HSM and Crypto Provider Registry Locations in Windows

Hardware Security Modules (HSMs) interface with Windows operating systems through cryptographic providers, which are registered in the Windows Registry (regedit). Depending on whether the HSM uses modern Cryptography Next Generation (CNG) Key Storage Providers (KSPs) or legacy Cryptographic API (CryptoAPI) Cryptographic Service Providers (CSPs), Windows stores their configuration, drivers, and metadata across specific system registry hives.

1. Cryptography Next Generation (CNG) Key Storage Providers (KSPs)

Modern HSMs typically implement a CNG Key Storage Provider (KSP) to support current Windows cryptographic operations, such as Active Directory Certificate Services (AD CS) and TLS.

• Primary 64-bit Provider Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Providers Under this key, each registered KSP appears as a subkey (e.g., nCipher Security World Key Storage Provider, SafeNet Key Storage Provider, or Microsoft Software Key Storage Provider). Inside the subkey, the Image path string value defines the path to the provider’s dynamic-link library (.dll).

• CNG Registered Interfaces Configuration: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local This path details the specific cryptographic interfaces, classes, and algorithms mapped to installed hardware and software providers.

2. Legacy CryptoAPI Cryptographic Service Providers (CSPs)

Older HSM integrations rely on Microsoft CryptoAPI CSP architecture.

• 64-bit System CSPs: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Each subkey represents a registered CSP and contains parameters such as the Image Path, Type, and Signature.

• 32-bit System CSPs (on 64-bit Windows): HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Defaults\Provider This location handles 32-bit applications interacting with 32-bit HSM cryptographic drivers on a 64-bit operating system.

3. Smart Card and Minidriver-Based HSMs

Some HSMs utilize the Windows Smart Card Minidriver specification to interface with the Base Smart Card Cryptographic Service Provider (Base CSP) or the Microsoft Smart Card KSP.

• Calais Database Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards Under this key, specific card profiles matching the HSM’s ATR (Answer to Reset) string map to the corresponding vendor-supplied minidriver .dll.

• Calais Readers Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers Lists the connected physical or virtual smart card reader interfaces exposed by the HSM.

Verifying Provider Registration

To verify that Windows recognizes the registry entries correctly without opening regedit, you can run the following command in an elevated Command Prompt:

certutil -csplist

(Lists all registered CSPs)

certutil -csptest

(Tests and lists available Cryptography Next Generation KSPs)