NAME symkeyutil - manage fixed keys in the database SYNOPSIS symkeyutil -H symkeyutil -L [std_opts] [-r] symkeyutil -K [-n name] -t type [-s size] [-i id |-j id_file] [std_opts] symkeyutil -D <[-n name | -i id | -j id_file> [std_opts] symkeyutil -I [-n name] [-t type] [-i id | -j id_file] -k data_file [std_opts] symkeyutil -E <-nname | -i id | -j id_file> [-t type] -k data_file [-r] [std_opts] symkeyutil -U [-n name] [-t type] [-i id | -j id_file] -k data_file [std_opts] symkeyutil -W <-n name | -i id | -j id_file> [-t type] -k data_file [-r] [std_opts] symkeyutil -M <-n name | -i id | -j id_file> -g target_token [std_opts] std_opts -> [-d certdir] [-P dbprefix] [-p password] [-f passwordFile] [-h token] wrap_opts -> <-w wrap_name | -x wrap_id | -y id_file> DESCRIPTION NSS can store fixed keys as well as asymetric keys in the database. The symkeyutil command can be used to manage these keys. As with certutil, symkeyutil takes two types of arguments, commands and options. Most commands fall into one of two catagories: commands which create keys and commands which extract or destroy keys. Exceptions to these catagories are listed first: -H takes no additional options. It lists a more detailed help message. -L takes the standard set of options. It lists all the keys in the specified token (NSS Internal DB Token is the default). Only the -L option accepts the all option for tokens to list all the fixed keys. Key Creation commands: For these commands, the key type (-t) option is always required. In addition, the -s option may be required for certain key types. The standard set of options may be specified. -K Create a new key using the token key gen function. -I Import a new key from the raw data specified in the data file, specified with the -k options (required). This command may fail on some tokens that don't support direct import of key material. -U Unwrap a new key from an encrypted data file specified with the -k option. The -w, -x, or -y option specifies the unwrapping key. The unwrapping algorithm is selected based on the type of the unwrapping key. Key extraction/destruction options: For these keys, one and only of of the -n, -i, or -j options must be specified. If more than one key matches the -n option, the 'first' key matching will be used. The standard set of options may be specified. -D Delete the key specified by the -n, -i, or -j options. -E Export the key specified by the -n, -i, or -j options and store the contents to a file specified by the -k file (required). This command will seldom work on any token since most keys are protected from export. -W Wrap the key specified by the -n, -i, or -j options and store the encrypted contents to a file specified by the -k file (required). The -w, -x, or -y option specifies the key used to wrap the target key. -M Move the key specified by the -n, -i, or -j options to the token specified by the -g option (required). The new key will have the same attributes as the source key. OPTIONS Standard options are those options that may be used by any command, and whose meaning is the same for all commands. -h token Specify the token which the command will operate on. If -h is not specified the internal token is presumed. In addition the special value 'all' may be used to specify that all tokens should be used. This is only valid for the '-L' command. -d certdir Specify the location of the NSS databases. The default value is platform dependent. -P dbprefix Specify the prefix for the NSS database. The default value is NULL. -p password Specify the password for the token. On the command line. The -p and -f options are mutually exclusive. If neither option is specified, the password would be prompted from the user. -f passwordFile Specify a file that contains the password for the token. This option is mutually exclusive to the -p option. In addition to the standard options are the following command specific options are. -r Opens the NSS databases Read/Write. By default the -L, -E, and -W commands open the database read only. Other commands automatically opens the databases Read/Write and igore this option if it is specified. -n name Specifies the nickname for the key. For the -K, -I, or -U options, name is the name for the new key. If -n is not specified, no name is assumed. There is not check for duplicate names. For the -D, -E, -W, or -M, the name specifies the key to operate on. In this case one andy only one of the -n, -i or -j options should be specifed. It is possible that the -n options specifies and ambiguous key. In that case the 'first' valid key is used. For the -M option, the nickname for the new key is copied from it's original key, even if the original key is specified using -i or -j. -i key id -j key id file These options are equivalent and mutually exclusive. They specify the key id for the file. The -i option specifies the key id on the command line using a hex string. The -j specifies a file to read the raw key id from. For the -K, -I, or -U options, key id is the key id for the new key. If -i or -j is not specified, no key id is assumed. Some tokens may generate their own unique id for the key in this case (but it is not guarrenteed). For the -D, -E, -W, or -M, the key id specifies the key to operate on. In this case one andy only one of the -n, -i or -j options should be specifed. -t type Specifies the key Type for the new key. This option is required for the -K, -I, and -U commands. Valid values are: generic, rc2, rc4, des, des2, des3, cast, cast3, cast5, cast128, rc5, idea, skipjack, baton, juniper, cdmf, aes, camellia Not all tokens support all key types. The generic key type is usually used in MACing and key derivation algorithms. Neither generic nor rc4 keys may be used to wrap other keys. Fixed rc4 keys are dangerous since multiple use of the same stream cipher key to encrypted different data can compromise all data encrypted with that key. -s size Specifies the key size. For most situations the key size is already known and need not be specified. For some algorithms, however, it is necessary to specify the key size when generation or unwrapping the key. -k key file Specifies the name of a file that contains key data to import or unwrap (-I or -U), or the location to store key data or encrypted key data (-E or -W). -g target token Specifies the target token when moving a key (-M). This option is required for the -M command. It is invalid for all other commands. -w wrap name -x wrap key id -y wrap key id file Specifies the wrapping key used int the -U and -W command. Exactly one of these must be specified for the -U or -W commands. Same semantics as the -n, -i, and -j options above. BUGS There is no way display the key id of a key. The -p and -f options only specifies one password. Multiple passwords may be needed for the -L -h all command and the -M command. Perhaps RC4 should not be supported as a key type. Use of these keys as fixed keys is exceedingly dangerous. The handling of multiple keys with the same nickname should be more deterministic than 'the first one' There is no way to specify, or display the operation flags of a key. The operation flags are not copied with the -M option as they should be. There is no way to change the attributes of a key (nickname, id, operation flags).