Key generation

credence keygen [-i identity] [-d directory]

Generates public and private key files. The following command line options are available:

-i identity

Specify the identity. If this option is not used, a default of username@hostname will be used, where username will be determined via getuid(2) and getpwuid(2) and hostname will be determined via gethostname(3).

-d directory

Specify the directory in which the keys should be stored. The public key will be stored in 'id_ed25519.pub' and the private key will be stored in 'id_ed25519' in the given directory. If this option is not used, ~/.credence will be used as the default directory.

A user will normally use their email address as the identity, and not use the -d directory argument. They may then copy the contents of their ~/.credence directory onto any host from which they need access to services using libDwmCredence, taking care to maintain 0600 permissions on their key files and 0700 permissions on their ~/.credence directory. For example:

% credence keygen -i dwm@mcplex.net

A service will normally use a service name and hostname as the identity, and an appropriate location for the key files. For example:

# credence keygen -i mcblockd@gw.mcplex.net -d /usr/local/etc/mcblockd

Key checking

credence keycheck [-d directory]

Checks the validity of a public/private key pair. The following command line options are available:

-d directory

Specify the directory in which the keys are stored. If this option is not used, the default ~/.credence directory is used.

If the key pair is valid, "Valid key stash '<directory>'" will be printed on stdout and the credence(1) process will exit with status 0. If any error occurs (invalid keypair, missing file(s), etc.), credence(1) will print an error on stderr and exit with status 1.