dhparam.pod revision 279265
1=pod 2 3=head1 NAME 4 5dhparam - DH parameter manipulation and generation 6 7=head1 SYNOPSIS 8 9B<openssl dhparam> 10[B<-inform DER|PEM>] 11[B<-outform DER|PEM>] 12[B<-in> I<filename>] 13[B<-out> I<filename>] 14[B<-dsaparam>] 15[B<-check>] 16[B<-noout>] 17[B<-text>] 18[B<-C>] 19[B<-2>] 20[B<-5>] 21[B<-rand> I<file(s)>] 22[B<-engine id>] 23[I<numbits>] 24 25=head1 DESCRIPTION 26 27This command is used to manipulate DH parameter files. 28 29=head1 OPTIONS 30 31=over 4 32 33=item B<-inform DER|PEM> 34 35This specifies the input format. The B<DER> option uses an ASN1 DER encoded 36form compatible with the PKCS#3 DHparameter structure. The PEM form is the 37default format: it consists of the B<DER> format base64 encoded with 38additional header and footer lines. 39 40=item B<-outform DER|PEM> 41 42This specifies the output format, the options have the same meaning as the 43B<-inform> option. 44 45=item B<-in> I<filename> 46 47This specifies the input filename to read parameters from or standard input if 48this option is not specified. 49 50=item B<-out> I<filename> 51 52This specifies the output filename parameters to. Standard output is used 53if this option is not present. The output filename should B<not> be the same 54as the input filename. 55 56=item B<-dsaparam> 57 58If this option is used, DSA rather than DH parameters are read or created; 59they are converted to DH format. Otherwise, "strong" primes (such 60that (p-1)/2 is also prime) will be used for DH parameter generation. 61 62DH parameter generation with the B<-dsaparam> option is much faster, 63and the recommended exponent length is shorter, which makes DH key 64exchange more efficient. Beware that with such DSA-style DH 65parameters, a fresh DH key should be created for each use to 66avoid small-subgroup attacks that may be possible otherwise. 67 68=item B<-check> 69 70check if the parameters are valid primes and generator. 71 72=item B<-2>, B<-5> 73 74The generator to use, either 2 or 5. 2 is the default. If present then the 75input file is ignored and parameters are generated instead. 76 77=item B<-rand> I<file(s)> 78 79a file or files containing random data used to seed the random number 80generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>). 81Multiple files can be specified separated by a OS-dependent character. 82The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for 83all others. 84 85=item I<numbits> 86 87this option specifies that a parameter set should be generated of size 88I<numbits>. It must be the last option. If not present then a value of 512 89is used. If this option is present then the input file is ignored and 90parameters are generated instead. 91 92=item B<-noout> 93 94this option inhibits the output of the encoded version of the parameters. 95 96=item B<-text> 97 98this option prints out the DH parameters in human readable form. 99 100=item B<-C> 101 102this option converts the parameters into C code. The parameters can then 103be loaded by calling the B<get_dh>I<numbits>B<()> function. 104 105=item B<-engine id> 106 107specifying an engine (by it's unique B<id> string) will cause B<req> 108to attempt to obtain a functional reference to the specified engine, 109thus initialising it if needed. The engine will then be set as the default 110for all available algorithms. 111 112=back 113 114=head1 WARNINGS 115 116The program B<dhparam> combines the functionality of the programs B<dh> and 117B<gendh> in previous versions of OpenSSL and SSLeay. The B<dh> and B<gendh> 118programs are retained for now but may have different purposes in future 119versions of OpenSSL. 120 121=head1 NOTES 122 123PEM format DH parameters use the header and footer lines: 124 125 -----BEGIN DH PARAMETERS----- 126 -----END DH PARAMETERS----- 127 128OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42 129DH. 130 131This program manipulates DH parameters not keys. 132 133=head1 BUGS 134 135There should be a way to generate and manipulate DH keys. 136 137=head1 SEE ALSO 138 139L<dsaparam(1)|dsaparam(1)> 140 141=head1 HISTORY 142 143The B<dhparam> command was added in OpenSSL 0.9.5. 144The B<-dsaparam> option was added in OpenSSL 0.9.6. 145 146=cut 147