Microsoft allows a CA to use Cryptography Next Generation (CNG) and [advises of incompatibility issues][1] for clients that do not support this suite.

Here is an image of the default cryptography settings for a 2008 CA.  This machine is a non-domain connected Standalone CA:

![Default Cryptography settings][2]

My intent is to have a general-purpose offline Root-CA and then several Intermediate CAs that serve a specific purpose (MSFT-only vs Unix vs SmartCards etc)

What are the ideal settings for a Root Certificate with an expiration of 5, 10, and 15 years?

1. CSP
2. Signing Certificate
3. Key Character Length

  [1]: http://technet.microsoft.com/en-us/library/cc730763%28v=ws.10%29.aspx
  [2]: https://i.sstatic.net/zfU7l.png