doc/zerotier-idtool.1


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

.TH "ZEROTIER\-IDTOOL" "1" "December 2016" "" ""
.SH "NAME"
\fBzerotier-idtool\fR \- tool for creating and manipulating ZeroTier identities
.SH SYNOPSIS
.P
\fBzerotier\-idtool\fP <command> [args]
.SH DESCRIPTION
.P
\fBzerotier\-idtool\fR is a command line utility for doing things with ZeroTier identities\. A ZeroTier identity consists of a public/private key pair (or just the public if it's only an identity\.public) and a 10\-digit hexadecimal ZeroTier address derived from the public key by way of a proof of work based hash function\.
.SH COMMANDS
.P
When command arguments call for a public or secret (full) identity, the identity can be specified as a path to a file or directly on the command line\.
.RS 0
.IP \(bu 2
\fBhelp\fP:
Display help\. (Also running with no command does this\.)
.IP \(bu 2
\fBgenerate\fP [secret file] [public file] [vanity]:
Generate a new ZeroTier identity\. If a secret file is specified, the full identity including the private key will be written to this file\. If the public file is specified, the public portion will be written there\. If no file paths are specified the full secret identity is output to STDOUT\. The vanity prefix is a series of hexadecimal digits that the generated identity's address should start with\. Typically this isn't used, and if it's specified generation can take a very long time due to the intrinsic cost of generating identities with their proof of work function\. Generating an identity with a known 16\-bit (4 digit) prefix on a 2\.8ghz Core i5 (using one core) takes an average of two hours\.
.IP \(bu 2
\fBvalidate\fP <identity, only public part required>:
Locally validate an identity's key and proof of work function correspondence\.
.IP \(bu 2
\fBgetpublic\fP <full identity with secret>:
Extract the public portion of an identity\.secret and print to STDOUT\.
.IP \(bu 2
\fBsign\fP <full identity with secret> <file to sign>:
Sign a file's contents with SHA512+ECC\-256 (ed25519)\. The signature is output in hex to STDOUT\.
.IP \(bu 2
\fBverify\fP <identity, only public part required> <file to check> <signature in hex>:
Verify a signature created with \fBsign\fP\|\.
.IP \(bu 2
\fBmkcom\fP <full identity with secret> [id,value,maxdelta] [\|\.\.\.]:
Create and sign a network membership certificate\. This is not generally useful since network controllers do this automatically and is included mostly for testing purposes\.

.RE
.SH EXAMPLES
.P
Generate and dump a new identity:
.P
.RS 2
.nf
$ zerotier\-idtool generate
.fi
.RE
.P
Generate and write a new identity, both secret and public parts:
.P
.RS 2
.nf
$ zerotier\-idtool generate identity\.secret identity\.public
.fi
.RE
.P
Generate a vanity address that begins with the hex digits "beef" (this will take a while!):
.P
.RS 2
.nf
$ zerotier\-idtool generate beef\.secret beef\.public beef
.fi
.RE
.P
Sign a file with an identity's secret key:
.P
.RS 2
.nf
$ zerotier\-idtool sign identity\.secret last_will_and_testament\.txt
.fi
.RE
.P
Verify a file's signature with a public key:
.P
.RS 2
.nf
$ zerotier\-idtool verify identity\.public last_will_and_testament\.txt
.fi
.RE
.SH COPYRIGHT
.P
(c)2011\-2016 ZeroTier, Inc\. \-\- https://www\.zerotier\.com/ \-\- https://github\.com/zerotier
.SH SEE ALSO
.P
zerotier\-one(8), zerotier\-cli(1)