dist/util/ntp-keygen.html

          1.1  christos <html lang="en">
          1.1  christos <head>
          1.1  christos <title>Ntp-keygen User's Manual</title>
          1.1  christos <meta http-equiv="Content-Type" content="text/html">
          1.1  christos <meta name="description" content="Ntp-keygen User's Manual">
      1.1.1.7  christos <meta name="generator" content="makeinfo 4.7">
          1.1  christos <link title="Top" rel="top" href="#Top">
          1.1  christos <link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage">
          1.1  christos <meta http-equiv="Content-Style-Type" content="text/css">
          1.1  christos <style type="text/css"><!--
          1.1  christos   pre.display { font-family:inherit }
          1.1  christos   pre.format  { font-family:inherit }
          1.1  christos   pre.smalldisplay { font-family:inherit; font-size:smaller }
          1.1  christos   pre.smallformat  { font-family:inherit; font-size:smaller }
          1.1  christos   pre.smallexample { font-size:smaller }
          1.1  christos   pre.smalllisp    { font-size:smaller }
      1.1.1.7  christos   span.sc { font-variant:small-caps }
      1.1.1.7  christos   span.roman { font-family: serif; font-weight: normal; }
          1.1  christos --></style>
          1.1  christos </head>
          1.1  christos <body>
          1.1  christos <h1 class="settitle">Ntp-keygen User's Manual</h1>
          1.1  christos   <div class="shortcontents">
          1.1  christos <h2>Short Contents</h2>
          1.1  christos <ul>
          1.1  christos <a href="#Top">Top</a>
          1.1  christos <a href="#Top">NTP Key Generation Program User Manual</a>
          1.1  christos </ul>
          1.1  christos </div>
          1.1  christos
          1.1  christos
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Top"></a>Up:&nbsp;<a rel="up" accesskey="u" href="#dir">(dir)</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h2 class="unnumbered">Top</h2>
          1.1  christos
          1.1  christos <ul class="menu">
          1.1  christos <li><a accesskey="1" href="#Description">Description</a>
          1.1  christos <li><a accesskey="2" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>: 	Invoking ntp-keygen
          1.1  christos <li><a accesskey="3" href="#Running-the-Program">Running the Program</a>
          1.1  christos <li><a accesskey="4" href="#Random-Seed-File">Random Seed File</a>
          1.1  christos <li><a accesskey="5" href="#Cryptographic-Data-Files">Cryptographic Data Files</a>
          1.1  christos </ul>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Top"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#Description">Description</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#dir">(dir)</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#dir">(dir)</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h2 class="unnumbered">NTP Key Generation Program User Manual</h2>
          1.1  christos
          1.1  christos <p>This document describes the use of the NTP Project's <code>ntp-keygen</code>
          1.1  christos program, that generates cryptographic data files used by the NTPv4
          1.1  christos authentication and identity schemes.
          1.1  christos It can generate message digest keys used in symmetric key cryptography and,
          1.1  christos if the OpenSSL software
          1.1  christos library has been installed, it can generate host keys, sign keys,
          1.1  christos certificates, and identity keys and parameters used by the Autokey
          1.1  christos public key cryptography.
          1.1  christos The message digest keys file is generated in a
          1.1  christos format compatible with NTPv3.
          1.1  christos All other files are in PEM-encoded
          1.1  christos printable ASCII format so they can be embedded as MIME attachments in
          1.1  christos mail to other sites.
          1.1  christos
1.1.1.10.10.2  pgoyette   <p>This document applies to version 4.2.8p12 of <code>ntp-keygen</code>.
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Description"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#Running-the-Program">Running the Program</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#Top">Top</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <!-- node-name,  next,  previous,  up -->
          1.1  christos <h3 class="section">Description</h3>
          1.1  christos
          1.1  christos <p>This program generates cryptographic data files used by the NTPv4
          1.1  christos authentication and identity schemes. It can generate message digest
          1.1  christos keys used in symmetric key cryptography and, if the OpenSSL software
          1.1  christos library has been installed, it can generate host keys, sign keys,
          1.1  christos certificates, and identity keys and parameters used by the Autokey
          1.1  christos public key cryptography. The message digest keys file is generated in a
          1.1  christos format compatible with NTPv3. All other files are in PEM-encoded
          1.1  christos printable ASCII format so they can be embedded as MIME attachments in
          1.1  christos mail to other sites.
          1.1  christos
          1.1  christos   <p>When used to generate message digest keys, the program produces a file
          1.1  christos containing ten pseudo-random printable ASCII strings suitable for the
          1.1  christos MD5 message digest algorithm included in the distribution.
          1.1  christos If the
          1.1  christos OpenSSL library is installed, it produces an additional ten hex-encoded
          1.1  christos random bit strings suitable for the SHA1 and other message digest
          1.1  christos algorithms.
          1.1  christos The message digest keys file must be distributed and stored
          1.1  christos using secure means beyond the scope of NTP itself.
          1.1  christos Besides the keys
          1.1  christos used for ordinary NTP associations, additional keys can be defined as
          1.1  christos passwords for the ntpq and ntpdc utility programs.
          1.1  christos
          1.1  christos   <p>The remaining generated files are compatible with other OpenSSL
          1.1  christos applications and other Public Key Infrastructure (PKI) resources.
          1.1  christos Certificates generated by this program are compatible with extant
          1.1  christos industry practice, although some users might find the interpretation of
          1.1  christos X509v3 extension fields somewhat liberal.
          1.1  christos However, the identity keys
          1.1  christos are probably not compatible with anything other than Autokey.
          1.1  christos
          1.1  christos   <p>Some files used by this program are encrypted using a private password.
          1.1  christos The <code>-p</code> option specifies the password for local encrypted files and the
          1.1  christos <code>-q</code> option the password for encrypted files sent to remote sites.
          1.1  christos If no password is specified, the host name returned by the Unix
          1.1  christos <code>gethostname()</code> function, normally the DNS name of the host, is used.
          1.1  christos
          1.1  christos   <p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command
          1.1  christos specifies the read password for previously encrypted local files.
          1.1  christos This must match the local password used by this program.
          1.1  christos If not specified, the host name is used.
          1.1  christos Thus, if files are generated by this program without password,
          1.1  christos they can be read back by ntpd without password, but only on the same
          1.1  christos host.
          1.1  christos
          1.1  christos   <p>Normally, encrypted files for each host are generated by that host and
          1.1  christos used only by that host, although exceptions exist as noted later on
          1.1  christos this page.
          1.1  christos The symmetric keys file, normally called <code>ntp.keys</code>, is
          1.1  christos usually installed in <code>/etc</code>.
          1.1  christos Other files and links are usually installed
          1.1  christos in <code>/usr/local/etc</code>, which is normally in a shared filesystem in
          1.1  christos NFS-mounted networks and cannot be changed by shared clients.
          1.1  christos The location of the keys directory can be changed by the keysdir
          1.1  christos configuration command in such cases.
          1.1  christos Normally, this is in <code>/etc</code>.
          1.1  christos
          1.1  christos   <p>This program directs commentary and error messages to the standard
          1.1  christos error stream <code>stderr</code> and remote files to the standard output stream
          1.1  christos <code>stdout</code> where they can be piped to other applications or redirected to
          1.1  christos files.
          1.1  christos The names used for generated files and links all begin with the
          1.1  christos string <code>ntpkey</code> and include the file type,
          1.1  christos generating host and filestamp,
          1.1  christos as described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below.
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Running-the-Program"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#Random-Seed-File">Random Seed File</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#Description">Description</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <!-- node-name,  next,  previous,  up -->
          1.1  christos <h3 class="section">Running the Program</h3>
          1.1  christos
          1.1  christos <p>To test and gain experience with Autokey concepts, log in as root and
          1.1  christos change to the keys directory, usually <code>/usr/local/etc</code>.
          1.1  christos When run for the
          1.1  christos first time, or if all files with names beginning <code>ntpkey</code>] have been
          1.1  christos removed, use the <code>ntp-keygen</code> command without arguments to generate a
          1.1  christos default RSA host key and matching RSA-MD5 certificate with expiration
          1.1  christos date one year hence.
          1.1  christos If run again without options, the program uses the
          1.1  christos existing keys and parameters and generates only a new certificate with
          1.1  christos new expiration date one year hence.
          1.1  christos
          1.1  christos   <p>Run the command on as many hosts as necessary.
          1.1  christos Designate one of them as the trusted host (TH) using <code>ntp-keygen</code>
          1.1  christos with the <code>-T</code> option and configure
          1.1  christos it to synchronize from reliable Internet servers.
          1.1  christos Then configure the other hosts to synchronize to the TH directly or indirectly.
          1.1  christos A certificate trail is created when Autokey asks the immediately
          1.1  christos ascendant host towards the TH to sign its certificate, which is then
          1.1  christos provided to the immediately descendant host on request.
          1.1  christos All group hosts should have acyclic certificate trails ending on the TH.
          1.1  christos
          1.1  christos   <p>The host key is used to encrypt the cookie when required and so must be
          1.1  christos RSA type.
          1.1  christos By default, the host key is also the sign key used to encrypt signatures.
          1.1  christos A different sign key can be assigned using the <code>-S</code> option
          1.1  christos and this can be either RSA or DSA type.
          1.1  christos By default, the signature
          1.1  christos message digest type is MD5, but any combination of sign key type and
          1.1  christos message digest type supported by the OpenSSL library can be specified
          1.1  christos using the <code>-c</code> option.
          1.1  christos
          1.1  christos   <p>The rules say cryptographic media should be generated with proventic
          1.1  christos filestamps, which means the host should already be synchronized before
          1.1  christos this program is run.
          1.1  christos This of course creates a chicken-and-egg problem
          1.1  christos when the host is started for the first time.
          1.1  christos Accordingly, the host time
          1.1  christos should be set by some other means, such as eyeball-and-wristwatch, at
          1.1  christos least so that the certificate lifetime is within the current year.
          1.1  christos After that and when the host is synchronized to a proventic source, the
          1.1  christos certificate should be re-generated.
          1.1  christos
          1.1  christos   <p>Additional information on trusted groups and identity schemes is on the
          1.1  christos Autokey Public-Key Authentication page.
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
          1.1  christos <a name="ntp_002dkeygen-Invocation"></a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h3 class="section">Invoking ntp-keygen</h3>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen-1"></a><a name="index-Create-a-NTP-host-key-2"></a>
          1.1  christos
          1.1  christos   <p>This program generates cryptographic data files used by the NTPv4
          1.1  christos authentication and identification schemes.
1.1.1.10.10.1  pgoyette It can generate message digest keys used in symmetric key cryptography and,
1.1.1.10.10.1  pgoyette if the OpenSSL software library has been installed, it can generate host keys,
1.1.1.10.10.1  pgoyette signing keys, certificates, and identity keys and parameters used in Autokey
1.1.1.10.10.1  pgoyette public key cryptography.
          1.1  christos These files are used for cookie encryption,
1.1.1.10.10.1  pgoyette digital signature, and challenge/response identification algorithms
          1.1  christos compatible with the Internet standard security infrastructure.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>The message digest symmetric keys file is generated in a format
1.1.1.10.10.1  pgoyette compatible with NTPv3.
1.1.1.10.10.1  pgoyette All other files are in PEM-encoded printable ASCII format,
1.1.1.10.10.1  pgoyette so they can be embedded as MIME attachments in email to other sites
          1.1  christos and certificate authorities.
          1.1  christos By default, files are not encrypted.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>When used to generate message digest symmetric keys, the program
1.1.1.10.10.1  pgoyette produces a file containing ten pseudo-random printable ASCII strings
1.1.1.10.10.1  pgoyette suitable for the MD5 message digest algorithm included in the
1.1.1.10.10.1  pgoyette distribution.
          1.1  christos If the OpenSSL library is installed, it produces an additional ten
1.1.1.10.10.1  pgoyette hex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and
1.1.1.10.10.1  pgoyette other message digest algorithms.
