Design and build a privately hosted Public Key Infrastructure
Principles for the design and build of in-house Public Key Infrastructure (PKI)
Pages
Page 20 of 21
11. Use current, strong, cryptographic algorithms and plan for new ones
The minimum cryptographic profiles used in your PKI should be in line with current recommended guidelines.
The minimum cryptographic profiles used in your PKI should be in line with current recommended guidelines.
In October 2020, these are:
Signing algorithm
Hashing algorithm
2048-bit RSA
SHA-256
ECDSA-256 P-256 Curve
SHA-256
Choosing between RSA and ECDSA is more of a system engineering choice than a security one, as long as you select the correct key lengths for the required security level.
Allow for cryptographic updates
Ensure that your PKI design allows you to change the cryptographic algorithms and renew all certificates with low overhead. This will enable you to respond to future threats and take advantage of new features.
Random sources
Private keys should be generated from a random source, making the key hard to predict. The source of randomness should be appropriate to the use case and security requirements.
An example of a random source could be a cryptographic processor on a HSM, or a random number generator on a CPU or secure discrete component like a TPM.
