0

As Windows CNG Keystorage offers API to export key(pair)s:

SECURITY_STATUS NCryptExportKey(
  /* The handle of the key(pair) to export */
  NCRYPT_KEY_HANDLE hKey,
  /* The handle of a key to encrypt exported key(pair) */
  NCRYPT_KEY_HANDLE hExportKey,
  LPCWSTR           pszBlobType,
  NCryptBufferDesc  *pParameterList,
  PBYTE             pbOutput,
  DWORD             cbOutput,
  DWORD             *pcbResult,
  DWORD             dwFlags
);

It seems that the exported key blob could be encrypted with hExportKey, but I haven't found any definition of the ciphertext format. For example, to export a DH keypair by setting parameter pszBlobType to BCRYPT_DH_PRIVATE_BLOB, the mannual just ambiguously said

Export a Diffie-Hellman public/private key pair. The pbOutput buffer receives a BCRYPT_DH_KEY_BLOB structure immediately followed by the key data.

And the BCRYPT_DH_KEY_BLOB is defined as follows:

typedef struct _BCRYPT_DH_KEY_BLOB {
  ULONG dwMagic;//BCRYPT_DH_PUBLIC_MAGIC or BCRYPT_DH_PRIVATE_MAGIC
  ULONG cbKey;//The length, in bytes, of the key
} BCRYPT_DH_KEY_BLOB, *PBCRYPT_DH_KEY_BLOB;

As the above structure is a header followed by the real data in contigious memory, the BCRYPT_DH_PRIVATE_BLOB (also the key data mentioned before) is composed as

BCRYPT_DH_KEY_BLOB
Modulus[cbKey] // Big-endian.
Generator[cbKey] // Big-endian.
Public[cbKey] // Big-endian.
PrivateExponent[cbKey] // Big-endian.

Now I wonder that:

As Keystore does not support the generation and storage of symmetric keys, is the parameter hExportKey of NCryptExportKey really valid?

If yes:

  1. Where does the exportKey come from? by BCryptGenerateSymmetricKey and BCryptImportKey?

  2. What format would the BCRYPT_DH_PRIVATE_BLOB be encrypted to? Just a unreadable blob with about cbKey*4 bytes?

  3. Are keypairs imported by BCryptImportKeyPair and NCryptImportKey the same stuff? I mean, both in storage and usage. Also, Is BCryptExportKey equivalent with NCryptExportKey?

  • CNG Keystorage Provider does not offer the generation and storage of symmetric keys, and that's why I suspect the validation of parameter hExportKey. – weir007 Sep 21 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.