diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 3562d6d9f1..2ffc227a40 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -8,7 +8,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -40,7 +40,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -56,7 +56,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -88,7 +88,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -120,7 +120,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -136,7 +136,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -200,7 +200,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -232,7 +232,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -280,7 +280,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -481,4 +481,4 @@ }, "need_generate_pdf": false, "need_generate_intellisense": false -} \ No newline at end of file +} diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index baa0b106f7..39a821b641 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6036,6 +6036,11 @@ "redirect_url": "/hololens/hololens-recovery", "redirect_document_id": false }, +{ + "source_path": "devices/hololens/holographic-photos-and-video.md", + "redirect_url": "/hololens/holographic-photos-and-videos", + "redirect_document_id": false +}, { "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", "redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", @@ -15330,6 +15335,81 @@ "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", "redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", +"redirect_document_id": true +}, +{ +"source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", +"redirect_document_id": true } ] } diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index aaea044e0e..45cd5c2570 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -35,6 +35,7 @@ "manager": "laurawi", "ms.prod": "edge", "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.microsoft-edge", diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 9fdee0781f..1cec2c9694 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -31,6 +31,7 @@ "manager": "laurawi", "ms.date": "04/05/2017", "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.internet-explorer", diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 87553ae281..8b12d44ca5 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -23,16 +23,16 @@ ## [Set up ring based updates for HoloLens](hololens-updates.md) ## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) -# User management and access management -## [Share your HoloLens with multiple people](hololens-multiple-users.md) -## [Set up HoloLens as a kiosk (single application access)](hololens-kiosk.md) -## [Set up limited application access](hololens-kiosk.md) - # Navigating Windows Holographic ## [Start menu and mixed reality home](holographic-home.md) ## [Use your voice with HoloLens](hololens-cortana.md) ## [Find and save files](hololens-find-and-save-files.md) -## [Create, share, and view photos and video](holographic-photos-and-video.md) +## [Create, share, and view photos and video](holographic-photos-and-videos.md) + +# User management and access management +## [Share your HoloLens with multiple people](hololens-multiple-users.md) +## [Set up HoloLens as a kiosk (single application access)](hololens-kiosk.md) +## [Set up limited application access](hololens-kiosk.md) # Holographic Applications ## [Try 3D Viewer](holographic-3d-viewer-beta.md) diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 51b4a3afbb..4f53494c32 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -43,8 +43,9 @@ "./": { "depot_name": "Win.itpro-hololens", "folder_relative_path_in_docset": "./" + } + } - } }, "fileMetadata": {}, "template": [ @@ -52,5 +53,15 @@ ], "dest": "devices/hololens", "markdownEngineName": "markdig" - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ] } diff --git a/devices/hololens/holographic-photos-and-video.md b/devices/hololens/holographic-photos-and-video.md deleted file mode 100644 index a02c1fb445..0000000000 --- a/devices/hololens/holographic-photos-and-video.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Create, share, and view photos and video -description: Create, share, and view photos and video -ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: high -ms.date: 8/12/19 -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Create, share, and view photos and video - -Use your HoloLens to take photos and videos that capture the holograms you've placed in your world. - -To sync your photos and videos to OneDrive, open the OneDrive app and select **Settings** > **Camera upload**, and then turn on **Camera upload**. - -## Take a photo on HoloLens (1st gen) - -Use the open the **Start** menu, and then select the Photos app. - -Use gaze to position the photo frame, then air tap to take the picture. The picture will be saved to your collection in the Photos app.

- -Want to snap a quick picture? Press the [volume up and volume down buttons](hololens1-hardware.md#hololens-components) at the same time. - -## Take a video on HoloLens (1st gen) - -Use the bloom gesture to go to **Start**, then select **Video**. Use gaze to position the video frame, then air tap to start recording. To stop recording, use bloom once. The video will be saved to your collection in the Photos app. - -To start recording more quickly, press and hold the volume up and volume down buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons. - -> [!TIP] -> You can always have Cortana take a photo or a video for you. Just say "Hey Cortana, take a photo" or "Hey Cortana, take a video." [What else can I say to Cortana?](hololens-cortana.md) - -## Find your photos and videos - -To see your photos from OneDrive, select **More** > **Settings**, and then turn on **Show my cloud-only content from OneDrive**. (You'll need to sign in to the Photos app with your Microsoft account, if you haven't already.) - -To pin a photo or video in your world, open it, then select **Place in mixed world**. Use tap and hold to move it to where you want it. - -## Share photos and videos - -To share images to a social network, in the Collection view, tap and hold the photo you want to share, then select **Share**. Select **Share Assistant**, then select the app that you want to share to. - -You can also share directly from the camera app right after you take a photo—at the top of the image, select **Share**. diff --git a/devices/hololens/holographic-photos-and-videos.md b/devices/hololens/holographic-photos-and-videos.md new file mode 100644 index 0000000000..10e6bb4756 --- /dev/null +++ b/devices/hololens/holographic-photos-and-videos.md @@ -0,0 +1,150 @@ +--- +title: Capture and manage mixed reality photos and videos +description: Learn how to capture, view, and share mixed reality photos and videos, using HoloLens. +keywords: hololens, photo, video, capture, mrc, mixed reality capture, photos, camera, stream, livestream, demo +ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 +ms.prod: hololens +ms.sitesec: library +author: mattzmsft +ms.author: mazeller +ms.topic: article +audience: ITPro +ms.localizationpriority: medium +ms.date: 10/28/2019 +manager: jarrettr +appliesto: +- HoloLens (1st gen) +- HoloLens 2 +--- + +# Create mixed reality photos and videos + +HoloLens gives users the experience of mixing the real world with the digital world. Mixed reality capture (MRC) lets you capture that experience as a photo or video, or share what you see with others in real-time. + +Mixed reality capture uses a first-person point of view so other people can see holograms as you see them. For a third-person point of view, use [spectator view](https://docs.microsoft.com/windows/mixed-reality/spectator-view). Spectator view is especially useful for demos. + +While it's fun to share videos amongst friends and colleagues, videos can also help teach other people to use an app or to communicate problems with apps and experiences. + +> [!NOTE] +> If you can't launch mixed reality capture experiences and your HoloLens is a work device, check with your system administrator. Access to the camera can be restricted through company policy. + +## Capture a mixed reality photo + +There are several ways to take a photo of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. + +### Hardware buttons to take photos + +To take a quick photo of your current view, press the volume up and volume down buttons at the same time. This is a bit like the HoloLens version of a screenshot or print screen. + +- [Button locations on HoloLens 2](hololens2-hardware.md) +- [Button locations on HoloLens (1st gen)](hololens1-hardware.md#hololens-components) + +> [!NOTE] +> Holding the **volume up** and **volume down** buttons for three seconds will start recording a video rather than taking a photo. To stop recording, tap both **volume up** and **volume down** buttons simultaneously. + +### Voice commands to take photos + +Cortana can also take a picture. Say: "Hey Cortana, take a picture." + +### Start menu to take photos + +Use the Start gesture to go to **Start**, then select the **camera** icon. + +Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to take a photo. You can continue to air tap and capture additional photos. Any photos you capture will be saved to your device. + +Use the Start gesture again to end photo capture. + +## Capture a mixed reality video + +There are several ways to record a video of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. + +### Hardware buttons to record videos + +The quickest way to record a video is to press and hold the **volume up** and **volume down** buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons simultaneously. + +> [!NOTE] +> Quickly pressing the **volume up** and **volume down** buttons at the same time will take a photo rather than recording a video. + +### Voice to record videos + +Cortana can also record a video. Say: "Hey Cortana, start recording." To stop a video, say "Hey Cortana, stop recording." + +### Start menu to record videos + +Use the Start gesture to go to **Start**, then select the **video** icon. Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to start recording. There will be a three second countdown and your recording will begin. + +To stop recording, use the Start gesture and select the highlighted **video** icon. The video will be saved to your device. + +> [!NOTE] +> **Applies to HoloLens (1st gen) only** +> The [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018) changes how the Start gesture and Windows button behave on HoloLens (1st gen). Before the update, the Start gesture or Windows button would stop a video recording. After the update, however, the Start gesture or Windows button opens the **Start** menu (or the **quick actions menu** if you are in an immersive app), from which you can select the highlighted **video** icon to stop recording. + +## Share what you see in real-time + +You can share what you see in HoloLens with friends and colleagues in real-time. There are a few methods available: + +1. Connecting to a Miracast-enabled device or adapter to watch on a TV. +1. Using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to watch on a PC +1. Using the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) to watch on a PC. +1. Deploying the [Microsoft Dynamics 365 Remote Assist](https://dynamics.microsoft.com/en-us/mixed-reality/remote-assist) app, which enables front-line workers to stream what they see to a remote expert. The remote expert can then guide the front-line worker verbally or by annotating in their world. + +> [!NOTE] +> Sharing what you see via Windows Device Portal or Microsoft HoloLens companion app requires your HoloLens to be in [Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#setting-up-hololens-to-use-windows-device-portal). + +### Stream video with Miracast + +Use the Start gesture to go to **Start**, then select the **connect** icon. From the picker that appears, select the Miracast-enabled device or adapter to which you want to connect. + +To stop sharing, use the Start gesture and select the highlighted **connect** icon. Because you were streaming, nothing will be saved to your device. + +> [!NOTE] +> Miracast support was enabled on HoloLens (1st gen) beginning with the [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018). + +### Real time video with Windows Device Portal + +Because sharing via Windows Device Portal requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode and navigate Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). + +### Microsoft HoloLens companion app + +Because sharing via the Microsoft HoloLens companion app requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). Then, download the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) and follow the instructions within the app to connect to your HoloLens. + +Once the app is set up with your HoloLens, select the **Live stream** option from the app's main menu. + +## View your mixed reality photos and videos + +Mixed reality photos and videos are saved to the device's "Camera Roll". You can browse the contents of this folder on your HoloLens with the File Explorer app (navigate to Pictures > Camera Roll). + +You can also view your mixed reality photos and videos in the Photos app, which is pre-installed on HoloLens. To pin a photo in your world, select it in the Photos app and choose **Place in mixed world**. You can move the photo around your world after it's been placed. + +To view and/or save your mixed reality photos and videos on a PC connected to HoloLens, you can use [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture) or your [PC's File Explorer via MTP](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018#new-features-for-hololens). + +## Share your mixed reality photos and videos + +After capturing a mixed reality photo or video, a preview will appear. Select the **share** icon above the preview to bring up the share assistant. From there, you can select the end point to which you'd like to share that photo or video. + +You can also share mixed reality photos and videos from OneDrive, by automatically uploading your mixed reality photos and videos. Open the OneDrive app on HoloLens and sign in with a personal [Microsoft account](https://account.microsoft.com) if you haven't already. Select the **settings** icon and choose **Camera upload**. Turn Camera upload on. Your mixed reality photos and videos will now be uploaded to OneDrive each time you launch the app on HoloLens. + +> [!NOTE] +> You can only enable camera upload in OneDrive if you’re signed into OneDrive with a personal Microsoft account. If you set up HoloLens with a work or school account, you can add a personal Microsoft account in the OneDrive app to enable this feature. + +## Limitations of mixed reality capture + +- While using mixed reality capture, the framerate of HoloLens will be halved to 30 Hz. +- Videos have a maximum length of five minutes. +- The resolution of photos and videos may be reduced if the photo/video camera is already in use by another application, while live streaming, or when system resources are low. + +## Default file format and resolution + +### Default photo format and resolution + +| Device | Format | Extension | Resolution | +|----------|----------|----------|----------| +| HoloLens 2 | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 3904x2196px | +| HoloLens (1st gen) | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 1408x792px | + +### Recorded video format and resolution + +| Device | Format | Extension | Resolution | Speed | Audio | +|----------|----------|----------|----------|----------|----------| +| HoloLens 2 | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1920x1080px | 30fps | 48kHz Stereo | +| HoloLens (1st gen) | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1216x684px | 24fps | 48kHz Stereo | diff --git a/devices/hololens/hololens2-basic-usage.md b/devices/hololens/hololens2-basic-usage.md index e15003a8f4..d8cc60064a 100644 --- a/devices/hololens/hololens2-basic-usage.md +++ b/devices/hololens/hololens2-basic-usage.md @@ -28,7 +28,7 @@ This guide provides an intro to: On HoloLens, holograms blend the digital world with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can always see your surroundings, move freely, and interact with people and objects. We call this experience "mixed reality". -The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision unobscured. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls. +The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision clear. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls. Getting around HoloLens is a lot like using your smart phone. You can use your hands to touch and manipulate holographic windows, menus, and buttons. @@ -54,6 +54,8 @@ To bring up a **context menu**, like the ones you'll find on an app tile in the ## Use hand ray for holograms out of reach +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZOum] + When there are no holograms near your hands, the **touch cursor** will hide automatically and **hand rays** will appear from the palm of your hands. Hand rays allow you to interact with holograms from a distance. > [!TIP] @@ -71,6 +73,8 @@ To select something using **hand ray**, follow these steps: ### Grab using air tap and hold +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxnh] + To grab a hologram or scroll app window content using **hand ray**, start with an **air tap**, but keep your fingers together instead of releasing them. Use **air tap and hold** to perform the following actions with hand ray: @@ -81,7 +85,9 @@ Use **air tap and hold** to perform the following actions with hand ray: ## Start gesture -The Start gesture opens the **Start menu**. To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand. The Start menu will open **where you’re looking**. +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxng] + +The Start gesture opens the **Start menu**. To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand. The Start menu will open **where you’re looking**. > [!TIP] > @@ -135,6 +141,8 @@ Move a hologram or app by following these steps: ### Resizing holograms +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZYIb] + Grab and use the **resize handles** that appear on the corners of 3D holograms and app windows to resize them. For an app window, when resized this way the window content correspondingly increases in size and becomes easier to read. diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md index 7b662a76b4..9f8edd7758 100644 --- a/devices/hololens/hololens2-setup.md +++ b/devices/hololens/hololens2-setup.md @@ -1,6 +1,7 @@ --- title: Prepare a new HoloLens 2 description: This guide walks through first time set up and hardware guide. +keywords: hololens, lights, fit, comfort, parts ms.assetid: 02692dcf-aa22-4d1e-bd00-f89f51048e32 ms.date: 9/17/2019 keywords: hololens @@ -68,14 +69,14 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL ### Charging behavior -| State of the Device | Action | HoloLens 2 will do this | +| State of the Device | Action | HoloLens 2 will do this | | - | - | - | -| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging. -| ON | Remove USB Cable | Device stops charging -| ON | Plug in USB Cable | Device starts charging -| SLEEP | Plug in USB Cable | Device starts charging -| SLEEP | Remove USB Cable | Device stops charging -| ON with USB cable pluged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging | +| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging. +| ON | Remove USB Cable | Device stops charging +| ON | Plug in USB Cable | Device starts charging +| SLEEP | Plug in USB Cable | Device starts charging +| SLEEP | Remove USB Cable | Device stops charging +| ON with USB cable plugged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging | ### Lights that indicate the battery level @@ -89,18 +90,19 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL ### Sleep Behavior -| State of the Device | Action | HoloLens 2 will do this | +| State of the Device | Action | HoloLens 2 will do this | | - | - | - | -| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights | -| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights | -| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights | +| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights | +| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights | +| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights | ### Lights to indicate problems | When you do this | The lights do this | It means this | | - | - | - | | You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. | -| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. | +| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. | +| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. | HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). | ## Safety and comfort diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 2f7fc9fd1f..aa2c651d1a 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -22,6 +22,8 @@ ## Deploy ### [Surface Hub 2S adoption and training](surface-hub-2s-adoption-kit.md) +### [Surface Hub 2S adoption videos](surface-hub-2s-adoption-videos.md) + ### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md) ### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) ### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md) diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md index 2058fcd918..78ec22ee3d 100644 --- a/devices/surface-hub/surface-hub-2s-adoption-kit.md +++ b/devices/surface-hub/surface-hub-2s-adoption-kit.md @@ -9,7 +9,7 @@ ms.author: greglin manager: laurawi audience: Admin ms.topic: article -ms.date: 08/22/2019 +ms.date: 11/04/2019 ms.localizationpriority: Medium --- @@ -17,6 +17,10 @@ ms.localizationpriority: Medium Whether you are a small or large business, a Surface Hub adoption plan is critical in generating the right use cases and helping your users become comfortable with the device. Check out these downloadable guides designed to help you deliver training across your organization. +## On-demand training + +- [Surface Hub 2S adoption and training videos](surface-hub-2s-adoption-videos.md) + ## Adoption toolkit - [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) @@ -28,7 +32,7 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf) - [Training guide – Microsoft Teams desktop](downloads/Guide-SurfaceHub2S-Teams.pptx) -[Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) +[Download all training guides](https://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) ## End user guides @@ -37,7 +41,7 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx) - [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx) -[Download all end user guides](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) +[Download all end user guides](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) ## Quick reference cards @@ -52,4 +56,4 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf) - [Whiteboard tools](downloads/QRCWhiteboardTools.pdf) -[Download all quick reference cards](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) +[Download all quick reference cards](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) diff --git a/devices/surface-hub/surface-hub-2s-adoption-videos.md b/devices/surface-hub/surface-hub-2s-adoption-videos.md new file mode 100644 index 0000000000..67fa4e4570 --- /dev/null +++ b/devices/surface-hub/surface-hub-2s-adoption-videos.md @@ -0,0 +1,137 @@ +--- +title: "Surface Hub 2S on-demand adoption and training videos" +description: "This page contains comprehensive training for Surface Hub 2S via on-demand streaming" +keywords: separate values with commas +ms.prod: surface-hub +ms.sitesec: library +author: greg-lindsay +ms.author: greglin +manager: laurawi +audience: Admin +ms.topic: article +ms.date: 11/04/2019 +ms.localizationpriority: Medium +--- + +# Surface Hub 2S on-demand adoption and training videos + +This page contains comprehensive training for Surface Hub 2S, available on demand. + +## Chapter 1 - Training overview + +> ![VIDEO ]
+ +- Welcome and introduction +- Training overview and agenda +- Software and technology reference +- Surface Hub messaging +- Industries and user roles +- Overview of training services +- Training best practices + +## Chapter 2 - Getting started with Surface Hub + +> ![VIDEO ]
+ +- What is Surface Hub? +- Technical overview +- Steelcase Roam and the mobility story +- Surface Hub services +- Getting started with Surface Hub +- Gathering expectations + +## Chapter 3 - Navigating Surface Hub + +> ![VIDEO ]
+ +- Welcome screen +- Start menu +- Full screen +- Clip to Whiteboard +- Task bar menu +- Teams/Skype +- End Session + +## Chapter 4 - Whiteboarding and collaboration + +> ![VIDEO ]
+ +- Whiteboard introduction +- Starting the Whiteboard +- Whiteboard tools +- Inserting pictures +- Changing the background +- Sharing the whiteboard +- Export the Whiteboard + +## Chapter 5 - Exploring Surface Hub apps + +> ![VIDEO ]
+ +- Surface Hub apps introduction +- PowerPoint overview +- Microsoft Word +- Microsoft Excel +- Microsoft Edge + +## Chapter 6 - Advanced apps and Office 365 + +> ![VIDEO ]
+ +- Advanced apps introduction +- Microsoft Maps +- Photos +- Power BI +- Sign in to Office 365 +- OneDrive +- CoAuthor documents + +## Chapter 7 - Connecting devices + +> ![VIDEO ]
+ +- Connect introduction +- Miracast overview +- Touch and Pen Input +- Wired connect overview +- Line of Business app workflows +- Troubleshooting Miracast and wired connect + +## Chapter 8 - Skype for Business meetings + +> ![VIDEO ]
+ +- Introduction to Skype for Business +-Scheduling Skype for Business meetings +- Start a meeting +- Start an ad hoc meeting +- Join a meeting on your calendar +- Managing a Skype for Business meeting +- Present content + +## Chapter 9 - Microsoft Teams meetings + +> ![VIDEO ]
+ +- Introduction to Microsoft Teams +- Scheduling Microsoft Teams meetings +- Start a meeting +- Start an ad hoc meeting +- Join a meeting on your calendar +- Managing a Microsoft Teams meeting +- Present content +- Conclusion + +## Chapter 10 - Basic troubleshooting + +> ![VIDEO ]
+ +- Introduction to Surface Hub troubleshooting +- Application troubleshooting +- End Session +- Restart the device +- Power cycle the device +- Factory reset +- Settings +- Manage Surface Hub +- Conclusion \ No newline at end of file diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md index a24ae8e7b8..c5d75cda00 100644 --- a/devices/surface/battery-limit.md +++ b/devices/surface/battery-limit.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.pagetype: surface, devices ms.sitesec: library author: dansimp -ms.date: 10/02/2018 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp ms.author: dansimp @@ -19,11 +19,13 @@ ms.audience: itpro Battery Limit option is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. This setting is recommended in cases in which the device is continuously connected to power, for example when devices are integrated into kiosk solutions. -## Battery Limit information +## How Battery Limit works Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity. -Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. +## Supported devices +The Battery Limit UEFI setting is built into the latest Surface devices including Surface Pro 7 and Surface Laptop 3. Earlier devices require a + [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the [Surface Support site](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface). Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later) diff --git a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md index e04ff8e6ba..855d637526 100644 --- a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md +++ b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md @@ -9,7 +9,7 @@ ms.sitesec: library author: Teresa-Motiv ms.author: v-tea ms.topic: article -ms.date: 10/2/2019 +ms.date: 10/31/2019 ms.reviewer: scottmca ms.localizationpriority: medium ms.audience: itpro @@ -17,6 +17,7 @@ manager: jarrettr appliesto: - Surface Laptop (1st Gen) - Surface Laptop 2 +- Surface Laptop 3 --- # How to enable the Surface Laptop keyboard during MDT deployment @@ -32,44 +33,77 @@ On most types of Surface devices, the keyboard should work during Lite Touch Ins To add the keyboard drivers to the selection profile, follow these steps: 1. Download the latest Surface Laptop MSI file from the appropriate locations: - - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489) - - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515) + - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489) + - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515) + - [Surface Laptop 3 with Intel Processor Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=100429) -1. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the following command: +2. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the command from the following example: ```cmd Msiexec.exe /a SurfaceLaptop_Win10_15063_1703008_1.msi targetdir=c:\surface_laptop_drivers /qn ``` -1. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder. +3. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder. ![Image that shows the location of the WindowsPEX64 folder in the Deployment Workbench](./images/surface-laptop-keyboard-1.png) -1. Right-click the **WindowsPEX64** folder and select **Import Drivers**. -1. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder. - - To support Surface Laptop (1st Gen), import the following folders: - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - To support Surface Laptop 2, import the following folders: - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\I2C - - SurfacePlatformInstaller\Drivers\System\SPI - - SurfacePlatformInstaller\Drivers\System\UART +4. Right-click the **WindowsPEX64** folder and select **Import Drivers**. +5. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder. -1. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following: +> [!NOTE] +> Check the downloaded MSI package to determine the format and directory structure. The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. + +To support Surface Laptop (1st Gen), import the following folders: + + - SurfacePlatformInstaller\Drivers\System\GPIO + - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver + - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver + +Or for newer MSI files beginning with "SurfaceUpdate", use: + +- SurfaceUpdate\SerialIOGPIO +- SurfaceUpdate\SurfaceHidMiniDriver +- SurfaceUpdate\SurfaceSerialHubDriver + +To support Surface Laptop 2, import the following folders: + + - SurfacePlatformInstaller\Drivers\System\GPIO + - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver + - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver + - SurfacePlatformInstaller\Drivers\System\I2C + - SurfacePlatformInstaller\Drivers\System\SPI + - SurfacePlatformInstaller\Drivers\System\UART + +Or for newer MSI files beginning with "SurfaceUpdate", use: + +- SurfaceUpdate\SerialIOGPIO +- SurfaceUpdate\IclSerialIOI2C +- SurfaceUpdate\IclSerialIOSPI +- SurfaceUpdate\IclSerialIOUART +- SurfaceUpdate\SurfaceHidMini +- SurfaceUpdate\SurfaceSerialHub + + +To support Surface Laptop 3 with Intel Processor, import the following folders: + +- SurfaceUpdate\IclSerialIOGPIO +- SurfaceUpdate\IclSerialIOI2C +- SurfaceUpdate\IclSerialIOSPI +- SurfaceUpdate\IclSerialIOUART +- SurfaceUpdate\SurfaceHidMini +- SurfaceUpdate\SurfaceSerialHub +- SurfaceUpdate\SurfaceHotPlug + + +6. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following: ![Image that shows the newly imported drivers in the WindowsPEX64 folder of the Deployment Workbench](./images/surface-laptop-keyboard-2.png) -1. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following: +7. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following: ![Image that shows the WindowsPEX64 folder selected as part of a selection profile](./images/surface-laptop-keyboard-3.png) -1. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows: +8. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows: - For **Platform**, select **x64**. - For **Selection profile**, select the new profile. @@ -77,7 +111,7 @@ To add the keyboard drivers to the selection profile, follow these steps: ![Image that shows the Windows PE properties of the MDT Deployment Share](./images/surface-laptop-keyboard-4.png) -1. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable. +9. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable. - For Surface Laptop (1st Gen), the model is **Surface Laptop**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop folder as shown in the figure that follows this list. - For Surface Laptop 2, the model is **Surface Laptop 2**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 2 folder. diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md index 93f0212193..8c512f48c2 100644 --- a/devices/surface/microsoft-surface-brightness-control.md +++ b/devices/surface/microsoft-surface-brightness-control.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 1/15/2019 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp ms.localizationpriority: medium diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 1cfe727788..7fbd031cf5 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -4,7 +4,7 @@ description: Microsoft Surface Deployment Accelerator provides a quick and simpl ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4 ms.reviewer: hachidan manager: dansimp -ms.date: 07/27/2017 +ms.date: 10/31/2019 ms.localizationpriority: medium keywords: deploy, install, tool ms.prod: w10 @@ -19,7 +19,6 @@ ms.audience: itpro # Microsoft Surface Deployment Accelerator - Microsoft Surface Deployment Accelerator (SDA) automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. > [!NOTE] diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 0fac7db7a9..488bd63a15 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -13,7 +13,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 07/27/2017 +ms.date: 10/31/2019 --- # Step by step: Surface Deployment Accelerator diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md index 9576334c98..62c4129d08 100644 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ b/devices/surface/surface-diagnostic-toolkit-business.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 09/27/2019 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp ms.audience: itpro diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md index 6f7e8b6263..738ec1ecae 100644 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md @@ -7,7 +7,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 11/15/2018 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp ms.localizationpriority: medium @@ -24,20 +24,17 @@ This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help user 2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. ![Start SDT in desktop mode](images/sdt-desk-1.png) - - *Figure 1. SDT in desktop mode* +*Figure 1. SDT in desktop mode* 3. When SDT indicates the device has the latest updates, click **Continue** to advance to the catalog of available tests, as shown in figure 2. ![Select from SDT options](images/sdt-desk-2.png) - - *Figure 2. Select from SDT options* +*Figure 2. Select from SDT options* 4. You can choose to run all the diagnostic tests. Or, if you already suspect a particular issue such as a faulty display or a power supply problem, click **Select** to choose from the available tests and click **Run Selected**, as shown in figure 3. See the following table for details of each test. ![Select hardware tests](images/sdt-desk-3.png) - - *Figure 3. Select hardware tests* +*Figure 3. Select hardware tests* Hardware test | Description --- | --- @@ -56,6 +53,7 @@ This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help user + ## Running multiple hardware tests to troubleshoot issues SDT is designed as an interactive tool that runs a series of tests. For each test, SDT provides instructions summarizing the nature of the test and what users should expect or look for in order for the test to be successful. For example, to diagnose if the display brightness is working properly, SDT starts at zero and increases the brightness to 100 percent, asking users to confirm – by answering **Yes** or **No** -- that brightness is functioning as expected, as shown in figure 4. @@ -63,7 +61,6 @@ SDT is designed as an interactive tool that runs a series of tests. For each tes For each test, if functionality does not work as expected and the user clicks **No**, SDT generates a report of the possible causes and ways to troubleshoot it. ![Running hardware diagnostics](images/sdt-desk-4.png) - *Figure 4. Running hardware diagnostics* 1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. @@ -76,24 +73,18 @@ For each test, if functionality does not work as expected and the user clicks ** SDT enables you to diagnose and repair applications that may be causing issues, as shown in figure 5. ![Running repairs](images/sdt-desk-5.png) - *Figure 5. Running repairs* - - - - + ### Generating logs for analyzing issues SDT provides extensive log-enabled diagnosis support across applications, drivers, hardware, and operating system issues, as shown in figure 6. ![Generating logs](images/sdt-desk-6.png) - *Figure 6. Generating logs* - - + ### Generating detailed report comparing device vs. optimal configuration Based on the logs, SDT generates a report for software- and firmware-based issues that you can save to a preferred location. diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md index ffd159f4a1..8fa4e11515 100644 --- a/devices/surface/surface-dock-firmware-update.md +++ b/devices/surface/surface-dock-firmware-update.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 09/18/2019 +ms.date: 10/09/2019 ms.reviewer: scottmca manager: dansimp ms.audience: itpro @@ -47,8 +47,14 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm - **Msiexec.exe /i /quiet /norestart** +> [!NOTE] +> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]" + For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation. +> [!IMPORTANT] +> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details. + ## Intune deployment You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management). @@ -84,8 +90,8 @@ Successful completion of Surface Dock Firmware Update results in new registry ke | Log | Location | Notes | | -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Surface Dock Firmware Update log | /l*v %windir%\logs\Applications\SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. | -| Windows Device Install log | %windir%\inf\ setupapi.dev.log | For more information about using Device Install Log, refer [to SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. | +| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. | +| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-). | **Table 2. Event log IDs for Surface Dock Firmware Update** @@ -97,6 +103,10 @@ Successful completion of Surface Dock Firmware Update results in new registry ke | 2003 | Dock firmware update failed to get firmware version. | | 2004 | Querying the firmware version. | | 2005 | Dock firmware failed to start update. | +| 2006 | Failed to send offer/payload pairs. | +| 2007 | Firmware update finished. | +| 2008 | BEGIN dock telemetry. | +| 2011 | END dock telemetry. | ## Troubleshooting tips diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index d70468adaa..de1879bcba 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -9,8 +9,8 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 01/06/2017 -ms.reviewer: +ms.date: 10/31/2019 +ms.reviewer: scottmca manager: dansimp ms.localizationpriority: medium ms.audience: itpro @@ -66,9 +66,7 @@ After a device is enrolled in SEMM, the configuration file is read and the setti ### Enable or disable devices in Surface UEFI with SEMM - The built in devices that appear in the UEFI Devices page may vary depending on your device or corporate environment; for example, LTE only appears on devices equipped with LTE support. - - The following list shows all the available devices you can manage in SEMM: +The following list shows all the available devices you can manage in SEMM: * Docking USB Port * On-board Audio @@ -82,6 +80,8 @@ After a device is enrolled in SEMM, the configuration file is read and the setti * Wi-Fi and Bluetooth * LTE + >[!NOTE] +>The built-in devices that appear in the UEFI Devices page may vary depending on your device or corporate environment. For example, the UEFI Devices page is not supported on Surface Pro X; LTE only appears on LTE-equipped devices. ### Configure advanced settings with SEMM **Table 1. Advanced settings** diff --git a/devices/surface/surface-manage-dfci-guide.md b/devices/surface/surface-manage-dfci-guide.md index b2988422c1..19a91301f7 100644 --- a/devices/surface/surface-manage-dfci-guide.md +++ b/devices/surface/surface-manage-dfci-guide.md @@ -17,7 +17,7 @@ ms.audience: itpro ## Introduction -The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. +The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For answers to frequently asked questions, see [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333). ### Background @@ -167,6 +167,7 @@ If the original DFCI profile has been deleted, you can remove policy settings by 6. Validate DFCI is removed from the device in the UEFI. ## Learn more -- [Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot) +- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333) +[Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot) - [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) - [Use DFCI profiles on Windows devices in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows) diff --git a/devices/surface/surface-system-sku-reference.md b/devices/surface/surface-system-sku-reference.md index d7e3e77236..74c348d2d1 100644 --- a/devices/surface/surface-system-sku-reference.md +++ b/devices/surface/surface-system-sku-reference.md @@ -9,7 +9,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 03/20/2019 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp ms.localizationpriority: medium @@ -41,6 +41,11 @@ System Model and System SKU are variables that are stored in the System Manageme | Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | | Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | | Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | +| Surface Pro 7 | Surface Pro 7 | Surface_Pro_7_1866 | +| Surface Pro X | Surface Pro X | Surface_Pro_X_1876 | +| Surface Laptop 3 13" Intel | Surface Laptop 3 | Surface_Laptop_3_1867:1868 | +| Surface Laptop 3 15" Intel | Surface Laptop 3 | Surface_Laptop_3_1872 | +| Surface Laptop 3 15" AMD | Surface Laptop 3 | Surface_Laptop_3_1873 | ## Examples diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md index ad386a1445..6e225137c2 100644 --- a/devices/surface/surface-wireless-connect.md +++ b/devices/surface/surface-wireless-connect.md @@ -9,13 +9,12 @@ ms.audience: itpro ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 08/15/2019 +ms.date: 10/31/2019 ms.reviewer: tokatz manager: dansimp --- # Optimize Wi-Fi connectivity for Surface devices -## Introduction To stay connected with all-day battery life, Surface devices implement wireless connectivity settings that balance performance and power conservation. Outside of the most demanding mobility scenarios, users can maintain sufficient wireless connectivity without modifying default network adapter or related settings. @@ -32,7 +31,7 @@ If you’re managing a wireless network that’s typically accessed by many diff - **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device. - **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization. -Surface Go devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. +Specific Surface devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. These include Surface Go, Surface Pro 7, Surface Pro X, and Surface Laptop 3. ## Managing user settings diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md index f05342b48f..6c29966521 100644 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -9,7 +9,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 02/01/2017 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp ms.localizationpriority: medium @@ -384,7 +384,7 @@ To configure Surface UEFI settings or permissions for Surface UEFI settings, you The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. -The following tables show the available settings for Surface Pro 4 and later including Surface Pro 7 and Surface Pro X; Surface Book, Surface Laptop 3, and Surface Go. +The following tables show the available settings for Surface Pro 4 and later including Surface Pro 7, Surface Book, Surface Laptop 3, and Surface Go. *Table 1. Surface UEFI settings for Surface Pro 4* diff --git a/education/developers.yml b/education/developers.yml index 23f2c74297..5c73169853 100644 --- a/education/developers.yml +++ b/education/developers.yml @@ -8,7 +8,7 @@ metadata: description: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here. ms.service: help ms.topic: hub-page - author: v-lamoyn + author: LaurenMoynihan ms.author: v-lamoyn ms.date: 10/24/2019 diff --git a/education/docfx.json b/education/docfx.json index ccdccf2c7e..91c875c200 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -33,6 +33,7 @@ "breadcrumb_path": "/education/breadcrumb/toc.json", "ms.date": "05/09/2017", "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.education", diff --git a/education/index.yml b/education/index.yml index dc0e6fa938..9d3a74a32c 100644 --- a/education/index.yml +++ b/education/index.yml @@ -8,7 +8,7 @@ metadata: description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. ms.service: help ms.topic: hub-page - author: v-lamoyn + author: LaurenMoynihan ms.author: v-lamoyn ms.date: 10/24/2019 diff --git a/education/itadmins.yml b/education/itadmins.yml index dc37e8803d..25eabd906a 100644 --- a/education/itadmins.yml +++ b/education/itadmins.yml @@ -8,26 +8,26 @@ metadata: description: M365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync. ms.service: help ms.topic: hub-page - author: v-lamoyn + author: LaurenMoynihan ms.author: v-lamoyn ms.date: 10/24/2019 productDirectory: - summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments. Check out at https://edujourney.microsoft.com/. Find help now at https://docs.microsoft.com/en-us/microsoft-365/education/deploy/find-deployment-help. + summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments. Check out at https://edujourney.microsoft.com/. Find help now at https://docs.microsoft.com/microsoft-365/education/deploy/find-deployment-help. items: # Card - title: Phase 1 - Cloud deployment imageSrc: ./images/EDU-Deploy.svg links: - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/create-your-office-365-tenant + - url: https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant text: 1. Create your Office 365 tenant - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/secure-and-configure-your-network + - url: https://docs.microsoft.com/microsoft-365/education/deploy/secure-and-configure-your-network text: 2. Secure and configure your network - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/aad-connect-and-adfs + - url: https://docs.microsoft.com/microsoft-365/education/deploy/aad-connect-and-adfs text: 3. Sync your active directory - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/school-data-sync + - url: https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync text: 4. Sync you SIS using School Data Sync - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/license-users + - url: https://docs.microsoft.com/microsoft-365/education/deploy/license-users text: 5. License users # Card - title: Phase 2 - Device management @@ -35,11 +35,11 @@ productDirectory: links: - url: https://docs.microsoft.com/en-us/education/windows/ text: 1. Get started with Windows 10 for Education - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/set-up-windows-10-education-devices + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices text: 2. Set up Windows 10 devices - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/intune-for-education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/intune-for-education text: 3. Get started with Intune for Education - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/use-intune-for-education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education text: 4. Use Intune to manage groups, apps, and settings - url: https://docs.microsoft.com/en-us/intune/enrollment/enrollment-autopilot text: 5. Enroll devices using Windows Autopilot @@ -47,28 +47,28 @@ productDirectory: - title: Phase 3 - Apps management imageSrc: ./images/EDU-Apps-Mgmt.svg links: - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/configure-admin-settings + - url: https://docs.microsoft.com/microsoft-365/education/deploy/configure-admin-settings text: 1. Configure admin settings - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/set-up-teams-for-education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education text: 2. Set up Teams for Education - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/deploy-office-365 + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-office-365 text: 3. Set up Office 365 - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/microsoft-store-for-education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education text: 4. Install apps from Microsoft Store for Education - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/minecraft-for-education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/minecraft-for-education text: 5. Install Minecraft - Education Edition # Card - title: Complete your deployment # imageSrc should be square in ratio with no whitespace imageSrc: ./images/EDU-Tasks.svg links: - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/deploy-exchange-online + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-online text: Deploy Exchange Online - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/deploy-sharepoint-online-and-onedrive + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-online-and-onedrive text: Deploy SharePoint Online and OneDrive - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/deploy-exchange-server-hybrid + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-server-hybrid text: Deploy Exchange Server hybrid - - url: https://docs.microsoft.com/en-us/microsoft-365/education/deploy/deploy-sharepoint-server-hybrid + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-server-hybrid text: Deploy SharePoint Server Hybrid # Card - title: Security & Compliance @@ -80,9 +80,9 @@ productDirectory: text: Azure information protection deployment acceleration guide - url: https://docs.microsoft.com/en-us/cloud-app-security/getting-started-with-cloud-app-security text: Microsoft Cloud app security - - url: https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy + - url: https://docs.microsoft.com/microsoft-365/compliance/create-test-tune-dlp-policy text: Office 365 data loss prevention - - url: https://docs.microsoft.com/en-us/microsoft-365/compliance/ + - url: https://docs.microsoft.com/microsoft-365/compliance/ text: Office 365 advanced compliance - url: https://social.technet.microsoft.com/wiki/contents/articles/35748.office-365-what-is-customer-lockbox-and-how-to-enable-it.aspx text: Deploying Lockbox diff --git a/education/partners.yml b/education/partners.yml index 6dd4d0038a..05d585f5f5 100644 --- a/education/partners.yml +++ b/education/partners.yml @@ -8,7 +8,7 @@ metadata: description: Looking for resources available to Microsoft Education partners? Start here. ms.service: help ms.topic: hub-page - author: v-lamoyn + author: LaurenMoynihan ms.author: v-lamoyn ms.date: 10/24/2019 diff --git a/smb/docfx.json b/smb/docfx.json index 5e53d296ed..14448aa33c 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -31,6 +31,7 @@ "globalMetadata": { "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "TechNet.smb", diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index aeefd6b341..760a988add 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -41,6 +41,7 @@ "Store" ], "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.store-for-business", diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index cb2908dda2..7b4f4424be 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -25,7 +25,13 @@ manager: dansimp ## Overview -Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. +Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. + +NOTE: Starting from the following Windows 10 version Replace command is supported +- Windows 10, version 1903 with KB4512941 and KB4517211 installed +- Windows 10, version 1809 with KB4512534 and KB installed +- Windows 10, version 1803 with KB4512509 and KB installed +- Windows 10, version 1709 with KB4516071 and KB installed When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations: @@ -48,6 +54,8 @@ When the ADMX policies are imported, the registry keys to which each policy is w - software\microsoft\exchange\ - software\policies\microsoft\vba\security\ - software\microsoft\onedrive +- software\Microsoft\Edge +- Software\Microsoft\EdgeUpdate\ > [!Warning] > Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index e8e03a3ba7..4986e61b5d 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -36,6 +36,7 @@ "audience": "ITPro", "ms.topic": "article", "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-configuration", diff --git a/windows/configure/docfx.json b/windows/configure/docfx.json index 32e84ef526..3dcf319a94 100644 --- a/windows/configure/docfx.json +++ b/windows/configure/docfx.json @@ -31,6 +31,7 @@ "externalReference": [], "globalMetadata": { "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.windows-configure" diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index dc7f8eaa52..044398b870 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -137,7 +137,7 @@ The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These | 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | | 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | | 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | -| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request. | +| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | | 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | | 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | | 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md index a1784e6a6e..7fd5fb5a6e 100644 --- a/windows/deployment/update/windows-update-troubleshooting.md +++ b/windows/deployment/update/windows-update-troubleshooting.md @@ -48,7 +48,7 @@ The update that is offered to a device depends on several factors. Some of the m If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day. -## My machine is frozen at scan. Why? +## My device is frozen at scan. Why? The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following: 1. Close the Settings app and reopen it. 2. Launch Services.msc and check if the following services are running: @@ -145,7 +145,23 @@ Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors. See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. + +## Device cannot access update files +Check that your device can access these Windows Update endpoints: + +- http://windowsupdate.microsoft.com +- http://*.windowsupdate.microsoft.com +- https://*.windowsupdate.microsoft.com +- http://*.update.microsoft.com +- https://*.update.microsoft.com +- http://*.windowsupdate.com +- http://download.windowsupdate.com +- https://download.microsoft.com +- http://*.download.windowsupdate.com +- http://wustat.windows.com +- http://ntservicepack.microsoft.com + Whitelist these endpoints for future use. ## Updates aren't downloading from the intranet endpoint (WSUS/SCCM) Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps: diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 0214e53ad8..ddb3d63a10 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -159,6 +160,93 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f 27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C +
setupapi.dev.log content: + +
+>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
+>>>  Section start 2019/09/26 20:13:01.623
+      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
+     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
+     ndv: Install flags: 0x00000000
+     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
+     ndv:      Search options: 0x00000081
+     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
+     dvi:      {Build Driver List} 20:13:01.643
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
+     sig:                Key      = lynxpointsystem.inf
+     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
+     sig:                Success: File is signed in catalog.
+     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 04/04/2016
+     dvi:                Version      - 10.1.1.18
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.699
+     ndv:      Searching currently installed INF
+     dvi:      {Build Driver List} 20:13:01.699
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 10/03/2016
+     dvi:                Version      - 10.1.1.38
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.731
+     dvi:      {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
+     dvi:           Default installer: Enter 20:13:01.735
+     dvi:                {Select Best Driver}
+     dvi:                     Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
+     dvi:                     Selected Driver:
+     dvi:                          Description - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                          InfFile     - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                          Section     - Needs_ISAPNP_DRV
+     dvi:                {Select Best Driver - exit(0x00000000)}
+     dvi:           Default installer: Exit
+     dvi:      {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
+     ndv:      Currently Installed Driver:
+     ndv:           Inf Name       - oem1.inf
+     ndv:           Driver Date    - 10/03/2016
+     ndv:           Driver Version - 10.1.1.38
+     ndv: {Update Device Driver - exit(00000103)}
+!    ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
+!    ndv: No devices were updated.
+<<<  Section end 2019/09/26 20:13:01.759
+<<<  [Exit status: FAILURE(0xC1900101)]
+

