Problem - Kevin Tafuro

Solution
Microsoft’s CryptoAPI is available on most versions of Windows that are widely
deployed, so it is a reasonable solution for many uses of symmetric encryption.
CryptoAPI contains a small, yet nearly complete, set of functions for creating and
manipulating symmetric encryption keys (which the Microsoft documentation usually
refers to as session keys), exchanging keys, and encrypting and decrypting data.
While the information in the following “Discussion” section will not provide you
with all the finer details of using CryptoAPI, it will give you enough background to
get started using the API successfully.
Discussion
CryptoAPI is designed as a high-level interface to various cryptographic constructs,
including hashes, MACs, public key encryption, and symmetric encryption. Its support
for public key cryptography makes up the majority of the API, but there is also a
small subset of functions for symmetric encryption.
Before you can do anything with CryptoAPI, you first need to acquire a provider context.
CryptoAPI provides a generic API that wraps around Cryptographic Service Providers
(CSPs), which are responsible for doing all the real work. Microsoft provides
several different CSPs that provide implementations of various algorithms. For symmetric
cryptography, two CSPs are widely available and of interest: Microsoft Base
Cryptographic Service Provider and Microsoft Enhanced Cryptographic Service Provider.
A third, Microsoft AES Cryptographic Service Provider, is available only in the
.NET framework. The Base CSP provides RC2, RC4, and DES implementations. The
Enhanced CSP adds implementations for DES, two-key Triple-DES, and three-key
Triple-DES. The AES CSP adds implementations for AES with 128-bit, 192-bit, and
256-bit key lengths.
For our purposes, we’ll concentrate only on the enhanced CSP. Acquiring a provider
context is done with the following code. We use the CRYPT_VERIFYCONTEXT flag here
because we will not be using private keys with the context. It doesn’t necessarily hurt
to omit the flag (which we will do in Recipes 5.26 and 5.27, for example), but if you
don’t need public key access with the context, you should use the flag. Some CSPs
may require user input when CryptAcquireContext( ) is called without CRYPT_
VERIFYCONTEXT.
#include
#include
HCRYPTPROV SpcGetCryptContext(void) {
HCRYPTPROV hProvider;
if (!CryptAcquireContext(&hProvider, 0, MS_ENHANCED_PROV, PROV_RSA_FULL,
CRYPT_VERIFYCONTEXT)) return 0;
return hProvider;
}
238 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.