WINDOWS CNG/KSP

Hợp đồng nhà cung cấp NCrypt

Hướng dẫn CNG/KSP mô tả cài đặt, nhận diện provider, vòng đời khóa lưu bền vững, thuộc tính, ký và hành vi backend được bảo vệ.

Thông tin phiên bản provider

Field	Required release value
Registered provider name	Exact string from signed release manifest
Package	MSI/MSIX/DLL names and SHA-256 checksums
Architecture	x64/ARM64 by release
Windows	Exact Windows 11/Server builds
Backend	Trusted Key, HSM/QSCD, Trusted SIC or test backend
Installation scope	Per-machine/per-user
Logging	Event source, level and support bundle

Ma trận hỗ trợ hàm NCrypt

Function	Status	Contract
NCryptOpenStorageProvider	Profiled	Provider name must match signed release manifest.
NCryptCreatePersistedKey	Profiled	Key type, user/machine scope and backend policy.
NCryptFinalizeKey	Profiled	Policy validation and backend creation evidence.
NCryptOpenKey	Profiled	Container naming, ACL and availability.
NCryptEnumKeys	Profiled	Enumeration visibility and pagination behavior.
NCryptSignHash	Profiled	Algorithm, padding/encoding and authentication.
NCryptVerifySignature	Profiled	Local/provider verification and error mapping.
NCryptImportKey	Restricted	Approved migration/import formats only.
NCryptExportKey	Restricted	Public key or explicitly approved wrapped export.
NCryptGetProperty	Allow-listed	Published property matrix.
NCryptSetProperty	Allow-listed	Mutable-property policy.
NCryptDeleteKey	Profiled	Deletion, zeroization and audit result.

Mô hình key container và chính sách

NAM

Container naming

Stable naming, tenant/application prefix and collision rules.

ACL

Identity & ACL

Windows identity, service account and machine/user scope.

EXP

Export policy

Non-exportable private keys; public or wrapped export only by profile.

AUT

Authentication

PIN, local step-up or remote approval with defined session lifetime.

ROT

Rotation

Certificate/key rollover, overlap and application re-binding.

DEL

Deletion

Fail-closed deletion, zeroization result and immutable audit.

Luồng NCrypt tối thiểu

NCryptOpenStorageProvider
  → NCryptCreatePersistedKey
  → NCryptSetProperty
  → NCryptFinalizeKey
  → NCryptSignHash
  → NCryptVerifySignature
  → NCryptFreeObject