This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 15c4156866..64f031f72e 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -294,7 +295,7 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m 0x80073BC3 - 0x20009
-0x8007002 - 0x20009
+0x80070002 - 0x20009
0x80073B92 - 0x20009 @@ -593,7 +594,7 @@ Download and run the media creation tool. See hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. - You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following: + You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
  1. Disable the Upgrades classification.
    2. @@ -602,7 +603,7 @@ Download and run the media creation tool. See How to delete upgrades in WSUS.

    +
    For detailed information on how to run these steps check out How to delete upgrades in WSUS.

    @@ -698,12 +699,12 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. | | 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. | | 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. | -| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. | +| 0XC1900108 | MOSETUP_E_REPORTING | An error has occurred and the result value must be consolidated for telemetry purposes. | | 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. | -| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. | +| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command-line argument. | | 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. | | 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. | -| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. | +| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command-line argument. | | 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. | | 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. | | 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. | diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md index b76cb0ec72..096ebe1151 100644 --- a/windows/deployment/windows-autopilot/add-devices.md +++ b/windows/deployment/windows-autopilot/add-devices.md @@ -27,7 +27,7 @@ Before deploying a device using Windows Autopilot, the device must be registered ## OEM registration -When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot). +When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot). Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). diff --git a/windows/docfx.json b/windows/docfx.json index 1bac183185..afb77d1e77 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -20,7 +20,17 @@ "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.windows" - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], } }, "externalReference": [ diff --git a/windows/release-information/index.md b/windows/release-information/index.md index 5f7b5e22f9..c6eba252f9 100644 --- a/windows/release-information/index.md +++ b/windows/release-information/index.md @@ -3,7 +3,7 @@ title: Windows 10 - release information description: Learn release information for Windows 10 releases keywords: ["Windows 10", "Windows 10 October 2018 Update"] ms.prod: w10 -layout: LandingPage +layout: LandingPage ms.topic: landing-page ms.mktglfcycl: deploy ms.sitesec: library @@ -11,6 +11,7 @@ author: lizap ms.author: elizapo ms.localizationpriority: high --- + # Windows 10 release information Feature updates for Windows 10 are released twice a year, around March and September, via the Semi-Annual Channel. They will be serviced with monthly quality updates for 18 or 30 months from the date of the release, depending on the lifecycle policy. @@ -19,14 +20,11 @@ We recommend that you begin deployment of each Semi-Annual Channel release immed For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853). ->[!NOTE] ->Beginning with Windows 10, version 1903, this page will no longer list Semi-Annual Channel (Targeted) information for version 1903 and future feature updates. Instead, you will find a single entry for each Semi-Annual Channel release. For more information, see [this blog post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523). - +> [!NOTE] +> Beginning with Windows 10, version 1903, you will find a [single entry for each SAC release](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523).
    - - diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index d8ce5f8d4a..fb8c792d7a 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -54,7 +54,6 @@ sections:
    Zone transfers over TCP may fail
    Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

    See details >OS Build 17763.475

    May 03, 2019
    KB4495667Resolved
    KB4494441May 14, 2019
    10:00 AM PT
    Latest cumulative update (KB 4495667) installs automatically
    Reports that the optional cumulative update (KB 4495667) installs automatically.

    See details >OS Build 17763.475

    May 03, 2019
    KB4495667Resolved
    May 08, 2019
    03:37 PM PT
    System may be unresponsive after restart if ArcaBit antivirus software installed
    After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809

    See details >OS Build 17763.437

    April 09, 2019
    KB4493509Resolved
    May 08, 2019
    03:30 PM PT -
    Custom URI schemes may not start corresponding application
    Custom URI schemes for application protocol handlers may not start the corresponding application.

    See details >OS Build 17763.379

    March 12, 2019
    KB4489899Resolved
    KB4495667May 03, 2019
    10:00 AM PT " @@ -140,7 +139,6 @@ sections: text: " -
    DetailsOriginating updateStatusHistory
    Issue using PXE to start a device from WDS
    After installing KB4489899, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension. 

    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
    • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
    Resolution: This issue was resolved in KB4503327.

    Back to top    		OS Build 17763.379

    March 12, 2019
    KB4489899    		Resolved
    KB4503327    		Resolved:
    June 11, 2019
    10:00 AM PT

    Opened:
    March 12, 2019
    10:00 AM PT
    Custom URI schemes may not start corresponding application
    After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
    • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
    Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
    1. Go to Tools > Internet options > Security.
    2. Within Select a zone to view of change security settings, select Local intranet and then select Enable Protected Mode.
    3. Select Trusted Sites and then select Enable Protected Mode. 
    4. Select OK.
    You must restart the browser after making these changes.

    Resolution: This issue is resolved in KB4495667.

