SQ(1)

NAME
sq key generate - Generates a new key

SYNOPSIS
sq [GLOBAL OPTIONS] key generate [OPTIONS]

DESCRIPTION
Generates a new key.

Generating a key is the prerequisite to receiving encrypted messages and creating signatures. There are a few parameters to this process, but we provide reasonable defaults for most users.

When generating a key, we also generate a revocation certificate. This can be used in case the key is superseded, lost, or compromised. It is a good idea to keep a copy of this in a safe place.

After generating a key, use "sq key extract-cert" to get the certificate corresponding to the key. The key must be kept secure, while the certificate should be handed out to correspondents, e.g. by uploading it to a keyserver.

By default a key expires after 3 years. Using the "--expiry=EXPIRY" argument specific validity periods may be defined. It allows for providing a point in time for validity to end or a validity duration.

"sq key generate" respects the reference time set by the top-level "--time" argument. It sets the creation time of the key, any subkeys, and the binding signatures to the reference time.

OPTIONS

  Global options

--cert-store=PATH
    Specifies the location of the certificate store

-f, --force=FORCE
    Overwrites existing files

--keyring=PATH
    Specifies the location of a keyring to use

--known-notation=NOTATION
    Adds NOTATION to the list of known notations

--no-cert-store=NO_CERT_STORE
    Disables the use of a certificate store

--output-format=FORMAT
    Produces output in FORMAT, if possible

--output-version=VERSION
    Produces output variant VERSION.

--pep-cert-store=PATH
    Specifies the location of a pEp certificate store

--time=TIME
    Sets the reference time as ISO 8601 formatted timestamp

--trust-root=FINGERPRINT|KEYID
    Considers the specified certificate to be a trust root

  Subcommand options

-c, --cipher-suite=CIPHER-SUITE
    Selects the cryptographic algorithms for the key

--can-authenticate=CAN_AUTHENTICATE
    Adds an authentication-capable subkey (default)

--can-encrypt=PURPOSE
    Adds an encryption-capable subkey [default: universal]

--can-sign=CAN_SIGN
    Adds a signing-capable subkey (default)

--cannot-authenticate=CANNOT_AUTHENTICATE
    Adds no authentication-capable subkey

--cannot-encrypt=CANNOT_ENCRYPT
    Adds no encryption-capable subkey

--cannot-sign=CANNOT_SIGN
    Adds no signing-capable subkey

--expiry=EXPIRY
    Defines EXPIRY for the key as ISO 8601 formatted string or custom duration.

-o, --output=FILE
    Writes to FILE or stdout if omitted

--rev-cert=FILE or -
    Writes the revocation certificate to FILE

-u, --userid=EMAIL
    Adds a userid to the key

--with-password=WITH_PASSWORD
    Protects the key with a password

EXAMPLES

First, this generates a key

    sq key generate --userid "<juliet@example.org>" --output juliet.key.pgp

Then, this extracts the certificate for distribution

    sq key extract-cert --output juliet.cert.pgp juliet.key.pgp

Generates a key protecting it with a password

    sq key generate --userid "<juliet@example.org>" --with-password

Generates a key with multiple userids

    sq key generate --userid "<juliet@example.org>" --userid "Juliet Capulet"

Generates a key whose creation time is June 9, 2011 at midnight UTC

    sq key generate --time 20110609 --userid "Noam" --output noam.pgp

SEE ALSO
sq(1).

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

VERSION
0.31.0 (sequoia-openpgp 1.16.0, using Nettle 3.9 (Cv448: true))