Mobile-ID Quantum Safe
Open Demo Lab

TRUSTED PQC PROVIDER SUITE

Windows Cryptographic Integration
CNG/KSP first. CSP/CAPI explicitly bounded.

A release-governed Windows provider profile for hardware-backed and remote keys. The modern NCrypt/CNG path is documented separately from legacy CryptoAPI/CSP compatibility so applications can select the correct integration contract.

Open Windows developer guide→View samples→

SCOPE, NOT A GENERIC WINDOWS CLAIM

One suite, two very different Windows integration models.

CNG/KSP is the supported modern integration surface. A legacy application that calls CryptoAPI/CAPI cannot be assumed to work through the KSP. It requires an approved CSP/CAPI bridge, application-specific testing or application modernization.

MODERN

Windows CNG/KSP

NCrypt storage-provider contract, persisted keys, Windows certificate-store binding, release-specific algorithms and hardware/remote key backends.

  • Provider registration and lifecycle
  • NCrypt function support matrix
  • Certificate enrollment and key binding
  • Diagnostics, upgrade and rollback
LEGACY

CSP/CAPI compatibility

Separate compatibility profile for applications using CryptAcquireContext, legacy key containers and CryptoAPI signing. It is not implied by CNG/KSP support.

  • Application inventory required
  • Provider type and container semantics
  • Algorithm and encoding limitations
  • Modernization recommendation
BACKENDS

Protected key execution

Release profiles can bind Windows key handles to Trusted Key, an approved HSM/QSCD connector or Trusted SIC remote signing without exposing private-key material to the application.

  • Non-exportable key policy
  • User/machine key scope
  • Step-up or remote approval
  • Audit correlation

NCrypt CONTRACT

Function support is published, versioned and testable.

OperationPilot statusRequired evidence
NCryptOpenStorageProviderProfiledRegistered provider name and package version
NCryptCreatePersistedKey / FinalizeKeyProfiledKey type, scope, policy and backend
NCryptOpenKey / EnumKeys / DeleteKeyProfiledContainer lifecycle and zeroization result
NCryptSignHash / VerifySignatureProfiledAlgorithm, encoding and verifier result
NCryptImportKey / ExportKeyRestrictedPublic-only or approved migration profile
NCryptGetProperty / SetPropertyAllow-listedSupported property register

The public matrix is a documentation baseline. The signed release manifest remains the source of truth for a deployable build.

REFERENCE FLOW

Release-specific integration sequence.

01

Inventory consumer API

Identify NCrypt/CNG or legacy CryptoAPI/CAPI before selecting a provider path.

02

Freeze release boundary

Record Windows build, architecture, package checksum and protected backend.

03

Install and register

Deploy signed package, verify provider registration and event source.

04

Create or bind key

Apply container, ACL, export and authentication policy.

05

Enroll and operate

Generate CSR, bind certificate and execute the approved sign/verify corpus.

06

Publish evidence

Record compatibility, diagnostics, upgrade and rollback result.

INTEGRATION PACKAGE

Documentation that a Windows integrator can use without guessing.

INS

Installation & registration

Defines signed-package installation, provider registration, architecture checks, Windows event sources and a reversible upgrade path for each approved operating-system build.

Open guide →
ENR

Certificate enrollment

Documents certreq and CertEnroll request generation, certificate-store placement, key-container association, renewal, re-binding and revocation behavior for protected keys.

Open enrollment guide →
APP

Compatibility matrix

Publishes tested combinations of Windows build, provider package, protected backend, algorithm profile and consuming application rather than claiming generic Windows compatibility.

View matrix →
DIA

Errors & diagnostics

Maps NCrypt security status, provider events and protected-backend correlation into stable diagnostic categories with fail-closed retry and support-bundle guidance.

Open diagnostics →
SDK

Compilable samples

Supplies illustrative C++, C#, PowerShell and certificate-request examples that demonstrate sequencing while leaving provider names and approved profiles to the signed release manifest.

View samples →
CSP

Legacy CSP decision guide

Separates legacy CryptAcquireContext/CryptSignHash consumers from NCrypt applications and provides a decision path for modernization or an explicitly scoped bridge.

Review CSP/CAPI scope →

KNOWN BOUNDARIES

Known limitations and release boundaries

These constraints prevent a pilot profile from becoming an unsupported general claim.

CONTROLLED PILOT

Freeze the Windows build, provider package, application and backend before testing.

The acceptance record must identify the exact OS build, provider version, key backend, algorithm profile, consumer application and rollback result.

Define pilot scope→Review interoperability→