X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/39bcd193d88309a411d3b26b5db205f913ce530d..e7c18650b233c1f337ceb5f5e3464b1ff943ef6a:/keys/tripe-keys.conf.5.in

diff --git a/keys/tripe-keys.conf.5.in b/keys/tripe-keys.conf.5.in
index 663b9176..4fc0485a 100644
--- a/keys/tripe-keys.conf.5.in
+++ b/keys/tripe-keys.conf.5.in
@@ -148,7 +148,7 @@ or
 .B ec
 (elliptic curves).  The default is
 .BR dh .
-.ne 7
+.ne 9
 .TP
 .I kx-genalg
 Key generation algorithm name to pass to
@@ -166,9 +166,11 @@ kx	kx-genalg
 _
 dh	dh
 ec	ec
+x25519	x25519
+x448	x448
 _
 .TE
-.ne 7
+.ne 9
 .TP
 .I kx-param-genalg
 Key generation algorithm name to pass to
@@ -186,9 +188,11 @@ kx	kx-param-genalg
 _
 dh	dh-param
 ec	ec-param
+x25519	empty
+x448	empty
 _
 .TE
-.ne 7
+.ne 9
 .TP
 .I kx-param
 Options to pass to
@@ -205,8 +209,11 @@ kx	kx-param
 _
 dh	\-LS \-b3072 \-B256
 ec	\-Cnist-p256
+x25519	\fInone
+x448	\fInone
 _
 .TE
+.ne 9
 .TP
 .I kx-attrs
 Additional attributes to set on the parameters
@@ -214,7 +221,22 @@ Additional attributes to set on the parameters
 as
 .IB key = value
 pairs separated by spaces.
-Default is empty.
+Default depends on
+.I kx
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+kx	kx-attrs
+_
+dh	serialization=constlen
+ec	serialization=constlen
+x25519	\fIempty
+x448	\fIempty
+_
+.TE
 .TP
 .I kx-expire
 Expiry time for generated keys.  Default is
@@ -228,25 +250,56 @@ Hashing algorithm to use.  Default is
 The bulk crypto transform to use.
 Default is
 .BR iiv .
+.ne 8
+.TP
 .I mac
-Message authentication algorithm to use.  Default is
-.IB hash -hmac/ halfhashlen \fR,
-where
+Message authentication algorithm to use.
+Default depends on
+.I bulk
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+bulk	mac
+_
+v0	\fIhash\fB-hmac/\fIhalfhashlen
+iiv	\fIhash\fB-hmac/\fIhalfhashlenrijndael-cbc
+naclbox	poly1305/128
+_
+.TE
+.IP
+(In the above,
 .I halfhashlen
 is half of
 .IR hash 's
-output length.
+output length.)
 .TP
 .I mgf
 Mask-generation algorithm to use.  Default is
 .IB hash -mgf \fR.
 This is probably a good choice.
-.ne 6
+.ne 7
 .TP
 .I cipher
-Symmetric encryption scheme to use.  Default is
-.BR rijndael-cbc .
-.ne 6
+Symmetric encryption scheme to use.
+Default depends on
+.I bulk
+as follows.
+.TS
+center;
+| ci | ci |
+| lb | lb |.
+_
+bulk	cipher
+_
+v0	rijndael-cbc
+iiv	rijndael-cbc
+naclbox	chacha20
+_
+.TE
+.ne 8
 .TP
 .I sig
 Signature scheme to use.  Must be one of those recognized by
@@ -263,6 +316,8 @@ kx	sig
 _
 dh	dsa
 ec	ecdsa
+x25519	ed25519
+x448	ed448
 _
 .TE
 .ne 12