1.1.1.10.10.1  pgoyette The message digest symmetric keys file must be distributed and stored
          1.1  christos using secure means beyond the scope of NTP itself.
          1.1  christos Besides the keys used for ordinary NTP associations, additional keys
          1.1  christos can be defined as passwords for the
          1.1  christos <code>ntpq(1ntpqmdoc)</code>
          1.1  christos and
          1.1  christos <code>ntpdc(1ntpdcmdoc)</code>
          1.1  christos utility programs.
          1.1  christos
          1.1  christos   <p>The remaining generated files are compatible with other OpenSSL
          1.1  christos applications and other Public Key Infrastructure (PKI) resources.
          1.1  christos Certificates generated by this program are compatible with extant
          1.1  christos industry practice, although some users might find the interpretation of
          1.1  christos X509v3 extension fields somewhat liberal.
          1.1  christos However, the identity keys are probably not compatible with anything
          1.1  christos other than Autokey.
          1.1  christos
          1.1  christos   <p>Some files used by this program are encrypted using a private password.
          1.1  christos The
          1.1  christos <code>-p</code>
1.1.1.10.10.1  pgoyette option specifies the read password for local encrypted files and the
          1.1  christos <code>-q</code>
1.1.1.10.10.1  pgoyette option the write password for encrypted files sent to remote sites.
          1.1  christos If no password is specified, the host name returned by the Unix
1.1.1.10.10.1  pgoyette <code>hostname(1)</code>
1.1.1.10.10.1  pgoyette command, normally the DNS name of the host, is used as the the default read
1.1.1.10.10.1  pgoyette password, for convenience.
1.1.1.10.10.1  pgoyette The
1.1.1.10.10.1  pgoyette <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette program prompts for the password if it reads an encrypted file
1.1.1.10.10.1  pgoyette and the password is missing or incorrect.
1.1.1.10.10.1  pgoyette If an encrypted file is read successfully and
1.1.1.10.10.1  pgoyette no write password is specified, the read password is used
1.1.1.10.10.1  pgoyette as the write password by default.
          1.1  christos
          1.1  christos   <p>The
1.1.1.10.10.1  pgoyette <code>pw</code>
          1.1  christos option of the
1.1.1.10.10.1  pgoyette <code>crypto</code>
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
          1.1  christos configuration command specifies the read
          1.1  christos password for previously encrypted local files.
1.1.1.10.10.1  pgoyette This must match the local read password used by this program.
          1.1  christos If not specified, the host name is used.
1.1.1.10.10.1  pgoyette Thus, if files are generated by this program without an explicit password,
          1.1  christos they can be read back by
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette without specifying an explicit password but only on the same host.
1.1.1.10.10.1  pgoyette If the write password used for encryption is specified as the host name,
1.1.1.10.10.1  pgoyette these files can be read by that host with no explicit password.
          1.1  christos
          1.1  christos   <p>Normally, encrypted files for each host are generated by that host and
          1.1  christos used only by that host, although exceptions exist as noted later on
          1.1  christos this page.
          1.1  christos The symmetric keys file, normally called
1.1.1.10.10.1  pgoyette <span class="file">ntp.keys</span>,
          1.1  christos is usually installed in
      1.1.1.7  christos <span class="file">/etc</span>.
          1.1  christos Other files and links are usually installed in
      1.1.1.7  christos <span class="file">/usr/local/etc</span>,
          1.1  christos which is normally in a shared filesystem in
          1.1  christos NFS-mounted networks and cannot be changed by shared clients.
1.1.1.10.10.1  pgoyette In these cases, NFS clients can specify the files in another
1.1.1.10.10.1  pgoyette directory such as
1.1.1.10.10.1  pgoyette <span class="file">/etc</span>
1.1.1.10.10.1  pgoyette using the
1.1.1.10.10.1  pgoyette <code>keysdir</code>
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette configuration file command.
          1.1  christos
          1.1  christos   <p>This program directs commentary and error messages to the standard
          1.1  christos error stream
1.1.1.10.10.1  pgoyette <span class="file">stderr</span>
          1.1  christos and remote files to the standard output stream
1.1.1.10.10.1  pgoyette <span class="file">stdout</span>
          1.1  christos where they can be piped to other applications or redirected to files.
          1.1  christos The names used for generated files and links all begin with the
          1.1  christos string
1.1.1.10.10.1  pgoyette <span class="file">ntpkey*</span>
          1.1  christos and include the file type, generating host and filestamp,
          1.1  christos as described in the
1.1.1.10.10.1  pgoyette <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a>
          1.1  christos section below.
          1.1  christos
          1.1  christos <h5 class="subsubsection">Running the Program</h5>
          1.1  christos
          1.1  christos <p>The safest way to run the
          1.1  christos <code>ntp-keygen</code>
          1.1  christos program is logged in directly as root.
1.1.1.10.10.1  pgoyette The recommended procedure is change to the
1.1.1.10.10.1  pgoyette <kbd>keys</kbd>
1.1.1.10.10.1  pgoyette directory, usually
      1.1.1.7  christos <span class="file">/usr/local/etc</span>,
1.1.1.10.10.1  pgoyette then run the program.
1.1.1.10.10.1  pgoyette
1.1.1.10.10.1  pgoyette   <p>To test and gain experience with Autokey concepts, log in as root and
1.1.1.10.10.1  pgoyette change to the
1.1.1.10.10.1  pgoyette <kbd>keys</kbd>
1.1.1.10.10.1  pgoyette directory, usually
1.1.1.10.10.1  pgoyette <span class="file">/usr/local/etc</span>.
1.1.1.10.10.1  pgoyette When run for the first time, or if all files with names beginning with
1.1.1.10.10.1  pgoyette <span class="file">ntpkey*</span>
1.1.1.10.10.1  pgoyette have been removed, use the
1.1.1.10.10.1  pgoyette <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette command without arguments to generate a default
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette host key and matching
1.1.1.10.10.1  pgoyette <code>RSA-MD5</code>
1.1.1.10.10.1  pgoyette certificate file with expiration date one year hence,
          1.1  christos which is all that is necessary in many cases.
          1.1  christos The program also generates soft links from the generic names
          1.1  christos to the respective files.
1.1.1.10.10.1  pgoyette If run again without options, the program uses the
1.1.1.10.10.1  pgoyette existing keys and parameters and generates a new certificate file with
1.1.1.10.10.1  pgoyette new expiration date one year hence, and soft link.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>The host key is used to encrypt the cookie when required and so must be
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette type.
          1.1  christos By default, the host key is also the sign key used to encrypt signatures.
          1.1  christos When necessary, a different sign key can be specified and this can be
1.1.1.10.10.1  pgoyette either
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>DSA</code>
1.1.1.10.10.1  pgoyette type.
1.1.1.10.10.1  pgoyette By default, the message digest type is
1.1.1.10.10.1  pgoyette <code>MD5</code>,
1.1.1.10.10.1  pgoyette but any combination
          1.1  christos of sign key type and message digest type supported by the OpenSSL library
1.1.1.10.10.1  pgoyette can be specified, including those using the
1.1.1.10.10.1  pgoyette <code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>RIPE160</code>
1.1.1.10.10.1  pgoyette message digest algorithms.
          1.1  christos However, the scheme specified in the certificate must be compatible
          1.1  christos with the sign key.
1.1.1.10.10.1  pgoyette Certificates using any digest algorithm are compatible with
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette sign keys;
1.1.1.10.10.1  pgoyette however, only
1.1.1.10.10.1  pgoyette <code>SHA</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>SHA1</code>
1.1.1.10.10.1  pgoyette certificates are compatible with
1.1.1.10.10.1  pgoyette <code>DSA</code>
1.1.1.10.10.1  pgoyette sign keys.
          1.1  christos
          1.1  christos   <p>Private/public key files and certificates are compatible with
          1.1  christos other OpenSSL applications and very likely other libraries as well.
          1.1  christos Certificates or certificate requests derived from them should be compatible
          1.1  christos with extant industry practice, although some users might find
          1.1  christos the interpretation of X509v3 extension fields somewhat liberal.
          1.1  christos However, the identification parameter files, although encoded
          1.1  christos as the other files, are probably not compatible with anything other than Autokey.
          1.1  christos
          1.1  christos   <p>Running the program as other than root and using the Unix
1.1.1.10.10.1  pgoyette <code>su(1)</code>
          1.1  christos command
          1.1  christos to assume root may not work properly, since by default the OpenSSL library
          1.1  christos looks for the random seed file
1.1.1.10.10.1  pgoyette <span class="file">.rnd</span>
          1.1  christos in the user home directory.
          1.1  christos However, there should be only one
1.1.1.10.10.1  pgoyette <span class="file">.rnd</span>,
          1.1  christos most conveniently
          1.1  christos in the root directory, so it is convenient to define the
1.1.1.10.10.1  pgoyette .Ev RANDFILE
          1.1  christos environment variable used by the OpenSSL library as the path to
1.1.1.10.10.1  pgoyette <span class="file">.rnd</span>.
          1.1  christos
          1.1  christos   <p>Installing the keys as root might not work in NFS-mounted
          1.1  christos shared file systems, as NFS clients may not be able to write
          1.1  christos to the shared keys directory, even as root.
          1.1  christos In this case, NFS clients can specify the files in another
          1.1  christos directory such as
      1.1.1.7  christos <span class="file">/etc</span>
          1.1  christos using the
          1.1  christos <code>keysdir</code>
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette configuration file command.
          1.1  christos There is no need for one client to read the keys and certificates
          1.1  christos of other clients or servers, as these data are obtained automatically
          1.1  christos by the Autokey protocol.
          1.1  christos
          1.1  christos   <p>Ordinarily, cryptographic files are generated by the host that uses them,
          1.1  christos but it is possible for a trusted agent (TA) to generate these files
          1.1  christos for other hosts; however, in such cases files should always be encrypted.
          1.1  christos The subject name and trusted name default to the hostname
          1.1  christos of the host generating the files, but can be changed by command line options.
          1.1  christos It is convenient to designate the owner name and trusted name
          1.1  christos as the subject and issuer fields, respectively, of the certificate.
          1.1  christos The owner name is also used for the host and sign key files,
          1.1  christos while the trusted name is used for the identity files.
          1.1  christos
          1.1  christos   <p>All files are installed by default in the keys directory
      1.1.1.7  christos <span class="file">/usr/local/etc</span>,
          1.1  christos which is normally in a shared filesystem
          1.1  christos in NFS-mounted networks.
          1.1  christos The actual location of the keys directory
          1.1  christos and each file can be overridden by configuration commands,
          1.1  christos but this is not recommended.
          1.1  christos Normally, the files for each host are generated by that host
          1.1  christos and used only by that host, although exceptions exist
          1.1  christos as noted later on this page.
          1.1  christos
          1.1  christos   <p>Normally, files containing private values,
          1.1  christos including the host key, sign key and identification parameters,
          1.1  christos are permitted root read/write-only;
          1.1  christos while others containing public values are permitted world readable.
          1.1  christos Alternatively, files containing private values can be encrypted
          1.1  christos and these files permitted world readable,
          1.1  christos which simplifies maintenance in shared file systems.
1.1.1.10.10.1  pgoyette Since uniqueness is insured by the
1.1.1.10.10.1  pgoyette <kbd>hostname</kbd>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>
1.1.1.10.10.1  pgoyette file name extensions, the files for an NTP server and
          1.1  christos dependent clients can all be installed in the same shared directory.
          1.1  christos
          1.1  christos   <p>The recommended practice is to keep the file name extensions
          1.1  christos when installing a file and to install a soft link
          1.1  christos from the generic names specified elsewhere on this page
          1.1  christos to the generated files.
          1.1  christos This allows new file generations to be activated simply
          1.1  christos by changing the link.
1.1.1.10.10.1  pgoyette If a link is present,
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette follows it to the file name to extract the
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>.
          1.1  christos If a link is not present,
          1.1  christos <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette extracts the
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>
1.1.1.10.10.1  pgoyette from the file itself.
          1.1  christos This allows clients to verify that the file and generation times
          1.1  christos are always current.
          1.1  christos The
          1.1  christos <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette program uses the same
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>
1.1.1.10.10.1  pgoyette extension for all files generated
          1.1  christos at one time, so each generation is distinct and can be readily
          1.1  christos recognized in monitoring data.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Run the command on as many hosts as necessary.
1.1.1.10.10.1  pgoyette Designate one of them as the trusted host (TH) using
          1.1  christos <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette with the
1.1.1.10.10.1  pgoyette <code>-T</code>
1.1.1.10.10.1  pgoyette option and configure it to synchronize from reliable Internet servers.
1.1.1.10.10.1  pgoyette Then configure the other hosts to synchronize to the TH directly or
1.1.1.10.10.1  pgoyette indirectly.
1.1.1.10.10.1  pgoyette A certificate trail is created when Autokey asks the immediately
1.1.1.10.10.1  pgoyette ascendant host towards the TH to sign its certificate, which is then
1.1.1.10.10.1  pgoyette provided to the immediately descendant host on request.
1.1.1.10.10.1  pgoyette All group hosts should have acyclic certificate trails ending on the TH.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>The host key is used to encrypt the cookie when required and so must be
1.1.1.10.10.1  pgoyette RSA type.
1.1.1.10.10.1  pgoyette By default, the host key is also the sign key used to encrypt
1.1.1.10.10.1  pgoyette signatures.
1.1.1.10.10.1  pgoyette A different sign key can be assigned using the
1.1.1.10.10.1  pgoyette <code>-S</code>
1.1.1.10.10.1  pgoyette option and this can be either
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>DSA</code>
1.1.1.10.10.1  pgoyette type.
1.1.1.10.10.1  pgoyette By default, the signature
1.1.1.10.10.1  pgoyette message digest type is
1.1.1.10.10.1  pgoyette <code>MD5</code>,
1.1.1.10.10.1  pgoyette but any combination of sign key type and
1.1.1.10.10.1  pgoyette message digest type supported by the OpenSSL library can be specified
1.1.1.10.10.1  pgoyette using the
1.1.1.10.10.1  pgoyette <code>-c</code>
1.1.1.10.10.1  pgoyette option.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>The rules say cryptographic media should be generated with proventic
1.1.1.10.10.1  pgoyette filestamps, which means the host should already be synchronized before
1.1.1.10.10.1  pgoyette this program is run.
1.1.1.10.10.1  pgoyette This of course creates a chicken-and-egg problem
1.1.1.10.10.1  pgoyette when the host is started for the first time.
1.1.1.10.10.1  pgoyette Accordingly, the host time
1.1.1.10.10.1  pgoyette should be set by some other means, such as eyeball-and-wristwatch, at
1.1.1.10.10.1  pgoyette least so that the certificate lifetime is within the current year.
1.1.1.10.10.1  pgoyette After that and when the host is synchronized to a proventic source, the
1.1.1.10.10.1  pgoyette certificate should be re-generated.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Additional information on trusted groups and identity schemes is on the
1.1.1.10.10.1  pgoyette Autokey Public-Key Authentication
1.1.1.10.10.1  pgoyette page.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>File names begin with the prefix
1.1.1.10.10.1  pgoyette <span class="file">ntpkey</span>_
1.1.1.10.10.1  pgoyette and end with the suffix
1.1.1.10.10.1  pgoyette <span class="file">_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>,
1.1.1.10.10.1  pgoyette where
1.1.1.10.10.1  pgoyette <kbd>hostname</kbd>
1.1.1.10.10.1  pgoyette is the owner name, usually the string returned
1.1.1.10.10.1  pgoyette by the Unix
1.1.1.10.10.1  pgoyette <code>hostname(1)</code>
1.1.1.10.10.1  pgoyette command, and
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>
1.1.1.10.10.1  pgoyette is the NTP seconds when the file was generated, in decimal digits.
1.1.1.10.10.1  pgoyette This both guarantees uniqueness and simplifies maintenance
1.1.1.10.10.1  pgoyette procedures, since all files can be quickly removed
1.1.1.10.10.1  pgoyette by a
1.1.1.10.10.1  pgoyette <code>rm</code> <span class="file">ntpkey*</span>
1.1.1.10.10.1  pgoyette command or all files generated
1.1.1.10.10.1  pgoyette at a specific time can be removed by a
1.1.1.10.10.1  pgoyette <code>rm</code> <span class="file">*</span><kbd>filestamp</kbd>
          1.1  christos command.
1.1.1.10.10.1  pgoyette To further reduce the risk of misconfiguration,
1.1.1.10.10.1  pgoyette the first two lines of a file contain the file name
1.1.1.10.10.1  pgoyette and generation date and time as comments.
          1.1  christos
1.1.1.10.10.1  pgoyette <h5 class="subsubsection">Trusted Hosts and Groups</h5>
          1.1  christos
1.1.1.10.10.1  pgoyette <p>Each cryptographic configuration involves selection of a signature scheme
          1.1  christos and identification scheme, called a cryptotype,
          1.1  christos as explained in the
          1.1  christos <a href="#Authentication-Options">Authentication Options</a>
          1.1  christos section of
          1.1  christos <code>ntp.conf(5)</code>.
1.1.1.10.10.1  pgoyette The default cryptotype uses
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette encryption,
1.1.1.10.10.1  pgoyette <code>MD5</code>
1.1.1.10.10.1  pgoyette message digest
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>TC</code>
1.1.1.10.10.1  pgoyette identification.
          1.1  christos First, configure a NTP subnet including one or more low-stratum
          1.1  christos trusted hosts from which all other hosts derive synchronization
          1.1  christos directly or indirectly.
          1.1  christos Trusted hosts have trusted certificates;
          1.1  christos all other hosts have nontrusted certificates.
          1.1  christos These hosts will automatically and dynamically build authoritative
          1.1  christos certificate trails to one or more trusted hosts.
          1.1  christos A trusted group is the set of all hosts that have, directly or indirectly,
          1.1  christos a certificate trail ending at a trusted host.
          1.1  christos The trail is defined by static configuration file entries
          1.1  christos or dynamic means described on the
          1.1  christos <a href="#Automatic-NTP-Configuration-Options">Automatic NTP Configuration Options</a>
          1.1  christos section of
          1.1  christos <code>ntp.conf(5)</code>.
          1.1  christos
          1.1  christos   <p>On each trusted host as root, change to the keys directory.
          1.1  christos To insure a fresh fileset, remove all
1.1.1.10.10.1  pgoyette <span class="file">ntpkey</span>
          1.1  christos files.
          1.1  christos Then run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-T</code>
          1.1  christos to generate keys and a trusted certificate.
          1.1  christos On all other hosts do the same, but leave off the
          1.1  christos <code>-T</code>
          1.1  christos flag to generate keys and nontrusted certificates.
          1.1  christos When complete, start the NTP daemons beginning at the lowest stratum
          1.1  christos and working up the tree.
          1.1  christos It may take some time for Autokey to instantiate the certificate trails
          1.1  christos throughout the subnet, but setting up the environment is completely automatic.
          1.1  christos
          1.1  christos   <p>If it is necessary to use a different sign key or different digest/signature
          1.1  christos scheme than the default, run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos with the
          1.1  christos <code>-S</code> <kbd>type</kbd>
          1.1  christos option, where
          1.1  christos <kbd>type</kbd>
          1.1  christos is either
          1.1  christos <code>RSA</code>
          1.1  christos or
          1.1  christos <code>DSA</code>.
1.1.1.10.10.1  pgoyette The most frequent need to do this is when a
1.1.1.10.10.1  pgoyette <code>DSA</code>-signed
1.1.1.10.10.1  pgoyette certificate is used.
          1.1  christos If it is necessary to use a different certificate scheme than the default,
          1.1  christos run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos with the
          1.1  christos <code>-c</code> <kbd>scheme</kbd>
          1.1  christos option and selected
          1.1  christos <kbd>scheme</kbd>
          1.1  christos as needed.
1.1.1.10.10.1  pgoyette If
          1.1  christos <code>ntp-keygen</code>
          1.1  christos is run again without these options, it generates a new certificate
1.1.1.10.10.1  pgoyette using the same scheme and sign key, and soft link.
          1.1  christos
          1.1  christos   <p>After setting up the environment it is advisable to update certificates
          1.1  christos from time to time, if only to extend the validity interval.
          1.1  christos Simply run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos with the same flags as before to generate new certificates
1.1.1.10.10.1  pgoyette using existing keys, and soft links.
          1.1  christos However, if the host or sign key is changed,
          1.1  christos <code>ntpd(1ntpdmdoc)</code>
          1.1  christos should be restarted.
          1.1  christos When
          1.1  christos <code>ntpd(1ntpdmdoc)</code>
          1.1  christos is restarted, it loads any new files and restarts the protocol.
          1.1  christos Other dependent hosts will continue as usual until signatures are refreshed,
          1.1  christos at which time the protocol is restarted.
          1.1  christos
          1.1  christos <h5 class="subsubsection">Identity Schemes</h5>
          1.1  christos
          1.1  christos <p>As mentioned on the Autonomous Authentication page,
1.1.1.10.10.1  pgoyette the default
1.1.1.10.10.1  pgoyette <code>TC</code>
1.1.1.10.10.1  pgoyette identity scheme is vulnerable to a middleman attack.
          1.1  christos However, there are more secure identity schemes available,
1.1.1.10.10.1  pgoyette including
1.1.1.10.10.1  pgoyette <code>PC</code>, <code>IFF</code>, <code>GQ</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>MV</code>
1.1.1.10.10.1  pgoyette schemes described below.
          1.1  christos These schemes are based on a TA, one or more trusted hosts
          1.1  christos and some number of nontrusted hosts.
          1.1  christos Trusted hosts prove identity using values provided by the TA,
          1.1  christos while the remaining hosts prove identity using values provided
          1.1  christos by a trusted host and certificate trails that end on that host.
          1.1  christos The name of a trusted host is also the name of its sugroup
          1.1  christos and also the subject and issuer name on its trusted certificate.
          1.1  christos The TA is not necessarily a trusted host in this sense, but often is.
          1.1  christos
          1.1  christos   <p>In some schemes there are separate keys for servers and clients.
          1.1  christos A server can also be a client of another server,
          1.1  christos but a client can never be a server for another client.
          1.1  christos In general, trusted hosts and nontrusted hosts that operate
          1.1  christos as both server and client have parameter files that contain
          1.1  christos both server and client keys.
          1.1  christos Hosts that operate
          1.1  christos only as clients have key files that contain only client keys.
          1.1  christos
          1.1  christos   <p>The PC scheme supports only one trusted host in the group.
          1.1  christos On trusted host alice run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-P</code>
          1.1  christos <code>-p</code> <kbd>password</kbd>
          1.1  christos to generate the host key file
1.1.1.10.10.1  pgoyette <span class="file">ntpkey</span>_ <code>RSA</code> <span class="file">key_alice.</span> <kbd>filestamp</kbd>
          1.1  christos and trusted private certificate file
1.1.1.10.10.1  pgoyette <span class="file">ntpkey</span>_ <code>RSA-MD5</code> <code>_</code> <span class="file">cert_alice.</span> <kbd>filestamp</kbd>,
1.1.1.10.10.1  pgoyette and soft links.
          1.1  christos Copy both files to all group hosts;
          1.1  christos they replace the files which would be generated in other schemes.
1.1.1.10.10.1  pgoyette On each host
1.1.1.10.10.1  pgoyette <kbd>bob</kbd>
1.1.1.10.10.1  pgoyette install a soft link from the generic name
      1.1.1.7  christos <span class="file">ntpkey_host_</span><kbd>bob</kbd>
          1.1  christos to the host key file and soft link
      1.1.1.7  christos <span class="file">ntpkey_cert_</span><kbd>bob</kbd>
          1.1  christos to the private certificate file.
          1.1  christos Note the generic links are on bob, but point to files generated
          1.1  christos by trusted host alice.
          1.1  christos In this scheme it is not possible to refresh
          1.1  christos either the keys or certificates without copying them
1.1.1.10.10.1  pgoyette to all other hosts in the group, and recreating the soft links.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>For the
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette scheme proceed as in the
1.1.1.10.10.1  pgoyette <code>TC</code>
1.1.1.10.10.1  pgoyette scheme to generate keys
          1.1  christos and certificates for all group hosts, then for every trusted host in the group,
1.1.1.10.10.1  pgoyette generate the
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette parameter file.
          1.1  christos On trusted host alice run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-T</code>
          1.1  christos <code>-I</code>
          1.1  christos <code>-p</code> <kbd>password</kbd>
          1.1  christos to produce her parameter file
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_IFFpar_alice.</span><kbd>filestamp</kbd>,
          1.1  christos which includes both server and client keys.
          1.1  christos Copy this file to all group hosts that operate as both servers
          1.1  christos and clients and install a soft link from the generic
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_iff_alice</span>
          1.1  christos to this file.
          1.1  christos If there are no hosts restricted to operate only as clients,
          1.1  christos there is nothing further to do.
1.1.1.10.10.1  pgoyette As the
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette scheme is independent
          1.1  christos of keys and certificates, these files can be refreshed as needed.
          1.1  christos
          1.1  christos   <p>If a rogue client has the parameter file, it could masquerade
          1.1  christos as a legitimate server and present a middleman threat.
          1.1  christos To eliminate this threat, the client keys can be extracted
          1.1  christos from the parameter file and distributed to all restricted clients.
          1.1  christos After generating the parameter file, on alice run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-e</code>
1.1.1.10.10.1  pgoyette and pipe the output to a file or email program.
1.1.1.10.10.1  pgoyette Copy or email this file to all restricted clients.
          1.1  christos On these clients install a soft link from the generic
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_iff_alice</span>
          1.1  christos to this file.
          1.1  christos To further protect the integrity of the keys,
          1.1  christos each file can be encrypted with a secret password.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>For the
1.1.1.10.10.1  pgoyette <code>GQ</code>
1.1.1.10.10.1  pgoyette scheme proceed as in the
1.1.1.10.10.1  pgoyette <code>TC</code>
1.1.1.10.10.1  pgoyette scheme to generate keys
          1.1  christos and certificates for all group hosts, then for every trusted host
1.1.1.10.10.1  pgoyette in the group, generate the
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette parameter file.
          1.1  christos On trusted host alice run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-T</code>
          1.1  christos <code>-G</code>
          1.1  christos <code>-p</code> <kbd>password</kbd>
          1.1  christos to produce her parameter file
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_GQpar_alice.</span><kbd>filestamp</kbd>,
          1.1  christos which includes both server and client keys.
          1.1  christos Copy this file to all group hosts and install a soft link
          1.1  christos from the generic
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_gq_alice</span>
          1.1  christos to this file.
1.1.1.10.10.1  pgoyette In addition, on each host
1.1.1.10.10.1  pgoyette <kbd>bob</kbd>
1.1.1.10.10.1  pgoyette install a soft link
          1.1  christos from generic
      1.1.1.7  christos <span class="file">ntpkey_gq_</span><kbd>bob</kbd>
          1.1  christos to this file.
1.1.1.10.10.1  pgoyette As the
1.1.1.10.10.1  pgoyette <code>GQ</code>
1.1.1.10.10.1  pgoyette scheme updates the
1.1.1.10.10.1  pgoyette <code>GQ</code>
1.1.1.10.10.1  pgoyette parameters file and certificate
          1.1  christos at the same time, keys and certificates can be regenerated as needed.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>For the
1.1.1.10.10.1  pgoyette <code>MV</code>
1.1.1.10.10.1  pgoyette scheme, proceed as in the
1.1.1.10.10.1  pgoyette <code>TC</code>
1.1.1.10.10.1  pgoyette scheme to generate keys
          1.1  christos and certificates for all group hosts.
          1.1  christos For illustration assume trish is the TA, alice one of several trusted hosts
          1.1  christos and bob one of her clients.
          1.1  christos On TA trish run
          1.1  christos <code>ntp-keygen</code>
          1.1  christos <code>-V</code> <kbd>n</kbd>
          1.1  christos <code>-p</code> <kbd>password</kbd>,
          1.1  christos where
          1.1  christos <kbd>n</kbd>
          1.1  christos is the number of revokable keys (typically 5) to produce
          1.1  christos the parameter file
1.1.1.10.10.1  pgoyette <span class="file">ntpkeys_MVpar_trish.</span><kbd>filestamp</kbd>
          1.1  christos and client key files
1.1.1.10.10.1  pgoyette <span class="file">ntpkeys_MVkey</span><kbd>d</kbd> <kbd>_</kbd> <span class="file">trish.</span> <kbd>filestamp</kbd>
          1.1  christos where
          1.1  christos <kbd>d</kbd>
          1.1  christos is the key number (0 &lt;
          1.1  christos <kbd>d</kbd>
          1.1  christos &lt;
          1.1  christos <kbd>n</kbd>).
          1.1  christos Copy the parameter file to alice and install a soft link
          1.1  christos from the generic
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_mv_alice</span>
          1.1  christos to this file.
          1.1  christos Copy one of the client key files to alice for later distribution
          1.1  christos to her clients.
1.1.1.10.10.1  pgoyette It does not matter which client key file goes to alice,
          1.1  christos since they all work the same way.
1.1.1.10.10.1  pgoyette Alice copies the client key file to all of her clients.
          1.1  christos On client bob install a soft link from generic
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_mvkey_bob</span>
          1.1  christos to the client key file.
1.1.1.10.10.1  pgoyette As the
1.1.1.10.10.1  pgoyette <code>MV</code>
1.1.1.10.10.1  pgoyette scheme is independent of keys and certificates,
          1.1  christos these files can be refreshed as needed.
          1.1  christos
          1.1  christos <h5 class="subsubsection">Command Line Options</h5>
          1.1  christos
          1.1  christos      <dl>
1.1.1.10.10.1  pgoyette <dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd><dd>Set the number of bits in the identity modulus for generating identity keys to
1.1.1.10.10.1  pgoyette <kbd>modulus</kbd>
1.1.1.10.10.1  pgoyette bits.
1.1.1.10.10.1  pgoyette The number of bits in the identity modulus defaults to 256, but can be set to
1.1.1.10.10.1  pgoyette values from 256 to 2048 (32 to 256 octets).
1.1.1.10.10.1  pgoyette Use the larger moduli with caution, as this can consume considerable computing
1.1.1.10.10.1  pgoyette resources and increases the size of authenticated packets.
1.1.1.10.10.1  pgoyette <br><dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd><dd>Select certificate signature encryption/message digest scheme.
          1.1  christos The
          1.1  christos <kbd>scheme</kbd>
          1.1  christos can be one of the following:
1.1.1.10.10.1  pgoyette <code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>,
          1.1  christos or
          1.1  christos <code>DSA-SHA1</code>.
1.1.1.10.10.1  pgoyette Note that
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette schemes must be used with an
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette sign key and
1.1.1.10.10.1  pgoyette <code>DSA</code>
1.1.1.10.10.1  pgoyette schemes must be used with a
1.1.1.10.10.1  pgoyette <code>DSA</code>
1.1.1.10.10.1  pgoyette sign key.
          1.1  christos The default without this option is
          1.1  christos <code>RSA-MD5</code>.
1.1.1.10.10.1  pgoyette If compatibility with FIPS 140-2 is required, either the
1.1.1.10.10.1  pgoyette <code>DSA-SHA</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>DSA-SHA1</code>
1.1.1.10.10.1  pgoyette scheme must be used.
1.1.1.10.10.1  pgoyette <br><dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd><dd>Select the OpenSSL cipher to encrypt the files containing private keys.
1.1.1.10.10.1  pgoyette The default without this option is three-key triple DES in CBC mode,
1.1.1.10.10.1  pgoyette <code>des-ede3-cbc</code>.
1.1.1.10.10.1  pgoyette The
1.1.1.10.10.1  pgoyette <code>openssl</code> <code>-h</code>
1.1.1.10.10.1  pgoyette command provided with OpenSSL displays available ciphers.
1.1.1.10.10.1  pgoyette <br><dt><code>-d</code> <code>--debug-level</code><dd>Increase debugging verbosity level.
          1.1  christos This option displays the cryptographic data produced in eye-friendly billboards.
1.1.1.10.10.1  pgoyette <br><dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd><dd>Set the debugging verbosity to
1.1.1.10.10.1  pgoyette <kbd>level</kbd>.
1.1.1.10.10.1  pgoyette This option displays the cryptographic data produced in eye-friendly billboards.
1.1.1.10.10.1  pgoyette <br><dt><code>-e</code> <code>--id-key</code><dd>Write the
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>GQ</code>
1.1.1.10.10.1  pgoyette public parameters from the
1.1.1.10.10.1  pgoyette <kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd>
1.1.1.10.10.1  pgoyette client keys file previously specified
1.1.1.10.10.1  pgoyette as unencrypted data to the standard output stream
1.1.1.10.10.1  pgoyette <span class="file">stdout</span>.
1.1.1.10.10.1  pgoyette This is intended for automatic key distribution by email.
1.1.1.10.10.1  pgoyette <br><dt><code>-G</code> <code>--gq-params</code><dd>Generate a new encrypted
1.1.1.10.10.1  pgoyette <code>GQ</code>
1.1.1.10.10.1  pgoyette parameters and key file for the Guillou-Quisquater (GQ) identity scheme.
1.1.1.10.10.1  pgoyette This option is mutually exclusive with the
1.1.1.10.10.1  pgoyette <code>-I</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>-V</code>
1.1.1.10.10.1  pgoyette options.
1.1.1.10.10.1  pgoyette <br><dt><code>-H</code> <code>--host-key</code><dd>Generate a new encrypted
1.1.1.10.10.1  pgoyette <code>RSA</code>
1.1.1.10.10.1  pgoyette public/private host key file.
1.1.1.10.10.1  pgoyette <br><dt><code>-I</code> <code>--iffkey</code><dd>Generate a new encrypted
1.1.1.10.10.1  pgoyette <code>IFF</code>
1.1.1.10.10.1  pgoyette key file for the Schnorr (IFF) identity scheme.
1.1.1.10.10.1  pgoyette This option is mutually exclusive with the
1.1.1.10.10.1  pgoyette <code>-G</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette Fl V
1.1.1.10.10.1  pgoyette options.
1.1.1.10.10.1  pgoyette <br><dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd><dd>Set the optional Autokey group name to
1.1.1.10.10.1  pgoyette <kbd>group</kbd>.
1.1.1.10.10.1  pgoyette This is used in the identity scheme parameter file names of
1.1.1.10.10.1  pgoyette <code>IFF</code>, <code>GQ</code>,
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>MV</code>
1.1.1.10.10.1  pgoyette client parameters files.
1.1.1.10.10.1  pgoyette In that role, the default is the host name if no group is provided.
1.1.1.10.10.1  pgoyette The group name, if specified using
1.1.1.10.10.1  pgoyette <code>-i</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>-s</code>
1.1.1.10.10.1  pgoyette following an
1.1.1.10.10.1  pgoyette @
1.1.1.10.10.1  pgoyette character, is also used in certificate subject and issuer names in the form
1.1.1.10.10.1  pgoyette <kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd>
1.1.1.10.10.1  pgoyette and should match the group specified via
1.1.1.10.10.1  pgoyette <code>crypto</code> <code>ident</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>server</code> <code>ident</code>
1.1.1.10.10.1  pgoyette in the ntpd configuration file.
1.1.1.10.10.1  pgoyette <br><dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd><dd>Set the lifetime for certificate expiration to
1.1.1.10.10.1  pgoyette <kbd>days</kbd>.
1.1.1.10.10.1  pgoyette The default lifetime is one year (365 days).
