# xmlsec

Index

## NAME

xmlsec - command line tool to sign and encrypt XML documents

## SYNOPSIS

    xmlsec [COMMAND] [OPTIONS] [FILE1] [FILE2] [....]

## INTRODUCTION

The xmlsec program signs or encrypts XML files, specified on the command line as FILE1, FILE2, ... according to "XML Digital Signature" and "XML Encryption" specifications.

The xmlsec program is included in XML Security Library.

## COMMANDS

version
  Prints version information for the xmlsec program.

help
  Prints general help information.

help-command
  Prints help information for command.

keys
  Manages keys in XML keys file. The result keys file is written to the FILE1, FILE2, ... files.

sign
  Signs XML documents FILE1, FILE2, ...

verify
  Verifies XML signature in the XML documents FILE1, FILE2, ...

encrypt
  Encrypts data using templates from FILE1, FILE2, ... files.

decrypt
  Decrypts encrypted XML documents FILE1, FILE2, ...

## KEYS COMMAND OPTIONS

--gen-hmac name
  Generates 24 bytes HMAC key and sets the key name to name.

--gen-rsa name
  Generates RSA key and sets the key name to name.

--gen-dsa name
  Generates DSA key and sets the key name to name.

--gen-des3 name
  Generates Tripple DES key and sets the key name to name.

--gen-aes128 name
  Generates AES 128 key and sets the key name to name.

--gen-aes192 name
  Generates AES 192 key and sets the key name to name.

--gen-aes256 name
  Generates AES 256 key and sets the key name to name.

--keys file
  Loads keys from XML keys file.

--pubkey[:name] file
  Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
  Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
  Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--pwd password
  Sets the password to use for reading keys and certificates from PEM files.

--hmackey[:name] file
  Loads HMAC key from binary file and sets the key name to name.

## SIGN COMMAND OPTIONS

--ignore-manifests
  Instructs the xmlsec program to ignore <dsig:Manifest> elements.

--node-id id
  Instructs the xmlsec program to sign only <dsig:Signature> element with given id.

--keys file
  Loads keys from XML keys file.

--pubkey[:name] file
  Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
  Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
  Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
  Loads HMAC key from binary file and sets the key name to name.

--pwd password
  Sets the password to use for reading keys and certificates from PEM files.

--allowed list
  Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--session-key-hmac
  Generates and uses for signature 24 bytes HMAC key.

--session-key-rsa
  Generates and uses for signature RSA key.

--session-key-dsa
  Generates and uses for signature DSA key.

--repeat number
  Repeats the operation number times.

--fake-signatures
  Disables actual signature calculation for performance testing.

## VERIFY COMMAND OPTIONS

--output file
  Writes the signed XML document to file.

--ignore-manifests
  Instructs the xmlsec program to ignore <dsig:Manifest> elements.

--node-id id
  Instructs the xmlsec program to sign only <dsig:Signature> element with given id.

--print-result
  Prints additional result information.

--print-references
  Prints the pre-digested signature references.

--print-manifests
  Prints the pre-digested manifests references.

--print-siganture
  Prints the pre-signated data (<dsig:SignedInfo> element).

--print-all
  Prints all available data.

--keys file
  Loads keys from XML keys file.

--pubkey[:name] file
  Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
  Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
  Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
  Loads HMAC key from binary file and sets the key name to name.

--pwd password
  Sets the password to use for reading keys and certificates from PEM files.

--allowed list
  Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--trusted file
  Loads trusted certificate from PEM file.

--untrusted file
  Loads un-trusted certificate from PEM file.

--repeat number
  Repeats the operation number times.

--fake-signatures
  Disables actual signature calculation for performance testing.

## ENCRYPT COMMAND OPTIONS

--output file
  Writes the encrypted XML document to file.

--binary file
  Encrypts binary file.

--xml file
  Encrypts XML file.

--node-id id
  Instructs the xmlsec program to encrypt only element with given id.

--node-name [namespace-uri:]name
  Instructs the xmlsec program to encrypt only element with given namespace-uri and name.

--keys file
  Loads keys from XML keys file.

--pubkey[:name] file
  Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
  Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
  Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
  Loads HMAC key from binary file and sets the key name to name.

--pwd password
  Sets the password to use for reading keys and certificates from PEM files.

--allowed list
  Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--session-key-rsa
  Generates and uses for encryption RSA key.

--session-key-des3
  Generates and uses for encryption Tripple DES key.

--session-key-aes128
  Generates and uses for encryption AES 128 key.

--session-key-aes192
  Generates and uses for encryption AES 192 key.

--session-key-256
  Generates and uses for encryption AES 256 key.

--repeat number
  Repeats the operation number times.

## DECRYPT COMMAND OPTIONS

--output file
  Writes the decrypted XML document to file.

--node-id id
  Instructs the xmlsec program to decrypt only element with given id.

--keys file
  Loads keys from XML keys file.

--pubkey[:name] file
  Loads public key from PEM file and sets the key name to name.

--privkey[:name] file[,cafile1[,cafile2[,...]]]
  Loads private key from PEM file along with certificates chain in PEM files cafile1, cafile2,... and sets the key name to name.

--pkcs12[:name] file
  Loads private key and certificates chain from pkcs12 file and sets the key name to name.

--hmackey[:name] file
  Loads HMAC key from binary file and sets the key name to name.

--pwd password
  Sets the password to use for reading keys and certificates from PEM files.

--allowed list
  Specifies the set of the allowed key origins as a comma separated list of the following values: "keymanager", "keyname", "keyvalue", "retrieval-doc", "retrieval-remote", "enc-key", "x509". By default, all key origins are allowed.

--trusted file
  Loads trusted certificate from PEM file.

--untrusted file
  Loads un-trusted certificate from PEM file.

--repeat number
  Repeats the operation number times.

## REPORTING BUGS

Report bugs to <xmlsec@aleksey.com>

## MORE INFORMATION

XML Security Library: http://www.aleksey.com/xmlsec/

XML Digital Signature: http://www.w3.org/Signature/

XML Encrytpion: http://www.w3.org/Encryption/

## AUTHOR

Aleksey Sanin <aleksey@aleksey.com>.

## COPYRIGHT

Copyright 2002 Aleksey Sanin <aleksey@aleksey.com>

## Index

NAME
SYNOPSIS
INTRODUCTION
COMMANDS
KEYS COMMAND OPTIONS
SIGN COMMAND OPTIONS
VERIFY COMMAND OPTIONS
ENCRYPT COMMAND OPTIONS
DECRYPT COMMAND OPTIONS
REPORTING BUGS
MORE INFORMATION
AUTHOR
COPYRIGHT

This document was created by man2html, using the manual pages.
Time: 02:31:41 GMT, August 15, 2002