SymCrypt Microsoft

cryptographic-function-library cryptographicfunctionlibrary microsoft-symcrypt-unit-test microsoftsymcryptunittest requirescmd

Use this command to install SymCrypt:

winget install --id=Microsoft.SymCryptUnitTest -e

SymCrypt is a cryptographic function library designed to provide robust and efficient implementations of symmetric and asymmetric cryptographic algorithms used by Windows. The library supports a wide range of cryptographic operations, ensuring security, performance, and compatibility across all CPU architectures supported by Windows.

Key Features:

Comprehensive support for symmetric and asymmetric cryptographic algorithms.
FIPS 140 certification compliance for products using SymCrypt.
High-assurance implementation with rigorous testing and validation.
Performance optimizations tailored for various hardware environments.
Extensive unit tests to verify functionality and compare results against other implementations.

Audience & Benefit: Ideal for developers, organizations, and security professionals requiring secure cryptographic operations within Windows-based systems. SymCrypt provides a reliable foundation for implementing cryptographic solutions, ensuring compliance with industry standards while minimizing maintenance costs and maximizing performance efficiency. It can be installed via winget.

Introduction

SymCrypt is the core cryptographic function library currently used by Windows.

History

The library was started in late 2006 with the first sources committed in Feb 2007. Initially the goal was limited to implement symmetric cryptographic operations, hence the name. Starting with Windows 8, it has been the primary crypto library for symmetric algorithms.

In 2015 we started the work of adding asymmetric algorithms to SymCrypt. Since the 1703 release of Windows 10, SymCrypt has been the primary crypto library for all algorithms in Windows.

Goals

Like any engineering project, SymCrypt is a compromise between conflicting requirements:

Provide safe implementations of the cryptographic algorithms needed by Microsoft products.
Run on all CPU architectures supported by Windows.
Good performance.
Minimize maintenance cost.
Support FIPS 140 certification of products using SymCrypt.
Provide high assurance in the proper functionality of the library.

Cloning the Repo

In some of our Linux modules, SymCrypt uses Jitterentropy as a source of FIPS-certifiable entropy. To build these modules, you will need to ensure that the jitterentropy-library submodule is also cloned. You can do this by running git submodule update --init after cloning.

The unittest/SymCryptDependencies submodule provides the RSA32 and msbignum implementations which are used as benchmarks in the unit tests when compiled on Windows. Due to licensing restrictions, we cannot release these libraries publicly, so this submodule will only be cloneable by Microsoft employees with access to our private Azure DevOps repository. If you are external to Microsoft, you can ignore this submodule. It is only used in the unit tests and does not change the behavior of the SymCrypt product code.

Building

The easiest way to get started building SymCrypt is to use the Python build script, scripts/build.py. You can run it with the --help argument to get help about which arguments are required and what each one does. For detailed build instructions, including alternative ways to build, see BUILD.md.

Testing

The SymCrypt unit test runs extensive functional tests on the SymCrypt library. On Windows it also compares results against on other implementations such as the Windows APIs CNG and CAPI, and the older crypto libraries rsa32 and msbignum, if they are available. It also provides detailed performance information.

SymCrypt Microsoft

README

Introduction

History

Goals

Cloning the Repo

Building

Testing

Versioning and Servicing

Security Bugs

Contribute