengths other than these three values for ECDSA keys 245will fail. 246.It Fl C Ar comment 247Provides a new comment. 248.It Fl c 249Requests changing the comment in the private and public key files. 250This operation is only supported for RSA1 keys. 251The program will prompt for the file containing the private keys, for 252the passphrase if the key has one, and for the new comment. 253.It Fl D Ar pkcs11 254Download the RSA public keys provided by the PKCS#11 shared library 255.Ar pkcs11 . 256When used in combination with 257.Fl s , 258this option indicates that a CA key resides in a PKCS#11 token (see the 259.Sx CERTIFICATES 260section for details). 261.It Fl e 262This option will read a private or public OpenSSH key file and 263print to stdout the key in one of the formats specified by the 264.Fl m 265option. 266The default export format is 267.Dq RFC4716 . 268This option allows exporting OpenSSH keys for use by other programs, including 269several commercial SSH implementations. 270.It Fl F Ar hostname 271Search for the specified 272.Ar hostname 273in a 274.Pa known_hosts 275file, listing any occurrences found. 276This option is useful to find hashed host names or addresses and may also be 277used in conjunction with the 278.Fl H 279option to print found keys in a hashed format. 280.It Fl f Ar filename 281Specifies the filename of the key file. 282.It Fl G Ar output_file 283Generate candidate primes for DH-GEX. 284These primes must be screened for 285safety (using the 286.Fl T 287option) before use. 288.It Fl g 289Use generic DNS format when printing fingerprint resource records using the 290.Fl r 291command. 292.It Fl H 293Hash a 294.Pa known_hosts 295file. 296This replaces all hostnames and addresses with hashed representations 297within the specified file; the original content is moved to a file with 298a .old suffix. 299These hashes may be used normally by 300.Nm ssh 301and 302.Nm sshd , 303but they do not reveal identifying information should the file's contents 304be disclosed. 305This option will not modify existing hashed hostnames and is therefore safe 306to use on files that mix hashed and non-hashed names. 307.It Fl h 308When signing a key, create a host certificate instead of a user 309certificate. 310Please see the 311.Sx CERTIFICATES 312section for details. 313.It Fl I Ar certificate_identity 314Specify the key identity when signing a public key. 315Please see the 316.Sx CERTIFICATES 317section for details. 318.It Fl i 319This option will read an unencrypted private (or public) key file 320in the format specified by the 321.Fl m 322option and print an OpenSSH compatible private 323(or public) key to stdout. 324.It Fl J Ar num_lines 325Exit after screening the specified number of lines 326while performing DH candidate screening using the 327.Fl T 328option. 329.It Fl j Ar start_line 330Start screening at the specified line number 331while performing DH candidate screening using the 332.Fl T 333option. 334.It Fl K Ar checkpt 335Write the last line processed to the file 336.Ar checkpt 337while performing DH candidate screening using the 338.Fl T 339option. 340This will be used to skip lines in the input file that have already been 341processed if the job is restarted. 342This option allows importing keys from other software, including several 343commercial SSH implementations. 344The default import format is 345.Dq RFC4716 . 346.It Fl k 347Generate a KRL file. 348In this mode, 349.Nm 350will generate a KRL file at the location specified via the 351.Fl f 352flag that revokes every key or certificate presented on the command line. 353Keys/certificates to be revoked may be specified by public key file or 354using the format described in the 355.Sx KEY REVOCATION LISTS 356section. 357.It Fl L 358Prints the contents of a certificate. 359.It Fl l 360Show fingerprint of specified public key file. 361Private RSA1 keys are also supported. 362For RSA and DSA keys 363.Nm 364tries to find the matching public key file and prints its fingerprint. 365If combined with 366.Fl v , 367an ASCII art representation of the key is supplied with the fingerprint. 368.It Fl M Ar memory 369Specify the amount of memory to use (in megabytes) when generating 370candidate moduli for DH-GEX. 371.It Fl m Ar key_format 372Specify a key format for the 373.Fl i 374(import) or 375.Fl e 376(export) conversion options. 377The supported key formats are: 378.Dq RFC4716 379(RFC 4716/SSH2 public or private key), 380.Dq PKCS8 381(PEM PKCS8 public key) 382or 383.Dq PEM 384(PEM public key). 385The default conversion format is 386.Dq RFC4716 . 387.It Fl N Ar new_passphrase 388Provides the new passphrase. 389.It Fl n Ar principals 390Specify one or more principals (user or host names) to be included in 391a certificate when signing a key. 392Multiple principals may be specified, separated by commas. 393Please see the 394.Sx CERTIFICATES 395section for details. 396.It Fl O Ar option 397Specify a certificate option when signing a key. 398This option may be specified multiple times. 