We would like to develop an application that will securely communicate to another application on another machine. For this we would like to use encryption. We can use symmetric or asymmetric cryptography, it is not a key design issue at this point.

Our specification requires two separate access levels:

  1. A key administrator who can install and replace a key on the machine

  2. The application can use this key to encrypt information without actually having knowledge of the key itself.

The application will use (hopefully) an operating system level service to encrypt the data without actually getting direct access to the key itself. The operating system should securely store the key and give only usage access to the application.

Normally this kind of implementation is done via an external device such as a smart card or an HSM. My question is whether Windows natively supports this kind of key management without an external device or provider?

  • Have a look at Microsoft's CNG - msdn.microsoft.com/en-us/library/windows/desktop/… – iainpb Dec 21 '16 at 16:15
  • @iain I checked but too brief information. – Cowboy Trader Dec 21 '16 at 16:16
  • For certificates, there is the Windows Certificate Store. For passwords there is the Windows Credential Manager or Data Protection API. That's about it. – Kirill Sinitski Dec 21 '16 at 16:18
  • @KirillSinitski Certificates are an option. The question is then can the application use the private key without knowing the private key via Windows service? – Cowboy Trader Dec 21 '16 at 16:25
  • I don't think so. – Kirill Sinitski Dec 22 '16 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.