Where to Find Installed CSPs in Windows Registry

Cryptographic Service Providers (CSPs) in Windows are registered components that handle cryptographic functions such as encryption, decryption, hashing, and digital signing. When a software-based or hardware-based CSP is installed on a system, Windows stores its registration and configuration details within specific registry keys in the Windows Registry. This guide details the exact registry paths used by Windows to catalog both traditional CryptoAPI CSPs and modern Cryptography Next Generation (CNG) providers.

Primary Registry Path for Legacy CSPs

For standard 64-bit applications on a 64-bit system (or 32-bit applications on a 32-bit system), registered Cryptographic Service Providers are located under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider

Each installed CSP has its own subkey named after the provider (for example, Microsoft Enhanced Cryptographic Provider v1.0 or Microsoft Strong Cryptographic Provider).

Inside each provider’s subkey, you will typically find the following values: * Image Path (REG_SZ): The file path to the dynamic link library (.dll) implementing the CSP. * Type (REG_DWORD): The numeric provider type (e.g., 1 for PROV_RSA_FULL). * Sig (REG_BINARY): The digital signature verifying the integrity of the CSP binary.

32-bit CSPs on 64-bit Windows

If you are running 32-bit cryptographic applications on a 64-bit version of Windows, the 32-bit CSP registrations are mapped under the WOW6432Node:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Defaults\Provider

Registry Path for CSP Provider Types

Windows also maps default providers to specific cryptographic categories under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types

This key contains subkeys corresponding to provider type IDs (such as Type 001 for RSA Full or Type 024 for RSA SChannel). Inside each subkey, the Name value defines the default CSP used for that specific provider type.

Cryptography Next Generation (CNG) Providers

Modern Windows versions use Cryptography Next Generation (CNG) as the successor to legacy CryptoAPI. CNG Key Storage Providers (KSPs) and cryptographic algorithms are registered under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Providers

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration

These keys contain registrations for modern CNG components, such as the Microsoft Software Key Storage Provider and Microsoft Platform Crypto Provider (TPM).

Viewing Installed CSPs via Command Line

In addition to opening regedit.exe and navigating to the registry keys mentioned above, you can list the registered CSPs directly from the command line using the built-in certutil tool:

certutil -csplist

To list CNG Key Storage Providers, use:

certutil -csptest