We would like to develop an application that will securely communicate to another application on another machine. For this we would like to use encryption. We can use symmetric or asymmetric cryptography, it is not a key design issue at this point.
Our specification requires two separate access levels:
A key administrator who can install and replace a key on the machine
The application can use this key to encrypt information without actually having knowledge of the key itself.
The application will use (hopefully) an operating system level service to encrypt the data without actually getting direct access to the key itself. The operating system should securely store the key and give only usage access to the application.
Normally this kind of implementation is done via an external device such as a smart card or an HSM. My question is whether Windows natively supports this kind of key management without an external device or provider?