# Microsoft CryptoAPI

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Microsoft_CryptoAPI
> Markdown URL: https://mediated.wiki/source/Microsoft_CryptoAPI.md
> Source: https://en.wikipedia.org/wiki/Microsoft_CryptoAPI
> Source revision: 1355567982
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

Application programming interface

This article may be confusing or unclear to readers. Please help clarify the article. There might be a discussion about this on the talk page. (January 2009) (Learn how and when to remove this message)

The Microsoft Windows platform specific **Cryptographic Application Programming Interface** (also known variously as **CryptoAPI**, **Microsoft Cryptography API**, **MS-CAPI** or simply **CAPI**) is an [application programming interface](/source/Application_programming_interface) included with [Microsoft Windows](/source/Microsoft_Windows) [operating systems](/source/Operating_system) that provides services to enable developers to secure Windows-based applications using [cryptography](/source/Cryptography). It is a set of [dynamically linked libraries](/source/Dynamic-link_library) that provides an [abstraction layer](/source/Abstraction_layer) which isolates programmers from the code used to encrypt the data. The Crypto API was first introduced in [Windows 95 OSR2](/source/Windows_95_OSR2)[1] and [Windows NT 4.0](/source/Windows_NT_4.0)[2] and enhanced in subsequent versions.

CryptoAPI supports both [public-key](/source/Public-key_cryptography) and [symmetric key](/source/Symmetric_key_algorithm) cryptography, though persistent symmetric keys are not supported. It includes functionality for encrypting and decrypting data and for [authentication](/source/Authentication) using [digital certificates](/source/Digital_certificate). It also includes a [cryptographically secure pseudorandom number generator](/source/Cryptographically_secure_pseudorandom_number_generator) function: [CryptGenRandom](/source/CryptGenRandom).

CryptoAPI works with a number of CSPs ([Cryptographic Service Providers](/source/Cryptographic_Service_Provider)) installed on the machine. CSPs are the modules that do the actual work of encoding and decoding data by performing the cryptographic functions. Vendors of [HSMs](/source/Hardware_security_module) may supply a CSP which works with their hardware.

## Cryptography API: Next Generation

[Windows Vista](/source/Windows_Vista) features an update to the Crypto API known as **Cryptography API: Next Generation** (**CNG**). It has better API factoring to allow the same functions to work using a wide range of cryptographic algorithms, and includes a number of newer algorithms that are part of the [National Security Agency](/source/National_Security_Agency) (NSA) [Suite B](/source/NSA_Suite_B_Cryptography).[3] It is also flexible, featuring support for plugging custom cryptographic APIs into the CNG runtime. However, CNG Key Storage Providers still do not support symmetric keys.[4] CNG works in both [user](/source/User_mode) and [kernel mode](/source/Kernel_mode), and also supports all of the algorithms from the CryptoAPI. The Microsoft provider that implements CNG is housed in Bcrypt.dll.

CNG also supports [elliptic curve cryptography](/source/Elliptic_curve_cryptography) which, because it uses shorter keys for the same expected [level of security](/source/Level_of_security), is more efficient than RSA.[5] The CNG API integrates with the [smart card](/source/Smart_card) subsystem by including a Base Smart Card Cryptographic Service Provider (Base CSP) module which encapsulates the smart card API. Smart card manufacturers just have to make their devices compatible with this, rather than provide a from-scratch solution.

CNG also adds support for [Dual_EC_DRBG](/source/Dual_EC_DRBG),[6] a [pseudorandom number generator](/source/Pseudorandom_number_generator) defined in [NIST SP 800-90A](/source/NIST_SP_800-90A) that could expose the user to eavesdropping by the [National Security Agency](/source/National_Security_Agency) since it contains a [kleptographic](/source/Kleptography) backdoor, unless the developer remembers to generate new base points with a different cryptographically secure pseudorandom number generator or a [true random number generator](/source/Hardware_random_number_generator) and then publish the generated seed in order to remove the NSA backdoor. It is also very slow.[7] It is only used when called for explicitly.

CNG also replaces the default PRNG with [CTR_DRBG](/source/CTR_DRBG) using AES as the block cipher, because the earlier RNG which is defined in the now superseded FIPS 186-2 is based on either [DES](/source/Data_Encryption_Standard) or [SHA-1](/source/SHA-1), both which have been broken.[8] CTR_DRBG is one of the two algorithms in NIST SP 800-90 endorsed by [Schneier](/source/Bruce_Schneier), the other being Hash_DRBG.[7]

## See also

- [CAPICOM](/source/CAPICOM)

- [DPAPI](/source/DPAPI)

- [Encrypting File System](/source/Encrypting_File_System)

- [Public-key cryptography](/source/Public-key_cryptography)

- [Cryptographic Service Provider](/source/Cryptographic_Service_Provider)

- [PKCS#11](/source/PKCS11)

- [Crypto API (Linux)](/source/Crypto_API_(Linux))

## References

1. **[^](#cite_ref-1)** ["Microsoft CryptoAPI"](https://www.geoffchappell.com/notes/windows/archive/cryptoapi/index.htm). *www.geoffchappell.com*. Retrieved 2026-05-22.