    Back to top    		OS Build 17763.379

    March 12, 2019
    KB4489899    		Resolved
    KB4495667    		Resolved:
    May 03, 2019
    10:00 AM PT

    Opened:
    March 12, 2019
    10:00 AM PT
    " diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml index be4512cee7..0e940b2321 100644 --- a/windows/release-information/status-windows-10-1507.yml +++ b/windows/release-information/status-windows-10-1507.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 10240.18368

    October 08, 2019
    KB4520011    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		OS Build 10240.18334

    September 23, 2019
    KB4522009    		Resolved
    KB4520011    		October 08, 2019
    10:00 AM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

    See details >    		OS Build 10240.18094

    January 08, 2019
    KB4480962    		Mitigated
    		April 25, 2019
    02:00 PM PT
    @@ -72,6 +73,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " + + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 10240.18368

    October 08, 2019
    KB4520011    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index c75ec5b5a9..d3cf6d65f2 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -74,6 +75,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 14393.3274

    October 08, 2019
    KB4519998    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		OS Build 14393.3206

    September 23, 2019
    KB4522010    		Resolved
    KB4519998    		October 08, 2019
    10:00 AM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

    See details >    		OS Build 14393.2724

    January 08, 2019
    KB4480961    		Mitigated
    		April 25, 2019
    02:00 PM PT
    Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
    Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

    See details >    		OS Build 14393.2608

    November 13, 2018
    KB4467691    		Mitigated
    		February 19, 2019
    10:00 AM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 14393.3274

    October 08, 2019
    KB4519998    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index 4b805689da..01a0e958ec 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -73,6 +74,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 16299.1451

    October 08, 2019
    KB4520004    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Unable to create local users in Chinese, Japanese and Korean during device setup
    You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

    See details >    		OS Build 16299.1387

    September 10, 2019
    KB4516066    		Mitigated
    		October 29, 2019
    05:15 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		OS Build 16299.1392

    September 23, 2019
    KB4522012    		Resolved
    KB4520004    		October 08, 2019
    10:00 AM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

    See details >    		OS Build 16299.904

    January 08, 2019
    KB4480978    		Mitigated
    		April 25, 2019
    02:00 PM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 16299.1451

    October 08, 2019
    KB4520004    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: October 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index 9f994933b5..4fa63b7381 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -64,6 +64,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -79,6 +80,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 17134.1069

    October 08, 2019
    KB4520008    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Unable to create local users in Chinese, Japanese and Korean during device setup
    You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

    See details >    		OS Build 17134.1006

    September 10, 2019
    KB4516058    		Mitigated
    		October 29, 2019
    05:15 PM PT
    Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
    You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

    See details >    		OS Build 17134.950

    August 13, 2019
    KB4512501    		Resolved
    KB4519978    		October 15, 2019
    10:00 AM PT
    Startup to a black screen after installing updates
    Your device may startup to a black screen during the first logon after installing updates.

    See details >    		OS Build 17134.829

    June 11, 2019
    KB4503286    		Resolved
    KB4519978    		October 15, 2019
    10:00 AM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 17134.1069

    October 08, 2019
    KB4520008    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: October 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index e26bde9233..fcc5aa3645 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,6 +64,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -81,6 +82,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 17763.805

    October 08, 2019
    KB4519338    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Unable to create local users in Chinese, Japanese and Korean during device setup
    You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

    See details >    		OS Build 17763.737

    September 10, 2019
    KB4512578    		Mitigated
    		October 29, 2019
    05:15 PM PT
    Microsoft Defender Advanced Threat Protection might stop running
    The Microsoft Defender ATP service might stop running and might fail to send reporting data.

    See details >    		OS Build 17763.832

    October 15, 2019
    KB4520062    		Investigating
    		October 18, 2019
    04:23 PM PT
    Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
    You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

    See details >    		OS Build 17763.678

    August 13, 2019
    KB4511553    		Resolved
    KB4520062    		October 15, 2019
    10:00 AM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 17763.805

    October 08, 2019
    KB4519338    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: October 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index 01ae8568a1..d0dd443d7e 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -64,6 +64,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -73,7 +74,7 @@ sections: - +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		OS Build 18362.418

    October 08, 2019
    KB4517389    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Unable to create local users in Chinese, Japanese and Korean during device setup
    You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		October 29, 2019
    05:15 PM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Resolved
    KB4501375    		June 27, 2019
    10:00 AM PT
    Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
    Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Resolved
    KB4517389    		October 08, 2019
    10:00 AM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		OS Build 18362.357

    September 23, 2019
    KB4522016    		Resolved
    KB4517389    		October 08, 2019
    10:00 AM PT
    Updates may fail to install and you may receive Error 0x80073701
    Installation of updates may fail and you may receive error code 0x80073701.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		August 16, 2019
    04:28 PM PT
    Intermittent loss of Wi-Fi connectivity
    Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated External
    		August 01, 2019
    08:44 PM PT
    Gamma ramps, color profiles, and night light settings do not apply in some cases
    Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		August 01, 2019
    06:27 PM PT
    Gamma ramps, color profiles, and night light settings do not apply in some cases
    Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    KB4505903    		August 01, 2019
    06:27 PM PT
    Intel Audio displays an intcdaud.sys notification
    Devices with a range of Intel Display Audio device drivers may experience battery drain.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    " @@ -85,6 +86,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " + + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		OS Build 18362.418

    October 08, 2019
    KB4517389    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: October 2019 - items: - type: markdown @@ -131,7 +141,7 @@ sections:
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:
            \"Close other apps, error code: 0XA00F4243.”

    To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4501375 and the safeguard hold has been removed.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Resolved
    KB4501375Resolved:
    June 27, 2019
    10:00 AM PT

    Opened:
    May 21, 2019
    07:20 AM PT
    Unable to discover or connect to Bluetooth devices using some Realtek adapters
    Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You will need to install a Realtek driver version greater than 1.5.1011.0.

    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Next steps: Microsoft is working with Realtek to release new drivers for all affected system via Windows Update.

    October 25, 2019 note This issue was previously grouped with the Qualcomm radio issue, which is now resolved. There is no change to this issue except to remove reference to Qualcomm.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Mitigated
    Last updated:
    October 25, 2019
    04:21 PM PT

    Opened:
    May 21, 2019
    07:29 AM PT
    Intermittent loss of Wi-Fi connectivity
    Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

    To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Mitigated External
    Last updated:
    August 01, 2019
    08:44 PM PT

    Opened:
    May 21, 2019
    07:13 AM PT -
    Gamma ramps, color profiles, and night light settings do not apply in some cases
    Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

    Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    • Closing full screen applications
    • Applying custom color profiles
    • Running applications that rely on custom gamma ramps
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Mitigated
    Last updated:
    August 01, 2019
    06:27 PM PT

    Opened:
    May 21, 2019
    07:28 AM PT +
    Gamma ramps, color profiles, and night light settings do not apply in some cases
    Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

    Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    • Closing full screen applications
    • Applying custom color profiles
    • Running applications that rely on custom gamma ramps
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Mitigated
    KB4505903Last updated:
    August 01, 2019
    06:27 PM PT

    Opened:
    May 21, 2019
    07:28 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
      
    To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809
    Workaround:
    On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

    For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

    Note We recommend you do not attempt to update your devices until newer device drivers are installed.

    Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

    Back to topOS Build 18362.116

    May 21, 2019
    KB4505057Mitigated
    Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:22 AM PT " diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index e1dbec18dc..1f8aaa76bb 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		October 08, 2019
    KB4519976    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		September 24, 2019
    KB4516048    		Resolved
    KB4519976    		October 08, 2019
    10:00 AM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    @@ -72,6 +73,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " + + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		October 08, 2019
    KB4519976    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml index 6b30adb9b0..e0f869f26a 100644 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -73,6 +74,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		October 08, 2019
    KB4520005    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		September 24, 2019
    KB4516041    		Resolved
    KB4520005    		October 08, 2019
    10:00 AM PT
    Japanese IME doesn't show the new Japanese Era name as a text input option
    With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

    See details >    		April 25, 2019
    KB4493443    		Mitigated
    		May 15, 2019
    05:53 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

    See details >    		January 08, 2019
    KB4480963    		Mitigated
    		April 25, 2019
    02:00 PM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		October 08, 2019
    KB4520005    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml index 0df1e85294..9e2992e255 100644 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ b/windows/release-information/status-windows-server-2008-sp2.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		October 08, 2019
    KB4520002    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Issues manually installing updates by double-clicking the .msu file
    You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

    See details >    		September 10, 2019
    KB4474419    		Resolved
    KB4474419    		September 23, 2019
    10:00 AM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		September 24, 2019
    KB4516030    		Resolved
    KB4520002    		October 08, 2019
    10:00 AM PT
    @@ -72,6 +73,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " + + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		October 08, 2019
    KB4520002    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml index e05f9d92b9..560b75a79f 100644 --- a/windows/release-information/status-windows-server-2012.yml +++ b/windows/release-information/status-windows-server-2012.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -73,6 +74,15 @@ sections:
    " +- title: November 2019 +- items: + - type: markdown + text: " +
    SummaryOriginating updateStatusLast updated
    TLS connections might fail or timeout
    Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

    See details >    		October 08, 2019
    KB4520007    		Mitigated External
    		November 05, 2019
    03:36 PM PT
    Intermittent issues when printing
    The print spooler service may intermittently have issues completing a print job and results print job failure.

    See details >    		September 24, 2019
    KB4516069    		Resolved
    KB4520007    		October 08, 2019
    10:00 AM PT
    Japanese IME doesn't show the new Japanese Era name as a text input option
    With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

    See details >    		April 25, 2019
    KB4493462    		Mitigated
    		May 15, 2019
    05:53 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

    See details >    		January 08, 2019
    KB4480975    		Mitigated
    		April 25, 2019
    02:00 PM PT
    + +
    DetailsOriginating updateStatusHistory
    TLS connections might fail or timeout
    Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
    • \"The request was aborted: Could not create SSL/TLS secure Channel\"
    • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

    Back to top    		October 08, 2019
    KB4520007    		Mitigated External
    		Last updated:
    November 05, 2019
    03:36 PM PT

    Opened:
    November 05, 2019
    03:36 PM PT
    + " + - title: September 2019 - items: - type: markdown diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 6f464d5043..e791ecca8e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -23,19 +23,21 @@ In Windows 10, Windows Hello for Business replaces passwords with strong two-fa Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. Windows Hello addresses the following problems with passwords: -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). + +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). >[!div class="mx-tdBreakAll"] >| | | | >| :---: | :---: | :---: | >| [![Overview Icon](images/hello_filter.png)](hello-overview.md)
    [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
    [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
    [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | -## Prerequisites +## Prerequisites ### Cloud Only Deployment + * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory @@ -44,6 +46,7 @@ Windows Hello addresses the following problems with passwords: * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory ### Hybrid Deployments + The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. | Key trust
    Group Policy managed | Certificate trust
    Mixed managed | Key trust
    Modern managed | Certificate trust
    Modern managed | @@ -54,25 +57,26 @@ The table shows the minimum requirements for each deployment. For key trust in a | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
    and
    Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | -| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter.| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter. This is for **Azure AD Joined** devices. | +| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter.| Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
    AD FS w/Azure MFA adapter, or
    AD FS w/Azure MFA Server adapter, or
    AD FS w/3rd Party MFA Adapter. | Azure Account | Azure Account | Azure Account | Azure Account | | Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory | | Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect | | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | -### On-premises Deployments +### On-premises Deployments + The table shows the minimum requirements for each deployment. | Key trust
    Group Policy managed | Certificate trust
    Group Policy managed| -| --- | --- | +| --- | --- | | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | -| AD FS with Azure MFA Server, or
    AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or
    AD FS with 3rd Party MFA Adapter | +| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | >[!IMPORTANT] -> For Windows Hello for Business deployment, if you have several domains, at least one Windows Server Domain Controller 2016 is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index 830bfcfcfc..702f62e6d4 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*> | 607 | Reader object failed to start monitor thread:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
    %1 = Windows error code | | 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
    %1 = Windows error code | | 609 | Reader monitor failed to create overlapped event:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
    %1 = Windows error code | -| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
    %1 = Windows error code
    %2 = Name of the smart card reader
    %3 = IOCTL that was sent
    %4 = First 4 bytes of the command sent to the smart card | +| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This is a benign error that does not affect end use of a smart card and can be ignored.
    %1 = Windows error code
    %2 = Name of the smart card reader
    %3 = IOCTL that was sent
    %4 = First 4 bytes of the command sent to the smart card | | 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. | | 612 | Reader insertion monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
    %1 = Windows error code | | 615 | Reader removal monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
    %1 = Windows error code | | 616 | Reader monitor '%2' received uncaught error code:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
    %1 = Windows error code
    %2 = Reader name | | 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
    %1 = Smart card reader name | | 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. | -| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
    %1 = Windows error code | +| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. This error may also occur if the event is queried before the smart card service is ready. In this case the error is benign and can be ignored.
    %1 = Windows error code | | 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
    %1 = Windows error code | ## Smart card Plug and Play events diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a751c426fc..65f80dda38 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -9,7 +9,7 @@ #### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) #### [Configuration score](microsoft-defender-atp/configuration-score.md) #### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md) -#### [Remediation](microsoft-defender-atp/tvm-remediation.md) +#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) #### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) #### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) #### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) @@ -311,21 +311,23 @@ ##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md) -#### [What's New in Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md) -#### [Deploy Microsoft Defender Advanced Threat Protection for Mac]() -##### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md) -##### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md) -##### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md) -##### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md) -#### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md) -#### [Configure Microsoft Defender ATP for Mac]() -##### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md) -##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/microsoft-defender-atp-mac-pua.md) -#### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md) -#### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md) - - +### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +#### [Troubleshoot]() +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) ### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 5f47de9db6..32bbf69dc2 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -1,7091 +1,7194 @@ ---- -title: FIPS 140 Validation -description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. -ms.prod: w10 -audience: ITPro -author: dulcemontemayor -ms.author: dansimp -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/03/2018 -ms.reviewer: ---- - - -# FIPS 140 Validation - -On this page - -- [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo) -- [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd) -- [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd) -- [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve) -- [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac) -- [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac) -- [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac) -- [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg) - -Updated: March 2018 - - - -## Introduction - -This document provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard, *Federal Information Processing Standard (FIPS) 140 – Security Requirements for Cryptographic Modules* \[FIPS 140\]. - -### Audience - -This document is primarily focused on providing information for three parties: - -[Procurement Officer](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Responsible for verifying that Microsoft products (or even third-party applications) are either FIPS 140 validated or utilize a Microsoft FIPS 140 validated cryptographic module. - -[System Integrator](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Responsible for ensuring that Microsoft Products are configured properly to use only FIPS 140 validated cryptographic modules. - -[Software Developer](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Responsible for building software products that utilize Microsoft FIPS 140 validated cryptographic modules. - -### Document Map - -This document is broken into seven major sections: - -[FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_overview) – Provides an overview of the FIPS 140 standard as well as provides some historical information about the standard. - -[Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Provides information on how Microsoft products are FIPS 140 validated. - -[Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Describes how to configure and verify that Microsoft Products are being used in a manner consistent with the product’s FIPS 140 Security Policy. - -[Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Identifies how developers can leverage the Microsoft FIPS 140 validated cryptographic modules. - -[FAQ](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_faq) – Frequently Asked Questions. - -[Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) – Explains Microsoft cryptographic architecture and identifies specific modules that are FIPS 140 validated. - -[Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#_cryptographic_algorithms) – Lists the cryptographic algorithm, modes, states, key sizes, Windows versions, and corresponding cryptographic algorithm validation certificates. - -## FIPS 140 Overview - -### FIPS 140 Standard - -FIPS 140 is a US government and Canadian government standard that defines a minimum set of the security requirements for products that implement cryptography. This standard is designed for cryptographic modules that are used to secure sensitive but unclassified information. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP), a joint effort between the US National Institute of Standards and Technology (NIST) and the Communications Security Establishment of Canada (CSEC). - -The current standard defines four-levels of increasing security, 1 through 4. Most software products (including all Microsoft products) are tested against the Level 1 security requirements. - -### Applicability of the FIPS standard - -Within the US Federal government, the FIPS 140 standard applies to any security system (whether hardware, firmware, software, or a combination thereof) to be used by agencies for protecting sensitive but unclassified information. Some agencies have expanded its use by requiring that the modules to be procured for secret systems also meet the FIPS 140 requirements. - -The FIPS 140 standard has also been used by different standards bodies, specification groups, nations, and private institutions as a requirement or guideline for those products (e.g. – Digital Cinema Systems Specification). - -### History of 140-1 - -FIPS 140-1 is the original working version of the standard made official on January 11, 1994. The standard remained in effect until FIPS 140-2 became mandatory for new products on May 25, 2002. - -### FIPS 140-2 - -FIPS 140-2 is currently the active version of the standard. - -### Microsoft FIPS Support Policy - -Microsoft actively maintains FIPS 140 validation for its cryptographic modules. - -### FIPS Mode of Operation - -The common term “FIPS mode” is used in this document and Security Policy documents. When a cryptographic module contains both FIPS-approved and non-FIPS approved security methods, it must have a "FIPS mode of operation" to ensure only FIPS-approved security methods may be used. When a module is in "FIPS mode", a non-FIPS approved method cannot be used instead of a FIPS-approved method. - -## Microsoft Product Validation (Information for Procurement Officers and Auditors) - -This section provides information for Procurement Officers and Auditors who are responsible for ensuring that Microsoft products with FIPS 140 validated cryptographic modules are used in their organization. The goal of this section is to provide an overview of the Microsoft developed products and modules and explain how the validated cryptographic modules are used. - -### Microsoft Product Relationship with CNG and CAPI libraries - -Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services. - -The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules: - -- Schannel Security Package -- Remote Desktop Protocol (RDP) Client -- Encrypting File System (EFS) -- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) -- BitLocker® Drive Full-volume Encryption -- IPsec Settings of Windows Firewall -- Server Message Block (SMB) 3.x - -## Information for System Integrators - -This section provides information for System Integrators and Auditors who are responsible for deploying Microsoft products in a manner consistent with the product’s FIPS 140 Security Policy. - -There are two steps to ensure that Microsoft products operate in FIPS mode: - -1. Selecting/Installing FIPS 140 validated cryptographic modules -2. Setting FIPS local/group security policy flag. - -### Step 1 – Selecting/Installing FIPS 140 Validated Cryptographic Modules - -Systems Integrators must ensure that all cryptographic modules installed are, in fact, FIPS 140 validated. This can be accomplished by cross-checking the version number of the installed module with the list of validated binaries. The list of validated CAPI binaries is identified in the [CAPI Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_capi_validated_cryptographic) section below and the list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section below. There are similar sections for all other validated cryptographic modules. - -The version number of the installed binary is found by right-clicking the module file and clicking on the Version or Details tab. Cryptographic modules are stored in the "windows\\system32" or "windows\\system32\\drivers" directory. - -### Step 2 – Setting FIPS Local/Group Security Policy Flag - -The Windows operating system provides a group (or local) security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing”, which is used by many Microsoft products to determine whether to operate in a FIPS-approved mode. When this policy is set, the validated cryptographic modules in Windows will also operate in a FIPS-approved mode. - -**Note** – There is no enforcement of the FIPS policy by the operating system or the validated cryptographic modules. Instead, each individual application must check this flag and enforce the Security Policy of the validated cryptographic modules. - -#### Instructions on Setting the FIPS Local/Group Security Policy Flag - -While there are alternative methods for setting the FIPS local/group security policy flag, the following method is included as a guide to users with Administrative privileges. This description is for the Local Security Policy, but the Group Security Policy may be set in a similar manner. - -1. Open the 'Run' menu by pressing the combination 'Windows Key + R'. -2. Type 'secpol.msc' and press 'Enter' or click the 'Ok' button. -3. In the Local Security Policy management console window that opens, use the left tab to navigate to the Local Policies -\> Security Options. -4. Scroll down the right pane and double-click 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing'. -5. In the properties window, select the 'Enabled' option and click the 'Apply' button. - -#### Microsoft Components and Products That Utilize FIPS Local/Group Security Policy - -The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy. - -- Schannel Security Package -- Remote Desktop Protocol (RDP) Client -- Encrypting File System (EFS) -- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) -- BitLocker® Drive Full-volume Encryption -- IPsec Settings of Windows Firewall - -#### Effects of Setting FIPS Local/Group Security Policy Flag - -When setting the FIPS local/group security policy flag, the behavior of several Microsoft components and products are affected. The most noticeable difference will be that the components enforcing this setting will only use those algorithms approved or allowed in FIPS mode. The specific changes to the products listed above are: - -- Schannel Security Package forced to negotiate sessions using TLS. The following supported Cipher Suites are disabled: - -- - TLS\_RSA\_WITH\_RC4\_128\_SHA - - TLS\_RSA\_WITH\_RC4\_128\_MD5 - - SSL\_CK\_RC4\_128\_WITH\_MD5 - - SSL\_CK\_DES\_192\_EDE3\_CBC\_WITH\_MD5 - - TLS\_RSA\_WITH\_NULL\_MD5 - - TLS\_RSA\_WITH\_NULL\_SHA - -- The set of cryptographic algorithms that a Remote Desktop Protocol (RDP) server will use is scoped to: - -- - CALG\_RSA\_KEYX - RSA public key exchange algorithm - - CALG\_3DES - Triple DES encryption algorithm - - CALG\_AES\_128 - 128 bit AES - - CALG\_AES\_256 - 256 bit AES - - CALG\_SHA1 - SHA hashing algorithm - - CALG\_SHA\_256 - 256 bit SHA hashing algorithm - - CALG\_SHA\_384 - 384 bit SHA hashing algorithm - - CALG\_SHA\_512 - 512 bit SHA hashing algorithm - -- Any Microsoft .NET Framework applications, such as Microsoft ASP.NET or Windows Communication Foundation (WCF), only allow algorithm implementations that are validated to FIPS 140, meaning only classes that end in "CryptoServiceProvider" or "Cng" can be used. Any attempt to create an instance of other cryptographic algorithm classes or create instances that use non-allowed algorithms will cause an InvalidOperationException exception. - -- Verification of ClickOnce applications fails unless the client computer has .NET Framework 2.0 SP1 or later service pack installed or .NET Framework 3.5 or later installed. - -- On Windows Vista and Windows Server 2008 and later, BitLocker Drive Encryption switches from AES-128 using the elephant diffuser to using the approved AES-256 encryption. Recovery passwords are not created or backed up. Instead, backup a recovery key on a local drive or on a network share. To use the recovery key, put the key on a USB device and plug the device into the computer. - -Please be aware that selection of FIPS mode can limit product functionality (See ). - -## Information for Software Developers - -This section is targeted at developers who wish to build their own applications using the FIPS 140 validated cryptographic modules. - -Each of the validated cryptographic modules defines a series of rules that must be followed. The security rules for each validated cryptographic module are specified in the Security Policy document. Links to each of the Security Policy documents is provided in the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section below. Generally, the restriction in Microsoft validated cryptographic modules is limiting the use of cryptography to only FIPS Approved cryptographic algorithms, modes, and key sizes. - -### Using Microsoft Cryptographic Modules in a FIPS mode of operation - -No matter whether developing with native languages or using .NET, it is important to first check whether the CNG modules for the target system are FIPS validated. The list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section. - -When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below. It is important to remember that setting the FIPS local/group security policy Flag (discussed above) does not affect the behavior of the modules when used for developing custom applications. - -If you are developing your application using .NET instead of using the native libraries, then setting the FIPS local policy flag will generate an exception when an improper .NET class is used for cryptography (i.e. the cryptographic classes whose names end in "Managed"). The names of these allowed classes end with "Cng", which use the CNG binaries or "CryptoServiceProvider", which use the legacy CAPI binaries. - -### Key Strengths and Validity Periods - -NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated November 2015, \[[SP 800-131A](http://dx.doi.org/10.6028/nist.sp.800-131ar1)\], offers guidance for moving to stronger cryptographic keys and algorithms. This does not replace NIST SP 800-57, Recommendation for Key Management Part 1: General, \[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\], but gives more specific guidance. One of the most important topics discussed in these publications deals with the key strengths of FIPS Approved algorithms and their validity periods. When developing applications that use FIPS Approved algorithms, it is also extremely important to select appropriate key sizes based on the security lifetimes recommended by NIST. - -## FIPS 140 FAQ - -The following are answers to commonly asked questions for the FIPS 140-2 validation of Microsoft products. - -1. How does FIPS 140 relate to the Common Criteria? - **Answer:** These are two separate security standards with different, but complementary, purposes. FIPS 140 is a standard designed specifically for validating product modules that implement cryptography. On the other hand, Common Criteria is designed to help evaluate security functions in IT products. - In many cases, Common Criteria evaluations will rely on FIPS 140 validations to provide assurance that cryptographic functionality is implemented properly. -2. How does FIPS 140 relate to Suite B? - **Answer:** Suite B is simply a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. - The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140 standard. -3. There are so many modules listed on the NIST website for each release, how are they related and how do I tell which one applies to me? - **Answer:** Microsoft strives to validate all releases of its cryptographic modules. Each module provides a different set of cryptographic algorithms. If you are required to use only FIPS validated cryptographic modules, you simply need to verify that the version being used appears on the validation list. - Please see the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140)section for a complete list of Microsoft validated modules. -4. My application links against crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. What do I need to do to assure I’m using FIPS 140 validated cryptographic modules? - **Answer:** crypt32.dll, cryptsp.dll, advapi32.dll, and ncrypt.dll are intermediary libraries that will offload all cryptographic operations to the FIPS validated cryptographic modules. Bcrypt.dll itself is a validated cryptographic module for Windows Vista and Windows Server 2008. For Windows 7 and Windows Server 2008 R2 and later, bcryptprimitives.dll is the validated module, but bcrypt.dll remains as one of the libraries to link against. - You must first verify that the underlying CNG cryptographic module is validated. Once verified, you'll need to confirm that you're using the module correctly in FIPS mode (See [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) section for details). -5. What does "When operated in FIPS mode" mean on certificates? - **Answer:** This caveat identifies that a required configuration and security rules must be followed in order to use the cryptographic module in a manner consistent with its FIPS 140 Security Policy. The security rules are defined in the Security Policy for the module and usually revolve around using only FIPS Approved cryptographic algorithms and key sizes. Please see the Security Policy for the specific security rules for each cryptographic module (See [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section for links to each policy). -6. Which FIPS validated module is called when Windows 7 or Windows 8 is configured to use the FIPS setting in the wireless configuration? - **Answer:** CNG is used. This setting tells the wireless driver to call FIPS 140-2 validated cryptographic modules instead of using the driver’s own cryptography, if any. -7. Is BitLocker to Go FIPS 140-2 validated? - **Answer:** There are two separate parts for BitLocker to Go. One part is simply a native feature of BitLocker and as such, it uses FIPS 140-2 validated cryptographic modules. The other part is the BitLocker to Go Reader application for down-level support of older operating systems such as Windows XP and Windows Vista. The Reader application does not use FIPS 140-2 validated cryptographic modules. -8. Are applications FIPS 140-2 validated? - **Answer:** Microsoft only has low-level cryptographic modules in Windows FIPS 140-2 validated, not high-level applications. A better question is whether a certain application calls a FIPS 140-2 validated cryptographic module in the underlying Windows OS. That question needs to be directed to the company/product group that created the application of interest. -9. How can Systems Center Operations Manager 2012 be configured to use FIPS 140-2 validated cryptographic modules? - **Answer:** See [https://technet.microsoft.com/library/hh914094.aspx](https://technet.microsoft.com/library/hh914094.aspx) - -## Microsoft FIPS 140 Validated Cryptographic Modules - -### Modules By Operating System - -The following tables identify the Cryptographic Modules for an operating system. - -#### Windows - -##### Windows 10 Creators Update (Version 1703) - -Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

    FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

    #3094

    -

    FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

    Boot Manager10.0.15063#3089

    FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

    -

    Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

    Windows OS Loader10.0.15063#3090

    FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

    -

    Other algorithms: NDRNG

    Windows Resume[1]10.0.15063#3091FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
    BitLocker® Dump Filter[2]10.0.15063#3092FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
    Code Integrity (ci.dll)10.0.15063#3093

    FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

    FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    - - -\[1\] Applies only to Home, Pro, Enterprise, Education and S - -\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub - -\[3\] Applies only to Pro, Enterprise Education and S - -##### Windows 10 Anniversary Update (Version 1607) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

    FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

    FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

    Boot Manager10.0.14393#2931

    FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    -

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.14393#2935

    FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

    FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    - - -\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile - -\[3\] Applies only to Pro, Enterprise and Enterprise LTSB - -##### Windows 10 November 2015 Update (Version 1511) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

    FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

    FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

    Boot Manager[4]10.0.10586#2700FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS Approved algorithms: AES (Certs. #3653)
    Code Integrity (ci.dll)10.0.10586#2604

    FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

    FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    - - -\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub - -\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub - -\[6\] Applies only to Home, Pro and Enterprise - -\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub - -\[8\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 10 (Version 1507) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

    FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

    FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    -
    -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

    Boot Manager[9]10.0.10240#2600FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS Approved algorithms: AES (Certs. #3497 and #3498)
    Code Integrity (ci.dll)10.0.10240#2604

    FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    -
    -Other algorithms: AES (non-compliant); MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

    FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    - - -\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[12\] Applies only to Pro, Enterprise and Enterprise LTSB - -\[13\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 8.1 - -Validated Editions: RT, Pro, Enterprise, Phone, Embedded - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

    FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

    FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    -

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    Boot Manager6.3.9600 6.3.9600.17031#2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS Approved algorithms: AES (Cert. #2832)
    -
    -Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

    FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    -
    -Other algorithms: MD5

    -

    Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    - - -\[14\] Applies only to Pro, Enterprise, and Embedded 8. - -##### Windows 8 - -Validated Editions: RT, Home, Pro, Enterprise, Phone - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.9200#1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
    -
    -Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.9200#1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    -
    -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -\[15\] Applies only to Home and Pro - -**Windows 7** - -Validated Editions: Windows 7, Windows 7 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

    6.1.7600.16385

    -

    6.1.7601.17514

    		1329FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Kernel Mode Cryptographic Primitives Library (cng.sys)

    6.1.7600.16385

    -

    6.1.7600.16915

    -

    6.1.7600.21092

    -

    6.1.7601.17514

    -

    6.1.7601.17725

    -

    6.1.7601.17919

    -

    6.1.7601.21861

    -

    6.1.7601.22076

    		1328FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Boot Manager

    6.1.7600.16385

    -

    6.1.7601.17514

    		1319FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
    -
    -Other algorithms: MD5
    Winload OS Loader (winload.exe)

    6.1.7600.16385

    -

    6.1.7600.16757

    -

    6.1.7600.20897

    -

    6.1.7600.20916

    -

    6.1.7601.17514

    -

    6.1.7601.17556

    -

    6.1.7601.21655

    -

    6.1.7601.21675

    		1326FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    BitLocker™ Drive Encryption

    6.1.7600.16385

    -

    6.1.7600.16429

    -

    6.1.7600.16757

    -

    6.1.7600.20536

    -

    6.1.7600.20873

    -

    6.1.7600.20897

    -

    6.1.7600.20916

    -

    6.1.7601.17514

    -

    6.1.7601.17556

    -

    6.1.7601.21634

    -

    6.1.7601.21655

    -

    6.1.7601.21675

    		1332FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    -
    -Other algorithms: Elephant Diffuser
    Code Integrity (CI.DLL)

    6.1.7600.16385

    -

    6.1.7600.17122

    -

    6.1.7600.21320

    -

    6.1.7601.17514

    -

    6.1.7601.17950

    -

    6.1.7601.22108

    		1327FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
    -(no change in SP1)    		1331FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
    -(no change in SP1)    		1330FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Vista SP1 - -Validated Editions: Ultimate Edition - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

    FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

    -

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

    FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

    -

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051002

    FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

    -

    Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051003

    FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

    -

    Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

    - - -##### Windows Vista - -Validated Editions: Ultimate Edition - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.0.6000.16386947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
    -
    -Other algorithms: Elephant Diffuser
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    -
    -Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
    - - -##### Windows XP SP3 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

    FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

    -

    Other algorithms: DES; MD5; HMAC MD5

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

    FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

    -

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

    Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

    FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

    -

    Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

    - - -##### Windows XP SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

    -

    Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

    Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

    FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    -

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    - - -##### Windows XP SP1 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

    FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    -

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    - - -##### Windows XP - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module5.1.2600.0241

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

    -

    Other algorithms: DES (Cert. #89)

    - - -##### Windows 2000 SP3 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    -

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2195.3665 [SP3])

    -

    (Base: 5.0.2195.3839 [SP3])

    -

    (DSS/DH Enh: 5.0.2195.3665 [SP3])

    -

    (Enh: 5.0.2195.3839 [SP3]

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    -

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS:

    -

    5.0.2195.2228 [SP2])

    -

    (Base:

    -

    5.0.2195.2228 [SP2])

    -

    (DSS/DH Enh:

    -

    5.0.2195.2228 [SP2])

    -

    (Enh:

    -

    5.0.2195.2228 [SP2])

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 SP1 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2150.1391 [SP1])

    -

    (Base: 5.0.2150.1391 [SP1])

    -

    (DSS/DH Enh: 5.0.2150.1391 [SP1])

    -

    (Enh: 5.0.2150.1391 [SP1])

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    - - -##### Windows 2000 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

    FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    - - -##### Windows 95 and Windows 98 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

    FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    -

    Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    - - -##### Windows NT 4.0 - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
    -
    -Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
    - - -#### Windows Server - -##### Windows Server 2016 - -Validated Editions: Standard, Datacenter, Storage Server - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    -
    -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager10.0.143932931

    FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    -

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.143932932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)10.0.143932933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.143932935FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    -
    -Other algorithms: AES (non-compliant); MD5
    Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    -
    -Other algorithms: MD5
    - - -##### Windows Server 2012 R2 - -Validated Editions: Server, Storage Server, - -**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    -
    -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.3.9600 6.3.9600.170312351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    -
    -Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS Approved algorithms: AES (Cert. #2832)
    -
    -Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    -
    -Other algorithms: MD5
    - - -\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -**Windows Server 2012** - -Validated Editions: Server, Storage Server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    -
    -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.92001895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
    -
    -Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.92001897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    -
    -Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    -
    -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Server 2008 R2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175141321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
    -
    -Other algorithms: MD5
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    --Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.175141336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    -
    -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
    Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    -
    -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    -
    -Other algorithms: Elephant Diffuser
    - - -##### Windows Server 2008 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: N/A
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
    -
    -Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
    -
    --Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
    -
    -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    - - -##### Windows Server 2003 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

    FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

    -

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

    FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

    -

    Other algorithms: DES; HMAC-MD5

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

    FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

    -

    Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    - - -##### Windows Server 2003 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

    FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    -

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

    FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    -

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

    FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    -

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    - - -##### Windows Server 2003 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

    FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    -

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

    FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    -

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

    FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    -

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    -

    [1] x86
    -[2] SP1 x86, x64, IA64

    - - -#### Other Products - -##### Windows Embedded Compact 7 and Windows Embedded Compact 8 - - ------ - - - - - - - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

    FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

    -

    Allowed algorithms: HMAC-MD5; MD5; NDRNG

    Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

    FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

    -

    Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

    - - - -##### Windows CE 6.0 and Windows Embedded Compact 7 - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

    FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

    -

    Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

    - - -##### Outlook Cryptographic Provider - - ------ - - - - - - - - - - - - - - -
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)SR-1A (3821)110

    FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

    -

    Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

    - - - -### Cryptographic Algorithms - -The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. - -### Advanced Encryption Standard (AES) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-OFB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -

    Microsoft Surface Hub Virtual TPM Implementations #4904

    -

    Version 10.0.15063.674

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-OFB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

    -

    Version 10.0.16299

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

    -

    Version 10.0.15063.674

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

    -

    Version 10.0.15254

      -
    • AES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CCM:
      • -
      • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • -
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      • -
    • AES-CFB128:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-CMAC:
      • -
      • -
      • Generation:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • Verification:
        • -
        • -
        • AES-128:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-192:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • AES-256:
          • -
          • -
          • Block Sizes: Full, Partial
            • -
          • Message Length: 0-65536
            • -
          • Tag Length: 16-16
            • -
          • -
        • -
      • -
    • AES-CTR:
      • -
      • -
      • Counter Source: Internal
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • -
    • AES-GCM:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • IV Generation: External
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • -
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • -
      • 96 bit IV supported
        • -
      • -
    • AES-XTS:
      • -
      • -
      • Key Size: 128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • Key Size: 256:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Block Sizes: Full
          • -
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

    -

    Version 10.0.16299

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES Val#4902

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

    -

    Version 10.0.15063.674

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES Val#4901

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

    -

    Version 10.0.15254

    AES-KW:

    -
      -
    • Modes: Decrypt, Encrypt
      • -
    • CIPHK transformation direction: Forward
      • -
    • Key Lengths: 128, 192, 256 (bits)
      • -
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • -
    -

    AES Val#4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

    -

    Version 10.0.16299

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • AAD Length: 0-65536
      • -
    -

    AES Val#4902

    Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

    -

    Version 10.0.15063.674

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • AAD Length: 0-65536
      • -
    -

    AES Val#4901

    Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

    -

    Version 10.0.15254

    AES-CCM:

    -
      -
    • Key Lengths: 256 (bits)
      • -
    • Tag Lengths: 128 (bits)
      • -
    • IV Lengths: 96 (bits)
      • -
    • Plain Text Length: 0-32
      • -
    • AAD Length: 0-65536
      • -
    -

    AES Val#4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    -

    Version 10.0.16299

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    OFB ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

    -

    Version 10.0.15063

    KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#4624

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

    -

    Version 10.0.15063

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#4624

    -

     

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

    -

    Version 10.0.15063

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

    -

    GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

    -

    Version 10.0.15063

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

    -

    Version 7.00.2872

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

    -

    Version 8.00.6246

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

    -

    Version 7.00.2872

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

    -

    Version 8.00.6246

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    OFB ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    -

    Version 10.0.14393

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

    -

    Version 10.0.14393

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
    -Version 10.0.14393

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

    -

    AES Val#4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

    -

    Version 10.0.14393

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

    -

    Version 10.0.14393

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

    -

    Version 10.0.10586

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

    -

    Version 10.0.10586

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
    -Version 10.0.10586

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
    -
    -

    -

    Version 10.0.10586

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#3497

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

    -

    Version 10.0.10240

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#3497

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

    -

    Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
    -Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
    -Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

    -

    Version 6.3.9600

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#2832

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

    -

    Version 6.3.9600

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
    -OtherIVLen_Supported
    -GMAC_Supported

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    -

    Version 6.3.9600

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    -AES Val#2197

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
    -AES Val#2197

    -

    GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
    -GMAC_Supported

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#2196

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    -AES Val#1168

    Windows Server 2008 R2 and SP1 CNG algorithms #1187

    -

    Windows 7 Ultimate and SP1 CNG algorithms #1178

    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
    -AES Val#1168    		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

     

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

    GCM

    -

    GMAC

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed
    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    Windows Server 2008 CNG algorithms #757

    -

    Windows Vista Ultimate SP1 CNG algorithms #756

    CBC ( e/d; 128 , 256 );

    -

    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

    Windows Vista Ultimate BitLocker Drive Encryption #715

    -

    Windows Vista Ultimate BitLocker Drive Encryption #424

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

    -

    Windows Vista Symmetric Algorithm Implementation #553

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

    -

    Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

    -

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

    -

    Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

    -

    Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

    -

    Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

    - - -Deterministic Random Bit Generator (DRBG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function not used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4904

    Microsoft Surface Hub Virtual TPM Implementations #1734

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function not used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4903

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    -

    Version 10.0.16299

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4902

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4901

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

    -

    Version 10.0.15254

      -
    • Counter:
      • -
      • -
      • Modes: AES-256
        • -
      • Derivation Function States: Derivation Function used
        • -
      • Prediction Resistance Modes: Not Enabled
        • -
      • -
    -

    Prerequisite: AES #4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    -

    Version 10.0.16299

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ]

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

    -

    Version 10.0.15063

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ]

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

    -

    Version 10.0.15063

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

    -

    Version 7.00.2872

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

    -

    Version 8.00.6246

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

    -

    Version 7.00.2872

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

    -

    Version 8.00.6246

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    -

    Version 10.0.14393

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

    -

    Version 10.0.14393

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ]

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

    -

    Version 10.0.10586

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ]

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

    -

    Version 10.0.10240

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ]

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    -

    Version 6.3.9600

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
    DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
    - - -#### Digital Signature Algorithm (DSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

    -

    Version 10.0.15063.674

      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          •  
            • -
          •  
            • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

    -

    Version 10.0.15254

      -
    • DSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • PQGGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • PQGVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigGen:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • SigVer:
          • -
          • -
          • L = 2048, N = 256 SHA: SHA-256
            • -
          • L = 3072, N = 256 SHA: SHA-256
            • -
          • -
        • KeyPair:
          • -
          • -
          • L = 2048, N = 256
            • -
          • L = 3072, N = 256
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    -

    Version 10.0.16299

    FIPS186-4:

    -

    PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    KeyPairGen:   [ (2048,256) ; (3072,256) ]

    -

    SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

    -

    SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val#3790

    -

    DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

    -

    Version 10.0.15063

    FIPS186-4:
    -PQG(ver)PARMS TESTED:       [ (1024,160) SHA( 1 ); ]
    -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    -SHS: Val# 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

    -

    Version 7.00.2872

    FIPS186-4:
    -PQG(ver)PARMS TESTED:       [ (1024,160) SHA( 1 ); ]
    -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    -SHS: Val#3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

    -

    Version 8.00.6246

    FIPS186-4:
    -PQG(gen)    PARMS TESTED: [
    -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256)
    -SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 3347
    -DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

    -

    Version 10.0.14393

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 3047
    -DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

    -

    Version 10.0.10586

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 2886
    -DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

    -

    Version 10.0.10240

    FIPS186-4:
    -PQG(gen)    PARMS TESTED:   [
    -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256)
    -SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 2373
    -DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    -

    Version 6.3.9600

    FIPS186-2:
    -PQG(ver) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: #1903
    -DRBG: #258

    -

    FIPS186-4:
    -PQG(gen)PARMS TESTED    : [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -SHS: #1903
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
    FIPS186-2:
    -PQG(ver)     MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: #1902
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 1773
    -DRBG: Val# 193
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645.    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 1081
    -DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386.

    Windows Server 2008 R2 and SP1 CNG algorithms #391

    -

    Windows 7 Ultimate and SP1 CNG algorithms #386

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 1081
    -RNG: Val# 649
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385.

    Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

    -

    Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283.

    Windows Server 2008 CNG algorithms #284

    -

    Windows Vista Ultimate SP1 CNG algorithms #283

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 753
    -RNG: Val# 435
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281.

    Windows Server 2008 Enhanced DSS (DSSENH) #282

    -

    Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 618
    -RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226.

    Windows Vista CNG algorithms #227

    -

    Windows Vista Enhanced DSS (DSSENH) #226

    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 784
    -RNG: Val# 448
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292.    		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
    FIPS186-2:
    -SIG(ver)     MOD(1024);
    -SHS: Val# 783
    -RNG: Val# 447
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 611
    -RNG: Val# 314    		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 385    		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
    FIPS186-2:
    -PQG(ver)     MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 181
    -
    -    		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
    FIPS186-2:
    -PQG(gen)     MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SHS: SHA-1 (BYTE)
    -SIG(ver) MOD(1024);
    -SHS: SHA-1 (BYTE)

    Windows 2000 DSSENH.DLL #29

    -

    Windows 2000 DSSBASE.DLL #28

    -

    Windows NT 4 SP6 DSSENH.DLL #26

    -

    Windows NT 4 SP6 DSSBASE.DLL #25

    FIPS186-2: PRIME;
    -FIPS186-2:

    -

    KEYGEN(Y):
    -SHS: SHA-1 (BYTE)

    -

    SIG(gen):
    -SIG(ver)     MOD(1024);
    -SHS: SHA-1 (BYTE)

    		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
    - - -#### Elliptic Curve Digital Signature Algorithm (ECDSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #2373, DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    -

    Version 6.3.9600

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384
            • -
          • Generation Methods: Testing Candidates
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #1253

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384
            • -
          • Generation Methods: Testing Candidates
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    -

    Version 10.0.16299

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

    -

    Version 10.0.15063.674

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

    -

    Version 10.0.15254

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

    -

    Version 10.0.15254

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    -

    Version 10.0.16299

      -
    • ECDSA:
      • -
      • -
      • 186-4:
        • -
        • -
        • Key Pair Generation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • Generation Methods: Extra Random Bits
            • -
          • -
        • Public Key Validation:
          • -
          • -
          • Curves: P-256, P-384, P-521
            • -
          • -
        • Signature Generation:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • Signature Verification:
          • -
          • -
          • P-256 SHA: SHA-256
            • -
          • P-384 SHA: SHA-384
            • -
          • P-521 SHA: SHA-512
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    -

    Version 10.0.16299

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 TestingCandidates )
    -SHS: Val#3790
    -DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#3790
    -DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#3790
    -DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

    -

    Version 10.0.15063

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    -SHS:Val# 3649
    -DRBG:Val# 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

    -

    Version 7.00.2872

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    -SHS:Val#3648
    -DRBG:Val# 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

    -

    Version 8.00.6246

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 TestingCandidates )
    -PKV: CURVES( P-256 P-384 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

    -

    SHS: Val# 3347
    -DRBG: Val# 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    -

    Version 10.0.14393

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 3347
    -DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

    -

    Version 10.0.14393

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 3047
    -DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

    -

    Version 10.0.10586

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 2886
    -DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

    -

    Version 10.0.10240

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val#2373
    -DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    -

    Version 6.3.9600

    FIPS186-2:
    -PKG: CURVES    ( P-256 P-384 P-521 )
    -SHS: #1903
    -DRBG: #258
    -SIG(ver):CURVES( P-256 P-384 P-521 )
    -SHS: #1903
    -DRBG: #258

    -

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: #1903
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

    FIPS186-2:
    -PKG: CURVES    ( P-256 P-384 P-521 )
    -SHS: Val#1773
    -DRBG: Val# 193
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#1773
    -DRBG: Val# 193

    -

    FIPS186-4:
    -PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#1773
    -DRBG: Val# 193
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
    FIPS186-2:
    -PKG: CURVES    ( P-256 P-384 P-521 )
    -SHS: Val#1081
    -DRBG: Val# 23
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#1081
    -DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141.

    Windows Server 2008 R2 and SP1 CNG algorithms #142

    -

    Windows 7 Ultimate and SP1 CNG algorithms #141

    FIPS186-2:
    -PKG: CURVES    ( P-256 P-384 P-521 )
    -SHS: Val#753
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82.

    Windows Server 2008 CNG algorithms #83

    -

    Windows Vista Ultimate SP1 CNG algorithms #82

    FIPS186-2:
    -PKG: CURVES    ( P-256 P-384 P-521 )
    -SHS: Val#618
    -RNG: Val# 321
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#618
    -RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60.    		Windows Vista CNG algorithms #60
    - - -#### Keyed-Hash Message Authentication Code (HMAC) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4011

    Microsoft Surface Hub Virtual TPM Implementations #3271

    -

    Version 10.0.15063.674

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    -

    Version 10.0.16299

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4011

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

    -

    Version 10.0.15063.674

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4010

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

    -

    Version 10.0.15254

      -
    • HMAC-SHA-1:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-256:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-384:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    • HMAC-SHA2-512:
      • -
      • -
      • Key Sizes &lt; Block Size
        • -
      • Key Sizes &gt; Block Size
        • -
      • Key Sizes = Block Size
        • -
      • -
    -

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    -

    Version 10.0.16299

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

    -

    Version 10.0.15063

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

    -

    Version 10.0.15063

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

    -

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

    -

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

    -

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

    -

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val# 3347

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3347

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    -

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

    -

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

    -

    Version 10.0.10586

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHSVal# 2886

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHSVal# 2886

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    - SHSVal# 2886

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHSVal# 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

    -

    Version 10.0.10240

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    -

    Version 6.3.9600

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

    -

    Version 5.2.29344

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    -

    Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    Windows Server 2008 R2 and SP1 CNG algorithms #686

    -

    Windows 7 and SP1 CNG algorithms #677

    -

    Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

    -

    Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

    HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

    		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

    -

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

    -

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    Windows Server 2008 CNG algorithms #413

    -

    Windows Vista Ultimate SP1 CNG algorithms #412

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

    		Windows Vista Ultimate BitLocker Drive Encryption #386

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    		Windows Vista CNG algorithms #298

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

    		Windows Vista BitLocker Drive Encryption #199
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

    -

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
    - - -#### Key Agreement Scheme (KAS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Full Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #150

    -

    Version 10.0.15063.674

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Full Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

    -

    Version 10.0.16299

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DSA #1303, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

    -

    Version 10.0.15063.674

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DSA #1302, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

    -

    Version 10.0.15254

      -
    • KAS ECC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • -
      • Schemes:
        • -
        • -
        • Ephemeral Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • KDFs: Concatenation
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • One Pass DH:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • Static Unified:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • EC:
              • -
              • -
              • Curve: P-256
                • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • ED:
              • -
              • -
              • Curve: P-384
                • -
              • SHA: SHA-384
                • -
              • MAC: HMAC
                • -
              • -
            • EE:
              • -
              • -
              • Curve: P-521
                • -
              • SHA: SHA-512
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

    -
      -
    • KAS FFC:
      • -
      • -
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • -
      • Schemes:
        • -
        • -
        • dhEphem:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhOneFlow:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • dhStatic:
          • -
          • -
          • Key Agreement Roles: Initiator, Responder
            • -
          • Parameter Sets:
            • -
            • -
            • FB:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • FC:
              • -
              • -
              • SHA: SHA-256
                • -
              • MAC: HMAC
                • -
              • -
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DSA #1301, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    -

    Version 10.0.16299

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

    -

    SHS Val#3790
    -DSA Val#1135
    -DRBG Val#1556

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

    -

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val#3790
    -DSA Val#1223
    -DRBG Val#1555

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -
    -SHS Val#3790
    -ECDSA Val#1133
    -DRBG Val#1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

    -

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val# 3649
    -DSA Val#1188
    -DRBG Val#1430

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

    -

    Version 7.00.2872

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val#3648
    -DSA Val#1187
    -DRBG Val#1429

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -
    -SHS Val#3648
    -ECDSA Val#1072
    -DRBG Val#1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

    -

    Version 8.00.6246

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
    -SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

    -

    SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    -

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
    -SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 3347 DSA Val#1098 DRBG Val#1217

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

    -

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 3047 DSA Val#1024 DRBG Val#955

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 3047 ECDSA Val#760 DRBG Val#955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

    -

    Version 10.0.10586

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 2886 DSA Val#983 DRBG Val#868

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 2886 ECDSA Val#706 DRBG Val#868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

    -

    Version 10.0.10240

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val#2373 DSA Val#855 DRBG Val#489

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val#2373 ECDSA Val#505 DRBG Val#489

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    -

    Version 6.3.9600

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
    -SHS #1903 DSA Val#687 DRBG #258

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
    -
    -SHS #1903 ECDSA Val#341 DRBG #258

