1

If I generate a Diffie-Hellman prime openssl dhparam 512 -text (deliberately of small size to keep the paste size below small; I know minimum is 2048 and up), what are the different parts of the output:

    PKCS#3 DH Parameters: (512 bit)
        prime:
            00:84:f7:d4:6a:96:54:da:8e:b0:68:4d:8f:42:fe:
            52:a1:4f:dc:05:f7:0b:f1:4a:fd:dd:0a:27:b7:b4:
            c4:09:db:4d:80:c2:b0:46:e0:f6:dc:fe:e2:9a:d2:
            5c:e8:7c:6e:9f:81:aa:bc:4b:8c:6e:67:b5:e5:b2:
            03:b6:56:d3:c3
        generator: 2 (0x2)
-----BEGIN DH PARAMETERS-----
MEYCQQCE99RqllTajrBoTY9C/lKhT9wF9wvxSv3dCie3tMQJ202AwrBG4Pbc/uKa
0lzofG6fgaq8S4xuZ7XlsgO2VtPDAgEC
-----END DH PARAMETERS-----

I understand the generator is the base number that's usually either 2 or 5. The question is the prime number and the DH parameters.

  1. What is the prime represented in?
  2. How can it be converted to an actual prime integer?
  3. What is encoded (and why?) in the DH parameters section?
  4. How do different applications (such as httpd) use this output?
  • Ahem openssl asn1parse -inform pem < YOUR_PARAMETERS.FILE. – Deer Hunter Feb 7 '16 at 9:04
  • @DeerHunter Ahem, that explains nothing if you're very new to the subject... Also, feeding the output of the command in the question into your command fails with Error: offset too large. – mart1n Feb 7 '16 at 9:17
  • take the lines from ----- inclusive. – Deer Hunter Feb 7 '16 at 9:19
5
  1. What is the prime represented in?

Plain base 16 encoding of actual number.

  1. How can it be converted to an actual prime integer?

Just convert from base 16. Like so:

$ echo "ibase=16;0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDD\
D0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B\
203B656D3C3" | bc
69641036876619088755613794741049804861416084108574896892562277663292\
07662129683124275184714669456043499786144904245391117269209586570225\
834561454877365187

And, yes, it is in fact a prime.

$ openssl prime -hex 0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3   
 84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3 is prime
  1. What is encoded (and why?) in the DH parameters section?

Same as the plain text description.

PEM version:

$ cat dh.pem
-----BEGIN DH PARAMETERS-----
MEYCQQCE99RqllTajrBoTY9C/lKhT9wF9wvxSv3dCie3tMQJ202AwrBG4Pbc/uKa
0lzofG6fgaq8S4xuZ7XlsgO2VtPDAgEC
-----END DH PARAMETERS-----

Parsing that file with openssl for human consumption:

$ cat dh.pem | openssl dhparam -noout -text
DH Parameters: (512 bit)
    prime:
        00:84:f7:d4:6a:96:54:da:8e:b0:68:4d:8f:42:fe:
        52:a1:4f:dc:05:f7:0b:f1:4a:fd:dd:0a:27:b7:b4:
        c4:09:db:4d:80:c2:b0:46:e0:f6:dc:fe:e2:9a:d2:
        5c:e8:7c:6e:9f:81:aa:bc:4b:8c:6e:67:b5:e5:b2:
        03:b6:56:d3:c3
    generator: 2 (0x2)

And parsing the actual ASN1 encoding:

$ cat dh.pem | openssl asn1parse -i
0:d=0  hl=2 l=  70 cons: SEQUENCE
2:d=1  hl=2 l=  65 prim:  INTEGER           :84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3
69:d=1  hl=2 l=   1 prim:  INTEGER           :02
  1. How do different applications (such as httpd) use this output?

I guess they just link against the OpenSSL library and pass in the relevant files. And allow OpenSSL to take care of it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.