Fix Bugzilla Bug 524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes).

git-svn-id: svn+ssh://svn.fedorahosted.org/svn/pki/trunk@1448 c9f7a03b-bd48-0410-a16d-cbbf54688b0b

34 files changed, 203 insertions, 132 deletions

diff --git a/pki/base/ca/shared/profiles/ca/caAdminCert.cfg b/pki/base/ca/shared/profiles/ca/caAdminCert.cfg
index 85394072..c44079a1 100644
--- a/pki/base/ca/shared/profiles/ca/caAdminCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caAdminCert.cfg
@@ -31,9 +31,8 @@ policyset.adminCertSet.2.default.params.range=365
 policyset.adminCertSet.2.default.params.startTime=0
 policyset.adminCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.adminCertSet.3.constraint.name=Key Constraint
-policyset.adminCertSet.3.constraint.params.keyType=-
-policyset.adminCertSet.3.constraint.params.keyMinLength=256
-policyset.adminCertSet.3.constraint.params.keyMaxLength=4096
+policyset.adminCertSet.3.constraint.params.keyType=RSA
+policyset.adminCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.adminCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.adminCertSet.3.default.name=Key Default
 policyset.adminCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caAgentFileSigning.cfg b/pki/base/ca/shared/profiles/ca/caAgentFileSigning.cfg
index 3472d264..a325c77f 100644
--- a/pki/base/ca/shared/profiles/ca/caAgentFileSigning.cfg
+++ b/pki/base/ca/shared/profiles/ca/caAgentFileSigning.cfg
@@ -30,9 +30,8 @@ policyset.serverCertSet.2.default.params.range=180
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caAgentServerCert.cfg b/pki/base/ca/shared/profiles/ca/caAgentServerCert.cfg
index cd642d36..d0aac7a8 100644
--- a/pki/base/ca/shared/profiles/ca/caAgentServerCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caAgentServerCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=180
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caCACert.cfg b/pki/base/ca/shared/profiles/ca/caCACert.cfg
index 37c511fb..a88abdf1 100644
--- a/pki/base/ca/shared/profiles/ca/caCACert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caCACert.cfg
@@ -29,9 +29,8 @@ policyset.caCertSet.2.default.params.range=2922
 policyset.caCertSet.2.default.params.startTime=0
 policyset.caCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.caCertSet.3.constraint.name=Key Constraint
-policyset.caCertSet.3.constraint.params.keyType=-
-policyset.caCertSet.3.constraint.params.keyMinLength=256
-policyset.caCertSet.3.constraint.params.keyMaxLength=4096
+policyset.caCertSet.3.constraint.params.keyType=RSA
+policyset.caCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.caCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.caCertSet.3.default.name=Key Default
 policyset.caCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caCMCUserCert.cfg b/pki/base/ca/shared/profiles/ca/caCMCUserCert.cfg
index 47f53a78..e80dfe23 100644
--- a/pki/base/ca/shared/profiles/ca/caCMCUserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caCMCUserCert.cfg
@@ -30,9 +30,8 @@ policyset.cmcUserCertSet.2.default.params.range=180
 policyset.cmcUserCertSet.2.default.params.startTime=0
 policyset.cmcUserCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.cmcUserCertSet.3.constraint.name=Key Constraint
-policyset.cmcUserCertSet.3.constraint.params.keyType=-
-policyset.cmcUserCertSet.3.constraint.params.keyMinLength=256
-policyset.cmcUserCertSet.3.constraint.params.keyMaxLength=4096
+policyset.cmcUserCertSet.3.constraint.params.keyType=RSA
+policyset.cmcUserCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.cmcUserCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.cmcUserCertSet.3.default.name=Key Default
 policyset.cmcUserCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caDirUserCert.cfg b/pki/base/ca/shared/profiles/ca/caDirUserCert.cfg
index 7e334a27..ce42445c 100644
--- a/pki/base/ca/shared/profiles/ca/caDirUserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caDirUserCert.cfg
@@ -34,9 +34,8 @@ policyset.userCertSet.2.default.params.range=180
 policyset.userCertSet.2.default.params.startTime=0
 policyset.userCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.userCertSet.3.constraint.name=Key Constraint
-policyset.userCertSet.3.constraint.params.keyType=-
-policyset.userCertSet.3.constraint.params.keyMinLength=256
-policyset.userCertSet.3.constraint.params.keyMaxLength=4096
+policyset.userCertSet.3.constraint.params.keyType=RSA
+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.userCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.userCertSet.3.default.name=Key Default
 policyset.userCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caDualCert.cfg b/pki/base/ca/shared/profiles/ca/caDualCert.cfg
index 78b73a8e..f85c70f4 100644
--- a/pki/base/ca/shared/profiles/ca/caDualCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caDualCert.cfg
@@ -30,9 +30,8 @@ policyset.encryptionCertSet.2.default.params.range=180
 policyset.encryptionCertSet.2.default.params.startTime=0
 policyset.encryptionCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.encryptionCertSet.3.constraint.name=Key Constraint
-policyset.encryptionCertSet.3.constraint.params.keyType=-
