dsa(1ssl)dsa(1ssl)NAMEdsa - DSA key processing
SYNOPSIS
openssl dsa [-inform PEM | DER] [-outform PEM | DER] [-in filename]
[-passin arg] [-out filename] [-passout arg] [-des] [-des3] [-idea]
[-text] [-noout] [-modulus] [-pubin] [-pubout]
OPTIONS
Specifies the input format. The DER option with a private key uses an
ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of
version (currently zero), p, q, g, the public and private key compo‐
nents respectively as ASN.1 INTEGERs. When used with a public key it
uses a SubjectPublicKeyInfo structure. It is an error if the key is not
DSA.
The PEM form is the default format. It consists of the DER for‐
mat base64 encoded with additional header and footer lines. In
the case of a private key PKCS#8 format is also accepted. Spec‐
ifies the output format. The options have the same meaning as
the -inform option. Specifies the input filename to read a key
from or standard input if this option is not specified. If the
key is encrypted, there will be a prompt for a pass phrase.
Input file password source. For more information about the for‐
mat of arg, see the Pass Phrase Arguments section in
openssl(1ssl). Specifies the output filename to write a key to
or standard output by is not specified. If any encryption
options are set there will be a prompt for a pass phrase. The
output filename should not be the same as the input filename.
Output file password source. For more information about the for‐
mat of arg, see the Pass Phrase Arguments section in
openssl(1ssl). These options encrypt the private key with the
DES, triple DES, or the IDEA ciphers respectively before out‐
putting it. There is a prompt for a pass phrase. If none of
these options is specified the key is written in plain text.
This means that using the dsa utility to read in an encrypted
key with no encryption option can be used to remove the pass
phrase from a key, or by setting the encryption options it can
be use to add or change the pass phrase. These options can only
be used with PEM format output files. Prints the public, pri‐
vate key components and parameters. Prevents output of the
encoded version of the key. Prints the value of the public key
component of the key. By default, a private key is read from
the input file. With this option a public key is read instead.
By default a private key is output. With this option a public
key will be output instead. This option is automatically set if
the input is a public key.
DESCRIPTION
The dsa command processes DSA keys. They can be converted between vari‐
ous forms and their components printed out. This command uses the tra‐
ditional SSLeay compatible format for private key encryption. Newer
applications should use the more secure PKCS#8 format using the pkcs8
command.
NOTES
The PEM private key format uses the header and footer lines:
-----BEGIN DSA PRIVATE KEY-----
-----END DSA PRIVATE KEY-----
The PEM public key format uses the header and footer lines:
-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----
EXAMPLES
To remove the pass phrase on a DSA private key:
openssl dsa-in key.pem -out keyout.pem
To encrypt a private key using triple DES:
openssl dsa-in key.pem -des3 -out keyout.pem
To convert a private key from PEM to DER format:
openssl dsa-in key.pem -outform DER -out keyout.der
To print out the components of a private key to standard output:
openssl dsa-in key.pem -text -noout
To just output the public part of a private key:
openssl dsa-in key.pem -pubout -out pubkey.pem
SEE ALSO
Commands: dsaparam(1ssl), gendsa(1ssl), rsa(1ssl), genrsa(1ssl)dsa(1ssl)