Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of the steps for setting up OpenVPN is running the command openssl dhparam -out dh1024.pem 1024. The man page tells me this 1024 value refers to the number of bits.

  • Why is the value 1024 suggested by the examples?
  • Should I use a larger value like 4096?
    • What value should I use, how many bits are enough, why?
    • RSA 1024 bit keys are now considered weak, and it is often suggested that to use 2048 bit or higher. Does this type of situation apply to this dhparam file as well?
  • The command to generate this file seems takes ~10 hours on the appliance I that I will be using as the OpenVPN server. Is it safe to generate this file on a faster machine machine and transfer it over, or should I treat it like most private keys, and keep it on that host only? How secret should this file be?
share|improve this question
Seems like an openvpn tag would also be appropriate here, but I don't have the privileges to add it yet. –  Zoredache Sep 14 '13 at 0:21

1 Answer 1

Much of this has been addressed before. See my answer and Thomas's answer to a related question for more info about DH and DH parameters.

The parameters are just primes, not keys. The needn't be unique or secret, but they must also not be specially crafted by an attacker. The bit lenght refers to the size of the prime not a key, so it's not directly comparable to RSA. Note that an RSA key of 2048 bits is composed of a pair of 1024-bit primes, so you're on the same level with respect to factorization with a 1024-bit DH prime versus a 2048 RSA key.

As Thomas's answer linked above points out, the number doesn't need to be unique or secret, and in fact your crypto library may provide a DH prime that will work just fine (assuming you trust the source of the library). Or you can generate one yourself.

share|improve this answer
Are you sure your answer is correct? If I got it right, a 1024 bit DH key gets it's name from the size of the modulus being used. And that modulus is the prime number which is part of the DH params (the DH params are a generator and the prime modulus). Therefore only DH params of 2048 bit (modulus of 2048 bit) and RSA keys of 2048 are comparable. So I would argue that your statement "you're on the same level with respect to factorization with a 1024-bit DH prime versus a 2048 RSA key" is not correct. –  0x80 Dec 3 '13 at 9:22
DH params contain two primes; one is typically 2 but sometimes 5, that's your generator. The other is the interesting prime, your modulus. It's the one that 1024 bits long. In RSA, your modulus is the product of two primes (p and q). A 2048-bit-key is the product of a pair of 1024-bit primes. In both cases, the primes are 1024 bits long. –  tylerl Dec 3 '13 at 18:17
@0x80 while 1024-bit DH isn't exactly equal to 2048-bit RSA, it's 1024b DH is closer to 2048b RSA (considered unbreakable) than it is to 1024b RSA (considered unsafe). 1024b DH is considered unbreakable by current and foreseeable technology. Hence the rough equality. –  tylerl Dec 3 '13 at 18:32
I'm not a mathematician, I just try to find an answer. :) But there seem to be different, conflicting answers. You are right that in both cases the primes are 1024 bits long. But while DH uses the prime as modulus, RSA doesnt - it uses the product of the two primes, which is n (as you said). Since the time to break DH and RSA seems to rely on the modulus length and since the algorithms to do that are "similar", both moduli need to be the same length. Therefore you can't compare the lenght of the prime numbers, but the moduli. I took this from here: security.stackexchange.com/a/5497 –  0x80 May 16 at 12:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.