At the moment I am looking into the most secure way to store a private RSA key on Windows.
Making it as much usable for the end user as possible, while keeping the security to its highest. As this is practically impossible I am not sure where to exactly go with a compromise. Maybe I am forgetting about another possibility and would like to ask for help from the information security board.
Scenario: A user generates an RSA key pair. This is frequently used to encrypt/decrypt AES keys to then access actual data. Lets say its a chat application, or an application like dropbox for files. The purpose doesn't really matter as the focus lies on the way the RSA private key is stored and can be accessed.
The workflow of the user: Login Windows -> Start App -> Login via API to webserver -> successful login -> access private key locally -> perform task x (chat, file, etc...)
SQLite Database where the private key is unencrypted in PEM format. The DB is "encrypted" and the password is saved in the .net application as a string Quick and dirty. I'd say bad practice. However, other applications cannot access the SQLite database as they do not know the key.
CryptoAPI .NET using the RSA User Key Container. While having DenyExport and other flags on, any app can access the key while the user is logged in. With mimikatz and similar software it's quite easy to export the private key even though it is not exportable.
.NET DAPI is not really for protecting RSA Keypair and more interesting for sensitive information in memory. No point at all
Simply export the PEM key as password protected key. Usability goes down as the user would need a 2nd password to access the key.
Isolated Data .NET - out of question.
Is there another way to store a private key in a secure but practical manner on a windows system ?