1=pod 2 3=head1 NAME 4 5dhparam - DH parameter manipulation and generation 6 7=head1 SYNOPSIS 8 9B<openssl dhparam> 10[B<-inform DER|PEM>] 11[B<-outform DER|PEM>] 12[B<-in> I<filename>] 13[B<-out> I<filename>] 14[B<-dsaparam>] 15[B<-noout>] 16[B<-text>] 17[B<-C>] 18[B<-2>] 19[B<-5>] 20[B<-rand> I<file(s)>] 21[B<-engine id>] 22[I<numbits>] 23 24=head1 DESCRIPTION 25 26This command is used to manipulate DH parameter files. 27 28=head1 OPTIONS 29 30=over 4 31 32=item B<-inform DER|PEM> 33 34This specifies the input format. The B<DER> option uses an ASN1 DER encoded 35form compatible with the PKCS#3 DHparameter structure. The PEM form is the 36default format: it consists of the B<DER> format base64 encoded with 37additional header and footer lines. 38 39=item B<-outform DER|PEM> 40 41This specifies the output format, the options have the same meaning as the 42B<-inform> option. 43 44=item B<-in> I<filename> 45 46This specifies the input filename to read parameters from or standard input if 47this option is not specified. 48 49=item B<-out> I<filename> 50 51This specifies the output filename parameters to. Standard output is used 52if this option is not present. The output filename should B<not> be the same 53as the input filename. 54 55=item B<-dsaparam> 56 57If this option is used, DSA rather than DH parameters are read or created; 58they are converted to DH format. Otherwise, "strong" primes (such 59that (p-1)/2 is also prime) will be used for DH parameter generation. 60 61DH parameter generation with the B<-dsaparam> option is much faster, 62and the recommended exponent length is shorter, which makes DH key 63exchange more efficient. Beware that with such DSA-style DH 64parameters, a fresh DH key should be created for each use to 65avoid small-subgroup attacks that may be possible otherwise. 66 67=item B<-2>, B<-5> 68 69The generator to use, either 2 or 5. 2 is the default. If present then the 70input file is ignored and parameters are generated instead. 71 72=item B<-rand> I<file(s)> 73 74a file or files containing random data used to seed the random number 75generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>). 76Multiple files can be specified separated by a OS-dependent character. 77The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for 78all others. 79 80=item I<numbits> 81 82this option specifies that a parameter set should be generated of size 83I<numbits>. It must be the last option. If not present then a value of 512 84is used. If this option is present then the input file is ignored and 85parameters are generated instead. 86 87=item B<-noout> 88 89this option inhibits the output of the encoded version of the parameters. 90 91=item B<-text> 92 93this option prints out the DH parameters in human readable form. 94 95=item B<-C> 96 97this option converts the parameters into C code. The parameters can then 98be loaded by calling the B<get_dh>I<numbits>B<()> function. 99 100=item B<-engine id> 101 102specifying an engine (by it's unique B<id> string) will cause B<req> 103to attempt to obtain a functional reference to the specified engine, 104thus initialising it if needed. The engine will then be set as the default 105for all available algorithms. 106 107=back 108 109=head1 WARNINGS 110 111The program B<dhparam> combines the functionality of the programs B<dh> and 112B<gendh> in previous versions of OpenSSL and SSLeay. The B<dh> and B<gendh> 113programs are retained for now but may have different purposes in future 114versions of OpenSSL. 115 116=head1 NOTES 117 118PEM format DH parameters use the header and footer lines: 119 120 -----BEGIN DH PARAMETERS----- 121 -----END DH PARAMETERS----- 122 123OpenSSL currently only supports the older PKCS#3 DH, not the newer X9.42 124DH. 125 126This program manipulates DH parameters not keys. 127 128=head1 BUGS 129 130There should be a way to generate and manipulate DH keys. 131 132=head1 SEE ALSO 133 134L<dsaparam(1)|dsaparam(1)> 135 136=head1 HISTORY 137 138The B<dhparam> command was added in OpenSSL 0.9.5. 139The B<-dsaparam> option was added in OpenSSL 0.9.6. 140 141=cut 142