DH_GENERATE_PARAMETERS(3) | Library Functions Manual | DH_GENERATE_PARAMETERS(3) |
DH_generate_parameters_ex
,
DH_check
,
DH_generate_parameters
—
generate and check Diffie-Hellman parameters
#include
<openssl/dh.h>
int
DH_generate_parameters_ex
(DH
*dh, int prime_len, int
generator, BN_GENCB *cb);
int
DH_check
(DH *dh,
int *codes);
Deprecated:
DH *
DH_generate_parameters
(int
prime_len, int generator, void
(*callback)(int, int, void *), void
*cb_arg);
DH_generate_parameters_ex
()
generates Diffie-Hellman parameters that can be shared among a group of
users, and stores them in the provided DH
structure.
prime_len is the length in bits of the safe prime to be generated. generator is a small number > 1, typically 2 or 5.
A callback function may be used to provide
feedback about the progress of the key generation. If
cb is not NULL
, it will be
called as described in
BN_generate_prime(3) while a
random prime number is generated, and when a prime has been found,
BN_GENCB_call
(cb,
3, 0) is called; see
BN_GENCB_call(3).
DH_check
()
validates Diffie-Hellman parameters. If no problems are found,
*codes is set to zero. Otherwise, one or more of the
following bits are set:
DH_CHECK_P_NOT_PRIME
DH_CHECK_P_NOT_SAFE_PRIME
DH_UNABLE_TO_CHECK_GENERATOR
DH_NOT_SUITABLE_GENERATOR
DH_generate_parameters_ex
() and
DH_check
() return 1 if the check could be performed,
or 0 otherwise.
DH_generate_parameters
() (deprecated)
returns a pointer to the DH structure, or
NULL
if the parameter generation fails.
The error codes can be obtained by ERR_get_error(3).
DH_check
() and
DH_generate_parameters
() first appeared in SSLeay
0.5.1 and have been available since OpenBSD 2.4.
The cb_arg argument to
DH_generate_parameters
() was added in SSLeay
0.9.0.
In versions before OpenSSL 0.9.5,
DH_CHECK_P_NOT_STRONG_PRIME
is used instead of
DH_CHECK_P_NOT_SAFE_PRIME
.
DH_generate_parameters_ex
() first appeared
in OpenSSL 0.9.8 and has been available since OpenBSD
4.5.
DH_generate_parameters_ex
() and
DH_generate_parameters
() may run for several hours
before finding a suitable prime.
The parameters generated by
DH_generate_parameters_ex
() and
DH_generate_parameters
() are not to be used in
signature schemes.
If generator is not 2 or 5, dh->g=generator is not a usable generator.
June 10, 2019 | OpenBSD-current |