dsaparam.1s

dsaparam [-help] [-inform PEM|DER] [-outform PEM|DER] [-in filename] [-out filename] [-noout] [-text] [-check] [-genkey] [-C] [-no_prime_checks] [numbits]

-help
    Display help message and exit

-inform PEM|DER
    Input format (default: PEM)

-outform PEM|DER
    Output format (default: PEM)

-in filename
    Input file containing parameters

-out filename
    Output file for parameters

-noout
    Do not output parameters

-text
    Print parameters as human-readable text

-check
    Verify DSA parameters are valid

-genkey
    Generate and output DSA private key

-C
    Output parameters as C code

-no_prime_checks
    Skip primality checks on q

The dsaparam command from OpenSSL generates or processes DSA (Digital Signature Algorithm) parameters, consisting of a large prime p, a subprime q, and a generator g. These parameters are essential for DSA key pair generation and are publicly shared between signature creators and verifiers.

Typically invoked as openssl dsaparam, it supports generating new parameters of a specified bit length (default 1024), reading from an input file, verifying correctness, and outputting in PEM or DER format. Additional features include text output for readability, C code generation for embedding, and direct DSA private key generation from parameters.

Use cases include preparing DSA setups for secure digital signatures in legacy systems. Note that DSA usage is declining due to performance and security recommendations favoring elliptic curve variants.

DSA is legacy; NIST discourages new DSA deployments. Vulnerable to certain attacks if parameters are weak. Use larger bit lengths (≥2048) for security.

openssl dsaparam -genkey 2048 -out dsa_params.pem
Generates 2048-bit parameters and private key.

openssl dsaparam -check -in dsa_params.pem
Verifies parameters.

Introduced in early OpenSSL versions (pre-1.0). DSA standardized in FIPS 186-1 (1994); enhanced in later revisions. OpenSSL 3.0+ deprecates DSA in favor of ECDSA.

openssl(1), dsa(1), genpkey(1), dgst(1)