---
name: "aespasswd"
section: "1"
platform: "linux"
package: "i2util-tools"
version: "1.6-1+b1"
release: "Debian 12 (Bookworm)"
platforms: ["linux"]
url: "https://new.carta.tech/aespasswd"
---

# aespasswd(1)

Used to create and manage an AES keyfile.

## NAME

aespasswd - Used to create and manage an AES keyfile.

## SYNOPSIS

**aespasswd** \[*-n*\] \[*-d*\] *-f keyfile identity*

## OPTIONS

- **-n**

  Create the keyfile

- **-d**

  Delete given identity from keyfile

- **-f keyfile**

  Specifies file that holds identity/key pairs

## DESCRIPTION

**aespasswd** is used to create and manage files that hold identity/key pairs. It is primarily used to manage the *bwctld.keys* file for **bwctld** and the *owampd.keys* file for **owampd**.

If the *-d* option is not specified, then **aespasswd** prompts the caller for a passphrase. The passphrase is hashed using an internal MD5 algorithm to generate a key that is then saved in the *keyfile* associated with the given *identity*. If the given *identity* already exists in the *keyfile*, the previous key is overwritten with the new one.

*keyfiles* generated by **aespasswd** are formatted for use with **BWCTL** and **OWAMP**.

## KEYFILE FORMAT

**aespasswd** generates lines of the format:

test	54b0c58c7ce9f2a8b551351102ee0938

An *identity*, followed by whitespace, followed by a hex encoded 128-bit number, that is suitable to be used as a symmetric AES key.

No other text is allowed on these lines; however, comment lines may be added. Comment lines are any line where the first non-white space character is '**#**'.

## EXAMPLES

**aespasswd -f /etc/bwctl/bwctld.keys testuser**

-

  Adds a key for the identity *testuser*. The user is prompted for a passphrase. If the file does not exist, an error message will be printed and no action will be taken.

**aespasswd -f /etc/bwctl/bwctld.keys -n testuser**

-

  Creates the file before doing the same as above. If the file already exists, an error message will be printed and no action will be taken.

**aespasswd -f /etc/bwctl/bwctld.keys -d testuser**

-

  Deletes the identity *testuser* from the keyfile. If the file does not exist, an error message will be printed and no action will be taken.

## SECURITY CONSIDERATIONS

The keys in the *keyfile* are not encrypted in any way. The security of these keys is completely dependent upon the security of the system and the discretion of the system administrator.

## RESTRICTIONS

*identity* names are restricted to 16 characters, and passphrases are limited to 1024 characters.

## SEE ALSO

owping(1), owampd(1), [bwctl(1)](/bwctl/1.md), bwctld(1) and the http://e2epi.internet2.edu/owamp and http://e2epi.internet2.edu/bwctl web sites.

## ACKNOWLEDGMENTS

This material is based in part on work supported by the National Science Foundation (NSF) under Grant No. ANI-0314723. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the NSF.