is cryptoapi good?

Question

i'm writing a crypto program that does stuff like hashing (sha1), encryption, digital signatues for win32 in c++ is built in cryptoapi secure, or should i use some other library like crypto++ i need maximum security and works on all systems xp and vista (and optionally 2000), but at same time i need to minimize exe size and so don't want uneeded external libs

Answer 1

Define "secure". The built in windows crypto api does what it advertises and doesn't have any flaws that don't get corrected, at least of which I'm aware. The "Crypto Next Generation" API might be worth a look.

Usually, in a secured program, the issue is what people do with the API — insufficient key lengths, leaving keys around in plain text, etc — that really make trouble, not the vendor software.