usage: in-toto-keygen [-h] [-p] [-t {rsa,ed25519,ecdsa}] [-b <bits>] [--version] <filename>

in-toto-keygen is a tool to generate, optionally encrypt, and write cryptographic keys to disk. These keys may be used with other in-toto tooling to e.g. sign or verify link or layout metadata.

Positional Arguments:
  <filename>            filename for the resulting key files, which are written to '<filename>'
                        (private key) and '<filename>.pub' (public key).

Options:
  -h, --help            show this help message and exit
  -p, --prompt          prompts for a password used to encrypt the private key before storing it
  -t, --type {rsa,ed25519,ecdsa}
                        type of the key to be generated. 'rsa' keys are written in a 'PEM' format.
                        'ed25519' and 'ecdsa' keys are written in a custom 'securesystemslib/json'
                        format. Default is 'rsa'.
  -b, --bits <bits>     key size, or key length, of the RSA key
  --version             show program's version number and exit

EXAMPLE USAGE

Generate RSA key pair of size 2048 bits, prompt for a password to encrypt
the private key, and write 'alice' (private encrypted) and 'alice.pub' (public)
as PEM-formatted key files to the current working directory.

  in-toto-keygen -p -t rsa -b 2048 alice

Generate unencrypted ed25519 key pair and write 'bob' (private) and 'bob.pub'
(public) as securesystemslib/json-formatted key files to the current working
directory.

  in-toto-keygen -t ed25519 bob