---
title: "Account Cryptographic Policy"
slug: "fortanix-dsm-account-cryptographic-policy"
updated: 2026-06-22T06:45:57Z
published: 2026-06-22T06:45:57Z
canonical: "support.fortanix.com/fortanix-dsm-account-cryptographic-policy"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account Cryptographic Policy

## 1.0 Introduction

This article describes the **Fortanix-Data-Security-Manager (DSM) Cryptographic Policy** feature.

It also contains the information related to Fortanix DSM account-level cryptographic policies.

### 1.1 Fortanix DSM Cryptographic Policy Definition

The Fortanix DSM supports cryptographic policies that can be set on accounts or groups to restrict what kind of keys can be created and the permitted operations. The policies are specified at the account or group-level.

## 2.0 Fortanix DSM Cryptographic Policy Structure

The Fortanix DSM **Cryptographic policy** defines how cryptographic keys are managed. It allows administrators to control key types, sizes, and operations to maintain security.

### 2.1 Allowed Keys

By default, all types of keys are selected in the policy, including AES, DES, DES3, RSA, EC, Tokenization, HMAC, SECRET, CERTIFICATE, OPAQUE, LMS, ML-KEM, ML-DSA, XMSS, BIP32, SLIP10, EC-KCDSA, KCDSA, SEED, ARIA, and BLS.

### 2.2 Key Sizes

The following key sizes are allowed for each key type:

- **AES**: 128, 192, or 256 bits
- **DES3**: 168 bits or 112 bits (for 2-key triple DES)
- **HMAC**: minimum 112 to 8192
- **RSA**: minimum 1024 to 8192 bits
- **DSA**: 2048 bits (subgroup size: 224, 256 bits) or 3072 bits (subgroup size: 256 bits)
- **DES**: 56 bits only
- **EC**: Supported curves include SecP192K1, SecP224K1, SecP256K1, NistP192, NistP224, NistP256, NistP384, NistP521, Gost256A, X25519, Ed25519, Ed448, and X448.
- **Tokenization**: 128, 192, or 256 bits.
- **ML-KEM**: 512, 768, or 1024 bits.
- **ML-DSA**: 44, 65, or 87 bits.
- **EC-KCDSA**: Supported curve include SecP192K1, SecP224K1, SecP256K1, NistP192, NistP224, NistP256, NistP384, or NistP521 and hashing algorithm include SHA1, SHA224, SHA256, SHA384, or SHA512.
- **KCDSA**: Key size: 2048 bits and Subgroup size: 224 or 256 bits.
- **SEED**: 128 bits.
- **ARIA**: 128, 192, or 256 bits.

### 2.3 Key Operations

The following default key operations are allowed for each key type:

- **AES/DES3**: ENCRYPT, DECRYPT, WRAPKEY, UNWRAPKEY, DERIVEKEY, MACGENERATE, MACVERIFY, APPMANAGEABLE
- **DSA**: SIGN, VERIFY, APPMANAGEABLE, EXPORT
- **RSA**: SIGN, VERIFY, ENCRYPT, DECRYPT, WRAPKEY, UNWRAPKEY, APPMANAGEABLE
- **EC**: SIGN, VERIFY, APPMANAGEABLE, AGREEKEY
- **DES**: ENCRYPT, DECRYPT, WRAPKEY, UNWRAPKEY, DERIVEKEY, APPMANAGEABLE
- **HMAC**: DERIVEKEY, MACGENERATE, MACVERIFY, APPMANAGEABLE
- **ML-KEM**: ENCAPSULATE, DECAPSULATE, EXPORT, APPMANAGEABLE
- **ML-DSA**: SIGN, VERIFY, APPMANAGEABLE, EXPORT
- **EC-KCDSA**: SIGN, VERIFY, APPMANAGEABLE, EXPORT
- **KCDSA**: SIGN, VERIFY, APPMANAGEABLE, EXPORT
- **SEED**: ENCRYPT, DECRYPT, WRAPKEY, UNWRAPKEY, DERIVEKEY, EXPORT
- **ARIA**: ENCRYPT, DECRYPT, WRAPKEY, UNWRAPKEY, DERIVEKEY, MACGENERATE, MACVERIFY, APPMANAGEABLE, EXPORT
- **BLS**: SIGN, VERIFY, APPMANAGEABLE, EXPORT
- **Tokenization**: TOKENIZE, DETOKENIZE, APPMANAGEABLE
- **LMS**: SIGN, VERIFY, APPMANAGEABLE
- **XMSS**: SIGN, VERIFY, APPMANAGEABLE
- **SLIP10**: DERIVE, TRANSFORM, SIGN, VERIFY, APP MANAGEABLE, EXPORT

When setting a Cryptographic Policy, users can restrict the key operations allowed for an account. By default, all operations are permitted.

## 3.0 Managing Account-Level Cryptographic Policy

You can create, edit, and delete the Cryptographic policies at the account-level to apply security settings across the entire account.

### 3.1 Creating the Policy

The Fortanix DSM account administrator controls the types of keys, key sizes (or elliptic curves), padding policies, and key permissions allowed for keys created or imported into an account.

