Re: Which is the strongest encryption?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Hi Art,

This is a complex area, but I'll tell you what I understand.

There is no benefit inherent in using any particular CSP (Cryptographic Service Provider); what matters is the facilities that they offer, and the way in which they are used. A brief overview of the Microsoft ones, installed with Windows (depending on your version of Windows you may not get all of them), can be seen here: http://msdn.microsoft.com/en-us/library/aa386983(VS.85).aspx.

Significant weaknesses can exist, regardless of CSP used, because the way in which they are used by calling applications, Word being a particular case in point here - its implementation, prior to 2007, was flawed.

Support for AES - and an improved implementation - is added in Word 2007, for Word 2007 format documents (.docx and .docm). With earlier versions (Word or Document format) you only have RC4 but with 128-bit keys you should be reasonably safe unless you're involved in international espionage <g>


I have found it extremely difficult to actually get very much real information; much of Microsoft's documentation (and there _is_ quite a lot of it) tells you nothing at all and then refers you to another document that tells you nothing at all in different words. It isn't hard to find similar circular non-information, and it is possible to find, sometimes quite detailed, technical information on algorithms, and a variety of implementations, but there doesn't seem to be much in between. It seems most people think things will be more secure the less knowledge there is out there, whereas I would argue the direct opposite.

--
Enjoy,
Tony

www.WordArticles.com

"Art" <Art@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:E017DAD0-C361-4D09-B8E4-7A0DE86C9868@xxxxxxxxxxxxxxxx
I've looked at the various encryption types in the Advanced tab in Word. I
wound up using the Strong Cryptographic Provider, but I really don't know
which is best. I did hunt around a bit trying to find out but don't really
know. It seems that the Enhanced providers provide some sort of backward
compatibility, so it makes me wonder about them. Also, all of them seem to
indicate that RC4 is used. I had thought that RC4 wasn't the best choice
these days.

Any opinions or sources of information? I would like to use the best
algorithm available.

Thanks.



.

Relevant Pages

  • RE: write your own CSP basic question
    ... on the specified provider Microsoft's CAPI ... layer routes the call to the appropriate CSP's CP... ... In that case your CSP can ... operations - everything else (eg. hashing and symmetric crypto) you probably ...
    (microsoft.public.platformsdk.security)
  • Custom CSP in Office 2003?
    ... I've developed a custom CSP. ... However, in Office 2003, I found my CSP ... Provider type is PROV_RSA_SIG. ... Here's how I register the certificate into system cert store: ...
    (microsoft.public.platformsdk.security)
  • Debug self written CSP
    ... I now make a certificate request ... from my WinXP machine to a 2003 Server (by selecting "My Cryptographic ... Provider" in the webform). ... The requesting procedure runns until my CSP has to return its name. ...
    (microsoft.public.platformsdk.security)
  • Using more powerful hash function with CAPI
    ... attacks on hash algorithms, it's becoming all the more desirable for MS ... either generate or verify a signature using a hash algorithm that is not ... implemented in a CSP presents on the machine? ... Will a future update change that provider to the final ...
    (microsoft.public.platformsdk.security)