1=pod 2{- OpenSSL::safe::output_do_not_edit_headers(); -} 3 4=head1 NAME 5 6openssl-dhparam - DH parameter manipulation and generation 7 8=head1 SYNOPSIS 9 10B<openssl dhparam> 11[B<-help>] 12[B<-inform> B<DER>|B<PEM>] 13[B<-outform> B<DER>|B<PEM>] 14[B<-in> I<filename>] 15[B<-out> I<filename>] 16[B<-dsaparam>] 17[B<-check>] 18[B<-noout>] 19[B<-text>] 20[B<-verbose>] 21[B<-quiet>] 22[B<-2>] 23[B<-3>] 24[B<-5>] 25{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} 26{- $OpenSSL::safe::opt_provider_synopsis -} 27[I<numbits>] 28 29=head1 DESCRIPTION 30 31This command is used to manipulate DH parameter files. 32 33See L<openssl-genpkey(1)/EXAMPLES> for examples on how to generate 34a key using a named safe prime group without generating intermediate 35parameters. 36 37=head1 OPTIONS 38 39=over 4 40 41=item B<-help> 42 43Print out a usage message. 44 45=item B<-inform> B<DER>|B<PEM>, B<-outform> B<DER>|B<PEM> 46 47The input format and output format; the default is B<PEM>. 48The object is compatible with the PKCS#3 B<DHparameter> structure. 49See L<openssl-format-options(1)> for details. 50 51=item B<-in> I<filename> 52 53This specifies the input file to read parameters from or standard input if 54this option is not specified. 55 56=item B<-out> I<filename> 57 58This specifies the output file to write parameters to. 59Standard output is used if this option is not present. 60The output filename can be the same as the input filename, 61which leads to replacing the file contents. 62Note that file I/O is not atomic. The output file is truncated and then written. 63 64=item B<-dsaparam> 65 66If this option is used, DSA rather than DH parameters are read or created; 67they are converted to DH format. Otherwise, safe primes (such 68that (p-1)/2 is also prime) will be used for DH parameter generation. 69 70DH parameter generation with the B<-dsaparam> option is much faster. 71Beware that with such DSA-style DH parameters, a fresh DH key should be 72created for each use to avoid small-subgroup attacks that may be possible 73otherwise. 74 75=item B<-check> 76 77Performs numerous checks to see if the supplied parameters are valid and 78displays a warning if not. 79 80=item B<-2>, B<-3>, B<-5> 81 82The generator to use, either 2, 3 or 5. If present then the 83input file is ignored and parameters are generated instead. If not 84present but I<numbits> is present, parameters are generated with the 85default generator 2. 86 87=item I<numbits> 88 89This option specifies that a parameter set should be generated of size 90I<numbits>. It must be the last option. If this option is present then 91the input file is ignored and parameters are generated instead. If 92this option is not present but a generator (B<-2>, B<-3> or B<-5>) is 93present, parameters are generated with a default length of 2048 bits. 94The minimum length is 512 bits. The maximum length is 10000 bits. 95 96=item B<-noout> 97 98This option inhibits the output of the encoded version of the parameters. 99 100=item B<-text> 101 102This option prints out the DH parameters in human readable form. 103 104{- $OpenSSL::safe::opt_engine_item -} 105 106{- $OpenSSL::safe::opt_r_item -} 107 108{- $OpenSSL::safe::opt_provider_item -} 109 110=item B<-verbose> 111 112This option enables the output of progress messages, which is handy when 113running commands interactively that may take a long time to execute. 114 115=item B<-quiet> 116 117This option suppresses the output of progress messages, which may be 118undesirable in batch scripts or pipelines. 119 120=back 121 122=head1 NOTES 123 124This command replaces the B<dh> and B<gendh> commands of previous 125releases. 126 127=head1 SEE ALSO 128 129L<openssl(1)>, 130L<openssl-pkeyparam(1)>, 131L<openssl-dsaparam(1)>, 132L<openssl-genpkey(1)>. 133 134=head1 HISTORY 135 136The B<-engine> option was deprecated in OpenSSL 3.0. 137 138The B<-C> option was removed in OpenSSL 3.0. 139 140=head1 COPYRIGHT 141 142Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved. 143 144Licensed under the Apache License 2.0 (the "License"). You may not use 145this file except in compliance with the License. You can obtain a copy 146in the file LICENSE in the source distribution or at 147L<https://www.openssl.org/source/license.html>. 148 149=cut 150
