>1. Are we restricted to machines that have Win95 OSR2 or higher if we want to use _crypt.vcx to get the same encrypted string?

Unfortunately I do not have ready access to Win95/Win98 machines around here to test. I'll try to follow up on this issue.

>2. Are there any other variables (IE version etc.) that impact the result of the EncryptSessionStreamString function?

Shouldn't be.

>3. Alex mentions that the CryptoAPI is an integral part of Windows nowadays and was previously available as the CryptoAPI SDK for NT 4 and Win95 OSR2. I have searched Microsoft's site but couldn't find a specific download for this. Does anyone have a link to where this SDK can be downloaded from?

Normally that would come with the SDK. Seems that the older Win95/Win98 SDKs are still available. Check at:
http://www.microsoft.com/msdownload/platformsdk/sdkupdate/
under "Core SDK".

HTH