--- name: "keynote" section: "1" platform: "openbsd" package: "man" version: "8.0-current-20261101" release: "OpenBSD 8.0-current (2026-11-01)" platforms: ["linux", "openbsd"] url: "https://new.carta.tech/keynote" --- # keynote(1) command line tool for keynote operations ## NAME **keynote** – command line tool for keynote operations ## SYNOPSIS **keynote** **keygen** *AlgorithmName* *KeySize* *PublicKeyFile* *PrivateKeyFile* \[*print-offset*\] \[*print-length*\] **keynote** **sign** \[**-v**\] *AlgorithmName* *AssertionFile* *PrivateKeyFile* \[*print-offset*\] \[*print-length*\] **keynote** **sigver** \[*AssertionFile*\] **keynote** **verify** \[**-h**\] \[**-e** *file*\] \[**-k** *file*\] \[**-l** *file*\] **-r** *retlist* \[*file* *...*\] ## DESCRIPTION For more details on **KeyNote**, see RFC 2704. ## KEY GENERATION **keynote** **keygen** creates a public/private key of size *KeySize* (in bits), for the algorithm specified by *AlgorithmName*. Typical keysizes are 512, 1024, or 2048 (bits). The minimum key size for DSA keys is 512 (bits). Supported *AlgorithmName* identifiers are: - dsa-hex: - dsa-base64: - rsa-hex: - rsa-base64: Notice that the trailing colon is required. The resulting public key is stored in file *PublicKeyFile*. Similarly, the resulting private key is stored in file *PrivateKeyFile*. Either of the filenames can be specified to be ‘-’, in which case the corresponding key(s) will be printed to standard output. The optional parameters *print-offset* and *print-length* specify the offset from the beginning of the line where the key will be printed, and the number of characters of the key that will be printed per line. *print-length* includes *AlgorithmName* for the first line and has to be longer (by at least 2) than *AlgorithmName*. *print-length* also accounts for the line-continuation character (backslash) at the end of each line, and the double quotes at the beginning and end of the key encoding. Default values are 12 and 50 respectively. ## ASSERTION SIGNING **keynote** **sign** reads the assertion contained in *AssertionFile* and generates a signature specified by *AlgorithmName* using the private key stored in *PrivateKeyFile*. The private key is expected to be of the form output by **keynote** **keygen**. The private key algorithm and the *AlgorithmName* specified as an argument are expected to match. There is no requirement for the internal or ASCII encodings to match. Valid *AlgorithmName* identifiers are: - sig-dsa-sha1-hex: - sig-dsa-sha1-base64: - sig-rsa-sha1-hex: - sig-rsa-sha1-base64: - sig-rsa-md5-hex: - sig-rsa-md5-base64: - sig-x509-sha1-hex: - sig-x509-sha1-base64: Notice that the trailing colon is required. The resulting signature is printed to standard output. This can then be added (via cut-and-paste or some script) at the end of the assertion, in the *Signature* field. The public key corresponding to the private key in *PrivateKeyFile* is expected to already be included in the *Authorizer* field of the assertion, either directly or indirectly (i.e., through use of a *Local-Constants* attribute). Furthermore, the assertion must have a *Signature* field (even if it is empty), as the signature is computed on everything between the *KeyNote-Version* and *Signature* keywords (inclusive), and the *AlgorithmName* string. If the **-v** flag is provided, **keynote** **sign** will also verify the newly-created signature using the *Authorizer* field key. The optional parameters *print-offset* and *print-length* specify the offset from the beginning of the line where the signature will be printed, and the number of characters of the signature that will be printed per line. *print-length* includes *AlgorithmName* for the first line and has to be longer (by at least 2) than *AlgorithmName*. *print-length* also accounts for the line-continuation character (backslash) at the end of each line, and the double quotes at the beginning and end of the signature encoding. Default values are 12 and 50 respectively. ## SIGNATURE VERIFICATION **keynote** **sigver** reads the assertions contained in *AssertionFile* and verifies the public-key signatures on all of them. ## QUERY TOOL For each operand that names a *file*, **keynote** **verify** reads the file and parses the assertions contained therein (one assertion per file). The options are as follows: - **-e** *file* Specify a file containing environment variables and their values, in the following format: ``` varname = "value" ``` *varname* can begin with any letter (upper or lower case) or number, and can contain underscores. *value* is a quoted string, and can contain any character, and escape (backslash) processing is performed, as specified in the KeyNote RFC. - **-h** Print a usage message and exit. - **-k** *file* Add a key from *file* in the action authorizers. - **-l** *file* Specify a file containing trusted assertions (no signature verification is performed), and the *Authorizer* field can contain non-key principals. There should be at least one assertion with the *POLICY* keyword in the *Authorizer* field. - **-r** *retlist* Specify a comma-separated list of return values, in increasing order of compliance from left to right. Exactly one **-r** and at least one each of the **-e**, **-l**, and **-k** flags should be given per invocation. If no flags are given, **keynote** **verify** prints the usage message and exits with error code -1. **keynote** **verify** exits with code -1 if there was an error, and 0 on success. ## SEE ALSO [keynote(3)](/keynote/3.md), [keynote(4)](/keynote/4.md), [keynote(5)](/keynote/5.md) M. Blaze, J. Feigenbaum, and J. Lacy, “Decentralized Trust Management”, *IEEE Symposium on Security and Privacy*, 1996. M. Blaze, J. Feigenbaum, and M. Strauss, “Compliance-Checking in the PolicyMaker Trust Management System”, *Financial Crypto Conference*, 1998. ## STANDARDS M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis, *The KeyNote Trust-Management System Version 2*, RFC 2704, September 1999. ## AUTHORS Angelos D. Keromytis ⟨*angelos@cs.columbia.edu*⟩ ## WEB PAGE **https://www1.cs.columbia.edu/~angelos/keynote.html**