zkey: Fix missing hyphen escapes in man pages

Ensure that all hyphens in command options and examples are escaped properly.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

zkey/ekmfweb/zkey-ekmfweb.1

@@ -176,7 +176,7 @@ information is also updated for the key in EKMF Web.
 You cannot change the associated cryptographic adapters (APQNs) of a key that
 is bound to EKMF Web, because it inherits the APQN association from the EKMF
 Web plugin. To change the APQNs associated with the EKMF Web plugin, use the
-\fBzkey kms configure\fP command with the \fB--apqns\fP option. This also
+\fBzkey kms configure\fP command with the \fB\-\-apqns\fP option. This also
 changes the APQN associations of all secure keys in the secure key repository,
 that are bound to the EKMF Web plugin.
 .
@@ -367,8 +367,8 @@ by zkey. For registration, the template for identity keys is used.
 Specifies the label tags for generating a secure key in EKMF Web, in the form
 \fB<tag>=<value>(,<tag>=<value>)*[,]\fP with tags as defined by the key
 template. Use the \fBzkey kms info\fP command to display the key templates used
-by zkey. For XTS type keys the two templates for \fBXTS-Key1\fP and
-\fBXTS-Key2\fP are used. For non-XTS type keys, the template for \fBNon-XTS\fP
+by zkey. For XTS type keys the two templates for \fBXTS\-Key1\fP and
+\fBXTS\-Key2\fP are used. For non-XTS type keys, the template for \fBNon\-XTS\fP
 keys is used.
 .
 .SS "Options for the zkey remove command"
@@ -446,7 +446,7 @@ and the label tags 'ENV=TEST' and 'APP=LINUX' for the identity key.
 .B zkey kms info
 Displays information about the EKMF Web plugin and its configuration.
 .TP
-.B zkey kms reencipher --staged
+.B zkey kms reencipher \-\-staged
 Re-enciphers the EKMF Plugin's identity key with a new CCA master key in staged
 mode
 .TP
@@ -456,7 +456,7 @@ Generates a secure AES key in EKMF Web using the label tags 'ENV=TEST' and
 and associates it with block device '/dev/dasdc1' and device-mapper name
 \&'encvol'.
 .TP
-.B zkey generate \-\-name seckey \-\-xts \-\-volumes /dev/dasdc1:encvol \-\-volume-type luks2 \-\-label\-tags \(dqENV=TEST,APP=LINUX\(dq
+.B zkey generate \-\-name seckey \-\-xts \-\-volumes /dev/dasdc1:encvol \-\-volume\-type luks2 \-\-label\-tags \(dqENV=TEST,APP=LINUX\(dq
 Generates a secure AES key for the XTS cipher mode in EKMF Web using the label
 tags 'ENV=TEST' and 'APP=LINUX' and stores it in the secure key repository
 using the name 'seckey' and associates it with block device '/dev/dasdc1' and

zkey/kmip/zkey-kmip.1

@@ -629,7 +629,7 @@ Generates a secure AES key in the KMIP server using the label 'TEST' and stores
 it in the secure key repository using the name 'seckey' and associates it with
 block device '/dev/dasdc1' and device\-mapper name 'encvol'.
 .TP
-.B zkey generate \-\-name seckey \-\-xts \-\-volumes /dev/dasdc1:encvol \-\-volume-type luks2 \-\-label TEST1:TEST2
+.B zkey generate \-\-name seckey \-\-xts \-\-volumes /dev/dasdc1:encvol \-\-volume\-type luks2 \-\-label TEST1:TEST2
 Generates a secure AES key for the XTS cipher mode in the KMIP server using the
 labels 'TEST1' and 'TEST2' and stores it in the secure key repository using the
 name 'seckey' and associates it with block device '/dev/dasdc1' and

