---
name: "libressl-DH_generate_parameters"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-DH_generate_parameters"
---

# libressl-DH\_generate\_parameters(3)

generate and check Diffie-Hellman parameters

## NAME

**DH\_generate\_parameters\_ex**, **DH\_check**, **DH\_check\_pub\_key**, **DH\_generate\_parameters** – generate and check Diffie-Hellman parameters

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/dh.h\>**

*int*\

**DH\_generate\_parameters\_ex**(*DH \*dh*, *int prime\_len*, *int generator*, *BN\_GENCB \*cb*);

*int*\

**DH\_check**(*DH \*dh*, *int \*codes*);

*int*\

**DH\_check\_pub\_key**(*const DH \*dh*, *const BIGNUM \*pub\_key*, *int \*codes*);

Deprecated:

*DH* *\**\

**DH\_generate\_parameters**(*int prime\_len*, *int generator*, *void (\*callback)(int, int, void \*)*, *void \*cb\_arg*);

## DESCRIPTION

**DH\_generate\_parameters\_ex**() generates Diffie-Hellman parameters that can be shared among a group of users, and stores them in the provided *DH* structure.

*prime\_len* is the length in bits of the safe prime to be generated. *generator* is a small number \> 1, typically 2 or 5.

A callback function may be used to provide feedback about the progress of the key generation. If *cb* is not NULL, it will be called as described in BN\_generate\_prime(3) while a random prime number is generated, and when a prime has been found, **BN\_GENCB\_call**(*cb*, *3*, *0*) is called; see BN\_GENCB\_call(3).

**DH\_check**() validates Diffie-Hellman parameters. If no problems are found, \**codes* is set to zero. Otherwise, one or more of the following bits are set:

- DH\_CHECK\_P\_NOT\_PRIME

  The parameter *dh-\>p* is not prime.

- DH\_CHECK\_P\_NOT\_SAFE\_PRIME

  The parameter *dh-\>p* is not a safe prime.

- DH\_UNABLE\_TO\_CHECK\_GENERATOR

  The generator *dh-\>g* cannot be checked for suitability: it is neither 2 nor 5.

- DH\_NOT\_SUITABLE\_GENERATOR

  The generator *dh-\>g* is not suitable.

**DH\_check\_pub\_key**() checks whether *pub\_key* is a valid public key when using the domain parameters contained in *dh*. If no problems are found, \**codes* is set to zero. Otherwise, one or more of the following bits are set:

- DH\_CHECK\_PUBKEY\_TOO\_SMALL

  *pub\_key* is less than or equal to 1.

- DH\_CHECK\_PUBKEY\_TOO\_LARGE

  *pub\_key* is greater than or equal to *dh-\>p* - 1.

- DH\_CHECK\_PUBKEY\_INVALID

  *dh-\>q* is set but *pub\_key* to the power of *dh-\>q* is not 1 modulo *dh-\>p*.

## RETURN VALUES

**DH\_generate\_parameters\_ex**(), **DH\_check**(), and **DH\_check\_pub\_key**() return 1 if the check could be performed or 0 otherwise.

**DH\_generate\_parameters**() (deprecated) returns a pointer to the *DH* structure, or NULL if the parameter generation fails.

The error codes can be obtained by ERR\_get\_error(3).

## SEE ALSO

DH\_get0\_pqg(3), DH\_new(3)

## HISTORY

**DH\_check**() and **DH\_generate\_parameters**() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.

The *cb\_arg* argument to **DH\_generate\_parameters**() was added in SSLeay 0.9.0.

**DH\_check\_pub\_key**() first appeared in OpenSSL 0.9.8a and has been available since OpenBSD 4.0.

**DH\_generate\_parameters\_ex**() first appeared in OpenSSL 0.9.8 and has been available since OpenBSD 4.5.

## CAVEATS

**DH\_generate\_parameters\_ex**() and **DH\_generate\_parameters**() may run for several hours before finding a suitable prime.

The parameters generated by **DH\_generate\_parameters\_ex**() and **DH\_generate\_parameters**() are not to be used in signature schemes.

## BUGS

If *generator* is not 2 or 5, *dh-\>g*=*generator* is not a usable generator.