-policyset.encryptionCertSet.3.constraint.params.keyMinLength=256
-policyset.encryptionCertSet.3.constraint.params.keyMaxLength=4096
+policyset.encryptionCertSet.3.constraint.params.keyType=RSA
+policyset.encryptionCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.encryptionCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.encryptionCertSet.3.default.name=Key Default
 policyset.encryptionCertSet.4.constraint.class_id=noConstraintImpl
@@ -114,8 +113,7 @@ policyset.signingCertSet.2.default.params.startTime=60
 policyset.signingCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.signingCertSet.3.constraint.name=Key Constraint
 policyset.signingCertSet.3.constraint.params.keyType=RSA
-policyset.signingCertSet.3.constraint.params.keyMinLength=512
-policyset.signingCertSet.3.constraint.params.keyMaxLength=4096
+policyset.signingCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.signingCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.signingCertSet.3.default.name=Key Default
 policyset.signingCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caDualRAuserCert.cfg b/pki/base/ca/shared/profiles/ca/caDualRAuserCert.cfg
index eb8849af..53885825 100644
--- a/pki/base/ca/shared/profiles/ca/caDualRAuserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caDualRAuserCert.cfg
@@ -29,9 +29,8 @@ policyset.userCertSet.2.default.params.range=180
 policyset.userCertSet.2.default.params.startTime=0
 policyset.userCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.userCertSet.3.constraint.name=Key Constraint
-policyset.userCertSet.3.constraint.params.keyType=-
-policyset.userCertSet.3.constraint.params.keyMinLength=256
-policyset.userCertSet.3.constraint.params.keyMaxLength=4096
+policyset.userCertSet.3.constraint.params.keyType=RSA
+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.userCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.userCertSet.3.default.name=Key Default
 policyset.userCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg b/pki/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
index d8752a9c..127a1332 100644
--- a/pki/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
@@ -29,9 +29,8 @@ policyset.cmcUserCertSet.2.default.params.range=180
 policyset.cmcUserCertSet.2.default.params.startTime=0
 policyset.cmcUserCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.cmcUserCertSet.3.constraint.name=Key Constraint
-policyset.cmcUserCertSet.3.constraint.params.keyMaxLength=4096
-policyset.cmcUserCertSet.3.constraint.params.keyMinLength=256
-policyset.cmcUserCertSet.3.constraint.params.keyType=-
+policyset.cmcUserCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
+policyset.cmcUserCertSet.3.constraint.params.keyType=RSA
 policyset.cmcUserCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.cmcUserCertSet.3.default.name=Key Default
 policyset.cmcUserCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caIPAserviceCert.cfg b/pki/base/ca/shared/profiles/ca/caIPAserviceCert.cfg
index 775bd332..bd1f3160 100644
--- a/pki/base/ca/shared/profiles/ca/caIPAserviceCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caIPAserviceCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=180
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInstallCACert.cfg b/pki/base/ca/shared/profiles/ca/caInstallCACert.cfg
index f31c8899..36721c1d 100644
--- a/pki/base/ca/shared/profiles/ca/caInstallCACert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInstallCACert.cfg
@@ -30,9 +30,8 @@ policyset.caCertSet.2.default.params.range=720
 policyset.caCertSet.2.default.params.startTime=0
 policyset.caCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.caCertSet.3.constraint.name=Key Constraint
-policyset.caCertSet.3.constraint.params.keyType=-
-policyset.caCertSet.3.constraint.params.keyMinLength=256
-policyset.caCertSet.3.constraint.params.keyMaxLength=4096
+policyset.caCertSet.3.constraint.params.keyType=RSA
+policyset.caCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.caCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.caCertSet.3.default.name=Key Default
 policyset.caCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthAuditSigningCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthAuditSigningCert.cfg
index b214c80d..3d72b20f 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthAuditSigningCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthAuditSigningCert.cfg
@@ -30,9 +30,8 @@ policyset.auditSigningCertSet.2.default.params.range=720
 policyset.auditSigningCertSet.2.default.params.startTime=0
 policyset.auditSigningCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.auditSigningCertSet.3.constraint.name=Key Constraint
-policyset.auditSigningCertSet.3.constraint.params.keyType=-
-policyset.auditSigningCertSet.3.constraint.params.keyMinLength=256
-policyset.auditSigningCertSet.3.constraint.params.keyMaxLength=4096
+policyset.auditSigningCertSet.3.constraint.params.keyType=RSA
+policyset.auditSigningCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.auditSigningCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.auditSigningCertSet.3.default.name=Key Default
 policyset.auditSigningCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthDRMstorageCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthDRMstorageCert.cfg
index abd207f7..55185aa9 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthDRMstorageCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthDRMstorageCert.cfg
@@ -30,9 +30,8 @@ policyset.ocspCertSet.2.default.params.range=720
 policyset.ocspCertSet.2.default.params.startTime=0
 policyset.ocspCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.ocspCertSet.3.constraint.name=Key Constraint
-policyset.ocspCertSet.3.constraint.params.keyType=-
-policyset.ocspCertSet.3.constraint.params.keyMinLength=256
-policyset.ocspCertSet.3.constraint.params.keyMaxLength=4096
+policyset.ocspCertSet.3.constraint.params.keyType=RSA
+policyset.ocspCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.ocspCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.ocspCertSet.3.default.name=Key Default
 policyset.ocspCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthOCSPCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthOCSPCert.cfg
index f56831d6..9d42b852 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthOCSPCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthOCSPCert.cfg
@@ -30,9 +30,8 @@ policyset.ocspCertSet.2.default.params.range=720
 policyset.ocspCertSet.2.default.params.startTime=0
 policyset.ocspCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.ocspCertSet.3.constraint.name=Key Constraint
-policyset.ocspCertSet.3.constraint.params.keyType=-
-policyset.ocspCertSet.3.constraint.params.keyMinLength=256
-policyset.ocspCertSet.3.constraint.params.keyMaxLength=4096
+policyset.ocspCertSet.3.constraint.params.keyType=RSA
+policyset.ocspCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.ocspCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.ocspCertSet.3.default.name=Key Default
 policyset.ocspCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthServerCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthServerCert.cfg
index 1e8d5d4c..a343a384 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthServerCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthServerCert.cfg
@@ -30,9 +30,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthSubsystemCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthSubsystemCert.cfg
index ed65549f..c6cf2dd0 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthSubsystemCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthSubsystemCert.cfg
@@ -32,9 +32,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caInternalAuthTransportCert.cfg b/pki/base/ca/shared/profiles/ca/caInternalAuthTransportCert.cfg
index d622854c..ddbc37a5 100644
--- a/pki/base/ca/shared/profiles/ca/caInternalAuthTransportCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caInternalAuthTransportCert.cfg
@@ -30,9 +30,8 @@ policyset.transportCertSet.2.default.params.range=720
 policyset.transportCertSet.2.default.params.startTime=0
 policyset.transportCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.transportCertSet.3.constraint.name=Key Constraint
-policyset.transportCertSet.3.constraint.params.keyType=-
-policyset.transportCertSet.3.constraint.params.keyMinLength=256
-policyset.transportCertSet.3.constraint.params.keyMaxLength=4096
+policyset.transportCertSet.3.constraint.params.keyType=RSA
+policyset.transportCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.transportCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.transportCertSet.3.default.name=Key Default
 policyset.transportCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caJarSigningCert.cfg b/pki/base/ca/shared/profiles/ca/caJarSigningCert.cfg
index e68cc75a..5ddf0077 100644
--- a/pki/base/ca/shared/profiles/ca/caJarSigningCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caJarSigningCert.cfg
@@ -30,9 +30,8 @@ policyset.caJarSigningSet.2.default.params.range=1461
 policyset.caJarSigningSet.2.default.params.startTime=60
 policyset.caJarSigningSet.3.constraint.class_id=keyConstraintImpl
 policyset.caJarSigningSet.3.constraint.name=Key Constraint
-policyset.caJarSigningSet.3.constraint.params.keyMaxLength=4096
-policyset.caJarSigningSet.3.constraint.params.keyMinLength=1024
-policyset.caJarSigningSet.3.constraint.params.keyType=-
+policyset.caJarSigningSet.3.constraint.params.keyParameters=1024,2048,3072,4096
+policyset.caJarSigningSet.3.constraint.params.keyType=RSA
 policyset.caJarSigningSet.3.default.class_id=userKeyDefaultImpl
 policyset.caJarSigningSet.3.default.name=Key Default
 policyset.caJarSigningSet.4.constraint.class_id=keyUsageExtConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caOCSPCert.cfg b/pki/base/ca/shared/profiles/ca/caOCSPCert.cfg
index 191d5b4e..bda3ee75 100644
--- a/pki/base/ca/shared/profiles/ca/caOCSPCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caOCSPCert.cfg
@@ -29,9 +29,8 @@ policyset.ocspCertSet.2.default.params.range=720
 policyset.ocspCertSet.2.default.params.startTime=0
 policyset.ocspCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.ocspCertSet.3.constraint.name=Key Constraint
-policyset.ocspCertSet.3.constraint.params.keyType=-
-policyset.ocspCertSet.3.constraint.params.keyMinLength=256
