If openssl uses a lot of CPU then it is not blocked waiting for "entropy". OpenSSL is actually sane in that respect, and uses a cryptographically secure PRNG to extend an initial seed into as many bits as it needs. When you use dhparam , OpenSSL not only generates DH parameters; it also wants to assert his social status by taking care to use for the modulus a so-called "strong prime", which is useless for security but requires an awful lot more computational effort. A "strong prime" is a prime p such that ( p -1)/2 is also prime. The prime generation algorithm looks like this: Generate a random odd integer p . Test whether p is prime. If not, loop. Test whether ( p -1)/2 is prime. If not, loop. Random odd 4096-bit integers are probability about 1/2000 to be prime, and since both p and ( p -1)/2 must be prime, this will need on average generating and testing for primality about 4 millions of odd...
In Flanders fields the poppies blow Between the crosses, row on row, That mark our place; and in the sky The larks, still bravely singing, fly Scarce heard amid the guns below. We are the Dead. Short days ago We lived, felt dawn, saw sunset glow, Loved and were loved, and now we lie, In Flanders fields. Take up our quarrel with the foe: To you from failing hands we throw The torch; be yours to hold it high. If ye break faith with us who die We shall not sleep, though poppies grow In Flanders fields. - John McCrae
Comments
Post a Comment