Diffie-Hellman parameters - Revision history

Jwalton: Spelling.

2021-05-12T20:55:39Z

Spelling.

Jwalton: Rework introduction.

2021-05-12T19:28:18Z

Rework introduction.

Jwalton: Reorganize Diffie-Hellman Groups. Add RFC 7919 group parameters.

2021-05-12T19:21:36Z

Reorganize Diffie-Hellman Groups. Add RFC 7919 group parameters.

Jflopezfernandez: Added page to examples category

2019-07-29T20:54:33Z

Added page to examples category

Jwalton: Added 1536-bit group.

2014-03-08T11:34:28Z

Added 1536-bit group.

Jwalton: Fixed formatting.

2014-03-08T11:25:30Z

Fixed formatting.

Jwalton: Added 1024-bit group.

2014-03-08T11:23:01Z

Added 1024-bit group.

Jwalton: Formatting.

2014-01-17T12:24:52Z

Formatting.

Jwalton: 2 -> DH_GENERATOR_2

2014-01-17T08:28:04Z

2 -> DH_GENERATOR_2

Jwalton: Grammar and markup.

2014-01-16T22:28:55Z

Grammar and markup.

@@ Line 1: / Line 1: @@
 TLS key agreement algorithms use [[Diffie Hellman|Diffie-Hellman]] groups and provide [http://blog.ivanristic.com/2013/06/ssl-labs-deploying-forward-secrecy.html perfect forward secrecy] (PFS). To use Diffie-Hellman groups and cipher suites with perfect forward secrecy, you must set up Diffie-Hellman parameters [http://www.mail-archive.com/openssl-users@openssl.org/msg71878.html at the server] or the PFS cipher suites will be silently ignored.
-Your Diffie-Hellman group parameters should match the key size used in the server's certificate. If you use a 2048-bit RSA prime in the server's certificate, then use a 2048-bit Dhiifie-Hellman group for key agreement.
+Your Diffie-Hellman group parameters should match the key size used in the server's certificate. If you use a 2048-bit RSA prime in the server's certificate, then use a 2048-bit Diffie-Hellman group for key agreement.
 Due to [https://weakdh.org/ Logjam vulnerabilities] you should use a group with 2048-bits or higher.

@@ Line 1: / Line 1: @@
-To use [http://blog.ivanristic.com/2013/06/ssl-labs-deploying-forward-secrecy.html perfect forward secrecy] cipher suites, you must set up [[Diffie Hellman|Diffie-Hellman]] parameters ([http://www.mail-archive.com/openssl-users@openssl.org/msg71878.html on the server side]), or the PFS cipher suites will be silently ignored.
+TLS key agreement algorithms use [[Diffie Hellman|Diffie-Hellman]] groups and provide [http://blog.ivanristic.com/2013/06/ssl-labs-deploying-forward-secrecy.html perfect forward secrecy] (PFS). To use Diffie-Hellman groups and cipher suites with perfect forward secrecy, you must set up Diffie-Hellman parameters [http://www.mail-archive.com/openssl-users@openssl.org/msg71878.html at the server] or the PFS cipher suites will be silently ignored.
 == Diffie-Hellman ==
@@ Line 131: / Line 135: @@
 To avoid the runtime costs associated with finding a group, you typically you use a standard group, like those published in RFC 3526 or RFC 7919. The declarations for the IETF groups are provided below.
-Due to [https://weakdh.org/ Logjam vulnerabilities] you should use a group with 2048-bits or higher.
+=== RFC 3526 Groups ===
 Below are five Diffie-Hellman MODP groups specified in [http://tools.ietf.org/html/rfc3526 RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)] (the 1024-bit parameter is from RFC 2409). They can be used with <tt>PEM_read_bio_DHparams</tt> and a memory <tt>BIO</tt>. RFC 3526 also offers 1536-bit, 6144-bit and 8192-bit primes.
@@ Line 190: / Line 192: @@
      "-----END DH PARAMETERS-----\n";</pre>
-== RFC 7919 Groups ==
+=== RFC 7919 Groups ===
 Below are three additional Diffie-Hellman groups specified in [http://tools.ietf.org/html/rfc3526 RFC 7919, Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS)]. They can be used with <tt>PEM_read_bio_DHparams</tt> and a memory <tt>BIO</tt>.

