English 
Tiếng ViệtLEGACY WINDOWS COMPATIBILITY
CSP/CAPI decision and modernization guide
CSP/CAPI is a separate legacy contract. A modern KSP cannot be presented as a transparent replacement unless the consuming application and provider type are tested.
01
Decision matrix
| Application behavior | Recommended path | Public status |
|---|---|---|
| Uses NCrypt/CNG | Use CNG/KSP profile | Controlled Pilot |
| Uses CryptAcquireContext/CryptSignHash | Assess CSP/CAPI bridge | Compatibility profile only |
| Configurable provider interface | Migrate to CNG/KSP | Preferred |
| Vendor application with fixed CSP | Vendor-specific test or modernization | No generic support claim |
| Requires unsupported legacy algorithm | Modernize application/profile | Not supported by default |
02
Legacy API inventory
| Area | Representative APIs | Evidence required |
|---|---|---|
| Context/container | CryptAcquireContext, CryptReleaseContext | Provider type, container naming and flags |
| Key lifecycle | CryptGenKey, CryptGetUserKey, CryptDestroyKey | Key type, export policy and deletion |
| Hash/sign | CryptCreateHash, CryptHashData, CryptSignHash | Hash/signature encoding and verifier |
| Certificate store | CertOpenStore, CryptAcquireCertificatePrivateKey | Certificate/private-key association |
| Errors | GetLastError / NTE_* | Error mapping and retry policy |
03
Migration guidance
- Inventory the application API calls and provider type.
- Confirm whether the vendor supports CNG/KSP.
- Map containers and certificates to the modern key model.
- Run dual-path signature and rollback tests.
- Retire CSP only after all consuming applications are migrated.