<?xml version="1.0" encoding="utf-8"?>

<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->

<!-- This component and the accompanying materials are made available under the terms of the License 

"Eclipse Public License v1.0" which accompanies this distribution, 

and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->

<!-- Initial Contributors:

    Nokia Corporation - initial contribution.

Contributors: 

-->

<!DOCTYPE concept

  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">

<concept id="GUID-6DF71555-1AB0-5B50-9FEA-E775F3AFEF8B" xml:lang="en"><title>Listing

Keystore Contents</title><prolog><metadata><keywords/></metadata></prolog><conbody>

<p>The list command is used to display the content of the key store. It can

be used to display the overall content of all key store implementations, to

display the content of a specific key store implementation, or to display

details about a specific key if we know its label. </p>

<p><b>Listing the content of all key store implementations </b> </p>

<p>To see all the private keys available on the device, use the command: </p>

<p><userinput>keytool -list</userinput> </p>

<p>The output, depending on the actual keys present on the device, will look

similar to: </p>

<codeblock id="GUID-1BCFB869-ABA0-5822-9921-071A6D4BD4A9" xml:space="preserve">Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

Store Label: Software key store

gm0 is a 512 bits RSA key 

Store Label: Software key store

gm1 is a 512 bits DSA key 

Store Label: Software key store

Tls RSAKey is a 1024 bits RSA key

</codeblock>

<p>In this case, there are two RSA keys and one DSA key. You can get information

in addition to the above output by using the –details (-d for short) option: </p>

<codeblock id="GUID-08D6C409-938E-56D1-B1A2-C154C1193000" xml:space="preserve">keytool –l –d</codeblock>

<codeblock id="GUID-DB7833DC-E9DE-54F9-B4D3-BAA79BBD5023" xml:space="preserve">keytool –l –d

Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

Store Label: Software key store

Version: 1.00      Serial Number: 0      Manufacturer: Nokia Corporation Store Type: Read only

        Algorithm: RSA    Size: 512  bits

        Usage : PKCS15 DecryptSignSignRecover    Code: 0xe 

        Owner : 0x101f7e95 

        User : 0x101f7e95 

        Access flags: Extractable 

        ID: 4d 15 e9 01 c6 ea ff a0 11 57 05 60 f4 ba 0c 0f 58 db ae e7 

        Label: gm0

        Native: Yes 

        Start date: not set    End date: not set

</codeblock>

<p>The following table details the fields that make up the output of the list

command: </p>

<table id="GUID-CBBCDC21-3220-52F5-8C4A-460BCBB26EDC">

<tgroup cols="2"><colspec colname="col0"/><colspec colname="col1"/>

<thead>

<row>

<entry>Output type </entry>

<entry>Description </entry>

</row>

</thead>

<tbody>

<row>

<entry><p>Algorithm </p> </entry>

<entry><p>The algorithm field shows the type of keys available. The valid

values are RSA and DSA. </p> </entry>

</row>

<row>

<entry><p>Size </p> </entry>

<entry><p>The size of the key in bits. For instance, in the example above,

there are three RSA keys with sizes ranging from 512 to 2048 bits. The maximum

allowed key size, as of now, is 2048 bits. </p> </entry>

</row>

<row>

<entry><p>Usage </p> </entry>

<entry><p>The usage attribute specifies the tasks which we can perform with

the given key. Valid values for usage are: </p> <ul>

<li id="GUID-A275AD33-178B-50D8-AE3C-7883E75E0A29"><p>sign and signrecover

for DSA keys </p> </li>

<li id="GUID-894879F1-4764-552A-8570-A5B1DE5C3C4E"><p>sign, signrecover, decrypt

and unwrap for RSA keys </p> </li>

</ul> <p>Usage attributes are set during key import. Attempts to set invalid

usages will result in an error. </p> </entry>

</row>

<row>

<entry><p>Owner </p> </entry>

<entry><p>Each key belongs to a specific UID. This UID represents the owner

of the key. Typically the owner of a key is the application which imported

the key. Only the owner of the key can remove it from the keystore. Additionally

only the owner can set the users of a key. </p> <p>The owner of the key can

be changed by <codeph>writedevicedata</codeph> after it is imported, using <codeph>keytool

