keys/tripe-keys.conf.5.in: Generally enclose literal strings in quotes.

[tripe] / keys / tripe-keys.conf.5.in

diff --git a/keys/tripe-keys.conf.5.in b/keys/tripe-keys.conf.5.in
index 663b9176f48986833b2531e329aa1924b47c1ea2..633f39f38f80aa4b21dbc0e45457ef7449dc18ec 100644 (file)
--- a/keys/tripe-keys.conf.5.in
+++ b/keys/tripe-keys.conf.5.in
@@ -9,19 +9,18 @@
 .\"
 .\" This file is part of Trivial IP Encryption (TrIPE).
 .\"
 .\"
 .\" This file is part of Trivial IP Encryption (TrIPE).
 .\"

-.\" TrIPE is free software; you can redistribute it and/or modify
-.\" it under the terms of the GNU General Public License as published by
-.\" the Free Software Foundation; either version 2 of the License, or
-.\" (at your option) any later version.
+.\" TrIPE is free software: you can redistribute it and/or modify it under
+.\" the terms of the GNU General Public License as published by the Free
+.\" Software Foundation; either version 3 of the License, or (at your
+.\" option) any later version.

 .\"
 .\"

-.\" TrIPE is distributed in the hope that it will be useful,
-.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\" GNU General Public License for more details.
+.\" TrIPE is distributed in the hope that it will be useful, but WITHOUT
+.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+.\" FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+.\" for more details.

 .\"
 .\" You should have received a copy of the GNU General Public License
 .\"
 .\" You should have received a copy of the GNU General Public License

-.\" along with TrIPE; if not, write to the Free Software Foundation,
-.\" Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+.\" along with TrIPE.  If not, see <https://www.gnu.org/licenses/>.

 .
 .\"--------------------------------------------------------------------------
 .so ../common/defs.man \" @@@PRE@@@
 .
 .\"--------------------------------------------------------------------------
 .so ../common/defs.man \" @@@PRE@@@


@@ -77,58 +76,58 @@ The fingerprint of the signing key identified by
 .BR @MASTER-SEQUENCE@ .
 .SS "Master repository parameters"
 .TP
 .BR @MASTER-SEQUENCE@ .
 .SS "Master repository parameters"
 .TP

-.I base-url
+.B base-url

 The base URL of the key repository (usually with a trailing
 .RB ` / ').
 Typically, this will be something like
 The base URL of the key repository (usually with a trailing
 .RB ` / ').
 Typically, this will be something like

-.RB http://www.distorted.org.uk/vpn/ .
+.RB ` http://www.distorted.org.uk/vpn/ '.

 No default.
 .TP
 No default.
 .TP

-.I repos-base
+.B repos-base

 The basename for the repository archive.  Default is
 The basename for the repository archive.  Default is

-.BR tripe-keys.tar.gz .
+.RB ` tripe-keys.tar.gz '.

 .TP
 .TP

-.I sig-base
+.B sig-base

 The basename template for repository signatures.  Default is
 The basename template for repository signatures.  Default is

-.BR tripe-keys.sig-<SEQ> .
+.RB ` tripe-keys.sig-<SEQ> '.

 The
 .RB ` <SEQ> '
 portion, if any, is replaced by the sequence number of the key which
 made the signature.
 .TP
 The
 .RB ` <SEQ> '
 portion, if any, is replaced by the sequence number of the key which
 made the signature.
 .TP

-.I repos-url
+.B repos-url

 The URL for the key repository tarball.  Default is the concatenation of
 .I base-url
 and
 .IR repos-base .
 .TP
 The URL for the key repository tarball.  Default is the concatenation of
 .I base-url
 and
 .IR repos-base .
 .TP

-.I sig-url
+.B sig-url

 The URL template for key repository signatures.  Default is the
 concatenation of
 .I base-url
 and
 .IR sig-base .
 .TP
 The URL template for key repository signatures.  Default is the
 concatenation of
 .I base-url
 and
 .IR sig-base .
 .TP

-.I master-sequence
+.B master-sequence

 The sequence number of the master authority's current signing key.  No
 default.  Usually set up automatically.
 .TP
 The sequence number of the master authority's current signing key.  No
 default.  Usually set up automatically.
 .TP

-.I master-keygen-flags
+.B master-keygen-flags

 Additional options for generating master keys.  Default is
 .RB ` -l '.
 .TP
 Additional options for generating master keys.  Default is
 .RB ` -l '.
 .TP

-.I master-attrs
+.B master-attrs

 Additional attributes to set on the master key,
 as
 .IB key = value
 pairs separated by spaces.
 Default is empty.
 .TP
 Additional attributes to set on the master key,
 as
 .IB key = value
 pairs separated by spaces.
 Default is empty.
 .TP

