skipd(1M)

NAME
skipd - SKIP key management and certificate daemon

SYNOPSIS
/usr/sbin/skipd -[fvV]

OPTIONS

-f  Causes skipd not to background itself after starting. This flag is useful for debugging only. It's general use is not advised.

    The skip log file messages will appear on standard output rather than in the skip log file. Cryptic debugging messages may also be printed.

-v  Be verbose with status output.

-V  Be even more verbose with status output.

DESCRIPTION
skipd services encryption and decryption requests from the kernel (received and answered via /dev/skip). It requests certificates from remote Certificate Discovery servers when necessary. skipd also functions as a certificate server, answering CDP requests from remote hosts.

USAGE

The skipd daemon is started at system boot, and restarted when necessary with the skipd_restart command. Only one key manager may be running at a time. The key manager must be started by root.

If a password has set for local secrets using skiplocal(1m), skipd will prompt you for a password prior to starting. If the key manager has been started at boot time and a password is required, the key manager will not prompt for a password. It will, instead, come up in a minimal mode, which will not perform encryption or decryption. Use the skipd_restart command to restart the key manager and supply the correct password when prompted.

skipd first reads the configuration file skipd.conf, loads the set of local identities from the localid directory, and loads the set of trusted Certificate Authority certificates from the CAs directory.

When the kernel receives IP packets and needs a traffic key to encrypt them, it sends information to the key manager including the local and remote keyids and their NSID. The keymanager sees if it has already cached a shared secret. If it has, it generates a random key, encrypts it using the shared secret, and sends the encrypted traffic key to the kernel.

If the key manager does not have the secret cached, it must try to find the certificate for the NSID keyid. It first looks in the certificate database. If it finds it there, it performs the calculation, encrypts the random key and returns it to the kernel.

If the certificate is not in the database, the key manager initiates a Certificate Discovery Protocol (CDP) request to a remote host to obtain the certificate.

DIAGNOSTICS
Errors are written to the Console and notice messages are written to /var/log/skipd.log

SEE ALSO
skipd_restart(1)
skipd.conf(4)

FILES

/etc/skip/skipd.conf
/etc/skip/CAs/
/etc/skip/localid/