1.1.1.10.10.1  pgoyette <br><dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd><dd>Set the number of bits in the prime modulus for generating files to
1.1.1.10.10.1  pgoyette <kbd>bits</kbd>.
1.1.1.10.10.1  pgoyette The modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets).
1.1.1.10.10.1  pgoyette Use the larger moduli with caution, as this can consume considerable computing
1.1.1.10.10.1  pgoyette resources and increases the size of authenticated packets.
1.1.1.10.10.1  pgoyette <br><dt><code>-M</code> <code>--md5key</code><dd>Generate a new symmetric keys file containing 10
1.1.1.10.10.1  pgoyette <code>MD5</code>
1.1.1.10.10.1  pgoyette keys, and if OpenSSL is available, 10
1.1.1.10.10.1  pgoyette <code>SHA</code>
1.1.1.10.10.1  pgoyette keys.
1.1.1.10.10.1  pgoyette An
1.1.1.10.10.1  pgoyette <code>MD5</code>
1.1.1.10.10.1  pgoyette key is a string of 20 random printable ASCII characters, while a
1.1.1.10.10.1  pgoyette <code>SHA</code>
1.1.1.10.10.1  pgoyette key is a string of 40 random hex digits.
1.1.1.10.10.1  pgoyette The file can be edited using a text editor to change the key type or key content.
1.1.1.10.10.1  pgoyette This option is mutually exclusive with all other options.
1.1.1.10.10.1  pgoyette <br><dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd><dd>Set the password for reading and writing encrypted files to
1.1.1.10.10.1  pgoyette <kbd>passwd</kbd>.
1.1.1.10.10.1  pgoyette These include the host, sign and identify key files.
1.1.1.10.10.1  pgoyette By default, the password is the string returned by the Unix
1.1.1.10.10.1  pgoyette <code>hostname</code>
1.1.1.10.10.1  pgoyette command.
1.1.1.10.10.1  pgoyette <br><dt><code>-P</code> <code>--pvt-cert</code><dd>Generate a new private certificate used by the
1.1.1.10.10.1  pgoyette <code>PC</code>
1.1.1.10.10.1  pgoyette identity scheme.
          1.1  christos By default, the program generates public certificates.
1.1.1.10.10.1  pgoyette Note: the PC identity scheme is not recommended for new installations.
1.1.1.10.10.1  pgoyette <br><dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd><dd>Set the password for writing encrypted
1.1.1.10.10.1  pgoyette <code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code>
1.1.1.10.10.1  pgoyette identity files redirected to
1.1.1.10.10.1  pgoyette <span class="file">stdout</span>
1.1.1.10.10.1  pgoyette to
1.1.1.10.10.1  pgoyette <kbd>passwd</kbd>.
1.1.1.10.10.1  pgoyette In effect, these files are decrypted with the
1.1.1.10.10.1  pgoyette <code>-p</code>
1.1.1.10.10.1  pgoyette password, then encrypted with the
1.1.1.10.10.1  pgoyette <code>-q</code>
1.1.1.10.10.1  pgoyette password.
1.1.1.10.10.1  pgoyette By default, the password is the string returned by the Unix
1.1.1.10.10.1  pgoyette <code>hostname</code>
1.1.1.10.10.1  pgoyette command.
1.1.1.10.10.1  pgoyette <br><dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ </code><kbd>group</kbd><code>]</code><dd>Specify the Autokey host name, where
1.1.1.10.10.1  pgoyette <kbd>host</kbd>
1.1.1.10.10.1  pgoyette is the optional host name and
1.1.1.10.10.1  pgoyette <kbd>group</kbd>
1.1.1.10.10.1  pgoyette is the optional group name.
1.1.1.10.10.1  pgoyette The host name, and if provided, group name are used in
1.1.1.10.10.1  pgoyette <kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd>
1.1.1.10.10.1  pgoyette form as certificate subject and issuer.
1.1.1.10.10.1  pgoyette Specifying
1.1.1.10.10.1  pgoyette <code>-s</code> <code>-@</code> <kbd>group</kbd>
1.1.1.10.10.1  pgoyette is allowed, and results in leaving the host name unchanged, as with
1.1.1.10.10.1  pgoyette <code>-i</code> <kbd>group</kbd>.
1.1.1.10.10.1  pgoyette The group name, or if no group is provided, the host name are also used in the
1.1.1.10.10.1  pgoyette file names of
1.1.1.10.10.1  pgoyette <code>IFF</code>, <code>GQ</code>,
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>MV</code>
1.1.1.10.10.1  pgoyette identity scheme client parameter files.
1.1.1.10.10.1  pgoyette If
1.1.1.10.10.1  pgoyette <kbd>host</kbd>
1.1.1.10.10.1  pgoyette is not specified, the default host name is the string returned by the Unix
1.1.1.10.10.1  pgoyette <code>hostname</code>
1.1.1.10.10.1  pgoyette command.
1.1.1.10.10.1  pgoyette <br><dt><code>-S</code> <code>--sign-key</code>= <code>[RSA | DSA]</code><dd>Generate a new encrypted public/private sign key file of the specified type.
1.1.1.10.10.1  pgoyette By default, the sign key is the host key and has the same type.
1.1.1.10.10.1  pgoyette If compatibility with FIPS 140-2 is required, the sign key type must be
1.1.1.10.10.1  pgoyette <code>DSA</code>.
1.1.1.10.10.1  pgoyette <br><dt><code>-T</code> <code>--trusted-cert</code><dd>Generate a trusted certificate.
          1.1  christos By default, the program generates a non-trusted certificate.
1.1.1.10.10.1  pgoyette <br><dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd><dd>Generate
1.1.1.10.10.1  pgoyette <kbd>nkeys</kbd>
1.1.1.10.10.1  pgoyette encrypted server keys and parameters for the Mu-Varadharajan (MV)
1.1.1.10.10.1  pgoyette identity scheme.
1.1.1.10.10.1  pgoyette This option is mutually exclusive with the
1.1.1.10.10.1  pgoyette <code>-I</code>
1.1.1.10.10.1  pgoyette and
1.1.1.10.10.1  pgoyette <code>-G</code>
1.1.1.10.10.1  pgoyette options.
1.1.1.10.10.1  pgoyette Note: support for this option should be considered a work in progress.
          1.1  christos </dl>
          1.1  christos
          1.1  christos <h5 class="subsubsection">Random Seed File</h5>
          1.1  christos
          1.1  christos <p>All cryptographically sound key generation schemes must have means
          1.1  christos to randomize the entropy seed used to initialize
          1.1  christos the internal pseudo-random number generator used
          1.1  christos by the library routines.
          1.1  christos The OpenSSL library uses a designated random seed file for this purpose.
          1.1  christos The file must be available when starting the NTP daemon and
          1.1  christos <code>ntp-keygen</code>
          1.1  christos program.
          1.1  christos If a site supports OpenSSL or its companion OpenSSH,
          1.1  christos it is very likely that means to do this are already available.
          1.1  christos
          1.1  christos   <p>It is important to understand that entropy must be evolved
          1.1  christos for each generation, for otherwise the random number sequence
          1.1  christos would be predictable.
          1.1  christos Various means dependent on external events, such as keystroke intervals,
          1.1  christos can be used to do this and some systems have built-in entropy sources.
          1.1  christos Suitable means are described in the OpenSSL software documentation,
          1.1  christos but are outside the scope of this page.
          1.1  christos
          1.1  christos   <p>The entropy seed used by the OpenSSL library is contained in a file,
          1.1  christos usually called
1.1.1.10.10.1  pgoyette <span class="file">.rnd</span>,
          1.1  christos which must be available when starting the NTP daemon
          1.1  christos or the
          1.1  christos <code>ntp-keygen</code>
          1.1  christos program.
          1.1  christos The NTP daemon will first look for the file
          1.1  christos using the path specified by the
          1.1  christos <code>randfile</code>
          1.1  christos subcommand of the
          1.1  christos <code>crypto</code>
          1.1  christos configuration command.
          1.1  christos If not specified in this way, or when starting the
          1.1  christos <code>ntp-keygen</code>
          1.1  christos program,
          1.1  christos the OpenSSL library will look for the file using the path specified
          1.1  christos by the
          1.1  christos .Ev RANDFILE
          1.1  christos environment variable in the user home directory,
          1.1  christos whether root or some other user.
          1.1  christos If the
          1.1  christos .Ev RANDFILE
          1.1  christos environment variable is not present,
          1.1  christos the library will look for the
1.1.1.10.10.1  pgoyette <span class="file">.rnd</span>
          1.1  christos file in the user home directory.
1.1.1.10.10.1  pgoyette Since both the
1.1.1.10.10.1  pgoyette <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette program and
1.1.1.10.10.1  pgoyette <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette daemon must run as root, the logical place to put this file is in
1.1.1.10.10.1  pgoyette <span class="file">/.rnd</span>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <span class="file">/root/.rnd</span>.
          1.1  christos If the file is not available or cannot be written,
          1.1  christos the daemon exits with a message to the system log and the program
          1.1  christos exits with a suitable error message.
          1.1  christos
          1.1  christos <h5 class="subsubsection">Cryptographic Data Files</h5>
          1.1  christos
1.1.1.10.10.1  pgoyette <p>All file formats begin with two nonencrypted lines.
1.1.1.10.10.1  pgoyette The first line contains the file name, including the generated host name
1.1.1.10.10.1  pgoyette and filestamp, in the format
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_</span><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>,
1.1.1.10.10.1  pgoyette where
1.1.1.10.10.1  pgoyette <kbd>key</kbd>
1.1.1.10.10.1  pgoyette is the key or parameter type,
1.1.1.10.10.1  pgoyette <kbd>name</kbd>
1.1.1.10.10.1  pgoyette is the host or group name and
1.1.1.10.10.1  pgoyette <kbd>filestamp</kbd>
1.1.1.10.10.1  pgoyette is the filestamp (NTP seconds) when the file was created.
1.1.1.10.10.1  pgoyette By convention,
1.1.1.10.10.1  pgoyette <kbd>key</kbd>
1.1.1.10.10.1  pgoyette names in generated file names include both upper and lower case
1.1.1.10.10.1  pgoyette characters, while
1.1.1.10.10.1  pgoyette <kbd>key</kbd>
1.1.1.10.10.1  pgoyette names in generated link names include only lower case characters.
1.1.1.10.10.1  pgoyette The filestamp is not used in generated link names.
1.1.1.10.10.1  pgoyette The second line contains the datestamp in conventional Unix
1.1.1.10.10.1  pgoyette <span class="file">date</span>
1.1.1.10.10.1  pgoyette format.
1.1.1.10.10.1  pgoyette Lines beginning with
1.1.1.10.10.1  pgoyette #
1.1.1.10.10.1  pgoyette are considered comments and ignored by the
          1.1  christos <code>ntp-keygen</code>
          1.1  christos program and
          1.1  christos <code>ntpd(1ntpdmdoc)</code>
1.1.1.10.10.1  pgoyette daemon.
1.1.1.10.10.1  pgoyette
1.1.1.10.10.1  pgoyette   <p>The remainder of the file contains cryptographic data, encoded first using ASN.1
1.1.1.10.10.1  pgoyette rules, then encrypted if necessary, and finally written in PEM-encoded
1.1.1.10.10.1  pgoyette printable ASCII text, preceded and followed by MIME content identifier lines.
1.1.1.10.10.1  pgoyette
1.1.1.10.10.1  pgoyette   <p>The format of the symmetric keys file, ordinarily named
1.1.1.10.10.1  pgoyette <span class="file">ntp.keys</span>,
1.1.1.10.10.1  pgoyette is somewhat different than the other files in the interest of backward compatibility.
1.1.1.10.10.1  pgoyette Ordinarily, the file is generated by this program, but it can be constructed
1.1.1.10.10.1  pgoyette and edited using an ordinary text editor.
