Key exchange algorithms are designed to allow two different parties to safely create an encryption key that can be used to communicate securely, and do so over an unsecured (or open) network, like the internet.<\/p>\n
Every key exchange method uses different math to achieve this. Without getting into the specifics, Diffie-Hellman uses\u00a0 a set of numbers known as \u201cDH parameters\u201d that kick off the whole key exchange process. These parameters include a very large prime number which is pre-computed. This means they are generated by the server before it starts forming connections. Properly supporting Diffie-Hellman requires that you generate unique DH parameters for your server.<\/p>\n
If you have used OpenSSL to generate Diffie-Hellman parameters, you may have noticed the console chugging along outputting \u201cdots\u201d(.) and \u201cpluses\u201d (+). Generating these parameters takes some time, so showing some sort of indicator that your server is still running is helpful. But these symbols are more than just a primitive \u201cloading bar.\u201d<\/p>\n The dots and pluses tell you every time your server has generated a number that it thinks may be a \u201csafe prime\u201d which can be used as the cryptographic underpinning for Diffie-Hellman SSL\/TLS connections.<\/p>\n Each dot represents a generated number that might be a prime, and each plus represents a number that was tested and found not to be a prime. Proving large numbers are prime is a rather intensive task, so a mathematical shortcut (the Miller-Rabin primality test<\/a>) is used to more quickly estimate if a number if prime. While it is not a 100% guarantee, it gets nearly as close with a lot less effort.<\/p>\n There is a third symbol as well: an asterisk (*). This indicates that a safe prime was found. You will only see the asterisk at the end of the output when your server has found the suitable prime it will use for your Diffie-Hellman parameters.<\/p>\n You will see in the screenshot above, that the output from generating DH parameters will end with sets of \u201c++*\u201d Planetbeing, a user over at StackExchange, explained why<\/a> that is. They wrote, \u201cThe first + means the prime p itself has passed one iteration of the Miller-Rabin primality test. The second + means the (p-1)\/2 also has passed one iteration of the Miller-Rabin primality test. The first * indicates both p and (p-1)\/2 has passed an iteration of the Miller-Rabin primality test.\u201d<\/p>\n This process is then repeated because OpenSSL wants to be very sure that this number is likely a prime, and therefore safe. The number of times this is repeated depends on the bit-size of the parameters<\/a>.<\/p>\n I generated 4096-bit parameters on a standard VPS to see how many dots and pluses would be outputted and how long it would take. It took just over 20 minutes and generated 26090 dots and 164 pluses, before finally finding a suitable prime.<\/p>\n April King, an engineer at Mozilla, recently generated a truly massive 32kb Diffie-Hellman group for badssl.com<\/a>, a test-bed website for different SSL errors. It took nearly 20 days<\/a> and generated one million numbers in search for a suitable prime of that size!<\/p>\n The way Diffie-Hellman is implemented in most server OSs makes it a security vulnerability<\/a>, and browsers like Chrome have recently removed support for these ciphers<\/a>, so we are likely to see less and less of it. Diffie-Hellman exists in other forms that are still safe to use, such as ECDHE, which incorporates Elliptic Curve Cryptography.<\/p>\n [1]<\/a> https:\/\/weakdh.org\/imperfect-forward-secrecy-ccs15.pdf<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Making Sense of the way Open SSL generates\u00a0Diffie-Hellman Parameters. This one is for the cryptography lovers and the curious\u2026 Diffie-Hellman key exchange, also known as DH or DHE, is one…<\/p>\n","protected":false},"author":2,"featured_media":3186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[130],"tags":[260,261,259,262,136,161],"class_list":["post-3184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-everything-encryption","tag-diffie-helman","tag-dots","tag-open-ssl","tag-pluses","tag-ssl","tag-tls","post-with-tags"],"views":12357,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/11\/Depositphotos_10694670_m-2015.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=3184"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3184\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/3186"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=3184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=3184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=3184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"open](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/11\/DHE.png\")
\n