=pod

=head1 NAME

add_key - add new keys to an existing PKI tree for secure boot on NXP i.MX processors

=head1 SYNOPSIS

=over 4

=item Interactive mode

B<add_key>

=item Non-interactive mode

B<add_key> B<-ver> I<hab_version> B<-key-name> I<name> B<-kt> I<algo> B<-kl> I<param> [B<-md> I<algo>]
B<-duration> I<years> B<-srk> I<yn> [B<-srk-ca> I<yn>] B<-signing-key> I<name> B<-signing-crt> I<name>

=back

=head1 NOTE

This manpage is a short description of NXP B<add_key>.
For a detailed discussion refer to the Code Signing Tool User Guide UG10106, section 4.1.5.
The user guide can be obtained from www.nxp.com and is excluded from Debian for copyright reasons.

=head1 DESCRIPTION

B<add_key> adds an SRK or CSF/IMG/SGK key to an existing PKI tree that has
previously been created with B<ahab_pki_tree> or B<hab4_pki_tree> in crts and
keys sub directories.

The directories are expected in the current working directory.

If no arguments are provided, the command starts in interactive mode and will
prompt for options.

=head1 OPTIONS

=over 4

=item B<-ver> I<hab_version>

The HAB version of the PKI tree.
One of B<4> for HAB4, or B<a> for AHAB.

=item B<-key-name> I<name>

Name of the key to be generated.

=item B<-kt> I<algo>

Public key algorithm to use.
One of B<rsa>, B<rsa-pss>, B<ecc>.

=item B<-kl> I<param>

For I<algo> B<ecc>, one of B<p256>, B<p384>, B<p521>.

For I<algo> B<rsa> and B<rsa-pss>, the key length in bits.
One of B<2048>, B<3072>, B<4096>.

=item B<-md> I<algo>

The hash function to use.

This option is only valid for I<hab_version> B<a> and can be one of B<sha256>, B<sha384>, B<sha512>.

For I<hab_version> B<4>, hash function is fixed to B<sha256>.

=item B<-duration> I<years>

Validity period of the generated certificate in years.

=item B<-srk> I<yn>

B<y> to generate a new SRK key, or B<n> to generate a CSF/IMG/SGK key.

=item B<-srk-ca> I<yn>

B<y> to generate SRK certificates where the CA flag is set.
Such SRK certificates can be used to issue other certificates.

B<n> to generate a user certificates.

=item B<-signing-key> I<file>

Path to existing signing key in PEM or DER encoding.
If B<-srk> was B<y>, I<file> must specify the CA key.
If B<-srk> was B<n>, I<file> must specify the SRK.

=item B<-signing-cert> I<file>

Path to existing signing certificate.
If B<-srk> was B<y>, I<file> must specify the CA certificate.
If B<-srk> was B<n>, I<file> must specify the SRK certificate.

=item B<--help>

Print help text.

=back

=head1 EXAMPLES

As starting point, generate a PKI tree with two SRKs.
This must be done in a directory where the current user has write permissions.

  hab4_pki_tree -existing-ca n -kt rsa -kl 4096 -duration 5 -num-srk 2 -srk-ca y

Then, to add a new SRK to the PKI tree

  add_key -ver 4 -key-name SRK3 -kt rsa -kl 4096 -duration 5 -srk y -srk-ca y -signing-key keys/CA1_sha256_4096_65537_v3_ca_key.pem -signing-crt crts/CA1_sha256_4096_65537_v3_ca_crt.pem

=head1 SEE ALSO

L<hab4_pki_tree(1)>, L<ahab_pki_tree(1)>

=cut
