Cryptography

Applies To: Windows Server 2008

A new Cryptography tab is available for version 3 certificate templates in Windows Server® 2008. This tab replaces and extends the cryptographic service provider (CSP) selection dialog box accessible by clicking the CSPs button on the Request Handling tab of a version 2 certificate template. The Cryptography tab contains the following options:

• Algorithm name. This option allows you to select an advanced algorithm for encryption, signing, or both (depending on the template's purpose). By default, the following algorithms are available: DSA, ECDH_P256, ECDH_P384, ECDH_P521, ECDSA_P256, ECDSA_P384, ECDSA_P521, and RSA. Only the algorithms that are available for a specific certificate template purpose will be listed.

• Minimum key size. This option allows you to specify a minimum required size for the keys used with the chosen algorithm. By default, the minimum key length supported on the computer for the chosen algorithm will be used.

• Providers. Version 2 templates offered a list of CryptoAPI CSPs, while version 3 templates offer a dynamically populated list of Cryptography Next Generation (CNG) providers. This list is populated with all providers available on the computer that meet the criteria specified by a combination of the following configuration options: Algorithm name and Minimum key size on the Cryptography tab, and Purpose and Allow private key to be exported on the Request Handling tab.

• Hash algorithm. This option allows you to choose an advanced hash algorithm. By default, the following algorithms are available: AES-GMAC, MD2, MD4, MD5, SHA1, SHA256, SHA384, and SHA512.

• Use alternate signature format. When the RSA algorithm is selected, this check box allows you to specify that certificate requests created for this template include a discrete signature in PKCS #1 V2.1 format.

Additional references

• Configuring a Certificate Template