SHIB-SECKEYGEN.8(8)

NAME
shib-seckeygen - Rotate the keys of a Versioned DataSealer

SYNOPSIS
shib-seckeygen [-o output-dir] [-f filename]
    [-h history-length] [-b key-size]
    [-u user] [-g group]

DESCRIPTION
The Versioned <DataSealer> type is designed for production use and obtains its key material from a simple flat file that allows a history of several keys to be kept to decrypt older data and continuously rotate the encryption key on a regular basis, usually daily.

The flat file format consists of lines of the form <name>:<key>, where the name is typically a number for record keeping but can be any label, and the key is base64-encoded. The key length dictates which AES-GCM algorithm is used, among the supported key sizes (128,192,256). The "default" key used for new operations is the last line in the file.

This script provides a simple means of rotating the key, and the Service Provider software will typically detect when the file changes and reload it.

OPTIONS

-b key-size
    Number of random bits in the newly generated key. See above for the supported sizes. The default is 128.

-g group
    Change the group ownership of the key file to this group. The default is "_shibd".

-h history-length
    The maximum number of keys to keep in the file. The default is 14.

-f filename
    The name of the file containing the keys in output-dir. The default is "sealer.keys".

-o output-dir
    The key file and a temporary key file are created in this directory. The default is "/etc/shibboleth".

-u user
    Change the ownership of the key file to this user. The default is "_shibd".

FILES

/etc/shibboleth/sealer.keys
    The default key file rotated by this script.

AUTHOR
This manual page was written by Ferenc Wágner for Debian GNU/Linux using the text on https://wiki.shibboleth.net/confluence/display/SP3/VersionedDataSealer.

COPYRIGHT
Copyright 2018 Shibboleth Project. License: Creative Commons Attribution-ShareAlike 3.0.