zkey/zkey-cryptsetup.1

@@ -31,12 +31,12 @@ These secure AES volume keys are enciphered with a master key of an IBM
 cryptographic adapter in CCA or EP11 coprocessor mode.
 .PP
 To encrypt a volume using \fBLUKS2\fP and the \fBpaes\fP cipher, generate a
-secure AES key using \fBzkey\fP: \fB'zkey generate luks.key --xts'\fP.
+secure AES key using \fBzkey\fP: \fB'zkey generate luks.key \-\-xts'\fP.
 Then format the device with \fBcryptsetup\fP using the just generated secure
-AES key from file luks.key: \fB'cryptsetup luksFormat <device> --type luks2
---cipher paes-xts-plain64 --master-key-file luks.key --key-size 1024'\fP. For
-more details about \fBzkey\fP or \fBcryptsetup\fP see the
-corresponding man pages.
+AES key from file luks.key: \fB'cryptsetup luksFormat <device> \-\-type luks2
+\-\-cipher paes\-xts\-plain64 \-\-master\-key\-file luks.key
+\-\-key\-size 1024'\fP. For more details about \fBzkey\fP or \fBcryptsetup\fP
+see the corresponding man pages.
 .
 .
 .
@@ -49,7 +49,7 @@ corresponding man pages.
 .BR validate | val
 .I device
 .RB [ \-\-key\-file | \-d
-.IR file-name ]
+.IR file\-name ]
 .RB [ \-\-keyfile\-offset | \-o
 .IR bytes ]
 .RB [ \-\-keyfile\-size | \-l
@@ -97,7 +97,7 @@ behave in the same way as with \fBcryptsetup\fP.
 .RB [ \-\-in\-place | \-i ]
 .RB [ \-\-complete | \-c ]
 .RB [ \-\-key\-file | \-d
-.IR file-name ]
+.IR file\-name ]
 .RB [ \-\-keyfile\-offset | \-o
 .IR bytes ]
 .RB [ \-\-keyfile\-size | \-l
@@ -131,7 +131,7 @@ The \fBNEW\fP register contains the new master key to be set.
 The master key in the \fBNEW\fP register cannot be used until it is made
 the current master key. You can pro-actively re-encipher a secure key with the
 \fBNEW\fP master key before this key is made the \fBCURRENT\fP key. Use the
-.B \-\-to-new
+.B \-\-to\-new
 option to do this.
 .RE
 .PP
@@ -143,20 +143,20 @@ Use the
 option to re-encipher a secure volume key that is currently enciphered with
 the master key in the \fBOLD\fP register with the master key in the
 \fBCURRENT\fP register. This option is only available for secure keys of type
-\fBCCA-AESDATA\fP or \fBCCA-AESCIPHER\fP.
+\fBCCA\-AESDATA\fP or \fBCCA\-AESCIPHER\fP.
 .PP
 .PP
 If both the
-.B \-\-from-old
+.B \-\-from\-old
 and
-.B \-\-to-new
+.B \-\-to\-new
 options are specified, a secure volume key that is currently enciphered
 with the master key in the \fBOLD\fP register is re-enciphered with the
 master key in the \fBNEW\fP register.
 .RE
 .PP
-If both options are omitted, \fBzkey-cryptsetup\fP automatically detects whether
-the secure volume key is currently enciphered with the master key in the
+If both options are omitted, \fBzkey\-cryptsetup\fP automatically detects
+whether the secure volume key is currently enciphered with the master key in the
 \fBOLD\fP register or with the master key in the \fBCURRENT\fP register.
 If currently enciphered with the master key in the \fBOLD\fP register,
 it is re-enciphered with the master key in the \fBCURRENT\fP register.
@@ -172,7 +172,7 @@ Re-enciphering a secure volume key of a volume encrypted with
 \fB"In-place"\fP immediately replaces the secure volume key in the LUKS2
 header of the encrypted volume with the re-enciphered secure volume key.
 Re-enciphering from \fBOLD\fP to \fBCURRENT\fP is performed in-place per
-default. You can use option \fB--in-place\fP to force an in-place
+default. You can use option \fB\-\-in\-place\fP to force an in-place