-policyset.ocspCertSet.3.constraint.params.keyMaxLength=4096
+policyset.ocspCertSet.3.constraint.params.keyType=RSA
+policyset.ocspCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.ocspCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.ocspCertSet.3.default.name=Key Default
 policyset.ocspCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caOtherCert.cfg b/pki/base/ca/shared/profiles/ca/caOtherCert.cfg
index 2bc1ed5b..305a37b9 100644
--- a/pki/base/ca/shared/profiles/ca/caOtherCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caOtherCert.cfg
@@ -29,9 +29,8 @@ policyset.otherCertSet.2.default.params.range=720
 policyset.otherCertSet.2.default.params.startTime=0
 policyset.otherCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.otherCertSet.3.constraint.name=Key Constraint
-policyset.otherCertSet.3.constraint.params.keyType=-
-policyset.otherCertSet.3.constraint.params.keyMinLength=256
-policyset.otherCertSet.3.constraint.params.keyMaxLength=4096
+policyset.otherCertSet.3.constraint.params.keyType=RSA
+policyset.otherCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.otherCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.otherCertSet.3.default.name=Key Default
 policyset.otherCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caRACert.cfg b/pki/base/ca/shared/profiles/ca/caRACert.cfg
index 0ecaed09..a3d8dc45 100644
--- a/pki/base/ca/shared/profiles/ca/caRACert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caRACert.cfg
@@ -29,9 +29,8 @@ policyset.raCertSet.2.default.params.range=720
 policyset.raCertSet.2.default.params.startTime=0
 policyset.raCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.raCertSet.3.constraint.name=Key Constraint
-policyset.raCertSet.3.constraint.params.keyType=-
-policyset.raCertSet.3.constraint.params.keyMinLength=256
-policyset.raCertSet.3.constraint.params.keyMaxLength=4096
+policyset.raCertSet.3.constraint.params.keyType=RSA
+policyset.raCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.raCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.raCertSet.3.default.name=Key Default
 policyset.raCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caRARouterCert.cfg b/pki/base/ca/shared/profiles/ca/caRARouterCert.cfg
index b2a769a9..723e010d 100644
--- a/pki/base/ca/shared/profiles/ca/caRARouterCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caRARouterCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caRAagentCert.cfg b/pki/base/ca/shared/profiles/ca/caRAagentCert.cfg
index a5bad467..67ba9224 100644
--- a/pki/base/ca/shared/profiles/ca/caRAagentCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caRAagentCert.cfg
@@ -30,9 +30,8 @@ policyset.userCertSet.2.default.params.range=180
 policyset.userCertSet.2.default.params.startTime=0
 policyset.userCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.userCertSet.3.constraint.name=Key Constraint
-policyset.userCertSet.3.constraint.params.keyType=-
-policyset.userCertSet.3.constraint.params.keyMinLength=256
-policyset.userCertSet.3.constraint.params.keyMaxLength=4096
+policyset.userCertSet.3.constraint.params.keyType=RSA
+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.userCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.userCertSet.3.default.name=Key Default
 policyset.userCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caRAserverCert.cfg b/pki/base/ca/shared/profiles/ca/caRAserverCert.cfg
index 6a440202..eca20e34 100644
--- a/pki/base/ca/shared/profiles/ca/caRAserverCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caRAserverCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=180
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caRouterCert.cfg b/pki/base/ca/shared/profiles/ca/caRouterCert.cfg
index c7df41bf..2400c69b 100644
--- a/pki/base/ca/shared/profiles/ca/caRouterCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caRouterCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caServerCert.cfg b/pki/base/ca/shared/profiles/ca/caServerCert.cfg
index cc04f345..060194d8 100644
--- a/pki/base/ca/shared/profiles/ca/caServerCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caServerCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caSignedLogCert.cfg b/pki/base/ca/shared/profiles/ca/caSignedLogCert.cfg
index 96b1abbb..ad5a0966 100644
--- a/pki/base/ca/shared/profiles/ca/caSignedLogCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caSignedLogCert.cfg
@@ -29,9 +29,8 @@ policyset.caLogSigningSet.2.default.params.range=180
 policyset.caLogSigningSet.2.default.params.startTime=60
 policyset.caLogSigningSet.3.constraint.class_id=keyConstraintImpl
 policyset.caLogSigningSet.3.constraint.name=Key Constraint
-policyset.caLogSigningSet.3.constraint.params.keyType=-
-policyset.caLogSigningSet.3.constraint.params.keyMinLength=256
-policyset.caLogSigningSet.3.constraint.params.keyMaxLength=4096
+policyset.caLogSigningSet.3.constraint.params.keyType=RSA
+policyset.caLogSigningSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.caLogSigningSet.3.default.class_id=userKeyDefaultImpl
 policyset.caLogSigningSet.3.default.name=Key Default
