NAME

generate - Generates a new key

SYNOPSIS

generate [-u|--userid] [-c|--cipher-suite] [--with-password] [--creation-time] [--expires] [--expires-in] [--can-sign] [--cannot-sign] [--can-authenticate] [--cannot-authenticate] [--can-encrypt] [--cannot-encrypt] [-e|--export] [--rev-cert] [-h|--help]

DESCRIPTION

Generates a new key

Generating a key is the prerequisite to receiving encrypted messages and creating signatures. There are a few parameters to this process, but we provide reasonable defaults for most users.

When generating a key, we also generate a revocation certificate. This can be used in case the key is superseded, lost, or compromised. It is a good idea to keep a copy of this in a safe place.

After generating a key, use "sq key extract-cert" to get the certificate corresponding to the key. The key must be kept secure, while the certificate should be handed out to correspondents, e.g. by uploading it to a keyserver.

OPTIONS

-u, --userid=EMAIL

Adds a userid to the key

-c, --cipher-suite=CIPHER-SUITE [default: cv25519] [possible values: rsa3k, rsa4k, cv25519]

Selects the cryptographic algorithms for the key

--with-password

Protects the key with a password

--creation-time=CREATION_TIME

Sets the key's creation time to TIME. TIME is interpreted as an ISO 8601 timestamp. To set the creation time to June 9, 2011 at midnight UTC, you can do:

$ sq key generate --creation-time 20110609 --export noam.pgp

To include a time, add a T, the time and optionally the timezone (the default timezone is UTC):

$ sq key generate --creation-time 20110609T1938+0200 --export noam.pgp

--expires=TIME

Makes the key expire at TIME (as ISO 8601). Use "never" to create keys that do not expire.

--expires-in=DURATION

Makes the key expire after DURATION. Either "N[ymwds]", for N years, months, weeks, days, seconds, or "never".

--can-sign

Adds a signing-capable subkey (default)

--cannot-sign

Adds no signing-capable subkey

--can-authenticate

Adds an authentication-capable subkey (default)

--cannot-authenticate

Adds no authentication-capable subkey

--can-encrypt=PURPOSE [possible values: transport, storage, universal]

Adds an encryption-capable subkey. Encryption-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both. [default: universal]

--cannot-encrypt

Adds no encryption-capable subkey

-e, --export=OUTFILE

Writes the key to OUTFILE

--rev-cert=FILE or -

Writes the revocation certificate to FILE. mandatory if OUTFILE is "-". [default: <OUTFILE>.rev]

-h, --help

Print help information

EXAMPLES

First, this generates a key

 sq key generate --userid "<juliet@example.org>" --export juliet.key.pgp

Then, this extracts the certificate for distribution

 sq key extract-cert --output juliet.cert.pgp juliet.key.pgp

Generates a key protecting it with a password

 sq key generate --userid "<juliet@example.org>" --with-password

Generates a key with multiple userids

 sq key generate --userid "<juliet@example.org>" --userid "Juliet Capulet"

SEE ALSO

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1) sq-inspect(1) sq-key(1) sq-key-adopt(1) sq-key-attest-certifications(1) sq-key-extract-cert(1) sq-key-password(1) sq-key-userid(1) sq-keyring(1) sq-keyserver(1) sq-packet(1) sq-revoke(1) sq-sign(1) sq-verify(1) sq-wkd(1)