PKI Implications of choosing different KSP/Key Size/Hashing Algo
In PKI deployments what happens if I pick a different Crypto provider, or change the key length or change the hashing algo?
Is it just a free for all and pick what you want? I note that MD5 is a hashing option but I know that has severe weaknesses for certain purposes so maybe not?
I would guess that SHA512 is better than SHA256, and 4096 bits are better than 2048. Can I just go for it, or will stuff break?
Some CSPs are marked as a smart card CSP, what happens if I pick that but don't have smart card hardware?
Are there pros & cons to changing the crypto provider? Are some better than others?
If anyone can give me a hint, or point me to a good resource I'd be very grateful!
Thanks in advance
The question is too broad. You can read about classic CSPs here: https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptographic-service-providers
and about modern KSP: https://learn.microsoft.com/en-us/windows/win32/seccertenroll/cng-key-storage-providers
Sign in to comment