 re-enciphering for the \fBCURRENT\fP to \fBNEW\fP case. Be aware that
 an encrypted volume with a secure volume key that was re-enciphered in-place
 from \fBCURRENT\fP to \fBNEW\fP is no longer usable, until the new CCA or EP11
@@ -182,14 +182,14 @@ master key has been made the current one.
 separate (unbound) key slot in the LUKS2 header of the encrypted volume. Thus
 all key slots containing the current secure volume key are still valid at this
 point. Once the new CCA or EP11 master key has been set (made active), you must
-rerun the reencipher command with option \fB--complete\fP to complete the staged
-re-enciphering. When completing the staged re-enciphering, the (unbound) key
-slot containing the re-enciphered secure volume key becomes the active
+rerun the reencipher command with option \fB\-\-complete\fP to complete the
+staged re-enciphering. When completing the staged re-enciphering, the (unbound)
+key slot containing the re-enciphered secure volume key becomes the active
 key slot and, optionally, all key slots containing the old secure volume key
 are removed.
 Re-enciphering from \fBCURRENT\fP to \fBNEW\fP is performed in staged mode per
-default. You can use option \fB--staged\fP to force a staged re-enciphering for
-the \fBOLD\fP to \fBCURRENT\fP case.
+default. You can use option \fB\-\-staged\fP to force a staged re-enciphering
+for the \fBOLD\fP to \fBCURRENT\fP case.
 .PP
 To open a key slot contained in the LUKS2 header of the volume, a passphrase is
 required. You are prompted for the passphrase, unless option
@@ -218,13 +218,13 @@ but this might cause out-of-memory errors when multiple encrypted volumes are
 unlocked automatically at boot through /etc/crypttab. Because PAES
 uses secure AES keys as volume keys, the security of the key derivation
 function used to encrypt the volume key in the LUKS key slots is of less
-relevance. 
+relevance.
 .PP
 .B Note:
 The \fBreencipher\fP command requires the CCA host library (libcsulcca.so)
-for secure volume keys of type CCA-AESDATA or CCA-AESCIPHER, or the IBM Z
+for secure volume keys of type CCA\-AESDATA or CCA\-AESCIPHER, or the IBM Z
 Enterprise PKCS #11 (EP11) Support Program (EP11 host library) for secure volume
-keys of type EP11-AES to be installed. For the supported environments and
+keys of type EP11\-AES to be installed. For the supported environments and
 downloads, see: \fIhttp://www.ibm.com/security/cryptocards\fP
 .
 .
@@ -235,7 +235,7 @@ downloads, see: \fIhttp://www.ibm.com/security/cryptocards\fP
 .BR setvp | setv
 .I device
 .RB [ \-\-key\-file | \-d
-.IR file-name ]
+.IR file\-name ]
 .RB [ \-\-keyfile\-offset | \-o
 .IR bytes ]
 .RB [ \-\-keyfile\-size | \-l
@@ -251,7 +251,7 @@ command to set a verification pattern of the secure AES volume key of a volume
 encrypted with \fBLUKS2\fP and the \fBpaes\fP cipher. The verification pattern
 identifies the effective key used to encrypt the volume's data.
 The verification pattern is stored in a token named
-\fBpaes-verification-pattern\fP in the LUKS2 header.
+\fBpaes\-verification\-pattern\fP in the LUKS2 header.
 .PP
 .B Note:
 Set the verification pattern right after formatting the volume using
@@ -280,9 +280,9 @@ behave in the same way as with \fBcryptsetup\fP.
 .BR setkey | setk
 .I device
 .BR \-\-master\-key\-file | \-m
-.IR file-name
+.IR file\-name
 .RB [ \-\-key\-file | \-d
-.IR file-name ]
+.IR file\-name ]
 .RB [ \-\-keyfile\-offset | \-o
 .IR bytes ]
