Restrictions

Edit online

The restrictions for CSNDPIM.

  • PKCS#7 certificate containers are currently not supported by this service.

    However it is possible to install all of the certificates from a PKCS#7 container, given that they are pulled from the container and loaded to the HSM as sub-CA certificates one at a time, in dependency order. The trust anchor for the chain should be loaded first using the platform-appropriate administration tool, as required. This is still done as a ‘load-root’ from a TKE command perspective, however the adapter PKI will recognize the parent relationship and automatically chain them.

  • An end-entity may not be loaded as a sub-CA certificate.
  • A key identifier length must be 64 for a key label.
  • The following signature algorithms are supported:
    Table 1. Supported signature algorithms for public infrastructure management (CSNDPIM)

    Supported signature algorithms for public infrastructure management (CSNDPIM)
    Signature Algorithm OID URL
    sha1-with-rsa-signature 1.2.840.113549.1.1.5 http://oid-info.com/get/1.2.840.113549.1.1.5
    sha224WithRSAEncryption 1.2.840.113549.1.1.14 http://oid-info.com/get/1.2.840.113549.1.1.14
    sha256WithRSAEncryption 1.2.840.113549.1.1.11 http://oid-info.com/get/1.2.840.113549.1.1.11
    sha384WithRSAEncryption 1.2.840.113549.1.1.12 http://oid-info.com/get/1.2.840.113549.1.1.12
    sha512WithRSAEncryption 1.2.840.113549.1.1.13 http://oid-info.com/get/1.2.840.113549.1.1.13
    ecdsa-with-SHA1 1.2.840.10045.4.1 http://oid-info.com/get/1.2.840.10045.4.1
    ecdsa-with-SHA224 1.2.840.10045.4.3.1 http://oid-info.com/get/1.2.840.10045.4.3.1
    ecdsa-with-SHA256 1.2.840.10045.4.3.2 http://oid-info.com/get/1.2.840.10045.4.3.2
    ecdsa-with-SHA384 1.2.840.10045.4.3.3 http://oid-info.com/get/1.2.840.10045.4.3.3
    ecdsa-with-SHA512 1.2.840.10045.4.3.4 http://oid-info.com/get/1.2.840.10045.4.3.4
  • Concerning the signature algorithm, it is recommended to use a hash method of commensurate security to the curve of the key being wrapped. The IETF RFC5753 document provides the following information:
    • Implementations that support SignedData with ECDSA:
      • must support ECDSA with SHA-256
      • may support ECDSA with SHA-1, ECDSA with SHA-224, ECDSA with SHA-384, and ECDSA with SHA-512. Other digital signature algorithms may also be supported.
    • When using ECDSA, to promote interoperability it is recommended that
      • the P-192, P-224, and P-256 curves are to be used with SHA-256
      • the P-384 curve is to be used with SHA-384
      • the P-521 curve is to be used with SHA-512.