@@ Line 123: / Line 123: @@
 For more information, see [[Elliptic Curve Diffie Hellman]] and [[Elliptic Curve Cryptography]].
-== RFC 3526 PEM Encoded Groups ==
+== Diffie-Hellman Groups ==
-Below are three Diffie-Hellman MODP groups specified in [http://tools.ietf.org/html/rfc3526 RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)] (the 1024-bit parameter is from RFC 2409). They can be used with <tt>PEM_read_bio_DHparams</tt> and a memory <tt>BIO</tt>. RFC 3526 also offers 1536-bit, 6144-bit and 8192-bit primes.
+Ephemeral Diffie-Hellman key agreement needs to happen over a group. The client and server will each pick a random value in the group and perform key agreement with the random parameters. For each run of the protocol, the random parameters will change but the group will remain the same. When you need a group you can either calculate one; or you can use a standard group published by a standards body like the IETF.
 <pre>static const char g_dh1024_sz[] =
@@ Line 132: / Line 142: @@
      "Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL\n"
      "/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC\n"
-     "-----END DH PARAMETERS-----";
+     "-----END DH PARAMETERS-----\n";
 static const char g_dh1536_sz[] = "-----BEGIN DH PARAMETERS-----\n"
@@ Line 140: / Line 150: @@
      "Fj+o/STPX4NlXSPco62WHGLzViCFUrue1SkHcJaWbWcMNU5KvJgE8XRsCMojcyf/\n"
      "/////////wIBAg==\n"
-     "-----END DH PARAMETERS-----";
+     "-----END DH PARAMETERS-----\n";
 static const char g_dh2048_sz[] =
@@ Line 150: / Line 160: @@
      "fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq\n"
      "5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==\n"
-     "-----END DH PARAMETERS-----";
+     "-----END DH PARAMETERS-----\n";
 static const char g_dh3072_sz[] =
@@ Line 163: / Line 173: @@
      "ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqTrS\n"
      "yv//////////AgEC\n"
-     "-----END DH PARAMETERS-----";
+     "-----END DH PARAMETERS-----\n";
 static const char g_dh4096_sz[] =
@@ Line 178: / Line 188: @@
      "+S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI\n"
      "HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=\n"
-     "-----END DH PARAMETERS-----";</pre>
+     "-----END DH PARAMETERS-----\n";</pre>
 [[Category:Examples]]

← Older revision		Revision as of 20:54, 29 July 2019
Line 179:		Line 179:
	"HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=\n"		"HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=\n"
	"-----END DH PARAMETERS-----";</pre>		"-----END DH PARAMETERS-----";</pre>
		+
		+	[[Category:Examples]]

@@ Line 132: / Line 132: @@
      "Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL\n"
      "/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC\n"
      "-----END DH PARAMETERS-----";

@@ Line 64: / Line 64: @@
 == Validating Parameters ==
-The Diffie-Hellman parameters should be validated after loading. To do so, you will call <tt>DH_check</tt>.
+The Diffie-Hellman parameters should be validated after loading. To perform paramter validation, you call <tt>DH_check</tt>. <tt>DH_check</tt> returns 0 or a bitmask values of the following:
-<tt>DH_check</tt> returns 0 or a bitmask values of the following:
+* <tt>DH_CHECK_P_NOT_PRIME</tt> (0x01)
+* <tt>DH_CHECK_P_NOT_SAFE_PRIME</tt> (0x02)
- * DH_CHECK_P_NOT_PRIME (0x01)
+* <tt>DH_UNABLE_TO_CHECK_GENERATOR</tt> (0x04)
- * DH_CHECK_P_NOT_SAFE_PRIME (0x02)
+* <tt>DH_NOT_SUITABLE_GENERATOR</tt> (0x08)
 The validation code might look as follows (error checking omitted for clarity):

@@ Line 82: / Line 82: @@
 assert(rc == 1);
-if(BN_is_word(dh->g, 2))
+if(BN_is_word(dh->g, DH_GENERATOR_2))
+{
      long residue = BN_mod_word(dh->p, 24);

@@ Line 64: / Line 64: @@
 == Validating Parameters ==
-The Diffie-Hellman parameters should be validated after loading. To do so, you will call <tt>DH_check</tt>. <tt>DH_check</tt> return 0 or a bitmask values of the following:
+The Diffie-Hellman parameters should be validated after loading. To do so, you will call <tt>DH_check</tt>.
   * DH_CHECK_P_NOT_PRIME (0x01)
@@ Line 100: / Line 102: @@
      printf("DH_check: p is not a safe prime\n");</pre>
-The additional call to `BN_mod_word(dh->p, 24)` (and unmasking of <tt>DH_NOT_SUITABLE_GENERATOR</tt>) is performed to ensure your program accepts IETF group parameters. OpenSSL checks the prime is congruent to 11 when <tt>g = 2</tt>; while the IETF's primes are congruent to 23 when <tt>g = 2</tt>. Without the test, the IETF parameters would fail validation. For details, see [http://crypto.stackexchange.com/questions/12961/diffie-hellman-parameter-check-when-g-2-must-p-mod-24-11 Diffie-Hellman Parameter Check (when g = 2, must p mod 24 == 11?)].
+The additional call to <tt>BN_mod_word(dh->p, 24)</tt> (and unmasking of <tt>DH_NOT_SUITABLE_GENERATOR</tt>) is performed to ensure your program accepts IETF group parameters. OpenSSL checks the prime is congruent to 11 when <tt>g = 2</tt>; while the IETF's primes are congruent to 23 when <tt>g = 2</tt>. Without the test, the IETF parameters would fail validation. For details, see [http://crypto.stackexchange.com/questions/12961/diffie-hellman-parameter-check-when-g-2-must-p-mod-24-11 Diffie-Hellman Parameter Check (when g = 2, must p mod 24 == 11?)].
 == Elliptic curve Diffie-Hellman ==