263 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
2
votes
1
answer
156
views
Signature created via CAPI cannot be verified using CNG, and vice versa
Background
My application is using CAPI to sign and verify some data using RSA 2048.
I'm trying to migrate to CNG, and it must be able to verify past signatures created with CAPI.
Problem
...
0
votes
0
answers
47
views
Problem signing Excel VBA files with Signtool and Google KMS
I'm using Google KMS with HSM to store my private key and:
Signtool
CNG 1.2
to sign exe and dll files for my software.
Command looks like this:
"signtool.exe" sign /v /fd sha256 /tr http://...
0
votes
0
answers
163
views
Windows 11: private key not usable when protected vbs + high security (password)
I have a C# program (running on .NET 8) that signs data using an RSA key that is stored in Windows cert-/keystore. The key had been imported using Windows certmgr.msc into the "Personal" ...
0
votes
0
answers
22
views
Why sometimes we can't read CryptoAPI keys with CNG?
I have read an interesting bit here:
When you move or copy CryptoAPI keys from a source machine to a target machine with Windows User State Migration Tool (USMT), CNG will fail to access the keys on ...
1
vote
0
answers
54
views
Import PEM Cert into Windows Crypto Next Generation issues
My project is to create a script in Golang that signs a document with a PIV card digital signature and then allows you to verify the signature with the piv card's certificate. I've got the first part ...
0
votes
0
answers
97
views
NCryptFinalizeKey Fails with ‘Access Denied’ After Setting Security Descriptor on Machine Key
I’m using the Windows CNG API to create a TPM-stored (or MS KSP) RSA key and want to allow non-administrative users to access it. My goal is to generate a machine level key (non-exportable) which can ...
1
vote
0
answers
81
views
OpenSSL3 Providers: SSL client doesn't use the certificate and private key I provide for mTLS authentication
I am trying to implement mTLS authentication in C on the client side, which uses a custom OpenSSL provider implemented with the Microsoft CNG API.
My provider dispatch table implements the functions:
...
-1
votes
1
answer
368
views
NCryptOpenStorageProvider + KeyIso
Restarting the service after opening the provider breaks the connection and forces you to restart the entire application.
Step by step:
Open the provider NCryptOpenStorageProvider(myProvider, ...
0
votes
0
answers
524
views
CNG, Microsoft Software Key Storage Provider, and the "Invalid provider type specified" error
Recently, our enterprise began issuing new CNG server certificates. We just installed the first of these on an app server, and it seems to have broken a web services call with the error "Invalid ...
0
votes
0
answers
75
views
Values of NCRYPT_REQUIRE_VBS_FLAG and NCRYPT_PREFER_VBS_FLAG
I'm developing app which uses the Windows Cryptography API: Next Generation. Function NCryptOpenKey have some flags and I can't find the values for two of them:
NCRYPT_REQUIRE_VBS_FLAG = ?
...
0
votes
1
answer
112
views
BCrypt: Import ECDSA public key in compressed form
Does the BCrypt (C++) API (BCryptImportKeyPair of similar) allow import of an ECDSA public key for the secp256r1 (aka P-256) curve directly in compressed form, that is 1-byte prefix 0x02 or 0x03 ...
0
votes
1
answer
540
views
NCryptSignHash returns NTE_INVALID_PARAMETER (0x80090027)
I'm working with some old code that was signing data using an installed certificate and the CryptoAPI, and I need to migrate it to use CNG. I've tried two different approaches, one using ...
1
vote
1
answer
95
views
What API call will tell me the number of PIN attempts remaining on a smartcard?
I am successfully retrieving certificates and their private key as follows:
PCCERT_CONTEXT cert = NULL;
if (!(cert = CertFindCertificateInStore(sys, X509_ASN_ENCODING, 0, CERT_FIND_EXISTING, ...
1
vote
0
answers
136
views
'The request is not supported' error during 'BCryptExportKey'
I'm trying to use BCrypt crypto operation (BCryptEncrypt, BCryptDecrypt).
Before running encryption, decryption, I wanted to export and import the key.
I'm getting an error when trying to use '...
-1
votes
1
answer
168
views
Decrypting a p7m file using CNG
I have existing legacy Crypto API code that worked OK-ish until recently - I am seeing more and more cases when the data is not being decrypted at all without returning any errors (...