How to Import 3rd party generated AES private key ( openssl ) into CNG storage

Question

How to Import 3rd party generated AES private key ( openssl ) into CNG storage

Bingi Prasanthi 0

Hi,

We are trying out the below scenario using CNG with Microsoft key storage provider in C++ builder 2007 IDE

Server side :

create openssl aes-256-cbc key and perform encryption on a secure file and share with the crypto container ( key id + AES key).

Client side :

Application will take the crypto container and store the AES key based on keyid into CNG storage .

In order to implement above, we have used NcryptImportKey with BCRYPT_KEY_DATA_BLOB as BLOB type on AES key provided by server ( which is generated using OPENSSL ), but the NcryptImportKey operation is failing with 0x80090009 , 0x80090029, 0x80090026 with different blob types.

can you please give us clarity on below aspects

Is it possible to import/store 3rd party Linux (OPENSSL)based key into CNG storage?
Is CNG support import operation in c++ builder 2006 IDE ( with default ncrypt.h, bcrypt.h, ncrypt.dll, bcrypt.dll which will come along with c++ builder 2006 installation )?
If the above are feasible, can you please help us with which blob type we may need to use for importing openssl key to Microsoft KSP

Xiaopo Yang - MSFT 12,731 Reputation points Microsoft External Staff

2023-09-13T01:49:34.6666667+00:00

Do the questions, https://stackoverflow.com/questions/68373965/how-to-convert-a-public-key-in-pem-format-to-a-cng-key-blob, https://stackoverflow.com/questions/15671476/how-to-import-an-openssl-key-file-into-the-windows-certificate-store, work for you?
Bingi Prasanthi 0 Reputation points

2023-09-13T05:25:47.48+00:00

Hi @Xiaopo Yang - MSFT

Thanks for the response.

We have checked the links shared in the above comment but it seems our requirement is different.

We are searching for the below

How to import a key to CNG which is generated from a Linux device ? key type : AES

Your answer

Xiaopo Yang - MSFT 12,731 Reputation points Microsoft External Staff

2023-09-13T01:49:34.6666667+00:00

Do the questions, https://stackoverflow.com/questions/68373965/how-to-convert-a-public-key-in-pem-format-to-a-cng-key-blob, https://stackoverflow.com/questions/15671476/how-to-import-an-openssl-key-file-into-the-windows-certificate-store, work for you?
Bingi Prasanthi 0 Reputation points

2023-09-13T05:25:47.48+00:00

Hi @Xiaopo Yang - MSFT

Thanks for the response.

We have checked the links shared in the above comment but it seems our requirement is different.

We are searching for the below

How to import a key to CNG which is generated from a Linux device ? key type : AES

Share via

How to Import 3rd party generated AES private key ( openssl ) into CNG storage

Your answer