PKI---GEN(1)

🎀 PKI --GEN(1) 🎀

okay so bestie, welcome to the pki --gen page — it's the key-generating sub-command from strongSwan, and it lives in the manual as PKI --GEN(1). it's genuinely iconic, let me walk you through it 💖

---

✨ NAME ✨

pki --gen — generate a new RSA or ECDSA private key 🔑

---

🌸 SYNOPSIS 🌸

pki --gen [--type type] [--size bits] [--safe-primes] [--shares n]
          [--threshold l] [--outform encoding] [--debug level]

pki --gen --options file

pki --gen -h | --help

---

🦋 DESCRIPTION 🦋

so this is a sub-command of pki(1), right, and its whole personality is generating a brand-new RSA or ECDSA private key. that's it, that's the gig. no cap 💅

---

✨ OPTIONS ✨

• -h, --help — prints the usage info plus a lil summary of everything you can pass. your bestie when you're lost 🫶
• -v, --debug level — sets the debug level. default is 1, slay ✨
• -+, --options file — reads the command line options straight out of a file. lowkey convenient.
• -t, --type type — the type of key you wanna generate: either rsa, ecdsa, ed25519, or ed448. defaults to rsa 👑
• -s, --size bits — key length in bits. defaults to 2048 for rsa and 384 for ecdsa. and heads up: for ecdsa only three values work rn — 256, 384 and 521. that's the whole menu, fr fr.
• -p, --safe-primes — generates RSA safe primes.
• -f, --outform encoding — the encoding of the private key you just made: either der (ASN.1 DER) or pem (Base64 PEM). defaults to der 🎀

🔥 RSA Threshold Cryptography 🔥

• -n, --shares <n> — number of private RSA key shares.
• -l, --threshold <l> — minimum number of participating RSA key shares.

---

⭐ PROBLEMS ON HOSTS WITH LOW ENTROPY ⭐

bestie, listen, this part matters 😭 if the gmp plugin is the one generating your RSA private keys, the key material gets read from /dev/random (via the random plugin). which means—yup—the command can literally just block if the system's entropy pool is empty. very much giving loading screen forever 💀

to dodge that, you've got options:

• use a hardware random number generator to feed /dev/random, or
• use OpenSSL (via the openssl plugin or the command line) — it's not as strict about the quality of the key material (it reads from /dev/urandom if necessary).

you can also configure the devices the random plugin uses in strongswan.conf(5). setting libstrongswan.plugins.random.random to /dev/urandom forces the plugin to treat bytes read from /dev/urandom as high grade random data, which avoids the blocking ✨ but of course, it doesn't change the fact that key material generated this way is of lower quality. keeping it real 🫶

tl;dr: skipping the block means lower-quality randomness. no free lunch, bestie.

---

💜 EXAMPLES 💜

pki --gen --size 3072 > rsa_key.der

generates a 3072-bit RSA private key 🔑

pki --gen --type ecdsa --size 256 > ecdsa_key.der

generates a 256-bit ECDSA private key 🌈

---

🌸 SEE ALSO 🌸

pki(1) — go read it, iykyk 💅

---

okay that's the whole page, mwah 💖 this was strongSwan version 6.1.0, dated 2016-12-13 — iconic behavior, go generate some keys bestie 🎀🦋✨