You should make the Security Domain Infrastructure (SDI) key, also known as the tree key, a Triple DES key (3DES). The SDI key can be checked and upgraded by using the SDIDiag utility. See Step 4: Verify That Your SDI Domain Key Servers Are Ready for Universal Password
in the Password Management Administration Guide.