-.I hk-master
+.B hk-master

 The fingerprint of the current master signing key.  No default.  Usually
 set up automatically.
 .TP
 The fingerprint of the current master signing key.  No default.  Usually
 set up automatically.
 .TP

-.I upload-hook
+.B upload-hook

 A shell command to run by
 .B tripe-keys upload
 after it has successfully written the
 A shell command to run by
 .B tripe-keys upload
 after it has successfully written the


@@ -136,21 +135,21 @@ after it has successfully written the
 and
 .IR sig-file s.
 Default is
 and
 .IR sig-file s.
 Default is

-.B ": run upload hook"
+.RB ` ": run upload hook" '

 which does nothing.
 .SS "Crypto parameters"
 .TP
 which does nothing.
 .SS "Crypto parameters"
 .TP

-.I kx
+.B kx

 Key-exchange algorithm to use.  Either
 .B dh
 (integer Diffie-Hellman)
 or
 .B ec
 (elliptic curves).  The default is
 Key-exchange algorithm to use.  Either
 .B dh
 (integer Diffie-Hellman)
 or
 .B ec
 (elliptic curves).  The default is

-.BR dh .
-.ne 7
+.RB ` dh '.
+.ne 9

 .TP
 .TP

-.I kx-genalg
+.B kx-genalg

 Key generation algorithm name to pass to
 .B "key add"
 when generating keys.
 Key generation algorithm name to pass to
 .B "key add"
 when generating keys.


@@ -166,11 +165,13 @@ kx        kx-genalg
 _
 dh     dh
 ec     ec
 _
 dh     dh
 ec     ec

+x25519 x25519
+x448   x448

 _
 .TE
 _
 .TE

-.ne 7
+.ne 9

 .TP
 .TP

-.I kx-param-genalg
+.B kx-param-genalg

 Key generation algorithm name to pass to
 .B "key add"
 when generating the parameters key.
 Key generation algorithm name to pass to
 .B "key add"
 when generating the parameters key.


@@ -186,11 +187,13 @@ kx        kx-param-genalg
 _
 dh     dh-param
 ec     ec-param
 _
 dh     dh-param
 ec     ec-param

+x25519 empty
+x448   empty

 _
 .TE
 _
 .TE

-.ne 7
+.ne 9

 .TP
 .TP

-.I kx-param
+.B kx-param

 Options to pass to
 .B "key add"
 when generating the parameters key.  Default depends on
 Options to pass to
 .B "key add"
 when generating the parameters key.  Default depends on


@@ -205,50 +208,99 @@ kx        kx-param
 _
 dh     \-LS \-b3072 \-B256
 ec     \-Cnist-p256
 _
 dh     \-LS \-b3072 \-B256
 ec     \-Cnist-p256

+x25519 \fInone
+x448   \fInone

 _
 .TE
 _
 .TE

+.ne 9

 .TP
 .TP

-.I kx-attrs
+.B kx-attrs

 Additional attributes to set on the parameters
 (and therefore copied to peer keys),
 as
 .IB key = value
 pairs separated by spaces.
 Additional attributes to set on the parameters
 (and therefore copied to peer keys),
 as
 .IB key = value
 pairs separated by spaces.

-Default is empty.
+Default depends on
+.I kx
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+kx     kx-attrs
+_
+dh     serialization=constlen
+ec     serialization=constlen
+x25519 \fIempty
+x448   \fIempty
+_
+.TE

 .TP
 .TP

-.I kx-expire
+.B kx-expire

 Expiry time for generated keys.  Default is
 Expiry time for generated keys.  Default is

-.BR "now + 1 year" .
+.RB ` "now + 1 year" '.

 .TP
 .TP

-.I hash
+.B hash

 Hashing algorithm to use.  Default is
 Hashing algorithm to use.  Default is

-.BR sha256 .
+.RB ` sha256 '.

 .TP
 .TP

-.I bulk
+.B bulk

 The bulk crypto transform to use.
 Default is
 The bulk crypto transform to use.
 Default is

-.BR iiv .
-.I mac
-Message authentication algorithm to use.  Default is
-.IB hash -hmac/ halfhashlen \fR,
-where
+.RB ` iiv '.
+.ne 8
+.TP
+.B mac
+Message authentication algorithm to use.
+Default depends on
+.I bulk
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+bulk   mac
+_
+v0     \fIhash\fB-hmac/\fIhalfhashlen
+iiv    \fIhash\fB-hmac/\fIhalfhashlenrijndael-cbc
+naclbox        poly1305/128
+_
+.TE
+.IP
+(In the above,

 .I halfhashlen
 is half of
 .IR hash 's
 .I halfhashlen
 is half of
 .IR hash 's

-output length.
+output length.)

 .TP
 .TP

-.I mgf
+.B mgf

 Mask-generation algorithm to use.  Default is
 Mask-generation algorithm to use.  Default is

-.IB hash -mgf \fR.
+.BI \fR` hash -mgf \fR'.

