'''ssh-keygen''' 中的 -k 标志有什么作用？

Question

根据ssh-keygen的手册 , -k 标志生成一些 KRL 文件。这些 KRL 文件是什么意思以及我如何在使用此标志时指定 KRL 位置？

Answer 1

根据 FreeBSD 手册页 BSD General Commands Manual :

KEY REVOCATION LISTS ssh-keygen is able to manage OpenSSH format Key Revocation Lists (KRLs). These binary files specify keys or certificates to be revoked using a compact format, taking as little as one bit per certificate if they are being revoked by serial number.

KRLs may be generated using the -k flag. This option reads one or more files from the command line and generates a new KRL. The files may ei- ther contain a KRL specification (see below) or public keys, listed one per line. Plain public keys are revoked by listing their hash or con- tents in the KRL and certificates revoked by serial number or key ID (if the serial is zero or not available).

Revoking keys using a KRL specification offers explicit control over the types of record used to revoke keys and may be used to directly revoke certificates by serial number or key ID without having the complete orig- inal certificate on hand. A KRL specification consists of lines contain- ing one of the following directives followed by a colon and some direc- tive-specific information.

 serial: serial_number[-serial_number]
     Revokes a certificate with the specified serial number.  Serial
     numbers are 64-bit values, not including zero and may be ex-
     pressed in decimal, hex or octal.  If two serial numbers are
     specified separated by a hyphen, then the range of serial numbers
     including and between each is revoked.  The CA key must have been
     specified on the ssh-keygen command line using the -s option.

 id: key_id
     Revokes a certificate with the specified key ID string.  The CA
     key must have been specified on the ssh-keygen command line using
     the -s option.

 key: public_key
     Revokes the specified key.  If a certificate is listed, then it
     is revoked as a plain public key.

 sha1: public_key
     Revokes the specified key by its SHA1 hash.

 KRLs may be updated using the -u flag in addition to -k.  When this op-
 tion is specified, keys listed via the command line are merged into the
 KRL, adding to those already there.

 It is also possible, given a KRL, to test whether it revokes a particular
 key (or keys).  The -Q flag will query an existing KRL, testing each key
 specified on the command line.  If any key listed on the command line has
 been revoked (or an error encountered) then ssh-keygen will exit with a
 non-zero exit status.  A zero exit status will only be returned if no key
 was revoked.

'''ssh-keygen''' 中的 -k 标志有什么作用？

what does the -k flag in '''ssh-keygen''' do?

openssh