xmlsec

Index
 

NAME

xmlsec - command line tool to sign and encrypt XML documents  

SYNOPSIS

xmlsec [COMMAND] [OPTIONS] [FILE1] [FILE2] [....]
      

 

INTRODUCTION

The xmlsec program signs or encrypts XML files, specified on the command line as FILE1, FILE2, ... according to "XML Digital Signature" and "XML Encryption" specifications.

The xmlsec program is included in XML Security Library.

 

COMMANDS

version
Prints version information for the xmlsec program.

help
Prints general help information.

help-command
Prints help information for command.

keys
Manages keys in XML keys file. The result keys file is written to the FILE1, FILE2, ... files.

sign
Signs XML documents FILE1, FILE2, ...

verify
Verifies XML signature in the XML documents FILE1, FILE2, ...

encrypt
Encrypts data using templates from FILE1, FILE2, ... files.

decrypt
Decrypts encrypted XML documents FILE1, FILE2, ...

 

KEYS COMMAND OPTIONS

--gen-hmac name
Generates 24 bytes HMAC key and sets the key name to name.

--gen-rsa name
Generates RSA key and sets the key name to name.

--gen-dsa name
Generates DSA key and sets the key name to name.

--gen-des3 name
Generates Tripple DES key and sets the key name to name.

--gen-aes128 name
Generates AES 128 key and sets the key name to name.

--gen-aes192 name
Generates AES 192 key and sets the key name to name.

--gen-aes256 name
Generates AES 256 key and sets the key name to name.

--keys file
Loads keys from XML keys file.

--pubkey[:name] file
Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--pwd password
Sets the password to use for reading keys and certificates from PEM files.

--hmackey[:name] file
Loads HMAC key from binary file and sets the key name to name.

 

SIGN COMMAND OPTIONS

--ignore-manifests
Instructs the xmlsec program to ignore <dsig:Manifest> elements.

--node-id id
Instructs the xmlsec program to sign only <dsig:Signature> element with given id.

--keys file
Loads keys from XML keys file.

--pubkey[:name] file
Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
Loads HMAC key from binary file and sets the key name to name.

--pwd password
Sets the password to use for reading keys and certificates from PEM files.

--allowed list
Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--session-key-hmac
Generates and uses for signature 24 bytes HMAC key.

--session-key-rsa
Generates and uses for signature RSA key.

--session-key-dsa
Generates and uses for signature DSA key.

--repeat number
Repeats the operation number times.

--fake-signatures
Disables actual signature calculation for performance testing.

 

VERIFY COMMAND OPTIONS

--output file
Writes the signed XML document to file.

--ignore-manifests
Instructs the xmlsec program to ignore <dsig:Manifest> elements.

--node-id id
Instructs the xmlsec program to sign only <dsig:Signature> element with given id.

--print-result
Prints additional result information.

--print-references
Prints the pre-digested signature references.

--print-manifests
Prints the pre-digested manifests references.

--print-siganture
Prints the pre-signated data (<dsig:SignedInfo> element).

--print-all
Prints all available data.

--keys file
Loads keys from XML keys file.

--pubkey[:name] file
Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
Loads HMAC key from binary file and sets the key name to name.

--pwd password
Sets the password to use for reading keys and certificates from PEM files.

--allowed list
Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--trusted file
Loads trusted certificate from PEM file.

--untrusted file
Loads un-trusted certificate from PEM file.

--repeat number
Repeats the operation number times.

--fake-signatures
Disables actual signature calculation for performance testing.

 

ENCRYPT COMMAND OPTIONS

--output file
Writes the encrypted XML document to file.

--binary file
Encrypts binary file.

--xml file
Encrypts XML file.

--node-id id
Instructs the xmlsec program to encrypt only element with given id.

--node-name [namespace-uri:]name
Instructs the xmlsec program to encrypt only element with given namespace-uri and name.

--keys file
Loads keys from XML keys file.

--pubkey[:name] file
Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
Loads HMAC key from binary file and sets the key name to name.

--pwd password
Sets the password to use for reading keys and certificates from PEM files.

--allowed list
Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--session-key-rsa
Generates and uses for encryption RSA key.

--session-key-des3
Generates and uses for encryption Tripple DES key.

--session-key-aes128
Generates and uses for encryption AES 128 key.

--session-key-aes192
Generates and uses for encryption AES 192 key.

--session-key-256
Generates and uses for encryption AES 256 key.

--repeat number
Repeats the operation number times.

 

DECRYPT COMMAND OPTIONS

--output file
Writes the decrypted XML document to file.

--node-id id
Instructs the xmlsec program to decrypt only element with given id.

--keys file
Loads keys from XML keys file.

--pubkey[:name] file
Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
Loads HMAC key from binary file and sets the key name to name.

--pwd password
Sets the password to use for reading keys and certificates from PEM files.

--allowed list
Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--trusted file
Loads trusted certificate from PEM file.

--untrusted file
Loads un-trusted certificate from PEM file.

--repeat number
Repeats the operation number times.

 

REPORTING BUGS

Report bugs to <xmlsec@aleksey.com>

 

MORE INFORMATION

XML Security Library: http://www.aleksey.com/xmlsec/

XML Digital Signature: http://www.w3.org/Signature/

XML Encrytpion: http://www.w3.org/Encryption/

 

AUTHOR

Aleksey Sanin <aleksey@aleksey.com>.  

COPYRIGHT

Copyright 2002 Aleksey Sanin <aleksey@aleksey.com>


 

Index

NAME
SYNOPSIS
INTRODUCTION
COMMANDS
KEYS COMMAND OPTIONS
SIGN COMMAND OPTIONS
VERIFY COMMAND OPTIONS
ENCRYPT COMMAND OPTIONS
DECRYPT COMMAND OPTIONS
REPORTING BUGS
MORE INFORMATION
AUTHOR
COPYRIGHT

This document was created by man2html, using the manual pages.
Time: 02:31:41 GMT, August 15, 2002