1.1.1.10.10.1  pgoyette <pre class="verbatim">
1.1.1.10.10.1  pgoyette # ntpkey_MD5key_bk.ntp.org.3595864945
1.1.1.10.10.1  pgoyette # Thu Dec 12 19:22:25 2013
1.1.1.10.10.1  pgoyette
1.1.1.10.10.1  pgoyette 1  MD5 L";Nw&lt;\`.I&lt;f4U0)247"i  # MD5 key
1.1.1.10.10.1  pgoyette 2  MD5 &amp;>l0%XXK9O'51VwV&lt;xq~  # MD5 key
1.1.1.10.10.1  pgoyette 3  MD5 lb4zLW~d^!K:]RsD'qb6  # MD5 key
1.1.1.10.10.1  pgoyette 4  MD5 Yue:tL[+vR)M\`n~bY,'?  # MD5 key
1.1.1.10.10.1  pgoyette 5  MD5 B;fx'Kgr/&amp;4ZTbL6=RxA  # MD5 key
1.1.1.10.10.1  pgoyette 6  MD5 4eYwa\`o@}3i@@@@V@@..R9!l  # MD5 key
1.1.1.10.10.1  pgoyette 7  MD5 \`A.([h+;wTQ|xfi%Sn_!  # MD5 key
1.1.1.10.10.1  pgoyette 8  MD5 45:V,r4]l6y^JH6"Sh?F  # MD5 key
1.1.1.10.10.1  pgoyette 9  MD5 3-5vcn*6l29DS?Xdsg)*  # MD5 key
1.1.1.10.10.1  pgoyette 10 MD5 2late4Me              # MD5 key
1.1.1.10.10.1  pgoyette 11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c  # SHA1 key
1.1.1.10.10.1  pgoyette 12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74  # SHA1 key
1.1.1.10.10.1  pgoyette 13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9  # SHA1 key
1.1.1.10.10.1  pgoyette 14 SHA  a5332809c8878dd3a5b918819108a111509aeceb  # SHA  key
1.1.1.10.10.1  pgoyette 15 MD2  2fe16c88c760ff2f16d4267e36c1aa6c926e6964  # MD2  key
1.1.1.10.10.1  pgoyette 16 MD4  b2691811dc19cfc0e2f9bcacd74213f29812183d  # MD4  key
1.1.1.10.10.1  pgoyette 17 MD5  e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c  # MD5  key
1.1.1.10.10.1  pgoyette 18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc  # MDC2 key
1.1.1.10.10.1  pgoyette 19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2  # RIPEMD160 key
1.1.1.10.10.1  pgoyette 20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878  # AES128CMAC key
1.1.1.10.10.1  pgoyette </pre>
1.1.1.10.10.1  pgoyette <pre class="example">     Figure 1. Typical Symmetric Key File
1.1.1.10.10.1  pgoyette </pre>
1.1.1.10.10.1  pgoyette   <p>Figure 1 shows a typical symmetric keys file used by the reference
1.1.1.10.10.1  pgoyette implementation.
1.1.1.10.10.1  pgoyette Following the header the keys are entered one per line in the format
          1.1  christos <pre class="example">     <kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd>
          1.1  christos </pre>
          1.1  christos   <p>where
          1.1  christos <kbd>keyno</kbd>
1.1.1.10.10.2  pgoyette is a positive integer in the range 1-65535;
          1.1  christos <kbd>type</kbd>
1.1.1.10.10.1  pgoyette is the key type for the message digest algorithm, which in the absence of the
1.1.1.10.10.1  pgoyette OpenSSL library must be
1.1.1.10.10.1  pgoyette <code>MD5</code>
1.1.1.10.10.1  pgoyette to designate the MD5 message digest algorithm;
1.1.1.10.10.1  pgoyette if the OpenSSL library is installed, the key type can be any
1.1.1.10.10.1  pgoyette message digest algorithm supported by that library;
1.1.1.10.10.1  pgoyette however, if compatibility with FIPS 140-2 is required,
1.1.1.10.10.1  pgoyette the key type must be either
1.1.1.10.10.1  pgoyette <code>SHA</code>
1.1.1.10.10.1  pgoyette or
1.1.1.10.10.1  pgoyette <code>SHA1</code>;
          1.1  christos <kbd>key</kbd>
          1.1  christos is the key itself,
1.1.1.10.10.1  pgoyette which is a printable ASCII string 20 characters or less in length:
1.1.1.10.10.1  pgoyette each character is chosen from the 93 printable characters
1.1.1.10.10.1  pgoyette in the range 0x21 through 0x7e (
1.1.1.10.10.1  pgoyette !
1.1.1.10.10.1  pgoyette through
1.1.1.10.10.1  pgoyette ~
1.1.1.10.10.1  pgoyette ) excluding space and the
1.1.1.10.10.1  pgoyette #
1.1.1.10.10.1  pgoyette character, and terminated by whitespace or a
          1.1  christos #
1.1.1.10.10.1  pgoyette character.
1.1.1.10.10.1  pgoyette An OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which
1.1.1.10.10.1  pgoyette is truncated as necessary.
          1.1  christos
          1.1  christos   <p>Note that the keys used by the
          1.1  christos <code>ntpq(1ntpqmdoc)</code>
          1.1  christos and
          1.1  christos <code>ntpdc(1ntpdcmdoc)</code>
          1.1  christos programs
          1.1  christos are checked against passwords requested by the programs
          1.1  christos and entered by hand, so it is generally appropriate to specify these keys
          1.1  christos in human readable ASCII format.
          1.1  christos
          1.1  christos   <p>The
          1.1  christos <code>ntp-keygen</code>
1.1.1.10.10.1  pgoyette program generates a symmetric keys file
1.1.1.10.10.1  pgoyette <span class="file">ntpkey_MD5key_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>.
          1.1  christos Since the file contains private shared keys,
          1.1  christos it should be visible only to root and distributed by secure means
          1.1  christos to other subnet hosts.
          1.1  christos The NTP daemon loads the file
      1.1.1.7  christos <span class="file">ntp.keys</span>,
          1.1  christos so
          1.1  christos <code>ntp-keygen</code>
          1.1  christos installs a soft link from this name to the generated file.
          1.1  christos Subsequently, similar soft links must be installed by manual
          1.1  christos or automated means on the other subnet hosts.
          1.1  christos While this file is not used with the Autokey Version 2 protocol,
          1.1  christos it is needed to authenticate some remote configuration commands
          1.1  christos used by the
          1.1  christos <code>ntpq(1ntpqmdoc)</code>
          1.1  christos and
          1.1  christos <code>ntpdc(1ntpdcmdoc)</code>
          1.1  christos utilities.
          1.1  christos
          1.1  christos   <p>This section was generated by <strong>AutoGen</strong>,
          1.1  christos using the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program.
          1.1  christos This software is released under the NTP license, &lt;http://ntp.org/license>;.
          1.1  christos
          1.1  christos <ul class="menu">
      1.1.1.7  christos <li><a accesskey="1" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>:                   ntp-keygen help/usage (<span class="option">--help</span>)
          1.1  christos <li><a accesskey="2" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>:                  imbits option (-b)
          1.1  christos <li><a accesskey="3" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>:             certificate option (-c)
          1.1  christos <li><a accesskey="4" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>:                  cipher option (-C)
          1.1  christos <li><a accesskey="5" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>:                  id-key option (-e)
          1.1  christos <li><a accesskey="6" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>:               gq-params option (-G)
          1.1  christos <li><a accesskey="7" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>:                host-key option (-H)
          1.1  christos <li><a accesskey="8" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>:                  iffkey option (-I)
          1.1  christos <li><a accesskey="9" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>:                   ident option (-i)
          1.1  christos <li><a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>:                lifetime option (-l)
          1.1  christos <li><a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>:                 modulus option (-m)
1.1.1.10.10.1  pgoyette <li><a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>:                  md5key option (-M)
          1.1  christos <li><a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>:                pvt-cert option (-P)
      1.1.1.2  christos <li><a href="#ntp_002dkeygen-password">ntp-keygen password</a>:                password option (-p)
      1.1.1.2  christos <li><a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>:           export-passwd option (-q)
          1.1  christos <li><a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>:            subject-name option (-s)
1.1.1.10.10.1  pgoyette <li><a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>:                sign-key option (-S)
          1.1  christos <li><a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>:            trusted-cert option (-T)
          1.1  christos <li><a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>:               mv-params option (-V)
          1.1  christos <li><a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>:                 mv-keys option (-v)
          1.1  christos <li><a href="#ntp_002dkeygen-config">ntp-keygen config</a>:                  presetting/configuring ntp-keygen
          1.1  christos <li><a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>:             exit status
          1.1  christos <li><a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>:                   Usage
          1.1  christos <li><a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>:                   Notes
          1.1  christos <li><a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>:                    Bugs
          1.1  christos </ul>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-usage"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
      1.1.1.7  christos <h4 class="subsection">ntp-keygen help/usage (<span class="option">--help</span>)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen-help-3"></a>
          1.1  christos This is the automatically generated usage text for ntp-keygen.
          1.1  christos
          1.1  christos   <p>The text printed is the same whether selected with the <code>help</code> option
      1.1.1.7  christos (<span class="option">--help</span>) or the <code>more-help</code> option (<span class="option">--more-help</span>).  <code>more-help</code> will print
          1.1  christos the usage text by passing it through a pager program.
          1.1  christos <code>more-help</code> is disabled on platforms without a working
          1.1  christos <code>fork(2)</code> function.  The <code>PAGER</code> environment variable is
      1.1.1.7  christos used to select the program, defaulting to <span class="file">more</span>.  Both will exit
          1.1  christos with a status code of 0.
          1.1  christos
1.1.1.10.10.2  pgoyette <pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p11
          1.1  christos Usage:  ntp-keygen [ -&lt;flag&gt; [&lt;val&gt;] | --&lt;name&gt;[{=| }&lt;val&gt;] ]...
          1.1  christos   Flg Arg Option-Name    Description
          1.1  christos    -b Num imbits         identity modulus bits
          1.1  christos                                 - it must be in the range:
          1.1  christos                                   256 to 2048
          1.1  christos    -c Str certificate    certificate scheme
          1.1  christos    -C Str cipher         privatekey cipher
          1.1  christos    -d no  debug-level    Increase debug verbosity level
          1.1  christos                                 - may appear multiple times
          1.1  christos    -D Num set-debug-level Set the debug verbosity level
          1.1  christos                                 - may appear multiple times
          1.1  christos    -e no  id-key         Write IFF or GQ identity keys
          1.1  christos    -G no  gq-params      Generate GQ parameters and keys
          1.1  christos    -H no  host-key       generate RSA host key
          1.1  christos    -I no  iffkey         generate IFF parameters
          1.1  christos    -i Str ident          set Autokey group name
          1.1  christos    -l Num lifetime       set certificate lifetime
1.1.1.10.10.1  pgoyette    -m Num modulus        prime modulus
          1.1  christos                                 - it must be in the range:
          1.1  christos                                   256 to 2048
1.1.1.10.10.1  pgoyette    -M no  md5key         generate symmetric keys
          1.1  christos    -P no  pvt-cert       generate PC private certificate
      1.1.1.2  christos    -p Str password       local private password
      1.1.1.2  christos    -q Str export-passwd  export IFF or GQ group keys with password
          1.1  christos    -s Str subject-name   set host and optionally group name
1.1.1.10.10.1  pgoyette    -S Str sign-key       generate sign key (RSA or DSA)
          1.1  christos    -T no  trusted-cert   trusted certificate (TC scheme)
          1.1  christos    -V Num mv-params      generate &lt;num&gt; MV parameters
          1.1  christos    -v Num mv-keys        update &lt;num&gt; MV keys
          1.1  christos       opt version        output version information and exit
          1.1  christos    -? no  help           display extended usage information and exit
          1.1  christos    -! no  more-help      extended usage information passed thru pager
          1.1  christos    -&gt; opt save-opts      save the option state to a config file
          1.1  christos    -&lt; Str load-opts      load options from a config file
          1.1  christos                                 - disabled as '--no-load-opts'
          1.1  christos                                 - may appear multiple times
          1.1  christos
          1.1  christos Options are specified by doubled hyphens and their name or by a single
          1.1  christos hyphen and the flag character.
