A2ID-KEYGEN(1)

💅 A2ID-KEYGEN — a2id-keygen

okay so real talk, this one's from the System Management Commands corner of the manual, and it's your girl's fave kind of page: short, sassy, and it makes keys. buckle up bestie 🎀

✨ NAME ✨

a2id-keygen — generate a key for ARPA2 Signed Identities 🗝️

🌸 SYNOPSIS 🌸

a2id-keygen keyname

a2id-keygen /path/to/file.key

💖 DESCRIPTION 💖

so like, with a2id-keygen, an administrator can install a key for use in the a2id_sign() and a2id_verify() functions. those two literally work on an ARPA2 Identity — a2id_sign() adds a signature, a2id_verify() checks one. no cap. 🔥

and the signature content? it shows up as part of the identity itself, like:

john+cook+AABBCC+@example.com

the way that works is the contents of this signature fixate the validity of the ARPA2 Identity to contextual matter — things like the time (which is how you get expiration, periodt) or the remote identity (fixating their domain and/or local-part). it's giving "this identity is valid in this exact context" and honestly? iconic.

---

🦋 making a new key 🦋

this command lets the system administrator create a new key. two vibes, one command:

• the /path/to/file.key form gives an absolute path name of a place to store the key — you pick, you slay
• the keyname form stores the file into a default location, which usually is /var/lib/arpa2/identity, where keys are stored with a .key extension

⚠️ not me warning you: overwriting an existing key file is not supported — it leads to an error message and a failure exit. no quiet clobbering, no sneaky replace, just a hard no. 🙈

🧚 the key repository 🧚

the purpose of the /var/lib/arpa2/identity directory is to serve as a key repository for the system, with files only accessible to the root user. main character security energy 👑

it is customary to have a key named default stored in /var/lib/arpa2/identity/default.key to serve most purposes. additional keys may be used, for instance, to permit verification of signatures with older keys, while default.key is used for signing. so to cycle keys:

1. move the default key to another name with the .key extension
2. generate a new default key to replace it

that's the whole ritual, bestie 🕯️

💜 how apps actually get their keys 💜

applications must load keys explicitly, and the default key store is merely a convention to get that started. the function a2id_addkey() is used to setup a new key.

programs may open a file descriptor to the key(s) to pass and harvest them after dropping privileges. and an even stronger mechanism is to do this key passing through a pipe — into which it fits, and from which it can only be read once by the program at a lower privilege. the way that's literally the most secure vibe here. 🔐✨

🌈 AUTHOR 🌈

written by Rick van Rein of OpenFortress.nl, for the ARPA2.net project. king behavior 👑

🍓 REPORTING BUGS 🍓

for any discussion, including about bugs, please use the https://gitlab.com/arpa2/arpa2common/ project page for ARPA2 Common. we use its issue tracker to track bugs and feature requests. come yell with us, it's a safe space 🫶

⭐ COPYRIGHT ⭐

Copyright © 2021 Rick van Rein, ARPA2.net.

ARPA2 is funded from InternetWide.org, which in turn receives funding from various sources. this particular work was funded through a grant of SIDNfonds, a public interest fund geared towards a better Internet for all, and paid by administration fees for .nl domain names. so yes, every .nl domain out there lowkey helped fund this 🎀

👑 SEE ALSO 👑

• a2id-loadkey(8)

ARPA2 Common is documented on http://common.arpa2.net/ and its code is on https://gitlab.com/arpa2/arpa2common/ — go read, iykyk 📚

---

that's the whole page, bestie, you ate it up 💅 this lil gem comes to you from ARPA2.net and it's dated June 2021 — vintage but still slay ✨