schannel

Secure Channel

Schannel is the security package (SP) and authentication package (AP) for the following protocols:

• DTLS 1.0 and 2.0

• SSL 2.0 and 3.0

• TLS 1.0, 1.1, 1.2, and 1.3

Schannel previously supported the Private Communication Technology (PCT) protocol version 1, but it appears that Microsoft has removed support for PCT 1 at some point. The use of PCT 1 may still be found in other Microsoft technologies such as the Microsoft Message Queuing (MSMQ) Directory Service Protocol.

Table of Contents

• Functions

Functions

Microsoft provides lots of documentation on MSDN for using schannel for authenticating client and server applications; though, they do not provide any documentation on the message types for package calls. The message types that schannel supports is provided here. Lsa Whisperer currently provides experimental support for some of these as schannel commands.

Id	Message Type	CLI Support	NT Version	Internal Function
0x2	LookupCert*		>=5.1	SslDoClientRequest
0x3	PurgeCache	✔️	>=5.1	SslPurgeSessionCache
0x4	CacheInfo		>=5.1	SslSessionCacheInfo
0x5	PerfmonInfo	✔️	?>x>=5.1	SslGetPerfmonInfo
0x6	LookupExternalCert*		>=5.1	SslMapExternalCredential
0x7	LookupEncodedCert*		?	SslMapEncodedCredential
0x8	StreamSizes	Planned	?	SslGetStreamSizes

✏️	The internal function will be located in schannel.dll.

Commands marked with an asterisk require the client to be trusted. The LookupCert command may also be alternatively called through the SpCallPackagePassthrough function. Oddly, the PurgeCache command was only available to untrusted callers and was removed from schannel after originally being available since at least NT 5.2.