Public-Key Algorithms

All PROV_RSA_FULL and PROV_RSA_SIG providers use the RSA Public-Key Cipher for both digital signatures and key exchange. Two public/private key pairs are defined: the signature key pair and the exchange key pair. The exchange key pair can be used both to exchange session keys and to perform/verify digital signatures.

Although the Microsoft Base Cryptographic Provider uses 512-bit public/private keys, this is not a requirement. Your CSP is perfectly free to use larger keys, although this may make it subject to export control. For more information on export control, see Getting CSPs Signed.

The CPVerifySignature function of all CSPs must be able to verify signatures of up to 2048 bits, regardless of the size of the signatures produced by CPSignHash. This ensures that the CSP will be able to validate all compatible certificates, even those signed with very large keys. This requirement may be difficult for CSPs implemented in hardware packages with limited memory, so it may be necessary for some hardware CSPs to implement a signature verification algorithm within the primary DLL.