| Message | Date |
+ October 2019 Windows 10, version 1903 \"D\" optional release is available.
The October 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release. | October 24, 2019
08:00 AM PT |
October 2019 Windows \"C\" optional release is available.
The October 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release. | October 15, 2019
09:59 AM PT |
Windows 10, version 1703 has reached end of service
Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the Windows lifecycle fact sheet. | October 09, 2019
12:00 PM PT |
Take Action: October 2019 security update available for all supported versions of Windows
The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate. | October 08, 2019
08:00 AM PT |
diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md
index afaaca56b3..228b863e82 100644
--- a/windows/security/identity-protection/access-control/active-directory-security-groups.md
+++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md
@@ -112,7 +112,7 @@ The following table lists the three group scopes and more information about each
Global groups from any domain in the same forest
Other Universal groups from any domain in the same forest
Can be converted to Domain Local scope
-Can be converted to Global scope if the group does not contain any other Universal groups |
+Can be converted to Global scope if the group is not a member of any other Universal groups
On any domain in the same forest or trusting forests |
Other Universal groups in the same forest
Domain Local groups in the same forest or trusting forests
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
index cf2079e8e5..cf63fb2c17 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
@@ -107,7 +107,7 @@ Federation server proxies are computers that run AD FS software that have been c
Use the [Setting of a Federation Proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment.
### Deploy Azure AD Connect
-Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
+Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**.
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
index 1cf7fcb2cd..804d8a9ca6 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
@@ -77,8 +77,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
->[!NOTE]
->The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
+> [!NOTE]
+> The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
### Enrollment Agent certificate template
@@ -150,10 +150,10 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq
Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials.
1. Open an elevated command prompt.
-2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
+2. Run `certutil -dsTemplate WHFBAuthentication,msPKI-Private-Key-Flag,+CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
->[!NOTE]
->If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
+> [!NOTE]
+> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
## Publish Templates
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
index abb29a0a18..0f5cdfa98a 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
@@ -27,7 +27,7 @@ ms.reviewer:
You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises.
## Deploy Azure AD Connect
-Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
+Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
> [!NOTE]
diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
index f00875d1a2..c1a9b60e79 100644
--- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
+++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
@@ -23,19 +23,21 @@ In Windows 10, Windows Hello for Business replaces passwords with strong two-fa
Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account.
Windows Hello addresses the following problems with passwords:
-- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites.
-- Server breaches can expose symmetric network credentials (passwords).
-- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673).
-- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing).
+
+- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites.
+- Server breaches can expose symmetric network credentials (passwords).
+- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673).
+- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing).
>[!div class="mx-tdBreakAll"]
>| | | |
>| :---: | :---: | :---: |
>| [](hello-overview.md)[Overview](hello-overview.md) | [](hello-why-pin-is-better-than-password.md)[Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [](hello-manage-in-organization.md)[Manage Windows Hello in your Organization](hello-manage-in-organization.md) |
-## Prerequisites
+## Prerequisites
### Cloud Only Deployment
+
* Windows 10, version 1511 or later
* Microsoft Azure Account
* Azure Active Directory
@@ -44,6 +46,7 @@ Windows Hello addresses the following problems with passwords:
* Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory
### Hybrid Deployments
+
The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process.
| Key trustGroup Policy managed | Certificate trustMixed managed | Key trustModern managed | Certificate trustModern managed |
@@ -54,25 +57,26 @@ The table shows the minimum requirements for each deployment. For key trust in a
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
andWindows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service |
-| Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter| Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter |
+| Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/3rd Party MFA Adapter| Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/3rd Party MFA Adapter |
| Azure Account | Azure Account | Azure Account | Azure Account |
| Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory |
| Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect |
| Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment |
-### On-premises Deployments
+### On-premises Deployments
+
The table shows the minimum requirements for each deployment.
| Key trust Group Policy managed | Certificate trust Group Policy managed|
-| --- | --- |
+| --- | --- |
| Windows 10, version 1703 or later | Windows 10, version 1703 or later |
| Windows Server 2016 Schema | Windows Server 2016 Schema|
| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level |
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
| Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) |
-| AD FS with Azure MFA Server, orAD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, orAD FS with 3rd Party MFA Adapter |
+| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter |
| Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing |
>[!IMPORTANT]
-> For Windows Hello for Business deployment, if you have several domains, at least one Windows Server Domain Controller 2016 is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers).
+> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers).
diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md
index 3878a9b907..99d02689bd 100644
--- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md
+++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md
@@ -21,7 +21,7 @@ ms.reviewer:
> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users.
+Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys).
The [FIDO2 CTAP specification](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html) contains a few optional features and extensions which are crucial to provide that seamless and secure experience.
diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md
index 830bfcfcfc..702f62e6d4 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-events.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-events.md
@@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*>
| 607 | Reader object failed to start monitor thread: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
%1 = Windows error code |
| 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
%1 = Windows error code |
| 609 | Reader monitor failed to create overlapped event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
%1 = Windows error code |
-| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
%1 = Windows error code
%2 = Name of the smart card reader
%3 = IOCTL that was sent
%4 = First 4 bytes of the command sent to the smart card |
+| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This is a benign error that does not affect end use of a smart card and can be ignored.
%1 = Windows error code
%2 = Name of the smart card reader
%3 = IOCTL that was sent
%4 = First 4 bytes of the command sent to the smart card |
| 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. |
| 612 | Reader insertion monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
%1 = Windows error code |
| 615 | Reader removal monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
%1 = Windows error code |
| 616 | Reader monitor '%2' received uncaught error code: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
%1 = Windows error code
%2 = Reader name |
| 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
%1 = Smart card reader name |
| 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. |
-| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
%1 = Windows error code |
+| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. This error may also occur if the event is queried before the smart card service is ready. In this case the error is benign and can be ignored.
%1 = Windows error code |
| 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
%1 = Windows error code |
## Smart card Plug and Play events
diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
index 7968ef5030..08e059935f 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
@@ -136,10 +136,7 @@ PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpace
-
-
-
-# **PowerShell**
+**Powershell**
[BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
index a426da3ed2..aca61b7f1d 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
@@ -78,4 +78,4 @@ To turn on, turn off, or change configurations of BitLocker on operating system
## What is the recommended boot order for computers that are going to be BitLocker-protected?
-You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
+You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md
index e17bd5c51b..c2050be90b 100644
--- a/windows/security/information-protection/index.md
+++ b/windows/security/information-protection/index.md
@@ -5,7 +5,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-author: justinha
+author: dansimp
+ms.author: dansimp
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
index f6d1a67328..bf7360d125 100644
--- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
+++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
@@ -49,6 +49,9 @@ The recovery process included in this topic only works for desktop devices. WIP
4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager](create-wip-policy-using-sccm.md).
+> [!NOTE]
+> This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM).
+
## Verify your data recovery certificate is correctly set up on a WIP client computer
1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP.
diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md
index 6edaaf0f7d..a710de4335 100644
--- a/windows/security/information-protection/windows-information-protection/wip-learning.md
+++ b/windows/security/information-protection/windows-information-protection/wip-learning.md
@@ -10,8 +10,8 @@ ms.mktglfcycl:
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: stephow-MSFT
-ms.author: stephow
+author: LauraWi
+ms.author: laurawi
manager: laurawi
audience: ITPro
ms.collection: M365-security-compliance
@@ -33,7 +33,7 @@ In the **Website learning report**, you can view a summary of the devices that h
## Access the WIP Learning reports
-1. Open the [Azure portal](http://portal.azure.com/).
+1. Open the [Azure portal](https://portal.azure.com/).
1. Click **All services**, type **Intune** in the text box filter, and click the star to add it to **Favorites**.
diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index f8776c4535..65f80dda38 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -9,7 +9,7 @@
#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
#### [Configuration score](microsoft-defender-atp/configuration-score.md)
#### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md)
-#### [Remediation](microsoft-defender-atp/tvm-remediation.md)
+#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md)
#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md)
#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md)
@@ -122,10 +122,13 @@
##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md)
##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md)
##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md)
+##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md)
+##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md)
+##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md)
+##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md)
#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md)
-
#### [Custom detections]()
##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md)
##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md)
@@ -308,21 +311,23 @@
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
-### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md)
-#### [What's New in Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md)
-#### [Deploy Microsoft Defender Advanced Threat Protection for Mac]()
-##### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md)
-##### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md)
-##### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md)
-##### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md)
-#### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md)
-#### [Configure Microsoft Defender ATP for Mac]()
-##### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md)
-##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/microsoft-defender-atp-mac-pua.md)
-#### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md)
-#### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md)
-
-
+### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
+#### [What's New](microsoft-defender-atp/mac-whatsnew.md)
+#### [Deploy]()
+##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md)
+##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md)
+##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md)
+##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md)
+#### [Update](microsoft-defender-atp/mac-updates.md)
+#### [Configure]()
+##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md)
+##### [Set preferences](microsoft-defender-atp/mac-preferences.md)
+##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md)
+#### [Troubleshoot]()
+##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md)
+##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md)
+#### [Privacy](microsoft-defender-atp/mac-privacy.md)
+#### [Resources](microsoft-defender-atp/mac-resources.md)
### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md)
diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md
index faa3dcf853..e9761cde7b 100644
--- a/windows/security/threat-protection/auditing/event-4738.md
+++ b/windows/security/threat-protection/auditing/event-4738.md
@@ -196,7 +196,7 @@ Typical **Primary Group** values for user accounts:
- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. If the value of **userAccountControl** attribute of user object was changed, you will see the new value here.
-To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
+To decode this value, you can go through the property value definitions in the [User’s or Computer’s account UAC flags.](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties) from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
Here's an example: Flags value from event: 0x15
@@ -226,7 +226,7 @@ Decoding:
So this UAC flags value decodes to: LOCKOUT and SCRIPT
-- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: “Table 7. User’s or Computer’s account UAC flags.”. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
+- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
- **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field. For local accounts, this field is not applicable and always has “<value not set>“ value.
diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md
index a5aaae535b..cdfc758875 100644
--- a/windows/security/threat-protection/auditing/event-5156.md
+++ b/windows/security/threat-protection/auditing/event-5156.md
@@ -184,7 +184,7 @@ For 5156(S): The Windows Filtering Platform has permitted a connection.
- If you need to monitor all inbound connections to a specific local port, monitor for [5156](event-5156.md) events with that “**Source Port**.**”**
-- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or compter, for example, anything other than 1, 6, or 17.
+- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or computer, for example, anything other than 1, 6, or 17.
- If the computer’s communication with “**Destination Address”** should always use a specific “**Destination Port**,**”** monitor for any other “**Destination Port**.”
diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md
index 2fa857956a..74a43afb5e 100644
--- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md
+++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md
@@ -50,8 +50,10 @@ The following table describes the ways Microsoft Defender ATP can allow or block
|----------|-------------|
| [Restrict USB drives and other peripherals](#restrict-usb-drives-and-other-peripherals) | You can allow/prevent users to install only the USB drives and other peripherals included on a list of authorized/unauthorized devices or device types. |
| [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | You can't install or use removable storage. |
-| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | You can only install and use approved peripherals that report specific properties in their firmware. |
+| [Allow installation and usage of specifically approved peripherals](#allow-installation-and-usage-of-specifically-approved-peripherals) | You can only install and use approved peripherals that report specific properties in their firmware. |
| [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | You can't install or use prohibited peripherals that report specific properties in their firmware. |
+| [Allow installation and usage of specifically approved peripherals with matching device instance IDs](#allow-installation-and-usage-of-specifically-approved-peripherals-with-matching-device-instance-ids) | You can only install and use approved peripherals that match any of these device instance IDs. |
+| [Prevent installation and usage of specifically prohibited peripherals with matching device instance IDs](#prevent-installation-and-usage-of-specifically-prohibited-peripherals-with-matching-device-instance-ids) | You can't install or use prohibited peripherals that match any of these device instance IDs. |
| [Limit services that use Bluetooth](#limit-services-that-use-bluetooth) | You can limit the services that can use Bluetooth. |
| [Use Microsoft Defender ATP baseline settings](#use-microsoft-defender-atp-baseline-settings) | You can set the recommended configuration for ATP by using the Microsoft Defender ATP security baseline. |
@@ -169,7 +171,7 @@ Select-Object -Property *
7. Click **Create** to save the profile.
-### Only allow installation and usage of specifically approved peripherals
+### Allow installation and usage of specifically approved peripherals
Peripherals that are allowed to be installed can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks and allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one.
@@ -183,6 +185,18 @@ Microsoft Defender ATP blocks installation and usage of prohibited peripherals b
- [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class.
- [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses).
+### Allow installation and usage of specifically approved peripherals with matching device instance IDs
+
+Peripherals that are allowed to be installed can be specified by their [device instance IDs](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one.
+
+You can allow installation and usage of approved peripherals with matching device instance IDs by configuring [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdeviceinstanceids) policy setting.
+
+### Prevent installation and usage of specifically prohibited peripherals with matching device instance IDs
+
+Peripherals that are prohibited to be installed can be specified by their [device instance IDs](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one.
+
+You can prevent installation of the prohibited peripherals with matching device instance IDs by configuring [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceinstanceids) policy setting.
+
### Limit services that use Bluetooth
Using Intune, you can limit the services that can use Bluetooth through the ["Bluetooth allowed services"](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist-usage-guide). The default state of "Bluetooth allowed services" settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and doesn’t add the file transfer GUIDs, file transfer should be blocked.
diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md
index 5f47de9db6..32bbf69dc2 100644
--- a/windows/security/threat-protection/fips-140-validation.md
+++ b/windows/security/threat-protection/fips-140-validation.md
@@ -1,7091 +1,7194 @@
----
-title: FIPS 140 Validation
-description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140.
-ms.prod: w10
-audience: ITPro
-author: dulcemontemayor
-ms.author: dansimp
-manager: dansimp
-ms.collection: M365-identity-device-management
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 04/03/2018
-ms.reviewer:
----
-
-
-# FIPS 140 Validation
-
-On this page
-
-- [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo)
-- [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd)
-- [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd)
-- [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve)
-- [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac)
-- [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac)
-- [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac)
-- [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg)
-
-Updated: March 2018
-
-
-
-## Introduction
-
-This document provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard, *Federal Information Processing Standard (FIPS) 140 – Security Requirements for Cryptographic Modules* \[FIPS 140\].
-
-### Audience
-
-This document is primarily focused on providing information for three parties:
-
-[Procurement Officer](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Responsible for verifying that Microsoft products (or even third-party applications) are either FIPS 140 validated or utilize a Microsoft FIPS 140 validated cryptographic module.
-
-[System Integrator](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Responsible for ensuring that Microsoft Products are configured properly to use only FIPS 140 validated cryptographic modules.
-
-[Software Developer](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Responsible for building software products that utilize Microsoft FIPS 140 validated cryptographic modules.
-
-### Document Map
-
-This document is broken into seven major sections:
-
-[FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_overview) – Provides an overview of the FIPS 140 standard as well as provides some historical information about the standard.
-
-[Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Provides information on how Microsoft products are FIPS 140 validated.
-
-[Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Describes how to configure and verify that Microsoft Products are being used in a manner consistent with the product’s FIPS 140 Security Policy.
-
-[Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Identifies how developers can leverage the Microsoft FIPS 140 validated cryptographic modules.
-
-[FAQ](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_faq) – Frequently Asked Questions.
-
-[Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) – Explains Microsoft cryptographic architecture and identifies specific modules that are FIPS 140 validated.
-
-[Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#_cryptographic_algorithms) – Lists the cryptographic algorithm, modes, states, key sizes, Windows versions, and corresponding cryptographic algorithm validation certificates.
-
-## FIPS 140 Overview
-
-### FIPS 140 Standard
-
-FIPS 140 is a US government and Canadian government standard that defines a minimum set of the security requirements for products that implement cryptography. This standard is designed for cryptographic modules that are used to secure sensitive but unclassified information. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP), a joint effort between the US National Institute of Standards and Technology (NIST) and the Communications Security Establishment of Canada (CSEC).
-
-The current standard defines four-levels of increasing security, 1 through 4. Most software products (including all Microsoft products) are tested against the Level 1 security requirements.
-
-### Applicability of the FIPS standard
-
-Within the US Federal government, the FIPS 140 standard applies to any security system (whether hardware, firmware, software, or a combination thereof) to be used by agencies for protecting sensitive but unclassified information. Some agencies have expanded its use by requiring that the modules to be procured for secret systems also meet the FIPS 140 requirements.
-
-The FIPS 140 standard has also been used by different standards bodies, specification groups, nations, and private institutions as a requirement or guideline for those products (e.g. – Digital Cinema Systems Specification).
-
-### History of 140-1
-
-FIPS 140-1 is the original working version of the standard made official on January 11, 1994. The standard remained in effect until FIPS 140-2 became mandatory for new products on May 25, 2002.
-
-### FIPS 140-2
-
-FIPS 140-2 is currently the active version of the standard.
-
-### Microsoft FIPS Support Policy
-
-Microsoft actively maintains FIPS 140 validation for its cryptographic modules.
-
-### FIPS Mode of Operation
-
-The common term “FIPS mode” is used in this document and Security Policy documents. When a cryptographic module contains both FIPS-approved and non-FIPS approved security methods, it must have a "FIPS mode of operation" to ensure only FIPS-approved security methods may be used. When a module is in "FIPS mode", a non-FIPS approved method cannot be used instead of a FIPS-approved method.
-
-## Microsoft Product Validation (Information for Procurement Officers and Auditors)
-
-This section provides information for Procurement Officers and Auditors who are responsible for ensuring that Microsoft products with FIPS 140 validated cryptographic modules are used in their organization. The goal of this section is to provide an overview of the Microsoft developed products and modules and explain how the validated cryptographic modules are used.
-
-### Microsoft Product Relationship with CNG and CAPI libraries
-
-Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services.
-
-The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules:
-
-- Schannel Security Package
-- Remote Desktop Protocol (RDP) Client
-- Encrypting File System (EFS)
-- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.)
-- BitLocker® Drive Full-volume Encryption
-- IPsec Settings of Windows Firewall
-- Server Message Block (SMB) 3.x
-
-## Information for System Integrators
-
-This section provides information for System Integrators and Auditors who are responsible for deploying Microsoft products in a manner consistent with the product’s FIPS 140 Security Policy.
-
-There are two steps to ensure that Microsoft products operate in FIPS mode:
-
-1. Selecting/Installing FIPS 140 validated cryptographic modules
-2. Setting FIPS local/group security policy flag.
-
-### Step 1 – Selecting/Installing FIPS 140 Validated Cryptographic Modules
-
-Systems Integrators must ensure that all cryptographic modules installed are, in fact, FIPS 140 validated. This can be accomplished by cross-checking the version number of the installed module with the list of validated binaries. The list of validated CAPI binaries is identified in the [CAPI Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_capi_validated_cryptographic) section below and the list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section below. There are similar sections for all other validated cryptographic modules.
-
-The version number of the installed binary is found by right-clicking the module file and clicking on the Version or Details tab. Cryptographic modules are stored in the "windows\\system32" or "windows\\system32\\drivers" directory.
-
-### Step 2 – Setting FIPS Local/Group Security Policy Flag
-
-The Windows operating system provides a group (or local) security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing”, which is used by many Microsoft products to determine whether to operate in a FIPS-approved mode. When this policy is set, the validated cryptographic modules in Windows will also operate in a FIPS-approved mode.
-
-**Note** – There is no enforcement of the FIPS policy by the operating system or the validated cryptographic modules. Instead, each individual application must check this flag and enforce the Security Policy of the validated cryptographic modules.
-
-#### Instructions on Setting the FIPS Local/Group Security Policy Flag
-
-While there are alternative methods for setting the FIPS local/group security policy flag, the following method is included as a guide to users with Administrative privileges. This description is for the Local Security Policy, but the Group Security Policy may be set in a similar manner.
-
-1. Open the 'Run' menu by pressing the combination 'Windows Key + R'.
-2. Type 'secpol.msc' and press 'Enter' or click the 'Ok' button.
-3. In the Local Security Policy management console window that opens, use the left tab to navigate to the Local Policies -\> Security Options.
-4. Scroll down the right pane and double-click 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing'.
-5. In the properties window, select the 'Enabled' option and click the 'Apply' button.
-
-#### Microsoft Components and Products That Utilize FIPS Local/Group Security Policy
-
-The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy.
-
-- Schannel Security Package
-- Remote Desktop Protocol (RDP) Client
-- Encrypting File System (EFS)
-- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.)
-- BitLocker® Drive Full-volume Encryption
-- IPsec Settings of Windows Firewall
-
-#### Effects of Setting FIPS Local/Group Security Policy Flag
-
-When setting the FIPS local/group security policy flag, the behavior of several Microsoft components and products are affected. The most noticeable difference will be that the components enforcing this setting will only use those algorithms approved or allowed in FIPS mode. The specific changes to the products listed above are:
-
-- Schannel Security Package forced to negotiate sessions using TLS. The following supported Cipher Suites are disabled:
-
-- - TLS\_RSA\_WITH\_RC4\_128\_SHA
- - TLS\_RSA\_WITH\_RC4\_128\_MD5
- - SSL\_CK\_RC4\_128\_WITH\_MD5
- - SSL\_CK\_DES\_192\_EDE3\_CBC\_WITH\_MD5
- - TLS\_RSA\_WITH\_NULL\_MD5
- - TLS\_RSA\_WITH\_NULL\_SHA
-
-- The set of cryptographic algorithms that a Remote Desktop Protocol (RDP) server will use is scoped to:
-
-- - CALG\_RSA\_KEYX - RSA public key exchange algorithm
- - CALG\_3DES - Triple DES encryption algorithm
- - CALG\_AES\_128 - 128 bit AES
- - CALG\_AES\_256 - 256 bit AES
- - CALG\_SHA1 - SHA hashing algorithm
- - CALG\_SHA\_256 - 256 bit SHA hashing algorithm
- - CALG\_SHA\_384 - 384 bit SHA hashing algorithm
- - CALG\_SHA\_512 - 512 bit SHA hashing algorithm
-
-- Any Microsoft .NET Framework applications, such as Microsoft ASP.NET or Windows Communication Foundation (WCF), only allow algorithm implementations that are validated to FIPS 140, meaning only classes that end in "CryptoServiceProvider" or "Cng" can be used. Any attempt to create an instance of other cryptographic algorithm classes or create instances that use non-allowed algorithms will cause an InvalidOperationException exception.
-
-- Verification of ClickOnce applications fails unless the client computer has .NET Framework 2.0 SP1 or later service pack installed or .NET Framework 3.5 or later installed.
-
-- On Windows Vista and Windows Server 2008 and later, BitLocker Drive Encryption switches from AES-128 using the elephant diffuser to using the approved AES-256 encryption. Recovery passwords are not created or backed up. Instead, backup a recovery key on a local drive or on a network share. To use the recovery key, put the key on a USB device and plug the device into the computer.
-
-Please be aware that selection of FIPS mode can limit product functionality (See ).
-
-## Information for Software Developers
-
-This section is targeted at developers who wish to build their own applications using the FIPS 140 validated cryptographic modules.
-
-Each of the validated cryptographic modules defines a series of rules that must be followed. The security rules for each validated cryptographic module are specified in the Security Policy document. Links to each of the Security Policy documents is provided in the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section below. Generally, the restriction in Microsoft validated cryptographic modules is limiting the use of cryptography to only FIPS Approved cryptographic algorithms, modes, and key sizes.
-
-### Using Microsoft Cryptographic Modules in a FIPS mode of operation
-
-No matter whether developing with native languages or using .NET, it is important to first check whether the CNG modules for the target system are FIPS validated. The list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section.
-
-When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below. It is important to remember that setting the FIPS local/group security policy Flag (discussed above) does not affect the behavior of the modules when used for developing custom applications.
-
-If you are developing your application using .NET instead of using the native libraries, then setting the FIPS local policy flag will generate an exception when an improper .NET class is used for cryptography (i.e. the cryptographic classes whose names end in "Managed"). The names of these allowed classes end with "Cng", which use the CNG binaries or "CryptoServiceProvider", which use the legacy CAPI binaries.
-
-### Key Strengths and Validity Periods
-
-NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated November 2015, \[[SP 800-131A](http://dx.doi.org/10.6028/nist.sp.800-131ar1)\], offers guidance for moving to stronger cryptographic keys and algorithms. This does not replace NIST SP 800-57, Recommendation for Key Management Part 1: General, \[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\], but gives more specific guidance. One of the most important topics discussed in these publications deals with the key strengths of FIPS Approved algorithms and their validity periods. When developing applications that use FIPS Approved algorithms, it is also extremely important to select appropriate key sizes based on the security lifetimes recommended by NIST.
-
-## FIPS 140 FAQ
-
-The following are answers to commonly asked questions for the FIPS 140-2 validation of Microsoft products.
-
-1. How does FIPS 140 relate to the Common Criteria?
- **Answer:** These are two separate security standards with different, but complementary, purposes. FIPS 140 is a standard designed specifically for validating product modules that implement cryptography. On the other hand, Common Criteria is designed to help evaluate security functions in IT products.
- In many cases, Common Criteria evaluations will rely on FIPS 140 validations to provide assurance that cryptographic functionality is implemented properly.
-2. How does FIPS 140 relate to Suite B?
- **Answer:** Suite B is simply a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information.
- The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140 standard.
-3. There are so many modules listed on the NIST website for each release, how are they related and how do I tell which one applies to me?
- **Answer:** Microsoft strives to validate all releases of its cryptographic modules. Each module provides a different set of cryptographic algorithms. If you are required to use only FIPS validated cryptographic modules, you simply need to verify that the version being used appears on the validation list.
- Please see the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140)section for a complete list of Microsoft validated modules.
-4. My application links against crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. What do I need to do to assure I’m using FIPS 140 validated cryptographic modules?
- **Answer:** crypt32.dll, cryptsp.dll, advapi32.dll, and ncrypt.dll are intermediary libraries that will offload all cryptographic operations to the FIPS validated cryptographic modules. Bcrypt.dll itself is a validated cryptographic module for Windows Vista and Windows Server 2008. For Windows 7 and Windows Server 2008 R2 and later, bcryptprimitives.dll is the validated module, but bcrypt.dll remains as one of the libraries to link against.
- You must first verify that the underlying CNG cryptographic module is validated. Once verified, you'll need to confirm that you're using the module correctly in FIPS mode (See [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) section for details).
-5. What does "When operated in FIPS mode" mean on certificates?
- **Answer:** This caveat identifies that a required configuration and security rules must be followed in order to use the cryptographic module in a manner consistent with its FIPS 140 Security Policy. The security rules are defined in the Security Policy for the module and usually revolve around using only FIPS Approved cryptographic algorithms and key sizes. Please see the Security Policy for the specific security rules for each cryptographic module (See [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section for links to each policy).
-6. Which FIPS validated module is called when Windows 7 or Windows 8 is configured to use the FIPS setting in the wireless configuration?
- **Answer:** CNG is used. This setting tells the wireless driver to call FIPS 140-2 validated cryptographic modules instead of using the driver’s own cryptography, if any.
-7. Is BitLocker to Go FIPS 140-2 validated?
- **Answer:** There are two separate parts for BitLocker to Go. One part is simply a native feature of BitLocker and as such, it uses FIPS 140-2 validated cryptographic modules. The other part is the BitLocker to Go Reader application for down-level support of older operating systems such as Windows XP and Windows Vista. The Reader application does not use FIPS 140-2 validated cryptographic modules.
-8. Are applications FIPS 140-2 validated?
- **Answer:** Microsoft only has low-level cryptographic modules in Windows FIPS 140-2 validated, not high-level applications. A better question is whether a certain application calls a FIPS 140-2 validated cryptographic module in the underlying Windows OS. That question needs to be directed to the company/product group that created the application of interest.
-9. How can Systems Center Operations Manager 2012 be configured to use FIPS 140-2 validated cryptographic modules?
- **Answer:** See [https://technet.microsoft.com/library/hh914094.aspx](https://technet.microsoft.com/library/hh914094.aspx)
-
-## Microsoft FIPS 140 Validated Cryptographic Modules
-
-### Modules By Operating System
-
-The following tables identify the Cryptographic Modules for an operating system.
-
-#### Windows
-
-##### Windows 10 Creators Update (Version 1703)
-
-Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile
-
-
-
-
-\[1\] Applies only to Home, Pro, Enterprise, Education and S
-
-\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub
-
-\[3\] Applies only to Pro, Enterprise Education and S
-
-##### Windows 10 Anniversary Update (Version 1607)
-
-Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-10.0.14393 |
-#2937 |
-FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
-
-Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-10.0.14393 |
-#2936 |
-FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
-
-Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887) |
-
-
-| Boot Manager |
-10.0.14393 |
-#2931 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)
-Other algorithms: MD5; PBKDF (non-compliant); VMK KDF |
-
-
-| BitLocker® Windows OS Loader (winload) |
-10.0.14393 |
-#2932 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: NDRNG; MD5 |
-
-
-| BitLocker® Windows Resume (winresume)[1] |
-10.0.14393 |
-#2933 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys)[2] |
-10.0.14393 |
-#2934 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064) |
-
-
-| Code Integrity (ci.dll) |
-10.0.14393 |
-#2935 |
-FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: AES (non-compliant); MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888) |
-
-
-| Secure Kernel Code Integrity (skci.dll)[3] |
-10.0.14393 |
-#2938 |
-FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
-
-Other algorithms: MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888) |
-
-
-
-
-
-\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
-
-\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile
-
-\[3\] Applies only to Pro, Enterprise and Enterprise LTSB
-
-##### Windows 10 November 2015 Update (Version 1511)
-
-Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-10.0.10586 |
-#2606 |
-FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
-
-Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-10.0.10586 |
-#2605 |
-FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
-
-Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663) |
-
-
-| Boot Manager[4] |
-10.0.10586 |
-#2700 |
-FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
-
-Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
-
-
-| BitLocker® Windows OS Loader (winload)[5] |
-10.0.10586 |
-#2701 |
-FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
-
-Other algorithms: MD5; NDRNG |
-
-
-| BitLocker® Windows Resume (winresume)[6] |
-10.0.10586 |
-#2702 |
-FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys)[7] |
-10.0.10586 |
-#2703 |
-FIPS Approved algorithms: AES (Certs. #3653) |
-
-
-| Code Integrity (ci.dll) |
-10.0.10586 |
-#2604 |
-FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
-
-Other algorithms: AES (non-compliant); MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665) |
-
-
-| Secure Kernel Code Integrity (skci.dll)[8] |
-10.0.10586 |
-#2607 |
-FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
-
-Other algorithms: MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665) |
-
-
-
-
-
-\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub
-
-\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub
-
-\[6\] Applies only to Home, Pro and Enterprise
-
-\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub
-
-\[8\] Applies only to Enterprise and Enterprise LTSB
-
-##### Windows 10 (Version 1507)
-
-Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-10.0.10240 |
-#2606 |
-FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
-
-Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-10.0.10240 |
-#2605 |
-FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
-
-Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576) |
-
-
-| Boot Manager[9] |
-10.0.10240 |
-#2600 |
-FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
-
-Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
-
-
-| BitLocker® Windows OS Loader (winload)[10] |
-10.0.10240 |
-#2601 |
-FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
-
-Other algorithms: MD5; NDRNG |
-
-
-| BitLocker® Windows Resume (winresume)[11] |
-10.0.10240 |
-#2602 |
-FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys)[12] |
-10.0.10240 |
-#2603 |
-FIPS Approved algorithms: AES (Certs. #3497 and #3498) |
-
-
-| Code Integrity (ci.dll) |
-10.0.10240 |
-#2604 |
-FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
-
-Other algorithms: AES (non-compliant); MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572) |
-
-
-| Secure Kernel Code Integrity (skci.dll)[13] |
-10.0.10240 |
-#2607 |
-FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
-
-Other algorithms: MD5
-Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572) |
-
-
-
-
-
-\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
-
-\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
-
-\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
-
-\[12\] Applies only to Pro, Enterprise and Enterprise LTSB
-
-\[13\] Applies only to Enterprise and Enterprise LTSB
-
-##### Windows 8.1
-
-Validated Editions: RT, Pro, Enterprise, Phone, Embedded
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-6.3.9600 6.3.9600.17031 |
-#2357 |
-FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
-
-Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.3.9600 6.3.9600.17042 |
-#2356 |
-FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
-
-Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
-Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289) |
-
-
-| Boot Manager |
-6.3.9600 6.3.9600.17031 |
-#2351 |
-FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
-
-Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
-
-
-| BitLocker® Windows OS Loader (winload) |
-6.3.9600 6.3.9600.17031 |
-#2352 |
-FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
-
-Other algorithms: MD5; NDRNG |
-
-
-| BitLocker® Windows Resume (winresume)[14] |
-6.3.9600 6.3.9600.17031 |
-#2353 |
-FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys) |
-6.3.9600 6.3.9600.17031 |
-#2354 |
-FIPS Approved algorithms: AES (Cert. #2832)
-
-Other algorithms: N/A |
-
-
-| Code Integrity (ci.dll) |
-6.3.9600 6.3.9600.17031 |
-#2355#2355 |
-FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
-
-Other algorithms: MD5
-Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289) |
-
-
-
-
-
-\[14\] Applies only to Pro, Enterprise, and Embedded 8.
