Armin,
Well I guess I don't actually use the decryptSessionStreamString in the user application. In our case we're encrypting file names (not underlying data) for storage and for lookup by the user application. File names are encrypted before sending to our clients, (their customer bills/information). The application doesn't need to decrypt the name it only needs to locate the appropriate file. So the application just runs encrypt (hopefully the same one (orig. thread)), then looks up/opens files as needed.

I built a test utility that utilizes _cryptapi to encrypt & decrypt files and I'm using decryptSessionStreamString in it. I'll admit I haven't tested/checked every single file (we have tens of thousands) but other than the original XP issue in this thread I haven't noticed any problems.

Greg