SQ(1)

NAME
sq key generate - Generate a new key

SYNOPSIS
sq key generate [OPTIONS]

DESCRIPTION
Generate a new key.

Generating a key is the prerequisite to receiving encrypted messages and creating signatures. There are a few parameters to this process, but we provide reasonable defaults for most users.

When generating a key, we also generate an emergency revocation certificate. This can be used in case the key is lost or compromised. It is saved alongside the key. This can be changed using the `--rev-cert` argument.

By default a key expires after 3 years. This can be changed using the `--expiration` argument.

`sq key generate` respects the reference time set by the top-level `--time` argument. It sets the creation time of the primary key, any subkeys, and the binding signatures to the reference time.

OPTIONS

  Subcommand options

--allow-non-canonical-userids
    Don't reject user IDs that are not in canonical form.

    Canonical user IDs are of the form `Name (Comment) <localpart@example.org>`.

--can-authenticate
    Add an authentication-capable subkey (default)

--can-encrypt=PURPOSE
    Add an encryption-capable subkey.

    Encryption-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both, i.e., universal. [default: universal]

    [possible values: transport, storage, universal]

--can-sign
    Add a signing-capable subkey (default)

--cannot-authenticate
    Don't add an authentication-capable subkey

--cannot-encrypt
    Don't add an encryption-capable subkey

--cannot-sign
    Don't add a signing-capable subkey

--cipher-suite=CIPHER-SUITE
    Select the cryptographic algorithms for the key

    [default: cv25519]

    [possible values: rsa2k, rsa3k, rsa4k, cv25519]

--email=ADDRESS
    Add an email address as user ID to the key

--expiration=EXPIRATION
    Sets the certificate's expiration time.

    EXPIRATION is either an ISO 8601 formatted string or a custom duration, which takes the form `N[ymwds]`, where the letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword `never` does not set an expiration time.

    When using an ISO 8601 formatted string, the validity period is from the certificate's creation time to the specified time. When using a duration, the validity period is from the certificate's creation time for the specified duration.

    [default: 3y]

--name=NAME
    Add a name as user ID to the key

--new-password-file=PASSWORD_FILE
    File containing password to encrypt the secret key material.

    Note that the entire key file will be used as the password including any surrounding whitespace like a trailing newline.

--no-userids
    Create a key without any user IDs

--output=FILE
    Write the key to the specified file.

    When not specified, the key is saved on the key store.

--rev-cert=FILE
    Write the emergency revocation certificate to FILE.

    When the key is stored on the key store, the revocation certificate is stored in $HOME/Library/Application Support/org.Sequoia-PGP.sequoia/revocation-certificates by default.

    When `--output` is specified, the revocation certificate is written to `FILE.rev` by default.

    If `--output` is `-`, then this option must be provided.

--userid=USERID
    Add a user ID to the key.

    This user ID can combine name and email address, can optionally contain a comment, or even be free-form if `--allow-non-canonical-userids` is given. However, user IDs that include different information such as name and email address are more difficult to reason about, so using distinct user IDs for name and email address is preferred nowadays.

    In doubt, prefer `--name` and `--email`.

--without-password
    Don't protect the secret key material with a password

  Global options
See sq(1) for a description of the global options.

EXAMPLES

Generate a key, and save it on the key store.

    sq key generate --without-password --name Alice --email \
        alice@example.org

Generate a key, and save it in a file instead of in the key store.

    sq key generate --without-password --name Alice --email \
        alice@example.org --output alice-priv.pgp

Strip the secret key material from the new key.

    sq toolbox extract-cert alice-priv.pgp --output alice.pgp

SEE ALSO
sq(1), sq-key(1).

For the full documentation see <https://book.sequoia-pgp.org>.

VERSION
0.38.0 (sequoia-openpgp 1.21.2)