diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/apps/dhparam.pod | 40 | ||||
| -rw-r--r-- | doc/apps/rand.pod | 2 |
2 files changed, 30 insertions, 12 deletions
diff --git a/doc/apps/dhparam.pod b/doc/apps/dhparam.pod index 6b237ec..15aabf4 100644 --- a/doc/apps/dhparam.pod +++ b/doc/apps/dhparam.pod @@ -6,18 +6,19 @@ dhparam - DH parameter manipulation and generation =head1 SYNOPSIS -B<openssl dh> +B<openssl dhparam> [B<-inform DER|PEM>] [B<-outform DER|PEM>] -[B<-in filename>] -[B<-out filename>] +[B<-in> I<filename>] +[B<-out> I<filename>] +[B<-dsaparam>] [B<-noout>] [B<-text>] [B<-C>] [B<-2>] [B<-5>] -[B<-rand file(s)>] -[numbits] +[B<-rand> I<file(s)>] +[I<numbits>] =head1 DESCRIPTION @@ -39,23 +40,35 @@ additional header and footer lines. This specifies the output format, the options have the same meaning as the B<-inform> option. -=item B<-in filename> +=item B<-in> I<filename> This specifies the input filename to read parameters from or standard input if this option is not specified. -=item B<-out filename> +=item B<-out> I<filename> This specifies the output filename parameters to. Standard output is used if this option is not present. The output filename should B<not> be the same as the input filename. +=item B<-dsaparam> + +If this option is used, DSA rather than DH parameters are read or created; +they are converted to DH format. Otherwise, "strong" primes (such +that (p-1)/2 is also prime) will be used for DH parameter generation. + +DH parameter generation with the B<-dsaparam> option is much faster, +and the recommended exponent length is shorter, which makes DH key +exchange more efficient. Beware that with such DSA-style DH +parameters, a fresh DH key should be created for each use to +avoid small-subgroup attacks that may be possible otherwise. + =item B<-2>, B<-5> The generator to use, either 2 or 5. 2 is the default. If present then the input file is ignored and parameters are generated instead. -=item B<-rand file(s)> +=item B<-rand> I<file(s)> a file or files containing random data used to seed the random number generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>). @@ -63,10 +76,10 @@ Multiple files can be specified separated by a OS-dependent character. The separator is B<;> for MS-Windows, B<,> for OpenVSM, and B<:> for all others. -=item B<numbits> +=item I<numbits> this option specifies that a parameter set should be generated of size -B<numbits>. It must be the last option. If not present then a value of 512 +I<numbits>. It must be the last option. If not present then a value of 512 is used. If this option is present then the input file is ignored and parameters are generated instead. @@ -81,7 +94,7 @@ this option prints out the DH parameters in human readable form. =item B<-C> this option converts the parameters into C code. The parameters can then -be loaded by calling the B<get_dhXXX()> function. +be loaded by calling the B<get_dh>I<numbits>B<()> function. =back @@ -112,4 +125,9 @@ There should be a way to generate and manipulate DH keys. L<dsaparam(1)|dsaparam(1)> +=head1 HISTORY + +The B<dhparam> command was added in OpenSSL 0.9.5. +The B<-dsaparam> option was added in OpenSSL 0.9.6. + =cut diff --git a/doc/apps/rand.pod b/doc/apps/rand.pod index 65912d3..f81eab0 100644 --- a/doc/apps/rand.pod +++ b/doc/apps/rand.pod @@ -8,7 +8,7 @@ rand - generate pseudo-random bytes B<openssl rand> [B<-out> I<file>] -[B<-rand> I<file(s)> +[B<-rand> I<file(s)>] [B<-base64>] I<num> |