Merge branch 'vendor/OPENSSL'
[dragonfly.git] / secure / usr.bin / openssl / man / rsa.1
CommitLineData
e257b235 1.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
8b0cefbb
JR
2.\"
3.\" Standard preamble:
4.\" ========================================================================
5.de Sh \" Subsection heading
984263bc
MD
6.br
7.if t .Sp
8.ne 5
9.PP
10\fB\\$1\fR
11.PP
12..
8b0cefbb 13.de Sp \" Vertical space (when we can't use .PP)
984263bc
MD
14.if t .sp .5v
15.if n .sp
16..
8b0cefbb 17.de Vb \" Begin verbatim text
984263bc
MD
18.ft CW
19.nf
20.ne \\$1
21..
8b0cefbb 22.de Ve \" End verbatim text
984263bc 23.ft R
984263bc
MD
24.fi
25..
8b0cefbb
JR
26.\" Set up some character translations and predefined strings. \*(-- will
27.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
e257b235
PA
28.\" double quote, and \*(R" will give a right double quote. \*(C+ will
29.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
30.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
31.\" nothing in troff, for use with C<>.
32.tr \(*W-
8b0cefbb 33.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
984263bc 34.ie n \{\
8b0cefbb
JR
35. ds -- \(*W-
36. ds PI pi
37. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
38. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
39. ds L" ""
40. ds R" ""
41. ds C` ""
42. ds C' ""
984263bc
MD
43'br\}
44.el\{\
8b0cefbb
JR
45. ds -- \|\(em\|
46. ds PI \(*p
47. ds L" ``
48. ds R" ''
984263bc 49'br\}
8b0cefbb 50.\"
e257b235
PA
51.\" Escape single quotes in literal strings from groff's Unicode transform.
52.ie \n(.g .ds Aq \(aq
53.el .ds Aq '
54.\"
8b0cefbb
JR
55.\" If the F register is turned on, we'll generate index entries on stderr for
56.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
57.\" entries marked with X<> in POD. Of course, you'll have to process the
58.\" output yourself in some meaningful fashion.
e257b235 59.ie \nF \{\
8b0cefbb
JR
60. de IX
61. tm Index:\\$1\t\\n%\t"\\$2"
984263bc 62..
8b0cefbb
JR
63. nr % 0
64. rr F
984263bc 65.\}
e257b235
PA
66.el \{\
67. de IX
68..
69.\}
aac4ff6f 70.\"
8b0cefbb
JR
71.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
72.\" Fear. Run. Save yourself. No user-serviceable parts.
73. \" fudge factors for nroff and troff
984263bc 74.if n \{\
8b0cefbb
JR
75. ds #H 0
76. ds #V .8m
77. ds #F .3m
78. ds #[ \f1
79. ds #] \fP
984263bc
MD
80.\}
81.if t \{\
8b0cefbb
JR
82. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
83. ds #V .6m
84. ds #F 0
85. ds #[ \&
86. ds #] \&
984263bc 87.\}
8b0cefbb 88. \" simple accents for nroff and troff
984263bc 89.if n \{\
8b0cefbb
JR
90. ds ' \&
91. ds ` \&
92. ds ^ \&
93. ds , \&
94. ds ~ ~
95. ds /
984263bc
MD
96.\}
97.if t \{\
8b0cefbb
JR
98. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
99. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
100. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
101. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
102. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
103. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
984263bc 104.\}
8b0cefbb 105. \" troff and (daisy-wheel) nroff accents
984263bc
MD
106.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
107.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
108.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
109.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
110.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
111.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
112.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
113.ds ae a\h'-(\w'a'u*4/10)'e
114.ds Ae A\h'-(\w'A'u*4/10)'E
8b0cefbb 115. \" corrections for vroff
984263bc
MD
116.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
117.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
8b0cefbb 118. \" for low resolution devices (crt and lpr)
984263bc
MD
119.if \n(.H>23 .if \n(.V>19 \
120\{\
8b0cefbb
JR
121. ds : e
122. ds 8 ss
123. ds o a
124. ds d- d\h'-1'\(ga
125. ds D- D\h'-1'\(hy
126. ds th \o'bp'
127. ds Th \o'LP'
128. ds ae ae
129. ds Ae AE
984263bc
MD
130.\}
131.rm #[ #] #H #V #F C
8b0cefbb
JR
132.\" ========================================================================
133.\"
134.IX Title "RSA 1"
fc468453 135.TH RSA 1 "2010-02-27" "0.9.8m" "OpenSSL"
e257b235
PA
136.\" For nroff, turn off justification. Always turn off hyphenation; it makes
137.\" way too many mistakes in technical documents.
