openpgpkey man page

openpgpkey — Create and verify RFC-TBD OPENPGPKEY DNS records

Syntax

openpgpkey [--fetch | --verify] [--insecure] [--resolv.conf /PATH/TO/RESOLV.CONF] user@domain

openpgpkey [--create] [--insecure] [--resolv.conf /PATH/TO/RESOLV.CONF] [--output {rfc,generic,both}] [--uid <uid>] [--keyid <keyid>] user@domain

Description

openpgpkey generates RFC-TBD OPENPGPKEY DNS records. To generate these records for older nameserver implementations that do not yet support the OPENPGPKEY record, specify --output generic to output the openpgpkey data in Generic Record (RFC-3597) format. Records are generated by taking all keys with the specified email address associated with it from the user's local GnuPG keychain.

Verification of OPENPGPKEY records is done by comparing the keyid and fingerprint of the OPENPGPKEY obtained from DNS with the version in the local GnuPG keychain.

Options

--fetch
Fetch an OPENPGPKEY public key record from DNS
--create
Create an OPENPGPKEY DNS record
--verify
Verify a public key from the local GPG keyring with the OPENPGPKEY DNS record
--resolvconf FILE
Specify a custom resolv.conf file (default: /etc/resolv.conf)
--output rfc | generic | both
Output format of OPENPGPKEY record. "OPENPGPKEY" for rfc, "TYPE61" for generic (default: generic)

If neither create or verify is specified, create is used.

Requirements

openpgpkey requires the following python libraries: unbound, gnupg and argparse. It also requires gnupg which provides the gpg command.

Bugs

none known

Examples

typical usage:

openpgpkey --fetch paul@nohats.ca > paul.pubkey

openpgpkey --verify paul@nohats.ca

openpgpkey --create paul@nohats.ca

See Also

draft-ietf-dane-openpgpkey

http://people.redhat.com/pwouters/hash-…

Authors

Paul Wouters <pwouters@redhat.com>

Info

December 30, 2013 Paul Wouters Internet / DNS