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

    KAS (SP 800–56A)

    -

    key agreement

    -

    key establishment methodology provides 80 to 256 bits of encryption strength

    Windows 7 and SP1, vendor-affirmed

    -

    Windows Server 2008 R2 and SP1, vendor-affirmed

    - - -SP 800-108 Key-Based Key Derivation Functions (KBKDF) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • Counter:
      • -
      • -
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • -
      • -
    -

    MAC prerequisite: HMAC #3271

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: DRBG #1734, KAS #150

    Microsoft Surface Hub Virtual TPM Implementations #161

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • -
      • -
    -

    MAC prerequisite: HMAC #3270

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: DRBG #1733, KAS #149

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    -

    Version 10.0.16299

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4902, HMAC #3269

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    • K prerequisite: KAS #148
      • -
    -

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

    -

    Version 10.0.15063.674

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4901, HMAC #3268

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: KAS #147

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

    -

    Version 10.0.15254

      -
    • Counter:
      • -
      • -
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • -
      • -
    -

    MAC prerequisite: AES #4897, HMAC #3267

    -
    -
      -
    • Counter Location: Before Fixed Data
      • -
    • R Length: 32 (bits)
      • -
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • -
    -
    -

    K prerequisite: KAS #146

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    -

    Version 10.0.16299

    CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    -
    -KAS Val#128
    -DRBG Val#1556
    -MAC Val#3062

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

    -

    Version 10.0.15063

    CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    -
    -KAS Val#127
    -AES Val#4624
    -DRBG Val#1555
    -MAC Val#3061

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

    -

    Version 10.0.15063

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#93 DRBG Val#1222 MAC Val#2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    -

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

    -

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

    -

    Version 10.0.10586

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

    -

    Version 10.0.10240

    CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    DRBG Val#489 MAC Val#1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    -

    Version 6.3.9600

    CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    DRBG #258 HMAC Val#1345

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
    - - -Random Number Generator (RNG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    FIPS 186-2 General Purpose

    -

    [ (x-Original); (SHA-1) ]

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
    FIPS 186-2
    -[ (x-Original); (SHA-1) ]

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

    -

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

    -

    Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

    -

    Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

    FIPS 186-2
    -[ (x-Change Notice); (SHA-1) ]

    -

    FIPS 186-2 General Purpose
    -[ (x-Change Notice); (SHA-1) ]

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

    -

    Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

    -

    Windows Vista RNG implementation #321

    FIPS 186-2 General Purpose
    -[ (x-Change Notice); (SHA-1) ]

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

    -

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

    FIPS 186-2
    -[ (x-Change Notice); (SHA-1) ]

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

    -

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

    - - -#### RSA - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #2677

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 240 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    -

    Version 10.0.16299

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub RSA32 Algorithm Implementations #2675

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    -

    Version 10.0.16299

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

    -

    Version 10.0.15254

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

    -

    Version 10.0.15063.674

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

    -

    Version 10.0.15254

    RSA:

    -
      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

    -

    Version 10.0.15254

      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Public Key Exponent: Fixed (10001)
          • -
        • Provable Primes with Conditions:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.3
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    -

    Version 10.0.16299

      -
    • 186-4:
      • -
      • -
      • Key Generation:
        • -
        • -
        • Probable Random Primes:
          • -
          • -
          • Mod lengths: 2048, 3072 (bits)
            • -
          • Primality Tests: C.2
            • -
          • -
        • -
      • Signature Generation PKCS1.5:
        • -
        • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Generation PSS:
        • -
        • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • Signature Verification PKCS1.5:
        • -
        • -
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • -
        • -
      • Signature Verification PSS:
        • -
        • -
        • Mod 1024:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 496 (bits)
            • -
          • -
        • Mod 2048:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • Mod 3072:
          • -
          • -
          • SHA-1: Salt Length: 160 (bits)
            • -
          • SHA-256: Salt Length: 256 (bits)
            • -
          • SHA-384: Salt Length: 384 (bits)
            • -
          • SHA-512: Salt Length: 512 (bits)
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    -

    Version 10.0.16299

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
    -SHA Val#3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

    -

    Version 10.0.15063

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

    -

    Version 10.0.15063

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -SHA Val#3790
    -DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

    -

    Version 10.0.15063

    FIPS186-4:
    -186-4KEY(gen):
    -PGM(ProbRandom:     ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -SHA Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

    -

    Version 10.0.15063

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

    -

    FIPS186-4:
    -ALG[ANSIX9.31]     Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

    -

    Version 7.00.2872

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

    -

    FIPS186-4:
    -ALG[ANSIX9.31]     Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

    -

    Version 8.00.6246

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

    -

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001) ;
    -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val# 3649
    -DRBG: Val# 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

    -

    Version 7.00.2872

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

    -

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e (10001) ;
    -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3648
    -DRBG: Val# 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

    -

    Version 8.00.6246

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

    -

    SHA Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    -

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

    -

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#3346

    soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

    -

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

    -

    Version 10.0.14393

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen):     (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

    -

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen)    :  FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 3047 DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

    -

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#3048

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

    -

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

    -

    Version 10.0.10586

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen)    : (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

    -

    Version 10.0.10586

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 2886 DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

    -

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

    -

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

    -

    Version 10.0.10240

    FIPS186-4:
    -[RSASSA-PSS]:     Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

    -

    Version 10.0.10240

    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val#2373 DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5    ] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    -

    Version 6.3.9600

    FIPS186-4:
    -[RSASSA-PSS]:     Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    - Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val#2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    -

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
    -SHA #1903

    -

    Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
    FIPS186-4:
    -186-4KEY(gen):     FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    -SHA #1903 DRBG: #258    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.    		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.    		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.

    Windows Server 2008 R2 and SP1 CNG algorithms #567

    -

    Windows 7 and SP1 CNG algorithms #560

    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.    		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.    		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.

    Windows Server 2008 CNG algorithms #358

    -

    Windows Vista SP1 CNG algorithms #357

    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

    -

    Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.    		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
    FIPS186-2:
    -ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.    		Windows Vista RSA key generation implementation #258
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.    		Windows Vista CNG algorithms #257
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.    		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.    		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
    FIPS186-2:
    -ALG[ANSIX9.31]:
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

    FIPS186-2:

    -

    – PKCS#1 v1.5, signature generation and verification

    -

    – Mod sizes: 1024, 1536, 2048, 3072, 4096

    -

    – SHS: SHA–1/256/384/512

    Windows XP, vendor-affirmed

    -

    Windows 2000, vendor-affirmed

    - - -#### Secure Hash Standard (SHS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

    -

    Version 10.0.15063.674

      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

    -

    Version 10.0.15254

      -
    • SHA-1:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-256:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-384:
      • -
      • -
      • Supports Empty Message
        • -
      • -
    • SHA-512:
      • -
      • -
      • Supports Empty Message
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    -

    Version 10.0.16299

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

    -

    Version 10.0.15063

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

    -

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

    -

    Version 8.00.6246

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

    -

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

    -

    Version 8.00.6246

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
    -Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
    -Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
    -Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
    -Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
    -Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
    -Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
    -Version 6.3.9600
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    -Version 6.3.9600

    SHA-1 (BYTE-only)

    -

    SHA-256 (BYTE-only)

    -

    SHA-384 (BYTE-only)

    -

    SHA-512 (BYTE-only)

    -

    Implementation does not support zero-length (null) messages.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

    -

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

    -

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    SHA-1 (BYTE-only)

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

    -

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

    -

    Windows Vista Symmetric Algorithm Implementation #618

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)

    Windows Vista BitLocker Drive Encryption #737

    -

    Windows Vista Beta 2 BitLocker Drive Encryption #495

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

    SHA-1 (BYTE-only)

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

    -

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

    -

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

    -

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

    -

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

    -

    Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

    -

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

    SHA-1 (BYTE-only)

    Windows XP Microsoft Enhanced Cryptographic Provider #83

    -

    Crypto Driver for Windows 2000 (fips.sys) #35

    -

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

    -

    Windows 2000 RSAENH.DLL #24

    -

    Windows 2000 RSABASE.DLL #23

    -

    Windows NT 4 SP6 RSAENH.DLL #21

    -

    Windows NT 4 SP6 RSABASE.DLL #20

    - - -#### Triple DES - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

    -

    Version 10.0.15063.674

      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

    -

    Version 10.0.15254

      -
    • TDES-CBC:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB64:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-CFB8:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -
    • TDES-ECB:
      • -
      • -
      • Modes: Decrypt, Encrypt
        • -
      • Keying Option: 1
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    -

    Version 10.0.16299

    TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

    -

    Version 10.0.15063

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

    -

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

    -

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    CTR ( int only )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

    -

    Version 7.00.2872

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

    -

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
    -
    -

    -

    Version 10.0.14393

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
    -
    -

    -

    Version 10.0.10586

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
    -
    -

    -

    Version 10.0.10240

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    -

    Version 6.3.9600

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 ) ;

    -

    TCFB64( e/d; KO 1,2 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    		Windows Vista Symmetric Algorithm Implementation #549
    Triple DES MAC

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

    -

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 )

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

    -

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

    -

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

    -

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

    -

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

    -

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

    -

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

    -

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

    -

    Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

    -

    Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

    -

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

    -

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

    -

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

    -

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

    -

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

    -

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

    -

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

    -

    Windows XP Microsoft Enhanced Cryptographic Provider #81

    -

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

    -

    Crypto Driver for Windows 2000 (fips.sys) #16

    - - -#### SP 800-132 Password Based Key Derivation Function (PBKDF) - - - - - - - - - - - - - - -
    - Modes / States / Key Sizes - - Algorithm Implementation and Certificate # -
    - PBKDF (vendor affirmed) -

     Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
    (Software Version: 10.0.14393)

    -

    Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    -

    Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
    (Software Version: 10.0.14393)

    -

    Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
    (Software Version: 10.0.14393)

    -
    - PBKDF (vendor affirmed) -

    Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    -

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

    -
    - - -#### Component Validation List - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Publication / Component Validated / DescriptionImplementation and Certificate #
      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    -

    Version 6.3.9600

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub Virtual TPM Implementations #1519

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

     Prerequisite: DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

    -

    Version 10.0.15063.674

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

    -

    Version 10.0.15063.674

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

    -

    Version 10.0.15063.674

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4011, HMAC #3269

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

    -

    Version 10.0.15063.674

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

    -

    Version 10.0.15254

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

    -

    Version 10.0.15254

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

    -

    Version 10.0.15254

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4010, HMAC #3268

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

    -

    Version 10.0.15254

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

    -

    Version 10.0.15254

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

    -

    Version 10.0.15254

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

    -

    Version 10.0.15254

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    -

    Version 10.0.16299

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    -

    Version 10.0.16299

      -
    • ECDSA SigGen:
      • -
      • -
      • P-256 SHA: SHA-256
        • -
      • P-384 SHA: SHA-384
        • -
      • P-521 SHA: SHA-512
        • -
      • -
    -

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    -

    Version 10.0.16299

      -
    • RSADP:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    -

    Version 10.0.16299

    -

     

      -
    • RSASP1:
      • -
      • -
      • Modulus Size: 2048 (bits)
        • -
      • Padding Algorithms: PKCS 1.5
        • -
      • -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    -

    Version 10.0.16299

      -
    • IKEv1:
      • -
      • -
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • -
      • Pre-shared Key Length: 64-2048
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    -
      -
    • IKEv2:
      • -
      • -
      • Derived Keying Material length: 192-1792
        • -
      • Diffie-Hellman shared secrets:
        • -
        • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 2048 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 256 (bits)
            • -
          • SHA Functions: SHA-256
            • -
          • -
        • Diffie-Hellman shared secret:
          • -
          • -
          • Length: 384 (bits)
            • -
          • SHA Functions: SHA-384
            • -
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    -
      -
    • TLS:
      • -
      • -
      • Supports TLS 1.0/1.1
        • -
      • Supports TLS 1.2:
        • -
        • -
        • SHA Functions: SHA-256, SHA-384
          • -
        • -
      • -
    -

    Prerequisite: SHS #4009, HMAC #3267

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    -

    Version 10.0.16299

    FIPS186-4 ECDSA

    -

    Signature Generation of hash sized messages

    -

    ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
    -Version 10.0. 15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
    -Version 10.0. 15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    -Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
    -Version 10.0.10586

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    -Version 6.3.9600

    FIPS186-4 RSA; PKCS#1 v2.1

    -

    RSASP1 Signature Primitive

    -

    RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
    -Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
    -Version  10.0.10240

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
    -Version 6.3.9600

    FIPS186-4 RSA; RSADP

    -

    RSADP Primitive

    -

    RSADP: (Mod2048)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
    -Version 10.0.15063

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
    -Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    -Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
    -Version  10.0.10240

    SP800-135

    -

    Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    -

    Version 10.0.16299

    -

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
    -Version 10.0.15063

    -

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
    -Version 7.00.2872

    -

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
    -Version 8.00.6246

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
    -Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
    -Version 10.0.10586

    -

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
    -Version  10.0.10240

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    -Version 6.3.9600

    - - -## References - -\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules - -\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ - -\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) - -\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths - -## Additional Microsoft References - -Enabling FIPS mode - - -Cipher Suites in Schannel - [https://msdn.microsoft.com/library/aa374757(VS.85).aspx](https://msdn.microsoft.com/library/aa374757\(vs.85\).aspx) - +--- +title: FIPS 140 Validation +description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. +ms.prod: w10 +audience: ITPro +author: dulcemontemayor +ms.author: dansimp +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.localizationpriority: medium +ms.date: 11/05/2019 +ms.reviewer: +--- + +# FIPS 140-2 Validation + +## FIPS 140-2 standard overview + +The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard that defines minimum security requirements for cryptographic modules in information technology products, as defined in Section 5131 of the Information Technology Management Reform Act of 1996. + +The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program), a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS), validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover eleven areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. + +## Microsoft’s approach to FIPS 140-2 validation + +Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since the inception of the standard in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. + +## Using Windows in a FIPS 140-2 approved mode of operation + +Windows 10 and Windows server may be configured to run in a FIPS 140-2 approved mode of operation. This is commonly referred to as “FIPS mode.” Achieving this mode of operation requires administrators to complete all four steps outlined below. + +### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed + +Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. This is accomplished by cross-checking the version number of the cryptographic module with the table of validated modules at the end of this topic, organized by operating system release. + +### Step 2: Ensure all security policies for all cryptographic modules are followed + +Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found by following the links in the table of validated modules at the end of this topic. Click on the module version number to view the published SPD for the module. + +### Step 3: Enable the FIPS security policy + +Windows provides the security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,” which is used by some Microsoft products to determine whether to operate in a FIPS 140-2 approved mode. When this policy is enabled, the validated cryptographic modules in Windows will also operate in FIPS approved mode. The policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). + +### Step 4: Ensure only FIPS validated cryptographic algorithms are used + +Neither the operating system nor the cryptographic modules can enforce a FIPS approved mode of operation, regardless of the FIPS security policy setting. To run in a FIPS approved mode, an application or service must check for the policy flag and enforce the security policies of the validated modules. If an application or service uses a non-approved cryptographic algorithm or does not follow the security policies of the validated modules, it is not operating in a FIPS approved mode. + +## Frequently asked questions + +### How long does it take to certify cryptographic modules? + +Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors. + +### When does Microsoft undertake a FIPS 140 validation? + +The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules. + +### What is the difference between “FIPS 140 validated” and “FIPS 140 compliant”? + +“FIPS 140 validated” means that the cryptographic module, or a product that embeds the module, has been validated (“certified”) by the CMVP as meeting as meeting the FIPS 140-2 requirements. “FIPS 140 compliant” is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. + +### I need to know if a Windows service or application is FIPS 140-2 validated. + +The cryptographic modules leveraged in Windows are validated through the CMVP, not individual services, applications, hardware peripherals, or other solutions. For a solution to be considered compliant, it must call a FIPS 140-2 validated cryptographic module in the underlying OS and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. + +### What does "When operated in FIPS mode" mean on a certificate? + +This caveat identifies required configuration and security rules that must be followed to use the cryptographic module in a way that is consistent with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. + +### What is the relationship between FIPS 140-2 and Common Criteria? + +These are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules, while Common Criteria is designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. + +### How does FIPS 140 relate to Suite B? + +Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140-2 standard. + +## Microsoft FIPS 140-2 validated cryptographic modules + +The following tables identify the cryptographic modules used in an operating system, organized by release. + +## Modules used by Windows + +##### Windows 10 Spring 2018 Update (Version 1803) + +Validated Editions: Home, Pro, Enterprise, Education + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows 10 Fall Creators Update (Version 1709) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows 10 Creators Update (Version 1703) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

    FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

    #3094

    +

    FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

    Boot Manager10.0.15063#3089

    FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

    +

    Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

    Windows OS Loader10.0.15063#3090

    FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

    +

    Other algorithms: NDRNG

    Windows Resume[1]10.0.15063#3091FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
    BitLocker® Dump Filter[2]10.0.15063#3092FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
    Code Integrity (ci.dll)10.0.15063#3093

    FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

    FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

    + + +\[1\] Applies only to Home, Pro, Enterprise, Education and S + +\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub + +\[3\] Applies only to Pro, Enterprise Education and S + +##### Windows 10 Anniversary Update (Version 1607) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

    FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

    FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

    Boot Manager10.0.14393#2931

    FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    +

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.14393#2935

    FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

    FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

    + + +\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile + +\[3\] Applies only to Pro, Enterprise and Enterprise LTSB + +##### Windows 10 November 2015 Update (Version 1511) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

    FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

    FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

    Boot Manager[4]10.0.10586#2700FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS Approved algorithms: AES (Certs. #3653)
    Code Integrity (ci.dll)10.0.10586#2604

    FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

    FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

    + + +\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[6\] Applies only to Home, Pro and Enterprise + +\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub + +\[8\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 10 (Version 1507) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

    FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

    FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
    +
    +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

    Boot Manager[9]10.0.10240#2600FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS Approved algorithms: AES (Certs. #3497 and #3498)
    Code Integrity (ci.dll)10.0.10240#2604

    FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    +
    +Other algorithms: AES (non-compliant); MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

    FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

    + + +\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[12\] Applies only to Pro, Enterprise and Enterprise LTSB + +\[13\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 8.1 + +Validated Editions: RT, Pro, Enterprise, Phone, Embedded + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

    FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

    FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

    +

    Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    Boot Manager6.3.9600 6.3.9600.17031#2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS Approved algorithms: AES (Cert. #2832)
    +
    +Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

    FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    +
    +Other algorithms: MD5

    +

    Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

    + + +\[14\] Applies only to Pro, Enterprise, and Embedded 8. + +##### Windows 8 + +Validated Editions: RT, Home, Pro, Enterprise, Phone + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.9200#1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
    +
    +Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.9200#1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    +
    +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +\[15\] Applies only to Home and Pro + +**Windows 7** + +Validated Editions: Windows 7, Windows 7 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

    6.1.7600.16385

    +

    6.1.7601.17514

    		1329FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Kernel Mode Cryptographic Primitives Library (cng.sys)

    6.1.7600.16385

    +

    6.1.7600.16915

    +

    6.1.7600.21092

    +

    6.1.7601.17514

    +

    6.1.7601.17725

    +

    6.1.7601.17919

    +

    6.1.7601.21861

    +

    6.1.7601.22076

    		1328FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Boot Manager

    6.1.7600.16385

    +

    6.1.7601.17514

    		1319FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
    +
    +Other algorithms: MD5
    Winload OS Loader (winload.exe)

    6.1.7600.16385

    +

    6.1.7600.16757

    +

    6.1.7600.20897

    +

    6.1.7600.20916

    +

    6.1.7601.17514

    +

    6.1.7601.17556

    +

    6.1.7601.21655

    +

    6.1.7601.21675

    		1326FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    BitLocker™ Drive Encryption

    6.1.7600.16385

    +

    6.1.7600.16429

    +

    6.1.7600.16757

    +

    6.1.7600.20536

    +

    6.1.7600.20873

    +

    6.1.7600.20897

    +

    6.1.7600.20916

    +

    6.1.7601.17514

    +

    6.1.7601.17556

    +

    6.1.7601.21634

    +

    6.1.7601.21655

    +

    6.1.7601.21675

    		1332FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    +
    +Other algorithms: Elephant Diffuser
    Code Integrity (CI.DLL)

    6.1.7600.16385

    +

    6.1.7600.17122

    +

    6.1.7600.21320

    +

    6.1.7601.17514

    +

    6.1.7601.17950

    +

    6.1.7601.22108

    		1327FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
    +(no change in SP1)    		1331FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
    +(no change in SP1)    		1330FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Vista SP1 + +Validated Editions: Ultimate Edition + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

    FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

    +

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

    FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

    +

    Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051002

    FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

    +

    Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051003

    FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

    +

    Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

    + + +##### Windows Vista + +Validated Editions: Ultimate Edition + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.0.6000.16386947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
    +
    +Other algorithms: Elephant Diffuser
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
    +
    +Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
    + + +##### Windows XP SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

    FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

    +

    Other algorithms: DES; MD5; HMAC MD5

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

    FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

    +

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

    Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

    FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

    +

    Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

    + + +##### Windows XP SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

    +

    Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

    Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

    FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    +

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    + + +##### Windows XP SP1 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

    FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

    +

    Other algorithms: DES (Cert. #156); RC2; RC4; MD5

    + + +##### Windows XP + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module5.1.2600.0241

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

    +

    Other algorithms: DES (Cert. #89)

    + + +##### Windows 2000 SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    +

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2195.3665 [SP3])

    +

    (Base: 5.0.2195.3839 [SP3])

    +

    (DSS/DH Enh: 5.0.2195.3665 [SP3])

    +

    (Enh: 5.0.2195.3839 [SP3]

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

    FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

    +

    Other algorithms: DES (Certs. #89)

    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS:

    +

    5.0.2195.2228 [SP2])

    +

    (Base:

    +

    5.0.2195.2228 [SP2])

    +

    (DSS/DH Enh:

    +

    5.0.2195.2228 [SP2])

    +

    (Enh:

    +

    5.0.2195.2228 [SP2])

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 SP1 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

    (Base DSS: 5.0.2150.1391 [SP1])

    +

    (Base: 5.0.2150.1391 [SP1])

    +

    (DSS/DH Enh: 5.0.2150.1391 [SP1])

    +

    (Enh: 5.0.2150.1391 [SP1])

    		103

    FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

    + + +##### Windows 2000 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

    FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    + + +##### Windows 95 and Windows 98 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

    FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

    +

    Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

    + + +##### Windows NT 4.0 + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
    +
    +Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
    + +## Modules used by Windows Server + +##### Windows Server (Version 1803) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows Server (Version 1709) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
    Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
    Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
    Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
    Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
    BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
    Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
    Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
    + +##### Windows Server 2016 + +Validated Editions: Standard, Datacenter, Storage Server + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
    +
    +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager10.0.143932931

    FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

    +

    Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

    BitLocker® Windows OS Loader (winload)10.0.143932932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: NDRNG; MD5
    BitLocker® Windows Resume (winresume)10.0.143932933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
    Code Integrity (ci.dll)10.0.143932935FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
    +
    +Other algorithms: AES (non-compliant); MD5
    Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
    +
    +Other algorithms: MD5
    + + +##### Windows Server 2012 R2 + +Validated Editions: Server, Storage Server, + +**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
    +
    +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.3.9600 6.3.9600.170312351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
    BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
    +
    +Other algorithms: MD5; NDRNG
    BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS Approved algorithms: AES (Cert. #2832)
    +
    +Other algorithms: N/A
    Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
    +
    +Other algorithms: MD5
    + + +\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +**Windows Server 2012** + +Validated Editions: Server, Storage Server + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
    +
    +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
    Boot Manager6.2.92001895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
    BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
    +
    +Other algorithms: N/A
    Code Integrity (CI.DLL)6.2.92001897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
    +
    +Other algorithms: MD5
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
    +
    +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Server 2008 R2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175141321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
    +
    +Other algorithms: MD5
    Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
    Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.175141336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
    +
    +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
    Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
    +
    +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
    BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
    +
    +Other algorithms: Elephant Diffuser
    + + +##### Windows Server 2008 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: N/A
    Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
    +
    +Other algorithms: MD5
    Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
    +
    +-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
    Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
    +
    +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
    + + +##### Windows Server 2003 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

    FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

    +

    Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

    FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

    +

    Other algorithms: DES; HMAC-MD5

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

    FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

    +

    Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

    + + +##### Windows Server 2003 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

    FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    +

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

    FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    +

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

    FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    +

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    + + +##### Windows Server 2003 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

    FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

    +

    Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

    FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

    +

    Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

    FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

    +

    Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

    +

    [1] x86
    +[2] SP1 x86, x64, IA64

    + + +#### Other Products + +##### Windows Embedded Compact 7 and Windows Embedded Compact 8 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

    FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

    +

    Allowed algorithms: HMAC-MD5; MD5; NDRNG

    Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

    FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

    +

    Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

    + + + +##### Windows CE 6.0 and Windows Embedded Compact 7 + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

    FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

    +

    Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

    + + +##### Outlook Cryptographic Provider + + ++++++ + + + + + + + + + + + + + + +
    Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
    Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)SR-1A (3821)110

    FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

    +

    Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

    + + + +### Cryptographic Algorithms + +The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. + +### Advanced Encryption Standard (AES) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-OFB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +

    Microsoft Surface Hub Virtual TPM Implementations #4904

    +

    Version 10.0.15063.674

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-OFB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

    +

    Version 10.0.16299

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

    +

    Version 10.0.15063.674

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

    +

    Version 10.0.15254

      +
    • AES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CCM:
      • +
      • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
        • +
      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      • +
    • AES-CFB128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-CMAC:
      • +
      • +
      • Generation:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • Verification:
        • +
        • +
        • AES-128:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-192:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • AES-256:
          • +
          • +
          • Block Sizes: Full, Partial
            • +
          • Message Length: 0-65536
            • +
          • Tag Length: 16-16
            • +
          • +
        • +
      • +
    • AES-CTR:
      • +
      • +
      • Counter Source: Internal
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • +
    • AES-GCM:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • IV Generation: External
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
        • +
      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • AAD Lengths: 0, 8, 1016, 1024 (bits)
        • +
      • 96 bit IV supported
        • +
      • +
    • AES-XTS:
      • +
      • +
      • Key Size: 128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • Key Size: 256:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Block Sizes: Full
          • +
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

    +

    Version 10.0.16299

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES Val#4902

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

    +

    Version 10.0.15063.674

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES Val#4901

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

    +

    Version 10.0.15254

    AES-KW:

    +
      +
    • Modes: Decrypt, Encrypt
      • +
    • CIPHK transformation direction: Forward
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      • +
    +

    AES Val#4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

    +

    Version 10.0.16299

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    +

    AES Val#4902

    Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

    +

    Version 10.0.15063.674

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    +

    AES Val#4901

    Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

    +

    Version 10.0.15254

    AES-CCM:

    +
      +
    • Key Lengths: 256 (bits)
      • +
    • Tag Lengths: 128 (bits)
      • +
    • IV Lengths: 96 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    +

    AES Val#4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    +

    Version 10.0.16299

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB128 ( e/d; 128 , 192 , 256 );

    +

    OFB ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

    +

    Version 10.0.15063

    KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    +

    AES Val#4624

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

    +

    Version 10.0.15063

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#4624

    +

     

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

    +

    Version 10.0.15063

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    CFB128 ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    +

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    +

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

    +

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    +

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    +

    IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

    +

    GMAC_Supported

    +

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

    +

    Version 10.0.15063

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

    +

    Version 7.00.2872

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

    +

    Version 8.00.6246

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

    +

    Version 7.00.2872

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

    +

    Version 8.00.6246

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB128 ( e/d; 128 , 192 , 256 );

    +

    OFB ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    +

    Version 10.0.14393

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    +

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    +

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    +

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    +GMAC_Supported

    +

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

    +

    Version 10.0.14393

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
    +Version 10.0.14393

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

    +

    AES Val#4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

    +

    Version 10.0.14393

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

    +

    Version 10.0.14393

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    +

    AES Val#3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

    +

    Version 10.0.10586

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

    +

    Version 10.0.10586

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
    +Version 10.0.10586

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    +

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    +

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    +

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    +GMAC_Supported

    +

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
    +
    +

    +

    Version 10.0.10586

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    +

    AES Val#3497

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

    +

    Version 10.0.10240

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#3497

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

    +

    Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    +

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    +

    CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    +

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    +GMAC_Supported

    +

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
    +Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
    +Version 10.0.10240

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

    +

    Version 6.3.9600

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#2832

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

    +

    Version 6.3.9600

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    +

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    +

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    +

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    +

    IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
    +OtherIVLen_Supported
    +GMAC_Supported

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    +

    Version 6.3.9600

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    +AES Val#2197

    +

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
    +AES Val#2197

    +

    GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    +IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
    +GMAC_Supported

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    +

    AES Val#2196

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    CFB128 ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    +AES Val#1168

    Windows Server 2008 R2 and SP1 CNG algorithms #1187

    +

    Windows 7 Ultimate and SP1 CNG algorithms #1178

    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
    +AES Val#1168    		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    +

     

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

    GCM

    +

    GMAC

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed
    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    Windows Server 2008 CNG algorithms #757

    +

    Windows Vista Ultimate SP1 CNG algorithms #756

    CBC ( e/d; 128 , 256 );

    +

    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

    Windows Vista Ultimate BitLocker Drive Encryption #715

    +

    Windows Vista Ultimate BitLocker Drive Encryption #424

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CFB8 ( e/d; 128 , 192 , 256 );

    Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

    +

    Windows Vista Symmetric Algorithm Implementation #553

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    +

    CTR ( int only; 128 , 192 , 256 )

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

    ECB ( e/d; 128 , 192 , 256 );

    +

    CBC ( e/d; 128 , 192 , 256 );

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

    +

    Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

    +

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

    +

    Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

    +

    Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

    +

    Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

    + + +Deterministic Random Bit Generator (DRBG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function not used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4904

    Microsoft Surface Hub Virtual TPM Implementations #1734

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function not used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4903

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    +

    Version 10.0.16299

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4902

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4901

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

    +

    Version 10.0.15254

      +
    • Counter:
      • +
      • +
      • Modes: AES-256
        • +
      • Derivation Function States: Derivation Function used
        • +
      • Prediction Resistance Modes: Not Enabled
        • +
      • +
    +

    Prerequisite: AES #4897

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    +

    Version 10.0.16299

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ]

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

    +

    Version 10.0.15063

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ]

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

    +

    Version 10.0.15063

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

    +

    Version 7.00.2872

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

    +

    Version 8.00.6246

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

    +

    Version 7.00.2872

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

    +

    Version 8.00.6246

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    +

    Version 10.0.14393

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

    +

    Version 10.0.14393

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ]

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

    +

    Version 10.0.10586

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ]

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

    +

    Version 10.0.10240

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ]

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    +

    Version 6.3.9600

    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
    CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
    DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
    + + +#### Digital Signature Algorithm (DSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

    +

    Version 10.0.15063.674

      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          •  
            • +
          •  
            • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

    +

    Version 10.0.15254

      +
    • DSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • PQGGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • PQGVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigGen:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • SigVer:
          • +
          • +
          • L = 2048, N = 256 SHA: SHA-256
            • +
          • L = 3072, N = 256 SHA: SHA-256
            • +
          • +
        • KeyPair:
          • +
          • +
          • L = 2048, N = 256
            • +
          • L = 3072, N = 256
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    +

    Version 10.0.16299

    FIPS186-4:

    +

    PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    KeyPairGen:   [ (2048,256) ; (3072,256) ]

    +

    SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

    +

    SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    SHS: Val#3790

    +

    DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

    +

    Version 10.0.15063

    FIPS186-4:
    +PQG(ver)PARMS TESTED:       [ (1024,160) SHA( 1 ); ]
    +SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    +SHS: Val# 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

    +

    Version 7.00.2872

    FIPS186-4:
    +PQG(ver)PARMS TESTED:       [ (1024,160) SHA( 1 ); ]
    +SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    +SHS: Val#3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

    +

    Version 8.00.6246

    FIPS186-4:
    +PQG(gen)    PARMS TESTED: [
    +(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    +PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    +KeyPairGen:    [ (2048,256) ; (3072,256) ]
    +SIG(gen)PARMS TESTED:   [ (2048,256)
    +SHA( 256 ); (3072,256) SHA( 256 ); ]
    +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    SHS: Val# 3347
    +DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

    +

    Version 10.0.14393

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
    +KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    SHS: Val# 3047
    +DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

    +

    Version 10.0.10586

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    +PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    +KeyPairGen:    [ (2048,256) ; (3072,256) ]
    +SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    SHS: Val# 2886
    +DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

    +

    Version 10.0.10240

    FIPS186-4:
    +PQG(gen)    PARMS TESTED:   [
    +(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    +PQG(ver)PARMS TESTED:   [ (2048,256)
    +SHA( 256 ); (3072,256) SHA( 256 ) ]
    +KeyPairGen:    [ (2048,256) ; (3072,256) ]
    +SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    +

    SHS: Val# 2373
    +DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    +

    Version 6.3.9600

    FIPS186-2:
    +PQG(ver) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: #1903
    +DRBG: #258

    +

    FIPS186-4:
    +PQG(gen)PARMS TESTED    : [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    +PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    +SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    +SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    +SHS: #1903
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
    FIPS186-2:
    +PQG(ver)     MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: #1902
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 1773
    +DRBG: Val# 193
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645.    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 1081
    +DRBG: Val# 23
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386.

    Windows Server 2008 R2 and SP1 CNG algorithms #391

    +

    Windows 7 Ultimate and SP1 CNG algorithms #386

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 1081
    +RNG: Val# 649
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385.

    Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

    +

    Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 753
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283.

    Windows Server 2008 CNG algorithms #284

    +

    Windows Vista Ultimate SP1 CNG algorithms #283

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 753
    +RNG: Val# 435
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281.

    Windows Server 2008 Enhanced DSS (DSSENH) #282

    +

    Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 618
    +RNG: Val# 321
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226.

    Windows Vista CNG algorithms #227

    +

    Windows Vista Enhanced DSS (DSSENH) #226

    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 784
    +RNG: Val# 448
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292.    		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
    FIPS186-2:
    +SIG(ver)     MOD(1024);
    +SHS: Val# 783
    +RNG: Val# 447
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: Val# 611
    +RNG: Val# 314    		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: Val# 385    		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
    FIPS186-2:
    +PQG(ver)     MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: Val# 181
    +
    +    		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
    FIPS186-2:
    +PQG(gen)     MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SHS: SHA-1 (BYTE)
    +SIG(ver) MOD(1024);
    +SHS: SHA-1 (BYTE)

    Windows 2000 DSSENH.DLL #29

    +

    Windows 2000 DSSBASE.DLL #28

    +

    Windows NT 4 SP6 DSSENH.DLL #26

    +

    Windows NT 4 SP6 DSSBASE.DLL #25

    FIPS186-2: PRIME;
    +FIPS186-2:

    +

    KEYGEN(Y):
    +SHS: SHA-1 (BYTE)

    +

    SIG(gen):
    +SIG(ver)     MOD(1024);
    +SHS: SHA-1 (BYTE)

    		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
    + + +#### Elliptic Curve Digital Signature Algorithm (ECDSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #2373, DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    +

    Version 6.3.9600

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384
            • +
          • Generation Methods: Testing Candidates
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #1253

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384
            • +
          • Generation Methods: Testing Candidates
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    +

    Version 10.0.16299

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

    +

    Version 10.0.15063.674

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

    +

    Version 10.0.15254

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

    +

    Version 10.0.15254

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    +

    Version 10.0.16299

      +
    • ECDSA:
      • +
      • +
      • 186-4:
        • +
        • +
        • Key Pair Generation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • Generation Methods: Extra Random Bits
            • +
          • +
        • Public Key Validation:
          • +
          • +
          • Curves: P-256, P-384, P-521
            • +
          • +
        • Signature Generation:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • Signature Verification:
          • +
          • +
          • P-256 SHA: SHA-256
            • +
          • P-384 SHA: SHA-384
            • +
          • P-521 SHA: SHA-512
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    +

    Version 10.0.16299

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 TestingCandidates )
    +SHS: Val#3790
    +DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +PKV: CURVES( P-256 P-384 P-521 )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    +SHS: Val#3790
    +DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +PKV: CURVES( P-256 P-384 P-521 )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    +SHS: Val#3790
    +DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

    +

    Version 10.0.15063

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +PKV: CURVES( P-256 P-384 P-521 )
    +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    +SHS:Val# 3649
    +DRBG:Val# 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

    +

    Version 7.00.2872

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +PKV: CURVES( P-256 P-384 P-521 )
    +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    +SHS:Val#3648
    +DRBG:Val# 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

    +

    Version 8.00.6246

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 TestingCandidates )
    +PKV: CURVES( P-256 P-384 )
    +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

    +

    SHS: Val# 3347
    +DRBG: Val# 1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    +

    Version 10.0.14393

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +PKV: CURVES( P-256 P-384 P-521 )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    +

    SHS: Val# 3347
    +DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

    +

    Version 10.0.14393

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    +

    SHS: Val# 3047
    +DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

    +

    Version 10.0.10586

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    +

    SHS: Val# 2886
    +DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

    +

    Version 10.0.10240

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    +

    SHS: Val#2373
    +DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    +

    Version 6.3.9600

    FIPS186-2:
    +PKG: CURVES    ( P-256 P-384 P-521 )
    +SHS: #1903
    +DRBG: #258
    +SIG(ver):CURVES( P-256 P-384 P-521 )
    +SHS: #1903
    +DRBG: #258

    +

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    +SHS: #1903
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

    FIPS186-2:
    +PKG: CURVES    ( P-256 P-384 P-521 )
    +SHS: Val#1773
    +DRBG: Val# 193
    +SIG(ver): CURVES( P-256 P-384 P-521 )
    +SHS: Val#1773
    +DRBG: Val# 193

    +

    FIPS186-4:
    +PKG: CURVES    ( P-256 P-384 P-521 ExtraRandomBits )
    +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    +SHS: Val#1773
    +DRBG: Val# 193
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
    FIPS186-2:
    +PKG: CURVES    ( P-256 P-384 P-521 )
    +SHS: Val#1081
    +DRBG: Val# 23
    +SIG(ver): CURVES( P-256 P-384 P-521 )
    +SHS: Val#1081
    +DRBG: Val# 23
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141.

    Windows Server 2008 R2 and SP1 CNG algorithms #142

    +

    Windows 7 Ultimate and SP1 CNG algorithms #141

    FIPS186-2:
    +PKG: CURVES    ( P-256 P-384 P-521 )
    +SHS: Val#753
    +SIG(ver): CURVES( P-256 P-384 P-521 )
    +SHS: Val#753
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82.

    Windows Server 2008 CNG algorithms #83

    +

    Windows Vista Ultimate SP1 CNG algorithms #82

    FIPS186-2:
    +PKG: CURVES    ( P-256 P-384 P-521 )
    +SHS: Val#618
    +RNG: Val# 321
    +SIG(ver): CURVES( P-256 P-384 P-521 )
    +SHS: Val#618
    +RNG: Val# 321
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60.    		Windows Vista CNG algorithms #60
    + + +#### Keyed-Hash Message Authentication Code (HMAC) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4011

    Microsoft Surface Hub Virtual TPM Implementations #3271

    +

    Version 10.0.15063.674

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    +

    Version 10.0.16299

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4011

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

    +

    Version 10.0.15063.674

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4010

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

    +

    Version 10.0.15254

      +
    • HMAC-SHA-1:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-256:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-384:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    • HMAC-SHA2-512:
      • +
      • +
      • Key Sizes &lt; Block Size
        • +
      • Key Sizes &gt; Block Size
        • +
      • Key Sizes = Block Size
        • +
      • +
    +

    Prerequisite: SHS #4009

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    +

    Version 10.0.16299

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

    +

    Version 10.0.15063

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

    +

    Version 10.0.15063

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

    +

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

    +

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

    +

    Version 7.00.2872

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

    +

    Version 8.00.6246

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    +SHS Val# 3347

    +

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    +SHS Val# 3347

    +

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    +SHS Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    +

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

    +

    Version 10.0.14393

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    +SHS Val# 3047

    +

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    +SHS Val# 3047

    +

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    +SHS Val# 3047

    +

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    +SHS Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

    +

    Version 10.0.10586

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    +SHSVal# 2886

    +

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    +SHSVal# 2886

    +

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    + SHSVal# 2886

    +

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    +SHSVal# 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

    +

    Version 10.0.10240

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    +SHS Val#2373

    +

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    +SHS Val#2373

    +

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    +SHS Val#2373

    +

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    +SHS Val#2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    +

    Version 6.3.9600

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

    +

    Version 5.2.29344

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

    +

    SHS#1903

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

    +

    SHS#1903

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

    +

    SHS#1903

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

    +

    SHS#1903

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    +

    Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    Windows Server 2008 R2 and SP1 CNG algorithms #686

    +

    Windows 7 and SP1 CNG algorithms #677

    +

    Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

    +

    Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

    HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

    		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

    +

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

    +

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    Windows Server 2008 CNG algorithms #413

    +

    Windows Vista Ultimate SP1 CNG algorithms #412

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

    		Windows Vista Ultimate BitLocker Drive Encryption #386

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    		Windows Vista CNG algorithms #298

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

    		Windows Vista BitLocker Drive Encryption #199
    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

    +

    Windows XP, vendor-affirmed

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

    +

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    +

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    +

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
    + + +#### Key Agreement Scheme (KAS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Full Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #150

    +

    Version 10.0.15063.674

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Full Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

    +

    Version 10.0.16299

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DSA #1303, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

    +

    Version 10.0.15063.674

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DSA #1302, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

    +

    Version 10.0.15254

      +
    • KAS ECC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
        • +
      • Schemes:
        • +
        • +
        • Ephemeral Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • KDFs: Concatenation
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • One Pass DH:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • Static Unified:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • EC:
              • +
              • +
              • Curve: P-256
                • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • ED:
              • +
              • +
              • Curve: P-384
                • +
              • SHA: SHA-384
                • +
              • MAC: HMAC
                • +
              • +
            • EE:
              • +
              • +
              • Curve: P-521
                • +
              • SHA: SHA-512
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

    +
      +
    • KAS FFC:
      • +
      • +
      • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
        • +
      • Schemes:
        • +
        • +
        • dhEphem:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhOneFlow:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • dhStatic:
          • +
          • +
          • Key Agreement Roles: Initiator, Responder
            • +
          • Parameter Sets:
            • +
            • +
            • FB:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • FC:
              • +
              • +
              • SHA: SHA-256
                • +
              • MAC: HMAC
                • +
              • +
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DSA #1301, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    +

    Version 10.0.16299

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

    +

    SHS Val#3790
    +DSA Val#1135
    +DRBG Val#1556

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

    +

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    +SHS Val#3790
    +DSA Val#1223
    +DRBG Val#1555

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +
    +SHS Val#3790
    +ECDSA Val#1133
    +DRBG Val#1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

    +

    Version 10.0.15063

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    +SHS Val# 3649
    +DSA Val#1188
    +DRBG Val#1430

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

    +

    Version 7.00.2872

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    +[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    +SHS Val#3648
    +DSA Val#1187
    +DRBG Val#1429

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +
    +SHS Val#3648
    +ECDSA Val#1072
    +DRBG Val#1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

    +

    Version 8.00.6246

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
    +SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

    +

    SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    +

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
    +SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    +

    SHS Val# 3347 DSA Val#1098 DRBG Val#1217

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    +

    SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

    +

    Version 10.0.14393

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    +

    SHS Val# 3047 DSA Val#1024 DRBG Val#955

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    +

    SHS Val# 3047 ECDSA Val#760 DRBG Val#955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

    +

    Version 10.0.10586

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    +

    SHS Val# 2886 DSA Val#983 DRBG Val#868

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    +

    SHS Val# 2886 ECDSA Val#706 DRBG Val#868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

    +

    Version 10.0.10240

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    +( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    +

    SHS Val#2373 DSA Val#855 DRBG Val#489

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    +

    SHS Val#2373 ECDSA Val#505 DRBG Val#489

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    +

    Version 6.3.9600

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    +( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    +[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
    +SHS #1903 DSA Val#687 DRBG #258

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    +[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
    +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
    +
    +SHS #1903 ECDSA Val#341 DRBG #258

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

    KAS (SP 800–56A)

    +

    key agreement

    +

    key establishment methodology provides 80 to 256 bits of encryption strength

    Windows 7 and SP1, vendor-affirmed

    +

    Windows Server 2008 R2 and SP1, vendor-affirmed

    + + +SP 800-108 Key-Based Key Derivation Functions (KBKDF) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • Counter:
      • +
      • +
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • +
      • +
    +

    MAC prerequisite: HMAC #3271

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: DRBG #1734, KAS #150

    Microsoft Surface Hub Virtual TPM Implementations #161

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
        • +
      • +
    +

    MAC prerequisite: HMAC #3270

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: DRBG #1733, KAS #149

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    +

    Version 10.0.16299

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4902, HMAC #3269

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    • K prerequisite: KAS #148
      • +
    +

    Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

    +

    Version 10.0.15063.674

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4901, HMAC #3268

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: KAS #147

    Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

    +

    Version 10.0.15254

      +
    • Counter:
      • +
      • +
      • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
        • +
      • +
    +

    MAC prerequisite: AES #4897, HMAC #3267

    +
    +
      +
    • Counter Location: Before Fixed Data
      • +
    • R Length: 32 (bits)
      • +
    • SPs used to generate K: SP 800-56A, SP 800-90A
      • +
    +
    +

    K prerequisite: KAS #146

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    +

    Version 10.0.16299

    CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    +
    +KAS Val#128
    +DRBG Val#1556
    +MAC Val#3062

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

    +

    Version 10.0.15063

    CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    +
    +KAS Val#127
    +AES Val#4624
    +DRBG Val#1555
    +MAC Val#3061

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

    +

    Version 10.0.15063

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    KAS Val#93 DRBG Val#1222 MAC Val#2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    +

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

    +

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

    +

    Version 10.0.10586

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

    +

    Version 10.0.10240

    CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    DRBG Val#489 MAC Val#1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    +

    Version 6.3.9600

    CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    +

    DRBG #258 HMAC Val#1345

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
    + + +Random Number Generator (RNG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    FIPS 186-2 General Purpose

    +

    [ (x-Original); (SHA-1) ]

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
    FIPS 186-2
    +[ (x-Original); (SHA-1) ]

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

    +

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

    +

    Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

    +

    Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

    FIPS 186-2
    +[ (x-Change Notice); (SHA-1) ]

    +

    FIPS 186-2 General Purpose
    +[ (x-Change Notice); (SHA-1) ]

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

    +

    Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

    +

    Windows Vista RNG implementation #321

    FIPS 186-2 General Purpose
    +[ (x-Change Notice); (SHA-1) ]

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

    +

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

    FIPS 186-2
    +[ (x-Change Notice); (SHA-1) ]

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

    +

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

    + + +#### RSA + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1734

    Microsoft Surface Hub Virtual TPM Implementations #2677

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 240 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    +

    Version 10.0.16299

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub RSA32 Algorithm Implementations #2675

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    +

    Version 10.0.16299

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

    +

    Version 10.0.15254

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

    +

    Version 10.0.15063.674

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

    +

    Version 10.0.15254

    RSA:

    +
      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

    +

    Version 10.0.15254

      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Public Key Exponent: Fixed (10001)
          • +
        • Provable Primes with Conditions:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.3
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    +

    Version 10.0.16299

      +
    • 186-4:
      • +
      • +
      • Key Generation:
        • +
        • +
        • Probable Random Primes:
          • +
          • +
          • Mod lengths: 2048, 3072 (bits)
            • +
          • Primality Tests: C.2
            • +
          • +
        • +
      • Signature Generation PKCS1.5:
        • +
        • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Generation PSS:
        • +
        • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • Signature Verification PKCS1.5:
        • +
        • +
        • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
          • +
        • +
      • Signature Verification PSS:
        • +
        • +
        • Mod 1024:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 496 (bits)
            • +
          • +
        • Mod 2048:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • Mod 3072:
          • +
          • +
          • SHA-1: Salt Length: 160 (bits)
            • +
          • SHA-256: Salt Length: 256 (bits)
            • +
          • SHA-384: Salt Length: 384 (bits)
            • +
          • SHA-512: Salt Length: 512 (bits)
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    +

    Version 10.0.16299

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
    +SHA Val#3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

    +

    Version 10.0.15063

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +SHA Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

    +

    Version 10.0.15063

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    +SHA Val#3790
    +DRBG: Val# 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

    +

    Version 10.0.15063

    FIPS186-4:
    +186-4KEY(gen):
    +PGM(ProbRandom:     ( 2048 , 3072 ) PPTT:( C.2 )
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    +SHA Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

    +

    Version 10.0.15063

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

    +

    FIPS186-4:
    +ALG[ANSIX9.31]     Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +SHA Val#3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

    +

    Version 7.00.2872

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

    +

    FIPS186-4:
    +ALG[ANSIX9.31]     Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.     Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +SHA Val#3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

    +

    Version 8.00.6246

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

    +

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001) ;
    +PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +SHA Val# 3649
    +DRBG: Val# 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

    +

    Version 7.00.2872

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

    +

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e (10001) ;
    +PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    +SHA Val#3648
    +DRBG: Val# 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

    +

    Version 8.00.6246

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

    +

    SHA Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    +

    Version 10.0.14393

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    +

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

    +

    Version 10.0.14393

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#3346

    soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

    +

    Version 10.0.14393

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

    +

    Version 10.0.14393

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen):     (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    +

    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    +

    SHA Val# 3347 DRBG: Val# 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

    +

    Version 10.0.14393

    FIPS186-4:
    +186-4KEY(gen)    :  FIPS186-4_Fixed_e ( 10001 ) ;
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    +

    SHA Val# 3047 DRBG: Val# 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

    +

    Version 10.0.10586

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#3048

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

    +

    Version 10.0.10586

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

    +

    Version 10.0.10586

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen)    : (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    +Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    +

    SHA Val# 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

    +

    Version 10.0.10586

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e ( 10001 ) ;
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    +

    SHA Val# 2886 DRBG: Val# 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

    +

    Version 10.0.10240

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

    +

    Version 10.0.10240

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

    +

    Version 10.0.10240

    FIPS186-4:
    +[RSASSA-PSS]:     Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    +Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    +

    SHA Val# 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

    +

    Version 10.0.10240

    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e ;
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    +

    SHA Val#2373 DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5    ] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    +

    SHA Val#2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    +

    Version 6.3.9600

    FIPS186-4:
    +[RSASSA-PSS]:     Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    + Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    +

    SHA Val#2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    +

    Version 6.3.9600

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]     SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
    +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    +Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
    +SHA #1903

    +

    Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
    FIPS186-4:
    +186-4KEY(gen):     FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
    +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    +SHA #1903 DRBG: #258    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.    		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.    		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.    		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.

