Windows Registry Cryptographic Hash Algorithm Location
This article details the exact Windows Registry locations where the operating system stores and manages the active configuration for system-wide cryptographic hashing algorithms. It covers the registry paths used for Secure Channel (Schannel) network protocols, FIPS algorithm compliance enforcement, and Cryptography Next Generation (CNG) provider registrations.
1. Schannel Network Hashing Algorithms
For secure communications (TLS/SSL) handled by the Windows Security Support Provider Interface (SSPI), hashing algorithms are configured within the Schannel registry hive:
- Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes
Within this key, individual cryptographic hash algorithms reside in
dedicated subkeys: * MD5 * SHA (SHA-1) *
SHA256 * SHA384 * SHA512
Each algorithm subkey contains a DWORD value named
Enabled: * 0x00000000 (0): The hashing
algorithm is disabled. * 0xffffffff or
0x00000001 (1): The hashing algorithm is enabled.
2. System-Wide FIPS Cryptographic Policy
To enforce system-wide compliance requiring only validated cryptographic algorithms (such as the SHA-2 family while restricting non-approved algorithms like MD5):
- Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - Value Name:
Enabled - Type:
REG_DWORD - Settings:
1enables enforcement across system cryptographic components;0leaves it disabled.
3. Cryptography Next Generation (CNG) Configurations
For low-level Windows cryptographic APIs and third-party registered cryptographic service providers, configuration data is maintained under the CNG registry branch:
- Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration - Provider Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Providers
The active hashing interface configurations are registered under: *
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\Default\00000001\BCRYPT_HASH_INTERFACE
This location lists the default kernel-mode and user-mode cryptographic providers responsible for executing active hash functions across the operating system.