808bits

Microsoft Windows Server 2008 R2 Kernel Mode Cryptographic Primitives Library (cng.sys)

FIPS 140-2 certificate #1335 · Microsoft Corporation · data as of 2026-08-28
Historical. RNG SP800-131A Revision 1 Transition. Federal agencies may reference historical validations for existing systems only, not for new procurement.
Caveat: When operated in FIPS mode with Windows Server 2008 R2 Winload OS Loader (winload.exe) validated to FIPS 140-2 under Cert. #1333 operating in FIPS mode

Certificate

Certificate number1335
StandardFIPS 140-2
Statushistorical
Overall level1
Module typeSoftware
EmbodimentMulti-chip standalone
VendorMicrosoft Corporation · website
Software versions6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.22076

Module description

CNG.SYS runs as a kernel mode export driver, and provides cryptographic services, through their documented interfaces, to Windows Server 2008 R2 kernel components. It supports several cryptographic algorithms accessible via a FIPS function table request irp (I/O request packet).

Approved algorithms

AlgorithmCAVP certificate
AES1168, 1187
AES GCM1168
AES GMAC1168
DRBG23, 27
ECDSA142
HMAC686
KASvendor affirmed
RNG649
RSA559, 567
SHS1081
Triple-DES846

Other algorithms

AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4

Tested configurations

  • Microsoft Windows Server 2008 R2 (IA64 version)
  • Microsoft Windows Server 2008 R2 (x64 Version)
  • Microsoft Windows Server 2008 R2 SP1 (IA64 version) (single-user mode)
  • Microsoft Windows Server 2008 R2 SP1 (x64 version)

Validation history

DateTypeLab
2010-08-12InitialSAIC-VA
2011-06-01UpdateSAIC-VA
2011-06-21UpdateSAIC-VA
2012-02-09UpdateSAIC-VA
2013-01-24Update

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical
  • Validation dates on record: 2010-08-12, 2011-06-01, 2011-06-21, 2012-02-09, 2013-01-24

Source documents