delim $$

dsagen, asn12dsa, dsa2pub, dsa2ssh – generate and format dsa keys

auth/dsagen [ –t tag ]

auth/asn12dsa [ –t tag ] [ file ]

auth/dsa2pub [ file ]

auth/dsa2ssh [ –c comment ] [ file ]

Plan 9 represents a DSA (Digital Signature Algorithm) key as an attribute–value pair list prefixed with the string key; this is the generic key format used by factotum(4). A full DSA private key has the following attributes:
proto    must be dsa
decryption key
p        modulus, a large prime
q        group order, another large prime that divides p – 1.
alpha    group generator
key      $"alpha" sup secret ~ mod ~ p$

All the numbers are in hexadecimal. A DSA public key omits the attributes beginning with !. A key may have other attributes as well (for example, a service attribute identifying how this key is typically used), but to these utilities such attributes are merely comments.

For example, a private key and corresponding public key might look like this (with [⋯] indicating elisions and \ marking line breaks for readability):
key proto=dsa p=D5[⋯]DB q=C2[⋯]E7 alpha=44[⋯]9B key=C1[⋯]3F \
key proto=dsa p=D5[⋯]DB q=C2[⋯]E7 alpha=44[⋯]9B key=C1[⋯]3F

Note that the order of the attributes does not matter.

Dsagen prints a randomly generated DSA private key whose n has exactly nbits (default 1024) significant bits. If tag is specified, it is printed between key and proto=dsa; typically, tag is a sequence of attribute–value comments describing the key.

Asn12dsa reads an DSA private key stored as ASN.1 encoded in the binary Distinguished Encoding Rules (DER) and prints a Plan 9 DSA key, inserting tag exactly as dsagen does. ASN.1/DER is a popular key format on Unix and Windows; it is often encoded in text form using the Privacy Enhanced Mail (PEM) format in a section labeled as an ``DSA PRIVATE KEY.'' The command:
auth/pemdecode 'DSA PRIVATE KEY' | auth/asn12dsa

extracts the key section from a textual ASN.1/DER/PEM key into binary ASN.1/DER format and then converts it to a Plan 9 DSA key.

Dsa2pub reads a Plan 9 DSA public or private key, removes the private attributes, and prints the resulting public key. Comment attributes are preserved.

Dsa2ssh reads a Plan 9 DSA public or private key and prints the public portion in the format used by SSH: ssh–dss and a long base–64 encoded number. delim @@ For compatibility with external SSH implementations, the public keys in /sys/lib/ssh/keyring and $home/lib/keyring are stored in this format.

Generate a fresh key and configure a remote Unix system to allow use of that key for logins:
auth/dsagen –t 'service=ssh' >key
auth/dsa2ssh key | ssh unix 'cat >>.ssh/authorized_keys'
cat key >/mnt/factotum/ctl
ssh unix


ssh(1), factotum(4), pem(8), rsa(8)

There are too many key formats.
Copyright © 2024 Plan 9 Foundation. All rights reserved.