399Please see the 400.Sx CERTIFICATES 401section for details. 402The options that are valid for user certificates are: 403.Bl -tag -width Ds 404.It Ic clear 405Clear all enabled permissions. 406This is useful for clearing the default set of permissions so permissions may 407be added individually. 408.It Ic force-command Ns = Ns Ar command 409Forces the execution of 410.Ar command 411instead of any shell or command specified by the user when 412the certificate is used for authentication. 413.It Ic no-agent-forwarding 414Disable 415.Xr ssh-agent 1 416forwarding (permitted by default). 417.It Ic no-port-forwarding 418Disable port forwarding (permitted by default). 419.It Ic no-pty 420Disable PTY allocation (permitted by default). 421.It Ic no-user-rc 422Disable execution of 423.Pa ~/.ssh/rc 424by 425.Xr sshd 8 426(permitted by default). 427.It Ic no-x11-forwarding 428Disable X11 forwarding (permitted by default). 429.It Ic permit-agent-forwarding 430Allows 431.Xr ssh-agent 1 432forwarding. 433.It Ic permit-port-forwarding 434Allows port forwarding. 435.It Ic permit-pty 436Allows PTY allocation. 437.It Ic permit-user-rc 438Allows execution of 439.Pa ~/.ssh/rc 440by 441.Xr sshd 8 . 442.It Ic permit-x11-forwarding 443Allows X11 forwarding. 444.It Ic source-address Ns = Ns Ar address_list 445Restrict the source addresses from which the certificate is considered valid. 446The 447.Ar address_list 448is a comma-separated list of one or more address/netmask pairs in CIDR 449format. 450.El 451.Pp 452At present, no options are valid for host keys. 453.It Fl P Ar passphrase 454Provides the (old) passphrase. 455.It Fl p 456Requests changing the passphrase of a private key file instead of 457creating a new private key. 458The program will prompt for the file 459containing the private key, for the old passphrase, and twice for the 460new passphrase. 461.It Fl Q 462Test whether keys have been revoked in a KRL. 463.It Fl q 464Silence 465.Nm ssh-keygen . 466Used by 467.Pa /etc/rc.d/sshd 468when creating a new key. 469.It Fl R Ar hostname 470Removes all keys belonging to 471.Ar hostname 472from a 473.Pa known_hosts 474file. 475This option is useful to delete hashed hosts (see the 476.Fl H 477option above). 478.It Fl r Ar hostname 479Print the SSHFP fingerprint resource record named 480.Ar hostname 481for the specified public key file. 482.It Fl S Ar start 483Specify start point (in hex) when generating candidate moduli for DH-GEX. 484.It Fl s Ar ca_key 485Certify (sign) a public key using the specified CA key. 486Please see the 487.Sx CERTIFICATES 488section for details. 489.Pp 490When generating a KRL, 491.Fl s 492specifies a path to a CA public key file used to revoke certificates directly 493by key ID or serial number. 494See the 495.Sx KEY REVOCATION LISTS 496section for details. 497.It Fl T Ar output_file 498Test DH group exchange candidate primes (generated using the 499.Fl G 500option) for safety. 501.It Fl t Ar type 502Specifies the type of key to create. 503The possible values are 504.Dq rsa1 505for protocol version 1 and 506.Dq dsa , 507.Dq ecdsa 508or 509.Dq rsa 510for protocol version 2. 511.It Fl u 512Update a KRL. 513When specified with 514.Fl k , 515keys listed via the command line are added to the existing KRL rather than 516a new KRL being created. 517.It Fl V Ar validity_interval 518Specify a validity interval when signing a certificate. 519A validity interval may consist of a single time, indicating that the 520certificate is valid beginning now and expiring at that time, or may consist 521of two times separated by a colon to indicate an explicit time interval. 522The start time may be specified as a date in YYYYMMDD format, a time 523in YYYYMMDDHHMMSS format or a relative time (to the current time) consisting 524of a minus sign followed by a relative time in the format described in the 525.Sx TIME FORMATS 526section of 527.Xr sshd_config 5 . 528The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time or 529a relative time starting with a plus character. 530.Pp 531For example: 532.Dq +52w1d 533(valid from now to 52 weeks and one day from now), 534.Dq -4w:+4w 535(valid from four weeks ago to four weeks from now), 536.Dq 20100101123000:20110101123000 537(valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011), 538.Dq -1d:20110101 539(valid from yesterday to midnight, January 1st, 2011). 540.It Fl v 541Verbose mode. 542Causes 543.Nm 544to print debugging messages about its progress. 545This is helpful for debugging moduli generation. 546Multiple 547.Fl v 548options increase the verbosity. 549The maximum is 3. 550.It Fl W Ar generator 551Specify desired generator when testing candidate moduli for DH-GEX. 552.It Fl y 553This option will read a private 554OpenSSH format file and print an OpenSSH public key to stdout. 