LIBRESSL-BN_GET_RFC3526_PRIME_8192(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 NAME 💖

okay so bestie, gather round — this is the libcrypto page for the eight fam:

BN_get_rfc2409_prime_768, BN_get_rfc2409_prime_1024, BN_get_rfc3526_prime_1536, BN_get_rfc3526_prime_2048, BN_get_rfc3526_prime_3072, BN_get_rfc3526_prime_4096, BN_get_rfc3526_prime_6144, BN_get_rfc3526_prime_8192 — iconic behavior, they literally hand you the standard moduli for Diffie-Hellman key exchange. yes ma'am 💅

✨ SYNOPSIS ✨

like, this is the whole vibe — library libcrypto, header #include <openssl/bn.h>, and then it's just the same shape eight times:

BIGNUM *
BN_get_rfc2409_prime_768(BIGNUM *bn);

BIGNUM *
BN_get_rfc2409_prime_1024(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_1536(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_2048(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_3072(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_4096(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_6144(BIGNUM *bn);

BIGNUM *
BN_get_rfc3526_prime_8192(BIGNUM *bn);

it's giving "one outfit, eight colors" and honestly? we love consistency 🎀

🦋 DESCRIPTION 🦋

so each of these functions returns one specific constant Sophie Germain prime number p. like, a real one, baked right in. no cap.

and here's the tea on the bn argument — it's genuinely flexible:

  • if bn is NULL, a brand new BIGNUM object is created and returned 🎉
  • otherwise, the number is stored in *bn and bn is returned right back to you 🫶

🧮 the math part (don't scroll, it's cute I promise)

all these numbers are of the form:

p = 2 sup s - 2 sup left ( s - 64 right ) - 1 + 2 sup 64 * left { left [
2 sup left ( s - 130 right ) pi right ] + offset right } delim $$

where s is the size of the binary representation of the number in bits — and yes, that's the number that shows up at the end of each function name, iykyk ⭐

as long as the offset is sufficiently small, the above form assures that the top and bottom 64 bits of each number are all 1. slay.

🌸 the offsets (straight from the standards, verbatim)

  • size s — 768 = 3 * 2^8 → offset 149686
  • size s — 1024 = 2 * 2^9 → offset 129093
  • size s — 1536 = 3 * 2^9 → offset 741804
  • size s — 2048 = 2 * 2^10 → offset 124476
  • size s — 3072 = 3 * 2^10 → offset 1690314
  • size s — 4096 = 2 * 2^11 → offset 240904
  • size s — 6144 = 3 * 2^11 → offset 929484
  • size s — 8192 = 2 * 2^12 → offset 4743158

🔥 what they're actually for

for each of these prime numbers, the finite group of natural numbers smaller than p — where the group operation is defined as multiplication modulo p — is what gets used for Diffie-Hellman key exchange. ✨

and the first two of these groups have names, because of course they do:

  • the First Oakley Group
  • the Second Oakley Group

obviously, all these groups are cyclic groups of order p, respectively — and listen, this is important — the numbers returned by these functions are not secrets. they're public, babe. don't be weird about it 🙈

💜 RETURN VALUES 💜

if memory allocation fails, these functions return NULL. and like — heads up — that can happen even if bn is not NULL. so yeah, check your returns, bestie. main character energy includes error handling 💀

🌈 SEE ALSO 🌈

go read them, they're all linked, it's a whole ecosystem 🦋

👑 STANDARDS 👑

  • RFC 2409, "The Internet Key Exchange (IKE)", defines the Oakley Groups.
  • RFC 2412, "The OAKLEY Key Determination Protocol", contains additional information about these numbers.
  • RFC 3526, "More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)", defines the other six numbers.

three RFCs, zero skips, we read them all 📚✨

🕰️ HISTORY 🕰️

BN_get_rfc2409_prime_768(), BN_get_rfc2409_prime_1024(), BN_get_rfc3526_prime_1536(), BN_get_rfc3526_prime_2048(), BN_get_rfc3526_prime_3072(), BN_get_rfc3526_prime_4096(), BN_get_rfc3526_prime_6144(), and BN_get_rfc3526_prime_8192() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.

the same functions without the BN_ prefix first appeared in OpenSSL 0.9.8a and OpenBSD 4.5; they were removed in OpenBSD 7.4. rip to the prefix-less era, gone but not forgotten 😭🕊️

⚠️ CAVEATS ⚠️

okay this is the part where you actually pay attention 🫶

as all the memory needed for storing the numbers is dynamically allocated, the BN_FLG_STATIC_DATA flag is not set on the returned BIGNUM objects.

so be careful to not change the returned numbers. like, fr fr. hands off. that's the whole warning. 💅

and that's the page, bestie — you ate that 🍓

this cutie dropped from Debian on June 8, 2025, filed under BN_GET_RFC3526_PRIME_8192(3) — go forth and Diffie-Hellman responsibly, ily 💖✨🎀

📦 where this page comes from