But the examples also show SDDL based descriptors, like:
I'm not sure I follow how a SDDL based protection descriptor is supposed to work. Is the secret protected so that the SDDL owner can decrypt it? What does the various access rights in the SDDL come into play? Does an Deny ACE deny encryption, or what? Does a G allow encryption, how does that work with a group?
I cannot find any documentation on this topic, and mapping an SDDL to key exchange feels much like the square peg and round hole.