CryptoPro CSP 5.0 is a new generation of cryptographic provider that develops three main product lines of CryptoPro: CryptoPro CSP (classic tokens and other passive storage of secret keys), CryptoPro FKN CSP / Rutoken CSP (unretrievable keys on tokens with secure messaging) and CryptoPro DSS (keys in the cloud).

All the advantages of the products of these lines are not only preserved, but also multiplied in CryptoPro CSP 5.0: the list of supported platforms and algorithms is wider, the performance is higher, and the user interface is more convenient. But the main thing is that work with all key carriers, including keys in the cloud, is now uniform. To transfer the application system in which the CryptoPro CSP of any version worked to support keys in the cloud or to new media with non-retrievable keys, no software rework is required - the access interface remains the same, and work with the key in the cloud will occur exactly the same in the same way as with the classic key carrier.

Purpose of CryptoPro CSP

• Formation and verification of electronic signature.
• Ensuring confidentiality and integrity control of information through its encryption and imitation protection.
• Ensuring the authenticity, confidentiality and imitation protection of connections using the , and protocols.
• Monitoring the integrity of system and application software to protect it from unauthorized changes and violations of trusted functioning.

Supported Algorithms

In CryptoPro CSP 5.0, along with Russian ones, foreign cryptographic algorithms are implemented. Users can now use familiar key carriers to store RSA and ECDSA private keys.

Supported key storage technologies

Cloud token

In CryptoPro CSP 5.0, for the first time, it became possible to use keys stored on the CryptoPro DSS cloud service through the CryptoAPI interface. Now the keys stored in the cloud can be easily used by any user application, as well as by most Microsoft applications.

Media with non-removable keys and secure messaging

CryptoPro CSP 5.0 adds support for media with non-recoverable keys that implement the protocol SESPAKE, which allows you to perform authentication without transmitting the user's password in clear form, and to establish an encrypted channel for exchanging messages between the crypto provider and the carrier. An attacker in the channel between the carrier and the user's application can neither steal the password during authentication nor change the data being signed. When using such media, the problem of safe work with non-removable keys is completely solved.

Active, InfoCrypt, SmartPark and Gemalto companies have developed new secure tokens that support this protocol (SmartPark and Gemalto starting from version 5.0 R2).

Media with non-removable keys

Many users want to be able to work with non-retrievable keys, but not upgrade tokens to the FKN level. Especially for them, the provider has added support for popular key carriers Rutoken EDS 2.0, JaCarta-2 GOST and InfoCrypt VPN-Key-TLS.

List of manufacturers and models supported by CryptoPro CSP 5.0

Classic passive USB tokens and smart cards

Most users prefer fast, cheap and convenient key storage solutions. As a rule, preference is given to tokens and smart cards without cryptographic coprocessors. As in previous versions of the provider, CryptoPro CSP 5.0 retains support for all compatible media manufactured by Active, Aladdin R.D., Gemalto / SafeNet, Multisoft, NovaCard, Rosan, Alioth, MorphoKST and SmartPark.

In addition, of course, as before, ways to store keys in the Windows registry, on a hard drive, on flash drives on all platforms are supported.

List of manufacturers and models supported by CryptoPro CSP 5.0

CryptoPro Tools

As part of CryptoPro CSP 5.0, a cross-platform (Windows / Linux / macOS) graphical application appeared - "CryptoPro Tools" ("CryptoPro Tools").

The main idea is to enable users to conveniently solve typical tasks. All the main functions are available in a simple interface - at the same time, we have also implemented a mode for advanced users, which opens up additional opportunities.

With the help of CryptoPro Tools, the tasks of managing containers, smart cards and settings of crypto providers are solved, and we have also added the ability to create and verify a PKCS # 7 electronic signature.

Supported Software

CryptoPro CSP allows you to quickly and securely use Russian cryptographic algorithms in the following standard applications:

• office suite Microsoft office;
• mail server Microsoft Exchange and client Microsoft Outlook;
• products Adobe Systems Inc.;
• browsers Yandex.Browser, Sputnik, Internet Explorer,edge;
• tool for generating and verifying application signatures Microsoft Authenticode;
• web servers Microsoft IIS, nginx, Apache;
• remote desktop tools Microsoft Remote Desktop Services;
• Microsoft Active Directory.

Integration with the CryptoPro platform

From the very first release, support and compatibility with all our products is provided:

• CryptoPro CA;
• CA services;
• CryptoPro EDS;
• CryptoPro IPsec;
• CryptoPro EFS;
• CryptoPro.NET;
• CryptoPro Java CSP.
• CryptoPro NGate

Operating systems and hardware platforms

Traditionally, we work in an unsurpassed wide range of systems:

• Microsoft Windows;
• MacOS;
• Linux;
• FreeBSD;
• solaris;
• android;
• SailfishOS.

hardware platforms:

• Intel/AMD;
• PowerPC;
• MIPS (Baikal);
• VLIW (Elbrus);
• Sparc.

and virtual environments:

• Microsoft Hyper-V
• VMWare
• Oracle Virtual Box
• RHEV.

Supported by different versions of CryptoPro CSP.

To use CryptoPro CSP with a license for a workstation and a server.

Embedding Interfaces

For embedding in applications on all platforms, CryptoPro CSP is available through standard interfaces for cryptographic tools:

• Microsoft Crypto API
• PKCS#11;
• OpenSSL engine;
• Java CSP (Java Cryptography Architecture)
• Qt SSL.

Performance for every taste

Years of development experience allows us to cover everything from miniature ARM boards such as Raspberry PI to multi-processor servers based on Intel Xeon, AMD EPYC and PowerPC, with excellent performance scaling.

Regulatory documents

Full list of regulatory documents

• The crypto provider uses algorithms, protocols and parameters defined in the following documents of the Russian standardization system:
• R 50.1.113–2016 “Information technology. Cryptographic protection of information. Cryptographic Algorithms Accompanying the Application of Digital Signature Algorithms and Hashing Functions" (also see RFC 7836 "Guidelines on the Cryptographic Algorithms to Accompany the Usage of Standards GOST R 34.10-2012 and GOST R 34.11-2012")
• R 50.1.114–2016 “Information technology. Cryptographic protection of information. Elliptic Curve Parameters for Cryptographic Algorithms and Protocols" (also see RFC 7836 "Guidelines on the Cryptographic Algorithms to Accompany the Usage of Standards GOST R 34.10-2012 and GOST R 34.11-2012")
• R 50.1.111–2016 “Information technology. Cryptographic protection of information. Password protection of key information»
• R 50.1.115–2016 “Information technology. Cryptographic protection of information. Shared Key Derivation Protocol with Password-Based Authentication" (also see RFC 8133 The Security Evaluated Standardized Password-Authenticated Key Exchange (SESPAKE) Protocol")
• Guidelines TC 26 "Cryptographic information protection" "Using sets of encryption algorithms based on GOST 28147-89 for the transport layer security protocol (TLS)"
• Guidelines TC 26 "Cryptographic information protection" "Use of algorithms GOST 28147-89, GOST R 34.11 and GOST R 34.10 in cryptographic messages of the CMS format"
• Technical specification TC 26 "Cryptographic information protection" "Use of GOST 28147-89, GOST R 34.11-2012 and GOST R 34.10-2012 in the IKE and ISAKMP key exchange protocols"
• Technical specification TC 26 "Cryptographic information protection" "Use of GOST 28147-89 when encrypting attachments in IPsec ESP protocols"
• Technical specification TK 26 "Cryptographic information protection" "Use of algorithms GOST R 34.10, GOST R 34.11 in the certificate profile and certificate revocation list (CRL) of X.509 public key infrastructure"
• Technical specification TC 26 "Cryptographic information protection" "PKCS # 11 extension for the use of Russian standards GOST R 34.10-2012 and GOST R 34.11-2012"