README

:computer: WCrypt2 Encrypter

The wcrypt2.pas unit provides Delphi header definitions for the classic Microsoft CryptoAPI (CAPI) functions. These interfaces are used to interact with Cryptographic Service Providers (CSPs), manage certificates, and perform cryptographic operations such as signing, encryption, or hashing.

This option is intended for applications that are using ephemeral keys, or applications that do not require access to persisted private keys, such as applications that perform only hashing, encryption, and digital signature verification. Only applications that create signatures or decrypt messages need access to a private key. In most cases, this flag should be set.

CryptAcquireContext (@hStore, PWideChar(citac.ReaderId), PWideChar(citac.CardId), PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);//CRYPT_VERIFYCONTEXT) ;

For file-based CSPs, when this flag is set, the pszContainer parameter must be set to NULL. The application has no access to the persisted private keys of public/private key pairs. When this flag is set, temporary public/private key pairs can be created, but they are not persisted.

For hardware-based CSPs, such as a smart card CSP, if the pszContainer parameter is NULL or blank, this flag implies that no access to any keys is required, and that no UI should be presented to the user. This form is used to connect to the CSP to query its capabilities but not to actually use its keys. If the pszContainer parameter is not NULL and not blank, then this flag implies that access to only the publicly available information within the specified container is required. The CSP should not ask for a PIN. Attempts to access private information (for example, the CryptSignHash function) will fail.

When CryptAcquireContext is called, many CSPs require input from the owning user before granting access to the private keys in the key container. For example, the private keys can be encrypted, requiring a password from the user before they can be used. However, if the CRYPT_VERIFYCONTEXT flag is specified, access to the private keys is not required and the user interface can be bypassed.

It's operation not a check sign and need private key.

CSP (Cryptographic Service Provider)

In the context of Windows-based software development (especially using Delphi or Free Pascal), wcrypt2.pas is a widely recognized Pascal translation header for Microsoft's CryptoAPI (wincrypt.h), which is used to interact directly with a Cryptographic Service Provider (CSP).A CSP is the underlying hardware or software module that executes actual cryptographic operations—such as hashing, encryption, digital signing, and key generation.

Core Relationship

When you use the wcrypt2 translation unit in Delphi, you invoke standard Windows CryptoAPI functions. These functions must target a CSP to perform any heavy lifting:

• 1.Initialization: You use CryptAcquireContext to load a specific CSP into your application memory and acquire a handle to a specific key container.
• 2.Execution: Functions like CryptGenKey, CryptEncrypt, or CryptSignHash route your data to the loaded CSP.
• 3.Hardware vs. Software: The CSP can either be a standard Microsoft software provider (like the Microsoft Enhanced Cryptographic Provider) or a hardware-bound provider supplied by a vendor (such as a Smart Card reader minidriver or a hardware security module).

Common CSP Types Used with wcrypt2:

When configuring a context using wcrypt2, your code generally looks like this:

:speech_balloon: Code example

uses
  Windows, wcrypt2;

var
  hProv: HCRYPTPROV;
begin
  // Acquiring a handle to the standard Microsoft RSA CSP
  if CryptAcquireContext(
       @hProv, 
       nil,                       // nil utilizes the default user container
       MS_DEF_PROV,               // Predefined Microsoft CSP name string
       PROV_RSA_FULL,             // Provider type constant from wcrypt2
       CRYPT_VERIFYCONTEXT        // Flag used if private keys aren't being permanently saved
     ) then
  begin
    try
      // Cryptographic operations (e.g., CryptGenRandom, CryptEncrypt) go here
    finally
      CryptReleaseContext(hProv, 0);
    end;
  end;
end;

Modern Status Note

Microsoft's original CryptoAPI (represented by wincrypt.h / wcrypt2.pas) is an older legacy architecture. In newer application development environments, Microsoft strongly suggests leveraging the newer Cryptography API: Next Generation (CNG). CNG substitutes Cryptographic Service Providers (CSPs) with Key Storage Providers (KSPs) and offers support for modern elliptic curve algorithms.