| [7f30af7] | 1 | .TH creddy 1 "September 2010" "ABAC 0.1.2" |
|---|
| [b02d665] | 2 | |
|---|
| 3 | .SH NAME |
|---|
| 4 | creddy \- ABAC X.509 identity and attribute certificate manager (for cool kids) |
|---|
| 5 | |
|---|
| 6 | .SH SYNOPSIS |
|---|
| 7 | |
|---|
| 8 | .B creddy [ --<mode> ] --help |
|---|
| 9 | |
|---|
| 10 | .SH DESCRIPTION |
|---|
| 11 | |
|---|
| 12 | creddy is an awesome and wonderful ABAC credential management tool. It |
|---|
| 13 | creates, verifies, and otherwise frobnicates X.509 identity and |
|---|
| 14 | attribute certificates. The output of the tool is suitable for use with |
|---|
| 15 | ABAC. Additionally, the self-signed X.509 identity certs (with |
|---|
| 16 | associated private keys) can be used with OpenSSL. |
|---|
| 17 | |
|---|
| 18 | .SH OPTIONS |
|---|
| 19 | |
|---|
| 20 | .SS --generate |
|---|
| 21 | Generate an X.509 identity cert and private key pair. The certificate is saved in ${cn}_id.pem and the private key is saved in ${cn}_private.pem. |
|---|
| 22 | .P |
|---|
| 23 | Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems. |
|---|
| 24 | |
|---|
| 25 | .TP |
|---|
| 26 | .B --cn |
|---|
| 27 | common name used on certificate, provided as a convenience and ignored by ABAC |
|---|
| 28 | |
|---|
| 29 | .TP |
|---|
| 30 | .B --validity |
|---|
| 31 | optional certificate validity in days, default is 1080 |
|---|
| 32 | |
|---|
| 33 | .SS --verify |
|---|
| 34 | verify the signature on a self-signed X.509 identity cert or an X.509 attribute cert |
|---|
| 35 | |
|---|
| 36 | .TP |
|---|
| 37 | .B --cert |
|---|
| 38 | self-signed X.509 identity cert |
|---|
| 39 | |
|---|
| 40 | .TP |
|---|
| 41 | .B --attrcert |
|---|
| 42 | optional X.509 attribute cert. If omitted the self-signature of the ID cert is checked |
|---|
| 43 | |
|---|
| 44 | .SS --keyid |
|---|
| 45 | extract the subjectKeyIdentifier (SHA1 hash) from an X.509 identity cert |
|---|
| 46 | |
|---|
| 47 | .TP |
|---|
| 48 | .B --cert |
|---|
| 49 | X.509 identity cert |
|---|
| 50 | |
|---|
| 51 | .SS --attribute |
|---|
| 52 | generate an X.509 attribute cert representing an ABAC credential |
|---|
| 53 | |
|---|
| [7f30af7] | 54 | An attribute cert has one or more subjects. A single subject may be defined without a role. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-role. Providing multiple subjects creates an intersection certificate. |
|---|
| 55 | |
|---|
| [b02d665] | 56 | .TP |
|---|
| 57 | .B --issuer |
|---|
| 58 | X.509 identity cert issuing the credential |
|---|
| 59 | |
|---|
| 60 | .TP |
|---|
| 61 | .B --key |
|---|
| 62 | private key associated with issuer cert |
|---|
| 63 | |
|---|
| 64 | .TP |
|---|
| 65 | .B --role |
|---|
| 66 | role in issuer's local attribute space |
|---|
| 67 | |
|---|
| 68 | .TP |
|---|
| 69 | .B --subject-cert |
|---|
| [7f30af7] | 70 | X.509 identity cert representing the principal to which the role is being issued. This fulfills the same purpose as --subject-id and should only be used once per subject. |
|---|
| [b02d665] | 71 | |
|---|
| 72 | .TP |
|---|
| 73 | .B --subject-id |
|---|
| [7f30af7] | 74 | public key identifier (SHA1 hash) of the principal to which the role is being issued. This fulfills the same purpose as --subject-cert and should only be used once per subject. |
|---|
| [b02d665] | 75 | |
|---|
| 76 | .TP |
|---|
| 77 | .B --subject-role |
|---|
| [19be896] | 78 | optional role in subject's local attribute space. If the issuer is A, role is r1, subject is B, and subject-role is r2, the attribute issued will be A.r1 <- B.r2. |
|---|
| [b02d665] | 79 | |
|---|
| 80 | .TP |
|---|
| 81 | .B --validity |
|---|
| 82 | optional certificate validity in days, default is 365 |
|---|
| 83 | |
|---|
| 84 | .TP |
|---|
| 85 | .B --out |
|---|
| 86 | where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der. |
|---|
| 87 | |
|---|
| [7f30af7] | 88 | |
|---|
| [b02d665] | 89 | .SS --roles |
|---|
| 90 | Extract the roles from an X.509 attribute cert |
|---|
| 91 | |
|---|
| 92 | .TP |
|---|
| 93 | .B --cert |
|---|
| 94 | X.509 attribute cert containing ABAC roles |
|---|
| 95 | |
|---|
| [19be896] | 96 | .SS --version |
|---|
| 97 | display ABAC/creddy version |
|---|
| 98 | |
|---|
| [b02d665] | 99 | .SH EXAMPLES |
|---|
| 100 | |
|---|
| 101 | .TP |
|---|
| 102 | Generate ID cert and private key pairs: |
|---|
| 103 | |
|---|
| 104 | .B creddy --generate --cn Alice |
|---|
| 105 | .br |
|---|
| 106 | .B creddy --generate --cn Bob |
|---|
| 107 | |
|---|
| 108 | .TP |
|---|
| 109 | Issue the credential Alice.friend <- Bob |
|---|
| 110 | |
|---|
| 111 | creddy --attribute \\ |
|---|
| 112 | --issuer Alice_ID.pem --key Alice_private.pem \\ |
|---|
| 113 | --role friend --subject-cert Bob_ID.pem \\ |
|---|
| 114 | --out Alice_friend__Bob_attr.der |
|---|
| 115 | |
|---|
| 116 | .SH AUTHOR |
|---|
| 117 | |
|---|
| 118 | Written by Mike Ryan <mikeryan@ISI.EDU>. Like what you see? Buy me a beer! |
|---|
| 119 | |
|---|
| 120 | .SH BUGS |
|---|
| 121 | |
|---|
| 122 | None yet. Report to http://abac.deterlab.net/ |
|---|
| 123 | |
|---|
| 124 | .SH COPYRIGHT |
|---|
| 125 | |
|---|
| 126 | Copyright (c) 2010 USC/ISI. Released under MIT license. See COPYING included with source for details. |
|---|
