0

When I generated a diffie-hellman prime number using openssl, the output file had some weird characters at the end and I wanted to understand what it means.

Background info:

My goal was to generate a safe prime number for use with Diffie-Hellman which is at least 500 bits long, and compatible with generator 5.

These are the terminal commands I used:

mymacbookname myname$ openssl dhparam -out dh512.der 512 -5 -outform DER -text
Generating DH parameters, 512 bit long safe prime, generator 5
This is going to take a long time
.......................+.+..+..........+............+........+................+....................+................................+.+...............................................................+......+.......+.............................+........+............................+............+..................+................+..........+..............+........................................+.....+............................................+.............+......+...........+....+..........................................+.........................................................+..........................+.................................+................+...+............+...+....................+................+....+...+.+.....................+......................+..............+..................++*++*++*++*++*++*
mymacbookname myname$ 

I renamed the file "dh512.der" to "dh512.der.txt" and this is what was in the text file: (This is for a class project and will not be used in any important key-exchange.)

Diffie-Hellman-Parameters: (512 bit)
    prime:
        00:9f:71:b9:ea:51:1e:95:d2:9a:66:65:bd:d2:a1:
        31:bd:6d:58:0d:59:06:c4:43:e2:53:34:03:f9:5b:
        c7:4e:48:1e:b0:1f:2c:7f:16:ff:1d:47:26:7d:4d:
        14:63:42:cf:ba:42:ee:06:83:6d:e6:f9:f0:6a:5a:
        fb:ca:66:da:87
    generator: 5 (0x5)
0FAüqπÍQï“öfeΩ“°1ΩmX YƒC‚S4˘[«NH∞,ˇG&}McBœ∫BÓÉmÊ˘jZ˚ f⁄á

I'm pretty sure that

            00:9f:71:b9:ea:51:1e:95:d2:9a:66:65:bd:d2:a1:
            31:bd:6d:58:0d:59:06:c4:43:e2:53:34:03:f9:5b:
            c7:4e:48:1e:b0:1f:2c:7f:16:ff:1d:47:26:7d:4d:
            14:63:42:cf:ba:42:ee:06:83:6d:e6:f9:f0:6a:5a:
            fb:ca:66:da:87

is the prime number I am seeking in hex format separated by :'s. But I am just curious about this part:

0FAüqπÍQï“öfeΩ“°1ΩmX YƒC‚S4˘[«NH∞,ˇG&}McBœ∫BÓÉmÊ˘jZ˚ f⁄á

What is that there for? What does it mean? I looked at the manual page https://www.openssl.org/docs/apps/dhparam.html and it has no description of what the output files will contain.

Thanks!


Update:

I tried viewing the PEM file as text, so I changed the option from DER to PEM.

Terminal command:

openssl dhparam -out dh512pem.txt 512 -5 -outform PEM -text

Terminal output:

Generating DH parameters, 512 bit long safe prime, generator 5
This is going to take a long time
......................................+...............................+........................................+...................+.........................+....+..........................................................................................................+.......................+............+........+...+..+................+.........................+......+.....................+........................+.........................................+..............................................+..........+..............................................+.........................+......+..............+...........+..+...............................................+....................................+..........+....................+.........+...................+........+.....................+..............................................+..+............+................+...............................+.+.............+.....................................+.............+............................+.......+.......................................................+...................+.........+.........+.................+..............+..........+.+..+.................................+.......+........+...............+....................+..................+.............+............+.........+...............++*++*++*++*++*++*

Contents of dh512pem.txt:

Diffie-Hellman-Parameters: (512 bit)
    prime:
        00:d6:23:97:87:75:2d:88:73:24:26:dc:be:c9:70:
        21:81:02:7d:ca:be:10:89:ba:57:f0:e1:2f:ca:b0:
        da:fd:5d:67:c9:51:f9:8c:e8:f2:20:dd:23:72:e5:
        a0:79:1c:ad:98:93:3e:c2:14:18:f9:02:5a:1a:0e:
        5a:d8:de:68:27
    generator: 5 (0x5)
-----BEGIN DH PARAMETERS-----
MEYCQQDWI5eHdS2IcyQm3L7JcCGBAn3KvhCJulfw4S/KsNr9XWfJUfmM6PIg3SNy
5aB5HK2Ykz7CFBj5AloaDlrY3mgnAgEF
-----END DH PARAMETERS-----

I am thinking that it output the DER format after printing the text (hex) version. Because when I switched to PEM format, it output base64 after printing the text version.

Source backing up this idea: Man page https://www.openssl.org/docs/apps/dhparam.html

-inform DER|PEM This specifies the input format. The DER option uses an ASN1 DER encoded form compatible with the PKCS#3 DHparameter structure. The PEM form is the default format: it consists of the DER format base64 encoded with additional header and footer lines.

-outform DER|PEM This specifies the output format, the options have the same meaning as the -inform option.

migrated from security.stackexchange.com Dec 8 '14 at 9:17

This question came from our site for information security professionals.

  • You are right the first output you saw is the DER output, except that is should be on the line after "generator: 5 (0x5)" DER is at least partly binary (in this case entirely so) which looks like gibberish when written to a terminal or printer. AIUI when you find the answer yourself the best procedure is to enter it so the question doesn't continue to show as open security.stackexchange.com/help/self-answer . – dave_thompson_085 Dec 6 '14 at 3:10
  • Ok. I was just waiting for someone to confirm that my idea was right. You're right, there was a newline in there but somehow it didn't show up, so I put it back. – Rock Lee Dec 7 '14 at 5:47
0

My idea when I updated my question was correct. Thanks to dave_thompson_085 for confirming that it was the DER output. That DER output is the same output that would have been there if I hadn't put the "-text" option. The text option made it print "human-readable" format in addition to the DER output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.