138.if n .ad l
139.nh
984263bc 140.SH "NAME"
e3cdf75b 141rsa \- RSA key processing tool
984263bc 142.SH "SYNOPSIS"
8b0cefbb
JR
143.IX Header "SYNOPSIS"
144\&\fBopenssl\fR \fBrsa\fR
984263bc
MD
145[\fB\-inform PEM|NET|DER\fR]
146[\fB\-outform PEM|NET|DER\fR]
147[\fB\-in filename\fR]
148[\fB\-passin arg\fR]
149[\fB\-out filename\fR]
150[\fB\-passout arg\fR]
151[\fB\-sgckey\fR]
152[\fB\-des\fR]
153[\fB\-des3\fR]
154[\fB\-idea\fR]
155[\fB\-text\fR]
156[\fB\-noout\fR]
157[\fB\-modulus\fR]
158[\fB\-check\fR]
159[\fB\-pubin\fR]
160[\fB\-pubout\fR]
161[\fB\-engine id\fR]
162.SH "DESCRIPTION"
8b0cefbb
JR
163.IX Header "DESCRIPTION"
164The \fBrsa\fR command processes \s-1RSA\s0 keys. They can be converted between various
984263bc
MD
165forms and their components printed out. \fBNote\fR this command uses the
166traditional SSLeay compatible format for private key encryption: newer
167applications should use the more secure PKCS#8 format using the \fBpkcs8\fR
168utility.
169.SH "COMMAND OPTIONS"
8b0cefbb
JR
170.IX Header "COMMAND OPTIONS"
171.IP "\fB\-inform DER|NET|PEM\fR" 4
172.IX Item "-inform DER|NET|PEM"
984263bc 173This specifies the input format. The \fB\s-1DER\s0\fR option uses an \s-1ASN1\s0 \s-1DER\s0 encoded
8b0cefbb 174form compatible with the PKCS#1 RSAPrivateKey or SubjectPublicKeyInfo format.
984263bc 175The \fB\s-1PEM\s0\fR form is the default format: it consists of the \fB\s-1DER\s0\fR format base64
8b0cefbb 176encoded with additional header and footer lines. On input PKCS#8 format private
984263bc
MD
177keys are also accepted. The \fB\s-1NET\s0\fR form is a format is described in the \fB\s-1NOTES\s0\fR
178section.
8b0cefbb
JR
179.IP "\fB\-outform DER|NET|PEM\fR" 4
180.IX Item "-outform DER|NET|PEM"
984263bc 181This specifies the output format, the options have the same meaning as the
8b0cefbb
JR
182\&\fB\-inform\fR option.
183.IP "\fB\-in filename\fR" 4
184.IX Item "-in filename"
984263bc
MD
185This specifies the input filename to read a key from or standard input if this
186option is not specified. If the key is encrypted a pass phrase will be
187prompted for.
8b0cefbb
JR
188.IP "\fB\-passin arg\fR" 4
189.IX Item "-passin arg"
984263bc 190the input file password source. For more information about the format of \fBarg\fR
8b0cefbb
JR
191see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1).
192.IP "\fB\-out filename\fR" 4
193.IX Item "-out filename"
984263bc
MD
194This specifies the output filename to write a key to or standard output if this
195option is not specified. If any encryption options are set then a pass phrase
196will be prompted for. The output filename should \fBnot\fR be the same as the input
197filename.
8b0cefbb
JR
198.IP "\fB\-passout password\fR" 4
199.IX Item "-passout password"
984263bc 200the output file password source. For more information about the format of \fBarg\fR
8b0cefbb
JR
201see the \fB\s-1PASS\s0 \s-1PHRASE\s0 \s-1ARGUMENTS\s0\fR section in \fIopenssl\fR\|(1).
202.IP "\fB\-sgckey\fR" 4
203.IX Item "-sgckey"
984263bc
MD
204use the modified \s-1NET\s0 algorithm used with some versions of Microsoft \s-1IIS\s0 and \s-1SGC\s0
205keys.
8b0cefbb
JR
206.IP "\fB\-des|\-des3|\-idea\fR" 4
207.IX Item "-des|-des3|-idea"
984263bc 208These options encrypt the private key with the \s-1DES\s0, triple \s-1DES\s0, or the
8b0cefbb 209\&\s-1IDEA\s0 ciphers respectively before outputting it. A pass phrase is prompted for.
984263bc
MD
210If none of these options is specified the key is written in plain text. This
211means that using the \fBrsa\fR utility to read in an encrypted key with no
212encryption option can be used to remove the pass phrase from a key, or by
213setting the encryption options it can be use to add or change the pass phrase.
214These options can only be used with \s-1PEM\s0 format output files.
8b0cefbb
JR
215.IP "\fB\-text\fR" 4
216.IX Item "-text"
984263bc 217prints out the various public or private key components in
e257b235 218plain text in addition to the encoded version.
8b0cefbb
JR
219.IP "\fB\-noout\fR" 4
220.IX Item "-noout"
984263bc 221this option prevents output of the encoded version of the key.
