Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual page 95

Table 3-3 Description of parameters defined in the DSAKeyConstraints module
Parameter Description
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
enable
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server
• If you disable the rule, the server does not apply the rule to certificates.
Specifies the predicate expression for this rule. If you want the rule to be applied to all
predicate
certificate requests, leave the field blank (default). To form a predicate expression, see
section "Using Predicates in Policy Rules" in Chapter 18, "Setting Up Policies" of
CMS Installation and Setup Guide.
Example: HTTP_PARAMS.certType==client
Specifies the minimum length, in bits, for the key (the length of the modulus in bits).
minSize
The value must be smaller than or equal to the one specified by the maxSize
parameter.
In general, a longer key size results in a key pair that is more difficult to crack. You
may want to enforce a minimum length to ensure a minimum level of security.
Permissible values: 512 or 1024. You may also enter a custom key size that is
between 512 and 1024, in increments of 64 bits. The default value is 512.
Example: 512
Specifies the maximum length, in bits, for the key.
maxSize
Permissible values: 512 or 1024. You may also enter a custom key size that is
between 512 and 1024, in increments of 64 bits. The default value is 1024.
Example: 1024
Limits the possible public exponent values. Use commas to separate different values.
exponents
Some exponents are more widely used than others. The following exponent values
are recommended for arithmetic and security reasons: 17 and 65537. Of these two
values, 65537 is preferred. (This setting is mainly an issue if you are using your own
software for generating key pairs. Key-generation programs in Netscape clients and
servers use 3 or 65537.)
Permissible values: A combination of 3, 7, 17, and 65537, separated by commas. The
default value is 3,7,17,65537.
Example: 17,65537
applies the rule to certificates specified by the predicate expression.
DSAKeyConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 95