WINDOWS CNG/KSP

NCrypt provider contract

The CNG/KSP guide documents installation, provider discovery, persisted-key lifecycle, properties, signing and protected backend behavior.

Provider release facts

Field	Required release value
Registered provider name	Exact string from signed release manifest
Package	MSI/MSIX/DLL names and SHA-256 checksums
Architecture	x64/ARM64 by release
Windows	Exact Windows 11/Server builds
Backend	Trusted Key, HSM/QSCD, Trusted SIC or test backend
Installation scope	Per-machine/per-user
Logging	Event source, level and support bundle

NCrypt function support matrix

Function	Status	Contract
NCryptOpenStorageProvider	Profiled	Provider name must match signed release manifest.
NCryptCreatePersistedKey	Profiled	Key type, user/machine scope and backend policy.
NCryptFinalizeKey	Profiled	Policy validation and backend creation evidence.
NCryptOpenKey	Profiled	Container naming, ACL and availability.
NCryptEnumKeys	Profiled	Enumeration visibility and pagination behavior.
NCryptSignHash	Profiled	Algorithm, padding/encoding and authentication.
NCryptVerifySignature	Profiled	Local/provider verification and error mapping.
NCryptImportKey	Restricted	Approved migration/import formats only.
NCryptExportKey	Restricted	Public key or explicitly approved wrapped export.
NCryptGetProperty	Allow-listed	Published property matrix.
NCryptSetProperty	Allow-listed	Mutable-property policy.
NCryptDeleteKey	Profiled	Deletion, zeroization and audit result.

Key-container and policy model

NAM

Container naming

Stable naming, tenant/application prefix and collision rules.

ACL

Identity & ACL

Windows identity, service account and machine/user scope.

EXP

Export policy

Non-exportable private keys; public or wrapped export only by profile.

AUT

Authentication

PIN, local step-up or remote approval with defined session lifetime.

ROT

Rotation

Certificate/key rollover, overlap and application re-binding.

DEL

Deletion

Fail-closed deletion, zeroization result and immutable audit.

Minimal NCrypt flow

NCryptOpenStorageProvider
  → NCryptCreatePersistedKey
  → NCryptSetProperty
  → NCryptFinalizeKey
  → NCryptSignHash
  → NCryptVerifySignature
  → NCryptFreeObject