STRONGSWAN_PKI---GEN(1)

💖 pki --gen — like, the manual page but make it make sense 💖

okay bestie, so this is the page for PKI --GEN(1) from strongSwan, and it's literally all about generating a shiny new RSA or ECDSA private key. yes, the --GEN is right there in the name, no cap. this sub-command lives under pki(1) and it's the one you call when you need fresh key material and you want it done right. 💅

---

✨ NAME ✨

pki --gen — generate a new RSA or ECDSA private key 🗝️✨

---

🌸 SYNOPSIS 🌸

pki --gen [--type type] [--size bits] [--safe-primes] [--shares n]
          [--threshold l] [--outform encoding] [--debug level]

pki --gen --options file

pki --gen -h | --help

like, that's the whole vibe check in three lines. 🫶

---

🦋 DESCRIPTION 🦋

so this sub-command of pki(1) is the one that generates you a brand new RSA or ECDSA private key. that's it. that's the job. she's a specialist, she's iconic, she does one thing and she eats. 👑

---

💅 OPTIONS 💅

• -h, --help — prints the usage info plus a little summary of every option you can use. your friendly lil cheat sheet. 🎀
• -v, --debug level — sets the debug level. default is 1. crank it up if you're nosy (affectionate).
• -+, --options file — reads the command line options from file instead of making you type them all out. yes, -+ is really the short flag, she's quirky like that. ✨
• -t, --type type — the type of key to generate. either rsa, ecdsa, ed25519, or ed448. defaults to rsa. pick your fighter. 🔥
• -s, --size bits — key length in bits. defaults to 2048 for rsa and 384 for ecdsa. and heads up: for ecdsa only three values are currently supported — 256, 384 and 521. no, you can't freestyle a fourth one, bestie. 😭
• -p, --safe-primes — generate RSA safe primes. extra careful, extra spicy. 🛡️
• -f, --outform encoding — encoding of the generated private key. either der (ASN.1 DER) or pem (Base64 PEM). defaults to der. ⭐

🔐 RSA Threshold Cryptography 🔐

• -n, --shares <n> — number of private RSA key shares. splitting the key like it's a group project, except this time everyone actually participates. 🙈
• -l, --threshold <l> — minimum number of participating RSA key shares. like, how many of the squad need to show up before the key works. 💜

---

💀 PROBLEMS ON HOSTS WITH LOW ENTROPY 💀

okay so this part is important, don't skip it.

if the gmp plugin is used to generate RSA private keys, the key material is read from /dev/random (via the random plugin). which means the command may block if the system's entropy pool is empty. literally just sitting there. waiting. not a vibe. 😭

to avoid this, you've got options:

• use a hardware random number generator to feed /dev/random, or
• use OpenSSL (via the openssl plugin or the command line), which is not as strict in regards to the quality of the key material — it reads from /dev/urandom if necessary.

it's also possible to configure the devices used by the random plugin in strongswan.conf(5).

setting libstrongswan.plugins.random.random to /dev/urandom forces the plugin to treat bytes read from /dev/urandom as high grade random data, thus avoiding the blocking.

but of course, this doesn't change the fact that the key material generated this way is of lower quality. like, you fixed the waiting, not the vibe. be honest with yourself about that. 🫠

---

🌈 EXAMPLES 🌈

pki --gen --size 3072 > rsa_key.der

generates a 3072-bit RSA private key. big girl energy. 💪

pki --gen --type ecdsa --size 256 > ecdsa_key.der

generates a 256-bit ECDSA private key. small, fast, slays. 🦋

---

👀 SEE ALSO 👀

pki(1)

---

and that's the whole page, bestie — you ate that. 🍓

strongSwan version 6.0.7, dated 2016-12-13. periodt. 💖