NCryptCreatePersistedKey - Any property to set User Reauthentication before Access?

Merlin Avery 21 Reputation points
2022-11-04T16:19:47.753+00:00

NCryptCreatePersistedKey has ability to set properties on the key. I have tested with UI settings for prompting for Allow/Deny. Also I have seen UI settings for PIN/Password. But I simply want the ability for a user to validate themselves like UAC before accessing a key. Is there a way to do something like this?

The purpose of this authorization is because a key created with the application for a specific purpose using Platform Crypto Provider (TPM) can still be accessed if the user happens to have another application running with with their user SID or anyone who sits down at the computer while someone is away from it could in fact simply access the key.

Obviously a PIN would protect against that, but that requires memory of a PIN/Password. If a person is already enrolled in Windows Hello they could just validate their own login to use a key.

Is this possible with some NCrypt key property that I can't find?

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,494 questions
C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,608 questions
0 comments
Accepted answer
  1. Xiaopo Yang - MSFT 12,151 Reputation points Microsoft Vendor
    2022-11-07T02:15:37.513+00:00

    As far as key is concerned, it should be tied with its PIN/Password. However, you can implement a custom Key Storage Provider to get the feature.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest