How to generate ffdhe from rfc7919

Question

Everyone recommends to use the pre-defined ffdhe groups from https://www.rfc-editor.org/rfc/rfc7919

There are multiple sources (for example mozilla) where I can download the DH PARAMETERS file but how can I generate it with the information provided in https://www.rfc-editor.org/rfc/rfc7919#appendix-A.3?

Answer 1

$ cat ffdhe4096.txt
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB
7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004
87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832
A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A
1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF
8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E655F6A
FFFFFFFF FFFFFFFF

$ printf "asn1=SEQUENCE:seq_sect\n[seq_sect]\nfield1=INTEGER:0x" >dh.cnf
$ cat ffdhe4096.txt | tr -d "[:space:]" >>dh.cnf
$ printf "\nfield2=INTEGER:0x2" >>dh.cnf
$ openssl asn1parse -genconf dh.cnf -noout -out dh.der

$ openssl dhparam -check -noout -inform DER -in dh.der
DH parameters appear to be ok.

$ openssl dhparam -text -noout -inform DER -in dh.der

DH Parameters: (4096 bit)
    prime:
        00:ff:ff:ff:ff:ff:ff:ff:ff:ad:f8:54:58:a2:bb:
        4a:9a:af:dc:56:20:27:3d:3c:f1:d8:b9:c5:83:ce:
        2d:36:95:a9:e1:36:41:14:64:33:fb:cc:93:9d:ce:
        24:9b:3e:f9:7d:2f:e3:63:63:0c:75:d8:f6:81:b2:
        02:ae:c4:61:7a:d3:df:1e:d5:d5:fd:65:61:24:33:
        f5:1f:5f:06:6e:d0:85:63:65:55:3d:ed:1a:f3:b5:
        57:13:5e:7f:57:c9:35:98:4f:0c:70:e0:e6:8b:77:
        e2:a6:89:da:f3:ef:e8:72:1d:f1:58:a1:36:ad:e7:
        35:30:ac:ca:4f:48:3a:79:7a:bc:0a:b1:82:b3:24:
        fb:61:d1:08:a9:4b:b2:c8:e3:fb:b9:6a:da:b7:60:
        d7:f4:68:1d:4f:42:a3:de:39:4d:f4:ae:56:ed:e7:
        63:72:bb:19:0b:07:a7:c8:ee:0a:6d:70:9e:02:fc:
        e1:cd:f7:e2:ec:c0:34:04:cd:28:34:2f:61:91:72:
        fe:9c:e9:85:83:ff:8e:4f:12:32:ee:f2:81:83:c3:
        fe:3b:1b:4c:6f:ad:73:3b:b5:fc:bc:2e:c2:20:05:
        c5:8e:f1:83:7d:16:83:b2:c6:f3:4a:26:c1:b2:ef:
        fa:88:6b:42:38:61:1f:cf:dc:de:35:5b:3b:65:19:
        03:5b:bc:34:f4:de:f9:9c:02:38:61:b4:6f:c9:d6:
        e6:c9:07:7a:d9:1d:26:91:f7:f7:ee:59:8c:b0:fa:
        c1:86:d9:1c:ae:fe:13:09:85:13:92:70:b4:13:0c:
        93:bc:43:79:44:f4:fd:44:52:e2:d7:4d:d3:64:f2:
        e2:1e:71:f5:4b:ff:5c:ae:82:ab:9c:9d:f6:9e:e8:
        6d:2b:c5:22:36:3a:0d:ab:c5:21:97:9b:0d:ea:da:
        1d:bf:9a:42:d5:c4:48:4e:0a:bc:d0:6b:fa:53:dd:
        ef:3c:1b:20:ee:3f:d5:9d:7c:25:e4:1d:2b:66:9e:
        1e:f1:6e:6f:52:c3:16:4d:f4:fb:79:30:e9:e4:e5:
        88:57:b6:ac:7d:5f:42:d6:9f:6d:18:77:63:cf:1d:
        55:03:40:04:87:f5:5b:a5:7e:31:cc:7a:71:35:c8:
        86:ef:b4:31:8a:ed:6a:1e:01:2d:9e:68:32:a9:07:
        60:0a:91:81:30:c4:6d:c7:78:f9:71:ad:00:38:09:
        29:99:a3:33:cb:8b:7a:1a:1d:b9:3d:71:40:00:3c:
        2a:4e:ce:a9:f9:8d:0a:cc:0a:82:91:cd:ce:c9:7d:
        cf:8e:c9:b5:5a:7f:88:a4:6b:4d:b5:a8:51:f4:41:
        82:e1:c6:8a:00:7e:5e:65:5f:6a:ff:ff:ff:ff:ff:
        ff:ff:ff
    generator: 2 (0x2)

$ openssl dhparam -inform DER -in dh.der -outform PEM -out dh.pem
$ cat dh.pem
-----BEGIN DH PARAMETERS-----
MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
-----END DH PARAMETERS-----

(Beware that dhparam check is kinda silly).