555.It Fl z Ar serial_number 556Specifies a serial number to be embedded in the certificate to distinguish 557this certificate from others from the same CA. 558The default serial number is zero. 559.Pp 560When generating a KRL, the 561.Fl z 562flag is used to specify a KRL version number. 563.El 564.Sh MODULI GENERATION 565.Nm 566may be used to generate groups for the Diffie-Hellman Group Exchange 567(DH-GEX) protocol. 568Generating these groups is a two-step process: first, candidate 569primes are generated using a fast, but memory intensive process. 570These candidate primes are then tested for suitability (a CPU-intensive 571process). 572.Pp 573Generation of primes is performed using the 574.Fl G 575option. 576The desired length of the primes may be specified by the 577.Fl b 578option. 579For example: 580.Pp 581.Dl # ssh-keygen -G moduli-2048.candidates -b 2048 582.Pp 583By default, the search for primes begins at a random point in the 584desired length range. 585This may be overridden using the 586.Fl S 587option, which specifies a different start point (in hex). 588.Pp 589Once a set of candidates have been generated, they must be screened for 590suitability. 591This may be performed using the 592.Fl T 593option. 594In this mode 595.Nm 596will read candidates from standard input (or a file specified using the 597.Fl f 598option). 599For example: 600.Pp 601.Dl # ssh-keygen -T moduli-2048 -f moduli-2048.candidates 602.Pp 603By default, each candidate will be subjected to 100 primality tests. 604This may be overridden using the 605.Fl a 606option. 607The DH generator value will be chosen automatically for the 608prime under consideration. 609If a specific generator is desired, it may be requested using the 610.Fl W 611option. 612Valid generator values are 2, 3, and 5. 613.Pp 614Screened DH groups may be installed in 615.Pa /etc/moduli . 616It is important that this file contains moduli of a range of bit lengths and 617that both ends of a connection share common moduli. 618.Sh CERTIFICATES 619.Nm 620supports signing of keys to produce certificates that may be used for 621user or host authentication. 622Certificates consist of a public key, some identity information, zero or 623more principal (user or host) names and a set of options that 624are signed by a Certification Authority (CA) key. 625Clients or servers may then trust only the CA key and verify its signature 626on a certificate rather than trusting many user/host keys. 627Note that OpenSSH certificates are a different, and much simpler, format to 628the X.509 certificates used in 629.Xr ssl 8 . 630.Pp 631.Nm 632supports two types of certificates: user and host. 633User certificates authenticate users to servers, whereas host certificates 634authenticate server hosts to users. 635To generate a user certificate: 636.Pp 637.Dl $ ssh-keygen -s /path/to/ca_key -I key_id /path/to/user_key.pub 638.Pp 639The resultant certificate will be placed in 640.Pa /path/to/user_key-cert.pub . 641A host certificate requires the 642.Fl h 643option: 644.Pp 645.Dl $ ssh-keygen -s /path/to/ca_key -I key_id -h /path/to/host_key.pub 646.Pp 647The host certificate will be output to 648.Pa /path/to/host_key-cert.pub . 649.Pp 650It is possible to sign using a CA key stored in a PKCS#11 token by 651providing the token library using 652.Fl D 653and identifying the CA key by providing its public half as an argument 654to 655.Fl s : 656.Pp 657.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub 658.Pp 659In all cases, 660.Ar key_id 661is a "key identifier" that is logged by the server when the certificate 662is used for authentication. 663.Pp 664Certificates may be limited to be valid for a set of principal (user/host) 665names. 666By default, generated certificates are valid for all users or hosts. 667To generate a certificate for a specified set of principals: 668.Pp 669.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub 670.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub" 671.Pp 672Additional limitations on the validity and use of user certificates may 673be specified through certificate options. 674A certificate option may disable features of the SSH session, may be 675valid only when presented from particular source addresses or may 676force the use of a specific command. 677For a list of valid certificate options, see the documentation for the 678.Fl O 679option above. 680.Pp 681Finally, certificates may be defined with a validity lifetime. 682The 683.Fl V 684option allows specification of certificate start and end times. 685A certificate that is presented at a time outside this range will not be 686considered valid. 687By default, certificates are valid from 688.Ux 689Epoch to the distant future. 690.Pp 691For certificates to be used for user or host authentication, the CA 692public key must be trusted by 693.Xr sshd 8 694or 695.Xr ssh 1 . 696Please refer to those manual pages for details. 697.Sh KEY REVOCATION LISTS 698.Nm 699is able to manage OpenSSH format Key Revocation Lists (KRLs). 700These binary files specify keys or certificates to be revoked using a 701compact format, taking as little a one bit per certificate if they are being 702revoked by serial number. 703.Pp 704KRLs may be generated using the 705.Fl k 706flag. 707This option reads one or more files from the command line and generates a new 708KRL. 709The files may either contain a KRL specification (see below) or public keys, 710listed one per line. 711Plain public keys are revoked by listing their hash or contents in the KRL and 712certificates revoked by serial number or key ID (if the serial is zero or 713not available). 714.Pp 715Revoking keys using a KRL specification offers explicit control over the 716types of record used to revoke keys and may be used to directly revoke 717certificates by serial number or key ID without having the complete original 718certificate on hand. 719A KRL specification consists of lines containing one of the following directives 720followed by a colon and some directive-specific information. 721.Bl -tag -width Ds 722.It Cm serial : Ar serial_number Ns Op - Ns Ar serial_number 723Revokes a certificate with the specified serial number. 724Serial numbers are 64-bit values, not including zero and may be expressed 725in decimal, hex or octal. 726If two serial numbers are specified separated by a hyphen, then the range 727of serial numbers including and between each is revoked. 728The CA key must have been specified on the 729.Nm 730command line using the 731.Fl s 732option. 733.It Cm id : Ar key_id 734Revokes a certificate with the specified key ID string. 735The CA key must have been specified on the 736.Nm 737command line using the 738.Fl s 739option. 740.It Cm key : Ar public_key 741Revokes the specified key. 742If a certificate is listed, then it is revoked as a plain public key. 743.It Cm sha1 : Ar public_key 744Revokes the specified key by its SHA1 hash. 745.El 746.Pp 747KRLs may be updated using the 748.Fl u 749flag in addition to 750.Fl k . 751When this option is specified, keys listed via the command line are merged into 752the KRL, adding to those already there. 753.Pp 754It is also possible, given a KRL, to test whether it revokes a particular key 755(or keys). 756The 757.Fl Q 758flag will query an existing KRL, testing each key specified on the commandline. 759If any key listed on the command line has been revoked (or an error encountered) 760then 761.Nm 762will exit with a non-zero exit status. 763A zero exit status will only be returned if no key was revoked. 764.Sh FILES 765.Bl -tag -width Ds -compact 766.It Pa ~/.ssh/identity 767Contains the protocol version 1 RSA authentication identity of the user. 768This file should not be readable by anyone but the user. 769It is possible to 770specify a passphrase when generating the key; that passphrase will be 771used to encrypt the private part of this file using 3DES. 772This file is not automatically accessed by 773.Nm 774but it is offered as the default file for the private key. 775.Xr ssh 1 776will read this file when a login attempt is made. 777.Pp 778.It Pa ~/.ssh/identity.pub 779Contains the protocol version 1 RSA public key for authentication. 780The contents of this file should be added to 781.Pa ~/.ssh/authorized_keys 782on all machines 783where the user wishes to log in using RSA authentication. 784There is no need to keep the contents of this file secret. 785.Pp 786.It Pa ~/.ssh/id_dsa 787.It Pa ~/.ssh/id_ecdsa 788.It Pa ~/.ssh/id_rsa 789Contains the protocol version 2 DSA, ECDSA or RSA authentication identity of the user. 790This file should not be readable by anyone but the user. 791It is possible to 792specify a passphrase when generating the key; that passphrase will be 793used to encrypt the private part of this file using 128-bit AES. 794This file is not automatically accessed by 795.Nm 796but it is offered as the default file for the private key. 797.Xr ssh 1 798will read this file when a login attempt is made. 799.Pp 800.It Pa ~/.ssh/id_dsa.pub 801.It Pa ~/.ssh/id_ecdsa.pub 802.It Pa ~/.ssh/id_rsa.pub 803Contains the protocol version 2 DSA, ECDSA or RSA public key for authentication. 804The contents of this file should be added to 805.Pa ~/.ssh/authorized_keys 806on all machines 807where the user wishes to log in using public key authentication. 808There is no need to keep the contents of this file secret. 809.Pp 810.It Pa /etc/moduli 811Contains Diffie-Hellman groups used for DH-GEX. 812The file format is described in 813.Xr moduli 5 . 814.El 815.Sh SEE ALSO 816.Xr ssh 1 , 817.Xr ssh-add 1 , 818.Xr ssh-agent 1 , 819.Xr moduli 5 , 820.Xr sshd 8 821.Rs 822.%R RFC 4716 823.%T "The Secure Shell (SSH) Public Key File Format" 824.%D 2006 825.Re 826.Sh AUTHORS 827OpenSSH is a derivative of the original and free 828ssh 1.2.12 release by Tatu Ylonen. 829Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 830Theo de Raadt and Dug Song 831removed many bugs, re-added newer features and 832created OpenSSH. 833Markus Friedl contributed the support for SSH 834protocol versions 1.5 and 2.0. 835