          1.1  christos
          1.1  christos
          1.1  christos The following option preset mechanisms are supported:
          1.1  christos  - reading file $HOME/.ntprc
          1.1  christos  - reading file ./.ntprc
          1.1  christos  - examining environment variables named NTP_KEYGEN_*
          1.1  christos
          1.1  christos Please send bug reports to:  &lt;http://bugs.ntp.org, bugs (a] ntp.org&gt;
          1.1  christos </pre>
          1.1  christos   <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-imbits"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">imbits option (-b)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dimbits-4"></a>
          1.1  christos This is the &ldquo;identity modulus bits&rdquo; option.
      1.1.1.7  christos This option takes a number argument <span class="file">imbits</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>The number of bits in the identity modulus.  The default is 256.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-certificate"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">certificate option (-c)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dcertificate-5"></a>
          1.1  christos This is the &ldquo;certificate scheme&rdquo; option.
      1.1.1.7  christos This option takes a string argument <span class="file">scheme</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>scheme is one of
1.1.1.10.10.1  pgoyette RSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160,
          1.1  christos DSA-SHA, or DSA-SHA1.
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Select the certificate signature encryption/message digest scheme.
          1.1  christos Note that RSA schemes must be used with a RSA sign key and DSA
          1.1  christos schemes must be used with a DSA sign key.  The default without
          1.1  christos this option is RSA-MD5.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-cipher"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">cipher option (-C)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dcipher-6"></a>
          1.1  christos This is the &ldquo;privatekey cipher&rdquo; option.
      1.1.1.7  christos This option takes a string argument <span class="file">cipher</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Select the cipher which is used to encrypt the files containing
          1.1  christos private keys.  The default is three-key triple DES in CBC mode,
1.1.1.10.10.1  pgoyette equivalent to "<code>-C des-ede3-cbc</code>".  The openssl tool lists ciphers
1.1.1.10.10.1  pgoyette available in "<code>openssl -h</code>" output.
1.1.1.10.10.1  pgoyette <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-id_002dkey"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">id-key option (-e)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002did_002dkey-7"></a>
          1.1  christos This is the &ldquo;write iff or gq identity keys&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Write the public parameters from the IFF or GQ client keys to
1.1.1.10.10.1  pgoyette the standard output.
1.1.1.10.10.1  pgoyette This is intended for automatic key distribution by email.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-gq_002dparams"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">gq-params option (-G)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dgq_002dparams-8"></a>
          1.1  christos This is the &ldquo;generate gq parameters and keys&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate parameters and keys for the GQ identification scheme,
          1.1  christos obsoleting any that may exist.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-host_002dkey"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">host-key option (-H)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dhost_002dkey-9"></a>
          1.1  christos This is the &ldquo;generate rsa host key&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate new host keys, obsoleting any that may exist.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-iffkey"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">iffkey option (-I)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002diffkey-10"></a>
          1.1  christos This is the &ldquo;generate iff parameters&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate parameters for the IFF identification scheme, obsoleting
          1.1  christos any that may exist.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-ident"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">ident option (-i)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dident-11"></a>
          1.1  christos This is the &ldquo;set autokey group name&rdquo; option.
      1.1.1.7  christos This option takes a string argument <span class="file">group</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Set the optional Autokey group name to name.  This is used in
          1.1  christos the file name of IFF, GQ, and MV client parameters files.  In
          1.1  christos that role, the default is the host name if this option is not
          1.1  christos provided.  The group name, if specified using <code>-i/--ident</code> or
1.1.1.10.10.1  pgoyette using <code>-s/--subject-name</code> following an '<code>@</code>' character,
1.1.1.10.10.1  pgoyette is also a part of the self-signed host certificate subject and
1.1.1.10.10.1  pgoyette issuer names in the form <code>host@group</code> and should match the
1.1.1.10.10.1  pgoyette '<code>crypto ident</code>' or '<code>server ident</code>' configuration in the
1.1.1.10.10.1  pgoyette <code>ntpd</code> configuration file.
1.1.1.10.10.1  pgoyette <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-lifetime"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">lifetime option (-l)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dlifetime-12"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;set certificate lifetime&rdquo; option.
      1.1.1.7  christos This option takes a number argument <span class="file">lifetime</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Set the certificate expiration to lifetime days from now.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-modulus"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">modulus option (-m)</h4>
          1.1  christos
1.1.1.10.10.1  pgoyette <p><a name="index-ntp_002dkeygen_002dmodulus-13"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;prime modulus&rdquo; option.
      1.1.1.7  christos This option takes a number argument <span class="file">modulus</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>The number of bits in the prime modulus.  The default is 512.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-md5key"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
1.1.1.10.10.1  pgoyette <h4 class="subsection">md5key option (-M)</h4>
1.1.1.10.10.1  pgoyette
1.1.1.10.10.1  pgoyette <p><a name="index-ntp_002dkeygen_002dmd5key-14"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;generate symmetric keys&rdquo; option.
1.1.1.10.10.1  pgoyette Generate symmetric keys, obsoleting any that may exist.
1.1.1.10.10.1  pgoyette <div class="node">
1.1.1.10.10.1  pgoyette <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-pvt_002dcert"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-password">ntp-keygen password</a>,
1.1.1.10.10.1  pgoyette Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>,
1.1.1.10.10.1  pgoyette Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
1.1.1.10.10.1  pgoyette <br>
1.1.1.10.10.1  pgoyette </div>
1.1.1.10.10.1  pgoyette
          1.1  christos <h4 class="subsection">pvt-cert option (-P)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dpvt_002dcert-15"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;generate pc private certificate&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate a private certificate.  By default, the program generates
          1.1  christos public certificates.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-password"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
      1.1.1.2  christos <h4 class="subsection">password option (-p)</h4>
          1.1  christos
      1.1.1.2  christos <p><a name="index-ntp_002dkeygen_002dpassword-16"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;local private password&rdquo; option.
      1.1.1.7  christos This option takes a string argument <span class="file">passwd</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
      1.1.1.2  christos   <p>Local files containing private data are encrypted with the
      1.1.1.2  christos DES-CBC algorithm and the specified password.  The same password
      1.1.1.2  christos must be specified to the local ntpd via the "crypto pw password"
      1.1.1.2  christos configuration command.  The default password is the local
      1.1.1.2  christos hostname.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-export_002dpasswd"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>,
      1.1.1.2  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-password">ntp-keygen password</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
      1.1.1.2  christos <h4 class="subsection">export-passwd option (-q)</h4>
          1.1  christos
      1.1.1.2  christos <p><a name="index-ntp_002dkeygen_002dexport_002dpasswd-17"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;export iff or gq group keys with password&rdquo; option.
      1.1.1.7  christos This option takes a string argument <span class="file">passwd</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
      1.1.1.2  christos   <p>Export IFF or GQ identity group keys to the standard output,
      1.1.1.2  christos encrypted with the DES-CBC algorithm and the specified password.
      1.1.1.2  christos The same password must be specified to the remote ntpd via the
      1.1.1.2  christos "crypto pw password" configuration command.  See also the option
1.1.1.10.10.1  pgoyette &ndash;id-key (-e) for unencrypted exports.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-subject_002dname"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>,
      1.1.1.2  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
1.1.1.10.10.1  pgoyette <h4 class="subsection">subject-name option (-s)</h4>
          1.1  christos
1.1.1.10.10.1  pgoyette <p><a name="index-ntp_002dkeygen_002dsubject_002dname-18"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;set host and optionally group name&rdquo; option.
1.1.1.10.10.1  pgoyette This option takes a string argument <span class="file">host@group</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Set the Autokey host name, and optionally, group name specified
1.1.1.10.10.1  pgoyette following an '<code>@</code>' character.  The host name is used in the file
1.1.1.10.10.1  pgoyette name of generated host and signing certificates, without the
1.1.1.10.10.1  pgoyette group name.  The host name, and if provided, group name are used
1.1.1.10.10.1  pgoyette in <code>host@group</code> form for the host certificate subject and issuer
1.1.1.10.10.1  pgoyette fields.  Specifying '<code>-s @group</code>' is allowed, and results in
1.1.1.10.10.1  pgoyette leaving the host name unchanged while appending <code>@group</code> to the
1.1.1.10.10.1  pgoyette subject and issuer fields, as with <code>-i group</code>.  The group name, or
1.1.1.10.10.1  pgoyette if not provided, the host name are also used in the file names
1.1.1.10.10.1  pgoyette of IFF, GQ, and MV client parameter files.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
1.1.1.10.10.1  pgoyette <a name="ntp_002dkeygen-sign_002dkey"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>,
1.1.1.10.10.1  pgoyette Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
1.1.1.10.10.1  pgoyette <h4 class="subsection">sign-key option (-S)</h4>
          1.1  christos
1.1.1.10.10.1  pgoyette <p><a name="index-ntp_002dkeygen_002dsign_002dkey-19"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;generate sign key (rsa or dsa)&rdquo; option.
1.1.1.10.10.1  pgoyette This option takes a string argument <span class="file">sign</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
1.1.1.10.10.1  pgoyette   <p>Generate a new sign key of the designated type, obsoleting any
1.1.1.10.10.1  pgoyette that may exist.  By default, the program uses the host key as the
1.1.1.10.10.1  pgoyette sign key.
1.1.1.10.10.1  pgoyette <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-trusted_002dcert"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>,
1.1.1.10.10.1  pgoyette Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">trusted-cert option (-T)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dtrusted_002dcert-20"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;trusted certificate (tc scheme)&rdquo; option.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate a trusted certificate.  By default, the program generates
          1.1  christos a non-trusted certificate.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-mv_002dparams"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">mv-params option (-V)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dmv_002dparams-21"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;generate &lt;num&gt; mv parameters&rdquo; option.
      1.1.1.7  christos This option takes a number argument <span class="file">num</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
          1.1  christos   <p>Generate parameters and keys for the Mu-Varadharajan (MV)
          1.1  christos identification scheme.
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-mv_002dkeys"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-config">ntp-keygen config</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">mv-keys option (-v)</h4>
          1.1  christos
          1.1  christos <p><a name="index-ntp_002dkeygen_002dmv_002dkeys-22"></a>
1.1.1.10.10.1  pgoyette This is the &ldquo;update &lt;num&gt; mv keys&rdquo; option.
      1.1.1.7  christos This option takes a number argument <span class="file">num</span>.
          1.1  christos
          1.1  christos <p class="noindent">This option has some usage constraints.  It:
          1.1  christos      <ul>
          1.1  christos <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation.
          1.1  christos </ul>
          1.1  christos
      1.1.1.7  christos   <p>This option has no <span class="samp">doc</span> documentation.
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-config"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">presetting/configuring ntp-keygen</h4>
          1.1  christos
          1.1  christos <p>Any option that is not marked as <i>not presettable</i> may be preset by
          1.1  christos loading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_&lt;OPTION_NAME&gt;</code>.  <code>&lt;OPTION_NAME&gt;</code> must be one of
          1.1  christos the options listed above in upper case and segmented with underscores.
          1.1  christos The <code>NTP-KEYGEN</code> variable will be tokenized and parsed like
          1.1  christos the command line.  The remaining variables are tested for existence and their
          1.1  christos values are treated like option arguments.
          1.1  christos
          1.1  christos <p class="noindent"><code>libopts</code> will search in 2 places for configuration files:
          1.1  christos      <ul>
          1.1  christos <li>$HOME
          1.1  christos <li>$PWD
          1.1  christos </ul>
          1.1  christos   The environment variables <code>HOME</code>, and <code>PWD</code>
      1.1.1.7  christos are expanded and replaced when <span class="file">ntp-keygen</span> runs.
          1.1  christos For any of these that are plain files, they are simply processed.
