Security Policy

SecurityPolicy defines security attributes and behavior applied to the profileName or KeyStore.

This policy is applied during the profile initialization, but sometimes it's also used during the installation of the certificate, so it must be informed on several methods of the certificate provider.

There are specific policies for each kind of Keystore, but not all the keystores have a specific policy. Sometimes is not possible to change some default values defined by the Keystore or profile by themselves.  In this kind of case, a default policy, using an empty JSON file, must be used.

Following there is a list of specific policy and values that can be used:

Microsoft CryptoAPI security policy

{
	"exportable": true,
	"protectionLevel": 1,
	"description": "John Doe - Digicert",
	"friendlyName": "Sign and Authenticate services",
	"title": "Digital Certificate"
}

Password security policy

Used by PFX/P12 keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5 
}

Device security policy

Used by some kind of devices

{
	"installDummy" : false,
	"generateOnBoard" : true 
	"modelTemplate" : "RIJKSPAS-qsign" 
}

PKCS11 security policy

Used by PKCS11 keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5,
	"installDummy" : false,
	"generateOnBoard" : true 
}

It combines the features of Password and Device security policies. This policy is used when the device can be initialized during the generation of keypair, and a new password must be entered to protect the key.

CSK security policy

Used on Alison KeyStore profiles.

{
	"id": "polIdv-A",
	"passComplexity": 3,
	"passMinLength": 8,
	"passExpiration": 365,
	"passLockCount": 10, 
	"lockTimeout": 15,
	"idleTimeout": 10, 
	"certExport": 15
}