I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA private key (in clear)?
According to my tests, indeed the private key seems usable in the code but the access to the raw value seems impossible.
I ask myself the question, because to make sure I can use the private key in my program, in order to decrypt, I had to give read rights on the private key to my user at the certificate level ... So Reading means being able to use the private key but does not mean that the user can extract the raw key? Is it right ?