-
-##### Windows 8
-
-Validated Editions: RT, Home, Pro, Enterprise, Phone
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
-6.2.9200 |
-#1892 |
-FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
-
-Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-
- |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.2.9200 |
-#1891 |
-FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
-
-Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-
-Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Boot Manager |
-6.2.9200 |
-#1895 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Windows OS Loader (WINLOAD) |
-6.2.9200 |
-#1896 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG |
-
-
-| BitLocker® Windows Resume (WINRESUME)[15] |
-6.2.9200 |
-#1898 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (DUMPFVE.SYS) |
-6.2.9200 |
-#1899 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198)
-
-Other algorithms: N/A |
-
-
-| Code Integrity (CI.DLL) |
-6.2.9200 |
-#1897 |
-FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
-6.2.9200 |
-#1893 |
-FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Enhanced Cryptographic Provider (RSAENH.DLL) |
-6.2.9200 |
-#1894 |
-FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
-
-Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-
-
-
-\[15\] Applies only to Home and Pro
-
-**Windows 7**
-
-Validated Editions: Windows 7, Windows 7 SP1
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
-6.1.7600.16385
-6.1.7601.17514 |
-1329 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
-
-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
-
-Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.1.7600.16385
-6.1.7600.16915
-6.1.7600.21092
-6.1.7601.17514
-6.1.7601.17725
-6.1.7601.17919
-6.1.7601.21861
-6.1.7601.22076 |
-1328 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
-
-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
-
-
-| Boot Manager |
-6.1.7600.16385
-6.1.7601.17514 |
-1319 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
-
-Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
-
-Other algorithms: MD5 |
-
-
-| Winload OS Loader (winload.exe) |
-6.1.7600.16385
-6.1.7600.16757
-6.1.7600.20897
-6.1.7600.20916
-6.1.7601.17514
-6.1.7601.17556
-6.1.7601.21655
-6.1.7601.21675 |
-1326 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
-
-Other algorithms: MD5 |
-
-
-| BitLocker™ Drive Encryption |
-6.1.7600.16385
-6.1.7600.16429
-6.1.7600.16757
-6.1.7600.20536
-6.1.7600.20873
-6.1.7600.20897
-6.1.7600.20916
-6.1.7601.17514
-6.1.7601.17556
-6.1.7601.21634
-6.1.7601.21655
-6.1.7601.21675 |
-1332 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
-
-Other algorithms: Elephant Diffuser |
-
-
-| Code Integrity (CI.DLL) |
-6.1.7600.16385
-6.1.7600.17122
-6.1.7600.21320
-6.1.7601.17514
-6.1.7601.17950
-6.1.7601.22108 |
-1327 |
-FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
-
-Other algorithms: MD5 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
-6.1.7600.16385
-(no change in SP1) |
-1331 |
-FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4 |
-
-
-| Enhanced Cryptographic Provider (RSAENH.DLL) |
-6.1.7600.16385
-(no change in SP1) |
-1330 |
-FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
-
-Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-
-
-
-##### Windows Vista SP1
-
-Validated Editions: Ultimate Edition
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Boot Manager (bootmgr) |
-6.0.6001.18000 and 6.0.6002.18005 |
-978 |
-FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753) |
-
-
-| Winload OS Loader (winload.exe) |
-6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596 |
-979 |
-FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
-
-Other algorithms: MD5 |
-
-
-| Code Integrity (ci.dll) |
-6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005 |
-980 |
-FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
-
-Other algorithms: MD5 |
-
-
-| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
-6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.22869 |
-1000 |
-FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert. and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Cryptographic Primitives Library (bcrypt.dll) |
-6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.22872 |
-1001 |
-FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)
-Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength) |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 |
-1002 |
-FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)
-Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
-1003 |
-FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
-
-
-
-
-
-##### Windows Vista
-
-Validated Editions: Ultimate Edition
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-6.0.6000.16386 |
-893 |
-FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
-
-Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-6.0.6000.16386 |
-894 |
-FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
-
-
-| BitLocker™ Drive Encryption |
-6.0.6000.16386 |
-947 |
-FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
-
-Other algorithms: Elephant Diffuser |
-
-
-| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
-6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067 |
-891 |
-FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
-
-Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5 |
-
-
-
-
-
-##### Windows XP SP3
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Kernel Mode Cryptographic Module (FIPS.SYS) |
-5.1.2600.5512 |
-997 |
-FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)
-Other algorithms: DES; MD5; HMAC MD5 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-5.1.2600.5507 |
-990 |
-FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)
-Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-5.1.2600.5507 |
-989 |
-FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)
-Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits) |
-
-
-
-
-
-##### Windows XP SP2
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| DSS/Diffie-Hellman Enhanced Cryptographic Provider |
-5.1.2600.2133 |
-240 |
-FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)
-Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement) |
-
-
-| Microsoft Enhanced Cryptographic Provider |
-5.1.2600.2161 |
-238 |
-FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)
-Other algorithms: DES (Cert. #156); RC2; RC4; MD5 |
-
-
-
-
-
-##### Windows XP SP1
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Microsoft Enhanced Cryptographic Provider |
-5.1.2600.1029 |
-238 |
-FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)
-Other algorithms: DES (Cert. #156); RC2; RC4; MD5 |
-
-
-
-
-
-##### Windows XP
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Kernel Mode Cryptographic Module |
-5.1.2600.0 |
-241 |
-FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)
-Other algorithms: DES (Cert. #89) |
-
-
-
-
-
-##### Windows 2000 SP3
-
-
-
-
-##### Windows 2000 SP2
-
-
-
-
-##### Windows 2000 SP1
-
-
-
-
-##### Windows 2000
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider |
-5.0.2150.1 |
-76 |
-FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)
-Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
-
-
-
-
-
-##### Windows 95 and Windows 98
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider |
-5.0.1877.6 and 5.0.1877.7 |
-75 |
-FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)
-Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
-
-
-
-
-
-##### Windows NT 4.0
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Base Cryptographic Provider |
-5.0.1877.6 and 5.0.1877.7 |
-68 |
-FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
-
-Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
-
-
-
-
-
-#### Windows Server
-
-##### Windows Server 2016
-
-Validated Editions: Standard, Datacenter, Storage Server
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-10.0.14393 |
-2937 |
-FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
-
-Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-10.0.14393 |
-2936 |
-FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
-
-Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Boot Manager |
-10.0.14393 |
-2931 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)
-Other algorithms: MD5; PBKDF (non-compliant); VMK KDF |
-
-
-| BitLocker® Windows OS Loader (winload) |
-10.0.14393 |
-2932 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: NDRNG; MD5 |
-
-
-| BitLocker® Windows Resume (winresume) |
-10.0.14393 |
-2933 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys) |
-10.0.14393 |
-2934 |
-FIPS Approved algorithms: AES (Certs. #4061 and #4064) |
-
-
-| Code Integrity (ci.dll) |
-10.0.14393 |
-2935 |
-FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
-
-Other algorithms: AES (non-compliant); MD5 |
-
-
-| Secure Kernel Code Integrity (skci.dll) |
-10.0.14393 |
-2938 |
-FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
-
-Other algorithms: MD5 |
-
-
-
-
-
-##### Windows Server 2012 R2
-
-Validated Editions: Server, Storage Server,
-
-**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2**
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
-6.3.9600 6.3.9600.17031 |
-2357 |
-FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
-
-Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.3.9600 6.3.9600.17042 |
-2356 |
-FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
-
-Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Boot Manager |
-6.3.9600 6.3.9600.17031 |
-2351 |
-FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
-
-Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
-
-
-| BitLocker® Windows OS Loader (winload) |
-6.3.9600 6.3.9600.17031 |
-2352 |
-FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
-
-Other algorithms: MD5; NDRNG |
-
-
-| BitLocker® Windows Resume (winresume)[16] |
-6.3.9600 6.3.9600.17031 |
-2353 |
-FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (dumpfve.sys)[17] |
-6.3.9600 6.3.9600.17031 |
-2354 |
-FIPS Approved algorithms: AES (Cert. #2832)
-
-Other algorithms: N/A |
-
-
-| Code Integrity (ci.dll) |
-6.3.9600 6.3.9600.17031 |
-2355 |
-FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
-
-Other algorithms: MD5 |
-
-
-
-
-
-\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2**
-
-\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2**
-
-**Windows Server 2012**
-
-Validated Editions: Server, Storage Server
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
-6.2.9200 |
-1892 |
-FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
-
-Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-
-Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.2.9200 |
-1891 |
-FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
-
-Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-
-Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
-
-
-| Boot Manager |
-6.2.9200 |
-1895 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Windows OS Loader (WINLOAD) |
-6.2.9200 |
-1896 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG |
-
-
-| BitLocker® Windows Resume (WINRESUME) |
-6.2.9200 |
-1898 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| BitLocker® Dump Filter (DUMPFVE.SYS) |
-6.2.9200 |
-1899 |
-FIPS Approved algorithms: AES (Certs. #2196 and #2198)
-
-Other algorithms: N/A |
-
-
-| Code Integrity (CI.DLL) |
-6.2.9200 |
-1897 |
-FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
-
-Other algorithms: MD5 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
-6.2.9200 |
-1893 |
-FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Enhanced Cryptographic Provider (RSAENH.DLL) |
-6.2.9200 |
-1894 |
-FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
-
-Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-
-
-
-##### Windows Server 2008 R2
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Boot Manager (bootmgr) |
-6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.17514 |
-1321 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
-
-Other algorithms: MD5 |
-
-
-| Winload OS Loader (winload.exe) |
-6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.21675 |
-1333 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
-
-Other algorithms: MD5 |
-
-
-| Code Integrity (ci.dll) |
-6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.22108 |
-1334 |
-FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
-
-Other algorithms: MD5 |
-
-
-| Kernel Mode Cryptographic Primitives Library (cng.sys) |
-6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.22076 |
-1335 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
-
--Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
-
-
-| Cryptographic Primitives Library (bcryptprimitives.dll) |
-66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.17514 |
-1336 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
-
-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-6.1.7600.16385 |
-1337 |
-FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
-
-Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-6.1.7600.16385 |
-1338 |
-FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
-
-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4 |
-
-
-| BitLocker™ Drive Encryption |
-6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.21675 |
-1339 |
-FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
-
-Other algorithms: Elephant Diffuser |
-
-
-
-
-
-##### Windows Server 2008
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Boot Manager (bootmgr) |
-6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.22497 |
-1004 |
-FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
-
-Other algorithms: N/A |
-
-
-| Winload OS Loader (winload.exe) |
-6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.22596 |
-1005 |
-FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
-
-Other algorithms: MD5 |
-
-
-| Code Integrity (ci.dll) |
-6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
-1006 |
-FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
-
-Other algorithms: MD5 |
-
-
-| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
-6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.22869 |
-1007 |
-FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
-
-Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert. and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
-
-Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-| Cryptographic Primitives Library (bcrypt.dll) |
-6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.22872 |
-1008 |
-FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
-
-Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength) |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
-1009 |
-FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
-
--Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 |
-1010 |
-FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
-
-Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-
-
-
-##### Windows Server 2003 SP2
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-5.2.3790.3959 |
-875 |
-FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)
-Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4 |
-
-
-| Kernel Mode Cryptographic Module (FIPS.SYS) |
-5.2.3790.3959 |
-869 |
-FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)
-Other algorithms: DES; HMAC-MD5 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-5.2.3790.3959 |
-868 |
-FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)
-Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
-
-
-
-
-
-##### Windows Server 2003 SP1
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Kernel Mode Cryptographic Module (FIPS.SYS) |
-5.2.3790.1830 [SP1] |
-405 |
-FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])
-Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-5.2.3790.1830 [Service Pack 1]) |
-382 |
-FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])
-Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-5.2.3790.1830 [Service Pack 1] |
-381 |
-FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)
-Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-
-
-
-##### Windows Server 2003
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Kernel Mode Cryptographic Module (FIPS.SYS) |
-5.2.3790.0 |
-405 |
-FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])
-Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-| Enhanced Cryptographic Provider (RSAENH) |
-5.2.3790.0 |
-382 |
-FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])
-Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
-5.2.3790.0 |
-381 |
-FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)
-Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40
-[1] x86
-[2] SP1 x86, x64, IA64 |
-
-
-
-
-
-#### Other Products
-
-##### Windows Embedded Compact 7 and Windows Embedded Compact 8
-
-
-
-
-
-##### Windows CE 6.0 and Windows Embedded Compact 7
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Enhanced Cryptographic Provider |
-6.00.1937 [1] and 7.00.1687 [2] |
-825 |
-FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])
-Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES |
-
-
-
-
-
-##### Outlook Cryptographic Provider
-
-
-
-
-
-
-
-
-
-
-| Cryptographic Module |
-Version (link to Security Policy) |
-FIPS Certificate # |
-Algorithms |
-
-
-| Outlook Cryptographic Provider (EXCHCSP) |
-SR-1A (3821)SR-1A (3821) |
-110 |
-FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)
-Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5 |
-
-
-
-
-
-
-### Cryptographic Algorithms
-
-The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate.
-
-### Advanced Encryption Standard (AES)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- AES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CFB128:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CTR:
-
-- Counter Source: Internal
-- Key Lengths: 128, 192, 256 (bits)
- - AES-OFB:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- |
-Microsoft Surface Hub Virtual TPM Implementations #4904
-Version 10.0.15063.674 |
-
-
-
-- AES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CFB128:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CTR:
-
-- Counter Source: Internal
-- Key Lengths: 128, 192, 256 (bits)
- - AES-OFB:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903
-Version 10.0.16299 |
-
-
-
-- AES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CCM:
-
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
-- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
- - AES-CFB128:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CMAC:
-
-- Generation:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - Verification:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-CTR:
-
-- Counter Source: Internal
-- Key Lengths: 128, 192, 256 (bits)
- - AES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-GCM:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 96, 104, 112, 120, 128 (bits)
-- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
-- AAD Lengths: 0, 8, 1016, 1024 (bits)
-- 96 bit IV supported
- - AES-XTS:
-
-- Key Size: 128:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- - Key Size: 256:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902
-Version 10.0.15063.674 |
-
-
-
-- AES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CCM:
-
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
-- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
- - AES-CFB128:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CMAC:
-
-- Generation:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - Verification:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-CTR:
-
-- Counter Source: Internal
-- Key Lengths: 128, 192, 256 (bits)
- - AES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-GCM:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 96, 104, 112, 120, 128 (bits)
-- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
-- AAD Lengths: 0, 8, 1016, 1024 (bits)
-- 96 bit IV supported
- - AES-XTS:
-
-- Key Size: 128:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- - Key Size: 256:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901
-Version 10.0.15254 |
-
-
-
-- AES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CCM:
-
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
-- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
- - AES-CFB128:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-CMAC:
-
-- Generation:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - Verification:
-
-- AES-128:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-192:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-256:
-
-- Block Sizes: Full, Partial
-- Message Length: 0-65536
-- Tag Length: 16-16
- - AES-CTR:
-
-- Counter Source: Internal
-- Key Lengths: 128, 192, 256 (bits)
- - AES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Key Lengths: 128, 192, 256 (bits)
- - AES-GCM:
-
-- Modes: Decrypt, Encrypt
-- IV Generation: External
-- Key Lengths: 128, 192, 256 (bits)
-- Tag Lengths: 96, 104, 112, 120, 128 (bits)
-- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
-- AAD Lengths: 0, 8, 1016, 1024 (bits)
-- 96 bit IV supported
- - AES-XTS:
-
-- Key Size: 128:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- - Key Size: 256:
-
-- Modes: Decrypt, Encrypt
-- Block Sizes: Full
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897
-Version 10.0.16299 |
-
-
-AES-KW:
-
-- Modes: Decrypt, Encrypt
-- CIPHK transformation direction: Forward
-- Key Lengths: 128, 192, 256 (bits)
-- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
-
-AES Val#4902 |
-Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900
-Version 10.0.15063.674 |
-
-
-AES-KW:
-
-- Modes: Decrypt, Encrypt
-- CIPHK transformation direction: Forward
-- Key Lengths: 128, 192, 256 (bits)
-- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
-
-AES Val#4901 |
-Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899
-Version 10.0.15254 |
-
-
-AES-KW:
-
-- Modes: Decrypt, Encrypt
-- CIPHK transformation direction: Forward
-- Key Lengths: 128, 192, 256 (bits)
-- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
-
-AES Val#4897 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898
-Version 10.0.16299 |
-
-
-AES-CCM:
-
-- Key Lengths: 256 (bits)
-- Tag Lengths: 128 (bits)
-- IV Lengths: 96 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
-
-AES Val#4902 |
-Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896
-Version 10.0.15063.674 |
-
-
-AES-CCM:
-
-- Key Lengths: 256 (bits)
-- Tag Lengths: 128 (bits)
-- IV Lengths: 96 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
-
-AES Val#4901 |
-Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895
-Version 10.0.15254 |
-
-
-AES-CCM:
-
-- Key Lengths: 256 (bits)
-- Tag Lengths: 128 (bits)
-- IV Lengths: 96 (bits)
-- Plain Text Length: 0-32
-- AAD Length: 0-65536
-
-AES Val#4897 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894
-Version 10.0.16299 |
-
-
-CBC ( e/d; 128 , 192 , 256 );
-CFB128 ( e/d; 128 , 192 , 256 );
-OFB ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627
-Version 10.0.15063 |
-
-
-KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
-AES Val#4624 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626
-Version 10.0.15063 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#4624
- |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625
-Version 10.0.15063 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
-CFB128 ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 )
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
-GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported
-GMAC_Supported
-XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624
-Version 10.0.15063 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 ); |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434
-Version 7.00.2872 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 ); |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433
-Version 8.00.6246 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431
-Version 7.00.2872 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430
-Version 8.00.6246 |
-
-
-CBC ( e/d; 128 , 192 , 256 );
-CFB128 ( e/d; 128 , 192 , 256 );
-OFB ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074
-Version 10.0.14393 |
-
-
-ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
-GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
-GMAC_Supported
-XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064
-Version 10.0.14393 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
-Version 10.0.14393 |
-
-
-KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )
-AES Val#4064 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062
-Version 10.0.14393 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#4064 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061
-Version 10.0.14393 |
-
-
-KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
-AES Val#3629 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652
-Version 10.0.10586 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#3629 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653
-Version 10.0.10586 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
-Version 10.0.10586 |
-
-
-ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
-GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
-GMAC_Supported
-XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
-
-
-Version 10.0.10586 |
-
-
-KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
-AES Val#3497 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507
-Version 10.0.10240 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#3497 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498
-Version 10.0.10240 |
-
-
-ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
-GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
-GMAC_Supported
-XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
-Version 10.0.10240 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
-Version 10.0.10240 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853
-Version 6.3.9600 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#2832 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848
-Version 6.3.9600 |
-
-
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
-GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported ;
-OtherIVLen_Supported
-GMAC_Supported |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832
-Version 6.3.9600 |
-
-
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-AES Val#2197
-CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
-AES Val#2197
-GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
-(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
-IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
-GMAC_Supported |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216 |
-
-
-CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
-AES Val#2196 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
-CFB128 ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196 |
-
-
-CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
-AES Val#1168 |
-Windows Server 2008 R2 and SP1 CNG algorithms #1187
-Windows 7 Ultimate and SP1 CNG algorithms #1178 |
-
-
-CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
-AES Val#1168 |
-Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 );
- |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 |
-
-
-GCM
-GMAC |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed |
-
-
-| CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 ) |
-Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760 |
-
-
-| CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 ) |
-Windows Server 2008 CNG algorithms #757
-Windows Vista Ultimate SP1 CNG algorithms #756 |
-
-
-CBC ( e/d; 128 , 256 );
-CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 ) |
-Windows Vista Ultimate BitLocker Drive Encryption #715
-Windows Vista Ultimate BitLocker Drive Encryption #424 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CFB8 ( e/d; 128 , 192 , 256 ); |
-Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739
-Windows Vista Symmetric Algorithm Implementation #553 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 );
-CTR ( int only; 128 , 192 , 256 ) |
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023 |
-
-
-ECB ( e/d; 128 , 192 , 256 );
-CBC ( e/d; 128 , 192 , 256 ); |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781
-Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548
-Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516
-Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507
-Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290
-Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224
-Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80
-Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33 |
-
-
-
-
-
-Deterministic Random Bit Generator (DRBG)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- Counter:
-
-- Modes: AES-256
-- Derivation Function States: Derivation Function not used
-- Prediction Resistance Modes: Not Enabled
-
-Prerequisite: AES #4904 |
-Microsoft Surface Hub Virtual TPM Implementations #1734
-Version 10.0.15063.674 |
-
-
-
-- Counter:
-
-- Modes: AES-256
-- Derivation Function States: Derivation Function not used
-- Prediction Resistance Modes: Not Enabled
-
-Prerequisite: AES #4903 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733
-Version 10.0.16299 |
-
-
-
-- Counter:
-
-- Modes: AES-256
-- Derivation Function States: Derivation Function used
-- Prediction Resistance Modes: Not Enabled
-
-Prerequisite: AES #4902 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732
-Version 10.0.15063.674 |
-
-
-
-- Counter:
-
-- Modes: AES-256
-- Derivation Function States: Derivation Function used
-- Prediction Resistance Modes: Not Enabled
-
-Prerequisite: AES #4901 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731
-Version 10.0.15254 |
-
-
-
-- Counter:
-
-- Modes: AES-256
-- Derivation Function States: Derivation Function used
-- Prediction Resistance Modes: Not Enabled
-
-Prerequisite: AES #4897 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730
-Version 10.0.16299 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ] |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556
-Version 10.0.15063 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ] |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555
-Version 10.0.15063 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ] |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433
-Version 7.00.2872 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ] |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432
-Version 8.00.6246 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ] |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430
-Version 7.00.2872 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ] |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429
-Version 8.00.6246 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ] |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222
-Version 10.0.14393 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ] |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217
-Version 10.0.14393 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ] |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955
-Version 10.0.10586 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ] |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868
-Version 10.0.10240 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ] |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489
-Version 6.3.9600 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ] |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ] |
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193 |
-
-
-| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ] |
-Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23 |
-
-
-| DRBG (SP 800–90) |
-Windows Vista Ultimate SP1, vendor-affirmed |
-
-
-
-
-
-#### Digital Signature Algorithm (DSA)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- DSA:
-
-- 186-4:
-
-- PQGGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - PQGVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - KeyPair:
-
-- L = 2048, N = 256
-- L = 3072, N = 256
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303
-Version 10.0.15063.674 |
-
-
-
-- DSA:
-
-- 186-4:
-
-- PQGGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - PQGVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - KeyPair:
-
--
--
-- L = 2048, N = 256
-- L = 3072, N = 256
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302
-Version 10.0.15254 |
-
-
-
-- DSA:
-
-- 186-4:
-
-- PQGGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - PQGVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigGen:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - SigVer:
-
-- L = 2048, N = 256 SHA: SHA-256
-- L = 3072, N = 256 SHA: SHA-256
- - KeyPair:
-
-- L = 2048, N = 256
-- L = 3072, N = 256
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301
-Version 10.0.16299 |
-
-
-FIPS186-4:
-PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
-PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-KeyPairGen: [ (2048,256) ; (3072,256) ]
-SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
-SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: Val#3790
-DRBG: Val# 1555 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223
-Version 10.0.15063 |
-
-
-FIPS186-4:
-PQG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
-SIG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
-SHS: Val# 3649 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188
-Version 7.00.2872 |
-
-
-FIPS186-4:
-PQG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
-SIG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
-SHS: Val#3648 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187
-Version 8.00.6246 |
-
-
-FIPS186-4:
-PQG(gen)PARMS TESTED: [
-(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
-PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-KeyPairGen: [ (2048,256) ; (3072,256) ]
-SIG(gen)PARMS TESTED: [ (2048,256)
-SHA( 256 ); (3072,256) SHA( 256 ); ]
-SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: Val# 3347
-DRBG: Val# 1217 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098
-Version 10.0.14393 |
-
-
-FIPS186-4:
-PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
-KeyPairGen: [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
-SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: Val# 3047
-DRBG: Val# 955 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024
-Version 10.0.10586 |
-
-
-FIPS186-4:
-PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
-PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-KeyPairGen: [ (2048,256) ; (3072,256) ]
-SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: Val# 2886
-DRBG: Val# 868 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983
-Version 10.0.10240 |
-
-
-FIPS186-4:
-PQG(gen)PARMS TESTED: [
-(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
-PQG(ver)PARMS TESTED: [ (2048,256)
-SHA( 256 ); (3072,256) SHA( 256 ) ]
-KeyPairGen: [ (2048,256) ; (3072,256) ]
-SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
-SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: Val# 2373
-DRBG: Val# 489 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855
-Version 6.3.9600 |
-
-
-FIPS186-2:
-PQG(ver) MOD(1024);
-SIG(ver) MOD(1024);
-SHS: #1903
-DRBG: #258
-FIPS186-4:
-PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
-PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
-SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
-SHS: #1903
-DRBG: #258
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687 |
-
-
-FIPS186-2:
-PQG(ver) MOD(1024);
-SIG(ver) MOD(1024);
-SHS: #1902
-DRBG: #258
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 1773
-DRBG: Val# 193
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645. |
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 1081
-DRBG: Val# 23
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386. |
-Windows Server 2008 R2 and SP1 CNG algorithms #391
-Windows 7 Ultimate and SP1 CNG algorithms #386 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 1081
-RNG: Val# 649
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385. |
-Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390
-Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 753
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283. |
-Windows Server 2008 CNG algorithms #284
-Windows Vista Ultimate SP1 CNG algorithms #283 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 753
-RNG: Val# 435
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281. |
-Windows Server 2008 Enhanced DSS (DSSENH) #282
-Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 618
-RNG: Val# 321
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226. |
-Windows Vista CNG algorithms #227
-Windows Vista Enhanced DSS (DSSENH) #226 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 784
-RNG: Val# 448
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292. |
-Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292 |
-
-
-FIPS186-2:
-SIG(ver) MOD(1024);
-SHS: Val# 783
-RNG: Val# 447
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291. |
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291 |
-
-
-FIPS186-2:
-PQG(gen) MOD(1024);
-PQG(ver) MOD(1024);
-KEYGEN(Y) MOD(1024);
-SIG(gen) MOD(1024);
-SIG(ver) MOD(1024);
-SHS: Val# 611
-RNG: Val# 314 |
-Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221 |
-
-
-FIPS186-2:
-PQG(gen) MOD(1024);
-PQG(ver) MOD(1024);
-KEYGEN(Y) MOD(1024);
-SIG(gen) MOD(1024);
-SIG(ver) MOD(1024);
-SHS: Val# 385 |
-Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146 |
-
-
-FIPS186-2:
-PQG(ver) MOD(1024);
-KEYGEN(Y) MOD(1024);
-SIG(gen) MOD(1024);
-SIG(ver) MOD(1024);
-SHS: Val# 181
-
- |
-Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95 |
-
-
-FIPS186-2:
-PQG(gen) MOD(1024);
-PQG(ver) MOD(1024);
-KEYGEN(Y) MOD(1024);
-SIG(gen) MOD(1024);
-SHS: SHA-1 (BYTE)
-SIG(ver) MOD(1024);
-SHS: SHA-1 (BYTE) |
-Windows 2000 DSSENH.DLL #29
-Windows 2000 DSSBASE.DLL #28
-Windows NT 4 SP6 DSSENH.DLL #26
-Windows NT 4 SP6 DSSBASE.DLL #25 |
-
-
-FIPS186-2: PRIME;
-FIPS186-2:
-KEYGEN(Y):
-SHS: SHA-1 (BYTE)
-SIG(gen):
-SIG(ver) MOD(1024);
-SHS: SHA-1 (BYTE) |
-Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17 |
-
-
-
-
-
-#### Elliptic Curve Digital Signature Algorithm (ECDSA)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #2373, DRBG #489 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263
-Version 6.3.9600 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384
-- Generation Methods: Testing Candidates
-
-Prerequisite: SHS #4011, DRBG #1734 |
-Microsoft Surface Hub Virtual TPM Implementations #1253
-Version 10.0.15063.674 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384
-- Generation Methods: Testing Candidates
-
-Prerequisite: SHS #4009, DRBG #1733 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252
-Version 10.0.16299 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub MsBignum Cryptographic Implementations #1251
-Version 10.0.15063.674 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250
-Version 10.0.15063.674 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249
-Version 10.0.15254 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248
-Version 10.0.15254 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247
-Version 10.0.16299 |
-
-
-
-- ECDSA:
-
-- 186-4:
-
-- Key Pair Generation:
-
-- Curves: P-256, P-384, P-521
-- Generation Methods: Extra Random Bits
- - Public Key Validation:
-
-- Curves: P-256, P-384, P-521
- - Signature Generation:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
- - Signature Verification:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246
-Version 10.0.16299 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 TestingCandidates )
-SHS: Val#3790
-DRBG: Val# 1555 |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136
-Version 10.0.15063 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-PKV: CURVES( P-256 P-384 P-521 )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val#3790
-DRBG: Val# 1555 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135
-Version 10.0.15063 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-PKV: CURVES( P-256 P-384 P-521 )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val#3790
-DRBG: Val# 1555 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133
-Version 10.0.15063 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-PKV: CURVES( P-256 P-384 P-521 )
-SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
-SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
-SHS:Val# 3649
-DRBG:Val# 1430 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073
-Version 7.00.2872 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-PKV: CURVES( P-256 P-384 P-521 )
-SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
-SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
-SHS:Val#3648
-DRBG:Val# 1429 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072
-Version 8.00.6246 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 TestingCandidates )
-PKV: CURVES( P-256 P-384 )
-SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
-SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )
-SHS: Val# 3347
-DRBG: Val# 1222 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920
-Version 10.0.14393 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-PKV: CURVES( P-256 P-384 P-521 )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val# 3347
-DRBG: Val# 1217 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911
-Version 10.0.14393 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val# 3047
-DRBG: Val# 955 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760
-Version 10.0.10586 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val# 2886
-DRBG: Val# 868 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706
-Version 10.0.10240 |
-
-
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val#2373
-DRBG: Val# 489 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505
-Version 6.3.9600 |
-
-
-FIPS186-2:
-PKG: CURVES( P-256 P-384 P-521 )
-SHS: #1903
-DRBG: #258
-SIG(ver):CURVES( P-256 P-384 P-521 )
-SHS: #1903
-DRBG: #258
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: #1903
-DRBG: #258
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341 |
-
-
-FIPS186-2:
-PKG: CURVES( P-256 P-384 P-521 )
-SHS: Val#1773
-DRBG: Val# 193
-SIG(ver): CURVES( P-256 P-384 P-521 )
-SHS: Val#1773
-DRBG: Val# 193
-FIPS186-4:
-PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
-SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
-SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
-SHS: Val#1773
-DRBG: Val# 193
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295. |
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295 |
-
-
-FIPS186-2:
-PKG: CURVES( P-256 P-384 P-521 )
-SHS: Val#1081
-DRBG: Val# 23
-SIG(ver): CURVES( P-256 P-384 P-521 )
-SHS: Val#1081
-DRBG: Val# 23
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141. |
-Windows Server 2008 R2 and SP1 CNG algorithms #142
-Windows 7 Ultimate and SP1 CNG algorithms #141 |
-
-
-FIPS186-2:
-PKG: CURVES( P-256 P-384 P-521 )
-SHS: Val#753
-SIG(ver): CURVES( P-256 P-384 P-521 )
-SHS: Val#753
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82. |
-Windows Server 2008 CNG algorithms #83
-Windows Vista Ultimate SP1 CNG algorithms #82 |
-
-
-FIPS186-2:
-PKG: CURVES( P-256 P-384 P-521 )
-SHS: Val#618
-RNG: Val# 321
-SIG(ver): CURVES( P-256 P-384 P-521 )
-SHS: Val#618
-RNG: Val# 321
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60. |
-Windows Vista CNG algorithms #60 |
-
-
-
-
-
-#### Keyed-Hash Message Authentication Code (HMAC)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- HMAC-SHA-1:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-256:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-384:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
-
-Prerequisite: SHS #4011 |
-Microsoft Surface Hub Virtual TPM Implementations #3271
-Version 10.0.15063.674 |
-
-
-
-- HMAC-SHA-1:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-256:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-384:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
-
-Prerequisite: SHS #4009 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270
-Version 10.0.16299 |
-
-
-
-- HMAC-SHA-1:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-256:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-384:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-512:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
-
-Prerequisite: SHS #4011 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269
-Version 10.0.15063.674 |
-
-
-
-- HMAC-SHA-1:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-256:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-384:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-512:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
-
-Prerequisite: SHS #4010 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268
-Version 10.0.15254 |
-
-
-
-- HMAC-SHA-1:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-256:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-384:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
- - HMAC-SHA2-512:
-
-- Key Sizes < Block Size
-- Key Sizes > Block Size
-- Key Sizes = Block Size
-
-Prerequisite: SHS #4009 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267
-Version 10.0.16299 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790 |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062
-Version 10.0.15063 |
-
-
-HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061
-Version 10.0.15063 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652 |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946
-Version 7.00.2872 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651 |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945
-Version 8.00.6246 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943
-Version 7.00.2872 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942
-Version 8.00.6246 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
-SHS Val# 3347
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
-SHS Val# 3347
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
-SHS Val# 3347 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661
-Version 10.0.14393 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651
-Version 10.0.14393 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
-SHS Val# 3047
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
-SHS Val# 3047
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
-SHS Val# 3047
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
-SHS Val# 3047 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381
-Version 10.0.10586 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
-SHSVal# 2886
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
-SHSVal# 2886
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
- SHSVal# 2886
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
-SHSVal# 2886 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233
-Version 10.0.10240 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
-SHS Val#2373
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
-SHS Val#2373
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
-SHS Val#2373
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
-SHS Val#2373 |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773
-Version 6.3.9600 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764 |
-Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122
-Version 5.2.29344 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902
-HMAC-SHA256 ( Key Size Ranges Tested: KS#1902 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
-SHS#1903
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
-SHS#1903
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
-SHS#1903
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
-SHS#1903 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773
-Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773 |
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774 |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081 |
-Windows Server 2008 R2 and SP1 CNG algorithms #686
-Windows 7 and SP1 CNG algorithms #677
-Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687
-Windows 7 Enhanced Cryptographic Provider (RSAENH) #673 |
-
-
-HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081
-HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081 |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816 |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753
-HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753 |
-Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753 |
-Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408
-Windows Vista Enhanced Cryptographic Provider (RSAENH) #407 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618 |
-Windows Vista Enhanced Cryptographic Provider (RSAENH) #297 |
-
-
-| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785 |
-Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429
-Windows XP, vendor-affirmed |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783 |
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613 |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289 |
-
-
-| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610 |
-Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753 |
-Windows Server 2008 CNG algorithms #413
-Windows Vista Ultimate SP1 CNG algorithms #412 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737
-HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737 |
-Windows Vista Ultimate BitLocker Drive Encryption #386 |
-
-
-HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618 |
-Windows Vista CNG algorithms #298 |
-
-
-HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589 |
-Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267 |
-
-
-HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578 |
-Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260 |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495
-HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495 |
-Windows Vista BitLocker Drive Encryption #199 |
-
-
-| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364 |
-Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99
-Windows XP, vendor-affirmed |
-
-
-HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305
-HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305
-HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305
-HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305 |
-Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31 |
-
-
-
-
-
-#### Key Agreement Scheme (KAS)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- KAS ECC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
-- Schemes:
-
-- Full Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- KDFs: Concatenation
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
-
-Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734 |
-Microsoft Surface Hub Virtual TPM Implementations #150
-Version 10.0.15063.674 |
-
-
-
-- KAS ECC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
-- Schemes:
-
-- Full Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- KDFs: Concatenation
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
-
-Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149
-Version 10.0.16299 |
-
-
-
-- KAS ECC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
-- Schemes:
-
-- Ephemeral Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- KDFs: Concatenation
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - One Pass DH:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - Static Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
-
-Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732
-
-- KAS FFC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
-- Schemes:
-
-- dhEphem:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhOneFlow:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhStatic:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
-
-Prerequisite: SHS #4011, DSA #1303, DRBG #1732 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #148
-Version 10.0.15063.674 |
-
-
-
-- KAS ECC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
-- Schemes:
-
-- Ephemeral Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- KDFs: Concatenation
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - One Pass DH:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - Static Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
-
-Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731
-
-- KAS FFC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
-- Schemes:
-
-- dhEphem:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhOneFlow:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhStatic:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
-
-Prerequisite: SHS #4010, DSA #1302, DRBG #1731 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147
-Version 10.0.15254 |
-
-
-
-- KAS ECC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
-- Schemes:
-
-- Ephemeral Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- KDFs: Concatenation
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - One Pass DH:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
- - Static Unified:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- EC:
-
-- Curve: P-256
-- SHA: SHA-256
-- MAC: HMAC
- - ED:
-
-- Curve: P-384
-- SHA: SHA-384
-- MAC: HMAC
- - EE:
-
-- Curve: P-521
-- SHA: SHA-512
-- MAC: HMAC
-
-Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730
-
-- KAS FFC:
-
-- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
-- Schemes:
-
-- dhEphem:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhOneFlow:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
- - dhStatic:
-
-- Key Agreement Roles: Initiator, Responder
-- Parameter Sets:
-
-- FB:
-
-- SHA: SHA-256
-- MAC: HMAC
- - FC:
-
-- SHA: SHA-256
-- MAC: HMAC
-
-Prerequisite: SHS #4009, DSA #1301, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146
-Version 10.0.16299 |
-
-
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Full Validation Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ]
-SHS Val#3790
-DSA Val#1135
-DRBG Val#1556 |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128
-Version 10.0.15063 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val#3790
-DSA Val#1223
-DRBG Val#1555
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-
-SHS Val#3790
-ECDSA Val#1133
-DRBG Val#1555 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127
-Version 10.0.15063 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val# 3649
-DSA Val#1188
-DRBG Val#1430
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ] |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115
-Version 7.00.2872 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhHybridOneFlow ( No_KC < KARole(s): Initiator / Responder> ) ( FB:SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-[ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB:SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val#3648
-DSA Val#1187
-DRBG Val#1429
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-
-SHS Val#3648
-ECDSA Val#1072
-DRBG Val#1429 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114
-Version 8.00.6246 |
-
-
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Full Validation Key Regeneration )
-SCHEMES [ FullUnified ( No_KC < KARole(s): Initiator / Responder > < KDF: CONCAT > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ]
-SHS Val# 3347 ECDSA Val#920 DRBG Val#1222 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93
-Version 10.0.14393 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation )
-SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic (No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val# 3347 DSA Val#1098 DRBG Val#1217
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92
-Version 10.0.14393 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val# 3047 DSA Val#1024 DRBG Val#955
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-SHS Val# 3047 ECDSA Val#760 DRBG Val#955 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72
-Version 10.0.10586 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val# 2886 DSA Val#983 DRBG Val#868
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-SHS Val# 2886 ECDSA Val#706 DRBG Val#868 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64
-Version 10.0.10240 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS Val#2373 DSA Val#855 DRBG Val#489
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-SHS Val#2373 ECDSA Val#505 DRBG Val#489 |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47
-Version 6.3.9600 |
-
-
-FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
-( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
-[ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
-SHS #1903 DSA Val#687 DRBG #258
-ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
-[ OnePassDH( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
-[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
-
-SHS #1903 ECDSA Val#341 DRBG #258 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36 |
-
-
-KAS (SP 800–56A)
-key agreement
-key establishment methodology provides 80 to 256 bits of encryption strength |
-Windows 7 and SP1, vendor-affirmed
-Windows Server 2008 R2 and SP1, vendor-affirmed |
-
-
-
-
-
-SP 800-108 Key-Based Key Derivation Functions (KBKDF)
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- Counter:
-
-- MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
-
-MAC prerequisite: HMAC #3271
-
-
-- Counter Location: Before Fixed Data
-- R Length: 32 (bits)
-- SPs used to generate K: SP 800-56A, SP 800-90A
-
- K prerequisite: DRBG #1734, KAS #150 |
-Microsoft Surface Hub Virtual TPM Implementations #161
-Version 10.0.15063.674 |
-
-
-
-- Counter:
-
-- MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
-
-MAC prerequisite: HMAC #3270
-
-
-- Counter Location: Before Fixed Data
-- R Length: 32 (bits)
-- SPs used to generate K: SP 800-56A, SP 800-90A
-
- K prerequisite: DRBG #1733, KAS #149 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160
-Version 10.0.16299 |
-
-
-
-- Counter:
-
-- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
-
-MAC prerequisite: AES #4902, HMAC #3269
-
-
-- Counter Location: Before Fixed Data
-- R Length: 32 (bits)
-- SPs used to generate K: SP 800-56A, SP 800-90A
-- K prerequisite: KAS #148
-
- |
-Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159
-Version 10.0.15063.674 |
-
-
-
-- Counter:
-
-- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
-
-MAC prerequisite: AES #4901, HMAC #3268
-
-
-- Counter Location: Before Fixed Data
-- R Length: 32 (bits)
-- SPs used to generate K: SP 800-56A, SP 800-90A
-
- K prerequisite: KAS #147 |
-Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158
-Version 10.0.15254 |
-
-
-
-- Counter:
-
-- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
-
-MAC prerequisite: AES #4897, HMAC #3267
-
-
-- Counter Location: Before Fixed Data
-- R Length: 32 (bits)
-- SPs used to generate K: SP 800-56A, SP 800-90A
-
- K prerequisite: KAS #146 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157
-Version 10.0.16299 |
-
-
-CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-
-KAS Val#128
-DRBG Val#1556
-MAC Val#3062 |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141
-Version 10.0.15063 |
-
-
-CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-
-KAS Val#127
-AES Val#4624
-DRBG Val#1555
-MAC Val#3061 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140
-Version 10.0.15063 |
-
-
-CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-KAS Val#93 DRBG Val#1222 MAC Val#2661 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102
-Version 10.0.14393 |
-
-
-CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101
-Version 10.0.14393 |
-
-
-CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72
-Version 10.0.10586 |
-
-
-CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66
-Version 10.0.10240 |
-
-
-CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-DRBG Val#489 MAC Val#1773 |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30
-Version 6.3.9600 |
-
-
-CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
-DRBG #258 HMAC Val#1345 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3 |
-
-
-
-
-
-Random Number Generator (RNG)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-FIPS 186-2 General Purpose
-[ (x-Original); (SHA-1) ] |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110 |
-
-
-FIPS 186-2
-[ (x-Original); (SHA-1) ] |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060
-Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292
-Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286
-Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66 |
-
-
-FIPS 186-2
-[ (x-Change Notice); (SHA-1) ]
-FIPS 186-2 General Purpose
-[ (x-Change Notice); (SHA-1) ] |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649
-Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435
-Windows Vista RNG implementation #321 |
-
-
-FIPS 186-2 General Purpose
-[ (x-Change Notice); (SHA-1) ] |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470
-Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316
-Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313 |
-
-
-FIPS 186-2
-[ (x-Change Notice); (SHA-1) ] |
-Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448
-Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314 |
-
-
-
-
-
-#### RSA
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-RSA:
-
-- 186-4:
-
-- Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
- - Signature Verification PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-
-Prerequisite: SHS #4011, DRBG #1734 |
-Microsoft Surface Hub Virtual TPM Implementations #2677
-Version 10.0.15063.674 |
-
-
-RSA:
-
-- 186-4:
-
-- Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 240 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-
-Prerequisite: SHS #4009, DRBG #1733 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676
-Version 10.0.16299 |
-
-
-RSA:
-
-- 186-4:
-
-- Key Generation:
-- Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub RSA32 Algorithm Implementations #2675
-Version 10.0.15063.674 |
-
-
-RSA:
-
-- 186-4:
-
-- Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674
-Version 10.0.16299 |
-
-
-RSA:
-
-- 186-4:
-
-- Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673
-Version 10.0.15254 |
-
-
-RSA:
-
-- 186-4:
-
-- Key Generation:
-
-- Public Key Exponent: Fixed (10001)
-- Provable Primes with Conditions:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.3
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub MsBignum Cryptographic Implementations #2672
-Version 10.0.15063.674 |
-
-
-RSA:
-
-- 186-4:
-
-- Key Generation:
-
-- Probable Random Primes:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.2
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4011, DRBG #1732 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671
-Version 10.0.15063.674 |
-
-
-RSA:
-
-- 186-4:
-
-- Key Generation:
-
-- Probable Random Primes:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.2
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670
-Version 10.0.15254 |
-
-
-RSA:
-
-- 186-4:
-
-- Key Generation:
-
-- Public Key Exponent: Fixed (10001)
-- Provable Primes with Conditions:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.3
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4010, DRBG #1731 |
-Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669
-Version 10.0.15254 |
-
-
-
-- 186-4:
-
-- Key Generation:
-
-- Public Key Exponent: Fixed (10001)
-- Provable Primes with Conditions:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.3
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668
-Version 10.0.16299 |
-
-
-
-- 186-4:
-
-- Key Generation:
-
-- Probable Random Primes:
-
-- Mod lengths: 2048, 3072 (bits)
-- Primality Tests: C.2
- - Signature Generation PKCS1.5:
-
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Generation PSS:
-
-- Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Signature Verification PKCS1.5:
-
-- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
-- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
- - Signature Verification PSS:
-
-- Mod 1024:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 496 (bits)
- - Mod 2048:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
- - Mod 3072:
-
-- SHA-1: Salt Length: 160 (bits)
-- SHA-256: Salt Length: 256 (bits)
-- SHA-384: Salt Length: 384 (bits)
-- SHA-512: Salt Length: 512 (bits)
-
-Prerequisite: SHS #4009, DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667
-Version 10.0.16299 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
-SHA Val#3790 |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524
-Version 10.0.15063 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3790 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523
-Version 10.0.15063 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val#3790
-DRBG: Val# 1555 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522
-Version 10.0.15063 |
-
-
-FIPS186-4:
-186-4KEY(gen):
-PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val#3790 |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521
-Version 10.0.15063 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
-FIPS186-4:
-ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
-SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3652 |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415
-Version 7.00.2872 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
-FIPS186-4:
-ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
-SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3651 |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414
-Version 8.00.6246 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
-PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val# 3649
-DRBG: Val# 1430 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412
-Version 7.00.2872 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
-PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
- SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3648
-DRBG: Val# 1429 |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411
-Version 8.00.6246 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
-SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
-Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
-SHA Val# 3347 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206
-Version 10.0.14393 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-SHA Val# 3347 DRBG: Val# 1217 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195
-Version 10.0.14393 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3346 |
-soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194
-Version 10.0.14393 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
-SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val# 3347 DRBG: Val# 1217 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193
-Version 10.0.14393 |
-
-
-FIPS186-4:
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val# 3347 DRBG: Val# 1217 |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192
-Version 10.0.14393 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-SHA Val# 3047 DRBG: Val# 955 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889
-Version 10.0.10586 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#3048 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871
-Version 10.0.10586 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
-SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val# 3047 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888
-Version 10.0.10586 |
-
-
-FIPS186-4:
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val# 3047 |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887
-Version 10.0.10586 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-SHA Val# 2886 DRBG: Val# 868 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798
-Version 10.0.10240 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#2871 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784
-Version 10.0.10240 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#2871 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783
-Version 10.0.10240 |
-
-
-FIPS186-4:
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val# 2886 |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802
-Version 10.0.10240 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e ;
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-SHA Val#2373 DRBG: Val# 489 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487
-Version 6.3.9600 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#2373 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494
-Version 6.3.9600 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
-SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
-SHA Val#2373 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493
-Version 6.3.9600 |
-
-
-FIPS186-4:
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
- Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
-SHA Val#2373 |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519
-Version 6.3.9600 |
-
-
-FIPS186-4:
-ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
-SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
-[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
-Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
-SHA #1903
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134 |
-
-
-FIPS186-4:
-186-4KEY(gen): FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
-PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
-SHA #1903 DRBG: #258 |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052. |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051. |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568. |
-Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560. |
-Windows Server 2008 R2 and SP1 CNG algorithms #567
-Windows 7 and SP1 CNG algorithms #560 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559. |
-Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557. |
-Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395. |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371. |
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
-ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357. |
-Windows Server 2008 CNG algorithms #358
-Windows Vista SP1 CNG algorithms #357 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354. |
-Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355
-Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353. |
-Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258. |
-Windows Vista RSA key generation implementation #258 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
-ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257. |
-Windows Vista CNG algorithms #257 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255. |
-Windows Vista Enhanced Cryptographic Provider (RSAENH) #255 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245. |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230. |
-Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222. |
-Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222 |
-
-
-FIPS186-2:
-ALG[RSASSA-PKCS1_V1_5]:
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81. |
-Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81 |
-
-
-FIPS186-2:
-ALG[ANSIX9.31]:
-SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
-ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
-SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
-Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52. |
-Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52 |
-
-
-FIPS186-2:
-– PKCS#1 v1.5, signature generation and verification
-– Mod sizes: 1024, 1536, 2048, 3072, 4096
-– SHS: SHA–1/256/384/512 |
-Windows XP, vendor-affirmed
-Windows 2000, vendor-affirmed |
-
-
-
-
-
-#### Secure Hash Standard (SHS)
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- SHA-1:
-
-- Supports Empty Message
- - SHA-256:
-
-- Supports Empty Message
- - SHA-384:
-
-- Supports Empty Message
- - SHA-512:
-
-- Supports Empty Message
- |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011
-Version 10.0.15063.674 |
-
-
-
-- SHA-1:
-
-- Supports Empty Message
- - SHA-256:
-
-- Supports Empty Message
- - SHA-384:
-
-- Supports Empty Message
- - SHA-512:
-
-- Supports Empty Message
- |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010
-Version 10.0.15254 |
-
-
-
-- SHA-1:
-
-- Supports Empty Message
- - SHA-256:
-
-- Supports Empty Message
- - SHA-384:
-
-- Supports Empty Message
- - SHA-512:
-
-- Supports Empty Message
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009
-Version 10.0.16299 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790
-Version 10.0.15063 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652
-Version 7.00.2872 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651
-Version 8.00.6246 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649
-Version 7.00.2872 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648
-Version 8.00.6246 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
-Version 10.0.14393 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
-Version 10.0.14393 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
-Version 10.0.10586 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
-Version 10.0.10586 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
-Version 10.0.10240 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
-Version 10.0.10240 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
-Version 6.3.9600 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
-Version 6.3.9600 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only)
-Implementation does not support zero-length (null) messages. |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816 |
-
-
-| SHA-1 (BYTE-only) |
-Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785
-Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753
-Windows Vista Symmetric Algorithm Implementation #618 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only) |
-Windows Vista BitLocker Drive Encryption #737
-Windows Vista Beta 2 BitLocker Drive Encryption #495 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613
-Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364 |
-
-
-| SHA-1 (BYTE-only) |
-Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611
-Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610
-Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385
-Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371
-Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181
-Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177
-Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176 |
-
-
-SHA-1 (BYTE-only)
-SHA-256 (BYTE-only)
-SHA-384 (BYTE-only)
-SHA-512 (BYTE-only) |
-Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589
-Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578
-Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305 |
-
-
-| SHA-1 (BYTE-only) |
-Windows XP Microsoft Enhanced Cryptographic Provider #83
-Crypto Driver for Windows 2000 (fips.sys) #35
-Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32
-Windows 2000 RSAENH.DLL #24
-Windows 2000 RSABASE.DLL #23
-Windows NT 4 SP6 RSAENH.DLL #21
-Windows NT 4 SP6 RSABASE.DLL #20 |
-
-
-
-
-
-#### Triple DES
-
-
-
-
-
-
-
-
-| Modes / States / Key Sizes |
-Algorithm Implementation and Certificate # |
-
-
-
-- TDES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB64:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558
-Version 10.0.15063.674 |
-
-
-
-- TDES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB64:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557
-Version 10.0.15254 |
-
-
-
-- TDES-CBC:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB64:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-CFB8:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- - TDES-ECB:
-
-- Modes: Decrypt, Encrypt
-- Keying Option: 1
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556
-Version 10.0.16299 |
-
-
-| TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, ) |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459
-Version 10.0.15063 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384
-Version 8.00.6246 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) |
-Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383
-Version 8.00.6246 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) ;
-CTR ( int only ) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382
-Version 7.00.2872 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) |
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381
-Version 8.00.6246 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) ;
-TCFB8( KO 1 e/d, ) ;
-TCFB64( KO 1 e/d, ) |
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
-
-
-Version 10.0.14393 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) ;
-TCFB8( KO 1 e/d, ) ;
-TCFB64( KO 1 e/d, ) |
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
-
-
-Version 10.0.10586 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) ;
-TCFB8( KO 1 e/d, ) ;
-TCFB64( KO 1 e/d, ) |
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
-
-
-Version 10.0.10240 |
-
-
-TECB( KO 1 e/d, ) ;
-TCBC( KO 1 e/d, ) ;
-TCFB8( KO 1 e/d, ) ;
-TCFB64( KO 1 e/d, ) |
-Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692
-Version 6.3.9600 |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) ;
-TCFB8( e/d; KO 1,2 ) ;
-TCFB64( e/d; KO 1,2 ) |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387 |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) ;
-TCFB8( e/d; KO 1,2 ) |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386 |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) ;
-TCFB8( e/d; KO 1,2 ) |
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846 |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) ;
-TCFB8( e/d; KO 1,2 ) |
-Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656 |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) ;
-TCFB8( e/d; KO 1,2 ) |
-Windows Vista Symmetric Algorithm Implementation #549 |
-
-
-| Triple DES MAC |
-Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed
-Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed |
-
-
-TECB( e/d; KO 1,2 ) ;
-TCBC( e/d; KO 1,2 ) |
-Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308
-Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691
-Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677
-Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676
-Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675
-Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544
-Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543
-Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542
-Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526
-Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517
-Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381
-Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370
-Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365
-Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315
-Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201
-Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199
-Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192
-Windows XP Microsoft Enhanced Cryptographic Provider #81
-Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18
-Crypto Driver for Windows 2000 (fips.sys) #16 |
-
-
-
-
-
-#### SP 800-132 Password Based Key Derivation Function (PBKDF)
-
-
-
- |
- Modes / States / Key Sizes
- |
-
- Algorithm Implementation and Certificate #
- |
-
-
- |
- PBKDF (vendor affirmed) |
-
- Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
(Software Version: 10.0.14393)
- Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)
- Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
(Software Version: 10.0.14393)
- Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
(Software Version: 10.0.14393)
- |
-
-
- |
- PBKDF (vendor affirmed) |
-
- Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)
- Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed
- |
-
-
-
-
-#### Component Validation List
-
-
-
-
-
-
-
-
-| Publication / Component Validated / Description |
-Implementation and Certificate # |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #489 |
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540
-Version 6.3.9600 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Microsoft Surface Hub Virtual TPM Implementations #1519
-Version 10.0.15063.674 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518
-Version 10.0.16299 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Microsoft Surface Hub MsBignum Cryptographic Implementations #1517
-Version 10.0.15063.674 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Microsoft Surface Hub MsBignum Cryptographic Implementations #1516
-Version 10.0.15063.674 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
- Prerequisite: DRBG #1732 |
-Microsoft Surface Hub MsBignum Cryptographic Implementations #1515
-Version 10.0.15063.674 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #1732 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514
-Version 10.0.15063.674 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513
-Version 10.0.15063.674 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512
-Version 10.0.15063.674 |
-
-
-
-- IKEv1:
-
-- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
-- Pre-shared Key Length: 64-2048
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4011, HMAC #3269
-
-- IKEv2:
-
-- Derived Keying Material length: 192-1792
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4011, HMAC #3269
-
-- TLS:
-
-- Supports TLS 1.0/1.1
-- Supports TLS 1.2:
-
-- SHA Functions: SHA-256, SHA-384
-
-Prerequisite: SHS #4011, HMAC #3269 |
-Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511
-Version 10.0.15063.674 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #1731 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510
-Version 10.0.15254 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509
-Version 10.0.15254 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508
-Version 10.0.15254 |
-
-
-
-- IKEv1:
-
-- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
-- Pre-shared Key Length: 64-2048
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4010, HMAC #3268
-
-- IKEv2:
-
-- Derived Keying Material length: 192-1792
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4010, HMAC #3268
-
-- TLS:
-
-- Supports TLS 1.0/1.1
-- Supports TLS 1.2:
-
-- SHA Functions: SHA-256, SHA-384
-
-Prerequisite: SHS #4010, HMAC #3268 |
-Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507
-Version 10.0.15254 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #1731 |
-Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506
-Version 10.0.15254 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505
-Version 10.0.15254 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504
-Version 10.0.15254 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503
-Version 10.0.16299 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502
-Version 10.0.16299 |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501
-Version 10.0.16299 |
-
-
-
-- ECDSA SigGen:
-
-- P-256 SHA: SHA-256
-- P-384 SHA: SHA-384
-- P-521 SHA: SHA-512
-
-Prerequisite: DRBG #1730 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499
-Version 10.0.16299 |
-
-
-
-- RSADP:
-
-- Modulus Size: 2048 (bits)
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498
-Version 10.0.16299
- |
-
-
-
-- RSASP1:
-
-- Modulus Size: 2048 (bits)
-- Padding Algorithms: PKCS 1.5
- |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1497
-Version 10.0.16299 |
-
-
-
-- IKEv1:
-
-- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
-- Pre-shared Key Length: 64-2048
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4009, HMAC #3267
-
-- IKEv2:
-
-- Derived Keying Material length: 192-1792
-- Diffie-Hellman shared secrets:
-
-- Diffie-Hellman shared secret:
-
-- Length: 2048 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 256 (bits)
-- SHA Functions: SHA-256
- - Diffie-Hellman shared secret:
-
-- Length: 384 (bits)
-- SHA Functions: SHA-384
-
-Prerequisite: SHS #4009, HMAC #3267
-
-- TLS:
-
-- Supports TLS 1.0/1.1
-- Supports TLS 1.2:
-
-- SHA Functions: SHA-256, SHA-384
-
-Prerequisite: SHS #4009, HMAC #3267 |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1496
-Version 10.0.16299 |
-
-
-FIPS186-4 ECDSA
-Signature Generation of hash sized messages
-ECDSA SigGen Component: CURVES( P-256 P-384 P-521 ) |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
-Version 10.0. 15063
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
-Version 10.0. 15063
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
-Version 10.0.14393
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
-Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
-Version 10.0.10586
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
-Version 6.3.9600 |
-
-
-FIPS186-4 RSA; PKCS#1 v2.1
-RSASP1 Signature Primitive
-RSASP1: (Mod2048: PKCS1.5 PKCSPSS) |
-Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
-Version 10.0.15063
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
-Version 10.0.15063
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
-Version 10.0.15063
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
-Version 10.0.14393
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
-Version 10.0.14393
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
-Version 10.0.10586
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
-Version 10.0.10240
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
-Version 6.3.9600 |
-
-
-FIPS186-4 RSA; RSADP
-RSADP Primitive
-RSADP: (Mod2048) |
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
-Version 10.0.15063
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
-Version 10.0.15063
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
-Version 10.0.14393
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
-Version 10.0.14393
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
-Version 10.0.10586
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
-Version 10.0.10240 |
-
-
-SP800-135
-Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS |
-Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1496
-Version 10.0.16299
-Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
-Version 10.0.15063
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
-Version 7.00.2872
-Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
-Version 8.00.6246
-Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
-Version 10.0.14393
-Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
-Version 10.0.10586
-Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
-Version 10.0.10240
-Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
-Version 6.3.9600 |
-
-
-
-
-
-## References
-
-\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules
-
-\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ
-
-\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised)
-
-\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
-
-## Additional Microsoft References
-
-Enabling FIPS mode -
-
-Cipher Suites in Schannel - [https://msdn.microsoft.com/library/aa374757(VS.85).aspx](https://msdn.microsoft.com/library/aa374757\(vs.85\).aspx)
-
+---
+title: FIPS 140 Validation
+description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140.
+ms.prod: w10
+audience: ITPro
+author: dulcemontemayor
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-identity-device-management
+ms.topic: article
+ms.localizationpriority: medium
+ms.date: 11/05/2019
+ms.reviewer:
+---
+
+# FIPS 140-2 Validation
+
+## FIPS 140-2 standard overview
+
+The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard that defines minimum security requirements for cryptographic modules in information technology products, as defined in Section 5131 of the Information Technology Management Reform Act of 1996.
+
+The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program), a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS), validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover eleven areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module.
+
+## Microsoft’s approach to FIPS 140-2 validation
+
+Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since the inception of the standard in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules.
+
+## Using Windows in a FIPS 140-2 approved mode of operation
+
+Windows 10 and Windows server may be configured to run in a FIPS 140-2 approved mode of operation. This is commonly referred to as “FIPS mode.” Achieving this mode of operation requires administrators to complete all four steps outlined below.
+
+### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed
+
+Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. This is accomplished by cross-checking the version number of the cryptographic module with the table of validated modules at the end of this topic, organized by operating system release.
+
+### Step 2: Ensure all security policies for all cryptographic modules are followed
+
+Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found by following the links in the table of validated modules at the end of this topic. Click on the module version number to view the published SPD for the module.
+
+### Step 3: Enable the FIPS security policy
+
+Windows provides the security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,” which is used by some Microsoft products to determine whether to operate in a FIPS 140-2 approved mode. When this policy is enabled, the validated cryptographic modules in Windows will also operate in FIPS approved mode. The policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing).
+
+### Step 4: Ensure only FIPS validated cryptographic algorithms are used
+
+Neither the operating system nor the cryptographic modules can enforce a FIPS approved mode of operation, regardless of the FIPS security policy setting. To run in a FIPS approved mode, an application or service must check for the policy flag and enforce the security policies of the validated modules. If an application or service uses a non-approved cryptographic algorithm or does not follow the security policies of the validated modules, it is not operating in a FIPS approved mode.
+
+## Frequently asked questions
+
+### How long does it take to certify cryptographic modules?
+
+Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors.
+
+### When does Microsoft undertake a FIPS 140 validation?
+
+The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules.
+
+### What is the difference between “FIPS 140 validated” and “FIPS 140 compliant”?
+
+“FIPS 140 validated” means that the cryptographic module, or a product that embeds the module, has been validated (“certified”) by the CMVP as meeting as meeting the FIPS 140-2 requirements. “FIPS 140 compliant” is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality.
+
+### I need to know if a Windows service or application is FIPS 140-2 validated.
+
+The cryptographic modules leveraged in Windows are validated through the CMVP, not individual services, applications, hardware peripherals, or other solutions. For a solution to be considered compliant, it must call a FIPS 140-2 validated cryptographic module in the underlying OS and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module.
+
+### What does "When operated in FIPS mode" mean on a certificate?
+
+This caveat identifies required configuration and security rules that must be followed to use the cryptographic module in a way that is consistent with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module.
+
+### What is the relationship between FIPS 140-2 and Common Criteria?
+
+These are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules, while Common Criteria is designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly.
+
+### How does FIPS 140 relate to Suite B?
+
+Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140-2 standard.
+
+## Microsoft FIPS 140-2 validated cryptographic modules
+
+The following tables identify the cryptographic modules used in an operating system, organized by release.
+
+## Modules used by Windows
+
+##### Windows 10 Spring 2018 Update (Version 1803)
+
+Validated Editions: Home, Pro, Enterprise, Education
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library |
+10.0.17134 |
+#3197 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Kernel Mode Cryptographic Primitives Library |
+10.0.17134 |
+#3196 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Code Integrity |
+10.0.17134 |
+#3195 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows OS Loader |
+10.0.17134 |
+#3480 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Secure Kernel Code Integrity |
+10.0.17134 |
+#3096 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| BitLocker Dump Filter |
+10.0.17134 |
+#3092 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Boot Manager |
+10.0.17134 |
+#3089 |
+See Security Policy and Certificate page for algorithm information |
+
+
+
+
+
+##### Windows 10 Fall Creators Update (Version 1709)
+
+Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library |
+10.0.16299 |
+#3197 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Kernel Mode Cryptographic Primitives Library |
+10.0.16299 |
+#3196 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Code Integrity |
+10.0.16299 |
+#3195 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows OS Loader |
+10.0.16299 |
+#3194 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Secure Kernel Code Integrity |
+10.0.16299 |
+#3096 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| BitLocker Dump Filter |
+10.0.16299 |
+#3092 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows Resume |
+10.0.16299 |
+#3091 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Boot Manager |
+10.0.16299 |
+#3089 |
+See Security Policy and Certificate page for algorithm information |
+
+
+
+
+
+##### Windows 10 Creators Update (Version 1703)
+
+Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile
+
+
+
+
+\[1\] Applies only to Home, Pro, Enterprise, Education and S
+
+\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub
+
+\[3\] Applies only to Pro, Enterprise Education and S
+
+##### Windows 10 Anniversary Update (Version 1607)
+
+Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+10.0.14393 |
+#2937 |
+FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+10.0.14393 |
+#2936 |
+FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887) |
+
+
+| Boot Manager |
+10.0.14393 |
+#2931 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)
+Other algorithms: MD5; PBKDF (non-compliant); VMK KDF |
+
+
+| BitLocker® Windows OS Loader (winload) |
+10.0.14393 |
+#2932 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: NDRNG; MD5 |
+
+
+| BitLocker® Windows Resume (winresume)[1] |
+10.0.14393 |
+#2933 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys)[2] |
+10.0.14393 |
+#2934 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064) |
+
+
+| Code Integrity (ci.dll) |
+10.0.14393 |
+#2935 |
+FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: AES (non-compliant); MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888) |
+
+
+| Secure Kernel Code Integrity (skci.dll)[3] |
+10.0.14393 |
+#2938 |
+FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
+
+Other algorithms: MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888) |
+
+
+
+
+
+\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
+
+\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile
+
+\[3\] Applies only to Pro, Enterprise and Enterprise LTSB
+
+##### Windows 10 November 2015 Update (Version 1511)
+
+Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+10.0.10586 |
+#2606 |
+FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+10.0.10586 |
+#2605 |
+FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663) |
+
+
+| Boot Manager[4] |
+10.0.10586 |
+#2700 |
+FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
+
+
+| BitLocker® Windows OS Loader (winload)[5] |
+10.0.10586 |
+#2701 |
+FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
+
+Other algorithms: MD5; NDRNG |
+
+
+| BitLocker® Windows Resume (winresume)[6] |
+10.0.10586 |
+#2702 |
+FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys)[7] |
+10.0.10586 |
+#2703 |
+FIPS Approved algorithms: AES (Certs. #3653) |
+
+
+| Code Integrity (ci.dll) |
+10.0.10586 |
+#2604 |
+FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
+
+Other algorithms: AES (non-compliant); MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665) |
+
+
+| Secure Kernel Code Integrity (skci.dll)[8] |
+10.0.10586 |
+#2607 |
+FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
+
+Other algorithms: MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665) |
+
+
+
+
+
+\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub
+
+\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub
+
+\[6\] Applies only to Home, Pro and Enterprise
+
+\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub
+
+\[8\] Applies only to Enterprise and Enterprise LTSB
+
+##### Windows 10 (Version 1507)
+
+Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+10.0.10240 |
+#2606 |
+FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+10.0.10240 |
+#2605 |
+FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576) |
+
+
+| Boot Manager[9] |
+10.0.10240 |
+#2600 |
+FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
+
+
+| BitLocker® Windows OS Loader (winload)[10] |
+10.0.10240 |
+#2601 |
+FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
+
+Other algorithms: MD5; NDRNG |
+
+
+| BitLocker® Windows Resume (winresume)[11] |
+10.0.10240 |
+#2602 |
+FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys)[12] |
+10.0.10240 |
+#2603 |
+FIPS Approved algorithms: AES (Certs. #3497 and #3498) |
+
+
+| Code Integrity (ci.dll) |
+10.0.10240 |
+#2604 |
+FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
+
+Other algorithms: AES (non-compliant); MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572) |
+
+
+| Secure Kernel Code Integrity (skci.dll)[13] |
+10.0.10240 |
+#2607 |
+FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
+
+Other algorithms: MD5
+Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572) |
+
+
+
+
+
+\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
+
+\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
+
+\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB
+
+\[12\] Applies only to Pro, Enterprise and Enterprise LTSB
+
+\[13\] Applies only to Enterprise and Enterprise LTSB
+
+##### Windows 8.1
+
+Validated Editions: RT, Pro, Enterprise, Phone, Embedded
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+6.3.9600 6.3.9600.17031 |
+#2357 |
+FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.3.9600 6.3.9600.17042 |
+#2356 |
+FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
+Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289) |
+
+
+| Boot Manager |
+6.3.9600 6.3.9600.17031 |
+#2351 |
+FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
+
+
+| BitLocker® Windows OS Loader (winload) |
+6.3.9600 6.3.9600.17031 |
+#2352 |
+FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
+
+Other algorithms: MD5; NDRNG |
+
+
+| BitLocker® Windows Resume (winresume)[14] |
+6.3.9600 6.3.9600.17031 |
+#2353 |
+FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys) |
+6.3.9600 6.3.9600.17031 |
+#2354 |
+FIPS Approved algorithms: AES (Cert. #2832)
+
+Other algorithms: N/A |
+
+
+| Code Integrity (ci.dll) |
+6.3.9600 6.3.9600.17031 |
+#2355#2355 |
+FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
+
+Other algorithms: MD5
+Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289) |
+
+
+
+
+
+\[14\] Applies only to Pro, Enterprise, and Embedded 8.
+
+##### Windows 8
+
+Validated Editions: RT, Home, Pro, Enterprise, Phone
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
+6.2.9200 |
+#1892 |
+FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+
+ |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.2.9200 |
+#1891 |
+FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Boot Manager |
+6.2.9200 |
+#1895 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Windows OS Loader (WINLOAD) |
+6.2.9200 |
+#1896 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG |
+
+
+| BitLocker® Windows Resume (WINRESUME)[15] |
+6.2.9200 |
+#1898 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (DUMPFVE.SYS) |
+6.2.9200 |
+#1899 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198)
+
+Other algorithms: N/A |
+
+
+| Code Integrity (CI.DLL) |
+6.2.9200 |
+#1897 |
+FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
+6.2.9200 |
+#1893 |
+FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Enhanced Cryptographic Provider (RSAENH.DLL) |
+6.2.9200 |
+#1894 |
+FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
+
+Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+
+
+
+\[15\] Applies only to Home and Pro
+
+**Windows 7**
+
+Validated Editions: Windows 7, Windows 7 SP1
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
+6.1.7600.16385
+6.1.7601.17514 |
+1329 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.1.7600.16385
+6.1.7600.16915
+6.1.7600.21092
+6.1.7601.17514
+6.1.7601.17725
+6.1.7601.17919
+6.1.7601.21861
+6.1.7601.22076 |
+1328 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
+
+
+| Boot Manager |
+6.1.7600.16385
+6.1.7601.17514 |
+1319 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
+
+Other algorithms: MD5 |
+
+
+| Winload OS Loader (winload.exe) |
+6.1.7600.16385
+6.1.7600.16757
+6.1.7600.20897
+6.1.7600.20916
+6.1.7601.17514
+6.1.7601.17556
+6.1.7601.21655
+6.1.7601.21675 |
+1326 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5 |
+
+
+| BitLocker™ Drive Encryption |
+6.1.7600.16385
+6.1.7600.16429
+6.1.7600.16757
+6.1.7600.20536
+6.1.7600.20873
+6.1.7600.20897
+6.1.7600.20916
+6.1.7601.17514
+6.1.7601.17556
+6.1.7601.21634
+6.1.7601.21655
+6.1.7601.21675 |
+1332 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
+
+Other algorithms: Elephant Diffuser |
+
+
+| Code Integrity (CI.DLL) |
+6.1.7600.16385
+6.1.7600.17122
+6.1.7600.21320
+6.1.7601.17514
+6.1.7601.17950
+6.1.7601.22108 |
+1327 |
+FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
+6.1.7600.16385
+(no change in SP1) |
+1331 |
+FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4 |
+
+
+| Enhanced Cryptographic Provider (RSAENH.DLL) |
+6.1.7600.16385
+(no change in SP1) |
+1330 |
+FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+
+
+
+##### Windows Vista SP1
+
+Validated Editions: Ultimate Edition
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Boot Manager (bootmgr) |
+6.0.6001.18000 and 6.0.6002.18005 |
+978 |
+FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753) |
+
+
+| Winload OS Loader (winload.exe) |
+6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596 |
+979 |
+FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
+
+Other algorithms: MD5 |
+
+
+| Code Integrity (ci.dll) |
+6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005 |
+980 |
+FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
+
+Other algorithms: MD5 |
+
+
+| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
+6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.22869 |
+1000 |
+FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert. and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Cryptographic Primitives Library (bcrypt.dll) |
+6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.22872 |
+1001 |
+FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength) |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 |
+1002 |
+FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
+1003 |
+FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
+
+
+
+
+
+##### Windows Vista
+
+Validated Editions: Ultimate Edition
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+6.0.6000.16386 |
+893 |
+FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+6.0.6000.16386 |
+894 |
+FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
+
+
+| BitLocker™ Drive Encryption |
+6.0.6000.16386 |
+947 |
+FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
+
+Other algorithms: Elephant Diffuser |
+
+
+| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
+6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067 |
+891 |
+FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
+
+Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5 |
+
+
+
+
+
+##### Windows XP SP3
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Kernel Mode Cryptographic Module (FIPS.SYS) |
+5.1.2600.5512 |
+997 |
+FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)
+Other algorithms: DES; MD5; HMAC MD5 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+5.1.2600.5507 |
+990 |
+FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)
+Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+5.1.2600.5507 |
+989 |
+FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)
+Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits) |
+
+
+
+
+
+##### Windows XP SP2
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| DSS/Diffie-Hellman Enhanced Cryptographic Provider |
+5.1.2600.2133 |
+240 |
+FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)
+Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement) |
+
+
+| Microsoft Enhanced Cryptographic Provider |
+5.1.2600.2161 |
+238 |
+FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)
+Other algorithms: DES (Cert. #156); RC2; RC4; MD5 |
+
+
+
+
+
+##### Windows XP SP1
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Microsoft Enhanced Cryptographic Provider |
+5.1.2600.1029 |
+238 |
+FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)
+Other algorithms: DES (Cert. #156); RC2; RC4; MD5 |
+
+
+
+
+
+##### Windows XP
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Kernel Mode Cryptographic Module |
+5.1.2600.0 |
+241 |
+FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)
+Other algorithms: DES (Cert. #89) |
+
+
+
+
+
+##### Windows 2000 SP3
+
+
+
+
+##### Windows 2000 SP2
+
+
+
+
+##### Windows 2000 SP1
+
+
+
+
+##### Windows 2000
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider |
+5.0.2150.1 |
+76 |
+FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)
+Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
+
+
+
+
+
+##### Windows 95 and Windows 98
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider |
+5.0.1877.6 and 5.0.1877.7 |
+75 |
+FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)
+Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
+
+
+
+
+
+##### Windows NT 4.0
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Base Cryptographic Provider |
+5.0.1877.6 and 5.0.1877.7 |
+68 |
+FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
+
+Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement) |
+
+
+
+
+## Modules used by Windows Server
+
+##### Windows Server (Version 1803)
+
+Validated Editions: Standard, Datacenter
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library |
+10.0.17134 |
+#3197 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Kernel Mode Cryptographic Primitives Library |
+10.0.17134 |
+#3196 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Code Integrity |
+10.0.17134 |
+#3195 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows OS Loader |
+10.0.17134 |
+#3480 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Secure Kernel Code Integrity |
+10.0.17134 |
+#3096 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| BitLocker Dump Filter |
+10.0.17134 |
+#3092 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Boot Manager |
+10.0.17134 |
+#3089 |
+See Security Policy and Certificate page for algorithm information |
+
+
+
+
+
+##### Windows Server (Version 1709)
+
+Validated Editions: Standard, Datacenter
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library |
+10.0.16299 |
+#3197 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Kernel Mode Cryptographic Primitives Library |
+10.0.16299 |
+#3196 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Code Integrity |
+10.0.16299 |
+#3195 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows OS Loader |
+10.0.16299 |
+#3194 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Secure Kernel Code Integrity |
+10.0.16299 |
+#3096 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| BitLocker Dump Filter |
+10.0.16299 |
+#3092 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Windows Resume |
+10.0.16299 |
+#3091 |
+See Security Policy and Certificate page for algorithm information |
+
+
+| Boot Manager |
+10.0.16299 |
+#3089 |
+See Security Policy and Certificate page for algorithm information |
+
+
+
+
+
+##### Windows Server 2016
+
+Validated Editions: Standard, Datacenter, Storage Server
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+10.0.14393 |
+2937 |
+FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+10.0.14393 |
+2936 |
+FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Boot Manager |
+10.0.14393 |
+2931 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)
+Other algorithms: MD5; PBKDF (non-compliant); VMK KDF |
+
+
+| BitLocker® Windows OS Loader (winload) |
+10.0.14393 |
+2932 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: NDRNG; MD5 |
+
+
+| BitLocker® Windows Resume (winresume) |
+10.0.14393 |
+2933 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys) |
+10.0.14393 |
+2934 |
+FIPS Approved algorithms: AES (Certs. #4061 and #4064) |
+
+
+| Code Integrity (ci.dll) |
+10.0.14393 |
+2935 |
+FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: AES (non-compliant); MD5 |
+
+
+| Secure Kernel Code Integrity (skci.dll) |
+10.0.14393 |
+2938 |
+FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
+
+Other algorithms: MD5 |
+
+
+
+
+
+##### Windows Server 2012 R2
+
+Validated Editions: Server, Storage Server,
+
+**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2**
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) |
+6.3.9600 6.3.9600.17031 |
+2357 |
+FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.3.9600 6.3.9600.17042 |
+2356 |
+FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Boot Manager |
+6.3.9600 6.3.9600.17031 |
+2351 |
+FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) |
+
+
+| BitLocker® Windows OS Loader (winload) |
+6.3.9600 6.3.9600.17031 |
+2352 |
+FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
+
+Other algorithms: MD5; NDRNG |
+
+
+| BitLocker® Windows Resume (winresume)[16] |
+6.3.9600 6.3.9600.17031 |
+2353 |
+FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (dumpfve.sys)[17] |
+6.3.9600 6.3.9600.17031 |
+2354 |
+FIPS Approved algorithms: AES (Cert. #2832)
+
+Other algorithms: N/A |
+
+
+| Code Integrity (ci.dll) |
+6.3.9600 6.3.9600.17031 |
+2355 |
+FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
+
+Other algorithms: MD5 |
+
+
+
+
+
+\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2**
+
+\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2**
+
+**Windows Server 2012**
+
+Validated Editions: Server, Storage Server
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) |
+6.2.9200 |
+1892 |
+FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.2.9200 |
+1891 |
+FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) |
+
+
+| Boot Manager |
+6.2.9200 |
+1895 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Windows OS Loader (WINLOAD) |
+6.2.9200 |
+1896 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG |
+
+
+| BitLocker® Windows Resume (WINRESUME) |
+6.2.9200 |
+1898 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| BitLocker® Dump Filter (DUMPFVE.SYS) |
+6.2.9200 |
+1899 |
+FIPS Approved algorithms: AES (Certs. #2196 and #2198)
+
+Other algorithms: N/A |
+
+
+| Code Integrity (CI.DLL) |
+6.2.9200 |
+1897 |
+FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) |
+6.2.9200 |
+1893 |
+FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Enhanced Cryptographic Provider (RSAENH.DLL) |
+6.2.9200 |
+1894 |
+FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
+
+Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+
+
+
+##### Windows Server 2008 R2
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Boot Manager (bootmgr) |
+6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.17514 |
+1321 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5 |
+
+
+| Winload OS Loader (winload.exe) |
+6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.21675 |
+1333 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5 |
+
+
+| Code Integrity (ci.dll) |
+6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.22108 |
+1334 |
+FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5 |
+
+
+| Kernel Mode Cryptographic Primitives Library (cng.sys) |
+6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.22076 |
+1335 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 |
+
+
+| Cryptographic Primitives Library (bcryptprimitives.dll) |
+66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.17514 |
+1336 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+6.1.7600.16385 |
+1337 |
+FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+6.1.7600.16385 |
+1338 |
+FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4 |
+
+
+| BitLocker™ Drive Encryption |
+6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.21675 |
+1339 |
+FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
+
+Other algorithms: Elephant Diffuser |
+
+
+
+
+
+##### Windows Server 2008
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Boot Manager (bootmgr) |
+6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.22497 |
+1004 |
+FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: N/A |
+
+
+| Winload OS Loader (winload.exe) |
+6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.22596 |
+1005 |
+FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: MD5 |
+
+
+| Code Integrity (ci.dll) |
+6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
+1006 |
+FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: MD5 |
+
+
+| Kernel Mode Security Support Provider Interface (ksecdd.sys) |
+6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.22869 |
+1007 |
+FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert. and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+| Cryptographic Primitives Library (bcrypt.dll) |
+6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.22872 |
+1008 |
+FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength) |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 |
+1009 |
+FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
+
+-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 |
+1010 |
+FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+
+
+
+##### Windows Server 2003 SP2
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+5.2.3790.3959 |
+875 |
+FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)
+Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4 |
+
+
+| Kernel Mode Cryptographic Module (FIPS.SYS) |
+5.2.3790.3959 |
+869 |
+FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)
+Other algorithms: DES; HMAC-MD5 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+5.2.3790.3959 |
+868 |
+FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)
+Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) |
+
+
+
+
+
+##### Windows Server 2003 SP1
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Kernel Mode Cryptographic Module (FIPS.SYS) |
+5.2.3790.1830 [SP1] |
+405 |
+FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])
+Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+5.2.3790.1830 [Service Pack 1]) |
+382 |
+FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])
+Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+5.2.3790.1830 [Service Pack 1] |
+381 |
+FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)
+Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+
+
+
+##### Windows Server 2003
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Kernel Mode Cryptographic Module (FIPS.SYS) |
+5.2.3790.0 |
+405 |
+FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])
+Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+| Enhanced Cryptographic Provider (RSAENH) |
+5.2.3790.0 |
+382 |
+FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])
+Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+| Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) |
+5.2.3790.0 |
+381 |
+FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)
+Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40
+[1] x86
+[2] SP1 x86, x64, IA64 |
+
+
+
+
+
+#### Other Products
+
+##### Windows Embedded Compact 7 and Windows Embedded Compact 8
+
+
+
+
+
+##### Windows CE 6.0 and Windows Embedded Compact 7
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Enhanced Cryptographic Provider |
+6.00.1937 [1] and 7.00.1687 [2] |
+825 |
+FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])
+Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES |
+
+
+
+
+
+##### Outlook Cryptographic Provider
+
+
+
+
+
+
+
+
+
+
+| Cryptographic Module |
+Version (link to Security Policy) |
+FIPS Certificate # |
+Algorithms |
+
+
+| Outlook Cryptographic Provider (EXCHCSP) |
+SR-1A (3821)SR-1A (3821) |
+110 |
+FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)
+Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5 |
+
+
+
+
+
+
+### Cryptographic Algorithms
+
+The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate.
+
+### Advanced Encryption Standard (AES)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- AES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CFB128:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CTR:
+
+- Counter Source: Internal
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-OFB:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ |
+Microsoft Surface Hub Virtual TPM Implementations #4904
+Version 10.0.15063.674 |
+
+
+
+- AES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CFB128:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CTR:
+
+- Counter Source: Internal
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-OFB:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903
+Version 10.0.16299 |
+
+
+
+- AES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CCM:
+
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
+- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+ - AES-CFB128:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CMAC:
+
+- Generation:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - Verification:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-CTR:
+
+- Counter Source: Internal
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-GCM:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 96, 104, 112, 120, 128 (bits)
+- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
+- AAD Lengths: 0, 8, 1016, 1024 (bits)
+- 96 bit IV supported
+ - AES-XTS:
+
+- Key Size: 128:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ - Key Size: 256:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902
+Version 10.0.15063.674 |
+
+
+
+- AES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CCM:
+
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
+- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+ - AES-CFB128:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CMAC:
+
+- Generation:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - Verification:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-CTR:
+
+- Counter Source: Internal
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-GCM:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 96, 104, 112, 120, 128 (bits)
+- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
+- AAD Lengths: 0, 8, 1016, 1024 (bits)
+- 96 bit IV supported
+ - AES-XTS:
+
+- Key Size: 128:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ - Key Size: 256:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901
+Version 10.0.15254 |
+
+
+
+- AES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CCM:
+
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
+- IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+ - AES-CFB128:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-CMAC:
+
+- Generation:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - Verification:
+
+- AES-128:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-192:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-256:
+
+- Block Sizes: Full, Partial
+- Message Length: 0-65536
+- Tag Length: 16-16
+ - AES-CTR:
+
+- Counter Source: Internal
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Key Lengths: 128, 192, 256 (bits)
+ - AES-GCM:
+
+- Modes: Decrypt, Encrypt
+- IV Generation: External
+- Key Lengths: 128, 192, 256 (bits)
+- Tag Lengths: 96, 104, 112, 120, 128 (bits)
+- Plain Text Lengths: 0, 8, 1016, 1024 (bits)
+- AAD Lengths: 0, 8, 1016, 1024 (bits)
+- 96 bit IV supported
+ - AES-XTS:
+
+- Key Size: 128:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ - Key Size: 256:
+
+- Modes: Decrypt, Encrypt
+- Block Sizes: Full
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897
+Version 10.0.16299 |
+
+
+AES-KW:
+
+- Modes: Decrypt, Encrypt
+- CIPHK transformation direction: Forward
+- Key Lengths: 128, 192, 256 (bits)
+- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
+
+AES Val#4902 |
+Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900
+Version 10.0.15063.674 |
+
+
+AES-KW:
+
+- Modes: Decrypt, Encrypt
+- CIPHK transformation direction: Forward
+- Key Lengths: 128, 192, 256 (bits)
+- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
+
+AES Val#4901 |
+Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899
+Version 10.0.15254 |
+
+
+AES-KW:
+
+- Modes: Decrypt, Encrypt
+- CIPHK transformation direction: Forward
+- Key Lengths: 128, 192, 256 (bits)
+- Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
+
+AES Val#4897 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898
+Version 10.0.16299 |
+
+
+AES-CCM:
+
+- Key Lengths: 256 (bits)
+- Tag Lengths: 128 (bits)
+- IV Lengths: 96 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+
+AES Val#4902 |
+Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896
+Version 10.0.15063.674 |
+
+
+AES-CCM:
+
+- Key Lengths: 256 (bits)
+- Tag Lengths: 128 (bits)
+- IV Lengths: 96 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+
+AES Val#4901 |
+Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895
+Version 10.0.15254 |
+
+
+AES-CCM:
+
+- Key Lengths: 256 (bits)
+- Tag Lengths: 128 (bits)
+- IV Lengths: 96 (bits)
+- Plain Text Length: 0-32
+- AAD Length: 0-65536
+
+AES Val#4897 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894
+Version 10.0.16299 |
+
+
+CBC ( e/d; 128 , 192 , 256 );
+CFB128 ( e/d; 128 , 192 , 256 );
+OFB ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627
+Version 10.0.15063 |
+
+
+KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
+AES Val#4624 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626
+Version 10.0.15063 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#4624
+ |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625
+Version 10.0.15063 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+CFB128 ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 )
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
+GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported
+GMAC_Supported
+XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624
+Version 10.0.15063 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 ); |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434
+Version 7.00.2872 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 ); |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433
+Version 8.00.6246 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431
+Version 7.00.2872 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430
+Version 8.00.6246 |
+
+
+CBC ( e/d; 128 , 192 , 256 );
+CFB128 ( e/d; 128 , 192 , 256 );
+OFB ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074
+Version 10.0.14393 |
+
+
+ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
+GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported
+XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064
+Version 10.0.14393 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
+Version 10.0.14393 |
+
+
+KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )
+AES Val#4064 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062
+Version 10.0.14393 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#4064 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061
+Version 10.0.14393 |
+
+
+KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
+AES Val#3629 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652
+Version 10.0.10586 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#3629 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653
+Version 10.0.10586 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
+Version 10.0.10586 |
+
+
+ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
+GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported
+XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
+
+
+Version 10.0.10586 |
+
+
+KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )
+AES Val#3497 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507
+Version 10.0.10240 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#3497 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498
+Version 10.0.10240 |
+
+
+ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
+GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported
+XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) ) |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
+Version 10.0.10240 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
+Version 10.0.10240 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853
+Version 6.3.9600 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#2832 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848
+Version 6.3.9600 |
+
+
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )
+GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported ;
+OtherIVLen_Supported
+GMAC_Supported |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832
+Version 6.3.9600 |
+
+
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+AES Val#2197
+CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
+AES Val#2197
+GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
+GMAC_Supported |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216 |
+
+
+CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )
+AES Val#2196 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+CFB128 ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196 |
+
+
+CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+AES Val#1168 |
+Windows Server 2008 R2 and SP1 CNG algorithms #1187
+Windows 7 Ultimate and SP1 CNG algorithms #1178 |
+
+
+CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
+AES Val#1168 |
+Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 );
+ |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 |
+
+
+GCM
+GMAC |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed |
+
+
+| CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 ) |
+Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760 |
+
+
+| CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 ) |
+Windows Server 2008 CNG algorithms #757
+Windows Vista Ultimate SP1 CNG algorithms #756 |
+
+
+CBC ( e/d; 128 , 256 );
+CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 ) |
+Windows Vista Ultimate BitLocker Drive Encryption #715
+Windows Vista Ultimate BitLocker Drive Encryption #424 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CFB8 ( e/d; 128 , 192 , 256 ); |
+Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739
+Windows Vista Symmetric Algorithm Implementation #553 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 );
+CTR ( int only; 128 , 192 , 256 ) |
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023 |
+
+
+ECB ( e/d; 128 , 192 , 256 );
+CBC ( e/d; 128 , 192 , 256 ); |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781
+Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548
+Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516
+Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507
+Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290
+Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224
+Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80
+Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33 |
+
+
+
+
+
+Deterministic Random Bit Generator (DRBG)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- Counter:
+
+- Modes: AES-256
+- Derivation Function States: Derivation Function not used
+- Prediction Resistance Modes: Not Enabled
+
+Prerequisite: AES #4904 |
+Microsoft Surface Hub Virtual TPM Implementations #1734
+Version 10.0.15063.674 |
+
+
+
+- Counter:
+
+- Modes: AES-256
+- Derivation Function States: Derivation Function not used
+- Prediction Resistance Modes: Not Enabled
+
+Prerequisite: AES #4903 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733
+Version 10.0.16299 |
+
+
+
+- Counter:
+
+- Modes: AES-256
+- Derivation Function States: Derivation Function used
+- Prediction Resistance Modes: Not Enabled
+
+Prerequisite: AES #4902 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732
+Version 10.0.15063.674 |
+
+
+
+- Counter:
+
+- Modes: AES-256
+- Derivation Function States: Derivation Function used
+- Prediction Resistance Modes: Not Enabled
+
+Prerequisite: AES #4901 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731
+Version 10.0.15254 |
+
+
+
+- Counter:
+
+- Modes: AES-256
+- Derivation Function States: Derivation Function used
+- Prediction Resistance Modes: Not Enabled
+
+Prerequisite: AES #4897 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730
+Version 10.0.16299 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ] |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556
+Version 10.0.15063 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ] |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555
+Version 10.0.15063 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ] |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433
+Version 7.00.2872 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ] |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432
+Version 8.00.6246 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ] |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430
+Version 7.00.2872 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ] |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429
+Version 8.00.6246 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ] |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222
+Version 10.0.14393 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ] |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217
+Version 10.0.14393 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ] |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955
+Version 10.0.10586 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ] |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868
+Version 10.0.10240 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ] |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489
+Version 6.3.9600 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ] |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ] |
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193 |
+
+
+| CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ] |
+Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23 |
+
+
+| DRBG (SP 800–90) |
+Windows Vista Ultimate SP1, vendor-affirmed |
+
+
+
+
+
+#### Digital Signature Algorithm (DSA)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- DSA:
+
+- 186-4:
+
+- PQGGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - PQGVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - KeyPair:
+
+- L = 2048, N = 256
+- L = 3072, N = 256
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303
+Version 10.0.15063.674 |
+
+
+
+- DSA:
+
+- 186-4:
+
+- PQGGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - PQGVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - KeyPair:
+
+-
+-
+- L = 2048, N = 256
+- L = 3072, N = 256
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302
+Version 10.0.15254 |
+
+
+
+- DSA:
+
+- 186-4:
+
+- PQGGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - PQGVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigGen:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - SigVer:
+
+- L = 2048, N = 256 SHA: SHA-256
+- L = 3072, N = 256 SHA: SHA-256
+ - KeyPair:
+
+- L = 2048, N = 256
+- L = 3072, N = 256
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301
+Version 10.0.16299 |
+
+
+FIPS186-4:
+PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen: [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: Val#3790
+DRBG: Val# 1555 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223
+Version 10.0.15063 |
+
+
+FIPS186-4:
+PQG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
+SIG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
+SHS: Val# 3649 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188
+Version 7.00.2872 |
+
+
+FIPS186-4:
+PQG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
+SIG(ver)PARMS TESTED: [ (1024,160) SHA( 1 ); ]
+SHS: Val#3648 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187
+Version 8.00.6246 |
+
+
+FIPS186-4:
+PQG(gen)PARMS TESTED: [
+(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen: [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED: [ (2048,256)
+SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: Val# 3347
+DRBG: Val# 1217 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098
+Version 10.0.14393 |
+
+
+FIPS186-4:
+PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
+KeyPairGen: [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: Val# 3047
+DRBG: Val# 955 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024
+Version 10.0.10586 |
+
+
+FIPS186-4:
+PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen: [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: Val# 2886
+DRBG: Val# 868 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983
+Version 10.0.10240 |
+
+
+FIPS186-4:
+PQG(gen)PARMS TESTED: [
+(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256)
+SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen: [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: Val# 2373
+DRBG: Val# 489 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855
+Version 6.3.9600 |
+
+
+FIPS186-2:
+PQG(ver) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: #1903
+DRBG: #258
+FIPS186-4:
+PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: #1903
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687 |
+
+
+FIPS186-2:
+PQG(ver) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: #1902
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1773
+DRBG: Val# 193
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645. |
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1081
+DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386. |
+Windows Server 2008 R2 and SP1 CNG algorithms #391
+Windows 7 Ultimate and SP1 CNG algorithms #386 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1081
+RNG: Val# 649
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385. |
+Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390
+Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283. |
+Windows Server 2008 CNG algorithms #284
+Windows Vista Ultimate SP1 CNG algorithms #283 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 753
+RNG: Val# 435
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281. |
+Windows Server 2008 Enhanced DSS (DSSENH) #282
+Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 618
+RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226. |
+Windows Vista CNG algorithms #227
+Windows Vista Enhanced DSS (DSSENH) #226 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 784
+RNG: Val# 448
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292. |
+Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292 |
+
+
+FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 783
+RNG: Val# 447
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291. |
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291 |
+
+
+FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 611
+RNG: Val# 314 |
+Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221 |
+
+
+FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 385 |
+Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146 |
+
+
+FIPS186-2:
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 181
+
+ |
+Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95 |
+
+
+FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SHS: SHA-1 (BYTE)
+SIG(ver) MOD(1024);
+SHS: SHA-1 (BYTE) |
+Windows 2000 DSSENH.DLL #29
+Windows 2000 DSSBASE.DLL #28
+Windows NT 4 SP6 DSSENH.DLL #26
+Windows NT 4 SP6 DSSBASE.DLL #25 |
+
+
+FIPS186-2: PRIME;
+FIPS186-2:
+KEYGEN(Y):
+SHS: SHA-1 (BYTE)
+SIG(gen):
+SIG(ver) MOD(1024);
+SHS: SHA-1 (BYTE) |
+Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17 |
+
+
+
+
+
+#### Elliptic Curve Digital Signature Algorithm (ECDSA)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #2373, DRBG #489 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263
+Version 6.3.9600 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384
+- Generation Methods: Testing Candidates
+
+Prerequisite: SHS #4011, DRBG #1734 |
+Microsoft Surface Hub Virtual TPM Implementations #1253
+Version 10.0.15063.674 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384
+- Generation Methods: Testing Candidates
+
+Prerequisite: SHS #4009, DRBG #1733 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252
+Version 10.0.16299 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub MsBignum Cryptographic Implementations #1251
+Version 10.0.15063.674 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250
+Version 10.0.15063.674 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249
+Version 10.0.15254 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248
+Version 10.0.15254 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247
+Version 10.0.16299 |
+
+
+
+- ECDSA:
+
+- 186-4:
+
+- Key Pair Generation:
+
+- Curves: P-256, P-384, P-521
+- Generation Methods: Extra Random Bits
+ - Public Key Validation:
+
+- Curves: P-256, P-384, P-521
+ - Signature Generation:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+ - Signature Verification:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246
+Version 10.0.16299 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 TestingCandidates )
+SHS: Val#3790
+DRBG: Val# 1555 |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136
+Version 10.0.15063 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#3790
+DRBG: Val# 1555 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135
+Version 10.0.15063 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#3790
+DRBG: Val# 1555 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133
+Version 10.0.15063 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
+SHS:Val# 3649
+DRBG:Val# 1430 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073
+Version 7.00.2872 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
+SHS:Val#3648
+DRBG:Val# 1429 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072
+Version 8.00.6246 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 TestingCandidates )
+PKV: CURVES( P-256 P-384 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )
+SHS: Val# 3347
+DRBG: Val# 1222 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920
+Version 10.0.14393 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val# 3347
+DRBG: Val# 1217 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911
+Version 10.0.14393 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val# 3047
+DRBG: Val# 955 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760
+Version 10.0.10586 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val# 2886
+DRBG: Val# 868 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706
+Version 10.0.10240 |
+
+
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#2373
+DRBG: Val# 489 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505
+Version 6.3.9600 |
+
+
+FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: #1903
+DRBG: #258
+SIG(ver):CURVES( P-256 P-384 P-521 )
+SHS: #1903
+DRBG: #258
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: #1903
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341 |
+
+
+FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#1773
+DRBG: Val# 193
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#1773
+DRBG: Val# 193
+FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#1773
+DRBG: Val# 193
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295. |
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295 |
+
+
+FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#1081
+DRBG: Val# 23
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#1081
+DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141. |
+Windows Server 2008 R2 and SP1 CNG algorithms #142
+Windows 7 Ultimate and SP1 CNG algorithms #141 |
+
+
+FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#753
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82. |
+Windows Server 2008 CNG algorithms #83
+Windows Vista Ultimate SP1 CNG algorithms #82 |
+
+
+FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#618
+RNG: Val# 321
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#618
+RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60. |
+Windows Vista CNG algorithms #60 |
+
+
+
+
+
+#### Keyed-Hash Message Authentication Code (HMAC)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- HMAC-SHA-1:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-256:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-384:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+
+Prerequisite: SHS #4011 |
+Microsoft Surface Hub Virtual TPM Implementations #3271
+Version 10.0.15063.674 |
+
+
+
+- HMAC-SHA-1:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-256:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-384:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+
+Prerequisite: SHS #4009 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270
+Version 10.0.16299 |
+
+
+
+- HMAC-SHA-1:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-256:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-384:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-512:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+
+Prerequisite: SHS #4011 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269
+Version 10.0.15063.674 |
+
+
+
+- HMAC-SHA-1:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-256:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-384:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-512:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+
+Prerequisite: SHS #4010 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268
+Version 10.0.15254 |
+
+
+
+- HMAC-SHA-1:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-256:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-384:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+ - HMAC-SHA2-512:
+
+- Key Sizes < Block Size
+- Key Sizes > Block Size
+- Key Sizes = Block Size
+
+Prerequisite: SHS #4009 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267
+Version 10.0.16299 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790 |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062
+Version 10.0.15063 |
+
+
+HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061
+Version 10.0.15063 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652 |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946
+Version 7.00.2872 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651 |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945
+Version 8.00.6246 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943
+Version 7.00.2872 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942
+Version 8.00.6246 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
+SHS Val# 3347
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
+SHS Val# 3347
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
+SHS Val# 3347 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661
+Version 10.0.14393 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651
+Version 10.0.14393 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
+SHS Val# 3047
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
+SHS Val# 3047
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
+SHS Val# 3047
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
+SHS Val# 3047 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381
+Version 10.0.10586 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
+SHSVal# 2886
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
+SHSVal# 2886
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
+ SHSVal# 2886
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
+SHSVal# 2886 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233
+Version 10.0.10240 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
+SHS Val#2373
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
+SHS Val#2373
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
+SHS Val#2373
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
+SHS Val#2373 |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773
+Version 6.3.9600 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764 |
+Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122
+Version 5.2.29344 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902
+HMAC-SHA256 ( Key Size Ranges Tested: KS#1902 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )
+SHS#1903
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )
+SHS#1903
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS )
+SHS#1903
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS )
+SHS#1903 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773
+Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773 |
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774 |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081 |
+Windows Server 2008 R2 and SP1 CNG algorithms #686
+Windows 7 and SP1 CNG algorithms #677
+Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687
+Windows 7 Enhanced Cryptographic Provider (RSAENH) #673 |
+
+
+HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081
+HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081 |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816 |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753
+HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753 |
+Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753 |
+Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408
+Windows Vista Enhanced Cryptographic Provider (RSAENH) #407 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618 |
+Windows Vista Enhanced Cryptographic Provider (RSAENH) #297 |
+
+
+| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785 |
+Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429
+Windows XP, vendor-affirmed |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783 |
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613 |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289 |
+
+
+| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610 |
+Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753 |
+Windows Server 2008 CNG algorithms #413
+Windows Vista Ultimate SP1 CNG algorithms #412 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737
+HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737 |
+Windows Vista Ultimate BitLocker Drive Encryption #386 |
+
+
+HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618 |
+Windows Vista CNG algorithms #298 |
+
+
+HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589 |
+Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267 |
+
+
+HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578 |
+Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260 |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495
+HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495 |
+Windows Vista BitLocker Drive Encryption #199 |
+
+
+| HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364 |
+Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99
+Windows XP, vendor-affirmed |
+
+
+HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305
+HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305
+HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305
+HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305 |
+Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31 |
+
+
+
+
+
+#### Key Agreement Scheme (KAS)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- KAS ECC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
+- Schemes:
+
+- Full Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- KDFs: Concatenation
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+
+Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734 |
+Microsoft Surface Hub Virtual TPM Implementations #150
+Version 10.0.15063.674 |
+
+
+
+- KAS ECC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
+- Schemes:
+
+- Full Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- KDFs: Concatenation
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+
+Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149
+Version 10.0.16299 |
+
+
+
+- KAS ECC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
+- Schemes:
+
+- Ephemeral Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- KDFs: Concatenation
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - One Pass DH:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - Static Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+
+Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732
+
+- KAS FFC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
+- Schemes:
+
+- dhEphem:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhOneFlow:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhStatic:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+
+Prerequisite: SHS #4011, DSA #1303, DRBG #1732 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #148
+Version 10.0.15063.674 |
+
+
+
+- KAS ECC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
+- Schemes:
+
+- Ephemeral Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- KDFs: Concatenation
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - One Pass DH:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - Static Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+
+Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731
+
+- KAS FFC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
+- Schemes:
+
+- dhEphem:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhOneFlow:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhStatic:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+
+Prerequisite: SHS #4010, DSA #1302, DRBG #1731 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147
+Version 10.0.15254 |
+
+
+
+- KAS ECC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
+- Schemes:
+
+- Ephemeral Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- KDFs: Concatenation
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - One Pass DH:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+ - Static Unified:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- EC:
+
+- Curve: P-256
+- SHA: SHA-256
+- MAC: HMAC
+ - ED:
+
+- Curve: P-384
+- SHA: SHA-384
+- MAC: HMAC
+ - EE:
+
+- Curve: P-521
+- SHA: SHA-512
+- MAC: HMAC
+
+Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730
+
+- KAS FFC:
+
+- Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
+- Schemes:
+
+- dhEphem:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhOneFlow:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - dhStatic:
+
+- Key Agreement Roles: Initiator, Responder
+- Parameter Sets:
+
+- FB:
+
+- SHA: SHA-256
+- MAC: HMAC
+ - FC:
+
+- SHA: SHA-256
+- MAC: HMAC
+
+Prerequisite: SHS #4009, DSA #1301, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146
+Version 10.0.16299 |
+
+
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Full Validation Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ]
+SHS Val#3790
+DSA Val#1135
+DRBG Val#1556 |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128
+Version 10.0.15063 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val#3790
+DSA Val#1223
+DRBG Val#1555
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS Val#3790
+ECDSA Val#1133
+DRBG Val#1555 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127
+Version 10.0.15063 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val# 3649
+DSA Val#1188
+DRBG Val#1430
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ] |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115
+Version 7.00.2872 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhHybridOneFlow ( No_KC < KARole(s): Initiator / Responder> ) ( FB:SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+[ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FB:SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val#3648
+DSA Val#1187
+DRBG Val#1429
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS Val#3648
+ECDSA Val#1072
+DRBG Val#1429 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114
+Version 8.00.6246 |
+
+
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Full Validation Key Regeneration )
+SCHEMES [ FullUnified ( No_KC < KARole(s): Initiator / Responder > < KDF: CONCAT > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ]
+SHS Val# 3347 ECDSA Val#920 DRBG Val#1222 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93
+Version 10.0.14393 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation )
+SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic (No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val# 3347 DSA Val#1098 DRBG Val#1217
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92
+Version 10.0.14393 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val# 3047 DSA Val#1024 DRBG Val#955
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+SHS Val# 3047 ECDSA Val#760 DRBG Val#955 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72
+Version 10.0.10586 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val# 2886 DSA Val#983 DRBG Val#868
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+SHS Val# 2886 ECDSA Val#706 DRBG Val#868 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64
+Version 10.0.10240 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC < KARole(s): Initiator / Responder > ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS Val#2373 DSA Val#855 DRBG Val#489
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder > ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+SHS Val#2373 ECDSA Val#505 DRBG Val#489 |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47
+Version 6.3.9600 |
+
+
+FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhStatic ( No_KC < KARole(s): Initiator / Responder> ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS #1903 DSA Val#687 DRBG #258
+ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
+[ StaticUnified ( No_KC < KARole(s): Initiator / Responder> ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS #1903 ECDSA Val#341 DRBG #258 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36 |
+
+
+KAS (SP 800–56A)
+key agreement
+key establishment methodology provides 80 to 256 bits of encryption strength |
+Windows 7 and SP1, vendor-affirmed
+Windows Server 2008 R2 and SP1, vendor-affirmed |
+
+
+
+
+
+SP 800-108 Key-Based Key Derivation Functions (KBKDF)
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- Counter:
+
+- MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
+
+MAC prerequisite: HMAC #3271
+
+
+- Counter Location: Before Fixed Data
+- R Length: 32 (bits)
+- SPs used to generate K: SP 800-56A, SP 800-90A
+
+ K prerequisite: DRBG #1734, KAS #150 |
+Microsoft Surface Hub Virtual TPM Implementations #161
+Version 10.0.15063.674 |
+
+
+
+- Counter:
+
+- MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
+
+MAC prerequisite: HMAC #3270
+
+
+- Counter Location: Before Fixed Data
+- R Length: 32 (bits)
+- SPs used to generate K: SP 800-56A, SP 800-90A
+
+ K prerequisite: DRBG #1733, KAS #149 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160
+Version 10.0.16299 |
+
+
+
+- Counter:
+
+- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
+
+MAC prerequisite: AES #4902, HMAC #3269
+
+
+- Counter Location: Before Fixed Data
+- R Length: 32 (bits)
+- SPs used to generate K: SP 800-56A, SP 800-90A
+- K prerequisite: KAS #148
+
+ |
+Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159
+Version 10.0.15063.674 |
+
+
+
+- Counter:
+
+- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
+
+MAC prerequisite: AES #4901, HMAC #3268
+
+
+- Counter Location: Before Fixed Data
+- R Length: 32 (bits)
+- SPs used to generate K: SP 800-56A, SP 800-90A
+
+ K prerequisite: KAS #147 |
+Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158
+Version 10.0.15254 |
+
+
+
+- Counter:
+
+- MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
+
+MAC prerequisite: AES #4897, HMAC #3267
+
+
+- Counter Location: Before Fixed Data
+- R Length: 32 (bits)
+- SPs used to generate K: SP 800-56A, SP 800-90A
+
+ K prerequisite: KAS #146 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157
+Version 10.0.16299 |
+
+
+CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+
+KAS Val#128
+DRBG Val#1556
+MAC Val#3062 |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141
+Version 10.0.15063 |
+
+
+CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+
+KAS Val#127
+AES Val#4624
+DRBG Val#1555
+MAC Val#3061 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140
+Version 10.0.15063 |
+
+
+CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+KAS Val#93 DRBG Val#1222 MAC Val#2661 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102
+Version 10.0.14393 |
+
+
+CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101
+Version 10.0.14393 |
+
+
+CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72
+Version 10.0.10586 |
+
+
+CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66
+Version 10.0.10240 |
+
+
+CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+DRBG Val#489 MAC Val#1773 |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30
+Version 6.3.9600 |
+
+
+CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+DRBG #258 HMAC Val#1345 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3 |
+
+
+
+
+
+Random Number Generator (RNG)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+FIPS 186-2 General Purpose
+[ (x-Original); (SHA-1) ] |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110 |
+
+
+FIPS 186-2
+[ (x-Original); (SHA-1) ] |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060
+Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292
+Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286
+Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66 |
+
+
+FIPS 186-2
+[ (x-Change Notice); (SHA-1) ]
+FIPS 186-2 General Purpose
+[ (x-Change Notice); (SHA-1) ] |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649
+Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435
+Windows Vista RNG implementation #321 |
+
+
+FIPS 186-2 General Purpose
+[ (x-Change Notice); (SHA-1) ] |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470
+Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316
+Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313 |
+
+
+FIPS 186-2
+[ (x-Change Notice); (SHA-1) ] |
+Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448
+Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314 |
+
+
+
+
+
+#### RSA
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+RSA:
+
+- 186-4:
+
+- Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
+ - Signature Verification PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+
+Prerequisite: SHS #4011, DRBG #1734 |
+Microsoft Surface Hub Virtual TPM Implementations #2677
+Version 10.0.15063.674 |
+
+
+RSA:
+
+- 186-4:
+
+- Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 240 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+
+Prerequisite: SHS #4009, DRBG #1733 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676
+Version 10.0.16299 |
+
+
+RSA:
+
+- 186-4:
+
+- Key Generation:
+- Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub RSA32 Algorithm Implementations #2675
+Version 10.0.15063.674 |
+
+
+RSA:
+
+- 186-4:
+
+- Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674
+Version 10.0.16299 |
+
+
+RSA:
+
+- 186-4:
+
+- Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673
+Version 10.0.15254 |
+
+
+RSA:
+
+- 186-4:
+
+- Key Generation:
+
+- Public Key Exponent: Fixed (10001)
+- Provable Primes with Conditions:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.3
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub MsBignum Cryptographic Implementations #2672
+Version 10.0.15063.674 |
+
+
+RSA:
+
+- 186-4:
+
+- Key Generation:
+
+- Probable Random Primes:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.2
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4011, DRBG #1732 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671
+Version 10.0.15063.674 |
+
+
+RSA:
+
+- 186-4:
+
+- Key Generation:
+
+- Probable Random Primes:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.2
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670
+Version 10.0.15254 |
+
+
+RSA:
+
+- 186-4:
+
+- Key Generation:
+
+- Public Key Exponent: Fixed (10001)
+- Provable Primes with Conditions:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.3
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4010, DRBG #1731 |
+Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669
+Version 10.0.15254 |
+
+
+
+- 186-4:
+
+- Key Generation:
+
+- Public Key Exponent: Fixed (10001)
+- Provable Primes with Conditions:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.3
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668
+Version 10.0.16299 |
+
+
+
+- 186-4:
+
+- Key Generation:
+
+- Probable Random Primes:
+
+- Mod lengths: 2048, 3072 (bits)
+- Primality Tests: C.2
+ - Signature Generation PKCS1.5:
+
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Generation PSS:
+
+- Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Signature Verification PKCS1.5:
+
+- Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+- Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
+ - Signature Verification PSS:
+
+- Mod 1024:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 496 (bits)
+ - Mod 2048:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+ - Mod 3072:
+
+- SHA-1: Salt Length: 160 (bits)
+- SHA-256: Salt Length: 256 (bits)
+- SHA-384: Salt Length: 384 (bits)
+- SHA-512: Salt Length: 512 (bits)
+
+Prerequisite: SHS #4009, DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667
+Version 10.0.16299 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
+SHA Val#3790 |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524
+Version 10.0.15063 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3790 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523
+Version 10.0.15063 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val#3790
+DRBG: Val# 1555 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522
+Version 10.0.15063 |
+
+
+FIPS186-4:
+186-4KEY(gen):
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val#3790 |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521
+Version 10.0.15063 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
+FIPS186-4:
+ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
+SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3652 |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415
+Version 7.00.2872 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
+FIPS186-4:
+ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
+SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3651 |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414
+Version 8.00.6246 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val# 3649
+DRBG: Val# 1430 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412
+Version 7.00.2872 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3648
+DRBG: Val# 1429 |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411
+Version 8.00.6246 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
+SHA Val# 3347 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206
+Version 10.0.14393 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA Val# 3347 DRBG: Val# 1217 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195
+Version 10.0.14393 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3346 |
+soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194
+Version 10.0.14393 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val# 3347 DRBG: Val# 1217 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193
+Version 10.0.14393 |
+
+
+FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val# 3347 DRBG: Val# 1217 |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192
+Version 10.0.14393 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA Val# 3047 DRBG: Val# 955 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889
+Version 10.0.10586 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3048 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871
+Version 10.0.10586 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val# 3047 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888
+Version 10.0.10586 |
+
+
+FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val# 3047 |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887
+Version 10.0.10586 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA Val# 2886 DRBG: Val# 868 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798
+Version 10.0.10240 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#2871 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784
+Version 10.0.10240 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#2871 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783
+Version 10.0.10240 |
+
+
+FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val# 2886 |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802
+Version 10.0.10240 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA Val#2373 DRBG: Val# 489 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487
+Version 6.3.9600 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#2373 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494
+Version 6.3.9600 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#2373 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493
+Version 6.3.9600 |
+
+
+FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val#2373 |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519
+Version 6.3.9600 |
+
+
+FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
+SHA #1903
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134 |
+
+
+FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA #1903 DRBG: #258 |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052. |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051. |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568. |
+Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560. |
+Windows Server 2008 R2 and SP1 CNG algorithms #567
+Windows 7 and SP1 CNG algorithms #560 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559. |
+Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557. |
+Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395. |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371. |
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357. |
+Windows Server 2008 CNG algorithms #358
+Windows Vista SP1 CNG algorithms #357 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354. |
+Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355
+Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353. |
+Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258. |
+Windows Vista RSA key generation implementation #258 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257. |
+Windows Vista CNG algorithms #257 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255. |
+Windows Vista Enhanced Cryptographic Provider (RSAENH) #255 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245. |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230. |
+Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222. |
+Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222 |
+
+
+FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]:
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81. |
+Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81 |
+
+
+FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52. |
+Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52 |
+
+
+FIPS186-2:
+– PKCS#1 v1.5, signature generation and verification
+– Mod sizes: 1024, 1536, 2048, 3072, 4096
+– SHS: SHA–1/256/384/512 |
+Windows XP, vendor-affirmed
+Windows 2000, vendor-affirmed |
+
+
+
+
+
+#### Secure Hash Standard (SHS)
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- SHA-1:
+
+- Supports Empty Message
+ - SHA-256:
+
+- Supports Empty Message
+ - SHA-384:
+
+- Supports Empty Message
+ - SHA-512:
+
+- Supports Empty Message
+ |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011
+Version 10.0.15063.674 |
+
+
+
+- SHA-1:
+
+- Supports Empty Message
+ - SHA-256:
+
+- Supports Empty Message
+ - SHA-384:
+
+- Supports Empty Message
+ - SHA-512:
+
+- Supports Empty Message
+ |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010
+Version 10.0.15254 |
+
+
+
+- SHA-1:
+
+- Supports Empty Message
+ - SHA-256:
+
+- Supports Empty Message
+ - SHA-384:
+
+- Supports Empty Message
+ - SHA-512:
+
+- Supports Empty Message
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009
+Version 10.0.16299 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790
+Version 10.0.15063 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652
+Version 7.00.2872 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651
+Version 8.00.6246 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649
+Version 7.00.2872 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648
+Version 8.00.6246 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
+Version 10.0.14393 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
+Version 10.0.14393 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
+Version 10.0.10586 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
+Version 10.0.10586 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
+Version 10.0.10240 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
+Version 10.0.10240 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
+Version 6.3.9600 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
+Version 6.3.9600 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)
+Implementation does not support zero-length (null) messages. |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816 |
+
+
+| SHA-1 (BYTE-only) |
+Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785
+Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753
+Windows Vista Symmetric Algorithm Implementation #618 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only) |
+Windows Vista BitLocker Drive Encryption #737
+Windows Vista Beta 2 BitLocker Drive Encryption #495 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613
+Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364 |
+
+
+| SHA-1 (BYTE-only) |
+Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611
+Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610
+Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385
+Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371
+Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181
+Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177
+Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176 |
+
+
+SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only) |
+Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589
+Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578
+Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305 |
+
+
+| SHA-1 (BYTE-only) |
+Windows XP Microsoft Enhanced Cryptographic Provider #83
+Crypto Driver for Windows 2000 (fips.sys) #35
+Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32
+Windows 2000 RSAENH.DLL #24
+Windows 2000 RSABASE.DLL #23
+Windows NT 4 SP6 RSAENH.DLL #21
+Windows NT 4 SP6 RSABASE.DLL #20 |
+
+
+
+
+
+#### Triple DES
+
+
+
+
+
+
+
+
+| Modes / States / Key Sizes |
+Algorithm Implementation and Certificate # |
+
+
+
+- TDES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB64:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558
+Version 10.0.15063.674 |
+
+
+
+- TDES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB64:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557
+Version 10.0.15254 |
+
+
+
+- TDES-CBC:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB64:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-CFB8:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ - TDES-ECB:
+
+- Modes: Decrypt, Encrypt
+- Keying Option: 1
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556
+Version 10.0.16299 |
+
+
+| TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, ) |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459
+Version 10.0.15063 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384
+Version 8.00.6246 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) |
+Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383
+Version 8.00.6246 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) ;
+CTR ( int only ) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382
+Version 7.00.2872 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) |
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381
+Version 8.00.6246 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) ;
+TCFB8( KO 1 e/d, ) ;
+TCFB64( KO 1 e/d, ) |
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
+
+
+Version 10.0.14393 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) ;
+TCFB8( KO 1 e/d, ) ;
+TCFB64( KO 1 e/d, ) |
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
+
+
+Version 10.0.10586 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) ;
+TCFB8( KO 1 e/d, ) ;
+TCFB64( KO 1 e/d, ) |
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
+
+
+Version 10.0.10240 |
+
+
+TECB( KO 1 e/d, ) ;
+TCBC( KO 1 e/d, ) ;
+TCFB8( KO 1 e/d, ) ;
+TCFB64( KO 1 e/d, ) |
+Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692
+Version 6.3.9600 |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) ;
+TCFB8( e/d; KO 1,2 ) ;
+TCFB64( e/d; KO 1,2 ) |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387 |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) ;
+TCFB8( e/d; KO 1,2 ) |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386 |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) ;
+TCFB8( e/d; KO 1,2 ) |
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846 |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) ;
+TCFB8( e/d; KO 1,2 ) |
+Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656 |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) ;
+TCFB8( e/d; KO 1,2 ) |
+Windows Vista Symmetric Algorithm Implementation #549 |
+
+
+| Triple DES MAC |
+Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed
+Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed |
+
+
+TECB( e/d; KO 1,2 ) ;
+TCBC( e/d; KO 1,2 ) |
+Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308
+Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691
+Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677
+Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676
+Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675
+Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544
+Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543
+Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542
+Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526
+Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517
+Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381
+Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370
+Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365
+Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315
+Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201
+Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199
+Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192
+Windows XP Microsoft Enhanced Cryptographic Provider #81
+Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18
+Crypto Driver for Windows 2000 (fips.sys) #16 |
+
+
+
+
+
+#### SP 800-132 Password Based Key Derivation Function (PBKDF)
+
+
+
+ |
+ Modes / States / Key Sizes
+ |
+
+ Algorithm Implementation and Certificate #
+ |
+
+
+ |
+ PBKDF (vendor affirmed) |
+
+ Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
(Software Version: 10.0.14393)
+ Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)
+ Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
(Software Version: 10.0.14393)
+ Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
(Software Version: 10.0.14393)
+ |
+
+
+ |
+ PBKDF (vendor affirmed) |
+
+ Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)
+ Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed
+ |
+
+
+
+
+#### Component Validation List
+
+
+
+
+
+
+
+
+| Publication / Component Validated / Description |
+Implementation and Certificate # |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #489 |
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540
+Version 6.3.9600 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Microsoft Surface Hub Virtual TPM Implementations #1519
+Version 10.0.15063.674 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518
+Version 10.0.16299 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Microsoft Surface Hub MsBignum Cryptographic Implementations #1517
+Version 10.0.15063.674 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Microsoft Surface Hub MsBignum Cryptographic Implementations #1516
+Version 10.0.15063.674 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+ Prerequisite: DRBG #1732 |
+Microsoft Surface Hub MsBignum Cryptographic Implementations #1515
+Version 10.0.15063.674 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #1732 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514
+Version 10.0.15063.674 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513
+Version 10.0.15063.674 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512
+Version 10.0.15063.674 |
+
+
+
+- IKEv1:
+
+- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
+- Pre-shared Key Length: 64-2048
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4011, HMAC #3269
+
+- IKEv2:
+
+- Derived Keying Material length: 192-1792
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4011, HMAC #3269
+
+- TLS:
+
+- Supports TLS 1.0/1.1
+- Supports TLS 1.2:
+
+- SHA Functions: SHA-256, SHA-384
+
+Prerequisite: SHS #4011, HMAC #3269 |
+Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511
+Version 10.0.15063.674 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #1731 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510
+Version 10.0.15254 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509
+Version 10.0.15254 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508
+Version 10.0.15254 |
+
+
+
+- IKEv1:
+
+- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
+- Pre-shared Key Length: 64-2048
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4010, HMAC #3268
+
+- IKEv2:
+
+- Derived Keying Material length: 192-1792
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4010, HMAC #3268
+
+- TLS:
+
+- Supports TLS 1.0/1.1
+- Supports TLS 1.2:
+
+- SHA Functions: SHA-256, SHA-384
+
+Prerequisite: SHS #4010, HMAC #3268 |
+Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507
+Version 10.0.15254 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #1731 |
+Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506
+Version 10.0.15254 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505
+Version 10.0.15254 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504
+Version 10.0.15254 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503
+Version 10.0.16299 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502
+Version 10.0.16299 |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501
+Version 10.0.16299 |
+
+
+
+- ECDSA SigGen:
+
+- P-256 SHA: SHA-256
+- P-384 SHA: SHA-384
+- P-521 SHA: SHA-512
+
+Prerequisite: DRBG #1730 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499
+Version 10.0.16299 |
+
+
+
+- RSADP:
+
+- Modulus Size: 2048 (bits)
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498
+Version 10.0.16299
+ |
+
+
+
+- RSASP1:
+
+- Modulus Size: 2048 (bits)
+- Padding Algorithms: PKCS 1.5
+ |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1497
+Version 10.0.16299 |
+
+
+
+- IKEv1:
+
+- Methods: Digital Signature, Pre-shared Key, Public Key Encryption
+- Pre-shared Key Length: 64-2048
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4009, HMAC #3267
+
+- IKEv2:
+
+- Derived Keying Material length: 192-1792
+- Diffie-Hellman shared secrets:
+
+- Diffie-Hellman shared secret:
+
+- Length: 2048 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 256 (bits)
+- SHA Functions: SHA-256
+ - Diffie-Hellman shared secret:
+
+- Length: 384 (bits)
+- SHA Functions: SHA-384
+
+Prerequisite: SHS #4009, HMAC #3267
+
+- TLS:
+
+- Supports TLS 1.0/1.1
+- Supports TLS 1.2:
+
+- SHA Functions: SHA-256, SHA-384
+
+Prerequisite: SHS #4009, HMAC #3267 |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1496
+Version 10.0.16299 |
+
+
+FIPS186-4 ECDSA
+Signature Generation of hash sized messages
+ECDSA SigGen Component: CURVES( P-256 P-384 P-521 ) |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
+Version 10.0. 15063
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
+Version 10.0. 15063
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
+Version 10.0.14393
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
+Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
+Version 10.0.10586
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
+Version 6.3.9600 |
+
+
+FIPS186-4 RSA; PKCS#1 v2.1
+RSASP1 Signature Primitive
+RSASP1: (Mod2048: PKCS1.5 PKCSPSS) |
+Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
+Version 10.0.15063
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
+Version 10.0.15063
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
+Version 10.0.15063
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
+Version 10.0.14393
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
+Version 10.0.14393
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
+Version 10.0.10586
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
+Version 10.0.10240
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
+Version 6.3.9600 |
+
+
+FIPS186-4 RSA; RSADP
+RSADP Primitive
+RSADP: (Mod2048) |
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
+Version 10.0.15063
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
+Version 10.0.15063
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
+Version 10.0.14393
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
+Version 10.0.14393
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
+Version 10.0.10586
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
+Version 10.0.10240 |
+
+
+SP800-135
+Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS |
+Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1496
+Version 10.0.16299
+Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
+Version 10.0.15063
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
+Version 7.00.2872
+Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
+Version 8.00.6246
+Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
+Version 10.0.14393
+Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
+Version 10.0.10586
+Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
+Version 10.0.10240
+Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
+Version 6.3.9600 |
+
+
+
+
+
+## References
+
+\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules
+
+\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ
+
+\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised)
+
+\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
\ No newline at end of file
diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md
index 663976a44a..bbba6bbb82 100644
--- a/windows/security/threat-protection/index.md
+++ b/windows/security/threat-protection/index.md
@@ -1,7 +1,7 @@
---
title: Threat Protection (Windows 10)
description: Learn how Microsoft Defender ATP helps protect against threats.
-keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting, cyber threat hunting
+keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting, cyber threat hunting, web threat protection
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -64,7 +64,7 @@ The attack surface reduction set of capabilities provide the first line of defen
- [Application control](windows-defender-application-control/windows-defender-application-control.md)
- [Device control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
- [Exploit protection](microsoft-defender-atp/exploit-protection.md)
-- [Network protection](microsoft-defender-atp/network-protection.md), [Web protection](microsoft-defender-atp/web-protection-overview.md)
+- [Network protection](microsoft-defender-atp/network-protection.md), [web protection](microsoft-defender-atp/web-protection-overview.md)
- [Controlled folder access](microsoft-defender-atp/controlled-folders.md)
- [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
- [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md)
diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md
index f00d63e08f..f6b12d45e0 100644
--- a/windows/security/threat-protection/intelligence/safety-scanner-download.md
+++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md
@@ -24,15 +24,17 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from
- [Download Microsoft Safety Scanner (64-bit)](https://go.microsoft.com/fwlink/?LinkId=212732)
> [!NOTE]
-> The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/wdsi/definitions).
+> Starting November 2019, Safety Scanner will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to run Safety Scanner. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
-Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.
+## Important information
-> [!NOTE]
-> This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
+- The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/wdsi/definitions).
-> [!NOTE]
-> Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download.
+- Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.
+
+- Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download.
+
+- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
## System requirements
diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
index adfe6b2035..1723f5ee27 100644
--- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
+++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
@@ -19,18 +19,11 @@ ms.topic: article
The Microsoft Virus Initiative (MVI) helps organizations to get their products working and integrated with Windows.
-MVI members will receive access to Windows APIs (such as those used by Windows Defender Antivirus), and other technologies including IOAV, AMSI and Cloud Files, malware telemetry and samples, and invitations to security related events and conferences.
+MVI members receive access to Windows APIs and other technologies including IOAV, AMSI and Cloud files. Members also get malware telemetry and samples and invitations to security related events and conferences.
-MVI requires members to develop and own antimalware technology and to be present in the antimalware industry community.
+## Become a member
-## Join MVI
-
-A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology.
-
-
-### Initial selection criteria
-
-Your organization must meet the following eligibility requirements to qualify for the MVI program:
+A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following eligibility requirements to qualify for the MVI program:
1. Offer an antimalware or antivirus product that is one of the following:
@@ -39,10 +32,9 @@ Your organization must meet the following eligibility requirements to qualify fo
2. Have your own malware research team unless you build a product based on an SDK.
-3. Be active and have a positive reputation in the antimalware industry. Your organization is:
+3. Be active and have a positive reputation in the antimalware industry.
- * Certified through independent testing by an industry standard organization such as [ICSA Labs](https://www.icsalabs.com/), [West Coast Labs](http://www.westcoastlabs.com/), [PCSL IT Consulting Institute](https://www.pitci.net/), or [SKD Labs](http://www.skdlabs.com/html/english/).
- * Be active in the antimalware industry. For example, participate in industry conferences, be reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner.
+ * Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner.
4. Be willing to sign a non-disclosure agreement (NDA) with Microsoft.
@@ -52,6 +44,19 @@ Your organization must meet the following eligibility requirements to qualify fo
7. Submit your app to Microsoft for periodic performance testing.
-### Apply now
+8. Certified through independent testing by at least one industry standard organization.
+
+Test Provider | Lab Test Type | Minimum Level / Score
+------------- |---------------|----------------------
+AV-Comparatives | Real-World Protection Test https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives
+AV-Test | Must pass tests for Windows. Certifications for Mac and Linux are not accepted https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
+ICSA Labs | Endpoint Anti-Malware Detection https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified
+NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS
+SKD Labs | Certification Requirements Product: Anti-virus or Antimalware http://www.skdlabs.com/html/english/ http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5 % with On Demand, On Access and Total Detection tests
+SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating
+VB 100 | VB100 Certification Test V1.1 https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification
+West Coast Labs | Checkmark Certified http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance
+
+## Apply now
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
index e269b25de8..c0b6610350 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
@@ -25,6 +25,8 @@ ms.date: 10/08/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+[!include[Prerelease information](prerelease.md)]
+
The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema.
## Schema tables
@@ -45,7 +47,11 @@ Table and column names are also listed within the Microsoft Defender Security Ce
| **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events |
| **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events |
| **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
+| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory |
+| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory |
+| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information |
+| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Basis of security configuration assessment such as security industry standards and benchmarks |
## Related topics
- [Advanced hunting overview](advanced-hunting-overview.md)
-- [Learn the query language](advanced-hunting-query-language.md)
\ No newline at end of file
+- [Learn the query language](advanced-hunting-query-language.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md
new file mode 100644
index 0000000000..35d38020d6
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md
@@ -0,0 +1,53 @@
+---
+title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema
+description: Learn about the DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema, such as machine ID, computer name, operating system platform, security configuration details, impact, and compliance information.
+keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSecureConfigurationAssessment
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dolmont
+author: DulceMontemayor
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 10/27/2019
+---
+
+# DeviceTvmSecureConfigurationAssessment
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+
+>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+
+[!include[Prerelease information](prerelease.md)]
+
+Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration. Use this reference to check the latest assessment results and determine whether device are compliant.
+
+For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
+
+| Column name | Data type | Description |
+|-------------|-----------|-------------|
+| MachineId | string | Unique identifier for the machine in the service |
+| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
+| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
+| Timestamp | datetime |Date and time when the record was generated|
+| ConfigurationId | string | Unique identifier for a specific configuration |
+| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
+| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
+| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
+| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured |
+
+
+## Related topics
+
+- [Advanced hunting overview](overview-hunting.md)
+- [All Advanced hunting tables](advanced-hunting-reference.md)
+- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
+- [Query data using Advanced hunting](advanced-hunting.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md
new file mode 100644
index 0000000000..857a5731c6
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md
@@ -0,0 +1,53 @@
+---
+title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema
+description: Learn about the DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema, security configuration details, and the associated industry benchmarks that it adheres to.
+keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, MITRE ATT&CK framework, DeviceTvmSecureConfigurationAssessmentKB
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dolmont
+author: DulceMontemayor
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 10/27/2019
+---
+
+# DeviceTvmSecureConfigurationAssessmentKB
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+
+>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+
+[!include[Prerelease information](prerelease.md)]
+
+The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configuration TVM checks during assessments related to your organization. An example of a security configuration is to block JavaScript or VBScript from launching downloaded executable content to prevent accidentally downloading malicious files in your network. Use this reference to construct queries that return information from the table.
+
+For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
+
+| Column name | Data type | Description |
+|-------------|-----------|-------------|
+| ConfigurationId | string | Unique identifier for a specific configuration |
+| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
+| ConfigurationName | string | Display name of the configuration |
+| ConfigurationDescription | string | Description of the configuration |
+| RiskDescription | string | Description of the associated risk |
+| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
+| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
+| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration |
+| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques related to the configuration |
+| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics related to the configuration|
+
+## Related topics
+
+- [Advanced hunting overview](overview-hunting.md)
+- [All Advanced hunting tables](advanced-hunting-reference.md)
+- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
+- [Query data using Advanced hunting](advanced-hunting.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md
new file mode 100644
index 0000000000..fcf0c2e4bd
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md
@@ -0,0 +1,56 @@
+---
+title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema
+description: Learn about the DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema, such as operating system platform, version, and architecture, software vendor, name, and version, CVE ID, vulnerability severity, and descriptions
+keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software inventory, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareInventoryVulnerabilities
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dolmont
+author: DulceMontemayor
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 10/27/2019
+---
+
+# DeviceTvmSoftwareInventoryVulnerabilities
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+
+>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+
+
+[!include[Prerelease information](prerelease.md)]
+
+The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains an inventory of the software on your devices as well as any known vulnerabilities in the software products. Use this reference to construct queries that return information from the table.
+
+For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
+
+| Column name | Data type | Description |
+|-------------|-----------|-------------|
+| MachineId | string | Unique identifier for the machine in the service |
+| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
+| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
+| OSVersion | string | Version of the operating system running on the machine |
+| OSArchitecture | string | Architecture of the operating system running on the machine|
+| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
+| SoftwareName | string | Name of the software product|
+|SoftwareVersion | string | Version number of the software product|
+| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system|
+| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
+
+
+
+## Related topics
+
+- [Advanced hunting overview](overview-hunting.md)
+- [All Advanced hunting tables](advanced-hunting-reference.md)
+- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
+- [Query data using Advanced hunting](advanced-hunting.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md
new file mode 100644
index 0000000000..757ad9858c
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md
@@ -0,0 +1,51 @@
+---
+title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema
+description: Learn about the DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema, such as CVE ID, CVSS score, exploit availability, vulnerability severity, last modified time, date the vulnerability was disclosed to public, and affected software in your network.
+keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareVulnerabilitiesKB
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dolmont
+author: DulceMontemayor
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 10/27/2019
+---
+
+# DeviceTvmSoftwareVulnerabilitiesKB
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+
+>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+
+[!include[Prerelease information](prerelease.md)]
+
+The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains information about the vulnerabilities Threat & Vulnerability Management assesses devices for. Use this reference along with DeviceTvmSoftwareInventoryVulnerabilities to construct queries that return information on the metadata related to the vulnerabilities in your inventory.
+
+For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
+
+| Column name | Data type | Description |
+|-------------|-----------|-------------|
+| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system|
+| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS)|
+| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available|
+| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
+| LastModifiedTime | datetime | Date and time the item or related metadata was last modified|
+| PublishedDate | datetime | Date vulnerability was disclosed to public|
+| VulnerabilityDescription | string | Description of vulnerability and associated risks|
+| AffectedSoftware | string | List of all software products affected by the vulnerability|
+
+## Related topics
+
+- [Advanced hunting overview](overview-hunting.md)
+- [All Advanced hunting tables](advanced-hunting-reference.md)
+- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
+- [Query data using Advanced hunting](advanced-hunting.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
index 010fb7a43b..7558960aa6 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
@@ -22,8 +22,6 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively.
The API Explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. You can also use the API Explorer to perform actions or find data that might not yet be available through the user interface.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md
index e526a20669..1e42b10a63 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md
@@ -33,7 +33,7 @@ API calls per connection | 100 | 60 seconds
Microsoft and any contributors grant you a license to the Microsoft documentation and other content in this repository under the Creative Commons Attribution 4.0 International Public License, see the LICENSE file.
-Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.
+Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at https://go.microsoft.com/fwlink/?LinkID=254653.
Privacy information can be found at https://privacy.microsoft.com/en-us/
Microsoft and any contributors reserve all others rights, whether under their respective copyrights, patents, or trademarks, whether by implication, estoppel or otherwise.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md
index 4eafbbefa8..6a076bfb65 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md
@@ -60,7 +60,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com
>- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071)
>
>To download the security updates:
->1. Go to [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/home.aspx).
+>1. Go to [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/home.aspx).
>2. Key-in the security update KB number that you need to download, then click **Search**.
## Related topics
@@ -68,7 +68,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
- [Exposure score](tvm-exposure-score.md)
- [Security recommendations](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md
index d0dfe6add3..2373d0cf56 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md
@@ -33,10 +33,10 @@ The topics in this section describe how to configure attack surface reduction. E
Topic | Description
-|-
-[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to preprare for and install Application Guard, including hardware and softeware requirements
-[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and potect kernel mode processes
+[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements
+[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and protect kernel mode processes
[Exploit protection](./enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps
-[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to acces dangerous domains
+[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to access dangerous domains
[Controlled folder access](./enable-controlled-folders.md)|How to protect valuable data from malicious apps
-[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used for by exploit-seeking malware
+[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used by exploit-seeking malware
[Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)|How to protect devices and data across a network
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
index 584f376ee3..6140a832e2 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
@@ -23,10 +23,11 @@ ms.topic: article
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
## Before you begin
-Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
+Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
+
+>[!NOTE]
+>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration.
## Register to Microsoft Threat Experts managed threat hunting service
If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal.
@@ -63,9 +64,6 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
->[!NOTE]
->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved.
-
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
>[!NOTE]
@@ -77,10 +75,12 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
>
->A flyout screen opens.
-
+>A flyout screen opens. The following screen shows when you are on a trial subscription.
>
+> The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription.
+>
+
>The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request.
3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation.
@@ -120,7 +120,7 @@ Response from Microsoft Threat Experts varies according to your inquiry. They wi
- Investigation requires more time
- Initial information was enough to conclude the investigation
-It is crucial to respond in a timely manner to keep the investigation moving. See the Premier customer service and support service level agreement for details.
+It is crucial to respond in a timely manner to keep the investigation moving.
## Related topic
- [Microsoft Threat Experts overview](microsoft-threat-experts.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
index 8c0c0aa43c..698e0aeb8d 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
@@ -111,7 +111,7 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
-|-
Common URLs for all locations | ```crl.microsoft.com```
```ctldl.windowsupdate.com```
```events.data.microsoft.com```
```notify.windows.com```
```settings-win.data.microsoft.com```
European Union | ```eu.vortex-win.data.microsoft.com```
```eu-v20.events.data.microsoft.com```
```usseu1northprod.blob.core.windows.net```
```usseu1westprod.blob.core.windows.net```
```winatp-gw-neu.microsoft.com```
```winatp-gw-weu.microsoft.com```
```wseu1northprod.blob.core.windows.net```
```wseu1westprod.blob.core.windows.net```
-United Kingdom | ```uk.vortex-win.data.microsoft.com```
```uk-v20.events.data.microsoft.com```
```ussuk1southprod. blob.core.windows.net```
```ussuk1westprod. blob.core.windows.net```
```winatp-gw-uks.microsoft.com```
```winatp-gw-ukw.microsoft.com```
```wsuk1southprod. blob.core.windows.net```
```wsuk1westprod. blob.core.windows.net```
+United Kingdom | ```uk.vortex-win.data.microsoft.com```
```uk-v20.events.data.microsoft.com```
```ussuk1southprod.blob.core.windows.net```
```ussuk1westprod.blob.core.windows.net```
```winatp-gw-uks.microsoft.com```
```winatp-gw-ukw.microsoft.com```
```wsuk1southprod.blob.core.windows.net```
```wsuk1westprod.blob.core.windows.net```
United States | ```us.vortex-win.data.microsoft.com```
```ussus1eastprod.blob.core.windows.net```
```ussus1westprod.blob.core.windows.net```
```ussus2eastprod.blob.core.windows.net```
```ussus2westprod.blob.core.windows.net```
```ussus3eastprod.blob.core.windows.net```
```ussus3westprod.blob.core.windows.net```
```ussus4eastprod.blob.core.windows.net```
```ussus4westprod.blob.core.windows.net```
```us-v20.events.data.microsoft.com```
```winatp-gw-cus.microsoft.com```
```winatp-gw-eus.microsoft.com```
```wsus1eastprod.blob.core.windows.net```
```wsus1westprod.blob.core.windows.net```
```wsus2eastprod.blob.core.windows.net```
```wsus2westprod.blob.core.windows.net```
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
@@ -141,7 +141,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
1. Download the [connectivity verification tool](https://aka.ms/mdatpanalyzer) to the PC where Microsoft Defender ATP sensor is running on.
-2. Extract the contents of WDATPConnectivityAnalyzer on the machine.
+2. Extract the contents of MDATPClientAnalyzer on the machine.
3. Open an elevated command-line:
@@ -152,19 +152,19 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
4. Enter the following command and press **Enter**:
```PowerShell
- HardDrivePath\WDATPConnectivityAnalyzer.cmd
+ HardDrivePath\MDATPClientAnalyzer.cmd
```
- Replace *HardDrivePath* with the path where the WDATPConnectivityAnalyzer tool was downloaded to, for example
+ Replace *HardDrivePath* with the path where the MDATPClientAnalyzer tool was downloaded to, for example
```PowerShell
- C:\Work\tools\WDATPConnectivityAnalyzer\WDATPConnectivityAnalyzer.cmd
+ C:\Work\tools\MDATPClientAnalyzer\MDATPClientAnalyzer.cmd
```
-5. Extract the *WDATPConnectivityAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*.
+5. Extract the *MDATPClientAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*.
-6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.
- The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example:
+6. Open *MDATPClientAnalyzerResult.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.
+ The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *MDATPClientAnalyzerResult.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example:
```text
Testing URL : https://xxx.microsoft.com/xxx
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md
index 7e89edf437..45538af5d0 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md
@@ -28,7 +28,7 @@ ms.topic: article
- Windows Server, 2019
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
+> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console.
@@ -43,6 +43,9 @@ The service supports the onboarding of the following servers:
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
+> [!NOTE]
+> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services)
+
## Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016
There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
@@ -70,19 +73,19 @@ You'll need to take the following steps if you choose to onboard servers through
- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
- >[!NOTE]
- >This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
+> [!NOTE]
+> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
- Turn on server monitoring from Microsoft Defender Security Center.
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
->[!TIP]
+> [!TIP]
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
### Configure and update System Center Endpoint Protection clients
->[!IMPORTANT]
->This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
+> [!IMPORTANT]
+> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
Microsoft Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
@@ -138,8 +141,8 @@ Agent Resource | Ports
## Windows Server, version 1803 and Windows Server 2019
To onboard Windows Server, version 1803 or Windows Server 2019, please refer to the supported methods and versions below.
->[!NOTE]
->The Onboarding package for Windows Server 2019 through System Center Configuration Manager currently ships a script. For more information on how to deploy scripts in System Center Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs).
+> [!NOTE]
+> The Onboarding package for Windows Server 2019 through System Center Configuration Manager currently ships a script. For more information on how to deploy scripts in System Center Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs).
Supported tools include:
- Local script
@@ -178,21 +181,18 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh
## Integration with Azure Security Center
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
->[!NOTE]
->You'll need to have the appropriate license to enable this feature.
-
The following capabilities are included in this integration:
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
- >[!NOTE]
- > Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
+> [!NOTE]
+> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
->[!IMPORTANT]
->- When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
->- If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
+> [!IMPORTANT]
+> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
+> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
@@ -203,8 +203,8 @@ For other server versions, you have two options to offboard servers from the ser
- Uninstall the MMA agent
- Remove the Microsoft Defender ATP workspace configuration
->[!NOTE]
->Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
+> [!NOTE]
+> Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
### Uninstall servers by uninstalling the MMA agent
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
index 97adf97d65..20a35409f5 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
@@ -22,7 +22,6 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
Connected applications integrates with the Microsoft Defender ATP platform using APIs.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
index 97a6409ed0..7f23be0e27 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
@@ -83,8 +83,8 @@ You can use the following procedure to enable network protection on domain-joine
You can confirm network protection is enabled on a local computer by using Registry editor:
1. Click **Start** and type **regedit** to open **Registry Editor**.
-1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
-1. Click **EnableNetworkProtection** and confirm the value:
+2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
+3. Click **EnableNetworkProtection** and confirm the value:
* 0=Off
* 1=On
* 2=Audit
diff --git a/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md
new file mode 100644
index 0000000000..94b0798855
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md
@@ -0,0 +1,153 @@
+---
+title: Enable Microsoft Defender ATP Insider Machine
+description: Install and use Microsoft Defender ATP for Mac.
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dansimp
+author: dansimp
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: conceptual
+---
+
+# Enable Microsoft Defender ATP Insider Machine
+
+Endpoint detection and response capabilities in Microsoft Defender ATP for Mac are now in preview. To get these and other preview features, you must set up your Mac machine to be an "Insider" machine as described in this article. For scale deployment, we recommend using [Jamf](#enable-the-insider-program-with-jamf) or [Intune](#enable-the-insider-program-with-intune).
+
+>[!IMPORTANT]
+>Make sure you have enabled [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md#how-to-install-microsoft-defender-atp-for-mac), and pay attention to the “earlyPreview” flag. See documentation for [Jamf](mac-install-with-jamf.md), [Intune](mac-install-with-intune.md) and [manual deployment](mac-install-manually.md) instructions.
+
+## Enable the Insider program with Jamf
+
+a. Create configuration profile com.microsoft.wdav.plist with the following content:
+
+```XML
+
+
+
+
+ edr
+
+ earlyPreview
+
+
+
+
+```
+
+b. From the JAMF console, navigate to **Computers > Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**.
+
+c. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist created earlier.
+
+>[!WARNING]
+>You must enter the correct preference domain (com.microsoft.wdav), otherwise the preferences will not be recognized by the product
+
+## Enable the Insider program with Intune
+
+a. Create configuration profile com.microsoft.wdav.plist with the following content:
+
+ ```XML
+
+
+
+
+ PayloadUUID
+ C4E6A782-0C8D-44AB-A025-EB893987A295
+ PayloadType
+ Configuration
+ PayloadOrganization
+ Microsoft
+ PayloadIdentifier
+ com.microsoft.wdav
+ PayloadDisplayName
+ Microsoft Defender ATP settings
+ PayloadDescription
+ Microsoft Defender ATP configuration settings
+ PayloadVersion
+ 1
+ PayloadEnabled
+
+ PayloadRemovalDisallowed
+
+ PayloadScope
+ System
+ PayloadContent
+
+
+ PayloadUUID
+ 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295
+ PayloadType
+ com.microsoft.wdav
+ PayloadOrganization
+ Microsoft
+ PayloadIdentifier
+ com.microsoft.wdav
+ PayloadDisplayName
+ Microsoft Defender ATP configuration settings
+ PayloadDescription
+
+ PayloadVersion
+ 1
+ PayloadEnabled
+
+ edr
+
+ earlyPreview
+
+
+
+
+
+
+```
+
+b. Open **Manage > Device configuration**. Select **Manage > Profiles > Create Profile**.
+
+c. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**.
+
+d. Save the .plist created earlier as com.microsoft.wdav.xml.
+
+e. Enter com.microsoft.wdav as the custom configuration profile name.
+
+f. Open the configuration profile and upload com.microsoft.wdav.xml. This file was created in step 1.
+
+g. Select **OK**.
+
+h. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
+
+>[!WARNING]
+>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product.
+
+## Enable the Insider program manually on a single machine
+
+In the command prompt, run:
+
+```bash
+ mdatp --edr --early-preview true
+ ```
+
+## Troubleshooting
+
+### Verify you are running the correct version
+
+To verify you are running the correct version, run ‘mdatp --health’ on the machine.
+
+* The required version is 100.72.15 or later.
+* If the version is not as expected, verify that Microsoft Auto Update is set to automatically download and install updates by running ‘defaults read com.microsoft.autoupdate2’ from terminal.
+* To change update settings use documentation in [Update Office for Mac automatically](https://support.office.com/article/update-office-for-mac-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1).
+* If you are not using Office for Mac, download and run the AutoUpdate tool.
+
+### A machine still does not appear on Microsoft Defender Security Center
+
+After a successful deployment and onboarding of the correct version, check that the machine has connectivity to the cloud service by running ‘mdatp --connectivity-test’.
+
+* Check that you enabled the early preview flag. In terminal run “mdatp –health” and look for the value of “edrEarlyPreviewEnabled”. It should be “Enabled”.
+
+If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the [manual deployment documentation](mac-install-manually.md#application-installation) and use the “Manual Deployment” section in the [troubleshoot kernel extension documentation](mac-support-kext.md#manual-deployment).
\ No newline at end of file
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png
new file mode 100644
index 0000000000..aecffb5789
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/threat-protection-reports.png b/windows/security/threat-protection/microsoft-defender-atp/images/threat-protection-reports.png
new file mode 100644
index 0000000000..026a246309
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/threat-protection-reports.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png
new file mode 100644
index 0000000000..27b00fdd87
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png
new file mode 100644
index 0000000000..d0eb92e377
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png
new file mode 100644
index 0000000000..3f8ead879c
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png
new file mode 100644
index 0000000000..9acba5c77f
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png
new file mode 100644
index 0000000000..31d16836b0
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png
new file mode 100644
index 0000000000..6cafba6c3d
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png
new file mode 100644
index 0000000000..e01d9f53a5
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png
new file mode 100644
index 0000000000..072835588a
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png
new file mode 100644
index 0000000000..dbd99451af
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png
new file mode 100644
index 0000000000..98d59f5c07
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png
new file mode 100644
index 0000000000..00d29b4a0c
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png
index a40e39c3d0..2f9717883f 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png
new file mode 100644
index 0000000000..36ca63f7bf
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png
index ebd390bd98..863c7e4fbe 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png
index b87ba02a90..e81d73f631 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md
index c46302a04f..38b96e9451 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md
@@ -53,6 +53,9 @@ When you have configured exploit protection to your desired state (including bot
3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved.
+> [!IMPORTANT]
+> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file.
+
> [!NOTE]
diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md
new file mode 100644
index 0000000000..2dda7ca218
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md
@@ -0,0 +1,81 @@
+---
+title: Configure and validate exclusions for Microsoft Defender ATP for Mac
+description: Provide and validate exclusions for Microsoft Defender ATP for Mac. Exclusions can be set for files, folders, and processes.
+keywords: microsoft, defender, atp, mac, exclusions, scans, antivirus
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dansimp
+author: dansimp
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: conceptual
+---
+
+# Configure and validate exclusions for Microsoft Defender ATP for Mac
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
+
+This article provides information on how to define exclusions that apply to on-demand scans, and real-time protection and monitoring.
+
+>[!IMPORTANT]
+>The exclusions described in this article don't apply to other Microsoft Defender ATP for Mac capabilities, including endpoint detection and response (EDR). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections.
+
+You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender ATP for Mac scans.
+
+Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. They can also be useful for mitigating performance issues caused by Microsoft Defender ATP for Mac.
+
+>[!WARNING]
+>Defining exclusions lowers the protection offered by Microsoft Defender ATP for Mac. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
+
+## Supported exclusion types
+
+The follow table shows the exclusion types supported by Microsoft Defender ATP for Mac.
+
+Exclusion | Definition | Examples
+---|---|---
+File extension | All files with the extension, anywhere on the machine | .test
+File | A specific file identified by the full path | /var/log/test.log
+Folder | All files under the specified folder | /var/log/
+Process | A specific process (specified either by the full path or file name) and all files opened by it | /bin/cat
cat
+
+## How to configure the list of exclusions
+
+### From the management console
+
+For more information on how to configure exclusions from JAMF, Intune, or another management console, see [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md).
+
+### From the user interface
+
+Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot:
+
+
+
+Select the type of exclusion that you wish to add and follow the prompts.
+
+## Validate exclusions lists with the EICAR test file
+
+You can validate that your exclusion lists are working by using `curl` to download a test file.
+
+In the following Bash snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the *.testing extension*, replace *test.txt* with *test.testing*. If you are testing a path, ensure that you run the command within that path.
+
+```bash
+$ curl -o test.txt http://www.eicar.org/download/eicar.com.txt
+```
+
+If Microsoft Defender ATP for Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html).
+
+If you do not have internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
+
+```bash
+echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt
+```
+
+You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md
similarity index 53%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md
index bed05f108c..117296a474 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md
@@ -1,8 +1,7 @@
---
-title: Installing Microsoft Defender ATP for Mac manually
-ms.reviewer:
-description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line.
-keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra
+title: Manual deployment for Microsoft Defender ATP for Mac
+description: Install Microsoft Defender ATP for Mac manually, from the command line.
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -18,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# Manual deployment
+# Manual deployment for Microsoft Defender ATP for Mac
**Applies to:**
@@ -42,7 +41,7 @@ Download the installation and onboarding packages from Windows Defender Security
3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory.
4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
- 
+ 
5. From a command prompt, verify that you have the two files.
Extract the contents of the .zip files:
@@ -63,83 +62,28 @@ To complete this process, you must have admin privileges on the machine.
1. Navigate to the downloaded wdav.pkg in Finder and open it.
- 
+ 
2. Select **Continue**, agree with the License terms, and enter the password when prompted.
- 
+ 
> [!IMPORTANT]
- > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed.
+ > You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed.
- 
+ 
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
- 
+ 
The installation proceeds.
-> [!NOTE]
-> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled.
+> [!CAUTION]
+> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but some features, such as real-time protection, will be disabled. See [Troubleshoot kernel extension issues](mac-support-kext.md) for information on how to resolve this.
> [!NOTE]
-> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted.
-
-### Fixing disabled Real-Time Protection
-
-If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it:
-
- 
-
-You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available:
-
-```bash
-$ mdatp --health
-...
-realTimeProtectionAvailable : false
-realTimeProtectionEnabled : true
-...
-```
-
-> [!NOTE]
-> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation.
-
-The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation".
-
-If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled:
-
-
-
-In this case, you need to perform the following steps to enable Real-Time Protection instead.
-
-1. In Terminal, attempt to install the driver. (The operation will fail)
- ```bash
- $ sudo kextutil /Library/Extensions/wdavkext.kext
- Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
- Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
- Diagnostics for /Library/Extensions/wdavkext.kext:
- ```
-
-2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.)
-
-3. **Allow** system software from developers "Microsoft Corporation"
-
-4. In Terminal, install the driver again. This time the operation will succeed:
-
-```bash
-$ sudo kextutil /Library/Extensions/wdavkext.kext
-```
-
-The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available:
-
-```bash
-$ mdatp --health
-...
-realTimeProtectionAvailable : true
-realTimeProtectionEnabled : true
-...
-```
+> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-time protection will not be available until the machine is rebooted.
## Client configuration
@@ -167,7 +111,7 @@ realTimeProtectionEnabled : true
After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner.
- 
+ 
## How to Allow Full Disk Access
@@ -178,8 +122,8 @@ To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Fu
## Logging installation issues
-See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
+See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
## Uninstallation
-See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices.
+See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md
similarity index 85%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md
index 84e9cb78dd..6a79d9fca6 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md
@@ -1,8 +1,7 @@
---
-title: Installing Microsoft Defender ATP for Mac with Microsoft Intune
-ms.reviewer:
-description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune.
-keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra
+title: Intune-based deployment for Microsoft Defender ATP for Mac
+description: Install Microsoft Defender ATP for Mac, using Microsoft Intune.
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -18,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# Microsoft Intune-based deployment
+# Intune-based deployment for Microsoft Defender ATP for Mac
**Applies to:**
@@ -44,7 +43,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos).
- 
+ 
6. From a command prompt, verify that you have the three files.
Extract the contents of the .zip files:
@@ -91,11 +90,11 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
1. You are asked to confirm device management.
-
+
Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**:
-
+
2. Select **Continue** and complete the enrollment.
@@ -103,7 +102,7 @@ You may now enroll more devices. You can also enroll them later, after you have
3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed:
-
+
## Create System Configuration profiles
@@ -112,7 +111,7 @@ You may now enroll more devices. You can also enroll them later, after you have
3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.
4. Select **OK**.
- 
+ 
5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
6. Repeat steps 1 through 5 for more profiles.
@@ -287,7 +286,7 @@ You may now enroll more devices. You can also enroll them later, after you have
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
-
+
## Publish application
@@ -295,43 +294,43 @@ Once the Intune changes are propagated to the enrolled devices, you can see them
2. Select **App type=Other/Line-of-business app**.
3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload.
4. Select **Configure** and add the required information.
-5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value.
+5. Use **macOS High Sierra 10.13** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value.
> [!CAUTION]
- > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated.
+ > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated.
- 
+ 
6. Select **OK** and **Add**.
- 
+ 
7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**.
- 
+ 
8. Change **Assignment type** to **Required**.
9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
- 
+ 
10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**:
- 
+ 
## Verify client device state
1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device.
- 
- 
+ 
+ 
2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune:
- 
+ 
3. You should also see the Microsoft Defender icon in the top-right corner:
- 
+ 
## Troubleshooting
@@ -341,8 +340,8 @@ Solution: Follow the steps above to create a device profile using WindowsDefende
## Logging installation issues
-For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) .
+For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](mac-resources.md#logging-installation-issues) .
## Uninstallation
-See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices.
+See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md
similarity index 85%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md
index 99a5b6cc89..259e8692cd 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md
@@ -1,8 +1,7 @@
---
-title: Installing Microsoft Defender ATP for Mac with JAMF
-ms.reviewer:
-description: Describes how to install Microsoft Defender ATP for Mac, using JAMF.
-keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra
+title: JAMF-based deployment for Microsoft Defender ATP for Mac
+description: Install Microsoft Defender ATP for Mac, using JAMF.
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -18,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# JAMF-based deployment
+# JAMF-based deployment for Microsoft Defender ATP for Mac
**Applies to:**
@@ -46,7 +45,7 @@ Download the installation and onboarding packages from Windows Defender Security
3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
- 
+ 
5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so:
@@ -79,7 +78,7 @@ To set the onboarding information, add a property list file with the name, _jamf
>[!IMPORTANT]
> You must set the Preference Domain as "com.microsoft.wdav.atp"
-
+
### Approved Kernel Extension
@@ -88,7 +87,7 @@ To approve the kernel extension:
1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**.
2. Use **UBF8T346G9** for Team Id.
-
+
### Privacy Preferences Policy Control
@@ -104,7 +103,7 @@ Add the following JAMF policy to grant Full Disk Access to Microsoft Defender AT
3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`.
4. Set app or service to SystemPolicyAllFiles and access to Allow.
-
+
#### Configuration Profile's Scope
@@ -112,7 +111,7 @@ Configure the appropriate scope to specify the devices that will receive the con
Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target.
-
+
Save the **Configuration Profile**.
@@ -132,7 +131,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific
1. Create a package in **Settings > Computer Management > Packages**.
- 
+ 
2. Upload the package to the Distribution Point.
3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_.
@@ -141,7 +140,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific
Your policy should contain a single package for Microsoft Defender.
-
+
Configure the appropriate scope to specify the computers that will receive this policy.
@@ -156,12 +155,12 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA
1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile.
-
-
+
+
After a moment, the device's User Approved MDM status will change to **Yes**.
-
+
You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages.
@@ -176,17 +175,17 @@ You can monitor deployment status in the **Logs** tab:
- **Pending** means that the deployment is scheduled but has not yet happened
- **Completed** means that the deployment succeeded and is no longer scheduled
-
+
### Status on client device
After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**.
-
+
Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner.
-
+
You can monitor policy installation on a device by following the JAMF log file:
@@ -231,11 +230,11 @@ If the product is not healthy, the exit code (which can be checked through `echo
## Logging installation issues
-See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
+See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
## Uninstallation
-This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling).
+This method is based on the script described in [Uninstalling](mac-resources.md#uninstalling).
### Script
@@ -258,12 +257,12 @@ This script removes Microsoft Defender ATP from the /Applications directory:
echo "Done!"
```
-
+
### Policy
Your policy should contain a single script:
-
+
Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md
similarity index 77%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md
index 91a5f56395..d67b31e398 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md
@@ -1,7 +1,7 @@
---
-title: Installing Microsoft Defender ATP for Mac with different MDM product
-description: Describes how to install Microsoft Defender ATP for Mac on other management solutions.
-keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra
+title: Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac
+description: Install Microsoft Defender ATP for Mac on other management solutions.
+keywords: microsoft, defender, atp, mac, installation, deploy, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# Deployment with a different Mobile Device Management (MDM) system
+# Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac
**Applies to:**
@@ -49,21 +49,21 @@ You can deploy Defender without the last requirement from the preceding list, ho
## Deployment
-Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template.
+Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](mac-install-with-jamf.md) as a template.
### Package
-Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package),
-with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages).
+Configure deployment of a [required application package](mac-install-with-jamf.md#package),
+with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages).
In order to deploy the package to your enterprise, use the instructions associated with your MDM solution.
### License settings
-Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile).
+Set up [a system configuration profile](mac-install-with-jamf.md#configuration-profile).
Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS.
-Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages).
+Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages).
Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case.
Alternatively, it may require you to convert the property list to a different format first.
@@ -76,4 +76,4 @@ Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to
## Check installation status
-Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status.
+Run [mdatp](mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md
similarity index 96%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md
index 80ec6a0f67..0d0904ba75 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md
@@ -1,8 +1,7 @@
---
title: Set preferences for Microsoft Defender ATP for Mac
-ms.reviewer:
-description: Describes how to configure Microsoft Defender ATP for Mac in enterprises.
-keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra
+description: Configure Microsoft Defender ATP for Mac in enterprises.
+keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -25,7 +24,7 @@ ms.topic: conceptual
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
>[!IMPORTANT]
->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page.
+>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](mac-resources.md#configuring-from-the-command-line) page.
In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile.
@@ -262,6 +261,28 @@ Whether the status menu icon (shown in the top-right corner of the screen) is hi
| **Data type** | Boolean |
| **Possible values** | false (default)
true |
+### EDR preferences
+
+The *edr* section of the configuration profile is used to manage the preferences of the EDR component of the product.
+
+|||
+|:---|:---|
+| **Domain** | com.microsoft.wdav |
+| **Key** | edr |
+| **Data type** | Dictionary (nested preference) |
+| **Comments** | See the following sections for a description of the dictionary contents. |
+
+#### Enable / disable early preview
+
+Whether EDR early preview features are enabled or not.
+
+|||
+|:---|:---|
+| **Domain** | com.microsoft.wdav |
+| **Key** | earlyPreview |
+| **Data type** | Boolean |
+| **Possible values** | true (default)
false |
+
## Recommended configuration profile
To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md
similarity index 98%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md
index 0c56970e6f..ab118ea2ca 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md
@@ -1,7 +1,6 @@
---
title: Privacy for Microsoft Defender ATP for Mac
-ms.reviewer:
-description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac.
+description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac.
keywords: microsoft, defender, atp, mac, privacy, diagnostic
search.product: eADQiWindows 10XVcnh
search.appverid: met150
@@ -62,7 +61,7 @@ When this feature is enabled and the sample that is collected is likely to conta
If you're an IT administrator, you might want to configure these controls at the enterprise level.
-The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md).
+The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md).
As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md
similarity index 82%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-pua.md
index 2696590c99..0f63486ad1 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md
@@ -1,7 +1,6 @@
---
-title: Detect and block potentially unwanted applications
-ms.reviewer:
-description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac.
+title: Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac
+description: Detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac.
keywords: microsoft, defender, atp, mac, pua, pus
search.product: eADQiWindows 10XVcnh
search.appverid: met150
@@ -18,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# Detect and block potentially unwanted applications
+# Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac
**Applies to:**
@@ -59,8 +58,8 @@ $ mdatp --threat --type-handling potentially_unwanted_application [off|audit|blo
### Use the management console to configure PUA protection:
-In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic.
+In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md) topic.
## Related topics
-- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md)
\ No newline at end of file
+- [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
similarity index 84%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
index f37fa94b99..ad4bf7ef53 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md
@@ -1,8 +1,7 @@
---
-title: Microsoft Defender ATP for Mac Resources
-ms.reviewer:
-description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product.
-keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra
+title: Resources for Microsoft Defender ATP for Mac
+description: Resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product.
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -18,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
---
-# Resources
+# Resources for Microsoft Defender ATP for Mac
**Applies to:**
@@ -95,18 +94,24 @@ Important tasks, such as controlling product settings and triggering on-demand s
|Protection |Do a full scan |`mdatp --scan --full` |
|Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` |
|Protection |Request a security intelligence update |`mdatp --definition-update` |
+|EDR |Turn on/off EDR preview for Mac |`mdatp --edr --early-preview [true/false]` |
+|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --edr --set-tag GROUP [name]` |
+|EDR |Remove group tag from machine |`mdatp --edr --remove-tag [name]` |
## Microsoft Defender ATP portal information
-In the Microsoft Defender ATP portal, you'll see two categories of information:
+In the Microsoft Defender ATP portal, you'll see two categories of information.
+
+Antivirus alerts, including:
-- Antivirus alerts, including:
- Severity
- Scan type
- Device information (hostname, machine identifier, tenant identifier, app version, and OS type)
- File information (name, path, size, and hash)
- Threat information (name, type, and state)
-- Device information, including:
+
+Device information, including:
+
- Machine identifier
- Tenant identifier
- App version
diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md
new file mode 100644
index 0000000000..bbf4825f45
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md
@@ -0,0 +1,90 @@
+---
+title: Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac
+description: Troubleshoot kernel extension-related issues in Microsoft Defender ATP for Mac.
+keywords: microsoft, defender, atp, mac, kernel, extension
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dansimp
+author: dansimp
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: conceptual
+---
+
+# Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
+
+This topic provides information on how to troubleshoot issues with the kernel extension that is installed as part of Microsoft Defender ATP for Mac.
+
+Starting with macOS High Sierra (10.13), macOS requires all kernel extensions to be explicitly approved before they are allowed to run on the device.
+
+If you did not approve the kernel extension during the deployment / installation of Microsoft Defender ATP for Mac, then the application displays a banner prompting you to enable it:
+
+ 
+
+You can also run ```mdatp --health```. It reports if real-time protection is enabled but not available. This is an indication that the kernel extension is not approved to run on your device.
+
+```bash
+$ mdatp --health
+...
+realTimeProtectionAvailable : false
+realTimeProtectionEnabled : true
+...
+```
+
+The following sections provide guidance on how to address this issue, depending on the method that you used to deploy Microsoft Defender ATP for Mac.
+
+## Managed deployment
+
+See the instructions corresponding to the management tool that you used to deploy the product:
+
+- [JAMF-based deployment](mac-install-with-jamf.md#configuration-profile)
+- [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles)
+
+## Manual deployment
+
+If less than 30 minutes have passed since the product was installed, navigate to **System Preferences** > **Security & Privacy**, where you have to **Allow** system software from developers "Microsoft Corporation".
+
+If you don't see this prompt, it means that 30 or more minutes have passed, and the kernel extension still not been approved to run on your device:
+
+
+
+In this case, you need to perform the following steps to trigger the approval flow again.
+
+1. In Terminal, attempt to install the driver. The following operation will fail, because the kernel extension was not approved to run on the device, however it will trigger the approval flow again.
+
+ ```bash
+ $ sudo kextutil /Library/Extensions/wdavkext.kext
+ Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
+ Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
+ Diagnostics for /Library/Extensions/wdavkext.kext:
+ ```
+
+2. Open **System Preferences** > **Security & Privacy** from the menu. (Close it first, if it's opened.)
+
+3. **Allow** system software from developers "Microsoft Corporation"
+
+4. In Terminal, install the driver again. This time the operation will succeed:
+
+```bash
+$ sudo kextutil /Library/Extensions/wdavkext.kext
+```
+
+The banner should disappear from the Defender application, and ```mdatp --health``` should now report that real-time protection is both enabled and available:
+
+```bash
+$ mdatp --health
+...
+realTimeProtectionAvailable : true
+realTimeProtectionEnabled : true
+...
+```
\ No newline at end of file
diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md
new file mode 100644
index 0000000000..3d1a203e82
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md
@@ -0,0 +1,54 @@
+---
+title: Troubleshoot performance issues for Microsoft Defender ATP for Mac
+description: Troubleshoot performance issues in Microsoft Defender ATP for Mac.
+keywords: microsoft, defender, atp, mac, performance
+search.product: eADQiWindows 10XVcnh
+search.appverid: met150
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: dansimp
+author: dansimp
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: conceptual
+---
+
+# Troubleshoot performance issues for Microsoft Defender ATP for Mac
+
+**Applies to:**
+
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
+
+This topic provides some general steps that can be used to narrow down performance issues related to Microsoft Defender ATP for Mac.
+
+Real-time protection (RTP) is a feature of Microsoft Defender ATP for Mac that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics.
+
+Depending on the applications that you are running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender ATP for Mac. In particular, applications or system processes that access many resources over a short timespan can lead to performance issues in Microsoft Defender ATP for Mac.
+
+The following steps can be used to troubleshoot and mitigate these issues:
+
+1. Disable real-time protection using one of the following methods and observe whether the performance improves. This approach helps narrow down whether Microsoft Defender ATP for Mac is contributing to the performance issues.
+
+ If your device is not managed by your organization, real-time protection can be disabled using one of the following options:
+
+ - From the user interface. Open Microsoft Defender ATP for Mac and navigate to **Manage settings**.
+
+ 
+
+ - From the Terminal. For security purposes, this operation requires elevation.
+
+ ```bash
+ $ mdatp --config realTimeProtectionEnabled false
+ ```
+
+ If your device is managed by your organization, real-time protection can be disabled by your administrator using the instructions in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md).
+
+2. Open Finder and navigate to **Applications** > **Utilities**. Open **Activity Monitor** and analyze which applications are using the resources on your system. Typical examples include software updaters and compilers.
+
+3. Configure Microsoft Defender ATP for Mac with exclusions for the processes or disk locations that contribute to the performance issues and re-enable real-time protection.
+
+ See [Configure and validate exclusions for Microsoft Defender ATP for Mac](mac-exclusions.md) for details.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md
similarity index 97%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-updates.md
index 50267f26bb..7770111d6d 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md
@@ -1,7 +1,6 @@
---
title: Deploy updates for Microsoft Defender ATP for Mac
-ms.reviewer:
-description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments.
+description: Control updates for Microsoft Defender ATP for Mac in enterprise environments.
keywords: microsoft, defender, atp, mac, updates, deploy
search.product: eADQiWindows 10XVcnh
search.appverid: met150
@@ -28,7 +27,7 @@ Microsoft regularly publishes software updates to improve performance, security,
To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually.
-
+
If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md
similarity index 76%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md
rename to windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md
index 7312d11a2d..e229fbbd91 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md
@@ -1,6 +1,5 @@
---
-title: Microsoft Defender ATP for Mac What's New
-ms.reviewer:
+title: What's new in Microsoft Defender Advanced Threat Protection for Mac
description: List of major changes for Microsoft Defender ATP for Mac.
keywords: microsoft, defender, atp, mac, installation, macos, whatsnew
search.product: eADQiWindows 10XVcnh
@@ -20,13 +19,17 @@ ms.topic: conceptual
# What's new in Microsoft Defender Advanced Threat Protection for Mac
+## 100.72.15
+
+- Bug fixes
+
## 100.70.99
- Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender ATP locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence.
## 100.68.99
-- Added the ability to configure the antivirus functionality to run in [passive mode](microsoft-defender-atp-mac-preferences.md#enable--disable-passive-mode)
+- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enable--disable-passive-mode)
- Performance improvements & bug fixes
## 100.65.28
@@ -38,7 +41,7 @@ ms.topic: conceptual
>
> The mechanism for granting this consent depends on how you deployed Microsoft Defender ATP:
>
-> - For manual deployments, see the updated instructions in the [Manual deployment](microsoft-defender-atp-mac-install-manually.md#how-to-allow-full-disk-access) topic.
-> - For managed deployments, see the updated instructions in the [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md#create-system-configuration-profiles) topics.
+> - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic.
+> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics.
- Performance improvements & bug fixes
diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md
index f0cf3d6772..d006defd48 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md
@@ -23,7 +23,6 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink)
@@ -108,7 +107,7 @@ When you add an indicator hash for a file, you can choose to raise an alert and
Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue.
-## Create indicators for IPs and URLs/domains (preview)
+## Create indicators for IPs and URLs/domains
Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser.
The threat intelligence data set for this has been managed by Microsoft.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md
similarity index 63%
rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md
rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md
index f87f5332c7..c64de21b8c 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md
@@ -1,8 +1,8 @@
---
title: Microsoft Defender ATP for Mac
-ms.reviewer:
+ms.reviewer:
description: Describes how to install and use Microsoft Defender ATP for Mac.
-keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra
+keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -14,7 +14,7 @@ author: dansimp
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
-ms.collection: M365-security-compliance
+ms.collection: M365-security-compliance
ms.topic: conceptual
---
@@ -27,36 +27,56 @@ This topic describes how to install, configure, update, and use Microsoft Defend
## What’s new in the latest release
-[What's new](microsoft-defender-atp-mac-whatsnew.md)
+[What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md)
-If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**.
+[What's new in Microsoft Defender ATP for Mac](mac-whatsnew.md)
+
+> [!TIP]
+> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**.
+
+To get the latest features, including preview capabilities (such as endpoint detection and response for your Mac machines), configure your macOS machine running Microsoft Defender ATP to be an "Insider" machine. See [Enable Microsoft Defender ATP Insider Machine](endpoint-detection-response-mac-preview.md).
## How to install Microsoft Defender ATP for Mac
### Prerequisites
-- Access to the Microsoft Defender Security Center portal
+- A Microsoft Defender ATP subscription and access to the Microsoft Defender Security Center portal
- Beginner-level experience in macOS and BASH scripting
- Administrative privileges on the device (in case of manual deployment)
+### Installation instructions
+
+There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
+
+- Third-party management tools:
+ - [Microsoft Intune-based deployment](mac-install-with-intune.md)
+ - [JAMF-based deployment](mac-install-with-jamf.md)
+ - [Other MDM products](mac-install-with-other-mdm.md)
+
+- Command-line tool:
+ - [Manual deployment](mac-install-manually.md)
+
### System requirements
-> [!CAUTION]
-> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported.
+The three most recent major releases of macOS are supported.
-- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra)
+- 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra)
- Disk space: 650 MB
+Beta versions of macOS are not supported. macOS Sierra (10.12) support will end on January 1, 2020.
+
After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.
+### Network connections
+
The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
| Service location | DNS record |
| ---------------------------------------- | ----------------------- |
-| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net |
-| European Union | europe.x.cp.wd.microsoft.com |
-| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com |
-| United States | unitedstates.x.cp.wd.microsoft.com |
+| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net
crl.microsoft.com
events.data.microsoft.com |
+| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com |
+| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com |
+| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com |
Microsoft Defender ATP can discover a proxy server by using the following discovery methods:
- Web Proxy Auto-discovery Protocol (WPAD)
@@ -74,40 +94,28 @@ $ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'http
The output from this command should be similar to the following:
-> `OK https://x.cp.wd.microsoft.com/api/report`
->
-> `OK https://cdn.x.cp.wd.microsoft.com/ping`
+ `OK https://x.cp.wd.microsoft.com/api/report`
+
+ `OK https://cdn.x.cp.wd.microsoft.com/ping`
> [!CAUTION]
> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default.
-### Installation instructions
-
-There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
-
-In general you need to take the following steps:
-
-- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal
-- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods:
- - Via third-party management tools:
- - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md)
- - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md)
- - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md)
- - Via the command-line tool:
- - [Manual deployment](microsoft-defender-atp-mac-install-manually.md)
+Once Microsoft Defender ATP is installed, connectivity can be validated by running the following command in Terminal:
+```bash
+$ mdatp --connectivity-test
+```
## How to update Microsoft Defender ATP for Mac
-Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used.
-
-To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md)
+Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. To learn more, see [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md)
## How to configure Microsoft Defender ATP for Mac
-Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md).
+Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md).
## Resources
-- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page.
+- For more information about logging, uninstalling, or other topics, see the [Resources](mac-resources.md) page.
-- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md)
+- [Privacy for Microsoft Defender ATP for Mac](mac-privacy.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
index 71b44a53e7..358b596f33 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
@@ -22,11 +22,12 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
Microsoft Threat Experts is a managed detection and response (MDR) service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed.
This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand.
+
+>[!NOTE]
+>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details.
## Targeted attack notification
Microsoft Threat Experts provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyberespionage. The managed hunting service includes:
@@ -36,9 +37,6 @@ Microsoft Threat Experts provides proactive hunting for the most important threa
- Scope of compromise and as much context as can be quickly delivered to enable fast SOC response.
## Collaborate with experts, on demand
->[!NOTE]
->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved.
-
Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised machines, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can:
- Get additional clarification on alerts including root cause or scope of the incident
diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md
index 57782a8e2b..e9723fa61e 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md
@@ -37,7 +37,7 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr
- Windows 10 Enterprise E5
- Windows 10 Education E5
- Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5
-- Microsoft 365 E3 (M365 E3) with Identity and Threat Protection package
+
For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare).
diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md
index 3a670e00a5..eecae45f38 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md
@@ -62,7 +62,7 @@ Microsoft Defender ATP’s Threat & Vulnerability Management allows security adm
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
- [Security recommendations](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md
index ce96f68340..e403692a49 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md
@@ -55,11 +55,11 @@ You'll need to have access to:
- Method: "GET" as a value to get the list of machines.
- URI: Enter `https://api.securitycenter.windows.com/api/machines`.
- Authentication: Select "Active Directory OAuth".
- - Tenant: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
+ - Tenant: Sign-in to https://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
- Audience: `https://securitycenter.onmicrosoft.com/windowsatpservice\`
- - Client ID: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Client ID value.
+ - Client ID: Sign-in to https://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Client ID value.
- Credential Type: Select "Secret".
- - Secret: Sign-in to http://portal.azure.com and navigate tnd navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
+ - Secret: Sign-in to https://portal.azure.com and navigate tnd navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md
index 692f8cc37b..6d4a1e101e 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/preview.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md
@@ -42,17 +42,15 @@ Turn on the preview experience setting to be among the first to try upcoming fea
## Preview features
The following features are included in the preview release:
-- [Connected Azure AD applications](connected-applications.md)
The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization.
+- [Endpoint detection and response for Mac devices](endpoint-detection-response-mac-preview.md). Recently, [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md) released. Expanding on the protection available in Microsoft Defender ATP for Mac, endpoint detection and response capabilities are now in preview.
-- [API Explorer](api-explorer.md)
The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint.
+- [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy).
+
+- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase.
+
+ - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions.
-- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation.
-
-- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
You can now allow or block URLs/domains using your own threat intelligence.
-
-- [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac)
Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices.
-
-- [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy).
+- [Threat & Vulnerability Management granular exploit details](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
You can now see a comprehensive set of details on the vulnerabilities found in your machine to give you informed decision on your next steps. The threat insights icon now shows more granular details, such as if the exploit is a part of an exploit kit, connected to specific advanced persistent campaigns or activity groups for which, Threat Analytics report links are provided that you can read, has associated zero-day exploitation news, disclosures, or related security advisories.
- [Machine health and compliance report](machine-reports.md) The machine health and compliance report provides high-level information about the devices in your organization.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md
index f7512247e0..df00947476 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md
@@ -143,12 +143,40 @@ When an exception is created for a recommendation, the recommendation is no long
2. Click the top-most recommendation. A flyout panel opens with the recommendation details.
3. Click **Exception options**.
+
4. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration.
+> 
+
5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created.
+
6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past).
+
+
+## Use Advanced hunting query to search for machines with High active alerts or critical CVE public exploit
+
+1. Go to **Advanced hunting** from the left-hand navigation pane.
+
+2. Scroll down to the TVM advanced hunting schemas to familiarize yourself with the column names.
+
+3. Enter the following queries:
+
+```
+// Search for machines with High active alerts or Critical CVE public exploit
+DeviceTvmSoftwareInventoryVulnerabilities
+| join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId
+| where IsExploitAvailable == 1 and CvssScore >= 7
+| summarize NumOfVulnerabilities=dcount(CveId),
+ComputerName=any(ComputerName) by MachineId
+| join kind =inner(AlertEvents) on MachineId
+| summarize NumOfVulnerabilities=any(NumOfVulnerabilities),
+ComputerName=any(ComputerName) by MachineId, AlertId
+| project ComputerName, NumOfVulnerabilities, AlertId
+| order by NumOfVulnerabilities desc
+
+```
## Related topics
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
@@ -156,6 +184,8 @@ When an exception is created for a recommendation, the recommendation is no long
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
- [Security recommendations](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
+- [Advanced hunting overview](overview-hunting.md)
+- [All Advanced hunting tables](advanced-hunting-reference.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md
index b7440c607e..7a7e652415 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports.md
@@ -27,7 +27,7 @@ The threat protection report provides high-level information about alerts genera
The dashboard is structured into two sections:
-
+
Section | Description
:---|:---
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md
index 1704845ac8..668b2a1cb4 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md
@@ -53,7 +53,7 @@ Area | Description
(2) Threat & Vulnerability Management navigation pane | Use the navigation pane to move across the **Threat and Vulnerability Management Dashboard**, **Security recommendations**, **Remediation**, **Software inventory**, and **Weaknesses**.
**Dashboards** | Get a high-level view of the organization exposure score, organization configuration score, machine exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed machines data.
**Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list, a flyout panel opens with vulnerability details, open the software page, see the remediation, and exception options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information.
-**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information.
+**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation and exception](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information.
**Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information.
**Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a flyout panel with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information.
(3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**.
@@ -73,7 +73,7 @@ See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/t
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
- [Security recommendations](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md
index 8eebb66298..fca24b4b1f 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md
@@ -42,7 +42,7 @@ Reduce the exposure score by addressing what needs to be remediated based on the
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
- [Configuration score](configuration-score.md)
- [Security recommendations](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md
index 674d4b0309..99b1ae6759 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md
@@ -1,6 +1,6 @@
---
-title: Remediation
-description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM).
+title: Remediation and exception
+description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations or filing exceptions provided there are compensation controls. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM).
keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm
search.product: eADQiWindows 10XVcnh
search.appverid: met150
@@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual
ms.date: 04/11/2019
---
-# Remediation
+# Remediation and exception
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
@@ -47,11 +47,62 @@ When you submit a remediation request from Threat & Vulnerability Management, it
It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune.
-You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted.
The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task.
-However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab.
+## When to file for exception instead of remediating issues
+You can file exceptions to exclude certain recommendation from showing up in reports and affecting risk scores or secure scores.
+
+When you select a security recommendation, it opens up a flyout screen with details and options for your next step. You can either **Open software page**, choose from **Remediation options**, go through **Exception options** to file for exceptions, or **Report inaccuracy**.
+
+Select **Exception options** and a flyout screen opens.
+
+
+
+### Exception justification
+If the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The following list details the justifications behind the exception options:
+
+- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a machine, third party antivirus
+- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow
+- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive
+- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization
+- **Other** - False positive
+
+
+ 
+
+### Exception visibility
+The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab.
+However, you also have the option to filter your view based on exception justification, type, and status.
+
+
+
+Aside from that, there's also an option to **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard.
+
+
+
+Clicking the link opens up to the **Security recommendations** page, where you can select the item exempted item with details.
+
+
+
+### Actions on exceptions
+- Cancel - You can cancel the exceptions you've filed any time
+- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change, which adversely affect the exposure impact associated with a recommendation that had previously been excluded
+
+### Exception status
+- **Canceled** - The exception has been canceled and is no longer in effect
+- **Expired** - The exception that you've filed is no longer in effect
+- **In effect** - The exception that you've filed is in progress
+
+### Exception impact on scores
+Creating an exception can potentially affect the Exposure Score (for both types of weaknesses) and Secure Score (for configurations) of your organization in the following manner:
+- **No impact** - Removes the recommendation from the lists (which can be reverse through filters), but will not affect the scores
+- **Mitigation-like impact** - As if the recommendation was mitigated (and scores will be adjusted accordingly) when you select it as a compensating control.
+- **Hybrid** - Provides visibility on both No impact and Mitigation-like impact. It shows both the Exposure Score and Secure Score results out of the exception option that you made
+
+The exception impact shows on both the Security recommendations page column and in the flyout pane.
+
+
## Related topics
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md
index cb1913abcb..ee75d061da 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md
@@ -79,14 +79,12 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
-
-
## Related topics
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md
index a7ff6812ce..e1d39cdf5d 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md
@@ -63,6 +63,6 @@ You can report a false positive when you see any vague, inaccurate version, inco
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
- [Security recommendation](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Weaknesses](tvm-weaknesses.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md
index e2615c2319..7eefec6595 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md
@@ -15,25 +15,32 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: conceptual
-ms.date: 04/11/2019
+ms.date: 10/31/2019
---
# Weaknesses
**Applies to:**
-- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559
+
+[!include[Prerelease information](prerelease.md)]
Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities.
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights.
>[!IMPORTANT]
->To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network:
+>To boost your vulnerability assessment detection rates, you can download the following mandatory security updates and deploy them in your network:
>- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941)
>- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077)
>- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045)
>- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071)
+>Downloading the above-mentioned security updates will be mandatory starting Patch Tuesday, October 8, 2019.
## Navigate through your organization's weaknesses page
-You can see the list of vulnerabilities in four ways:
+You can access the list of vulnerabilities in a few places in the portal:
+- Global search
+- Weaknesses option in the navigation menu
+- Top vulnerable software widget in the dashboard
+- Discovered vulnerabilities page in the machine page
*Vulnerabilities in global search*
1. Click the global search drop-down menu.
@@ -46,12 +53,13 @@ You can see the list of vulnerabilities in four ways:
*Weaknesses page in the menu*
1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization.
-2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
+2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, dates when it was published and updated, related software, exploit kits available, vulnerability type, link to useful reference, and number of exposed machines which users can also export.
+
*Top vulnerable software widget in the dashboard*
1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time.
-2. Click the software that you want to investigate and it takes you to the software page. You will the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation.
+2. Click the software that you want to investigate and it takes you to the software page. You will see the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation.
3. Select the **Discovered vulnerabilities** tab.
4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
@@ -68,22 +76,25 @@ You can see the list of vulnerabilities in four ways:
5. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
## How it works
-When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page.
+When new vulnerabilities are released, you would want to know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page.
-If the **Exposed Machines** column shows 0, that means you are not infected.
+If the **Exposed Machines** column shows 0, that means you are not at risk.
-If there's a number in the **Exposed Machines**, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk.
+If exposed machines exist, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk.
You can also see the related alert and threat insights in the **Threat** column.
-The breach insights icons are highlighted if there are active alerts associated with the vulnerability found in your organization.
+The breach insights icon is highlighted if there is a vulnerability found in your organization. Prioritize an investigation because it means there might be a breach in your organization.
+
-The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is connected to specific campaign for which, Threat Analytics report links are provided that you can read.
+The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is a part of an exploit kit, connected to specific advanced persistent campaigns or activity groups for which, Threat Analytics report links are provided that you can read, has zero-day exploitation news, disclosures, or related security advisories.
+
+
>[!NOTE]
- > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight  icon and possible active alert  icon.
+ > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight  icon and breach insight  icon.
## Report inaccuracy
@@ -115,6 +126,6 @@ You can report a false positive when you see any vague, inaccurate, missing, or
- [Exposure score](tvm-exposure-score.md)
- [Configuration score](configuration-score.md)
- [Security recommendation](tvm-security-recommendation.md)
-- [Remediation](tvm-remediation.md)
+- [Remediation and exception](tvm-remediation.md)
- [Software inventory](tvm-software-inventory.md)
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
index 8d498f43b4..e3afd90910 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
@@ -19,12 +19,12 @@ ms.topic: article
# Create and manage roles for role-based access control
**Applies to:**
-
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-roles-abovefoldlink)
+[!include[Prerelease information](prerelease.md)]
+
## Create roles and assign the role to an Azure Active Directory group
The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups.
@@ -37,25 +37,31 @@ The following steps guide you on how to create roles in Microsoft Defender Secur
- **Role name**
- **Description**
- **Permissions**
- - **View data** - Users can view information in the portal.
- - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline.
- - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions.
- - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups.
+ - **View data** - Users can view information in the portal.
+ >[!NOTE]
+ >To view Threat & Vulnerability Management data, select **Threat and vulnerability management**.
+
+ - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline.
+ - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions.
