Generating a Diffie-Hellman 4096-bit Key

Linode Staff

I'm trying to generate a 4096-bit DH key, but it has taken over 24 hours and the key is still trying to generate. Can I make this faster?

2 Replies

You're probably not generating enough entropy on your guest. Try generating system activity, like writing to the disk.

You can also use a program like haveged. I won't speak of the security implications as that's a much more complicated subject, but you should know there could be some.

Diffie-Hellman keys can take a long time to generate because dhparam requires something known as a strong prime. Strong primes provide little to no security benefit but take a lot of effort to produce.

Instead, you should be using the -dsaparam option to decrease generation time by avoiding strong prime effort. Here's an example of that:

openssl dhparam -dsaparam -out dhparam2.pem 4096

You can read more about this in the following OpenSSL manpage where you'll find:

If this option is used, DSA rather than DH parameters are read or created; they are converted to DH format. Otherwise, "strong" primes (such that (p-1)/2 is also prime) will be used for DH parameter generation.
DH parameter generation with the -dsaparam option is much faster, and the recommended exponent length is shorter, which makes DH key exchange more efficient. Beware that with such DSA-style DH parameters, a fresh DH key should be created for each use to avoid small-subgroup attacks that may be possible otherwise.

There's some additional discussion on this topic here, as well:


Please enter an answer

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct