39

The .Net SHA256Managed class is supported in all framework versions while the SHA256CryptoServiceProvider class is only supported from framework 3.5 and above.

Why is the SHA256CryptoServiceProvider introduced ? It seems to do the same as the SHA256Managed class, but the latter performs better.

What am I missing and why should I use the SHA256CryptoServiceProvider?

3 Answers 3

75

It has nothing to do with performance - SHA256CryptoServiceProvider uses the FIPS 140-2 validated (FIPS = Federal Information Processing Standards) Crypto Service Provider (CSP) while SHA256Managed does not. SHA256Managed is a pure managed implementation while SHA256CryptoServiceProvider does presumably the same thing but wraps the CryptoAPI.

This has big ramifications if you're going to operate on US federal or many state government systems as it is a requirement for software vendors. In the eyes of NIST, using a non-FIPS validated cryptographic module, like the SHA256Managed implementation, is no different than not using any encryption at all.

If you don't care about FIPS validation then the SHA256Managed is fine.

Everything that ends in Cng stands for "Crytographic API: Next Generation" which refers to the newer protocols that the US government calls Suite B cryptographic algorithms, but regardless of .Net framework version there is no support prior to Vista/Server 2008).

So use the algorithm and implementation that is appropriate for what you're protecting. You will be limited by which .Net framework version you're using, which operating system(s) your code runs on, and whether you need to use FIPS 140-2/140-3 (coming in 2011) validated module(s). If there isn't a supported .Net Framework class for the combination you need, there are 3rd party modules available, and you can also drop down and use the unmanaged CAPI if needed.

If you have insomnia, you can find a cure at http://csrc.nist.gov/groups/STM/cmvp/standards.html#02

2
7

I wanted to add some information about this since I just ran into a problem that required me to switch to using the CSP version. Sorry, I cannot add a comment (rep too low).

For testing this you can enable FIPS quickly by setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled to 1. Then boot up Visual Studio and try to build a project that uses SHA256Managed. You'll get errors saying "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms". In fact, you'll get this for any *Managed cryptography algorithms.

Now swap out SHA256Managed with SHA256CryptoServiceProvider and rebuild. Poof, errors go away!

Note: If you have deployed a program and a customer enables FIPS it'll throw an InvalidOperationException with the same error message above.

3

Both will generate the same hash. The only difference is that SHA256Managed is a managed implementation of hashing.

Also note that SHA256CryptoServiceProvider uses Operating system cryptographic service providers and even if you have .NET 3.5 installed it will need Windows XP with SP3, 7, or 2008 to work.

As for the advantages, using SHA256CryptoServiceProvider must give you better performance than SHA256Managed.

6
  • Thanks for your explanation. Could not find this info on MSDN. There is even a SHA256Cng class. It is very unclear which to use in certain circumstances. Aug 24, 2010 at 11:10
  • 1
    ScottBai states the opposite about performance in his answer. Oct 19, 2011 at 11:14
  • SHA256Managed is much faster than SHA256CryptoServiceProvider. Nov 15, 2011 at 7:15
  • 6
    Regarding speed, benchmarking the algorithms as of today (on Win 8.1 with .net 4.6) shows that SHA256Managed is much slower than the other algorithms, consistently taking about twice as long hashing a range of in-memory random bytes from 1mb to 512mb, with repeats etc. Readers should test for themselves before making any conclusions. Jan 21, 2016 at 9:49
  • @GeorgeHelyar have you tried with smaller payloads? This is where the effect might turn around due to possible overheads by marshalling to/invoking of the native implementations. Sep 23, 2020 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.