1=pod
2{- OpenSSL::safe::output_do_not_edit_headers(); -}
3
4=head1 NAME
5
6openssl-dhparam - DH parameter manipulation and generation
7
8=head1 SYNOPSIS
9
10B<openssl dhparam>
11[B<-help>]
12[B<-inform> B<DER>|B<PEM>]
13[B<-outform> B<DER>|B<PEM>]
14[B<-in> I<filename>]
15[B<-out> I<filename>]
16[B<-dsaparam>]
17[B<-check>]
18[B<-noout>]
19[B<-text>]
20[B<-2>]
21[B<-3>]
22[B<-5>]
23{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -}
24{- $OpenSSL::safe::opt_provider_synopsis -}
25[I<numbits>]
26
27=head1 DESCRIPTION
28
29This command is used to manipulate DH parameter files.
30
31See L<openssl-genpkey(1)/EXAMPLES> for examples on how to generate
32a key using a named safe prime group without generating intermediate
33parameters.
34
35=head1 OPTIONS
36
37=over 4
38
39=item B<-help>
40
41Print out a usage message.
42
43=item B<-inform> B<DER>|B<PEM>, B<-outform> B<DER>|B<PEM>
44
45The input format and output format; the default is B<PEM>.
46The object is compatible with the PKCS#3 B<DHparameter> structure.
47See L<openssl-format-options(1)> for details.
48
49=item B<-in> I<filename>
50
51This specifies the input filename to read parameters from or standard input if
52this option is not specified.
53
54=item B<-out> I<filename>
55
56This specifies the output filename parameters to. Standard output is used
57if this option is not present. The output filename should B<not> be the same
58as the input filename.
59
60=item B<-dsaparam>
61
62If this option is used, DSA rather than DH parameters are read or created;
63they are converted to DH format.  Otherwise, "strong" primes (such
64that (p-1)/2 is also prime) will be used for DH parameter generation.
65
66DH parameter generation with the B<-dsaparam> option is much faster,
67and the recommended exponent length is shorter, which makes DH key
68exchange more efficient.  Beware that with such DSA-style DH
69parameters, a fresh DH key should be created for each use to
70avoid small-subgroup attacks that may be possible otherwise.
71
72=item B<-check>
73
74Performs numerous checks to see if the supplied parameters are valid and
75displays a warning if not.
76
77=item B<-2>, B<-3>, B<-5>
78
79The generator to use, either 2, 3 or 5. If present then the
80input file is ignored and parameters are generated instead. If not
81present but I<numbits> is present, parameters are generated with the
82default generator 2.
83
84=item I<numbits>
85
86This option specifies that a parameter set should be generated of size
87I<numbits>. It must be the last option. If this option is present then
88the input file is ignored and parameters are generated instead. If
89this option is not present but a generator (B<-2>, B<-3> or B<-5>) is
90present, parameters are generated with a default length of 2048 bits.
91The minimum length is 512 bits. The maximum length is 10000 bits.
92
93=item B<-noout>
94
95This option inhibits the output of the encoded version of the parameters.
96
97=item B<-text>
98
99This option prints out the DH parameters in human readable form.
100
101{- $OpenSSL::safe::opt_engine_item -}
102
103{- $OpenSSL::safe::opt_r_item -}
104
105{- $OpenSSL::safe::opt_provider_item -}
106
107=back
108
109=head1 NOTES
110
111This command replaces the B<dh> and B<gendh> commands of previous
112releases.
113
114=head1 SEE ALSO
115
116L<openssl(1)>,
117L<openssl-pkeyparam(1)>,
118L<openssl-dsaparam(1)>,
119L<openssl-genpkey(1)>.
120
121=head1 HISTORY
122
123The B<-engine> option was deprecated in OpenSSL 3.0.
124
125The B<-C> option was removed in OpenSSL 3.0.
126
127=head1 COPYRIGHT
128
129Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.
130
131Licensed under the Apache License 2.0 (the "License").  You may not use
132this file except in compliance with the License.  You can obtain a copy
133in the file LICENSE in the source distribution or at
134L<https://www.openssl.org/source/license.html>.
135
136=cut
137