Next: , Previous: Creating a Database, Up: Tutorial



2.3 Generating Keys

Now Jim, Abe and Beth must each generate an rsa key pair for themselves. This step requires choosing a key identifier. Typical key identifiers are similar to email addresses, possibly modified with some prefix or suffix to distinguish multiple keys held by the same owner. Our example programmers will use their email addresses at the fictional “juicebot.co.jp” domain name. When we ask for a key to be generated, monotone will ask us for a passphrase. This phrase is used to encrypt the key when storing it on disk, as a security measure.

Jim does the following:

     $ monotone --db=~/jim.db genkey jim@juicebot.co.jp
     enter passphrase for key ID [jim@juicebot.co.jp] : <Jim enters his passphrase>
     monotone: generating key-pair 'jim@juicebot.co.jp'
     monotone: storing key-pair 'jim@juicebot.co.jp' in database

Abe does something similar:

     $ monotone --db=~/abe.db genkey abe@juicebot.co.jp
     enter passphrase for key ID [abe@juicebot.co.jp] : <Abe enters his passphrase>
     monotone: generating key-pair 'abe@juicebot.co.jp'
     monotone: storing key-pair 'abe@juicebot.co.jp' in database

as does Beth:

     $ monotone --db=~/beth.db genkey beth@juicebot.co.jp
     enter passphrase for key ID [beth@juicebot.co.jp] : <Beth enters her passphrase>
     monotone: generating key-pair 'beth@juicebot.co.jp'
     monotone: storing key-pair 'beth@juicebot.co.jp' in database

Each programmer has now generated a key pair and placed it in their local database. Each can list the keys in their database, to ensure the correct key was generated. For example, Jim might see this:

     $ monotone --db=~/jim.db list keys
     
     [public keys]
     9e9e9ef1d515ad58bfaa5cf282b4a872d8fda00c jim@juicebot.co.jp
     
     
     [private keys]
     771ace046c27770a99e5fddfa99c9247260b5401 jim@juicebot.co.jp

The hexadecimal string printed out before each key name is a fingerprint of the key, and can be used to verify that the key you have stored under a given name is the one you intended to store. Monotone will never permit one database to store two keys with the same name or the same fingerprint.

This output shows one private and one public key stored under the name jim@juicebot.co.jp, so it indicates that Jim's key-pair has been successfully generated and stored. On subsequent commands, Jim will need to re-enter our passphrase in order to perform security-sensitive tasks. To simplify matters, Jim decides to store his security passphrase in his .monotonerc file, by writing a hook function which returns the passphrase, so that he does not need to repeatedly be prompted for it:

     $ cat >>~/.monotonerc
     function get_passphrase(keypair_id)
       return "jimsekret"
     end
     ^D

Note that we are appending the new hook to the (possibly existing) file. We do this to avoid loosing other changes by mistake; therefore, be sure to check that no other get_passphrase function appears in the configuration file.

Abe and Beth do the same, with their secret passphrases.