NCryptCreateProtectionDescriptor accepts various Protection Descriptors, and I can understand the examples shown like:


But the examples also show SDDL based descriptors, like:


I'm not sure I follow how a SDDL based protection descriptor is supposed to work. Is the secret protected so that the SDDL owner can decrypt it? What does the various access rights in the SDDL come into play? Does an Deny ACE deny encryption, or what? Does a G allow encryption, how does that work with a group?

I cannot find any documentation on this topic, and mapping an SDDL to key exchange feels much like the square peg and round hole.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.