diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index cd66d2365378..3db72634b87e 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -2120,7 +2120,9 @@ def generate_dh_parameters(self, generator, key_size): res = self._lib.DH_generate_parameters_ex( dh_param_cdata, key_size, generator, self._ffi.NULL ) - self.openssl_assert(res == 1) + if res != 1: + errors = self._consume_errors_with_text() + raise ValueError("Unable to generate DH parameters", errors) return _DHParameters(self, dh_param_cdata) diff --git a/tests/hazmat/primitives/test_dh.py b/tests/hazmat/primitives/test_dh.py index f6bf8fea3c20..7b31b72e9b73 100644 --- a/tests/hazmat/primitives/test_dh.py +++ b/tests/hazmat/primitives/test_dh.py @@ -150,6 +150,10 @@ def test_unsupported_generator_generate_dh(self, backend): with pytest.raises(ValueError): dh.generate_parameters(7, 512, backend) + def test_large_key_generate_dh(self): + with pytest.raises(ValueError): + dh.generate_parameters(2, 1 << 30) + @pytest.mark.skip_fips(reason="non-FIPS parameters") def test_dh_parameters_supported(self, backend): valid_p = int(