 This is probably a good choice.
 This is probably a good choice.

-.ne 6
+.ne 7

 .TP
 .TP

-.I cipher
-Symmetric encryption scheme to use.  Default is
-.BR rijndael-cbc .
-.ne 6
+.B cipher
+Symmetric encryption scheme to use.
+Default depends on
+.I bulk
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+bulk   cipher
+_
+v0     rijndael-cbc
+iiv    rijndael-cbc
+naclbox        chacha20
+_
+.TE
+.ne 8

 .TP
 .TP

-.I sig
+.B sig

 Signature scheme to use.  Must be one of those recognized by
 .BR catsign (1).
 Default depends on
 Signature scheme to use.  Must be one of those recognized by
 .BR catsign (1).
 Default depends on


@@ -263,11 +315,13 @@ kx        sig
 _
 dh     dsa
 ec     ecdsa
 _
 dh     dsa
 ec     ecdsa

+x25519 ed25519
+x448   ed448

 _
 .TE
 .ne 12
 .TP
 _
 .TE
 .ne 12
 .TP

-.I sig-genalg
+.B sig-genalg

 Key-generation algorithm for signing key.  Default depends on
 .I sig
 as follows.
 Key-generation algorithm for signing key.  Default depends on
 .I sig
 as follows.


@@ -280,7 +334,7 @@ sig sig-genalg
 _
 kcdsa  dh
 dsa    dsa
 _
 kcdsa  dh
 dsa    dsa

-rsapcs1        rsa
+rsapkcs1       rsa

 rsapss rsa
 ecdsa  ec
 eckcdsa        ec
 rsapss rsa
 ecdsa  ec
 eckcdsa        ec


@@ -290,7 +344,7 @@ _
 .TE
 .ne 10
 .TP
 .TE
 .ne 10
 .TP

-.I sig-param
+.B sig-param

 Signature-key generation parameters.  Default depends on
 .I sig-genalg
 as follows.
 Signature-key generation parameters.  Default depends on
 .I sig-genalg
 as follows.


@@ -310,49 +364,49 @@ ed448     \fInone
 _
 .TE
 .TP
 _
 .TE
 .TP

-.I sig-hash
+.B sig-hash

 Hash function to use for making signatures.  Default is
 .IR hash .
 .TP
 Hash function to use for making signatures.  Default is
 .IR hash .
 .TP

-.I sig-fresh
+.B sig-fresh

 Oldest time we should consider a signed archive to be fresh.  Default is
 Oldest time we should consider a signed archive to be fresh.  Default is

-.BR always ,
+.RB ` always ',

 meaning that all signatures are fresh.
 .TP
 meaning that all signatures are fresh.
 .TP

-.I sig-expire
+.B sig-expire

 Expiry time for master signing key.  Default is
 Expiry time for master signing key.  Default is

-.BR forever .
+.RB ` forever '.

 .TP
 .TP

-.I fingerprint-hash
+.B fingerprint-hash

 Hash function to use for key fingerprinting.  Default is
 .IR hash .
 .SS "Master maintenance parameters"
 .TP
 Hash function to use for key fingerprinting.  Default is
 .IR hash .
 .SS "Master maintenance parameters"
 .TP

-.I base-dir
+.B base-dir

 Local base directory for the repository files.  This probably ought to
 end in a
 .RB ` / '
 character.  Unexpected files in this directory will be removed by the
 Local base directory for the repository files.  This probably ought to
 end in a
 .RB ` / '
 character.  Unexpected files in this directory will be removed by the

-.B tripe-keys upload
+.RB ` "tripe-keys upload" '

 command.  No default.
 .TP
 command.  No default.
 .TP

-.I repos-file
+.B repos-file

 Filename for local repository tarball.  Default is the concatenation of
 .I base-dir
 and
 .IB repos-base .
 .TP
 Filename for local repository tarball.  Default is the concatenation of
 .I base-dir
 and
 .IB repos-base .
 .TP

-.I sig-file
+.B sig-file

 Template for repository signatures.  Default is the concatenation of
 .I base-dir
 and
 .IR sig-base .
 .TP
 Template for repository signatures.  Default is the concatenation of
 .I base-dir
 and
 .IR sig-base .
 .TP

-.I conf-file
+.B conf-file

 Filename for local repository configuration file.  Default is
 Filename for local repository configuration file.  Default is

-.IB basedir /tripe-keys.conf \fR.
+.BI \fR` basedir /tripe-keys.conf \fR'.

 .TP
 .TP

-.I kx-warn-days
+.B kx-warn-days

 The
 .B "tripe-keys check"
 command will warn about keys which will in less than
 The
 .B "tripe-keys check"
 command will warn about keys which will in less than