 policyset.caLogSigningSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg b/pki/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg
index dd26a29b..ee0df883 100644
--- a/pki/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg
@@ -28,9 +28,8 @@ policyset.cmcUserCertSet.2.default.params.range=180
 policyset.cmcUserCertSet.2.default.params.startTime=0
 policyset.cmcUserCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.cmcUserCertSet.3.constraint.name=Key Constraint
-policyset.cmcUserCertSet.3.constraint.params.keyMaxLength=4096
-policyset.cmcUserCertSet.3.constraint.params.keyMinLength=256
-policyset.cmcUserCertSet.3.constraint.params.keyType=-
+policyset.cmcUserCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
+policyset.cmcUserCertSet.3.constraint.params.keyType=RSA
 policyset.cmcUserCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.cmcUserCertSet.3.default.name=Key Default
 policyset.cmcUserCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caTPSCert.cfg b/pki/base/ca/shared/profiles/ca/caTPSCert.cfg
index 87bc5bf5..5553d4f4 100644
--- a/pki/base/ca/shared/profiles/ca/caTPSCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caTPSCert.cfg
@@ -29,9 +29,8 @@ policyset.serverCertSet.2.default.params.range=720
 policyset.serverCertSet.2.default.params.startTime=0
 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.serverCertSet.3.constraint.name=Key Constraint
-policyset.serverCertSet.3.constraint.params.keyType=-
-policyset.serverCertSet.3.constraint.params.keyMinLength=256
-policyset.serverCertSet.3.constraint.params.keyMaxLength=4096
+policyset.serverCertSet.3.constraint.params.keyType=RSA
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.serverCertSet.3.default.name=Key Default
 policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caTransportCert.cfg b/pki/base/ca/shared/profiles/ca/caTransportCert.cfg
index 75fa3ad4..44968e39 100644
--- a/pki/base/ca/shared/profiles/ca/caTransportCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caTransportCert.cfg
@@ -29,9 +29,8 @@ policyset.transportCertSet.2.default.params.range=720
 policyset.transportCertSet.2.default.params.startTime=0
 policyset.transportCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.transportCertSet.3.constraint.name=Key Constraint
-policyset.transportCertSet.3.constraint.params.keyType=-
-policyset.transportCertSet.3.constraint.params.keyMinLength=256
-policyset.transportCertSet.3.constraint.params.keyMaxLength=4096
+policyset.transportCertSet.3.constraint.params.keyType=RSA
+policyset.transportCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.transportCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.transportCertSet.3.default.name=Key Default
 policyset.transportCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caUUIDdeviceCert.cfg b/pki/base/ca/shared/profiles/ca/caUUIDdeviceCert.cfg
index 1acdf7a9..f1701081 100644
--- a/pki/base/ca/shared/profiles/ca/caUUIDdeviceCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caUUIDdeviceCert.cfg
@@ -30,9 +30,8 @@ policyset.userCertSet.2.default.params.range=180
 policyset.userCertSet.2.default.params.startTime=0
 policyset.userCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.userCertSet.3.constraint.name=Key Constraint
-policyset.userCertSet.3.constraint.params.keyType=-
-policyset.userCertSet.3.constraint.params.keyMinLength=256
-policyset.userCertSet.3.constraint.params.keyMaxLength=4096
+policyset.userCertSet.3.constraint.params.keyType=RSA
+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.userCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.userCertSet.3.default.name=Key Default
 policyset.userCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/ca/shared/profiles/ca/caUserCert.cfg b/pki/base/ca/shared/profiles/ca/caUserCert.cfg
index a2e5e833..9a5d83c9 100644
--- a/pki/base/ca/shared/profiles/ca/caUserCert.cfg
+++ b/pki/base/ca/shared/profiles/ca/caUserCert.cfg
@@ -36,9 +36,8 @@ policyset.userCertSet.2.default.params.range=180
 policyset.userCertSet.2.default.params.startTime=0
 policyset.userCertSet.3.constraint.class_id=keyConstraintImpl
 policyset.userCertSet.3.constraint.name=Key Constraint
-policyset.userCertSet.3.constraint.params.keyType=-
-policyset.userCertSet.3.constraint.params.keyMinLength=256
-policyset.userCertSet.3.constraint.params.keyMaxLength=4096
+policyset.userCertSet.3.constraint.params.keyType=RSA
+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
 policyset.userCertSet.3.default.class_id=userKeyDefaultImpl
 policyset.userCertSet.3.default.name=Key Default
 policyset.userCertSet.4.constraint.class_id=noConstraintImpl
diff --git a/pki/base/common/src/UserMessages.properties b/pki/base/common/src/UserMessages.properties
index a798d619..9d454a98 100644
--- a/pki/base/common/src/UserMessages.properties
+++ b/pki/base/common/src/UserMessages.properties
@@ -894,6 +894,7 @@ CMS_PROFILE_KEY_LEN=Key Length
 CMS_PROFILE_KEY_TYPE=Key Type
 CMS_PROFILE_KEY_MIN_LEN=Min Key Length
 CMS_PROFILE_KEY_MAX_LEN=Max Key Length
+CMS_PROFILE_KEY_PARAMETERS=Key Lengths or Curves. For EC use comma separated list of curves, otherise use list of key sizes. Ex: 512,1024,2048,4096,8192 or: nistp256, sect163k1, nistk163 for EC.
 CMS_PROFILE_IS_CA=Is CA
 CMS_PROFILE_PATH_LEN=Path Length
 CMS_PROFILE_MIN_PATH_LEN=Min Path Length
@@ -910,6 +911,7 @@ CMS_PROFILE_INVALID_KEY_TYPE=Invalid Key Type {0}
 CMS_PROFILE_KEY_TYPE_NOT_MATCHED=Key Type {0} Not Matched
 CMS_PROFILE_KEY_MIN_LEN_NOT_MATCHED=Key Min Length {0} Not Matched
 CMS_PROFILE_KEY_MAX_LEN_NOT_MATCHED=Key Max Length {0} Not Matched
+CMS_PROFILE_KEY_PARAMS_NOT_MATCHED=Key Parameters {0} Not Matched
 CMS_PROFILE_OID_NOT_MATCHED=OID {0} Not Matched
 CMS_PROFILE_CRITICAL_NOT_MATCHED=Criticality Not Matched
 CMS_PROFILE_CONSTRAINT_NO_CONSTRAINT=No Constraint
@@ -920,7 +922,7 @@ CMS_PROFILE_CONSTRAINT_BASIC_CONSTRAINTS_EXT_MAX_PATH=Max Path Length not matche
 CMS_PROFILE_CONSTRAINT_CA_VALIDITY_CONSTRAINT_TEXT=This constraint rejects the validity that is not between {0} (now) and {1} (Certificate Authority's notAfter)
 CMS_PROFILE_CONSTRAINT_EXTENDED_KEY_EXT_TEXT=This constraint accepts the Extended Key Usage extension, if present, only when Criticality={0}, OIDs={1}
 CMS_PROFILE_CONSTRAINT_EXTENSION_TEXT=This constraint accepts the extension only when Criticality={0}, OID={1}
-CMS_PROFILE_CONSTRAINT_KEY_TEXT=This constraint accepts the key only if Key Type={0}, Key Min Length={1}, Key Max Length={2}
+CMS_PROFILE_CONSTRAINT_KEY_TEXT=This constraint accepts the key only if Key Type={0}, Key Parameters ={1}
 CMS_PROFILE_CONSTRAINT_ALLOW_SAME_KEY_RENEWAL_TEXT = This constraint allows certificate requests with same keys when key uniqueness is enforced
 CMS_PROFILE_CONSTRAINT_KEY_USAGE_EXT_TEXT=This constraint accepts the Key Usage extension, if present, only when Criticality={0}, Digital Signature={1}, Non-Repudiation={2}, Key Encipherment={3}, Data Encipherment={4}, Key Agreement={5}, Key Certificate Sign={6}, Key CRL Sign={7}, Encipher Only={8}, Decipher Only={9}
 CMS_PROFILE_CONSTRAINT_NS_CERT_EXT_TEXT=This constraint accepts the NS Certificate Type extension, if present, only when Criticality={0}, SSL Client={1}, SSL Server={2}, Email={3}, Object Signing={4}, SSL CA={5}, Email CA={6}, Object Signing CA={7}
diff --git a/pki/base/common/src/com/netscape/cms/profile/constraint/KeyConstraint.java b/pki/base/common/src/com/netscape/cms/profile/constraint/KeyConstraint.java
index 2641922e..01fd7eb0 100644
--- a/pki/base/common/src/com/netscape/cms/profile/constraint/KeyConstraint.java
+++ b/pki/base/common/src/com/netscape/cms/profile/constraint/KeyConstraint.java
@@ -43,36 +43,55 @@ import java.math.BigInteger;
  */
 public class KeyConstraint extends EnrollConstraint {
 
-    public static final String CONFIG_KEY_TYPE = "keyType"; // (DSA, RSA)
-    public static final String CONFIG_KEY_MIN_LEN = "keyMinLength";
-    public static final String CONFIG_KEY_MAX_LEN = "keyMaxLength";
+    public static final String CONFIG_KEY_TYPE = "keyType"; // (EC, RSA)
+    public static final String CONFIG_KEY_PARAMETERS = "keyParameters";
+
+    private static final String[] ecCurves = {"nistp256","nistp384","nistp521","sect163k1","nistk163","sect163r1","sect163r2",
+       "nistb163","sect193r1","sect193r2","sect233k1","nistk233","sect233r1","nistb233","sect239k1","sect283k1","nistk283",
+       "sect283r1","nistb283","sect409k1","nistk409","sect409r1","nistb409","sect571k1","nistk571","sect571r1","nistb571",
+       "secp160k1","secp160r1","secp160r2","secp192k1","secp192r1","nistp192","secp224k1","secp224r1","nistp224","secp256k1",
+       "secp256r1","secp384r1","secp521r1","prime192v1","prime192v2","prime192v3","prime239v1","prime239v2","prime239v3","c2pnb163v1",
+       "c2pnb163v2","c2pnb163v3","c2pnb176v1","c2tnb191v1","c2tnb191v2","c2tnb191v3","c2pnb208w1","c2tnb239v1","c2tnb239v2","c2tnb239v3",
