Windows Registry Cryptographic Hash Algorithm Location

This article details the exact Windows Registry locations where the operating system stores and manages the active configuration for system-wide cryptographic hashing algorithms. It covers the registry paths used for Secure Channel (Schannel) network protocols, FIPS algorithm compliance enforcement, and Cryptography Next Generation (CNG) provider registrations.

1. Schannel Network Hashing Algorithms

For secure communications (TLS/SSL) handled by the Windows Security Support Provider Interface (SSPI), hashing algorithms are configured within the Schannel registry hive:

Within this key, individual cryptographic hash algorithms reside in dedicated subkeys: * MD5 * SHA (SHA-1) * SHA256 * SHA384 * SHA512

Each algorithm subkey contains a DWORD value named Enabled: * 0x00000000 (0): The hashing algorithm is disabled. * 0xffffffff or 0x00000001 (1): The hashing algorithm is enabled.

2. System-Wide FIPS Cryptographic Policy

To enforce system-wide compliance requiring only validated cryptographic algorithms (such as the SHA-2 family while restricting non-approved algorithms like MD5):

3. Cryptography Next Generation (CNG) Configurations

For low-level Windows cryptographic APIs and third-party registered cryptographic service providers, configuration data is maintained under the CNG registry branch:

The active hashing interface configurations are registered under: * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\Default\00000001\BCRYPT_HASH_INTERFACE

This location lists the default kernel-mode and user-mode cryptographic providers responsible for executing active hash functions across the operating system.