Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Anyone can "come up with their own".

In Debian, install openvpn with easy-rsa. Then:

    # cd /etc/openvpn/easy-rsa
    # source ./vars
    # ./build-dh
Some time (depending on sources of randomness) later, you'll have a unique dh2048.pem key, aka prime, such as this one I just created:

    -----BEGIN DH PARAMETERS-----
    MIIBCAKCAQEA3Mdx5SV5kjdmq+QdTG+JIwkqdlsrXYitOTUK2GQdlRI9JhYFW3cZ
    6R1oLy14JbhTKTHEzRrljePCyJJDq1gAVAcIdIazNWFRnuAMRN5HdJcDyXluaajO
    k3u9HDVlIyTIDiJC6fNXuq76AQV1J+8V5t2s+nqhYFIjxxeXdSdGqeGlINgM+kMm
    cRZa77UTk3MZK0uEjxeZNFnMIW+laCUT96YB8Vs+PH+7JPeMPBWJP7yQmrSEkOgD
    h8BxnE+P+6lTgtNgd1wKDzdGd8wES7ObXhAcxhZnKSUIUyuzzaJtXDMsj/rXXQip
    xIXKARi8X7uCaYZUEh5qC2F+uBoPjV6NywIBAg==
    -----END DH PARAMETERS-----


Or just run:

    openssl dhparam -out dhparam.pem 2048


Right, which is what build-dh calls.


So you can skip the "install OpenVPN" step...


True, but that's what I mostly use it for, so it's what came to mind.


The question isn't about what's possible, the question is about common practice. If everybody used their own private prime numbers this wouldn't have been news.


Thanks! I'll use that for all my secrets




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: