Using Crypto APIs in Kernel Mode(urgent pls help)

NTFSD
2

I need to be able to turn water into gold and US Dollars. We both have a
snowball’s chance in a very warm place to get what we asked for. This has
been answered many times before - try searching before asking.

“gaurav krishna” wrote in message
news:xxxxx@ntfsd…
Hi ,

I need to use the Windows Crypto APIs in Kernel Mode.

How can I go about it?

Thanks in anticipation.

regards,
Gaurav

3

I don’t wish to belittle this situation, but looking in the archives can do a lot to help answer your questions before asking. I asked this very question last month and had some good advice. You can search for “Implementing digital hashing in the Kernel” for some of the threads. Actually, now that I think of it, I answered part of your question in that thread when you asked then.

Anyways, let me take some of the experience I gained discussing this with other kernelmode developers over the last month and provide it to you.

The kernel itself is not exposed to the Crypto APIs. Although the headers in the DDK expose the Crypto API (wincrypt.h), Don Burn pointed out that the SDK libs are unsafe to use in the kernel, like most other usermode API. Maxim Shatskih suggested that there are some descriptions on interfaces in Fips.sys, which is kernelmode CryptoAPI. However, I could not find anything useful to tap into it myself.

If you HAVE to use the CryptoAPI, you should push it up to usermode through a service, using IOCTL to communicate between ring 0 and ring 3. While there you have full use of the CryptoAPI. You can learn how to write code to communicate in this manner by checking out the great IFS FAQ hosted on OSR Online at: http://www.osronline.com/article.cfm?article=17#Q37

Now, depending on what you need from the Crypto API, you may not wish to do this. If you are looking to specifically implement a particular function (in my case I simply wanted access to SHA1 for hashing purposes), you may decide to write it yourself, or ‘borrow’ an open source implementation.

A few ‘alarm bells’ come off on this for me. (I include this commentary for those who have commented to me already on this, and I haven’t responded). Here are some of my concerns, and something you should consider:

  1. GPL is not a panacea. There have been recommendations to utilize the code at http://www.cr0.net:8040/code/crypto/. Its great code. Its clean. And it has a license that exposes you to risk if you do not wish to expose your own code as part of the licensing agreement. You can of course get around this (re-engineer the crypto code to be in its own DLL, allowing you to share that code, without exposing your own driver to GPL restrictions). If you are going to roll out their code in yours, have your lawyers look at the GPL. What is the GPLs greatest strength is also its greatest weakness if you wish to protect IP of source code. Of course, I will not get into the issue of closed vs open source, as its not appropriate here. I will leave that to the reader. If you want my opinion on it, its publicly available on the Internet at http://silverstr.ufies.org/blog/archives/000525.html

  2. There has been suggestions to simply take the RFC and write your own, and run the proofs/tests against the implementation. Ben Curley offered up some suggestions on NIST test vectors for this. Thats all great, but doesn’t actually prove the implementation is SAFE. It only proves the implementation is correct for that particular test. The code itself may still be incorrect. When the code is incorrect, you can’t really talk about security. When the code is faulty, it cannot be safe. When code isn’t audited, you will rarely be able to know the difference. And as we have seen recently on this newsgroup… many people have NO CLUE what they are doing when it comes to cryptography. When you can, use whats in the OS. Thats what it’s there for. And the “expectation” is that the bits in the OS have had more eyes audit it, use it, and implement it in a production environment. If you cannot use the stuff available by the OS vendor and need to roll your own, make sure you go through
    the test vectors and somehow have your code audited to ensure the code is correct, is safe and designed correctly.

Anyways, I can sit and banter all day long about this. Reality is, you probably just want to get to work. If you want to use the CryptoAPI, go up to usermode through IOCTL and talk via a service. If you want to roll your own, evaluate the risks and create a strategy to ensure you code is tested against the test vectors and has been coded correctly.

Good luck.

–
Regards,
Dana Epp
[Blog: http://silverstr.ufies.org/blog/]

gaurav krishna wrote:

Hi ,

I need to use the Windows Crypto APIs in Kernel Mode.

How can I go about it?

Thanks in anticipation.

regards,
Gaurav

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> 1) GPL is not a panacea. There have been recommendations to utilize the code
at

http://www.cr0.net:8040/code/crypto/. Its great code. Its clean. And it has a
license that

The reference implementations are not GPLed and are public domain.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com