X-Git-Url: https://git.distorted.org.uk/u/mdw/catacomb/blobdiff_plain/f387fcb17a980fe165218d217b0187a8c279508a..298182ad446aaced14dea7ed0e7c968946787288:/catsign.1

diff --git a/catsign.1 b/catsign.1
index 9eb2398..3f1cd5e 100644
--- a/catsign.1
+++ b/catsign.1
@@ -44,7 +44,7 @@ is one of:
 .RI [ item ...]
 .br
 .B sign
-.RB [ \-adt ]
+.RB [ \-adtC ]
 .RB [ \-k
 .IR tag ]
 .RB [ \-f
@@ -54,11 +54,13 @@ is one of:
 .RI [ file ]
 .br
 .B verify
-.RB [ \-aquv ]
+.RB [ \-aquvC ]
 .RB [ \-k
 .IR tag ]
 .RB [ \-f
 .IR format ]
+.RB [ \-t
+.IR time ]
 .br
 	
 .RB [ \-o
@@ -241,6 +243,21 @@ algorithm of the
 command (see
 .BR key (1))
 to generate the key.
+.TP
+.B mac
+This uses a symmetric message-authentication algorithm rather than a
+digital signature.  The precise message-authentication scheme used is
+determined by the
+.B mac
+attribute on the key, which defaults to
+.IB hash -hmac
+if unspecified.  Use the
+.B binary
+algorithm of the
+.B key add
+command (see
+.BR key (1))
+to generate the key.
 .PP
 As well as the signature algorithm itself, a hash function is used.
 This is taken from the
@@ -401,6 +418,11 @@ rather than to standard output.
 .TP
 .B "\-t, \-\-text"
 Read and sign the input as text.  This is the default.
+.TP
+.B "\-C, \-\-nocheck"
+Don't check the private key for validity.  This makes signing go much
+faster, but at the risk of using a duff key, and potentially leaking
+information about the private key.
 .SS verify
 The
 .B verify
@@ -448,6 +470,15 @@ signature.  Using this option causes verification to fail unless the
 signature header specifies the key named
 .IR tag .
 .TP
+.BI "\-t, \-\-freshtime " time
+Only accept signatures claiming to have been made more recently than
+.IR time .
+If
+.I time
+is
+.B always
+(the default) then any timestamp in the past is acceptable.
+.TP
 .B "\-u, \-\-utc"
 Show the datestamp in the signature in UTC rather than (your) local
 time.  The synonym
@@ -461,6 +492,11 @@ The file is written in text or binary
 mode as appropriate.  The default is to write the message to standard
 output unless verifying a detached signature, in which case nothing is
 written.
+.TP
+.B "\-C, \-\-nocheck"
+Don't check the public key for validity.  This makes verification go
+much faster, but at the risk of using a duff key, and potentially
+accepting false signatures.
 .PP
 Output is written to standard output in a machine-readable format.
 Major problems cause the program to write a diagnostic to standard error