+       "c2pnb272w1","c2pnb304w1","c2tnb359w1","c2pnb368w1","c2tnb431r1","secp112r1","secp112r2","secp128r1","secp128r2","sect113r1","sect113r2",
+       "sect131r1","sect131r2"
+    };
+
+    private static String[] cfgECCurves = null;
+    private static String keyType = "";
+    private static String keyParams = "";
 
     public KeyConstraint() {
         super();
         addConfigName(CONFIG_KEY_TYPE);
-        addConfigName(CONFIG_KEY_MIN_LEN);
-        addConfigName(CONFIG_KEY_MAX_LEN);
+        addConfigName(CONFIG_KEY_PARAMETERS);
     }
 
     public void init(IProfile profile, IConfigStore config)
         throws EProfileException {
         super.init(profile, config);
+
+        String ecNames = "";
+        try {
+            ecNames = CMS.getConfigStore().getString("keys.ecc.curve.list");
+        } catch (Exception e) {
+        }
+
+        CMS.debug("KeyConstraint.init ecNames: " + ecNames);
+        if (ecNames != null && ecNames.length() != 0) {
+            cfgECCurves = ecNames.split(",");
+       }
     }
 
     public IDescriptor getConfigDescriptor(Locale locale, String name) { 
         if (name.equals(CONFIG_KEY_TYPE)) {
-            return new Descriptor(IDescriptor.CHOICE, "RSA,DSA,EC,-",
-                    "-",
+            return new Descriptor(IDescriptor.CHOICE, "RSA,EC",
+                    "RSA",
                     CMS.getUserMessage(locale, "CMS_PROFILE_KEY_TYPE"));
-        } else if (name.equals(CONFIG_KEY_MIN_LEN)) {
-            return new Descriptor(IDescriptor.INTEGER, null,
-                    "512",
-                    CMS.getUserMessage(locale, "CMS_PROFILE_KEY_MIN_LEN"));
-        } else if (name.equals(CONFIG_KEY_MAX_LEN)) {
-            return new Descriptor(IDescriptor.INTEGER, null,
-                    "4096",
-                    CMS.getUserMessage(locale, "CMS_PROFILE_KEY_MAX_LEN"));
+        }   else if (name.equals(CONFIG_KEY_PARAMETERS)) {
+            return new Descriptor(IDescriptor.STRING,null,"",
+                    CMS.getUserMessage(locale,"CMS_PROFILE_KEY_PARAMETERS"));
         }
+
         return null;
     }
 
@@ -86,8 +105,10 @@ public class KeyConstraint extends EnrollConstraint {
             CertificateX509Key infokey = (CertificateX509Key)
                 info.get(X509CertInfo.KEY);
             X509Key key = (X509Key) infokey.get(CertificateX509Key.KEY); 
+
             String alg = key.getAlgorithmId().getName().toUpperCase();
             String value = getConfig(CONFIG_KEY_TYPE);
+            String keyType = value;
 
             if (!isOptional(value)) {
                 if (!alg.equals(value)) {
@@ -100,13 +121,14 @@ public class KeyConstraint extends EnrollConstraint {
             }
 
             int keySize = 0;
+            String ecCurve = "";
 
             if (alg.equals("RSA")) { 
                 keySize = getRSAKeyLen(key);
             } else if (alg.equals("DSA")) { 
                 keySize = getDSAKeyLen(key);
             } else if (alg.equals("EC")) { 
-                keySize = getECKeyLen(key);
+                //EC key case.
             } else {
                 throw new ERejectException(	
                         CMS.getUserMessage(
@@ -114,26 +136,31 @@ public class KeyConstraint extends EnrollConstraint {
                             "CMS_PROFILE_INVALID_KEY_TYPE",
                             alg));
             }
-            value = getConfig(CONFIG_KEY_MIN_LEN);
-            if (!isOptional(value)) {
-                if (keySize < Integer.parseInt(value)) {
+
+            value = getConfig(CONFIG_KEY_PARAMETERS);
+
+            String[] keyParams = value.split(",");
+
+            if (alg.equals("EC")) {
+                //For now only check for legal EC key type.
