Windows Registry Path for Hashing Algorithms

Windows manages its system-wide cryptographic hashing algorithms through specific registry hives dedicated to the Security Support Provider Interface (SSPI), Secure Channel (Schannel), and Cryptography Next Generation (CNG) frameworks. This guide outlines the exact registry paths used to view, enable, or disable system-wide cryptographic hash algorithms such as SHA-256, SHA-384, SHA-512, SHA-1, and MD5 in the Windows Registry Editor (Regedit).

Primary Registry Path for Schannel Hashes

The primary registry location for configuring system-wide cryptographic hashing protocols used by Windows Schannel (TLS/SSL) is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes

Under the Hashes key, each individual hashing algorithm is defined as a separate subkey:

• MD5
• SHA (refers to SHA-1)
• SHA256
• SHA384
• SHA512

To explicitly configure the behavior of a specific algorithm, the following DWORD (32-bit) value is modified within the corresponding algorithm’s subkey:

• Value Name: Enabled
• Value Data: 0x00000000 (0) disables the hash algorithm system-wide.
• Value Data: 0xffffffff (-1) or 0x00000001 (1) explicitly enables the hash algorithm.

CNG and CryptoAPI Registry Configurations

For broader Cryptography Next Generation (CNG) configurations that define the cryptographic providers, algorithms, and cipher suites registered on the system, Windows utilizes the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration

This directory stores registration data for built-in cryptographic providers (like the Microsoft Primitive Provider) and controls the order and priority of cryptographic primitives across the OS.

System-Wide FIPS Policy Enforcement

To restrict the entire operating system strictly to FIPS-compliant cryptographic hashing algorithms, Windows provides an overarching LSA policy located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

Setting the Enabled DWORD value to 1 in this path enforces system-wide utilization of only FIPS-validated hashing algorithms (such as the SHA-2 family), automatically disallowing non-compliant algorithms like MD5 across supported applications and subsystems.