NCryptCreatePersistedKey - Any property to set User Reauthentication before Access?

Merlin Avery 1 Reputation point
2022-11-04T16:19:47.753+00:00

NCryptCreatePersistedKey has ability to set properties on the key. I have tested with UI settings for prompting for Allow/Deny. Also I have seen UI settings for PIN/Password. But I simply want the ability for a user to validate themselves like UAC before accessing a key. Is there a way to do something like this?

The purpose of this authorization is because a key created with the application for a specific purpose using Platform Crypto Provider (TPM) can still be accessed if the user happens to have another application running with with their user SID or anyone who sits down at the computer while someone is away from it could in fact simply access the key.

Obviously a PIN would protect against that, but that requires memory of a PIN/Password. If a person is already enrolled in Windows Hello they could just validate their own login to use a key.

Is this possible with some NCrypt key property that I can't find?

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,427 questions
C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,540 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Xiaopo Yang - MSFT 11,501 Reputation points Microsoft Vendor
    2022-11-07T02:15:37.513+00:00

    As far as key is concerned, it should be tied with its PIN/Password. However, you can implement a custom Key Storage Provider to get the feature.