.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-KEY" "1" "2026\-08\-10"
.PP
.SH NAME
.PP
\fBsyd\-key\fR \- Utility to generate encryption keys and save to \fIkeyrings\fR(7)
.PP
.SH SYNOPSIS
.PP
\fBsyd\-key\fR \fI[\-hpP]\fR \fI[\-d keydesc]\fR \fI[\-t keytype]\fR \fI[\-k keyring]\fR \fI[\-m keyperm]\fR
.PP
.SH DESCRIPTION
.PP
\fBsyd\-key\fR utility generates random 256\-bit encryption keys using
\fIgetrandom\fR(2).\& Key is saved to linux \fIkeyrings\fR(7) and key serial ID is
printed as a decimal 32\-bit integer to \fIstdout\fR(3).\&
.PP
.SH OPTIONS
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB\-h\fR
T}	T{
Display help.\&
T}
T{
\fB\-p\fR
T}	T{
Read passphrase from the controlling tty (not \fIstdin\fR(3)) and derive key material.\&
T}
T{

T}	T{
\fBsyd\-key\fR will refuse to read the passphrase from \fIstdin\fR(3) for safety, unless \fB\-P\fR is explicitly supplied.\&
T}
T{

T}	T{
Passphrase is hashed using SHA3\-256.\& Resulting digest is stored with \fIkeyrings\fR(7) interface.\& Passphrase buffer is zeroized after use.\& Key serial ID is printed on \fIstdout\fR(3).\&
T}
T{

T}	T{
If none of \fB\-pP\fR is supplied, a random key is generated using \fIgetrandom\fR(2) instead.\&
T}
T{
\fB\-P\fR
T}	T{
Read passphrase from \fIstdin\fR(3) and derive key material.\&
T}
T{

T}	T{
This option is intended for non\-interactive use (for example, piping a passphrase from a password manager).\&
T}
T{

T}	T{
Passphrase is hashed using SHA3\-256.\& Resulting digest is stored with \fIkeyrings\fR(7) interface.\& Passphrase buffer is zeroized after use.\& Key serial ID is printed on \fIstdout\fR(3).\&
T}
T{

T}	T{
\fBUse with caution\fR: Reading a passphrase from \fIstdin\fR(3) can be less secure than reading from the controlling tty because it may be observable by other processes, recorded in shell constructs, or otherwise leaked by environment.\&
T}
T{

T}	T{
If none of \fB\-pP\fR is supplied, a random key is generated using \fIgetrandom\fR(2) instead.\&
T}
T{
\fB\-d kdesc\fR
T}	T{
Specify alternative key description.\& Default is \fBSYD\-3\-CRYPT\fR.\&
T}
T{
\fB\-t ktype\fR
T}	T{
Specify alternative key type.\& Default is \fBuser\fR.\&
T}
T{
\fB\-k kring\fR
T}	T{
Specify alternative key ring ID.\& Default is \fBuser\fR.\&
T}
T{

T}	T{
It may be exactly one of \fBthread\fR, \fBprocess\fR, \fBsession\fR, \fBuser\fR or \fBuser\-session\fR.\& It may also be a 32\-bit decimal number specifying a keyring ID.\&
T}
T{
\fB\-m kperm\fR
T}	T{
Set \fIkeyrings\fR(7) permission mask on the new key.\&
T}
T{

T}	T{
It may be hexadecimal (\fB0x\fR), octal (\fB0o\fR) or decimal.\&
T}
T{

T}	T{
When omitted, the key keeps its default permissions, which \fIsyd\fR(1) reads.\&
T}
.TE
.sp 1
.SH CAVEATS
.PP
Keys in \fIkeyrings\fR(7) are identified by their (type, description) pair.\&
When \fBsyd\-key\fR invokes \fIadd_key\fR(2) with a type/description that already
exists in the target keyring, the kernel will update the existing key'\&s
payload instead of creating a new key.\& To force creation of a new key,
use a unique description (for example by appending a UUID or timestamp).\&
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\-aes\fR(1), \fIgetrandom\fR(2), \fIadd_key\fR(2), \fIkeyctl\fR(2), \fIkeyrings\fR(7)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&