+ >[!NOTE]
+ >To enable your Security operation personnel to choose remediation options and file exceptions, select **Threat and vulnerability management - Remediation handling**, and **Threat and vulnerability management - Exception handling**.
+
+ - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups.
> [!NOTE]
> This setting is only available in the Microsoft Defender ATP administrator (default) role.
- - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
+ - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
- - **Live response capabilities** - Users can take basic or advanced live response commands.
- - Basic commands allow users to:
- - Start a live response session
- - Run read only live response commands on a remote machine
- - Advanced commands allow users to:
- - Run basic actions
- - Download a file from the remote machine
- - View a script from the files library
- - Run a script on the remote machine from the files library take read and write commands.
+ - **Live response capabilities** - Users can take basic or advanced live response commands.
+ - Basic commands allow users to:
+ - Start a live response session
+ - Run read only live response commands on a remote machine
+ - Advanced commands allow users to:
+ - Run basic actions
+ - Download a file from the remote machine
+ - View a script from the files library
+ - Run a script on the remote machine from the files library take read and write commands.
For more information on the available commands, see [Investigate machines using Live response](live-response.md).
diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md
index 0673d31c32..da6e550794 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md
@@ -1,7 +1,7 @@
---
title: Monitoring web browsing security in Microsoft Defender ATP
description: Use web protection in Microsoft Defender ATP to monitor web browsing security
-keywords: web protection, web browsing, monitoring, reports, cards, domain list, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser
+keywords: web protection, web threat protection, web browsing, monitoring, reports, cards, domain list, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -22,9 +22,7 @@ ms.date: 08/30/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1)
-[!include[Prerelease information](prerelease.md)]
-
-Web protection lets you monitor your organization’s web browsing security through reports under **Reports > Web protection** in the Microsoft Defender Security Center. The report contains the following cards that provide web threat detection statistics:
+Web protection lets you monitor your organization’s web browsing security through reports under **Reports > Web protection** in the Microsoft Defender Security Center. The report contains cards that provide web threat detection statistics.
- **Web threat protection detections over time** — this trending card displays the number of web threats detected by type during the selected time period (Last 30 days, Last 3 months, Last 6 months)
@@ -44,7 +42,7 @@ Web protection categorizes malicious and unwanted websites as:
- **Custom indicator** — websites whose URLs or domains you've added to your [custom indicator list](manage-indicators.md) for blocking
## View the domain list
-Clicking on a specific web threat category in the **Web threat protection summary** card opens the **Domains** page, which shows a list of the domains prefiltered under that threat category. The page provides the following information for each domain:
+Select a specific web threat category in the **Web threat protection summary** card to open the **Domains** page and display the list of the domains under that threat category. The page provides the following information for each domain:
- **Access count** — number of requests for URLs in the domain
- **Blocks** — number of times requests were blocked
@@ -52,7 +50,7 @@ Clicking on a specific web threat category in the **Web threat protection summar
- **Threat category** — type of web threat
- **Machines** — number of machines with access attempts
-Selecting a domain opens a panel that shows the list of URLs in that domain that have been accessed. The panel also lists machines that have attempted to access URLs in the domain.
+Select a domain to view the list of machines that have attempted to access URLs in that domain as well as the list of URLs.
## Related topics
- [Web protection overview](web-protection-overview.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md
index 714ddb9915..37f62a101c 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md
@@ -1,7 +1,7 @@
---
title: Overview of web protection in Microsoft Defender ATP
description: Learn about web protection in Microsoft Defender ATP and how it can protect your organization
-keywords: web protection, web browsing, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser
+keywords: web protection, web threat protection, web browsing, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -22,18 +22,16 @@ ms.date: 08/30/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1)
-[!include[Prerelease information](prerelease.md)]
+Web protection in Microsoft Defender ATP uses [network protection](network-protection.md) to secure your machines against web threats. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web protection stops web threats without a web proxy and can protect machines while they are away or on premises. Web protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, as well as sites that you have blocked in your [custom indicator list](manage-indicators.md).
-Web protection in Microsoft Defender ATP leverages [network protection](network-protection.md) to secure your machines against web threats without relying on a web proxy, providing security for devices that are either away or on premises. By integrating with Microsoft Edge as well as popular third-party browsers like Chrome and Firefox, web protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, as well as sites that you have blocked in your [custom indicator list](manage-indicators.md).
+>[!Note]
+>It can take up to an hour for machines to receive new customer indicators.
With web protection, you also get:
- Comprehensive visibility into web threats affecting your organization
- Investigation capabilities over web-related threat activity through alerts and comprehensive profiles of URLs and the machines that access these URLs
- A full set of security features that track general access trends to malicious and unwanted websites
->[!Note]
->It can take up to an hour for machines to receive new customer indicators.
-
## Prerequisites
Web protection uses network protection to provide web browsing security on Microsoft Edge and third-party web browsers.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md
index 1d2a797e10..e963f8f504 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md
@@ -1,7 +1,7 @@
---
title: Respond to web threats in Microsoft Defender ATP
description: Respond to alerts related to malicious and unwanted websites. Understand how web threat protection informs end users through their web browsers and Windows notifications
-keywords: web protection, web browsing, alerts, response, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser, notifications, end users, Windows notifications, blocking page,
+keywords: web protection, web threat protection, web browsing, alerts, response, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser, notifications, end users, Windows notifications, blocking page,
search.product: eADQiWindows 10XVcnh
search.appverid: met150
ms.prod: w10
@@ -22,8 +22,6 @@ ms.date: 08/30/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1)
-[!include[Prerelease information](prerelease.md)]
-
Web protection in Microsoft Defender ATP lets you efficiently investigate and respond to alerts related to malicious websites and websites in your custom indicator list.
## View web threat alerts
@@ -62,10 +60,10 @@ You can also check the machine that attempted to access a blocked URL. Selecting
With web protection in Microsoft Defender ATP, your end users will be prevented from visiting malicious or unwanted websites using Microsoft Edge or other browsers. Because blocking is performed by [network protection](network-protection.md), they will see a generic error from the web browser. They will also see a notification from Windows.
-*Web threat blocked by Microsoft Edge*
+*Web threat blocked on Microsoft Edge*
-
-*Web threat blocked by the Chrome web browser*
+
+*Web threat blocked on Chrome*
## Related topics
- [Web protection overview](web-protection-overview.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
index be3d95c1f3..658a41d9f0 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
@@ -27,6 +27,21 @@ The following features are generally available (GA) in the latest release of Mic
For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection).
+## November 2019
+
+- [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md)
Microsoft Defender ATP for Mac brings the next-generation protection to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. ([Endpoint detection and response is currently in preview](preview.md).)
+
+## October 2019
+
+- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
You can now allow or block URLs/domains using your own threat intelligence.
+
+
+- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation.
+
+- [Connected Azure AD applications](connected-applications.md)
The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization.
+
+- [API Explorer](api-explorer.md)
The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint.
+
## September 2019
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
index e73bbfe476..d600158473 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
@@ -46,7 +46,7 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender
After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints.
-As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net").
+As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication.
| **Service**| **Description** |**URL** |
diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
index 1fbf4b6b35..20f5db2632 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
@@ -11,6 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: dansimp
ms.author: dansimp
+audience: ITPro
ms.date: 10/02/2018
ms.reviewer:
manager: dansimp
@@ -21,76 +22,93 @@ manager: dansimp
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+- [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge)
-The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can detect and block PUAs on endpoints in your network.
+Potentially unwanted applications are not considered viruses, malware, or other types of threats, but they might perform actions on endpoints which adversely affect endpoint performance or use. _PUA_ can also refer to an application that has a poor reputation, as assessed by Microsoft Defender ATP, due to certain kinds of undesirable behavior.
-These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation.
+For example:
-Typical PUA behavior includes:
+* **Advertising software:** Software that displays advertisements or promotions, including software that inserts advertisements to webpages.
+* **Bundling software:** Software that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualify as PUA.
+* **Evasion software:** Software that actively tries to evade detection by security products, including software that behaves differently in the presence of security products.
-- Various types of software bundling
-- Ad injection into web browsers
-- Driver and registry optimizers that detect issues, request payment to fix the errors, but remain on the endpoint and make no changes or optimizations (also known as "rogue antivirus" programs)
+For more examples and a discussion of the criteria we use to label applications for special attention from security features, see [How Microsoft identifies malware and potentially unwanted applications](../intelligence/criteria.md).
-These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications.
-
->[!TIP]
->You can also visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
+Potentially unwanted applications can increase the risk of your network being infected with actual malware, make malware infections harder to identify, or waste IT resources in cleaning them up.
## How it works
-Windows Defender Antivirus blocks detected PUA files and attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantined.
+### Microsoft Edge
-When a PUA is detected on an endpoint, Windows Defender Antivirus presents a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:").
+The next major version of Microsoft Edge, which is Chromium-based, blocks potentially unwanted application downloads and associated resource URLs. This feature is provided via [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md).
-They will also appear in the usual [quarantine list in the Windows Security app](windows-defender-security-center-antivirus.md#detection-history).
+#### Enable PUA protection in Chromium-based Microsoft Edge
-## View PUA events
+Although potentially unwanted application protection in Microsoft Edge (Chromium-based) is off by default, it can easily be turned on from within the browser.
-PUA events are reported in the Windows Event Viewer, but not in System Center Configuration Manager or Intune.
+1. From the tool bar, select **Settings and more** > **Settings**
+1. Select **Privacy and services**
+1. Under the **Services** section, you can toggle **Potentially unwanted app blocking** on or off
-You can turn on email notifications for PUA detections.
+> [!TIP]
+> If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our Windows Defender SmartScreen demo pages.
-See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID 1160.
+
-## Configure PUA protection
+### Windows Defender Antivirus
-You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, Group Policy, or PowerShell cmdlets.
+The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can detect and block PUAs on endpoints in your network.
-You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log.
+> [!NOTE]
+> This feature is only available in Windows 10.
-This feature is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives.
+Windows Defender Antivirus blocks detected PUA files, and any attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantine.
-**Use Intune to configure PUA protection**
+When a PUA is detected on an endpoint, Windows Defender Antivirus sends a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as other threat detections. The notification will be prefaced with _PUA:_ to indicate its content.
+
+The notification will appear in the usual [quarantine list within the Windows Security app](windows-defender-security-center-antivirus.md#detection-history).
+
+#### Configure PUA protection in Windows Defender Antivirus
+
+You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, Group Policy, or via PowerShell cmdlets.
+
+You can also use the PUA audit mode to detect PUAs without blocking them. The detections will be captured in the Windows event log.
+
+> [!TIP]
+> You can visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action.
+
+PUA audit mode is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives.
+
+##### Use Intune to configure PUA protection
See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-**Use Configuration Manager to configure PUA protection:**
+##### Use Configuration Manager to configure PUA protection
-PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later.
+PUA protection is enabled by default in the System Center Configuration Manager (current branch), starting with version 1606.
See [How to create and deploy antimalware policies: Scheduled scans settings](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring System Center Configuration Manager (current branch).
For Configuration Manager 2012, see [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508770.aspx#BKMK_PUA).
> [!NOTE]
-> PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager.
+> PUA events blocked by Windows Defender Antivirus are reported in the Windows Event Viewer and not in System Center Configuration Manager.
-**Use Group Policy to configure PUA protection:**
+##### Use Group Policy to configure PUA protection
-1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and select **Edit**.
-2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
3. Expand the tree to **Windows components > Windows Defender Antivirus**.
4. Double-click **Configure protection for potentially unwanted applications**.
-5. Click **Enabled** to enable PUA protection.
+5. Select **Enabled** to enable PUA protection.
-6. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Click **OK**.
+6. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**.
-**Use PowerShell cmdlets to configure PUA protection:**
+##### Use PowerShell cmdlets to configure PUA protection
Use the following cmdlet:
@@ -98,12 +116,24 @@ Use the following cmdlet:
Set-MpPreference -PUAProtection
```
-Setting the value for this cmdlet to `Enabled` will turn the feature on if it has been disabled.
+Setting the value for this cmdlet to `Enabled` will turn the feature on if it has been disabled.
-Setting `AuditMode` will detect PUAs but will not block them.
+Setting `AuditMode` will detect PUAs without blocking them.
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
+#### View PUA events
+
+PUA events are reported in the Windows Event Viewer, but not in System Center Configuration Manager or in Intune.
+
+You can turn on email notifications to receive mail about PUA detections.
+
+See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID **1160**.
+
+#### Allow-listing apps
+
+Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be allow-listed. See [How to Configure Endpoint Protection in Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/hh508770(v=technet.10)#to-exclude-specific-files-or-folders) for information on allowing files which are currently blocked by PUA protection in Windows Defender Antivirus.
+
## Related topics
- [Next gen protection](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png b/windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png
new file mode 100644
index 0000000000..dab113680f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png differ
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png
new file mode 100644
index 0000000000..d33e01e247
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png differ
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png
rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png
diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md
new file mode 100644
index 0000000000..d1fde8548c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md
@@ -0,0 +1,232 @@
+---
+title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows 10)
+description: Using WDAC supplemental policies, you can expand the S mode base policy on your Intune-managed devices.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
+ms.date: 10/30/2019
+---
+
+# Allow Line-of-Business Win32 Apps on Intune-Managed S Mode Devices
+
+**Applies to:**
+
+- Windows 10
+
+Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices.
+
+With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from “every app is Microsoft-verified" to “every app is verified by Microsoft or your organization”.
+
+# Policy Authorization Process
+
+The general steps for expanding the S mode base policy on your devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups.
+1. Generate a supplemental policy with WDAC tooling
+
+ This policy will expand the S mode base policy to authorize additional applications. Anything authorized by either the S mode base policy or your supplemental policy will be allowed to run. Your supplemental policies can specify filepath rules, trusted publishers, and more.
+
+ Refer to [Deploy multiple Windows Defender Application Control Policies](deploy-multiple-windows-defender-application-control-policies.md) for guidance on creating supplemental policies and [Deploy Windows Defender Application Control policy rules and file rules](select-types-of-rules-to-create.md) to choose the right type of rules to create for your policy.
+
+ Below are a basic set of instructions for creating an S mode supplemental policy:
+ - Create a new base policy using [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps)
+
+ ```powershell
+ New-CIPolicy -MultiplePolicyFormat -ScanPath -UserPEs -FilePath "\SupplementalPolicy.xml" -Level Publisher -Fallback Hash
+ ```
+ - Change it to a supplemental policy using [Set-CIPolicyIdInfo](https://docs.microsoft.com/powershell/module/configci/set-cipolicyidinfo?view=win10-ps)
+
+ ```powershell
+ Set-CIPolicyIdInfo -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath "\SupplementalPolicy.xml"
+ ```
+ Policies which are supplementing the S mode base policy must use **-SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784**, as this is the S mode policy ID.
+ - Put the policy in enforce mode using [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps)
+
+ ```powershell
+ Set-RuleOption -FilePath "\SupplementalPolicy.xml>" -Option 3 –Delete
+ ```
+ This deletes the ‘audit mode’ qualifier.
+ - Convert to .bin using [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps)
+
+ ```powershell
+ ConvertFrom-CIPolicy -XmlFilePath "\SupplementalPolicy.xml" -BinaryFilePath "\SupplementalPolicy.bin>
+ ```
+
+2. Sign policy
+
+ Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA.
+
+ Once your policy is signed, you must authorize the signing certificate you used to sign the policy and optionally one or more additional signers that can be used to sign updates to the policy in the future. Use Add-SignerRule to add the signing certificate to the WDAC policy:
+
+ ```powershell
+ Add-SignerRule -FilePath -CertificatePath -User -Update`
+ ```
+ Rename your policy to "{PolicyID}.p7b" after you've signed it. PolicyID can be found by inspecting the Supplemental Policy XML
+
+3. Deploy the signed supplemental policy using Microsoft Intune
+
+ Go to the Azure portal online and navigate to the Microsoft Intune page, then go to the Client apps blade and select 'S mode supplemental policies'. Upload the signed policy to Intune and assign it to user or device groups. Intune will generate tenant- and device- specific authorization tokens. Intune then deploys the corresponding authorization token and supplemental policy to each device in the assigned group. Together, these expand the S mode base policy on the device.
+
+> [!Note]
+> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](https://docs.microsoft.com/powershell/module/configci/set-cipolicyversion?view=win10-ps) for information on setting the version number.
+
+# Standard Process for Deploying Apps through Intune
+
+Refer to [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management) for guidance on the existing procedure of packaging signed catalogs and app deployment.
+
+# Optional: Process for Deploying Apps using Catalogs
+
+Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that will authorize all apps signed by that certificate, which may include apps you don’t want to allow as well.
+
+Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don’t want to trust all apps that may share the same signing certificate.
+
+The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs.
+
+> [!Note]
+> Every time an app updates, you will need to deploy an updated catalog. Because of this, IT Pros should try to avoid using catalog files for applications that auto-update and direct users not to update applications on their own.
+
+# Sample Policy
+Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Registry Editor. It also demonstrates how to specify your organization's code signing and policy signing certificates.
+```xml
+
+
+ 10.0.0.0
+ {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}
+
+ {5951A96A-E0B5-4D3D-8FB8-3E5B61030784}
+
+ {52671094-ACC6-43CF-AAF1-096DC69C1345}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0
+
+
+
+ Example Policy Name
+
+
+
+
+ Example-Policy-10.0.0.0
+
+
+
+
+```
+# Policy Removal
+> [!Note]
+> This feature currently has a known a policy deletion bug, with a fix expected in the 2D update in late February 2020. Devices of users who are unenrolled will still have their WDAC policies removed. In the mentime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode.
+
+```xml
+
+
+ 10.0.0.1
+ {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}
+ {5951A96A-E0B5-4D3D-8FB8-3E5B61030784}
+ {52671094-ACC6-43CF-AAF1-096DC69C1345}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0
+
+
+
+ Example Policy Name - Empty
+
+
+
+
+ Example-Policy-Empty-10.0.0.1
+
+
+
+
+```
diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md
index 196c8dc9a2..02767f2f29 100644
--- a/windows/security/threat-protection/windows-defender-application-control/TOC.md
+++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md
@@ -1,20 +1,17 @@
# [Windows Defender Application Control](windows-defender-application-control.md)
## [Windows Defender Application Control design guide](windows-defender-application-control-design-guide.md)
-### [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md)
-### [Select the types of rules to create](select-types-of-rules-to-create.md)
-### [Plan for WDAC policy management](plan-windows-defender-application-control-management.md)
-#### [Document your application control management processes](document-your-windows-defender-application-control-management-processes.md)
-### [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md)
+### [Plan for WDAC policy lifecycle management](plan-windows-defender-application-control-management.md)
+### Design and create your WDAC policy
+#### [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md)
+#### [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md)
+#### [Create an initial default policy](create-initial-default-policy.md)
+#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md)
### [Types of devices](types-of-devices.md)
-### Use WDAC with custom policies
-#### [Create an initial default policy](create-initial-default-policy.md)
-#### [Create path-based rules](create-path-based-rules.md)
-#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
### [Audit WDAC policies](audit-windows-defender-application-control-policies.md)
### [Merge WDAC policies](merge-windows-defender-application-control-policies.md)
### [Deploy multiple WDAC policies](deploy-multiple-windows-defender-application-control-policies.md)
@@ -35,7 +32,9 @@
### [Use signed policies to protect Windows Defender Application Control against tampering](use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md)
#### [Signing WDAC policies with SignTool.exe](signing-policies-with-signtool.md)
### [Disable WDAC policies](disable-windows-defender-application-control-policies.md)
-### [Device Guard and AppLocker](windows-defender-device-guard-and-applocker.md)
+### [LOB Win32 Apps on S Mode](LOB-win32-apps-on-s.md)
+
+
## [AppLocker](applocker\applocker-overview.md)
### [Administer AppLocker](applocker\administer-applocker.md)
diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
index c0e0200d21..039a888196 100644
--- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
@@ -1,13 +1,19 @@
---
title: Allow COM object registration in a Windows Defender Application Control policy (Windows 10)
description: You can allow COM object registration in a Windows Defender Application Control policy.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/21/2019
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
index eef2cc16e8..320db86050 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
@@ -80,12 +80,6 @@ The following are examples of scenarios in which AppLocker can be used:
AppLocker can help you protect the digital assets within your organization, reduce the threat of malicious software being introduced into your environment, and improve the management of application control and the maintenance of application control policies.
-## System requirements
-
-AppLocker policies can only be configured on and applied to computers that are running on the supported versions and editions of the Windows operating system. Group Policy is required to distribute Group Policy Objects that contain AppLocker policies. For more info, see [Requirements to Use AppLocker](requirements-to-use-applocker.md).
-
-AppLocker rules can be created on domain controllers.
-
## Installing AppLocker
AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC).
diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
index 10a2c6c988..a866996a6f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Audit Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
@@ -96,5 +99,5 @@ Use the following procedure after you have been running a computer with a WDAC p
You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md).
-> [!NOTE]
-> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
+> [!Note]
+> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
index 92c3c3aa47..9d7b5e5f7c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
@@ -1,6 +1,7 @@
---
title: Create a code signing cert for Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
index 67c1e0ccef..9f2f505f65 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
@@ -1,6 +1,7 @@
---
-title: Create an initial default policy (Windows 10)
+title: Create a Windows Defender Application Control policy from a reference computer (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
@@ -26,6 +32,14 @@ For this example, you must initiate variables to be used during the creation pro
Then create the WDAC policy by scanning the system for installed applications.
The policy file is converted to binary format when it gets created so that Windows can interpret it.
+## Overview of the process of creating Windows Defender Application Control policies
+
+A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
+
+Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
+
+If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
+
> [!NOTE]
> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md
deleted file mode 100644
index 44a9846b76..0000000000
--- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Windows Defender Application Control path-based rules (Windows 10)
-description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules.
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
-ms.date: 05/17/2019
----
-
-# Create Windows Defender Application Control path-based rules
-
-**Applies to:**
-
-- Windows 10
-- Windows Server 2016
-
->[!IMPORTANT]
->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
-Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules.
-
-- New-CIPolicy parameters
- - FilePath: create path rules under path \ for anything not user-writeable (at the individual file level)
-
- ```powershell
- New-CIPolicy -f .\mypolicy.xml -l FilePath -s -u
- ```
-
- Optionally, add -UserWriteablePaths to ignore user writeability
-
- - FilePathRule: create a rule where filepath string is directly set to value of \
-
- ```powershell
- New-CIPolicyRule -FilePathRule
- ```
-
- Useful for wildcards like C:\foo\\*
-
-- Usage follows the same flow as per-app rules:
-
- ```powershell
- $rules = New-CIPolicyRule …
- $rules += New-CIPolicyRule …
- …
- New-CIPolicyRule -f .\mypolicy.xml -u
- ```
-
-- Wildcards supported
- - Suffix (ex. C:\foo\\*) OR Prefix (ex. *\foo\bar.exe)
- - One or the other, not both at the same time
- - Does not support wildcard in the middle (ex. C:\\*\foo.exe)
-- Supported Macros:
- - %WINDIR%\\...
- - %SYSTEM32%\\...
- - %OSDRIVE%\\...
-
-- Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy:
-
- ```powershell
- Set-RuleOption -o 18 .\policy.xml
- ```
-
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
deleted file mode 100644
index d7f2a132fb..0000000000
--- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
+++ /dev/null
@@ -1,382 +0,0 @@
----
-title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10)
-description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
-ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e
-ms.reviewer:
-ms.author: dansimp
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 09/21/2017
----
-
-# Create your Windows Defender Application Control (WDAC) planning document
-
-**Applies to**
-- Windows 10
-- Windows Server
-
-This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
-
-## The WDAC deployment design
-
-The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using WDAC.
-
-You should have completed these steps in the design and planning process:
-
-1. [Select types of rules to create](select-types-of-rules-to-create.md)
-2. [Plan for WDAC policy management](document-your-windows-defender-application-control-management-processes.md)
-
-### WDAC planning document contents
-
-Your planning document should contain:
-
-- A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information.
-- Application control policy project target dates, both for planning and deployment.
-- A complete list of apps used by each business group (or organizational unit), including version information and installation paths.
-- What condition to apply to rules governing each application (or whether to use the default set provided by WDAC).
-- A strategy for using Group Policy to deploy the WDAC policies.
-- A strategy in processing the application usage events generated by WDAC.
-- A strategy to maintain and manage WDAC polices after deployment.
-
-### Sample template for an WDAC planning document
-
-You can use the following form to construct your own WDAC planning document.
-
-**Business group**:
-
-**Operating system environment**: (Windows and non-Windows)
-
-
-
-
-
-
-
-
-
-Contacts |
-Business contact: |
-Technical contact: |
-
-
-Other departments |
-In this business group: |
-Affected by this project: |
-
-
-Security policies |
-Internal: |
-Regulatory/compliance: |
-
-
-Business goals |
-Primary: |
-Secondary: |
-
-
-Project target dates |
-Design signoff date: |
-Policy deployment date: |
-
-
-
-
-Rules
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- |
- |
- |
- |
- |
- |
- |
- |
- |
-
-
-
-
-Event processing
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- |
- |
- |
- |
- |
-
-
-
-
-Policy maintenance
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- |
-Planned:
-Emergency: |
- |
- |
- |
-
-
-
-
-### Example of a WDAC planning document
-
-**Rules**
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Teller-East and Teller-West |
-Yes |
-Teller Software |
-C:\Program Files\Woodgrove\Teller.exe |
-File is signed; create a publisher condition |
-Allow |
-Tellers-WDACTellerRules |
-Web help |
-
-
- |
- |
- |
-Windows files
- |
-C:\Windows |
-Create a path exception to the default rule to exclude \Windows\Temp |
-Allow |
- |
-Help desk |
-
-
-Human Resources |
-HR-All |
-Yes |
-Check Payout |
-C:\Program Files\Woodgrove\HR\Checkcut.exe |
-File is signed; create a publisher condition |
-Allow |
-HR-WDACHRRules |
-Web help |
-
-
- |
- |
- |
-Time Sheet Organizer |
-C:\Program Files\Woodgrove\HR\Timesheet.exe |
-File is not signed; create a file hash condition |
-Allow |
- |
-Web help |
-
-
- |
- |
- |
-Internet Explorer 7 |
-C:\Program Files\Internet Explorer</p> |
-File is signed; create a publisher condition |
-Deny |
- |
-Web help
- |
-
-
- |
- |
- |
-Windows files |
-C:\Windows |
-Use the default rule for the Windows path |
-Allow |
- |
-Help desk |
-
-
-
-
-Event processing
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Forwarded to: WDAC Event Repository on srvBT093 |
-Standard |
-None |
-Standard |
-
-
-Human Resources |
-DO NOT FORWARD. srvHR004 |
-60 months |
-Yes, summary reports monthly to managers |
-Standard |
-
-
-
-
-Policy maintenance
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Planned: Monthly through business office triage
-Emergency: Request through help desk |
-Through business office triage
-30-day notice required |
-General policy: Keep past versions for 12 months
-List policies for each application |
-Coordinated through business office
-30-day notice required |
-
-
-Human Resources |
-Planned: Monthly through HR triage
-Emergency: Request through help desk |
-Through HR triage
-30-day notice required |
-General policy: Keep past versions for 60 months
-List policies for each application |
-Coordinated through HR
-30-day notice required |
-
-
-
-
-### Additional resources
-
-- [Windows Defender Application Control](windows-defender-application-control.md)
-
-
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
index 13fa578687..586cf70292 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
@@ -1,16 +1,19 @@
---
title: Deploy catalog files to support Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
index e24750f74b..d70793409e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
@@ -1,13 +1,19 @@
---
title: Deploy multiple Windows Defender Application Control Policies (Windows 10)
description: Windows Defender Application Control supports multiple code integrity policies for one device.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/17/2019
---
@@ -18,9 +24,6 @@ ms.date: 05/17/2019
- Windows 10
- Windows Server 2016
->[!IMPORTANT]
->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
The restriction of only having a single code integrity policy active on a system at any given time has felt limiting for customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios:
1. Enforce and Audit Side-by-Side
@@ -44,10 +47,10 @@ Note that multiple policies will not work on pre-1903 systems.
### Allow Multiple Policies
-In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in New-CIPolicy results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base.
+In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format.
```powershell
-New-CIPolicy -MultiplePolicyFormat -foo –bar
+New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash
```
Optionally, you can choose to make the new base policy supplementable (allow supplemental policies).
@@ -64,19 +67,19 @@ Add-SignerRule -FilePath -CertificatePath [-Kernel] [-User] [-
### Supplemental Policy Creation
-In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands.
-- "SupplementsBasePolicyID": guid of new supplemental policy
-- "BasePolicyToSupplementPath": base policy that the supplemental policy applies to
+In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy.
+- "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to
+- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to
```powershell
Set-CIPolicyIdInfo [-FilePath] [-PolicyName ] [-SupplementsBasePolicyID ] [-BasePolicyToSupplementPath ] [-ResetPolicyID] [-PolicyId ] []
```
-Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and resets the policy guids back to a random guid.
+Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and resets the policy GUIDs back to a random GUID.
### Merging policies
-When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDS and types are for any subsequent policies, the merged policy will be a base policy with ID \.
+When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \.
### Deploying policies
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
index e4c776c47e..7bbbc5f8e5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
@@ -1,16 +1,19 @@
---
title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
index 61a3e06b58..8a2a80de85 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
@@ -1,16 +1,19 @@
---
title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/17/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
index 79cdfd3512..59112ea46a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Disable Windows Defender Application Control policies (Windows 10)
description: This topic covers how to disable unsigned or signed WDAC policies.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
deleted file mode 100644
index f29188cd79..0000000000
--- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
+++ /dev/null
@@ -1,239 +0,0 @@
----
-title: Document your application control management processes (Windows 10)
-description: This planning topic describes the WDAC policy maintenance information to record for your design document.
-ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb
-ms.reviewer:
-ms.author: dansimp
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
-audience: ITPro
-ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 09/21/2017
----
-
-# Document your application control management processes
-
-**Applies to**
-- Windows 10
-- Windows Server
-
-This planning topic describes the Windows Defender Application Control (WDAC) policy maintenance information to record for your design document.
-
-## Record your findings
-
-To complete this planning document, you should first complete the following steps:
-
-3. [Select the types of rules to create](select-types-of-rules-to-create.md)
-4. [Plan for WDAC policy management](plan-windows-defender-application-control-management.md)
-
-The three key areas to determine for WDAC policy management are:
-
-1. Support policy
-
- Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel know recommended troubleshooting steps and escalation points for your policy.
-
-2. Event processing
-
- Document whether events will be collected in a central location, how that store will be archived, and whether the events will be processed for analysis.
-
-3. Policy maintenance
-
- Detail how rules will be added to the policy, in which Group Policy Object (GPO) the rules should be defined, and how to modify rules when apps are retired, updated, or added.
-
-The following table contains the added sample data that was collected when determining how to maintain and manage WDAC policies.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Teller-East and Teller-West |
-Yes |
-Teller Software |
-C:\Program Files\Woodgrove\Teller.exe |
-File is signed; create a publisher condition |
-Allow |
-Tellers-WDACTellerRules |
-Web help |
-
-
- |
- |
- |
-Windows files
- |
-C:\Windows |
-Create a path exception to the default rule to exclude \Windows\Temp |
-Allow |
- |
-Help desk |
-
-
-Human Resources |
-HR-All |
-Yes |
-Check Payout |
-C:\Program Files\Woodgrove\HR\Checkcut.exe |
-File is signed; create a publisher condition |
-Allow |
-HR-WDACHRRules |
-Web help |
-
-
- |
- |
- |
-Time Sheet Organizer |
-C:\Program Files\Woodgrove\HR\Timesheet.exe |
-File is not signed; create a file hash condition |
-Allow |
- |
-Web help |
-
-
- |
- |
- |
-Internet Explorer 7 |
-C:\Program Files\Internet Explorer</p> |
-File is signed; create a publisher condition |
-Deny |
- |
-Web help
- |
-
-
- |
- |
- |
-Windows files |
-C:\Windows |
-Use the default rule for the Windows path |
-Allow |
- |
-Help desk |
-
-
-
-
-The following two tables illustrate examples of documenting considerations to maintain and manage WDAC policies.
-
-**Event processing policy**
-
-One discovery method for app usage is to use Audit mode. This will write events to the CodeIntegrity log, which can be managed and analyzed like other Windows logs.
-
-The following table is an example of what to consider and record.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Forwarded to: CodeIntegrity Event Repository on srvBT093 |
-Standard |
-None |
-Standard |
-
-
-Human Resources |
-DO NOT FORWARD. srvHR004 |
-60 months |
-Yes, summary reports monthly to managers |
-Standard |
-
-
-
-
-Policy maintenance policy
-When applications are identified and policies are created for application control, then you can begin documenting how you intend to update those policies.
-The following table is an example of what to consider and record.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Bank Tellers |
-Planned: Monthly through business office triage
-Emergency: Request through help desk |
-Through business office triage
-30-day notice required |
-General policy: Keep past versions for 12 months
-List policies for each application |
-Coordinated through business office
-30-day notice required |
-
-
-Human Resources |
-Planned: Monthly through HR triage
-Emergency: Request through help desk |
-Through HR triage
-30-day notice required |
-General policy: Keep past versions for 60 months
-List policies for each application |
-Coordinated through HR
-30-day notice required |
-
-
-
-
-## Next steps
-
-After you determine your application control management strategy for each business group, [create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
index 13a60fe360..7d5a20d2d6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png
new file mode 100644
index 0000000000..754cf041ba
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png differ
diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png
new file mode 100644
index 0000000000..91fc4f136b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png differ
diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png
new file mode 100644
index 0000000000..d011fc4408
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png differ
diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
index fbad450704..e6b57b9722 100644
--- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
@@ -1,16 +1,19 @@
---
title: Manage packaged apps with Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/14/2019
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
index 4d04e9f6fa..01d8f1abb4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Merge Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
index 387ba074e2..a9250a0e9e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
@@ -1,16 +1,20 @@
---
title: Microsoft recommended block rules (Windows 10)
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
audience: ITPro
-ms.date: 04/09/2019
-ms.reviewer:
-manager: dansimp
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 04/09/2019
---
# Microsoft recommended block rules
diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
index be74ddf1f0..2d05216e90 100644
--- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
+++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
@@ -1,32 +1,73 @@
---
title: Plan for Windows Defender Application Control policy management (Windows 10)
description: Plan for Windows Defender Application Control policy management.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 02/21/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 02/21/2018
---
-# Plan for Windows Defender Application Control policy management
+# Plan for Windows Defender Application Control lifecycle policy management
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows Server 2016 and above
-This topic for describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
+This topic describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
-## Policy management
+## Policy XML lifecycle management
-Before you begin the deployment process, consider how the WDAC rules will be managed. Developing a process for managing WDAC rules helps assure that WDAC continues to effectively control how applications are allowed to run in your organization.
+Before you begin deploying WDAC, consider how your policies will be managed and maintained over time. Developing a process for managing WDAC policies helps assure that WDAC continues to effectively control how applications are allowed to run in your organization.
-### Application and user support policy
+
+Most WDAC policies will evolve over time and proceed through a set of identifiable phases during their lifetime. Typically, these phases include:
+
+1. [Define (or refine) the "circle-of-trust"](understand-windows-defender-application-control-policy-design-decisions.md) for the policy and build an audit mode version of the policy XML.
+2. Deploy the audit mode policy to intended computers.
+3. Monitor audit block events from the intended computers and add/edit/delete rules as needed to address unexpected/unwanted blocks.
+4. Repeat steps 2-3 until the remaining block events meet expectations.
+5. Generate the enforced mode version of the policy.
+6. Deploy the enforced mode policy to intended computers. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly.
+7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes.
+
+### Keep WDAC policies in a source control or document management solution
+
+To effectively manage WDAC policies, you should store and maintain your policy XML documents in a central repository that is accessible to everyone responsible for WDAC policy management. We recommend a source control solution such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration), which provide version control and allow you to specify metadata about the XML documents.
+
+### Set PolicyName, PolicyID, and Version metadata for each policy
+
+Use the [Set-CIPolicyIDInfo](https://docs.microsoft.com/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system auto-generate a unique ID for the policy.
+
+> [!NOTE]
+> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10.
+> PolicyID should be set only once per policy and use different PolicyID's for the audit and enforced mode versions of each policy.
+
+In addition, we recommend using the [Set-CIPolicyVersion](https://docs.microsoft.com/powershell/module/configci/set-cipolicyversion) cmdlet to increment the policy's internal version number when you make changes to the policy. The version must be defined as a standard four-part version string (e.g. "1.0.0.0").
+
+### Policy rule updates
+
+As new apps are deployed or existing apps are updated by the software publisher, you may need to make revisions to your rules to ensure that these apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you leverage WDAC [managed installer](use-windows-defender-application-control-with-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you are less likely to need policy updates.
+
+## WDAC event management
+
+Each time that a process is blocked by WDAC, events will be written to either the CodeIntegrity\Operational or the AppLocker\MSI and Script Windows event logs. The event details which file tried to run, the attributes of that file and its signatures, and the process that attempted to run the blocked file.
