My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using CryptAcquireContext with MS_ENH_RSA_AES_PROV and PROV_RSA_AES. Then I create a key via CryptDeriveKey, etc.

I found this instruction https://technet.microsoft.com/en-us/library/cc750357.aspx which tells about FIPS 140-2 Validation.

It says that

Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services.

Then it says

The list of validated CNG binaries is identified in the CNG Validated Cryptographic Modules section.


When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below.

Using the information in the tables it looks like AES 256 is FIPS allowed. Then I can see the following dynamic libraries.

bcryptprimitives.dll and ncryptsslp.dll

I have checked the library version (10.0.14393) and I have the correct version on my computer. I looked via Process Hacker and see the the application uses the libraries. But at the same time I have a lot of additional libraries like crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. I cannot check if they are used as wrappers or actually have some underlying cryptographic functions.

In http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2937.pdf which is linked to bcryptprimitives.dll and ncryptsslp.dll, I can see a set of CNG primitive functions which can be used by callers to access the cryptographic services. At the same time it looks like CAPI (CryptoAPI?) is allowed too.

So do I have to move from CryptoAPI to the list of CNG function to use FIPS 140-2 validated cryptographic libraries or is it allowed to the functions which I currently use? But then how to check if I only use FIPS 140-2 validated libraries?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.