Using a seperate CSP for key archival

is possible use seperate csp key archival. if have installed ca use non-microsoft csp want use cng key archival, work changing following registry keys:

ca1\encryptioncsp\cngencryptionalgorithm = aes

ca1\encryptioncsp\provider = microsoft software key storage provider

ca1\encryptioncsp\provider type = 1

what effect have on key exchange?

 

thanks

these registry values control

• which csp used generate caexchange key, , how caexchange key stored (ie, encrypted on disk, or on hsm)
• which symmetric algorithm used encrypt archived private keys

this csp not affect csp used sign certificates issued ca.

changing encryptioncsp not update private keys may have archived. don't think issue, however, decryption performed using kra's private key, don't see issue.

hope helps.

---

jonathan stephens

Windows Server  >  Security