Hardware Key Generation APIs in Windows Mobile 6.5

Windows Mobile 6.5 relied on the Microsoft Cryptographic Application Programming Interface (CryptoAPI 1.0/2.0) alongside specialized Cryptographic Service Providers (CSPs) to support hardware-backed cryptographic key generation. Because the newer Cryptography Next Generation (CNG) framework was not available on the Windows CE 5.2 kernel powering Windows Mobile 6.5, hardware-isolated operations—such as generating keys directly inside smart cards, secure elements, or hardware security modules (HSMs)—depended strictly on CAPI functions interfacing with vendor-supplied hardware drivers.

Microsoft CryptoAPI (CAPI)

The primary interface for cryptographic operations in Windows Mobile 6.5 was CryptoAPI. CAPI abstracted cryptographic algorithms behind an architecture of interchangeable modules known as Cryptographic Service Providers (CSPs). When hardware security mechanisms were present, the hardware vendor provided a custom CSP dynamic-link library (DLL) registered in the system registry under HKEY_LOCAL_MACHINE\Comm\Security\Crypto\Defaults\Provider.

Key generation inside hardware was performed using standard CAPI functions configured to target the hardware provider:

  • CryptAcquireContext: Used to acquire a handle to a specific key container within a designated hardware CSP (such as a Smart Card CSP or a device-specific Secure Element CSP). By passing the name of the hardware-specific provider and the appropriate provider type (e.g., PROV_RSA_FULL), the application bound execution to the physical token.
  • CryptGenKey: Instructed the CSP to generate a random cryptographic key. When invoked against a hardware-backed CSP, the key generation executed directly within the secure hardware chip rather than in the device’s general memory. Flag options such as passing zero for export flags ensured private keys were tagged as non-exportable, permanently binding them inside the physical perimeter of the chip.
  • CryptDeriveKey: Handled key derivation directly on the secure module when generating session keys from base data or password hashes.

Smart Card API (PC/SC)

For enterprise devices equipped with smart card readers, secure digital (SD) security tokens, or SIM-based cryptographic chips, Windows Mobile 6.5 implemented the PC/SC (Personal Computer/Smart Card) standard through the Winscard.dll subsystem.

The WinSCard API provided low-level access via the following mechanisms:

  • Direct APDU Transmission (SCardTransmit): Enabled developers to bypass CAPI and communicate directly with the smart card or secure element using Application Protocol Data Units (APDUs). This allowed proprietary key generation routines defined by ISO/IEC 7816-4 or Java Card applets residing on the card.
  • Base Smart Card CSP Integration: Supported standard smart card minidrivers that routed CAPI calls (such as CryptGenKey) directly through the PC/SC layer to the smart card chip.

OEM and Vendor-Specific Extensions

Native out-of-the-box Windows Mobile 6.5 images only provided software-based providers (like the Microsoft Default Cryptographic Provider). Consequently, physical key generation was heavily contingent on OEM implementations (such as enterprise handhelds produced by Motorola Solutions or Intermec). These vendors exposed proprietary SDKs that wrapped CAPI or interacted with onboard Trusted Platform Modules (TPM) and cryptographic coprocessors via dedicated kernel-mode drivers and custom CSP implementations.