---
title: "Why Diffie-Hellman keys generation is important?"
description: "### Overview **Diffie-Hellman key exchange (D-H)** is a method to generate a private key between two machines connected through an insecure channel. When a client begins a connection to a secured web service the SSL negotiation occurs exchanging the public…"
url: "https://www.relianoid.com/resources/knowledge-base/misc/diffie-hellman-keys-generation-important/"
updated: "2023-08-04"
category: Misc
---

# Why Diffie-Hellman keys generation is important?

### Overview

**Diffie-Hellman key exchange (D-H)** is a method to generate a private key between two machines connected through an insecure channel.

When a client begins a connection to a secured web service the SSL negotiation occurs exchanging the public keys and then, the two parties comes into an agreement in regards to the keys and ciphers to be used during the communication.

In [this illustration](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#/media/File:Diffie-Hellman_Key_Exchange.svg) is perfectly explained how the negotiation behaves with colors. Just imagine how it works with large random numbers computed by both communication nodes.

 

### How it's used in a load balancer

The load balancer creates SSL services when it performs SSL Offload operations, in the form:

![SSL Offload Scenario Diagram](https://www.relianoid.com/wp-content/uploads/2016/08/SSL-Offload-Scenario-Diagram-225x300.png)

Zen Load Balancer uses the **OpenSSL** tools with *dhparam* options to generate the Diffie-Hellman keys. Read more about the full options [here](https://www.openssl.org/docs/man1.1.1/man1/dhparam.html).

In order to create a SSL Offload farm ([HTTP profile with HTTPS listener in Zen Load Balancer](https://www.relianoid.com/knowledge-base/enterprise-edition-v4-0-administration-guide/enterprise-edition-v4-0-http-profile-farms/)) it's required to generate a Diffie-Hellman key with the following good practices in order to ensure a robust key generation.

**1.**A minimum key length of 2048 bits. More length will mean more difficult to decrypt in a reasonable amount of time.
 **2.**One DH key per SSL farm in order to make more difficult to break the communication of several SSL services and isolate the security of every farm.
 **3.**Less predictable in the random generation means more difficult to break the communication.

Note that the generation of the Diffie-Hellman keys is usually a computationally costly process due to the random number generation could take too much time, but this ensures a security assurance for our SSL services.

 

### References

[https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange)
 [http://mathworld.wolfram.com/Diffie-HellmanProtocol.html](http://mathworld.wolfram.com/Diffie-HellmanProtocol.html)

### 📄 Download this document in PDF format