Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When creating Diffie Hellman parameters for OpenSSH, there's a two-step process which looks like this to generate and filter secure primes for Diffie Hellman key exchange:
ssh-keygen -b 4096 -G dh4096-insecure
ssh-keygen -f dh4096-insecure -T dh4096
When reading the OpenVPN documentation, they recommend generating DH parameters like so:
openssl dhparam 2048 -out dh2048.pem
Is there a way to filter these primes for safety before using them with OpenVPN?
OpenSSL does filter the primes it generates and then outputs a single one.
You should just not use the -dsaparam option.
Source: manpage
A safe prime p is a prime such that p = 2 q + 1, with q also a prime. Actually, there are two ways to find safe primes: one is to generate a prime (that is, a random number, and apply a primality test to its uneven successors) p ; then calculate q = (p - 1)/2 and do a second primality test on q.
However, one can also generate first a prime q (random number, and primality test on uneven successors), calculate p = 2 q + 1, and do a primality test on p.
If both primality tests are reliable, I would think that both procedures are equivalent. I don't know what procedure is more prone to "doctored non-safe primes". In any case, one can easily do such generation one-self.
