summaryrefslogtreecommitdiff
path: root/man/man1/pem2openpgp.1
blob: fe207884999d78f254dc84fb5259944d6620f284 (plain) 
    

  1. .\"  -*- nroff -*-
    2. 

  2. .Dd $Mdocdate: March 1, 2009 $
    3. 

  3. .Dt PEM2OPENPGP 1
    4. 

  4. .Os
    5. 

  5. .Sh NAME
    6. 

  6. pem2openpgp
    7. 

  7. .Nd translate PEM-encoded RSA keys to OpenPGP certificates
    8. 

  8. .Sh SYNOPSIS
    9. 

  9. .Nm pem2openpgp "$USERID" < mykey.pem | gpg \-\-import
    10. 

  10. .Pp
    11. 

  11. .Nm PEM2OPENPGP_EXPIRATION=$((86400 * $DAYS)) PEM2OPENPGP_USAGE_FLAGS=authenticate,certify pem2openpgp "$USERID" <mykey.pem
    12. 

  12. .Sh DESCRIPTION
    13. 

  13. .Nm
    14. 

  14. is a low-level utility for transforming raw, PEM-encoded RSA secret
    15. 

  15. keys into OpenPGP-formatted certificates.  The generated certificates
    16. 

  16. include the secret key material, so they should be handled carefully.
    17. 

  17. .Pp
    18. 

  18. It works as an element within a pipeline: feed it the raw key on
    19. 

  19. stdin, supply the desired User ID as a command line argument.  Note
    20. 

  20. that you may need to quote the string to ensure that it is entirely in
    21. 

  21. a single argument.
    22. 

  22. .Pp
    23. 

  23. Other choices about how to generate the new OpenPGP certificate are
    24. 

  24. governed by environment variables.
    25. 

  25. .Sh ENVIRONMENT
    26. 

  26. The following environment variables influence the behavior of
    27. 

  27. .Nm :
    28. 

  28. .Pp
    29. 

  29. .ti 3
    30. 

  30. \fBPEM2OPENPGP_TIMESTAMP\fP controls the timestamp (measured in
    31. 

  31. seconds since the UNIX epoch) indicated as the creation time (a.k.a
    32. 

  32. "not valid before") of the generated certificate (self-signature) and
    33. 

  33. the key itself.  By default,
    34. 

  34. .Nm
    35. 

  35. uses the current time.
    36. 

  36. .Pp
    37. 

  37. .ti 3
    38. 

  38. \fBPEM2OPENPGP_KEY_TIMESTAMP\fP controls the timestamp (measured in
    39. 

  39. seconds since the UNIX epoch) indicated as the creation time of just
    40. 

  40. the key itself (not the self-signature).  By default,
    41. 

  41. .Nm
    42. 

  42. uses the value from PEM2OPENPGP_TIMESTAMP.
    43. 

  43. .Pp
    44. 

  44. .ti 3
    45. 

  45. \fBPEM2OPENPGP_USAGE_FLAGS\fP should contain a comma-separated list of
    46. 

  46. valid OpenPGP usage flags (see section 5.2.3.21 of RFC 4880 for what
    47. 

  47. these mean).  The available choices are: certify, sign, encrypt_comms,
    48. 

  48. encrypt_storage, encrypt (this means both encrypt_comms and
    49. 

  49. encrypt_storage), authenticate, split, shared.  By default, 
    50. 

  50. .Nm
    51. 

  51. only sets the certify flag.
    52. 

  52. .Pp
    53. 

  53. .ti 3
    54. 

  54. \fBPEM2OPENPGP_EXPIRATION\fP sets an expiration (measured in seconds
    55. 

  55. after the creation time of the key) in each self-signature packet.  By
    56. 

  56. default, no expiration subpacket is included.
    57. 

  57. .Pp
    58. 

  58. .ti 3
    59. 

  59. \fBPEM2OPENPGP_NEWKEY\fP indicates that
    60. 

  60. .Nm
    61. 

  61. should ignore stdin, and instead generate a new key internally and
    62. 

  62. build the certificate based on this new key.  Set this variable to the
    63. 

  63. number of bits for the new key (e.g. 2048).  By default (when this is
    64. 

  64. unset), 
    65. 

  65. .Nm
    66. 

  66. will read the key from stdin.
    67. 

  67. .Sh AUTHOR
    68. 

  68. .Nm
    69. 

  69. and this man page were written by Daniel Kahn Gillmor
    70. 

  70. <dkg@fifthhorseman.net>.
    71. 

  71. .Sh BUGS
    72. 

  72. Only handles RSA keys at the moment.  It might be nice to handle DSA
    73. 

  73. keys as well.
    74. 

  74. .Pp
    75. 

  75. Currently only creates certificates with a single User ID.  Should be
    76. 

  76. able to create certificates with multiple User IDs.
    77. 

  77. .Pp
    78. 

  78. Currently only accepts unencrypted RSA keys.  It should be able to
    79. 

  79. deal with passphrase-locked key material.
    80. 

  80. .Pp
    81. 

  81. Currently outputs OpenPGP certificates with cleartext secret key
    82. 

  82. material.  It would be good to be able to lock the output with a
    83. 

  83. passphrase.
    84. 

  84. .Pp
    85. 

  85. If you find other bugs, please report them at
    86. 

  86. https://labs.riseup.net/code/projects/show/monkeysphere
    87. 

  87. .Sh SEE ALSO
    88. 

  88. .Xr openpgp2ssh 1,
    89. 

  89. .Xr monkeysphere 1 ,
    90. 

  90. .Xr monkeysphere 7 ,
    91. 

  91. .Xr ssh 1 ,
    92. 

  92. .Xr monkeysphere\-host 8 ,
    93. 

  93. .Xr monkeysphere\-authentication 8
    94.
generated by cgit v1.2.3 (git 2.46.0) at 2024-11-04 21:49:41 +0000