+                //We don't have the required EC key class to evaluate curve names.
+                if (!alg.equals(keyType)) {
                     throw new ERejectException(
                             CMS.getUserMessage(
                                 getLocale(request),
-                                "CMS_PROFILE_KEY_MIN_LEN_NOT_MATCHED",
+                                "CMS_PROFILE_KEY_PARAMS_NOT_MATCHED",
                                 value));
                 }
-            }
-
-            value = getConfig(CONFIG_KEY_MAX_LEN);
-            if (!isOptional(value)) {
-                if (keySize > Integer.parseInt(value)) {
-                    throw new ERejectException(
+                CMS.debug("KeyConstraint.validate: EC key constrainst passed.");
+            }  else {
+                if ( !arrayContainsString(keyParams,Integer.toString(keySize))) {
+                     throw new ERejectException(
                             CMS.getUserMessage(
                                 getLocale(request),
-                                "CMS_PROFILE_KEY_MAX_LEN_NOT_MATCHED",
+                                "CMS_PROFILE_KEY_PARAMS_NOT_MATCHED",
                                 value));
                 }
+                CMS.debug("KeyConstraint.validate: RSA key contraints passed.");
             }
         } catch (Exception e) {
             if (e instanceof ERejectException) {
@@ -145,10 +172,6 @@ public class KeyConstraint extends EnrollConstraint {
         }
     }
 
-    public int getECKeyLen(X509Key key) throws Exception {
-        return 256; // XXX
-    }
-
     public int getRSAKeyLen(X509Key key) throws Exception {
         X509Key newkey = null;
 
@@ -178,8 +201,7 @@ public class KeyConstraint extends EnrollConstraint {
     public String getText(Locale locale) {
         String params[] = {
                 getConfig(CONFIG_KEY_TYPE),
-                getConfig(CONFIG_KEY_MIN_LEN),
-                getConfig(CONFIG_KEY_MAX_LEN)
+                getConfig(CONFIG_KEY_PARAMETERS)
             };
 
         return CMS.getUserMessage(locale, 
@@ -193,4 +215,84 @@ public class KeyConstraint extends EnrollConstraint {
             return true;
         return false;
     }
+
+    public void setConfig(String name, String value)
+        throws EPropertyException {
+
+        CMS.debug("KeyConstraint.setConfig name: " + name + " value: " + value);
+        //establish keyType, we don't know which order these params will arrive
+        if (name.equals(CONFIG_KEY_TYPE)) {
+            keyType = value;
+            if(keyParams.equals(""))
+               return;
+        }
+        
+        //establish keyParams
+        if (name.equals(CONFIG_KEY_PARAMETERS)) {
+            CMS.debug("establish keyParams: " + value);
+            keyParams = value;
+
+            if(keyType.equals(""))
+                return;
+        }
+        // All the params we need for validation have been collected, 
+        // we don't know which order they will show up
+        if (keyType.length() > 0  && keyParams.length() > 0) {
+            String[] params = keyParams.split(",");
+            boolean isECCurve = false;
+            int keySize = 0;
+
+            for (int i = 0; i < params.length; i++) {
+                if (keyType.equals("EC")) {
+                    if (cfgECCurves == null) {
+                        //Use the static array as a backup if the config values are not present.
+                        isECCurve = arrayContainsString(ecCurves,params[i]);
+                    } else {
+                        isECCurve = arrayContainsString(cfgECCurves,params[i]);
+                    }
+                    if (isECCurve == false) { //Not a valid EC curve throw exception.
+                        keyType = "";
+                        keyParams = "";
+                        throw new EPropertyException(CMS.getUserMessage(
+                            "CMS_INVALID_PROPERTY", name));
+                    }
+                }  else {
+                    try {
+                        keySize = Integer.parseInt(params[i]);
+                    } catch (Exception e) {
+                        keySize = 0;
+                    }
+                    if (keySize <=  0) {
+                        keyType = "";
+                        keyParams = "";
+                        throw new EPropertyException(CMS.getUserMessage(
+                            "CMS_INVALID_PROPERTY", name));
+                    }
+                }
+            }
+       }
+       //Actually set the configuration in the profile
+       super.setConfig(CONFIG_KEY_TYPE, keyType);
+       super.setConfig(CONFIG_KEY_PARAMETERS, keyParams);
+
+       //Reset the vars for next round.
+       keyType = "";
+       keyParams = "";
+    }
+
+    private boolean arrayContainsString(String[] array, String value) {
+
+        if (array == null || value == null) {
+           return false;
+        } 
+
+        for (int i = 0 ; i < array.length; i++) {
+            if (array[i].equals(value)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }
+