-m &lt;keyname&gt;</codeph>. All processes that have <codeph>writedevicedata</codeph> capability

can manipulate the keys. </p> </entry>

</row>

<row>

<entry><p>User </p> </entry>

<entry><p>The user attribute is a list of application UIDs. Each of those

UIDs is allowed to use the key to perform a task allowed by its usage attribute,

for example, sign data, verify a signature, and so on. </p> <p>Each key user

belongs to a specific UID, which is, by default the process owner. It can

be set to <codeph>all</codeph> by using <codeph>keytool –a &lt;keyname&gt;</codeph>. </p> </entry>

</row>

<row>

<entry><p>Access Flags </p> </entry>

<entry><p>Access flags reflect those defined in the PKCS#11 standard. The

values are: </p> <ul>

<li id="GUID-F60CF849-BCB3-5081-80FF-4DCA3D3157C5"><p>1. <codeph>Sensitive</codeph> –

The key can only be exported in encrypted form. A key marked as sensitive

might have been imported either from a cleartext or encrypted source. </p> </li>

<li id="GUID-E96569F6-CD01-56B0-98B4-F905F77B58CF"><p>2. <codeph>Extractable</codeph> –

The key can be exported. </p> </li>

<li id="GUID-D6003F64-DE79-586B-937C-0AC0AD6110A4"><p>3. <codeph>AlwaysSensitive</codeph> –

The key has never existed outside the keystore in unencrypted form. This access

flag is set automatically by the key store. You do not have explicit access

to it. It will be set only if the key has been imported as Sensitive from

an encrypted source. </p> </li>

<li id="GUID-0DCA4585-36AB-5402-9092-6A7C09FD3E1A"><p>4. <codeph>NeverExtractable</codeph> –

The key cannot be exported, and has never existed outside the keystore. This

implies that the key was created on the device. </p> </li>

<li id="GUID-023C2B68-A7EC-5AA4-9428-BF245396B939"><p>5. <codeph>Local</codeph> –

The key was created on the device, rather than being imported. </p> </li>

</ul> <p>The access flag can be set only during import and the only the values <codeph>Sensitive</codeph> and <codeph>Extractable</codeph> are

available to the users. See the section <xref href="GUID-2E02B840-FF86-5535-BA0E-5C4C3B600E9B.dita">Importing

private keys</xref>. </p> </entry>

</row>

<row>

<entry><p>ID </p> </entry>

<entry><p>A unique identifier for the key. It is in hexadecimal format. </p> </entry>

</row>

<row>

<entry><p>Label </p> </entry>

<entry><p>The key label. A human-readable handle for the key. </p> </entry>

</row>

<row>

<entry><p>Native </p> </entry>

<entry><p>Specifies whether cryptographic operations involving the key will

be performed on the cryptographic token or outside it. For instance, a hardware

keystore might provide key storage but no facilities for encryption which

will then be executed outside the token (native is false). This is always

true for the Symbian file key store implementation. </p> </entry>

</row>

<row>

<entry><p>Start and End date </p> </entry>

<entry><p>The period of time when the key is actually valid. The key cannot

be used outside this time frame. </p> </entry>

</row>

</tbody>

</tgroup>

</table>

<p><b>Listing the content of a specific key store implementation </b> </p>

<p>If the content of only a specific key store implementation is required,

the list command can be restricted to that implementation using the –store

option. Suppose the content of the key store implementation with index 0 (see

the section <xref href="GUID-62AE0683-642D-539A-A590-3D8210591BD9.dita">Working

with multiple keystore implementations</xref> for details on how to list the

available key store implementations) is required, you can issue the following

command: </p>

<codeblock id="GUID-87B31B6E-C245-5AEA-A1DC-50CF121F6C4E" xml:space="preserve">keytool –store 0 –list</codeblock>

<p>Depending on the content of the key store implementation with index 0,

output similar to the following is displayed: </p>

<codeblock id="GUID-BBAD731C-7A70-5A22-81E9-7534747ED081" xml:space="preserve">Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

    Algorithm: RSA    Size: 512 bits

    Usage: Pkcs15 Sign     Code: 0x4

    Owner: 0x101f7e95

    User: 0x101f7e95

    Access Flags: Extractable

    ID: …

    Label: rsa1

    Native: Yes

    Start Date: not set     End Data: not set

</codeblock>

<p>If you try to specify a non-existing key store implementation, the following

error will occur: </p>

<codeblock id="GUID-92ADD04D-B22A-55F3-A6F6-3E2747C71B77" xml:space="preserve">Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

The specified keystore implementation does not exist.

Error during list!

Error code KErrArgument.

</codeblock>

<p><b>Displaying information about a specific private key </b> </p>

<p>It is possible to display information about a specific key whose label

is known. This is useful, for instance, when the key store contains a significant

amount of keys and only a particular store's keys are required. For example,

to display information about a key with label “rsa1”, you can issue the command: </p>

<codeblock id="GUID-C954576F-3E5D-52C7-9A67-795B4758769C" xml:space="preserve">keytool –list rsa1 -d</codeblock>

<p>Remember that labels are case sensitive. The output should be similar to: </p>

<codeblock id="GUID-E68F9B25-44F1-5263-A1AE-667129A73C03" xml:space="preserve">Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

    Algorithm: RSA    Size: 512 bits

    Usage: Pkcs15 Sign     Code: 0x4

    Owner: 0x101f7e95

    User: 0x101f7e95

    Access Flags: Extractable

    ID: …

    Label: rsa1

    Native: Yes

    Start Date: not set     End Data: not set

</codeblock>

<p>If no key in the key store corresponds to the given label, the following

error will occur: </p>

<codeblock id="GUID-28F8EA88-1F84-505B-8863-977A8FDA0632" xml:space="preserve">Symbian KeyStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

Cannot find the specified key.

</codeblock>

<p><b>Wildcards </b> </p>

<p>The list commands supports wildcards (“*” and “?”) on key labels. For instance

the following command lists information about all keys whose label contains

the string “dsa”: </p>

<p><userinput>c:\&gt;keytool –l *dsa*</userinput> </p>

<table id="GUID-6B2F1F3B-A301-5D0A-923A-CA6D9B04A1C1">

<tgroup cols="3"><colspec colname="col0"/><colspec colname="col1"/><colspec colname="col2"/>

<thead>

<row>

<entry>Internal name</entry>

<entry>Algorithm</entry>

<entry>Key size</entry>

</row>

</thead>

<tbody>

<row>

<entry><p> <codeph>ECipherDES_CBC</codeph>  </p> </entry>

<entry><p> <codeph>DES</codeph>  </p> </entry>

<entry><p> <codeph>64 bits</codeph>  </p> </entry>

</row>

<row>

<entry><p> <codeph>ECipher3DES_CBC</codeph>  </p> </entry>

<entry><p> <codeph>Triple DES</codeph>  </p> </entry>

<entry><p> <codeph>192 bits</codeph>  </p> </entry>

</row>

<row>

<entry><p> <codeph>ECipherRC2_CBC_40</codeph>  </p> </entry>

<entry><p> <codeph>RC2</codeph>  </p> </entry>

<entry><p> <codeph>Effective key length 1024 bits</codeph>  </p> </entry>

</row>

<row>

<entry><p> <codeph>ECipherRC2_CBC_128</codeph>  </p> </entry>

<entry><p> <codeph>RC2</codeph>  </p> </entry>

<entry><p> <codeph>Effective key length 1024 bits</codeph>  </p> </entry>

</row>

<row>

<entry><p> <codeph>ECipherRC2_CBC_40_16</codeph>  </p> </entry>

<entry><p> <codeph>RC2</codeph>  </p> </entry>

<entry><p> <codeph>Effective key length 128 bits</codeph>  </p> </entry>

</row>

<row>

<entry><p> <codeph>ECipherRC2_CBC_128_16</codeph>  </p> </entry>

<entry><p> <codeph>RC2</codeph>  </p> </entry>

<entry><p> <codeph>Effective key length 128 bits</codeph>  </p> </entry>

</row>

</tbody>

</tgroup>

</table></conbody><related-links>

<link href="GUID-E90A22C7-0AD7-55C4-83BB-165E1AA1E296.dita"><linktext>Removing

Keys</linktext></link>