Perform the following steps to create an account-level Cryptographic policy:

1. Navigate to the **Settings** → **CRYPTOGRAPHIC POLICY** tab and click **ADD CRYPTOGRAPHIC POLICY** to add a new Cryptographic policy.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Account-crypto-policy.png)

**Figure 1: Add new cryptography policy**
2. In the **Allowed object types for the account** section, select the key types that you want to allow for this account. By default, all the key types are selected.
3. In the **Allowed key sizes** section, add the required allowed key size(s) for the keys.
4. In the **Handling existing non-compliant keys** section, select the required radio button to handle the existing non-compliant keys. By default, **Accept** is selected. *For more information, refer to* [*Section 4.0: Policy Enforcement*](/v1/docs/users-guide-account-cryptographic-policy#40-policy-enforcement)*.*
5. Click **RESTRICT KEY OPERATIONS** to select the permitted key operations that will be allowed for the keys. By default, all the key operations are selected.
6. In the **Audit Log** section, enable the toggle to store the detailed audit logs for all the groups in the account.
7. Click **SAVE POLICY** to save the policy settings.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/FIGURE 2 ACCOUNT CRYPTOGRAPHIC POLICY.png)

**Figure 2: Add account cryptographic policy**

After the policy is saved, you need to create a new group and add a security object. *For more information, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* You will notice that key types and operations are restricted based on the Cryptographic policy settings at the account-level. The restricted values are greyed out.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/2025-07-03_14-08-38.png)

**Figure 3: Create security object with new cryptographic policy**

If there are existing keys in the account that do not comply with the newly added policy, a warning will appear next to the non-compliant keys in the security object table view.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Key_Undo_Policy_Compromised_Icon(1)(2).png)

**Figure 4: Error message for non-compliance**

Additionally, an error message will be displayed in the detailed view of the key, highlighting the non-compliance based on the account-level Cryptographic policy settings.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768944494680.png)

**Figure 5: Error message for non-compliance**

### 3.2 Editing or Deleting a Policy

A user can edit an account-level policy to add or remove key types, change key operations, or modify key sizes.

Perform the following steps to edit an account-level Cryptographic policy:

1. Navigate to **Settings** → **CRYPTOGRAPHIC POLICY** → **Cryptographic policy for security objects** page and click **EDIT POLICY**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Settings_Account_Edit_Crypto_Policy(1).png)

**Figure 6: Edit account cryptographic policy**
2. Modify the allowed key operations as required. For example, disable adding a “DES3” key type and “MacVerify” key operation.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Figure 7 Edit cryptographic policy.png)

**Figure 7: Edit cryptographic policy**
3. Click **SAVE POLICY**.

This action will restrict the users from selecting the “DES3” key type and the “MacVerify”, “Sign”, “Verify”, “AgreeKey”, and “Transform” key operation when creating a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/2025-07-03_14-12-31.png)

**Figure 8: Create a new security object**
4. Click **DELETE POLICY** at the bottom of the page to delete the Cryptographic policy.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Figure 9 Delete account-level cryptographic policy.png)

**Figure 9: Delete account-level cryptographic policy**

> [!WARNING]
> WARNING
> 
> Deleting an account-level Cryptographic policy will remove all the key restriction for the groups that were set at the account-level.

## 4.0 Policy Enforcement

- All new keys will be allowed/denied based on the Cryptographic policy rules.
- Any existing keys that are not compliant with the policy will still exist in the group. However, these keys will be marked separately as policy-violating keys. For these keys the following conditions are applicable:
  - Cryptographic Operations that are classified as “protect operations” will not be allowed: For example, Sign, Encrypt, Wrapkey, Derivekey, MacGenerate, AgreeKey.
  - Cryptographic Operations which are classified as “process operations” will still be allowed: For example, Verify, Decrypt, UnwrapKey, MacVerify.

If a group contains keys that are not compliant with the policy being added, an error message is displayed where the key can either be grandfathered, forbidden, or partially grandfathered. When a Cryptographic policy is created at an account or group-level, there are three options provided to handle non-compliant keys. These options are detailed in the section Handling existing non-compliant keys:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Settings_Account_Handling.png)

**Figure 10: Handling non-compliant keys**

1. **Forbid to use:** Forbid any use of non-compliant objects. If this option is selected, you are forbidden from using the non-compliant keys for any operation.
2. **Accept**: Accept non-compliant objects even though they violate the current policy. If this option is selected, you may continue to use existing non-compliant keys, but you may not generate or import new non-compliant objects.
3. **Limit usage:** Restrict non-compliant objects so that they may only be used for “process operations” such as Decrypt, Unwrap, Verify, and MacVerify operations. The “protect operations” such as Encrypt, Wrap, Sign, and Mac are forbidden.

> [!NOTE]
> NOTE
> 
> If the non-compliance setting for account-level Cryptographic policy is different from the group-level Cryptographic policy, then the setting that is more restrictive is applied for the existing keys.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [AWS KMS Cloud Native Key Management](/fortanix-dsm-aws-cloud-native-key-management.md)
- [Key Lifecycle Management](/fortanix-data-security-manager-key-lifecycle-management.md)
- [Creating a Security Object](/dsm-example-code-creating-a-security-object.md)
- [Configure API Client](/dsm-example-code-configure-api-client.md)
- [Store Keys Externally - Setup](/fortanix-dsm-store-keys-externally-setup.md)