808bits

Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows 10 for Surface Hub

FIPS 140-2 certificate #2605 · Microsoft Corporation · data as of 2026-08-28
Historical. Moved to historical list due to sunsetting. Federal agencies may reference historical validations for existing systems only, not for new procurement.
Caveat: When operated in FIPS mode with modules BitLocker(R) Windows OS Loader (winload) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB validated to FIPS 140-2 under Cert. #2601 operating in FIPS mode or BitLocker(R) Windows Resume (winresume) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB validated to FIPS 140-2 under Cert. #2602 operating in FIPS mode or BitLocker(R) Windows OS Loader (winload) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Mobile, Windows 10 for Surface Hub validated to FIPS 140-2 under Cert. #2701 or #3451 operating in FIPS mode or BitLocker(R) Windows Resume (winresume) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise validated to FIPS 140-2 under Cert. #2702 or #3464 operating in FIPS mode or BitLocker(R) Windows OS Loader (winload) in Windows 10 Enterprise LTSB validated to FIPS 140-2 under Cert. #3427 operating in FIPS mode or BitLocker(R) Windows Resume (winresume) in Windows 10 Enterprise LTSB validated to FIPS 140-2 under Cert. #3426 operating in FIPS mode

Certificate

Certificate number2605
StandardFIPS 140-2
Statushistorical
Overall level1
Module typeSoftware
EmbodimentMulti-Chip Stand Alone
VendorMicrosoft Corporation · website
Software versions10.0.10240 [1], 10.0.10240.17643 [2], 10.0.10586 [3], 10.0.10586.1176 [4]

Module description

Kernel Mode Cryptographic Primitives Library (cng.sys) runs as a kernel mode export driver, and provides cryptographic services, through their documented interfaces, to Windows kernel components. It supports several cryptographic algorithms accessible via a FIPS function table request IRP (I/O request packet).

Security level exceptions

  • Physical Security: N/A
  • Design Assurance: Level 2

Approved algorithms

AlgorithmCAVP certificate
AES3497, 3629, 5287, 5291
CVL576, 663, 1755, 1758
DRBG868, 955, 2033, 2035
DSA983, 1024, 1369, 1370
ECDSA706, 760, 1381, 1383
HMAC2233, 2381, 3494, 3496
KAS64, 72, 169, 170
KBKDF66, 72, 183, 184
KTS
PBKDFvendor affirmed
RSA1783, 1784, 1798, 1802, 1871, 1887, 1888, 1889, 2821, 2825, 2827, 2828, 2829, 2830, 2831, 2835
SHS2871, 2886, 3047, 3048, 4240, 4246, 4248, 4249
Triple-DES1969, 2024, 2672, 2674

Other algorithms

HMAC-MD5; MD5; NDRNG

Tested configurations

  • Windows 10 (x64) running on a Dell XPS 8700 with PAA [1][3][4]
  • Windows 10 (x64) running on a HP Compaq Pro 6305 with PAA [1][3][4]
  • Windows 10 (x86) running on a Dell Inspiron 660s without PAA [1][3][4]
  • Windows 10 Enterprise (x64) running on a HP Compaq Pro 6305 with PAA [1][3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface 3 with PAA [1][3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface Book with PAA [3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface Pro 2 with PAA [1][3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface Pro 3 with PAA [1][3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface Pro 4 with PAA [3][4]
  • Windows 10 Enterprise (x64) running on a Microsoft Surface Pro with PAA [1][3][4]
  • Windows 10 Enterprise (x86) running on a Dell Inspiron 660s without PAA [1][3][4]
  • Windows 10 Enterprise LTSB (x64) running on a Dell XPS 8700 with PAA [1][2]
  • Windows 10 Enterprise LTSB (x64) running on a HP Compaq Pro 6305 with PAA [1][2]
  • Windows 10 Enterprise LTSB (x64) running on a Microsoft Surface 3 with PAA [2]
  • Windows 10 Enterprise LTSB (x64) running on a Microsoft Surface Pro 2 with PAA [2]
  • Windows 10 Enterprise LTSB (x64) running on a Microsoft Surface Pro 3 with PAA [2]
  • Windows 10 Enterprise LTSB (x64) running on a Microsoft Surface Pro with PAA [2] (single-user mode)
  • Windows 10 Enterprise LTSB (x86) running on a Dell Inspiron 660s without PAA [1][2]
  • Windows 10 for Surface Hub (x64) running on a Microsoft Surface Hub 55" with PAA [3][4]
  • Windows 10 for Surface Hub (x64) running on a Microsoft Surface Hub 84" with PAA [3][4]
  • Windows 10 Mobile (ARMv7) running on a Microsoft Lumia 635 [3][4]
  • Windows 10 Mobile (ARMv7) running on a Microsoft Lumia 950 [3][4]
  • Windows 10 Pro (x64) running on a HP Compaq Pro 6305 with PAA [1][3][4]
  • Windows 10 Pro (x64) running on a Microsoft Surface Book with PAA [3][4]
  • Windows 10 Pro (x64) running on a Microsoft Surface Pro 2 with PAA [1][3][4]
  • Windows 10 Pro (x64) running on a Microsoft Surface Pro 3 with PAA [1][3][4]
  • Windows 10 Pro (x64) running on a Microsoft Surface Pro 4 with PAA [3][4]
  • Windows 10 Pro (x64) running on a Microsoft Surface Pro with PAA [1][3][4]
  • Windows 10 Pro (x86) running on a Dell Inspiron 660s without PAA [1][3][4]

Validation history

DateTypeLab
2016-06-02InitialLeidos Accredited Testing & Evaluation (AT&E) Lab
2016-08-26UpdateLeidos Accredited Testing & Evaluation (AT&E) Lab
2019-06-06UpdateLeidos Accredited Testing & Evaluation (AT&E) Lab

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical
  • Validation dates on record: 2016-06-02, 2016-08-26, 2019-06-06

Source documents