test

System Administration Guide: Security Services

ProcedureHow to Generate a Symmetric Key by Using the pktool Command

Some applications require a symmetric key for encryption and decryption of communications. In this procedure, you create a symmetric key and store it.

  1. (Optional) If you plan to use a keystore, create it.

  2. Generate a random number for use as a symmetric key.

    Use one of the following methods.

    • Generate a key and store it in a file.

      The advantage of a file-stored key is that you can extract the key from this file for use in an application's key file, such as the /etc/inet/secret/ipseckeys file or IPsec.


      % pktool genkey keystore=file outkey=key-fn \ 
[keytype=generic|specific-symmetric-algorithm] [keylen=size-in-bits] \
[dir=directory] [print=n]
      keystore

      The value file specifies the file type of storage location for the key.

      outkey=key-fn

      Is the filename when keystore=file.

      keytype=specific-symmetric-algorithm

      For a symmetric key of any length, the value is generic. For a particular algorithm, specify aes, arcfour, des, or 3des.

      keylen=size-in-bits

      Is the length of the key in bits. The number must be divisible by 8. Do not specify for des or 3des.

      dir=directory

      Is the directory path to key-fn. By default, directory is the current directory.

      print=n

      Prints the key to the terminal window. By default, the value of print is n.

    • Generate a key and store it in a PKCS #11 keystore.

      The advantage of the PKCS #11 keystore is that you can retrieve the key by its label. This method is useful for keys that encrypt and decrypt files. You must complete Step 1 before using this method.


      % pktool genkey label=key-label \ 
[keytype=generic|specific-symmetric-algorithm] [keylen=size-in-bits] \
[token=token] [sensitive=n] [extractable=y] [print=n]
      label=key-label

      Is a user-specified label for the key. The key can be retrieved from the keystore by its label.

      keytype=specific-symmetric-algorithm

      For a symmetric key of any length, the value is generic. For a particular algorithm, specify aes, arcfour, des, or 3des.

      keylen=size-in-bits

      Is the length of the key in bits. The number must be divisible by 8. Do not specify for des or 3des.

      token=token

      Is the token name. By default, the token is Sun Software PKCS#11 softtoken.

      sensitive=n

      Specifies the sensitivity of the key. When the value is y, the key cannot be printed by using the print=y argument. By default, the value of sensitive is n.

      extractable=y

      Specifies that the key can be extracted from the keystore. Specify n to prevent the key from being extracted.

      print=n

      Prints the key to the terminal window. By default, the value of print is n.

    • Generate a key and store it in an NSS keystore.

      You must complete Step 1 before using this method.


      % pktool keystore=nss genkey label=key-label \ 
[keytype=[keytype=generic|specific-symmetric-algorithm] [keylen=size-in-bits] [token=token] \
[dir=directory-path] [prefix=database-prefix]
      keystore

      The value nss specifies the NSS type of storage location for the key.

      label=key-label

      Is a user-specified label for the key. The key can be retrieved from the keystore by its label.

      keytype=specific-symmetric-algorithm

      For a symmetric key of any length, the value is generic. For a particular algorithm, specify aes, arcfour, des, or 3des.

      keylen=size-in-bits

      Is the length of the key in bits. The number must be divisible by 8. Do not specify for des or 3des.

      token=token

      Is the token name. By default, the token is the NSS internal token.

      dir=directory

      Is the directory path to the NSS database. By default, directory is the current directory.

      prefix=directory

      Is the prefix to the NSS database. The default is no prefix.

      print=n

      Prints the key to the terminal window. By default, the value of print is n.

  3. (Optional) Verify that the key exists.

    Use one of the following commands, depending on where you stored the key.

    • Verify the key in the key-fn file.


      % pktool list keystore=file objtype=key infile=key-fn
Found n keys.
Key #1 - keytype:location (keylen)

    • Verify the key in the PKCS #11 or the NSS keystore.


      $ pktool list objtype=key
Enter PIN for keystore:
Found n keys.
Key #1 - keytype:location (keylen)
Example 14–5 Creating a Symmetric Key by Using the pktool Command

In the following example, a user creates a PKCS #11 keystore for the first time, and then generates a large symmetric key for an application. Finally, the user verifies that the key is in the keystore.


# pktool setpin
Create new passphrase:easily-remembered-hard-to-detect-password
Re-enter new passphrase:Retype password
Passphrase changed.
% pktool genkey label=specialappkey keytype=generic keylen=1024
Enter PIN for Sun Software PKCS#11 softtoken  :Type password

% pktool list objtype=key
Enter PIN for Sun Software PKCS#11 softtoken  :Type password

Found 1 keys.
Key #1 - symmetric:  specialappkey (1024 bits)
Example 14–6 Creating a DES Key by Using the pktool Command

In the following example, a secret key for the DES algorithm is created. The key is stored in a local file for later decryption. The command protects the file with 400 permissions. When the key is created, the print=y option displays the generated key in the terminal window.

DES mechanisms use a 64-bit key. The user who owns the keyfile retrieves the key by using the od command.


% pktool genkey keystore=file outkey=64bit.file1 keytype=des print=y
        Key Value ="a3237b2c0a8ff9b3"
% od -x 64bit.file1
0000000 a323 7b2c 0a8f f9b3
Example 14–7 Creating a Symmetric Key for IPsec Security Associations

In the following example, the administrator manually creates the keying material for IPsec SAs and stores them in files. Then, the administrator copies the keys to the /etc/inet/secret/ipseckeys file and destroys the original files.