      1.1.1.7  christos For any that are directories, then a file named <span class="file">.ntprc</span> is searched for
          1.1  christos within that directory and processed.
          1.1  christos
          1.1  christos   <p>Configuration files may be in a wide variety of formats.
          1.1  christos The basic format is an option name followed by a value (argument) on the
          1.1  christos same line.  Values may be separated from the option name with a colon,
          1.1  christos equal sign or simply white space.  Values may be continued across multiple
          1.1  christos lines by escaping the newline with a backslash.
          1.1  christos
          1.1  christos   <p>Multiple programs may also share the same initialization file.
          1.1  christos Common options are collected at the top, followed by program specific
          1.1  christos segments.  The segments are separated by lines like:
          1.1  christos <pre class="example">    [NTP-KEYGEN]
          1.1  christos </pre>
          1.1  christos   <p class="noindent">or by
          1.1  christos <pre class="example">    &lt;?program ntp-keygen&gt;
          1.1  christos </pre>
          1.1  christos   <p class="noindent">Do not mix these styles within one configuration file.
          1.1  christos
          1.1  christos   <p>Compound values and carefully constructed string values may also be
          1.1  christos specified using XML syntax:
          1.1  christos <pre class="example">    &lt;option-name&gt;
          1.1  christos        &lt;sub-opt&gt;...&amp;lt;...&amp;gt;...&lt;/sub-opt&gt;
          1.1  christos     &lt;/option-name&gt;
          1.1  christos </pre>
          1.1  christos   <p class="noindent">yielding an <code>option-name.sub-opt</code> string value of
          1.1  christos <pre class="example">    "...&lt;...&gt;..."
          1.1  christos </pre>
          1.1  christos   <p><code>AutoOpts</code> does not track suboptions.  You simply note that it is a
          1.1  christos hierarchicly valued option.  <code>AutoOpts</code> does provide a means for searching
          1.1  christos the associated name/value pair list (see: optionFindValue).
          1.1  christos
          1.1  christos   <p>The command line options relating to configuration and/or usage help are:
          1.1  christos
          1.1  christos <h5 class="subsubheading">version (-)</h5>
          1.1  christos
          1.1  christos <p>Print the program version to standard out, optionally with licensing
          1.1  christos information, then exit 0.  The optional argument specifies how much licensing
          1.1  christos detail to provide.  The default is to print just the version.  The licensing infomation may be selected with an option argument.
          1.1  christos Only the first letter of the argument is examined:
          1.1  christos
          1.1  christos      <dl>
      1.1.1.7  christos <dt><span class="samp">version</span><dd>Only print the version.  This is the default.
      1.1.1.7  christos <br><dt><span class="samp">copyright</span><dd>Name the copyright usage licensing terms.
      1.1.1.7  christos <br><dt><span class="samp">verbose</span><dd>Print the full copyright usage licensing terms.
          1.1  christos </dl>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-exit-status"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-config">ntp-keygen config</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">ntp-keygen exit status</h4>
          1.1  christos
          1.1  christos <p>One of the following exit values will be returned:
          1.1  christos      <dl>
      1.1.1.7  christos <dt><span class="samp">0 (EXIT_SUCCESS)</span><dd>Successful program execution.
      1.1.1.7  christos <br><dt><span class="samp">1 (EXIT_FAILURE)</span><dd>The operation failed or the command syntax was not valid.
      1.1.1.7  christos <br><dt><span class="samp">66 (EX_NOINPUT)</span><dd>A specified configuration file could not be loaded.
      1.1.1.7  christos <br><dt><span class="samp">70 (EX_SOFTWARE)</span><dd>libopts had an internal operational error.  Please report
          1.1  christos it to autogen-users (a] lists.sourceforge.net.  Thank you.
          1.1  christos </dl>
          1.1  christos   <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-Usage"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">ntp-keygen Usage</h4>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-Notes"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">ntp-keygen Notes</h4>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="ntp_002dkeygen-Bugs"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <h4 class="subsection">ntp-keygen Bugs</h4>
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Random-Seed-File"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#Cryptographic-Data-Files">Cryptographic Data Files</a>,
          1.1  christos Previous:&nbsp;<a rel="previous" accesskey="p" href="#Running-the-Program">Running the Program</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <!-- node-name,  next,  previous,  up -->
          1.1  christos <h3 class="section">Random Seed File</h3>
          1.1  christos
          1.1  christos <p>All cryptographically sound key generation schemes must have means to
          1.1  christos randomize the entropy seed used to initialize the internal
          1.1  christos pseudo-random number generator used by the OpenSSL library routines.
          1.1  christos If a site supports ssh, it is very likely that means to do this are
          1.1  christos already available.
          1.1  christos The entropy seed used by the OpenSSL library is contained in a file,
          1.1  christos usually called <code>.rnd</code>, which must be available when
          1.1  christos starting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon.
          1.1  christos
          1.1  christos   <p>The OpenSSL library looks for the file using the path specified by the
          1.1  christos <code>RANDFILE</code> environment variable in the user home directory, whether root
          1.1  christos or some other user.
          1.1  christos If the <code>RANDFILE</code> environment variable is not
          1.1  christos present, the library looks for the <code>.rnd</code> file in the user home
          1.1  christos directory.
          1.1  christos Since both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run
          1.1  christos as root, the logical place to put this file is in <code>/.rnd</code> or
          1.1  christos <code>/root/.rnd</code>.
          1.1  christos If the file is not available or cannot be written, the program exits
          1.1  christos with a message to the system log.
          1.1  christos
          1.1  christos <div class="node">
          1.1  christos <p><hr>
      1.1.1.7  christos <a name="Cryptographic-Data-Files"></a>Previous:&nbsp;<a rel="previous" accesskey="p" href="#Random-Seed-File">Random Seed File</a>,
          1.1  christos Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>
      1.1.1.7  christos <br>
          1.1  christos </div>
          1.1  christos
          1.1  christos <!-- node-name,  next,  previous,  up -->
          1.1  christos <h3 class="section">Cryptographic Data Files</h3>
          1.1  christos
          1.1  christos <p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>,
          1.1  christos where <code>key</code> is the key or parameter type,
          1.1  christos <code>name</code> is the host or group name and
          1.1  christos <code>fstamp</code> is the filestamp (NTP seconds) when the file was created).
          1.1  christos By convention, key names in generated file names include both upper and
          1.1  christos lower case characters, while key names in generated link names include
          1.1  christos only lower case characters. The filestamp is not used in generated link
          1.1  christos names.
          1.1  christos
          1.1  christos   <p>The key name is a string defining the cryptographic key type.
          1.1  christos Key types include public/private keys host and sign, certificate cert
          1.1  christos and several challenge/response key types.
          1.1  christos By convention, client files used for
          1.1  christos challenges have a par subtype, as in the IFF challenge IFFpar, while
          1.1  christos server files for responses have a key subtype, as in the GQ response
          1.1  christos GQkey.
          1.1  christos
          1.1  christos   <p>All files begin with two nonencrypted lines. The first line contains
          1.1  christos the file name in the format <code>ntpkey_key_host.fstamp</code>.
          1.1  christos The second line contains the datestamp in conventional Unix date format.
          1.1  christos Lines beginning with <code>#</code> are ignored.
          1.1  christos
          1.1  christos   <p>The remainder of the file contains cryptographic data encoded first
          1.1  christos using ASN.1 rules, then encrypted using the DES-CBC algorithm with
          1.1  christos given password and finally written in PEM-encoded printable ASCII text
          1.1  christos preceded and followed by MIME content identifier lines.
          1.1  christos
          1.1  christos   <p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>,
          1.1  christos is somewhat different than the other files in the interest of backward
          1.1  christos compatibility.
          1.1  christos Ordinarily, the file is generated by this program, but
          1.1  christos it can be constructed and edited using an ordinary text editor.
          1.1  christos
          1.1  christos <pre class="example">    # ntpkey_MD5key_hms.local.3564038757
          1.1  christos     # Sun Dec  9 02:45:57 2012
          1.1  christos
          1.1  christos      1 MD5 "]!ghT%O;3)WJ,/Nc:&gt;I  # MD5 key
          1.1  christos      2 MD5 lu+H^tF46BKR-6~pV_5  # MD5 key
          1.1  christos      3 MD5 :lnoVsE%Yz*avh%EtNC  # MD5 key
          1.1  christos      4 MD5 |fdZrf0sF~^V  # MD5 key
          1.1  christos      5 MD5 IyAG&gt;O"y"LmCRS!*bHC  # MD5 key
          1.1  christos      6 MD5 "&gt;e\A  # MD5 key
          1.1  christos      7 MD5 c9x=M'CfLxax9v)PV-si  # MD5 key
          1.1  christos      8 MD5 E|=jvFVov?Bn|Ev=&amp;aK\  # MD5 key
          1.1  christos      9 MD5 T!c4UT&amp;`(m$+m+B6,`Q0  # MD5 key
          1.1  christos     10 MD5 JVF/1=)=IFbHbJQz..Cd  # MD5 key
          1.1  christos     11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48  # SHA1 key
          1.1  christos     12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394  # SHA1 key
          1.1  christos     13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3  # SHA1 key
          1.1  christos     14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178  # SHA1 key
          1.1  christos     15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de  # SHA1 key
          1.1  christos     16 SHA1 1930da171297dd63549af50b29449de17dcf341f  # SHA1 key
          1.1  christos     17 SHA1 fee892110358cd4382322b889869e750db8e8a8f  # SHA1 key
          1.1  christos     18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37  # SHA1 key
          1.1  christos     19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92  # SHA1 key
          1.1  christos     20 SHA1 6bc05f734306a189326000970c19b3910f403795  # SHA1 key
          1.1  christos </pre>
          1.1  christos   <p>Figure 1. Typical Symmetric Key File
          1.1  christos
          1.1  christos   <p>Figure 1 shows a typical symmetric keys file used by the reference
          1.1  christos implementation.
          1.1  christos Each line of the file contains three fields, first an
1.1.1.10.10.2  pgoyette integer between 1 and 65535, inclusive, representing the key identifier
          1.1  christos used in the server and peer configuration commands.
          1.1  christos Next is the key type for the message digest algorithm,
          1.1  christos which in the absence of the
          1.1  christos OpenSSL library must be MD5 to designate the MD5 message digest
          1.1  christos algorithm.
          1.1  christos If the OpenSSL library is installed, the key type can be any
          1.1  christos message digest algorithm supported by that library.
          1.1  christos However, if
          1.1  christos compatibility with FIPS 140-2 is required, the key type must be either
          1.1  christos SHA or SHA1.
          1.1  christos The key type can be changed using an ASCII text editor.
          1.1  christos
          1.1  christos   <p>An MD5 key consists of a printable ASCII string less than or equal to
          1.1  christos 16 characters and terminated by whitespace or a # character.
          1.1  christos An OpenSSL
          1.1  christos key consists of a hex-encoded ASCII string of 40 characters, which is
          1.1  christos truncated as necessary.
          1.1  christos
          1.1  christos   <p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are
          1.1  christos checked against passwords requested by the programs and entered by hand,
          1.1  christos so it
          1.1  christos is generally appropriate to specify these keys in human readable ASCII
          1.1  christos format.
          1.1  christos
          1.1  christos   <p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file
          1.1  christos <code>ntpkey_MD5key_hostname.filestamp</code>.
          1.1  christos Since the file contains private
          1.1  christos shared keys, it should be visible only to root and distributed by
          1.1  christos secure means to other subnet hosts.
          1.1  christos The NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code>
          1.1  christos installs a soft link from this name to the generated file.
          1.1  christos Subsequently, similar soft links must be installed by
          1.1  christos manual or automated means on the other subnet hosts.
          1.1  christos While this file is
          1.1  christos not used with the Autokey Version 2 protocol, it is needed to
          1.1  christos authenticate some remote configuration commands used by the <code>ntpq</code> and
          1.1  christos <code>ntpdc</code> utilities.
          1.1  christos
          1.1  christos </body></html>
          1.1  christos