    Windows Server 2008 R2 and SP1 CNG algorithms #567

    +

    Windows 7 and SP1 CNG algorithms #560

    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.    		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.    		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.

    Windows Server 2008 CNG algorithms #358

    +

    Windows Vista SP1 CNG algorithms #357

    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

    +

    Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.    		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
    FIPS186-2:
    +ALG[ANSIX9.31]:     Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.    		Windows Vista RSA key generation implementation #258
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.    		Windows Vista CNG algorithms #257
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:     SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.    		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.    		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.    		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.    		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.    		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
    FIPS186-2:
    +ALG[ANSIX9.31]:
    +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.    		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

    FIPS186-2:

    +

    – PKCS#1 v1.5, signature generation and verification

    +

    – Mod sizes: 1024, 1536, 2048, 3072, 4096

    +

    – SHS: SHA–1/256/384/512

    Windows XP, vendor-affirmed

    +

    Windows 2000, vendor-affirmed

    + + +#### Secure Hash Standard (SHS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

    +

    Version 10.0.15063.674

      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

    +

    Version 10.0.15254

      +
    • SHA-1:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-256:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-384:
      • +
      • +
      • Supports Empty Message
        • +
      • +
    • SHA-512:
      • +
      • +
      • Supports Empty Message
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    +

    Version 10.0.16299

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

    +

    Version 10.0.15063

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

    +

    Version 7.00.2872

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

    +

    Version 8.00.6246

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

    +

    Version 7.00.2872

    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

    +

    Version 8.00.6246

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
    +Version 10.0.14393
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
    +Version 10.0.14393
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
    +Version 10.0.10586
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
    +Version 10.0.10586
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
    +Version 10.0.10240
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
    +Version 10.0.10240
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
    +Version 6.3.9600
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    +Version 6.3.9600

    SHA-1 (BYTE-only)

    +

    SHA-256 (BYTE-only)

    +

    SHA-384 (BYTE-only)

    +

    SHA-512 (BYTE-only)

    +

    Implementation does not support zero-length (null) messages.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

    +

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

    +

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    SHA-1 (BYTE-only)

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

    +

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)    		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

    +

    Windows Vista Symmetric Algorithm Implementation #618

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)

    Windows Vista BitLocker Drive Encryption #737

    +

    Windows Vista Beta 2 BitLocker Drive Encryption #495

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

    SHA-1 (BYTE-only)

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

    +

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

    +

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

    +

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

    +

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

    +

    Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

    +

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

    SHA-1 (BYTE-only)

    Windows XP Microsoft Enhanced Cryptographic Provider #83

    +

    Crypto Driver for Windows 2000 (fips.sys) #35

    +

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

    +

    Windows 2000 RSAENH.DLL #24

    +

    Windows 2000 RSABASE.DLL #23

    +

    Windows NT 4 SP6 RSAENH.DLL #21

    +

    Windows NT 4 SP6 RSABASE.DLL #20

    + + +#### Triple DES + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #
      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

    +

    Version 10.0.15063.674

      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

    +

    Version 10.0.15254

      +
    • TDES-CBC:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB64:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-CFB8:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +
    • TDES-ECB:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Keying Option: 1
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    +

    Version 10.0.16299

    TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

    +

    Version 10.0.15063

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

    +

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

    +

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, ) ;

    +

    CTR ( int only )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

    +

    Version 7.00.2872

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, )

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

    +

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, ) ;

    +

    TCFB8( KO 1 e/d, ) ;

    +

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
    +
    +

    +

    Version 10.0.14393

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, ) ;

    +

    TCFB8( KO 1 e/d, ) ;

    +

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
    +
    +

    +

    Version 10.0.10586

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, ) ;

    +

    TCFB8( KO 1 e/d, ) ;

    +

    TCFB64( KO 1 e/d, )

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
    +
    +

    +

    Version 10.0.10240

    TECB( KO 1 e/d, ) ;

    +

    TCBC( KO 1 e/d, ) ;

    +

    TCFB8( KO 1 e/d, ) ;

    +

    TCFB64( KO 1 e/d, )

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    +

    Version 6.3.9600

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 ) ;

    +

    TCFB8( e/d; KO 1,2 ) ;

    +

    TCFB64( e/d; KO 1,2 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 ) ;

    +

    TCFB8( e/d; KO 1,2 )

    		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 ) ;

    +

    TCFB8( e/d; KO 1,2 )

    		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 ) ;

    +

    TCFB8( e/d; KO 1,2 )

    		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 ) ;

    +

    TCFB8( e/d; KO 1,2 )

    		Windows Vista Symmetric Algorithm Implementation #549
    Triple DES MAC

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

    +

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

    TECB( e/d; KO 1,2 ) ;

    +

    TCBC( e/d; KO 1,2 )

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

    +

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

    +

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

    +

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

    +

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

    +

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

    +

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

    +

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

    +

    Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

    +

    Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

    +

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

    +

    Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

    +

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

    +

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

    +

    Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

    +

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

    +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

    +

    Windows XP Microsoft Enhanced Cryptographic Provider #81

    +

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

    +

    Crypto Driver for Windows 2000 (fips.sys) #16

    + + +#### SP 800-132 Password Based Key Derivation Function (PBKDF) + + + + + + + + + + + + + + +
    + Modes / States / Key Sizes + + Algorithm Implementation and Certificate # +
    + PBKDF (vendor affirmed) +

     Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
    (Software Version: 10.0.14393)

    +

    Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    +

    Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
    (Software Version: 10.0.14393)

    +

    Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
    (Software Version: 10.0.14393)

    +
    + PBKDF (vendor affirmed) +

    Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    +

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

    +
    + + +#### Component Validation List + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Publication / Component Validated / DescriptionImplementation and Certificate #
      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    +

    Version 6.3.9600

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub Virtual TPM Implementations #1519

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

     Prerequisite: DRBG #1732

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1732

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

    +

    Version 10.0.15063.674

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

    +

    Version 10.0.15063.674

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

    +

    Version 10.0.15063.674

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4011, HMAC #3269

    Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

    +

    Version 10.0.15063.674

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

    +

    Version 10.0.15254

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

    +

    Version 10.0.15254

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

    +

    Version 10.0.15254

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4010, HMAC #3268

    Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

    +

    Version 10.0.15254

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1731

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

    +

    Version 10.0.15254

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

    +

    Version 10.0.15254

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

    +

    Version 10.0.15254

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    +

    Version 10.0.16299

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    +

    Version 10.0.16299

      +
    • ECDSA SigGen:
      • +
      • +
      • P-256 SHA: SHA-256
        • +
      • P-384 SHA: SHA-384
        • +
      • P-521 SHA: SHA-512
        • +
      • +
    +

    Prerequisite: DRBG #1730

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    +

    Version 10.0.16299

      +
    • RSADP:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    +

    Version 10.0.16299

    +

     

      +
    • RSASP1:
      • +
      • +
      • Modulus Size: 2048 (bits)
        • +
      • Padding Algorithms: PKCS 1.5
        • +
      • +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    +

    Version 10.0.16299

      +
    • IKEv1:
      • +
      • +
      • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
        • +
      • Pre-shared Key Length: 64-2048
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    +
      +
    • IKEv2:
      • +
      • +
      • Derived Keying Material length: 192-1792
        • +
      • Diffie-Hellman shared secrets:
        • +
        • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 2048 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 256 (bits)
            • +
          • SHA Functions: SHA-256
            • +
          • +
        • Diffie-Hellman shared secret:
          • +
          • +
          • Length: 384 (bits)
            • +
          • SHA Functions: SHA-384
            • +
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    +
      +
    • TLS:
      • +
      • +
      • Supports TLS 1.0/1.1
        • +
      • Supports TLS 1.2:
        • +
        • +
        • SHA Functions: SHA-256, SHA-384
          • +
        • +
      • +
    +

    Prerequisite: SHS #4009, HMAC #3267

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Version 10.0.16299

    FIPS186-4 ECDSA

    +

    Signature Generation of hash sized messages

    +

    ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
    +Version 10.0. 15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
    +Version 10.0. 15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    +Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
    +Version 10.0.10586

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    +Version 6.3.9600

    FIPS186-4 RSA; PKCS#1 v2.1

    +

    RSASP1 Signature Primitive

    +

    RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
    +Version 10.0.15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
    +Version  10.0.10240

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
    +Version 6.3.9600

    FIPS186-4 RSA; RSADP

    +

    RSADP Primitive

    +

    RSADP: (Mod2048)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
    +Version 10.0.15063