8b0cefbb
JR
222.IP "\fB\-modulus\fR" 4
223.IX Item "-modulus"
984263bc 224this option prints out the value of the modulus of the key.
8b0cefbb
JR
225.IP "\fB\-check\fR" 4
226.IX Item "-check"
984263bc 227this option checks the consistency of an \s-1RSA\s0 private key.
8b0cefbb
JR
228.IP "\fB\-pubin\fR" 4
229.IX Item "-pubin"
984263bc
MD
230by default a private key is read from the input file: with this
231option a public key is read instead.
8b0cefbb
JR
232.IP "\fB\-pubout\fR" 4
233.IX Item "-pubout"
984263bc
MD
234by default a private key is output: with this option a public
235key will be output instead. This option is automatically set if
236the input is a public key.
8b0cefbb
JR
237.IP "\fB\-engine id\fR" 4
238.IX Item "-engine id"
984263bc
MD
239specifying an engine (by it's unique \fBid\fR string) will cause \fBreq\fR
240to attempt to obtain a functional reference to the specified engine,
241thus initialising it if needed. The engine will then be set as the default
242for all available algorithms.
243.SH "NOTES"
8b0cefbb
JR
244.IX Header "NOTES"
245The \s-1PEM\s0 private key format uses the header and footer lines:
984263bc
MD
246.PP
247.Vb 2
e257b235
PA
248\& \-\-\-\-\-BEGIN RSA PRIVATE KEY\-\-\-\-\-
249\& \-\-\-\-\-END RSA PRIVATE KEY\-\-\-\-\-
984263bc 250.Ve
8b0cefbb
JR
251.PP
252The \s-1PEM\s0 public key format uses the header and footer lines:
984263bc
MD
253.PP
254.Vb 2
e257b235
PA
255\& \-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-
256\& \-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
984263bc 257.Ve
8b0cefbb
JR
258.PP
259The \fB\s-1NET\s0\fR form is a format compatible with older Netscape servers
260and Microsoft \s-1IIS\s0 .key files, this uses unsalted \s-1RC4\s0 for its encryption.
984263bc
MD
261It is not very secure and so should only be used when necessary.
262.PP
8b0cefbb 263Some newer version of \s-1IIS\s0 have additional data in the exported .key
984263bc 264files. To use these with the utility, view the file with a binary editor
e257b235 265and look for the string \*(L"private-key\*(R", then trace back to the byte
8b0cefbb 266sequence 0x30, 0x82 (this is an \s-1ASN1\s0 \s-1SEQUENCE\s0). Copy all the data
984263bc 267from this point onwards to another file and use that as the input
8b0cefbb 268to the \fBrsa\fR utility with the \fB\-inform \s-1NET\s0\fR option. If you get
984263bc
MD
269an error after entering the password try the \fB\-sgckey\fR option.
270.SH "EXAMPLES"
8b0cefbb
JR
271.IX Header "EXAMPLES"
272To remove the pass phrase on an \s-1RSA\s0 private key:
984263bc
MD
273.PP
274.Vb 1
e257b235 275\& openssl rsa \-in key.pem \-out keyout.pem
984263bc 276.Ve
8b0cefbb
JR
277.PP
278To encrypt a private key using triple \s-1DES:\s0
984263bc
MD
279.PP
280.Vb 1
e257b235 281\& openssl rsa \-in key.pem \-des3 \-out keyout.pem
984263bc 282.Ve
8b0cefbb 283.PP
e257b235 284To convert a private key from \s-1PEM\s0 to \s-1DER\s0 format:
984263bc
MD
285.PP
286.Vb 1
e257b235 287\& openssl rsa \-in key.pem \-outform DER \-out keyout.der
984263bc 288.Ve
8b0cefbb 289.PP
984263bc
MD
290To print out the components of a private key to standard output:
291.PP
292.Vb 1
e257b235 293\& openssl rsa \-in key.pem \-text \-noout
984263bc 294.Ve
8b0cefbb 295.PP
984263bc
MD
296To just output the public part of a private key:
297.PP
298.Vb 1
e257b235 299\& openssl rsa \-in key.pem \-pubout \-out pubkey.pem
984263bc
MD
300.Ve
301.SH "BUGS"
8b0cefbb 302.IX Header "BUGS"
984263bc 303The command line password arguments don't currently work with
8b0cefbb 304\&\fB\s-1NET\s0\fR format.
984263bc
MD
305.PP
306There should be an option that automatically handles .key files,
307without having to manually edit them.
308.SH "SEE ALSO"
e3cdf75b 309.IX Header "SEE ALSO"
8b0cefbb 310\&\fIpkcs8\fR\|(1), \fIdsa\fR\|(1), \fIgenrsa\fR\|(1),
e257b235 311\&\fIgendsa\fR\|(1)