<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thanks for the explanation. So I guess I just got lucky with the first one. :) Do you have any kind of estimate of how long it will take to generate?<br><br><div>> Date: Wed, 14 Jan 2015 13:27:55 +0000<br>> From: matt@openssl.org<br>> To: openssl-users@openssl.org<br>> Subject: Re: [openssl-users] Generating large DH parameters<br>> <br>> <br>> <br>> On 14/01/15 12:35, jack seth wrote:<br>> > I am trying to generate a 16384 bit DH file for testing purposes. Is<br>> > it necessary to have a '.rnd' in existence before trying to generate<br>> > this file? I generated one which took 4 days to do but the computer had<br>> > a .rnd file. I am currently trying to generate another on a system<br>> > WITHOUT the .rnd file and it has been going 3 WEEKS so far. Did I just<br>> > get lucky with the first DH file and it really can take this long (or<br>> > longer) to make this file or does openssl really need the .rnd file to<br>> > do this?<br>> <br>> The purpose of the .rnd file is to seed the random number generator with<br>> entropy before you start. The built-in OpenSSL PRNG will attempt to seed<br>> itself from various different sources dependent on the platform that you<br>> are on, e.g. if you have a "/dev/urandom" then it will try to use it.<br>> Some platforms may have very restricted access to entropy sources, and<br>> on those platforms a .rnd file might be particularly useful. Assuming<br>> you are using a relatively modern desktop machine this is unlikely to be<br>> a problem for you.<br>> <br>> If the PRNG has not been seeded with sufficient entropy then it will<br>> fail with the "PRNG not seeded" error:<br>> https://www.openssl.org/support/faq.html#USER1<br>> <br>> The fact that you have not seen that error means that the PRNG believes<br>> it has been sufficiently seeded. The method that was used to seed the<br>> PRNG will not have a subsequent impact on its performance.<br>> <br>> In other words, the presence or otherwise of the .rnd file will not<br>> impact the performance once seeding is complete.<br>> <br>> The reason it is taking so long is that 16384 bits is GIGANTIC!<br>> <br>> Matt<br>> <br>> _______________________________________________<br>> openssl-users mailing list<br>> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users<br></div> </div></body>
</html>