NAME

dsagen, asn12dsa, dsa2pub, dsa2ssh − generate and format dsa keys

SYNOPSIS

­auth/dsagen [ ­-t ­tag ]

­auth/asn12dsa [ ­-t ­tag ] [ ­file ]

­auth/dsa2pub [ ­file ]

­auth/dsa2ssh [ ­-c ­comment ] [ ­file ]

DESCRIPTION

Plan 9 represents a DSA (Digital Signature Algorithm) key as an attribute-value pair list prefixed with the string key; this is the generic key format used by factotum(4). A full DSA private key has the following attributes:

­proto must be ­dsa

­!secret
decryption key

­p modulus, a large prime

­q group order, another large prime that divides ­p - 1. 

­alpha group generator

­key alphasecret mod p

All the numbers are in hexadecimal.  A DSA public key omits the attributes beginning with !.  A key may have other attributes as well (for example, a ­service attribute identifying how this key is typically used), but to these utilities such attributes are merely comments. 

For example, a private key and corresponding public key might look like this (with [⋯] indicating elisions and \ marking line breaks for readability):

key proto=dsa p=D5[⋯]DB q=C2[⋯]E7 alpha=44[⋯]9B key=C1[⋯]3F \
!secret=9E[⋯]3B
key proto=dsa p=D5[⋯]DB q=C2[⋯]E7 alpha=44[⋯]9B key=C1[⋯]3F

Note that the order of the attributes does not matter. 

­Dsagen prints a randomly generated DSA private key whose ­n has exactly ­nbits (default 1024) significant bits.  If ­tag is specified, it is printed between ­key and proto=dsa; typically, ­tag is a sequence of attribute-value comments describing the key. 

­Asn12dsa reads an DSA private key stored as ASN.1 encoded in the binary Distinguished Encoding Rules (DER) and prints a Plan 9 DSA key, inserting ­tag exactly as ­dsagen does.  ASN.1/DER is a popular key format on Unix and Windows; it is often encoded in text form using the Privacy Enhanced Mail (PEM) format in a section labeled as an “DSA ­PRIVATE KEY.” The command:

auth/pemdecode ’DSA PRIVATE KEY’ | auth/asn12dsa

extracts the key section from a textual ASN.1/DER/PEM key into binary ASN.1/DER format and then converts it to a Plan 9 DSA key. 

­Dsa2pub reads a Plan 9 DSA public or private key, removes the private attributes, and prints the resulting public key.  Comment attributes are preserved. 

­Dsa2ssh reads a Plan 9 DSA public or private key and prints the public portion in the format used by SSH: ­ssh-dss and a long base-64 encoded number.  For compatibility with external SSH implementations, the public keys in ­/sys/lib/ssh/keyring and ­$home/lib/keyring are stored in this format. 

EXAMPLES

Generate a fresh key and configure a remote Unix system to allow use of that key for logins:

auth/dsagen -t ’service=ssh’ >key
auth/dsa2ssh key | ssh unix ’cat >>.ssh/authorized_keys’
cat key >/mnt/factotum/ctl
ssh unix

SOURCE

­/sys/src/cmd/auth

SEE ALSO

ssh(1), factotum(4), pem(8), rsa(8)

BUGS

There are too many key formats. 

Plan 9  —  April 03, 2012