generate(1)

NAME
generate - Generates a new key

SYNOPSIS
generate [-u|--userid] [-c|--cipher-suite] [--with-password] [--expires] [--expires-in] [--can-sign] [--cannot-sign] [--can-authenticate] [--cannot-authenticate] [--can-encrypt] [--cannot-encrypt] [-e|--export] [--rev-cert] [-h|--help]

DESCRIPTION
Generates a new key

Generating a key is the prerequisite to receiving encrypted messages and creating signatures. There are a few parameters to this process, but we provide reasonable defaults for most users.

When generating a key, we also generate a revocation certificate. This can be used in case the key is superseded, lost, or compromised. It is a good idea to keep a copy of this in a safe place.

After generating a key, use "sq key extract-cert" to get the certificate corresponding to the key. The key must be kept secure, while the certificate should be handed out to correspondents, e.g. by uploading it to a keyserver.

"sq key generate" respects the reference time set by the top-level "--time" argument. It sets the creation time of the key, any subkeys, and the binding signatures to the reference time.

OPTIONS

-u, --userid=EMAIL
    Adds a userid to the key

-c, --cipher-suite=CIPHER-SUITE [default: cv25519]
    Selects the cryptographic algorithms for the key
    [possible values: rsa3k, rsa4k, cv25519]

--with-password=WITH_PASSWORD
    Protects the key with a password

--expires=TIME
    Makes the key expire at TIME (as ISO 8601). Use "never" to create keys that do not expire.

--expires-in=DURATION
    Makes the key expire after DURATION. Either "N[ymwds]", for N years, months, weeks, days, seconds, or "never".

--can-sign=CAN_SIGN
    Adds a signing-capable subkey (default)

--cannot-sign=CANNOT_SIGN
    Adds no signing-capable subkey

--can-authenticate=CAN_AUTHENTICATE
    Adds an authentication-capable subkey (default)

--cannot-authenticate=CANNOT_AUTHENTICATE
    Adds no authentication-capable subkey

--can-encrypt=PURPOSE
    Adds an encryption-capable subkey. Encryption-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both. [default: universal]
    [possible values: transport, storage, universal]

--cannot-encrypt=CANNOT_ENCRYPT
    Adds no encryption-capable subkey

-e, --export=OUTFILE
    Writes the key to OUTFILE

--rev-cert=FILE or -
    Writes the revocation certificate to FILE. mandatory if OUTFILE is "-". [default: <OUTFILE>.rev]

-h, --help
    Print help information (use `-h` for a summary)

EXTRA
EXAMPLES: # First, this generates a key $ sq key generate --userid "<juliet@example.org>" --export juliet.key.pgp # Then, this extracts the certificate for distribution $ sq key extract-cert --output juliet.cert.pgp juliet.key.pgp # Generates a key protecting it with a password $ sq key generate --userid "<juliet@example.org>" --with-password # Generates a key with multiple userids $ sq key generate --userid "<juliet@example.org>" --userid "Juliet Capulet" # Generates a key whose creation time is June 9, 2011 at midnight UTC $ sq key generate --time 20110609 --userid "Noam" --export noam.pgp