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
    +Version 10.0.15063

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    +Version 10.0.14393

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
    +Version  10.0.10240

    SP800-135

    +

    Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Version 10.0.16299

    +

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
    +Version 10.0.15063

    +

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
    +Version 7.00.2872

    +

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
    +Version 8.00.6246

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
    +Version 10.0.14393

    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
    +Version 10.0.10586

    +

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
    +Version  10.0.10240

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    +Version 6.3.9600

    + + +## References + +\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules + +\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ + +\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) + +\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index 28286da43d..c0b6610350 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -25,6 +25,8 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. ## Schema tables @@ -52,4 +54,4 @@ Table and column names are also listed within the Microsoft Defender Security Ce ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) \ No newline at end of file +- [Learn the query language](advanced-hunting-query-language.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md index 8d6222dc34..35d38020d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -26,6 +26,8 @@ ms.date: 10/27/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration. Use this reference to check the latest assessment results and determine whether device are compliant. For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). @@ -34,13 +36,13 @@ For information on other tables in the Advanced hunting schema, see [the Advance |-------------|-----------|-------------| | MachineId | string | Unique identifier for the machine in the service | | ComputerName | string | Fully qualified domain name (FQDN) of the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| +| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| | Timestamp | datetime |Date and time when the record was generated| | ConfigurationId | string | Unique identifier for a specific configuration | | ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| | ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | | ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | -| IsCompliant | string | Indicates whether the configuration or policy is properly configured | +| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md index a8ca8d8c52..857a5731c6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md @@ -26,6 +26,8 @@ ms.date: 10/27/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configuration TVM checks during assessments related to your organization. An example of a security configuration is to block JavaScript or VBScript from launching downloaded executable content to prevent accidentally downloading malicious files in your network. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md index 138f8a0e3f..fcf0c2e4bd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -42,8 +42,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | OSArchitecture | string | Architecture of the operating system running on the machine| | SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| | SoftwareName | string | Name of the software product| -|SoftwareVersion | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| -| CveId | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| +|SoftwareVersion | string | Version number of the software product| +| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| | VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md index 68260d0b2c..757ad9858c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md @@ -26,6 +26,8 @@ ms.date: 10/27/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains information about the vulnerabilities Threat & Vulnerability Management assesses devices for. Use this reference along with DeviceTvmSoftwareInventoryVulnerabilities to construct queries that return information on the metadata related to the vulnerabilities in your inventory. For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). @@ -34,7 +36,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance |-------------|-----------|-------------| | CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| | CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS)| -| IsExploitAvailable | string | Indicates whether exploit code for the vulnerability is publicly available| +| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available| | VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| | LastModifiedTime | datetime | Date and time the item or related metadata was last modified| | PublishedDate | datetime | Date vulnerability was disclosed to public| diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 4eafbbefa8..6a076bfb65 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -60,7 +60,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com >- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) > >To download the security updates: ->1. Go to [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/home.aspx). +>1. Go to [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/home.aspx). >2. Key-in the security update KB number that you need to download, then click **Search**. ## Related topics @@ -68,7 +68,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md new file mode 100644 index 0000000000..e0e7253afa --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md @@ -0,0 +1,154 @@ +--- +title: Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to install and use Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Enable Microsoft Defender ATP Insider Machine + +The following instructions specify how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine. For scale deployment we recommend using Jamf, or Intune. + +>[!IMPORTANT] +>Make sure you have enabled [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md#how-to-install-microsoft-defender-atp-for-mac), and pay attention to the “earlyPreview” flag. See documentation for [Jamf](mac-install-with-jamf.md), [Intune](mac-install-with-intune.md) and [manual deployment](mac-install-manually.md) instructions. + +## Enable the Insider program with Jamf + +a. Create configuration profile com.microsoft.wdav.plist with the following content: + +```XML + + + + + edr + + earlyPreview + + + + +``` + +b. From the JAMF console, navigate to **Computers > Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. + +c. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist created earlier. + +>[!WARNING] +>You must enter the correct preference domain (com.microsoft.wdav), otherwise the preferences will not be recognized by the product + +## Enable the Insider program with Intune + +a. Create configuration profile com.microsoft.wdav.plist with the following content: + + ```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + edr + + earlyPreview + + + + + + +``` + +b. Open **Manage > Device configuration**. Select **Manage > Profiles > Create Profile**. + +c. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. + +d. Save the .plist created earlier as com.microsoft.wdav.xml. + +e. Enter com.microsoft.wdav as the custom configuration profile name. + +f. Open the configuration profile and upload com.microsoft.wdav.xml. This file was created in step 1. + +g. Select **OK**. + +h. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +>[!WARNING] +>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. + +## Enable the Insider program manually on a single machine + +In the command prompt, run: + +```bash + mdatp --edr --early-preview true + ``` + +## Troubleshooting + +### Verify you are running the correct version + +To verify you are running the correct version, run ‘mdatp --health’ on the machine. + +* The required version is 100.72.15 or later. +* If the version is not as expected, verify that Microsoft Auto Update is set to automatically download and install updates by running ‘defaults read com.microsoft.autoupdate2’ from terminal. +* To change update settings use documentation in Update Office for Mac automatically. +* If you are not using Office for Mac, download and run the AutoUpdate tool. + +### A machine still does not appear on Microsoft Defender Security Center + +After a successful deployment and onboarding of the correct version, check that the machine has connectivity to the cloud service by running ‘mdatp --connectivity-test’. + +* Check that you enabled the early preview flag. In terminal run “mdatp –health” and look for the value of “edrEarlyPreviewEnabled”. It should be “Enabled”. + +If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the manual deployment documentation and use the “Manual Deployment” section in the troubleshoot kernel extension documentation. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png new file mode 100644 index 0000000000..27b00fdd87 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png new file mode 100644 index 0000000000..d0eb92e377 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png new file mode 100644 index 0000000000..3f8ead879c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png new file mode 100644 index 0000000000..9acba5c77f Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png new file mode 100644 index 0000000000..31d16836b0 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png new file mode 100644 index 0000000000..6cafba6c3d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png new file mode 100644 index 0000000000..e01d9f53a5 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png new file mode 100644 index 0000000000..072835588a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png new file mode 100644 index 0000000000..dbd99451af Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png new file mode 100644 index 0000000000..98d59f5c07 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index c46302a04f..38b96e9451 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -53,6 +53,9 @@ When you have configured exploit protection to your desired state (including bot 3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved. +> [!IMPORTANT] +> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file. + ![Highlight of the Export Settings option](../images/wdsc-exp-prot-export.png) > [!NOTE] diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md new file mode 100644 index 0000000000..2dda7ca218 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md @@ -0,0 +1,81 @@ +--- +title: Configure and validate exclusions for Microsoft Defender ATP for Mac +description: Provide and validate exclusions for Microsoft Defender ATP for Mac. Exclusions can be set for files, folders, and processes. +keywords: microsoft, defender, atp, mac, exclusions, scans, antivirus +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Configure and validate exclusions for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This article provides information on how to define exclusions that apply to on-demand scans, and real-time protection and monitoring. + +>[!IMPORTANT] +>The exclusions described in this article don't apply to other Microsoft Defender ATP for Mac capabilities, including endpoint detection and response (EDR). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. + +You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender ATP for Mac scans. + +Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. They can also be useful for mitigating performance issues caused by Microsoft Defender ATP for Mac. + +>[!WARNING] +>Defining exclusions lowers the protection offered by Microsoft Defender ATP for Mac. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. + +## Supported exclusion types + +The follow table shows the exclusion types supported by Microsoft Defender ATP for Mac. + +Exclusion | Definition | Examples +---|---|--- +File extension | All files with the extension, anywhere on the machine | .test +File | A specific file identified by the full path | /var/log/test.log +Folder | All files under the specified folder | /var/log/ +Process | A specific process (specified either by the full path or file name) and all files opened by it | /bin/cat
    cat + +## How to configure the list of exclusions + +### From the management console + +For more information on how to configure exclusions from JAMF, Intune, or another management console, see [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). + +### From the user interface + +Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot: + +![[Manage exclusions screenshot](../windows-defender-antivirus/images/mdatp-37-exclusions.png) + +Select the type of exclusion that you wish to add and follow the prompts. + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using `curl` to download a test file. + +In the following Bash snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the *.testing extension*, replace *test.txt* with *test.testing*. If you are testing a path, ensure that you run the command within that path. + +```bash +$ curl -o test.txt http://www.eicar.org/download/eicar.com.txt +``` + +If Microsoft Defender ATP for Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html). + +If you do not have internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command: + +```bash +echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt +``` + +You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md similarity index 55% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md index 1800859a23..117296a474 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md @@ -1,7 +1,6 @@ --- -title: Installing Microsoft Defender ATP for Mac manually -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. +title: Manual deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac manually, from the command line. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Manual deployment +# Manual deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -42,7 +41,7 @@ Download the installation and onboarding packages from Windows Defender Security 3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. 4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/ATP-Portal-Onboarding-page.png) 5. From a command prompt, verify that you have the two files. Extract the contents of the .zip files: @@ -63,83 +62,28 @@ To complete this process, you must have admin privileges on the machine. 1. Navigate to the downloaded wdav.pkg in Finder and open it. - ![App install screenshot](images/MDATP_28_AppInstall.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-28-AppInstall.png) 2. Select **Continue**, agree with the License terms, and enter the password when prompted. - ![App install screenshot](images/MDATP_29_AppInstallLogin.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-29-AppInstallLogin.png) > [!IMPORTANT] > You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. - ![App install screenshot](images/MDATP_30_SystemExtension.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-30-SystemExtension.png) 3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: - ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) + ![Security and privacy window screenshot](../windows-defender-antivirus/images/MDATP-31-SecurityPrivacySettings.png) The installation proceeds. -> [!NOTE] -> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. +> [!CAUTION] +> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but some features, such as real-time protection, will be disabled. See [Troubleshoot kernel extension issues](mac-support-kext.md) for information on how to resolve this. > [!NOTE] -> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. - -### Fixing disabled Real-Time Protection - -If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: - - ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) - -You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : false -realTimeProtectionEnabled : true -... -``` - -> [!NOTE] -> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. - -The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". - -If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: - -![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) - -In this case, you need to perform the following steps to enable Real-Time Protection instead. - -1. In Terminal, attempt to install the driver. (The operation will fail) - ```bash - $ sudo kextutil /Library/Extensions/wdavkext.kext - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Diagnostics for /Library/Extensions/wdavkext.kext: - ``` - -2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) - -3. **Allow** system software from developers "Microsoft Corporation" - -4. In Terminal, install the driver again. This time the operation will succeed: - -```bash -$ sudo kextutil /Library/Extensions/wdavkext.kext -``` - -The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : true -realTimeProtectionEnabled : true -... -``` +> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-time protection will not be available until the machine is rebooted. ## Client configuration @@ -167,7 +111,7 @@ realTimeProtectionEnabled : true After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + ![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) ## How to Allow Full Disk Access @@ -178,8 +122,8 @@ To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Fu ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md similarity index 86% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index c72aafc900..6a79d9fca6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -1,7 +1,6 @@ --- -title: Installing Microsoft Defender ATP for Mac with Microsoft Intune -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. +title: Intune-based deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac, using Microsoft Intune. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Intune-based deployment +# Intune-based deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -44,7 +43,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi 4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. 5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) 6. From a command prompt, verify that you have the three files. Extract the contents of the .zip files: @@ -91,11 +90,11 @@ You need no special provisioning for a Mac device beyond a standard [Company Por 1. You are asked to confirm device management. -![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) +![Confirm device management screenshot](../windows-defender-antivirus/images/MDATP-3-ConfirmDeviceMgmt.png) Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: -![Management profile screenshot](images/MDATP_4_ManagementProfile.png) +![Management profile screenshot](../windows-defender-antivirus/images/MDATP-4-ManagementProfile.png) 2. Select **Continue** and complete the enrollment. @@ -103,7 +102,7 @@ You may now enroll more devices. You can also enroll them later, after you have 3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: -![Add Devices screenshot](images/MDATP_5_allDevices.png) +![Add Devices screenshot](../windows-defender-antivirus/images/MDATP-5-allDevices.png) ## Create System Configuration profiles @@ -112,7 +111,7 @@ You may now enroll more devices. You can also enroll them later, after you have 3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. 4. Select **OK**. - ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) + ![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-6-SystemConfigurationProfiles.png) 5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. 6. Repeat steps 1 through 5 for more profiles. @@ -287,7 +286,7 @@ You may now enroll more devices. You can also enroll them later, after you have Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: -![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) +![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-7-DeviceStatusBlade.png) ## Publish application @@ -298,40 +297,40 @@ Once the Intune changes are propagated to the enrolled devices, you can see them 5. Use **macOS High Sierra 10.13** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. > [!CAUTION] - > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. + > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. - ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) + ![Device status blade screenshot](../windows-defender-antivirus/images/MDATP-8-IntuneAppInfo.png) 6. Select **OK** and **Add**. - ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) + ![Device status blade screenshot](../windows-defender-antivirus/images/MDATP-9-IntunePkgInfo.png) 7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. - ![Client apps screenshot](images/MDATP_10_ClientApps.png) + ![Client apps screenshot](../windows-defender-antivirus/images/MDATP-10-ClientApps.png) 8. Change **Assignment type** to **Required**. 9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. - ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) + ![Intune assignments info screenshot](../windows-defender-antivirus/images/MDATP-11-Assignments.png) 10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: - ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) + ![Intune device status screenshot](../windows-defender-antivirus/images/MDATP-12-DeviceInstall.png) ## Verify client device state 1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. - ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) - ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) + ![System Preferences screenshot](../windows-defender-antivirus/images/MDATP-13-SystemPreferences.png)
    + ![System Preferences Profiles screenshot](../windows-defender-antivirus/images/MDATP-14-SystemPreferencesProfiles.png) 2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: - ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) + ![Profiles screenshot](../windows-defender-antivirus/images/MDATP-15-ManagementProfileConfig.png) 3. You should also see the Microsoft Defender icon in the top-right corner: - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + ![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) ## Troubleshooting @@ -341,8 +340,8 @@ Solution: Follow the steps above to create a device profile using WindowsDefende ## Logging installation issues -For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . +For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](mac-resources.md#logging-installation-issues) . ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md similarity index 85% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 59a2dce0fd..259e8692cd 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -1,7 +1,6 @@ --- -title: Installing Microsoft Defender ATP for Mac with JAMF -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. +title: JAMF-based deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac, using JAMF. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# JAMF-based deployment +# JAMF-based deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -46,7 +45,7 @@ Download the installation and onboarding packages from Windows Defender Security 3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. 4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: @@ -79,7 +78,7 @@ To set the onboarding information, add a property list file with the name, _jamf >[!IMPORTANT] > You must set the Preference Domain as "com.microsoft.wdav.atp" -![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) +![Configuration profile screenshot](../windows-defender-antivirus/images/MDATP-16-PreferenceDomain.png) ### Approved Kernel Extension @@ -88,7 +87,7 @@ To approve the kernel extension: 1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. 2. Use **UBF8T346G9** for Team Id. -![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) +![Approved kernel extensions screenshot](../windows-defender-antivirus/images/MDATP-17-approvedKernelExtensions.png) ### Privacy Preferences Policy Control @@ -104,7 +103,7 @@ Add the following JAMF policy to grant Full Disk Access to Microsoft Defender AT 3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. 4. Set app or service to SystemPolicyAllFiles and access to Allow. -![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) +![Privacy Preferences Policy Control](../windows-defender-antivirus/images/MDATP-35-JAMF-PrivacyPreferences.png) #### Configuration Profile's Scope @@ -112,7 +111,7 @@ Configure the appropriate scope to specify the devices that will receive the con Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. -![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) +![Configuration profile scope screenshot](../windows-defender-antivirus/images/MDATP-18-ConfigurationProfilesScope.png) Save the **Configuration Profile**. @@ -132,7 +131,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific 1. Create a package in **Settings > Computer Management > Packages**. - ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) + ![Computer management packages screenshot](../windows-defender-antivirus/images/MDATP-19-MicrosoftDefenderWDAVPKG.png) 2. Upload the package to the Distribution Point. 3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. @@ -141,7 +140,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific Your policy should contain a single package for Microsoft Defender. -![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) +![Microsoft Defender packages screenshot](../windows-defender-antivirus/images/MDATP-20-MicrosoftDefenderPackages.png) Configure the appropriate scope to specify the computers that will receive this policy. @@ -156,12 +155,12 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA 1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. -![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) -![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) +![MDM approve button screenshot](../windows-defender-antivirus/images/MDATP-21-MDMProfile1.png)
    +![MDM screenshot](../windows-defender-antivirus/images/MDATP-22-MDMProfileApproved.png) After a moment, the device's User Approved MDM status will change to **Yes**. -![MDM status screenshot](images/MDATP_23_MDMStatus.png) +![MDM status screenshot](../windows-defender-antivirus/images/MDATP-23-MDMStatus.png) You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. @@ -176,17 +175,17 @@ You can monitor deployment status in the **Logs** tab: - **Pending** means that the deployment is scheduled but has not yet happened - **Completed** means that the deployment succeeded and is no longer scheduled -![Status on server screenshot](images/MDATP_24_StatusOnServer.png) +![Status on server screenshot](../windows-defender-antivirus/images/MDATP-24-StatusOnServer.png) ### Status on client device After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. -![Status on client screenshot](images/MDATP_25_StatusOnClient.png) +![Status on client screenshot](../windows-defender-antivirus/images/MDATP-25-StatusOnClient.png) Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. -![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) You can monitor policy installation on a device by following the JAMF log file: @@ -231,11 +230,11 @@ If the product is not healthy, the exit code (which can be checked through `echo ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). +This method is based on the script described in [Uninstalling](mac-resources.md#uninstalling). ### Script @@ -258,12 +257,12 @@ This script removes Microsoft Defender ATP from the /Applications directory: echo "Done!" ``` -![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) +![Microsoft Defender uninstall screenshot](../windows-defender-antivirus/images/MDATP-26-Uninstall.png) ### Policy Your policy should contain a single script: -![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) +![Microsoft Defender uninstall script screenshot](../windows-defender-antivirus/images/MDATP-27-UninstallScript.png) Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md similarity index 78% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md index b7a001aa8c..d67b31e398 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md @@ -1,6 +1,6 @@ --- -title: Installing Microsoft Defender ATP for Mac with different MDM product -description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. +title: Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac on other management solutions. keywords: microsoft, defender, atp, mac, installation, deploy, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Deployment with a different Mobile Device Management (MDM) system +# Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac **Applies to:** @@ -49,21 +49,21 @@ You can deploy Defender without the last requirement from the preceding list, ho ## Deployment -Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. +Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](mac-install-with-jamf.md) as a template. ### Package -Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), -with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Configure deployment of a [required application package](mac-install-with-jamf.md#package), +with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages). In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. ### License settings -Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). +Set up [a system configuration profile](mac-install-with-jamf.md#configuration-profile). Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. -Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages). Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. Alternatively, it may require you to convert the property list to a different format first. @@ -76,4 +76,4 @@ Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to ## Check installation status -Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. +Run [mdatp](mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md similarity index 96% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md index b1e1ba3bff..0d0904ba75 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md @@ -1,7 +1,6 @@ --- title: Set preferences for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. +description: Configure Microsoft Defender ATP for Mac in enterprises. keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -25,7 +24,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](mac-resources.md#configuring-from-the-command-line) page. In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. @@ -262,6 +261,28 @@ Whether the status menu icon (shown in the top-right corner of the screen) is hi | **Data type** | Boolean | | **Possible values** | false (default)
    true | +### EDR preferences + +The *edr* section of the configuration profile is used to manage the preferences of the EDR component of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | edr | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable early preview + +Whether EDR early preview features are enabled or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | earlyPreview | +| **Data type** | Boolean | +| **Possible values** | true (default)
    false | + ## Recommended configuration profile To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md similarity index 98% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md index 0c56970e6f..ab118ea2ca 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md @@ -1,7 +1,6 @@ --- title: Privacy for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. +description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, privacy, diagnostic search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -62,7 +61,7 @@ When this feature is enabled and the sample that is collected is likely to conta If you're an IT administrator, you might want to configure these controls at the enterprise level. -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md similarity index 82% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-pua.md index 2696590c99..0f63486ad1 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md @@ -1,7 +1,6 @@ --- -title: Detect and block potentially unwanted applications -ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. +title: Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac +description: Detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, pua, pus search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Detect and block potentially unwanted applications +# Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac **Applies to:** @@ -59,8 +58,8 @@ $ mdatp --threat --type-handling potentially_unwanted_application [off|audit|blo ### Use the management console to configure PUA protection: -In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. +In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md) topic. ## Related topics -- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file +- [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md similarity index 86% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-resources.md index c187a7c270..d8e6a4dfff 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md @@ -1,7 +1,6 @@ --- -title: Microsoft Defender ATP for Mac Resources -ms.reviewer: -description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +title: Resources for Microsoft Defender ATP for Mac +description: Resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Resources +# Resources for Microsoft Defender ATP for Mac **Applies to:** @@ -95,18 +94,24 @@ Important tasks, such as controlling product settings and triggering on-demand s |Protection |Do a full scan |`mdatp --scan --full` | |Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | |Protection |Request a security intelligence update |`mdatp --definition-update` | +|EDR |Turn on/off EDR preview for Mac |`mdatp --early-preview [true/false]` | +|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --set-tag GROUP [name]` | +|EDR |Remove group tag from machine |`mdatp --remove-tag [name]` | ## Microsoft Defender ATP portal information -In the Microsoft Defender ATP portal, you'll see two categories of information: +In the Microsoft Defender ATP portal, you'll see two categories of information. + +Antivirus alerts, including: -- Antivirus alerts, including: - Severity - Scan type - Device information (hostname, machine identifier, tenant identifier, app version, and OS type) - File information (name, path, size, and hash) - Threat information (name, type, and state) -- Device information, including: + +Device information, including: + - Machine identifier - Tenant identifier - App version diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md new file mode 100644 index 0000000000..bbf4825f45 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md @@ -0,0 +1,90 @@ +--- +title: Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac +description: Troubleshoot kernel extension-related issues in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, kernel, extension +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic provides information on how to troubleshoot issues with the kernel extension that is installed as part of Microsoft Defender ATP for Mac. + +Starting with macOS High Sierra (10.13), macOS requires all kernel extensions to be explicitly approved before they are allowed to run on the device. + +If you did not approve the kernel extension during the deployment / installation of Microsoft Defender ATP for Mac, then the application displays a banner prompting you to enable it: + + ![RTP disabled screenshot](../windows-defender-antivirus/images/MDATP-32-Main-App-Fix.png) + +You can also run ```mdatp --health```. It reports if real-time protection is enabled but not available. This is an indication that the kernel extension is not approved to run on your device. + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : false +realTimeProtectionEnabled : true +... +``` + +The following sections provide guidance on how to address this issue, depending on the method that you used to deploy Microsoft Defender ATP for Mac. + +## Managed deployment + +See the instructions corresponding to the management tool that you used to deploy the product: + +- [JAMF-based deployment](mac-install-with-jamf.md#configuration-profile) +- [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) + +## Manual deployment + +If less than 30 minutes have passed since the product was installed, navigate to **System Preferences** > **Security & Privacy**, where you have to **Allow** system software from developers "Microsoft Corporation". + +If you don't see this prompt, it means that 30 or more minutes have passed, and the kernel extension still not been approved to run on your device: + +![Security and privacy window after prompt expired screenshot](../windows-defender-antivirus/images/MDATP-33-SecurityPrivacySettings-NoPrompt.png) + +In this case, you need to perform the following steps to trigger the approval flow again. + +1. In Terminal, attempt to install the driver. The following operation will fail, because the kernel extension was not approved to run on the device, however it will trigger the approval flow again. + + ```bash + $ sudo kextutil /Library/Extensions/wdavkext.kext + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Diagnostics for /Library/Extensions/wdavkext.kext: + ``` + +2. Open **System Preferences** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + +3. **Allow** system software from developers "Microsoft Corporation" + +4. In Terminal, install the driver again. This time the operation will succeed: + +```bash +$ sudo kextutil /Library/Extensions/wdavkext.kext +``` + +The banner should disappear from the Defender application, and ```mdatp --health``` should now report that real-time protection is both enabled and available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : true +realTimeProtectionEnabled : true +... +``` \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md new file mode 100644 index 0000000000..3d1a203e82 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md @@ -0,0 +1,54 @@ +--- +title: Troubleshoot performance issues for Microsoft Defender ATP for Mac +description: Troubleshoot performance issues in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, performance +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Troubleshoot performance issues for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic provides some general steps that can be used to narrow down performance issues related to Microsoft Defender ATP for Mac. + +Real-time protection (RTP) is a feature of Microsoft Defender ATP for Mac that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics. + +Depending on the applications that you are running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender ATP for Mac. In particular, applications or system processes that access many resources over a short timespan can lead to performance issues in Microsoft Defender ATP for Mac. + +The following steps can be used to troubleshoot and mitigate these issues: + +1. Disable real-time protection using one of the following methods and observe whether the performance improves. This approach helps narrow down whether Microsoft Defender ATP for Mac is contributing to the performance issues. + + If your device is not managed by your organization, real-time protection can be disabled using one of the following options: + + - From the user interface. Open Microsoft Defender ATP for Mac and navigate to **Manage settings**. + + ![Manage real-time protection screenshot](../windows-defender-antivirus/images/mdatp-36-rtp.png) + + - From the Terminal. For security purposes, this operation requires elevation. + + ```bash + $ mdatp --config realTimeProtectionEnabled false + ``` + + If your device is managed by your organization, real-time protection can be disabled by your administrator using the instructions in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). + +2. Open Finder and navigate to **Applications** > **Utilities**. Open **Activity Monitor** and analyze which applications are using the resources on your system. Typical examples include software updaters and compilers. + +3. Configure Microsoft Defender ATP for Mac with exclusions for the processes or disk locations that contribute to the performance issues and re-enable real-time protection. + + See [Configure and validate exclusions for Microsoft Defender ATP for Mac](mac-exclusions.md) for details. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md similarity index 97% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-updates.md index 50267f26bb..7770111d6d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md @@ -1,7 +1,6 @@ --- title: Deploy updates for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. +description: Control updates for Microsoft Defender ATP for Mac in enterprise environments. keywords: microsoft, defender, atp, mac, updates, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,7 +27,7 @@ Microsoft regularly publishes software updates to improve performance, security, To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. -![MAU screenshot](images/MDATP_34_MAU.png) +![MAU screenshot](../windows-defender-antivirus/images/MDATP-34-MAU.png) If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md similarity index 76% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 16a195c6dd..e229fbbd91 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -1,6 +1,5 @@ --- -title: Microsoft Defender ATP for Mac What's New -ms.reviewer: +title: What's new in Microsoft Defender Advanced Threat Protection for Mac description: List of major changes for Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, installation, macos, whatsnew search.product: eADQiWindows 10XVcnh @@ -30,7 +29,7 @@ ms.topic: conceptual ## 100.68.99 -- Added the ability to configure the antivirus functionality to run in [passive mode](microsoft-defender-atp-mac-preferences.md#enable--disable-passive-mode) +- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enable--disable-passive-mode) - Performance improvements & bug fixes ## 100.65.28 @@ -42,7 +41,7 @@ ms.topic: conceptual > > The mechanism for granting this consent depends on how you deployed Microsoft Defender ATP: > -> - For manual deployments, see the updated instructions in the [Manual deployment](microsoft-defender-atp-mac-install-manually.md#how-to-allow-full-disk-access) topic. -> - For managed deployments, see the updated instructions in the [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md#create-system-configuration-profiles) topics. +> - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic. +> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics. - Performance improvements & bug fixes diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md similarity index 72% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md index 75301d31b1..f073ddf397 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md @@ -1,6 +1,6 @@ --- title: Microsoft Defender ATP for Mac -ms.reviewer: +ms.reviewer: description: Describes how to install and use Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh @@ -14,7 +14,7 @@ author: dansimp ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual --- @@ -27,38 +27,53 @@ This topic describes how to install, configure, update, and use Microsoft Defend ## What’s new in the latest release -[What's new](microsoft-defender-atp-mac-whatsnew.md) +[What's new](mac-whatsnew.md) If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. +To learn how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine, go to [Enable Microsoft Defender ATP Insider Machine](endpoint-detection-response-mac-preview.md) + ## How to install Microsoft Defender ATP for Mac ### Prerequisites -- Access to the Microsoft Defender Security Center portal +- A Microsoft Defender ATP subscription and access to the Microsoft Defender Security Center portal - Beginner-level experience in macOS and BASH scripting - Administrative privileges on the device (in case of manual deployment) +### Installation instructions + +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. + +* Third-party management tools: + * [Microsoft Intune-based deployment](mac-install-with-intune.md) + * [JAMF-based deployment](mac-install-with-jamf.md) + * [Other MDM products](mac-install-with-other-mdm.md) + +* Command-line tool: + * [Manual deployment](mac-install-manually.md) + ### System requirements -> [!CAUTION] -> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. -> -> macOS Sierra (10.12) support will end on January 1, 2020. +The three most recent major releases of macOS are supported. -- Supported macOS versions: 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra) +- 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra) - Disk space: 650 MB +Beta versions of macOS are not supported. macOS Sierra (10.12) support will end on January 1, 2020. + After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. +### Network connections + The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | -| Common URLs for all locations | x.cp.wd.microsoft.com
    cdn.x.cp.wd.microsoft.com
    eu-cdn.x.cp.wd.microsoft.com
    wu-cdn.x.cp.wd.microsoft.com
    *.blob.core.windows.net
    officecdn-microsoft-com.akamaized.net | -| European Union | europe.x.cp.wd.microsoft.com | -| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | -| United States | unitedstates.x.cp.wd.microsoft.com | +| Common URLs for all locations | x.cp.wd.microsoft.com
    cdn.x.cp.wd.microsoft.com
    eu-cdn.x.cp.wd.microsoft.com
    wu-cdn.x.cp.wd.microsoft.com
    *.blob.core.windows.net
    officecdn-microsoft-com.akamaized.net
    crl.microsoft.com
    events.data.microsoft.com | +| European Union | europe.x.cp.wd.microsoft.com
    eu-v20.events.data.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
    uk-v20.events.data.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com
    us-v20.events.data.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) @@ -83,33 +98,23 @@ The output from this command should be similar to the following: > [!CAUTION] > We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. -### Installation instructions - -There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. - -In general you need to take the following steps: - -- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal -- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: - - Via third-party management tools: - - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) - - Via the command-line tool: - - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) +Once Microsoft Defender ATP is installed, connectivity can be validated by running the following command in Terminal: +```bash +$ mdatp --connectivity-test +``` ## How to update Microsoft Defender ATP for Mac Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. -To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) +To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) ## How to configure Microsoft Defender ATP for Mac -Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). ## Resources -- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. +- For more information about logging, uninstalling, or other topics, see the [Resources](mac-resources.md) page. -- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) +- [Privacy for Microsoft Defender ATP for Mac](mac-privacy.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index 3a670e00a5..eecae45f38 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -62,7 +62,7 @@ Microsoft Defender ATP’s Threat & Vulnerability Management allows security adm - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 2e352baa0e..90e4e88018 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,11 +42,11 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac)
    Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. - - [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
    You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). - [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table)
    You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. + + - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
    You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. - [Threat & Vulnerability Management granular exploit details](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
    You can now see a comprehensive set of details on the vulnerabilities found in your machine to give you informed decision on your next steps. The threat insights icon now shows more granular details, such as if the exploit is a part of an exploit kit, connected to specific advanced persistent campaigns or activity groups for which, Threat Analytics report links are provided that you can read, has associated zero-day exploitation news, disclosures, or related security advisories. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index d52680c6a8..df00947476 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -143,12 +143,17 @@ When an exception is created for a recommendation, the recommendation is no long 2. Click the top-most recommendation. A flyout panel opens with the recommendation details. 3. Click **Exception options**. +![Screenshot of the exception option in the remediation flyout pane](images/tvm-exception-option.png) 4. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. +> ![Screenshot of exception flyout page which details justification and context](images/tvm-exception-flyout.png) + 5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created. +![Screenshot of exception confirmation message](images/tvm-exception-confirmation.png) 6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). +![Screenshot of exception list of exceptions in the Remediation page](images/tvm-exception-list.png) ## Use Advanced hunting query to search for machines with High active alerts or critical CVE public exploit @@ -179,7 +184,7 @@ ComputerName=any(ComputerName) by MachineId, AlertId - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Advanced hunting overview](overview-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 1704845ac8..668b2a1cb4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -53,7 +53,7 @@ Area | Description (2) Threat & Vulnerability Management navigation pane | Use the navigation pane to move across the **Threat and Vulnerability Management Dashboard**, **Security recommendations**, **Remediation**, **Software inventory**, and **Weaknesses**. **Dashboards** | Get a high-level view of the organization exposure score, organization configuration score, machine exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed machines data. **Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list, a flyout panel opens with vulnerability details, open the software page, see the remediation, and exception options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. -**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. +**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation and exception](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. **Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information. **Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a flyout panel with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information. (3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**. @@ -73,7 +73,7 @@ See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/t - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index 8eebb66298..fca24b4b1f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -42,7 +42,7 @@ Reduce the exposure score by addressing what needs to be remediated based on the - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 674d4b0309..99b1ae6759 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -1,6 +1,6 @@ --- -title: Remediation -description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). +title: Remediation and exception +description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations or filing exceptions provided there are compensation controls. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/11/2019 --- -# Remediation +# Remediation and exception **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -47,11 +47,62 @@ When you submit a remediation request from Threat & Vulnerability Management, it It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune. -You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted. The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. -However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. +## When to file for exception instead of remediating issues +You can file exceptions to exclude certain recommendation from showing up in reports and affecting risk scores or secure scores. + +When you select a security recommendation, it opens up a flyout screen with details and options for your next step. You can either **Open software page**, choose from **Remediation options**, go through **Exception options** to file for exceptions, or **Report inaccuracy**. + +Select **Exception options** and a flyout screen opens. + +![Screenshot of exception flyout screen](images/tvm-exception-flyout.png) + +### Exception justification +If the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The following list details the justifications behind the exception options: + +- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a machine, third party antivirus +- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow +- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive +- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization +- **Other** - False positive + + + ![Screenshot of exception reason dropdown menu](images/tvm-exception-dropdown.png) + +### Exception visibility +The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. +However, you also have the option to filter your view based on exception justification, type, and status. + +![Screenshot of exception tab and filters](images/tvm-exception-filters.png) + +Aside from that, there's also an option to **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard. + +![Screenshot of Show exceptions link in the Top security recommendations card in the dashboard](images/tvm-exception-dashboard.png) + +Clicking the link opens up to the **Security recommendations** page, where you can select the item exempted item with details. + +![Screenshot of exception details in the Security recommendation page](images/tvm-exception-details.png) + +### Actions on exceptions +- Cancel - You can cancel the exceptions you've filed any time +- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change, which adversely affect the exposure impact associated with a recommendation that had previously been excluded + +### Exception status +- **Canceled** - The exception has been canceled and is no longer in effect +- **Expired** - The exception that you've filed is no longer in effect +- **In effect** - The exception that you've filed is in progress + +### Exception impact on scores +Creating an exception can potentially affect the Exposure Score (for both types of weaknesses) and Secure Score (for configurations) of your organization in the following manner: +- **No impact** - Removes the recommendation from the lists (which can be reverse through filters), but will not affect the scores +- **Mitigation-like impact** - As if the recommendation was mitigated (and scores will be adjusted accordingly) when you select it as a compensating control. +- **Hybrid** - Provides visibility on both No impact and Mitigation-like impact. It shows both the Exposure Score and Secure Score results out of the exception option that you made + +The exception impact shows on both the Security recommendations page column and in the flyout pane. + +![Screenshot of where to find the exception impact](images/tvm-exception-impact.png) ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 02878e9531..ee75d061da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -84,7 +84,7 @@ You can report a false positive when you see any vague, inaccurate, incomplete, - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index a7ff6812ce..e1d39cdf5d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -63,6 +63,6 @@ You can report a false positive when you see any vague, inaccurate version, inco - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index c10b32a219..7eefec6595 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/11/2019 +ms.date: 10/31/2019 --- # Weaknesses **Applies to:** @@ -126,6 +126,6 @@ You can report a false positive when you see any vague, inaccurate, missing, or - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index 8d498f43b4..e3afd90910 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -19,12 +19,12 @@ ms.topic: article # Create and manage roles for role-based access control **Applies to:** - - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-roles-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + ## Create roles and assign the role to an Azure Active Directory group The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups. @@ -37,25 +37,31 @@ The following steps guide you on how to create roles in Microsoft Defender Secur - **Role name** - **Description** - **Permissions** - - **View data** - Users can view information in the portal. - - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. - - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. - - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. + - **View data** - Users can view information in the portal. + >[!NOTE] + >To view Threat & Vulnerability Management data, select **Threat and vulnerability management**. + + - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. + - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. + >[!NOTE] + >To enable your Security operation personnel to choose remediation options and file exceptions, select **Threat and vulnerability management - Remediation handling**, and **Threat and vulnerability management - Exception handling**. + + - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. > [!NOTE] > This setting is only available in the Microsoft Defender ATP administrator (default) role. - - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. + - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. - - **Live response capabilities** - Users can take basic or advanced live response commands. - - Basic commands allow users to: - - Start a live response session - - Run read only live response commands on a remote machine - - Advanced commands allow users to: - - Run basic actions - - Download a file from the remote machine - - View a script from the files library - - Run a script on the remote machine from the files library take read and write commands. + - **Live response capabilities** - Users can take basic or advanced live response commands. + - Basic commands allow users to: + - Start a live response session + - Run read only live response commands on a remote machine + - Advanced commands allow users to: + - Run basic actions + - Download a file from the remote machine + - View a script from the files library + - Run a script on the remote machine from the files library take read and write commands. For more information on the available commands, see [Investigate machines using Live response](live-response.md). diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index e73bbfe476..d600158473 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -46,7 +46,7 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. -As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). +As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication. | **Service**| **Description** |**URL** | diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png b/windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png rename to windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png new file mode 100644 index 0000000000..dab113680f Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png new file mode 100644 index 0000000000..d33e01e247 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 268a9cf97b..d1fde8548c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -23,7 +23,7 @@ ms.date: 10/30/2019 - Windows 10 -Beginning in Windows 10 (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode (S mode) devices. +Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from “every app is Microsoft-verified" to “every app is verified by Microsoft or your organization”. diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 321aa58e14..40e42e3eb4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -13,7 +13,6 @@ ### [Types of devices](types-of-devices.md) ### Use WDAC with custom policies #### [Create an initial default policy](create-initial-default-policy.md) -#### [Create path-based rules](create-path-based-rules.md) #### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) ### [Audit WDAC policies](audit-windows-defender-application-control-policies.md) ### [Merge WDAC policies](merge-windows-defender-application-control-policies.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md deleted file mode 100644 index 4ac0c9fa6e..0000000000 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Windows Defender Application Control path-based rules (Windows 10) -description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. -keywords: whitelisting, security, malware -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -audience: ITPro -ms.collection: M365-security-compliance -author: jsuther1974 -ms.reviewer: isbrahm -ms.author: dansimp -manager: dansimp -ms.date: 05/17/2019 ---- - -# Create Windows Defender Application Control path-based rules - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. - -- New-CIPolicy parameters - - FilePath: create path rules under path \ for anything not user-writeable (at the individual file level) - - ```powershell - New-CIPolicy -f .\mypolicy.xml -l FilePath -s -u - ``` - - Optionally, add -UserWriteablePaths to ignore user writeability - - - FilePathRule: create a rule where filepath string is directly set to value of \ - - ```powershell - New-CIPolicyRule -FilePathRule - ``` - - Useful for wildcards like C:\foo\\* - -- Usage follows the same flow as per-app rules: - - ```powershell - $rules = New-CIPolicyRule … - $rules += New-CIPolicyRule … - … - New-CIPolicyRule -f .\mypolicy.xml -u - ``` - -- Wildcards supported - - Suffix (ex. C:\foo\\*) OR Prefix (ex. *\foo\bar.exe) - - One or the other, not both at the same time - - Does not support wildcard in the middle (ex. C:\\*\foo.exe) -- Supported Macros: - - %WINDIR%\\... - - %SYSTEM32%\\... - - %OSDRIVE%\\... - -- Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy: - - ```powershell - Set-RuleOption -o 18 .\policy.xml - ``` - diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 904c5d1ad8..d70793409e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -67,10 +67,9 @@ Add-SignerRule -FilePath -CertificatePath [-Kernel] [-User] [- ### Supplemental Policy Creation -In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. -- "SupplementsBasePolicyID": -of new supplemental policy -- "BasePolicyToSupplementPath": base policy that the supplemental policy applies to +In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. +- "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to +- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to ```powershell Set-CIPolicyIdInfo [-FilePath] [-PolicyName ] [-SupplementsBasePolicyID ] [-BasePolicyToSupplementPath ] [-ResetPolicyID] [-PolicyId ] []