Cryptography system and method for providing cryptographic services for a computer application

In a computer system having a processing unit and a computer-readable medium, a computer-implemented cryptography service provider stored on the computer-readable medium for execution on the processing unit as part of a cryptography system used to support a computer executable application requiring encryption or decryption of electronic messages to be sent or received by a user, the cryptography service provider comprising:

• a key manager to manage encryption keys used to encrypt messages and to prevent the encryption keys from being exported in a non-encrypted form from the cryptography service provider;
• an encryption/decryption device to encrypt or decrypt messages using the encryption keys;
• and
• the cryptography service provider being configured as a dynamic linked library, software module which is dynamically accessible as needed by the application to receive a plaintext message and to return an encrypted message, or to receive an encrypted message and to return a plaintext message, without exposing the encryption keys in their non-encrypted form to the application.

A method for supporting cryptographic functions requested by an application, the method comprising the following steps:

• supplying a request for a cryptographic function to a cryptographic application program interface (CAPI);
• selecting a cryptography service provider (CSP) to perform the desired cryptographic function;
• establishing communication between the CAPI and the CSP;
• verifying an authenticity of the CSP;
• performing the cryptographic function at the CSP using at least one cryptographic key;
• and
• preventing exposure of the encryption key in a non-encrypted form to the CAPI or application.

A method for encrypting a message comprising the following steps:

• supplying a plaintext message to a cryptographic application program interface (CAPI);
• selecting a cryptography service provider (CSP) for encrypting the message;
• establishing communication between the CAPI and the CSP;
• verifying an authenticity of the CSP;
• passing the plaintext message from the CAPI to the CSP;
• encrypting the message at the CSP using an encryption key maintained by the CSP to produce an encrypted message;
• and
• passing the encrypted message from the CSP back to the CAPI without exposing the encryption key in its non-encrypted form.