You should make the Security Domain Infrastructure (SDI) key, also known as the tree key, a Triple DES key (3DES). The SDI key can be checked and upgraded by using the SDIDiag utility. See the Step 4: Verify that Your SDI Domain Key Servers Are Ready for Universal Password
section in the Novell Password Management 3.3.2 Administration Guide.