DH “prime size” security in OpenSSL

There's a program that uses the following OpenSSL function...

DH_generate_parameters(256, 5, NULL, NULL)


...to create DH parameters which are later used for hundreds of key exchanges (and the one-time keys used to encrypt login details sent over Internet).

The manual page says 256 is prime_len in bits. How secure is this value? (I have a bad feeling.)

Also, if I'm reading http://www.keylength.com/, does this correspond to "discrete logarithm key" or "discrete logarithm group" or am I looking in the entirely wrong place?

-
By the way, you don't need to generate your own parameters. You can use, for example, get_rfc3526_prime_2048 to load some standard ones. –  Matt Nordhoff Jun 21 '14 at 22:37

1 Answer

I'm guessing whoever made the program was confused about key lengths. A 256-bit DH modulus will not give 256-bits of security. It will provide far less.

If you're reading http://www.keylength.com, the value here corresponds to the "discrete logarithm group". These days you really want a minimum of 2048 bits.

-
At work, so I cannot look up the constants, but I'm pretty sure the security of DH also depends on the parameter which is now 5 in the question (sub-group?). –  Maarten Bodewes Jun 23 '14 at 11:27