 .RB [ \-\-keyfile\-size | \-l
@@ -345,7 +345,7 @@ but this might cause out-of-memory errors when multiple encrypted volumes are
 unlocked automatically at boot through /etc/crypttab. Because PAES
 uses secure AES keys as volume keys, the security of the key derivation
 function used to encrypt the volume key in the LUKS key slots is of less
-relevance. 
+relevance.
 .
 .
 .
@@ -364,7 +364,7 @@ Re-enciphers a secure volume key in the LUKS2 header that is currently
 enciphered with the master key in the OLD register with the master key in the
 CURRENT register.
 .TP
-.BR \-i ", " \-\-in-place
+.BR \-i ", " \-\-in\-place
 Forces an in-place re-enciphering of a secure volume key in the LUKS2
 header. This option immediately replaces the secure volume key in the LUKS2
 header of the encrypted volume with the re-enciphered secure volume key.
@@ -378,7 +378,7 @@ secure volume key is stored in a separate (unbound) key slot in the LUKS2
 header of the encrypted volume. Thus all key slots containing the current
 secure volume key are still valid at this point. Once the new CCA or EP11 master
 key has been set (made active), you must rerun the reencipher command with
-option \fB--complete\fP to complete the staged re-enciphering. Re-enciphering
+option \fB\-\-complete\fP to complete the staged re-enciphering. Re-enciphering
 from \fBCURRENT\fP to \fBNEW\fP is performed in staged mode per default.
 .TP
 .BR \-p ", " \-\-complete
@@ -408,8 +408,8 @@ Suppresses all confirmation questions. Use with care!
 .TP
 .BR \-d ", " \-\-key\-file\~\fIfile\-name\fP
 Reads the passphrase from the specified file. If this option is omitted,
-or if the file\-name is \fI-\fP (a dash), then you are prompted to enter the
-passphrase interactively.
+or if the file\-zkey\-cryptsetup \fI\-\fP (a dash), then you are prompted to
+enter the passphrase interactively.
 .TP
 .BR \-o ", " \-\-keyfile\-offset\~\fIbytes\fP
 Specifies the number of bytes to skip before starting to read in the file
@@ -450,29 +450,29 @@ Displays version information and exits.
 .
 .SH EXAMPLES
 .TP
-.B zkey-cryptsetup reencipher /dev/dasdd1
+.B zkey\-cryptsetup reencipher /dev/dasdd1
 Re-enciphers the secure volume key of the encrypted volume /dev/dasdd1.
 .TP
-.B zkey-cryptsetup reencipher /dev/dasdd1 \-\-staged
+.B zkey\-cryptsetup reencipher /dev/dasdd1 \-\-staged
 Re-enciphers the secure volume key of the encrypted volume /dev/dasdd1 in
 staged mode.
 .TP
-.B zkey-cryptsetup reencipher /dev/dasdd1 \-\-complete
+.B zkey\-cryptsetup reencipher /dev/dasdd1 \-\-complete
 Completes re-enciphers the secure volume key of the encrypted
 volume /dev/dasdd1.
 .TP
-.B zkey-cryptsetup reencipher /dev/dasdd1 \-\-in\-place
+.B zkey\-cryptsetup reencipher /dev/dasdd1 \-\-in\-place
 Re-enciphers the secure volume key of the encrypted volume /dev/dasdd1 in
 in-place mode.
 .TP
-.B zkey-cryptsetup validate /dev/dasdd1
+.B zkey\-cryptsetup validate /dev/dasdd1
 Validates the secure volume key of the encrypted volume /dev/dasdd1 and
 displays its attributes.
 .TP
-.B zkey-cryptsetup setvp /dev/dasdd1
+.B zkey\-cryptsetup setvp /dev/dasdd1
 Sets the verification pattern of the secure volume key of the encrypted
 volume /dev/dasdd1.
 .TP
-.B zkey-cryptsetup setkey /dev/dasdd1 --master-key-file seckey.key
+.B zkey\-cryptsetup setkey /dev/dasdd1 \-\-master\-key\-file seckey.key
 Sets the secure key contained in file seckey.key as the new volume key
 for the encrypted volume /dev/dasdd1.