1. **[^](#cite_ref-2)** [Poking Around Under the Hood: A Programmer's View of Windows NT 4.0](http://www.microsoft.com/msj/archive/S413.aspx)

1. **[^](#cite_ref-3)** [Suite B](http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml) [Archived](https://web.archive.org/web/20090207005135/http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml) 2009-02-07 at the [Wayback Machine](/source/Wayback_Machine)

1. **[^](#cite_ref-4)** [Key Storage and Retrieval, Microsoft](https://msdn.microsoft.com/en-us/library/bb204778%28v=vs.85%29.aspx)

1. **[^](#cite_ref-5)** [The Case for Elliptic Curve Cryptography, NSA](https://www.nsa.gov/business/programs/elliptic_curve.shtml)

1. **[^](#cite_ref-Schneier_6-0)** [Schneier, Bruce](/source/Bruce_Schneier) (December 17, 2007). ["Dual_EC_DRBG Added to Windows Vista"](http://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_ad.html). *Schneier on Security*. Retrieved January 13, 2010.

1. ^ [***a***](#cite_ref-Schneier2_7-0) [***b***](#cite_ref-Schneier2_7-1) [Schneier, Bruce](/source/Bruce_Schneier) (November 15, 2007). ["The Strange Story of Dual_EC_DRBG"](http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html). *Schneier on Security*. Retrieved January 12, 2010.

1. **[^](#cite_ref-8)** ["FIPS PUB 186-2"](http://csrc.nist.gov/publications/fips/archive/fips186-2/fips186-2.pdf) (PDF). *[Federal Information Processing Standards](/source/Federal_Information_Processing_Standard)*. [National Institute of Standards and Technology](/source/National_Institute_of_Standards_and_Technology). January 27, 2000. Retrieved January 13, 2010.

## External links

- [Cryptography Reference on MSDN](http://msdn2.microsoft.com/en-us/library/aa380256.aspx)

- [Microsoft CAPI](https://web.archive.org/web/20130212010016/http://www.cryptodox.com/Microsoft_CAPI) at CryptoDox

v t e Microsoft APIs and frameworks Graphics and UI Desktop Window Manager Direct2D Direct3D D3D (extensions) GDI / GDI+ WPF Silverlight WinUI Windows Color System Windows Image Acquisition Windows Imaging Component DirectX Graphics Infrastructure (DXGI) Windows Advanced Rasterization Platform WinG Audio DirectMusic DirectSound XACT Speech API XAudio2 Multimedia DirectX Media Objects Video Acceleration Xinput DirectInput DirectShow Managed DirectX Media Foundation XNA Windows Media Video for Windows Web MSHTML JScript VBScript BHO XDR SideBar Gadgets TypeScript Data access Data Access Components (MDAC) ADO ADO.NET ODBC OLE DB Extensible Storage Engine Entity Framework Sync Framework Access Database Engine MSXML OPC Networking Winsock LSP Winsock Kernel Filtering Platform NDIS Windows Rally BITS P2P API MSMQ DirectPlay Communication Messaging API Telephony API WCF Administration and management Win32 console Windows Script Host WMI (extensions) PowerShell Task Scheduler Offline Files Shadow Copy Windows Installer Error Reporting Event Log Common Log File System Component model COM COM+ ActiveX Distributed Component Object Model .NET Framework Libraries Framework Class Library Microsoft Foundation Classes (MFC) Active Template Library (ATL) Windows Template Library (WTL) Device drivers WDM WDF KMDF UMDF WDDM NDIS UAA VxD Security Crypto API CAPICOM Windows CardSpace Data Protection API Security Support Provider Interface (SSPI) .NET ASP.NET ADO.NET Remoting Silverlight TPL WCF WCS WPF WF Software factories Enterprise Library CCF IPC MSRPC Dynamic Data Exchange (DDE) Remoting WCF Accessibility Active Accessibility UI Automation Text and multilingual support DirectWrite Text Services Framework Text Object Model Input method editor Language Interface Pack Multilingual User Interface Uniscribe

---
Adapted from the Wikipedia article [Microsoft CryptoAPI](https://en.wikipedia.org/wiki/Microsoft_CryptoAPI) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Microsoft_CryptoAPI?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.