Solved

Setting DRA's Key Length to 4096

Posted on 2008-10-23
6
802 Views
Last Modified: 2012-05-05
Hello,

I'm deploying a Microsoft PKI solution and need to create a DRA for EFS.  By default, using the cipher \r command, it creates a DRA key of 2048 bits on either a Vista or a 2008 machine (1024 on 2003 and XP).  However, I would like create them as 4096 bit in length.  I have added theHKLM\Software\Microsoft\Windows NT\CurrentVersion\EFS\RSAKeyLength DWORD with a decimal value of 4096 as recommended by Microsoft document.  Unfortunately, when I run the cipher \r command to create a DRA key, it is created as a 2048 bit length RSA key.   I have no idea how to get around this problem.

Any help would be appreciated.

Cheers,
Mark
0
Comment
Question by:nav_support
  • 3
  • 3
6 Comments
 
LVL 31

Expert Comment

by:Paranormastic
ID: 22789900
Dare I ask why you would want a 4096 keyset?  2048 is plenty good enough to last you for over a decade.

Are you trying to create this on a smartcard or just as a local file?  The CSP needs to support the 4096 keyset, which most, if not all, smartcards do not.  4096 can be created on another device and stored on a smartcard, that's a different story, such as with an HSM, but that would not suite your purpose.  The default MS CSPs should support 4096 ok though.

Also, is this using a self-signed cert or one from a CA?
0
 
LVL 31

Expert Comment

by:Paranormastic
ID: 22790004
If this is a CA issued cert, you should try adding that same reg key to the CA server as well.
likewise, a CA cannot issue a cert with a key strength greater than its own.  I.e. the CA cert needs to be 4096 or higher to issue a 4096 key.  The reasoning behind this is that the CA cert would be made vulnerable prior to the cert it is authorizing.
Also keeping in mind that the validity period cannot be longer than that of the CA cert - if it is set longer it will be truncated.
0
 

Author Comment

by:nav_support
ID: 22790408
Thanks for your comments Paranormastic.

I should have mentioned in my question, this will be a self-signed certificate as opposed to a CA issued one.  Essentially, it is so we don't have to worry about renewing it at any point.  

I'm essentially trying to create the self-signed certificate locally, so there are no smartcards in the equation (perhaps in the future, but not anytime soon).

As for why we would a 4096 key length, it is probably just paranoia (most likely misplaced!) since the key will be in use for a long while.  I suppose if I can't get around this issue, I'll end up using a 2048 key length.

Cheers,
Mark
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 31

Accepted Solution

by:
Paranormastic earned 125 total points
ID: 22795812
Have you tried rebooting since setting that registry key?  I don't recall ever seeing if that key actually affected the DRA cert or just the EFS cert, but by means of logic it should affect both.  I am not familar and am not finding reference to anything that specifically designates the keysize for the DRA vs. normal EFS keysets.  To my memory this reg key affects standard EFS certs, hence your normal EFS cert would be 4096 - does that match up?


BTW, here is a handy reg key to add the Encrypt/Decrypt option to your standard right-click menu:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EncryptionContextMenu"=dword:00000001
0
 

Author Comment

by:nav_support
ID: 22799341
Thanks again Paranormastic for your response.  I just tested creating a self signed EFS key on a Vista box and the key was created using a 4096 key length using that Registry entry.  However, when I create a DRA key it is only a 2048.  So your suspicion about the registry entry only working on the EFS keys and not the DRA are correct.  I guess I'll have to settle for a 2048 key length for the DRA unless I use a CA issued one.

Also, thanks for the handy reg key - I had read about this option, but I had not seen the actual registry entry.  Much appreciated.
0
 

Author Closing Comment

by:nav_support
ID: 31509375
Paranormastic made me think about what I was doing by seing what would happen when I changed the registry value and created a self-signed EFS cert and a DRA (the EFS cert was affected by the registry key and not the DRA).  This convinced me that what I was trying to do won't work.  
0

Featured Post

The curse of the end user strikes again      

You’ve updated all your end user’s email signatures. Hooray! But guess what? They’re playing around with the HTML, adding stupid taglines and ruining the imagery. Find out how you can save your signatures from end users today.

Join & Write a Comment

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
When the confidentiality and security of your data is a must, trust the highly encrypted cloud fax portfolio used by 12 million businesses worldwide, including nearly half of the Fortune 500.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now