schannel

[Ben]

I need to use SSL with a windows app and have succeeded in
using the Schannel package through SSPI on Win2K.
However, I also need to support Win 98. It appears that
schannel.dll is in the windows\system folder, but I cannot
use it through SSPI because it is not an installed SSPI
package. (I discovered this through using the
EnumerateSecurityPackage function.) I tried adding ",
schannel.dll" to the registry key SecurityProviders in the
entry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Securit
yProviders, but that just made everything not work at all.

Anything I'm missing or should I be trying some other
route?

Thanks,
Ben

[Yu Chen [MS]]

You can load schannel.dll explicitly in your application:

#include <sspi.h>

HMODULE hSecurity = NULL;
PSecurityFunctionTable pSecurityFunc = NULL;
INIT_SECURITY_INTERFACE pInitSecurityInterface = NULL;

// note: error checking omitted below for simplicity
hSecurity = LoadLibrary("schannel.dll");
pInitSecurityInterface =
(INIT_SECURITY_INTERFACE)GetProcAddress(hSecurity,
"InitSecurityInterfaceA");
pSecurityFunc = pInitSecurityInterface();

Later in your application:
pSecurityFunc->AcquireCredentialsHandle( ... )

--
Yu Chen [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Ben" <ben...@yahoo.com> wrote in message
news:02f901c2f966$7ddcd4c0$a101...@phx.gbl...

[Pieter Philippaerts]

"Ben" <ben...@yahoo.com> wrote in message
news:02f901c2f966$7ddcd4c0$a101...@phx.gbl...

> Anything I'm missing or should I be trying some other
> route?

Windows 95 and 98 do not natively support SSL and TLS encryption. You can
enable it by installing the Directory Service Client and then modifying some
registry keys. For more information, take a look at
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q276245

Regards,
Pieter Philippaerts
http://www.mentalis.org/

[Ben]

OK, I loaded schannel.dll explicitly which brought me much
further than I was before - thank you - however I then ran
into the problem addressed by Peter Philippaerts' post.
EncryptMessage and DecryptMessage are not exposed by
earlier versions of schannel's InitSecurityInterface
function due to (now defunct) encryption export laws. The
MSDN says these functions were implemented but not
documented. Peter's post has a link to an MSDN page which
poses a solution to this by editing the registry and using
dsclient.exe from the Win2K setup CD, however 1)
dsclient.exe crashes when I try to run it on a Win98
client and 2) isn't there an easier way? I keep going on
the presumption that if IE is using TLS/SSL through
Schannel then so can I. Is IE grabbing the encryption
functions in a different way, or have they been
implemented directly in IE source code which I don't have
access to?

Thanks,
Ben

>.
>

[Yu Chen [MS]]

If you have IE installed you don't need dsclient.exe.
Try to use Reserved3 in the function table (cast to ENCRYPT_MESSAGE_FN
first) for encryption and Reserved4 (cast to DECRYPT_MESSAGE_FN) for
decryption.

--
Yu Chen [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Ben" <ben...@yahoo.com> wrote in message

news:012301c2fa0c$caf8cdd0$a101...@phx.gbl...

[Pieter Philippaerts]

"Yu Chen [MS]" <yuc...@online.microsoft.com> wrote in message
news:OAMYGPh#CHA....@TK2MSFTNGP11.phx.gbl...

> If you have IE installed you don't need dsclient.exe.

Could you tell me starting from which IE version this is true?
I'm writing an SSL/TLS library for .NET, and one of the supported platforms
by the .NET runtime is Windows98 with IE5.01. If I do not install DSCLIENT
on that Win98 machine, it doesn't work, although IE5.01 is installed. So is
the DSCLIENT shipped with IE5.5? Or 6.0? It would be a lot easier to link
people to an IE download than to a DSCLIENT download [especially since
Microsoft only online distributes DSCLIENT for NT4, not for Win98/ME/2K].

Regards,
Pieter Philippaerts

[Yu Chen [MS]]

> > If you have IE installed you don't need dsclient.exe (to get
schannel.dll)

What I meant is that if you only need schannel.dll on W98, you can just
install IE (5.0 and above) - no need to install dsclient.exe
Dsclient is not shipped with any IE version.

--
Yu Chen [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Pieter Philippaerts" <pie...@nospam.mentalis.org> wrote in message
news:uddl5Uj#CHA...@TK2MSFTNGP11.phx.gbl...

[Ben]

Yup - that worked like a charm. Thanks!

I guess that's what the MSDN meant by "implemented but not
documented."

Ben

>.
>