+
+Collecting these events in a central location can help you maintain your WDAC policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012).
+
+Additionally, WDAC events are collected by [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) and can be queried using the [advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) feature.
+
+## Application and user support policy
Considerations include:
@@ -35,7 +76,7 @@ Considerations include:
- How are existing rules updated?
- Are events forwarded for review?
-**Help desk support**
+### Help desk support
If your organization has an established help desk support department in place, consider the following when deploying WDAC policies:
@@ -44,49 +85,17 @@ If your organization has an established help desk support department in place, c
- Who are the contacts in the support department?
- How will the support department resolve application control issues between the end user and those who maintain the WDAC rules?
-**End-user support**
+### End-user support
Because WDAC is preventing unapproved apps from running, it is important that your organization carefully plan how to provide end-user support. Considerations include:
- Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app?
- How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app?
-**WDAC event management**
-
-Each time that a process requests permission to run, WDAC creates an event in the CodeIntegrity log. The event details which file tried to run, the attributes of that file, and the user that initiated the request.
-
-Collecting these events in a central location can help you maintain your WDAC policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012).
-
-### Policy maintenance
-
-As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current.
-
-To ensure version control when modifying an WDAC policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013).
-
-**New version of a supported app**
-
-When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you are using publisher conditions and the version is not specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app has not altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied.
-
-To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version.
-
-For files that are allowed or denied with file hash conditions, you must retrieve the new file hash. To add support for a new version and maintain support for the older version, you can either create a new file hash rule for the new version or edit the existing rule and add the new file hash to the list of conditions.
-
-For files with path conditions, you should verify that the installation path has not changed from what is stated in the rule. If the path has changed, you need to update the rule before installing the new version of the app
-
-**Recently deployed app**
-
-To support a new app, you must add one or more rules to the existing WDAC policy.
-
-**App is no longer supported**
-
-If your organization has determined that it will no longer support an application that has WDAC rules associated with it, the easiest way to prevent users from running the app is to delete these rules.
-
-## Next steps
+## Document your plan
After deciding how your organization will manage your WDAC policy, record your findings.
- **End-user support policy.** Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the WDAC policy, if necessary.
- **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis.
-- **Policy maintenance.** Detail how rules will be added to the policy and in which GPO the rules are defined.
-
-For information and steps how to document your processes, see [Document your application control management processes](document-your-windows-defender-application-control-management-processes.md).
+- **Policy management.** Detail what policies are planned, how they will be managed, and how rules will be maintained over time.
diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
index fa2f7af6ec..183701e0a9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
@@ -1,16 +1,20 @@
---
title: Querying Application Control events centrally using Advanced hunting (Windows 10)
description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
-ms.mktglfcycl: manage
+ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
-ms.date: 12/06/2018
-ms.reviewer:
manager: dansimp
+ms.date: 12/06/2018
---
# Querying Application Control events centrally using Advanced hunting
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 9abcd191f4..6e77768954 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -1,55 +1,51 @@
---
title: Select the types of rules to create (Windows 10)
description: Select the types of rules to create.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 04/20/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 04/20/2018
---
-# Deploy Windows Defender Application Control policy rules and file rules
+# Understand WDAC policy rules and file rules
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows Server 2016 and above
Windows Defender Application Control (WDAC) provides control over a computer running Windows 10 by using policies that specify whether a driver or application is trusted and can be run. A policy includes *policy rules* that control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a WDAC policy, and *file rules* (or *file rule levels*) that specify the level at which applications will be identified and trusted.
-## Overview of the process of creating Windows Defender Application Control policies
-
-A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
-
-Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
-
-If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
-
## Windows Defender Application Control policy rules
-To modify the policy rule options of an existing WDAC policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
+To modify the policy rule options of an existing WDAC policy XML, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
- To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
- `Set-RuleOption -FilePath -Option 0`
+ `Set-RuleOption -FilePath -Option 0`
Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Windows Defender Application Control will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option.
- To disable UMCI on an existing WDAC policy, delete rule option 0 by running the following command:
- `Set-RuleOption -FilePath -Option 0 -Delete`
+ `Set-RuleOption -FilePath -Option 0 -Delete`
-You can set several rule options within a WDAC policy. Table 2 describes each rule option.
+You can set several rule options within a WDAC policy. Table 1 describes each rule option.
> [!NOTE]
> We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. To allow these applications, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode.
-**Table 2. Windows Defender Application Control policy - policy rule options**
+**Table 1. Windows Defender Application Control policy - policy rule options**
| Rule option | Description |
|------------ | ----------- |
@@ -64,7 +60,7 @@ You can set several rule options within a WDAC policy. Table 2 describes each ru
| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. |
| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. |
| **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
-| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to Restricted Language Mode. NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. |
+| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. |
| **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. |
| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as System Center Configuration Manager, that has been defined as a managed installer. |
| **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). |
@@ -78,15 +74,15 @@ You can set several rule options within a WDAC policy. Table 2 describes each ru
File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as fine-tuned as the hash of each binary or as general as a CA certificate. You specify file rule levels both when you create a new WDAC policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, WDAC policies combine their file rules, so that any application that would be allowed by either of the original policies will be allowed by the combined policy.
-Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
+Each file rule level has its benefit and disadvantage. Use Table 2 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
-Table 3. Windows Defender Application Control policy - file rule levels
+**Table 2. Windows Defender Application Control policy - file rule levels**
| Rule level | Description |
|----------- | ----------- |
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
-| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained in paths that are admin-writeable only. By default, WDAC performs a user-writeability check at runtime which ensures that the current permissions on the specified filepath and its parent directories (recursively) do not allow standard users write access.
Note that filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. IT Pros should take care while crafting path rules to allow paths that they know are likely to remain to be admin-writeable only and deny execution from sub-directories where standard users can modify ACLs on the folder.
There is a defined list of SIDs which are recognized as admins (below). If a file has write permissions for a SID not in this list, the file will be flagged as user writeable.
S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523.
Wildcards can be used at the beginning or end of a path rule: only one wildcard is allowed per path rule. Wildcards placed at the end of a path authorize all files in that path and its subdirectories recursively (ex. C:\\* would include C:\foo\\* ). Wildcards placed at the beginning of a path scan all directories for files with a specific name (ex. \*\bar.exe would allow C:\bar.exe and C:\foo\bar.exe). Wildcards in the middle of a path are not supported (ex. C:\\*\foo.exe). Without a wildcard, the rule will allow only a specific file (ex. C:\foo\bar.exe).
Supported macros: %WINDIR%, %SYSTEM32%, %OSDRIVE%.|
+| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained under specific file path locations. Additional information about FilePath level rules can be found below. |
> [!NOTE]
> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
@@ -115,3 +111,20 @@ As part of normal operations, they will eventually install software updates, or
They could also choose to create a catalog that captures information about the unsigned internal application, then sign and distribute the catalog. Then the internal application could be handled by WDAC policies in the same way as any other signed application. An update to the internal application would only require that the catalog be regenerated, signed, and distributed (no restarts would be required).
+## More information about filepath rules
+
+Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. IT Pros should take care while crafting path rules to allow paths that they know are likely to remain to be admin-writeable only and deny execution from sub-directories where standard users can modify ACLs on the folder.
+
+By default, WDAC performs a user-writeability check at runtime which ensures that the current permissions on the specified filepath and its parent directories (recursively) do not allow standard users write access.
+
+There is a defined list of SIDs which WDAC recognizes as admins. If a filepath allows write permissions for any SID not in this list, the filepath is considered to be user-writeable even if the additional SID is associated to a custom admin user. To handle these special cases, you can override WDAC's runtime admin-writeable check with the **Disabled:Runtime FilePath Rule Protection** option described above.
+
+WDAC's list of well-known admin SIDs are:
+S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523.
+
+When generating filepath rules using [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy), a unique, fully-qualified path rule is generated for every file discovered in the scanned path(s). To create rules that instead allow all files under a specified folder path, use [New-CIPolicyRule](https://docs.microsoft.com/powershell/module/configci/new-cipolicyrule) to define rules containing wildcards and include them in your [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy) scan using the -Rules switch.
+
+Wildcards can be used at the beginning or end of a path rule: only one wildcard is allowed per path rule. Wildcards placed at the end of a path authorize all files in that path and its subdirectories recursively (ex. C:\\* would include C:\foo\\* ). Wildcards placed at the beginning of a path will allow the exact specified filename under any path (ex. \*\bar.exe would allow C:\bar.exe and C:\foo\bar.exe). Wildcards in the middle of a path are not supported (ex. C:\\*\foo.exe). Without a wildcard, the rule will allow only a specific file (ex. C:\foo\bar.exe).
Supported macros: %WINDIR%, %SYSTEM32%, %OSDRIVE%.
+
+> [!NOTE]
+> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
diff --git a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
index 7f2c0b16d3..4d6bb94c8f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
+++ b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
@@ -1,16 +1,20 @@
---
title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10)
description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 02/21/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 02/21/2018
---
# Signing Windows Defender Application Control policies with SignTool.exe
diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
index aacc7afb09..6a955009ea 100644
--- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
+++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
@@ -1,18 +1,20 @@
---
-title: types of devices (Windows 10)
+title: Types of devices (Windows 10)
description: Typically, deployment of Windows Defender Application Control happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 03/01/2018
-ms.reviewer:
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 03/01/2018
---
# Windows Defender Application Control deployment in different scenarios: types of devices
diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
index 5f6b6c7849..87a4942ff4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
@@ -1,6 +1,7 @@
---
title: Understand Windows Defender Application Control policy design decisions (Windows 10)
description: Understand Windows Defender Application Control policy design decisions.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/08/2018
---
@@ -19,57 +25,64 @@ ms.date: 02/08/2018
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows Server 2016 and above
-This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
+This topic is for the IT professional and lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance.
-You should consider using WDAC as part of your organization's application control policies if all the following are true:
+You should consider using WDAC as part of your organization's application control policies if the following are true:
-- You have deployed or plan to deploy the supported versions of Windows in your organization.
+- You have deployed or plan to deploy the supported versions of Windows in your organization.
- You need improved control over the access to your organization's applications and the data your users access.
-- The number of applications in your organization is known and manageable.
+- Your organization has a well-defined process for application management and deployed.
- You have resources to test policies against the organization's requirements.
- You have resources to involve Help Desk or to build a self-help process for end-user application access issues.
- The group's requirements for productivity, manageability, and security can be controlled by restrictive policies.
-The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment).
+## Decide what policies to create
-### Which apps do you need to control in your organization?
+Beginning with Windows 10, version 1903, WDAC allows [multiple simultaneous policies](deploy-multiple-windows-defender-application-control-policies.md) to be applied to each device. While this opens up many new use cases for organizations, your policy management can easily become unwieldy without a well-thought-out plan for the number and types of policies to create.
-You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage.
+The first step is to define the desired "circle-of-trust" for your WDAC policies. By "circle-of-trust", we mean a description of the business intent of the policy expressed in natural language. This "circle-of-trust" definition will guide you as you create the actual policy rules for your policy XML.
+
+For example, the DefaultWindows policy, which can be found under %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies, establishes a "circle-of-trust" that allows Windows, 3rd-party hardware and software kernel drivers, and applications from the Microsoft Store.
+
+Microsoft Endpoint Configuration Manager (previously known as System Center Configuration Manager (SCCM)), uses the DefaultWindows policy as the basis for its policy but then modifies the policy rules to allow SCCM and its dependencies, sets the managed installer policy rule, and additionally configures SCCM as a managed installer. It also can optionally authorize apps with positive reputation and perform a one-time scan of folder paths specified by the SCCM administrator which adds rules for any apps found in the specified paths on the managed endpoint. This establishes the "circle-of-trust" for SCCM's native WDAC integration.
+
+The following questions can help you plan your WDAC deployment and determine the right "circle-of-trust" for your policies. They are not in priority or sequential order and are not meant to be an exhaustive set of design considerations.
+
+## WDAC design considerations
+
+### How are apps managed and deployed in your organization?
+
+Organizations with well-defined, centrally-managed app management and deployment processes can create more restrictive, more secure policies. Other organizations may be able to deploy WDAC with more relaxed rules or may choose to deploy WDAC in audit mode to gain better visibility to the apps being used in their organization.
| Possible answers | Design considerations|
| - | - |
-| Control all apps | WDAC policies control applications by creating an allowed list of applications. Exceptions are also possible. WDAC policies can only be applied to applications installed on computers running Windows 10 . |
-| Control specific apps | When you create WDAC rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. WDAC policies can only be applied to apps installed on computers running Windows 10 or Windows Server 2016. |
-|Control only Classic Windows applications, only Universal Windows apps, or both| WDAC policies control apps by creating an allowed list of apps based on code signing certificate and\or file hash information. Because Universal Windows apps are all signed by the Windows Store, Classic Windows applications and Universal Windows apps can be controlled together. WDAC policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Microsoft Store, but Classic Windows applications can be controlled with WDAC on Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.|
-| Control apps by business group | WDAC policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). |
-| Control apps by computer, not user | WDAC is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your WDAC planning. Otherwise, you will have to identify users, their computers, and their app access requirements.|
-|Understand app usage, but there is no need to control any apps yet | WDAC policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the CodeIntegrity log in Event Viewer to create WDAC policies.|
+| All apps are centrally managed and deployed using endpoint management tools like [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). | Organizations that centrally manage all apps are best-suited for application control. WDAC options like [managed installer](use-windows-defender-application-control-with-managed-installer.md) can make it easy to authorize apps that are deployed by the organization's app distribution management solution. |
+| Some apps are centrally managed and deployed, but teams can install additional apps for their members. | [Supplemental policies](deploy-multiple-windows-defender-application-control-policies.md) can be used to allow team-specific exceptions to your core organization-wide WDAC policy. Alternatively, teams can leverage managed installers to install their team-specific apps or admin-only file path rules can be used to allow apps installed by admin users. |
+| Users and teams are free to download and install apps but the organization wants to restrict that right to prevalent and reputable apps only. | WDAC can integrate with Microsoft's [Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md) (the same source of intelligence that powers Windows Defender Antivirus and SmartScreen) to allow only apps and binaries that have positive reputation. |
+| Users and teams are free to download and install apps without restriction. | WDAC policies can be deployed in audit mode to gain insight into the apps and binaries running in your organization without impacting user and team productivity.|
-### How do you currently control app usage in your organization?
+### Are internally-developed line-of-business (LOB) apps and apps developed by 3rd parties digitally signed?
-Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. WDAC includes improvements over AppLocker and SRP in the architecture and management of application control policies.
+Traditional Win32 apps on Windows can run without being digitally signed. This practice can expose Windows devices to malicious or tampered code and presents a security vulnerability to your Windows devices. Adopting code-signing as part of your organization's app development practices or augmenting apps with signed catalog files as part of your app ingestion and distribution can greatly improve the integrity and security of apps used.
| Possible answers | Design considerations |
| - | - |
-| Security polices (locally set or through Mobile Device Management (MDM) or Group Policy) | Using WDAC requires increased effort in planning to create correct policies, but this results in a simpler distribution method.|
-| Non-Microsoft app control software | Using WDAC requires a complete app control policy evaluation and implementation.|
-| Managed usage by group or OU | Using WDAC requires a complete app control policy evaluation and implementation.|
-| Authorization Manager or other role-based access technologies | Using WDAC requires a complete app control policy evaluation and implementation.|
-| Other | Using WDAC requires a complete app control policy evaluation and implementation.|
+| All apps used in your organization must be signed. | Organizations that enforce [codesigning](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) for all executable code are best-positioned to protect their Windows computers from malicious code execution. WDAC rules can be created to authorize apps and binaries from the organization's internal development teams and from trusted independent software vendors (ISV). |
+| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific app catalog signatures to existing apps as a part of the app deployment process which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed app catalogs. |
### Are there specific groups in your organization that need customized application control policies?
-Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization.
+Most business teams or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. There is overhead in managing policies which may lead you to choose between broad, organization-wide policies and multiple team-specific policies.
| Possible answers | Design considerations |
| - | - |
-| Yes | For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.
If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply WDAC rules in a GPO to specific user groups.|
+| Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally-defined base policy.|
| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|
-
+
### Does your IT department have resources to analyze application usage, and to design and manage the policies?
The time and resources that are available to you to perform the research and analysis can affect the detail of your plan and processes for continuing policy management and maintenance.
@@ -77,8 +90,8 @@ The time and resources that are available to you to perform the research and ana
| Possible answers | Design considerations |
| - | - |
| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.|
-| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. |
-
+| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. |
+
### Does your organization have Help Desk support?
Preventing your users from accessing known, deployed, or personal applications will initially cause an increase in end-user support. It will be necessary to address the various support issues in your organization so security policies are followed and business workflow is not hampered.
@@ -87,56 +100,3 @@ Preventing your users from accessing known, deployed, or personal applications w
| - | - |
| Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. |
| No | Invest time in developing online support processes and documentation before deployment. |
-
-
-### Do you know what applications require restrictive policies?
-Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data.
-
-| Possible answers | Design considerations |
-| - | - |
-| Yes | You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies. |
-| No | You will have to perform an audit and requirements gathering project to discover the application usage. WDAC provides the means to deploy policies in audit mode.|
-
-### How do you deploy or sanction applications (upgraded or new) in your organization?
-
-Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies.
-
-| Possible answers | Design considerations |
-| - | - |
-| Ad hoc | You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.|
-| Strict written policy or guidelines to follow | You need to develop WDAC rules that reflect those policies, and then test and maintain the rules. |
-| No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. |
-
-### What are your organization's priorities when implementing application control policies?
-
-Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of WDAC.
-
-| Possible answers | Design considerations |
-| - | - |
-| Productivity: The organization assures that tools work and required applications can be installed. | To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress. |
-| Management: The organization is aware of and controls the apps it supports. | In some business groups, application usage can be managed from a central point of control. WDAC policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps|
-| Security: The organization must protect data in part by ensuring that only approved apps are used. | WDAC can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.|
-
-### How are apps currently accessed in your organization?
-
-WDAC is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, WDAC can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from WDAC policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules.
-
-| Possible answers | Design considerations |
-| - | - |
-| Users run without administrative rights. | Apps are installed by using an installation deployment technology.|
-| WDAC can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using WDAC to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.
**Note: **WDAC can also be effective in helping create standardized desktops in organizations where users run as administrators. | Users must be able to install applications as needed.
-| Users currently have administrator access, and it would be difficult to change this.|Enforcing WDAC rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using WDAC or to implement the audit only enforcement setting.|
-
-### Is the structure in Active Directory Domain Services based on the organization's hierarchy?
-
-Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure.
-Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins.
-
-| Possible answers | Design considerations |
-| - | - |
-| Yes | WDAC rules can be developed and implemented through Group Policy, based on your AD DS structure.|
-| No | The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.|
-
-## Record your findings
-
-The next step in the process is to record and analyze your answers to the preceding questions. If WDAC is the right solution for your goals, you can set your application control policy objectives and plan your WDAC rules.
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
index 597df3c8b3..e35f247793 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
@@ -1,6 +1,7 @@
---
title: Use code signing to simplify application control for classic Windows applications (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
index 567c3db270..bb2b9834f3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
@@ -1,6 +1,7 @@
---
title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/19/2019
---
@@ -30,11 +36,11 @@ Before you get started, be sure to review these best practices:
**Best practices**
- Test your code integrity policies on a pilot group of devices before deploying them to production.
-- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](hhttps://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
+- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
**To sign a code integrity policy**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, click **Store settings**, and then click **Device Guard**.
3. Click **Upload** to upload your code integrity policy.
4. After the files are uploaded, click **Sign** to sign the code integrity policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
index 7cca116982..edbac5d2b9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
@@ -1,6 +1,7 @@
---
title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10)
description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
index 8919d6d670..2151bc0de5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
@@ -1,6 +1,7 @@
---
title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
index 8d7885f549..90585fe7cb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
@@ -1,16 +1,19 @@
---
title: Windows Defender Application Control and .NET Hardening (Windows 10)
description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 08/20/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
index 91eec3f5c5..62085ad482 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
@@ -1,14 +1,20 @@
---
title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10)
description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 06/14/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 06/14/2018
---
# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
index 1c2b670b16..aac3df82fc 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
@@ -1,15 +1,20 @@
---
title: Deploy Managed Installer for Windows Defender Device Guard (Windows 10)
description: Explains how you can use a managed installer to automatically authorize applications deployed and installed by a designated software distribution solution, such as System Center Configuration Manager.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 06/13/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 06/13/2018
---
# Deploy Managed Installer for Windows Defender Application Control
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
index 38cfd605db..80ddc17590 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
@@ -1,15 +1,20 @@
---
title: Planning and getting started on the Windows Defender Application Control deployment process (Windows 10)
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 05/16/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 05/16/2018
---
# Planning and getting started on the Windows Defender Application Control deployment process
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
index e9719fd4e4..605383ec22 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
@@ -1,28 +1,41 @@
---
title: Windows Defender Application Control design guide (Windows 10)
-description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
-keywords: virtualization, security, malware
+description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows 10 devices.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.topic: conceptual
ms.date: 02/20/2018
-ms.reviewer:
-ms.author: dansimp
---
# Windows Defender Application Control design guide
**Applies to**
- Windows 10
-- Windows Server
+- Windows Server 2016 and above
This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization.
+## Plan for success
+
+A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be very successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning:
+
+- Executive sponsorship and organizational buy-in is in place.
+- There is a clear **business** objective for using application control and it is not being planned as a purely technical problem from IT.
+- The organization has a plan to handle potential helpdesk support requests for users who are blocked from running some apps.
+- The organization has considered where application control can be most useful (e.g. securing sensitive workloads or business functions) and also where it may be difficult to achieve (e.g. developer workstations).
+
+Once these business factors are in place, you are ready to begin planning your WDAC deployment. The following topics can help guide you through your planning process.
## In this section
@@ -31,7 +44,5 @@ This guide covers design and planning for Windows Defender Application Control (
| [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. |
| [Select the types of rules to create](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. |
| [Plan for WDAC policy management](plan-windows-defender-application-control-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining WDAC policies. |
-| [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |
After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
-
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
index b3bbec14d2..b05ffe98c6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
@@ -1,20 +1,23 @@
---
-title: Windows Defender Application Control (WDAC) (Windows 10)
-description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+title: Application Control for Windows
+description: Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 01/08/2019
---
-# Windows Defender Application Control
+# Application Control
**Applies to:**
@@ -22,36 +25,77 @@ ms.date: 01/08/2019
- Windows Server 2016
- Windows Server 2019
-With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks.
-In most organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative.
+With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks.
-However, when a user runs a process, that process has the same level of access to data that the user has.
-As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software.
+In most organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software.
-Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions.
-Specifically, application control moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run.
-Many organizations, like the Australian Signals Directorate, understand this and frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).
+Application control can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). Application control policies can also block unsigned scripts and MSIs, and restrict Windows PowerShell to run in [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes).
-Windows Defender Application Control (WDAC) can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel).
-WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs in [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-5.1).
+Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control moves away from an application trust model where all applications are assumed trustworthy to one where applications must earn trust in order to run. Many organizations, like the Australian Signals Directorate, understand this and frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).
+
+> [!NOTE]
+> Although application control can significantly harden your computers against malicious code, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
+
+Windows 10 includes two technologies that can be used for application control depending on your organization's specific scenarios and requirements:
+- **Windows Defender Application Control**; and
+- **AppLocker**
+
+## Windows Defender Application Control
+
+Windows Defender Application Control (WDAC) was introduced with Windows 10 and allows organizations to control what drivers and applications are allowed to run on their Windows 10 clients. WDAC was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria) defined by the Microsoft Security Response Center (MSRC).
> [!NOTE]
> Prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity policies.
-## WDAC System Requirements
+WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on:
+- Attributes of the codesigning certificate(s) used to sign an app and its binaries;
+- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file;
+- The reputation of the app as determined by Microsoft's Intelligent Security Graph;
+- The identity of the process that initiated the installation of the app and its binaries (managed installer);
+- The path from which the app or file is launched (beginning with Windows 10 version 1903);
+- The process that launched the app or binary.
-WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Windows Server 2016 and above.
+### WDAC System Requirements
+
+WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Windows Server 2016 and above.
They can be applied to computers running any edition of Windows 10 or Windows Server 2016 and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune.
-Group Policy or Intune can be used to distribute WDAC policies.
+Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition or Windows Server 2016 and above.
-## New and changed functionality
+## AppLocker
-Prior to Windows 10, version 1709, Windows Defender Application Control was known as Windows Defender Device Guard configurable code integrity policies.
+AppLocker was introduced with Windows 7 and allows organizations to control what applications their users are allowed to run on their Windows clients. AppLocker provides security value as a defense in depth feature and helps end users avoid running unapproved software on their computers.
-Beginning with Windows 10, version 1703, you can use WDAC not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser).
-For more information, see [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md).
+AppLocker policies can apply to all users on a computer or to individual users and groups. AppLocker rules can be defined based on:
+- Attributes of the codesigning certificate(s) used to sign an app and its binaries;
+- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file;
+- The path from which the app or file is launched (beginning with Windows 10 version 1903).
+
+### AppLocker System Requirements
+
+AppLocker policies can only be configured on and applied to computers that are running on the supported versions and editions of the Windows operating system. For more info, see [Requirements to Use AppLocker](applocker/requirements-to-use-applocker.md).
+AppLocker policies can be deployed using Group Policy or MDM.
+
+## Choose when to use WDAC or AppLocker
+
+Although either AppLocker or WDAC can be used to control application execution on Windows 10 clients, the following factors can help you decide when to use each of the technologies.
+
+**WDAC is best when:**
+- You are adopting application control primarily for security reasons.
+- Your application control policy can be applied to all users on the managed computers.
+- All of the devices you wish to manage are running Windows 10.
+
+**AppLocker is best when:**
+- You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS.
+- You need to apply different policies for different users or groups on a shared computer.
+- You are using application control to help users avoid running unapproved software, but you do not require a solution designed as a security feature.
+- You do not wish to enforce application control on application files such as DLLs or drivers.
+
+**When to use both WDAC and AppLocker together**
+AppLocker can also be deployed as a complement to WDAC to add user- or group-specific rules for shared device scenarios where its important to prevent some users from running specific apps.
+As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
## See also
- [WDAC design guide](windows-defender-application-control-design-guide.md)
- [WDAC deployment guide](windows-defender-application-control-deployment-guide.md)
+- [AppLocker overview](applocker/applocker-overview.md)
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md
deleted file mode 100644
index bc80b871c8..0000000000
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: Windows Defender Device Guard and AppLocker (Windows 10)
-description: Explains how
-keywords: virtualization, security, malware
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-author: dansimp
-ms.date: 05/03/2018
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
----
-
-# Windows Defender Device Guard with AppLocker
-
-Although [AppLocker](applocker/applocker-overview.md) is not considered a new Windows Defender Device Guard feature, it complements Windows Defender Device Guard functionality when Windows Defender Application Control (WDAC) cannot be fully implemented or its functionality does not cover every desired scenario.
-There are many scenarios in which WDAC would be used alongside AppLocker rules.
-As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
-
-> [!NOTE]
-> One example of how Windows Defender Device Guard functionality can be enhanced by AppLocker is when you want to apply different policies for different users on the same device. For example, you may allow your IT support personnel to run additional apps that you do not allow for your end-users. You can accomplish this user-specific enforcement by using an AppLocker rule.
-
-AppLocker and Windows Defender Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible.
-In addition to these features, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
index 990977f063..3f9f335b8f 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
@@ -56,7 +56,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Win
|Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.
**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.
**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
|Allow Persistence|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
**Disabled or not configured.** All user data within Application Guard is reset between sessions.
**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**- Open a command-line program and navigate to Windows/System32.
- Type `wdagtool.exe cleanup`.
The container environment is reset, retaining only the employee-generated data. - Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
The container environment is reset, including discarding all employee-generated data.
|
-|Turn on Windows Defender Application Guard in Enterprise Mode|Windows 10 Enterprise, 1709 or higher|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.
**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.|
+|Turn on Windows Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device. Available options:- Enable Windows Defender Application Guard only for Microsoft Edge;
- Enable Windows Defender Application Guard only for Microsoft Office;
- Enable Windows Defender Application Guard for both Microsoft Edge and Microsoft Office.
**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.|
|Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.
**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.|
|Allow hardware-accelerated rendering for Windows Defender Application Guard|Windows 10 Enterprise, 1803 or higher
Windows 10 Pro, 1803 or higher|Determines whether Windows Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Windows Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Windows Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Windows Defender Application Guard will automatically revert to software-based (CPU) rendering.
**Important**
Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.
**Disabled or not configured.** Windows Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.|
|Allow camera and microphone access in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher
Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Windows Defender Application Guard.|**Enabled.** Applications inside Windows Defender Application Guard are able to access the camera and microphone on the user's device.
**Important**
Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.
**Disabled or not configured.** Applications inside Windows Defender Application Guard are unable to access the camera and microphone on the user's device.|
diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
index 9d214a2b3c..475ce2cff3 100644
--- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
+++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
@@ -7,38 +7,41 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
author: mjcaparas
+ms.author: macapara
+audience: ITPro
ms.localizationpriority: medium
ms.date: 07/27/2017
ms.reviewer:
manager: dansimp
-ms.author: macapara
---
# Windows Defender SmartScreen
+
**Applies to:**
- Windows 10
- Windows 10 Mobile
-Windows Defender SmartScreen helps to protect your employees if they try to visit sites previously reported as phishing or malware websites, or if an employee tries to download potentially malicious files.
+Windows Defender SmartScreen protects against phishing or malware websites, and the downloading of potentially malicious files.
**SmartScreen determines whether a site is potentially malicious by:**
-- Analyzing visited webpages looking for indications of suspicious behavior. If it finds suspicious pages, SmartScreen shows a warning page, advising caution.
+- Analyzing visited webpages, looking for indications of suspicious behavior. If SmartScreen determines that a page is suspicious, it will show a warning page to advise caution.
-- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, SmartScreen shows a warning to let the user know that the site might be malicious.
+- Checking visited sites against a dynamic list of reported phishing and malicious software sites. If SmartScreen finds a match, it will show a warning indicating that the site might be malicious.
**SmartScreen determines whether a downloaded app or app installer is potentially malicious by:**
-- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen shows a warning to let the user know that the site might be malicious.
+- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If SmartScreen finds a match, it will show a warning indicating that the site might be malicious.
-- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, SmartScreen shows a warning, advising caution.
+- Checking downloaded files against a list of files that are well-known and downloaded by many Windows users. If the file isn't on that list, SmartScreen shows a warning, advising caution.
- >[!NOTE]
- >Before Windows 10, version 1703 this feature was called the SmartScreen Filter when used within the browser and Windows SmartScreen when used outside of the browser.
+ > [!NOTE]
+ > Before Windows 10, version 1703, this feature was called _the SmartScreen Filter_ when used within the browser and _Windows SmartScreen_ when used outside of the browser.
## Benefits of Windows Defender SmartScreen
-Windows Defender SmartScreen helps to provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are:
+
+Windows Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are:
- **Anti-phishing and anti-malware support.** SmartScreen helps to protect your employees from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly-used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Microsoft SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97)
@@ -50,28 +53,27 @@ Windows Defender SmartScreen helps to provide an early warning system against we
- **Management through Group Policy and Microsoft Intune.** SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md).
+- **Blocking URLs associated with potentially unwanted applications.** In the next major version of Microsoft Edge (based on Chromium), SmartScreen will blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md).
+
## Viewing Windows Defender SmartScreen anti-phishing events
+
When Windows Defender SmartScreen warns or blocks an employee from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx).
-
## Viewing Windows event logs for SmartScreen
+
SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer.
> [!NOTE]
> For information on how to use the Event Viewer, see [Windows Event Viewer](https://docs.microsoft.com/host-integration-server/core/windows-event-viewer1).
-|EventID | Description |
-| :---: | :---: |
-|1000 | Application SmartScreen Event|
-|1001 | Uri SmartScreen Event|
-|1002 | User Decision SmartScreen Event|
+EventID | Description
+-|-
+1000 | Application SmartScreen Event
+1001 | Uri SmartScreen Event
+1002 | User Decision SmartScreen Event
## Related topics
+
- [SmartScreen Frequently Asked Questions (FAQ)](https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx)
-
- [Threat protection](../index.md)
-
- [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings)
-
->[!NOTE]
->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
diff --git a/windows/security/threat-protection/windows-platform-common-criteria.md b/windows/security/threat-protection/windows-platform-common-criteria.md
index f2d8e10f0a..8efa0d1a1c 100644
--- a/windows/security/threat-protection/windows-platform-common-criteria.md
+++ b/windows/security/threat-protection/windows-platform-common-criteria.md
@@ -23,7 +23,7 @@ Microsoft is committed to optimizing the security of its products and services.
The Security Target describes security functionality and assurance measures used to evaluate Windows.
-- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf)
+- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf)
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/B/6/A/B6A5EC2C-6351-4FB9-8FF1-643D4BD5BE6E/Windows%2010%201709%20GP%20OS%20Security%20Target.pdf)
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf)
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf)
@@ -43,7 +43,7 @@ The Security Target describes security functionality and assurance measures used
- [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-st.pdf)
- [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-st.pdf)
- [Windows 7 and Windows Server 2008 R2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-st.pdf)
-- [Microsoft Windows Server 2008 R2 Hyper-V Role](http://www.microsoft.com/download/en/details.aspx?id=29305)
+- [Microsoft Windows Server 2008 R2 Hyper-V Role](https://www.microsoft.com/download/en/details.aspx?id=29305)
- [Windows Vista and Windows Server 2008 at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-st.pdf)
- [Microsoft Windows Server 2008 Hyper-V Role](http://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf)
- [Windows Vista and Windows Server 2008 at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_st_v1.0.pdf)
@@ -60,7 +60,7 @@ These documents describe how to configure Windows to replicate the configuration
**Windows 10, Windows 10 Mobile, Windows Server 2016, Windows Server 2012 R2**
-- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf)
+- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf)
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/5/D/2/5D26F473-0FCE-4AC4-9065-6AEC0FE5B693/Windows%2010%201709%20GP%20OS%20Administrative%20Guide.pdf)
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf)
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf)
@@ -137,7 +137,7 @@ These documents describe how to configure Windows to replicate the configuration
An Evaluation Technical Report (ETR) is a report submitted to the Common Criteria certification authority for how Windows complies with the claims made in the Security Target. A Certification / Validation Report provides the results of the evaluation by the validation team.
-- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf)
+- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf)
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/2/C/2/2C20D013-0610-4047-B2FA-516819DFAE0A/Windows%2010%201709%20GP%20OS%20Certification%20Report.pdf)
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf)
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf)
|
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
-
-
-
-
-
-
-
-
-
-Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service.
-
-[BRK2417: What’s new in Windows Analytics: An Intro to Desktop Analytics](https://myignite.techcommunity.microsoft.com/sessions/64324#ignite-html-anchor)
-
-[BRK3018: Deploying Windows 10 in the enterprise using traditional and modern techniques](https://myignite.techcommunity.microsoft.com/sessions/64509#ignite-html-anchor)
-
-[BRK3019: Delivery Optimization deep dive: How to reduce internet bandwidth impact on your network](https://myignite.techcommunity.microsoft.com/sessions/64510#ignite-html-anchor)
-
-[BRK3020: Using AI to automate Windows and Office update staging with Windows Update for Business](https://myignite.techcommunity.microsoft.com/sessions/64513#ignite-html-anchor)
-
-[BRK3027: Deploying Windows 10: Making the update experience smooth and seamless](https://myignite.techcommunity.microsoft.com/sessions/64612#ignite-html-anchor)
-
-[BRK3039: Windows 10 and Microsoft Office 365 ProPlus lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor)
-
-[BRK3211: Ask the Experts: Successfully deploying, servicing, managing Windows 10](https://myignite.techcommunity.microsoft.com/sessions/65963#ignite-html-anchor)
-
-[THR2234: Windows servicing and delivery fundamentals](https://myignite.techcommunity.microsoft.com/sessions/66741#ignite-html-anchor)
-
-[THR3006: The pros and cons of LTSC in the enterprise](https://myignite.techcommunity.microsoft.com/sessions/64512#ignite-html-anchor)
+---
+title: Windows as a service
+ms.prod: windows-10
+layout: LandingPage
+ms.topic: landing-page
+ms.manager: elizapo
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.localizationpriority: high
+ms.collection: M365-modern-desktop
+---
+# Windows as a service
+
+Find the tools and resources you need to help deploy and support Windows as a service in your organization.
+
+## Latest news, videos, & podcasts
+
+Find the latest and greatest news on Windows 10 deployment and servicing.
+
+**Discovering the Windows 10 Update history pages**
+> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY]
+
+Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the 
-
-
-Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism.
-
-- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot). This is the preferred mechanism for all customers.
-- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers.
-- [Microsoft 365 Business & Office 365 Admin](https://docs.microsoft.com/microsoft-365/business/add-autopilot-devices-and-profile). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business.
-- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings.
-
-A summary of each platform's capabilities is provided below.
-
-