How to create a AES persistent key with Crypto API Next Generation on Windows 7

Question

On Windows 7 Pro x64, I try to create a persistent AES key with Cryptography API Next Generation.

The problem is that the NCryptCreatePersistedKey function returns NTE_NOT_SUPPORTED.

My code:

#include "Windows.h"
#include "bcrypt.h"
#include "ncrypt.h"

int main() {

    NCRYPT_PROV_HANDLE hProvider;
    NCRYPT_KEY_HANDLE hKey;

    // Open storage provider
    HRESULT status = NCryptOpenStorageProvider(&hProvider, 
    MS_KEY_STORAGE_PROVIDER, 0);

    // Get stored cipher key
    status = NCryptOpenKey(hProvider, &hKey, L"test-key", 0, 0);

    // Create key if it doesn't exist
    if (status == NTE_BAD_KEYSET) {
        status = NCryptCreatePersistedKey(hProvider, &hKey, 
        BCRYPT_AES_ALGORITHM, L"test-key", 0, 0);
        status = NCryptFinalizeKey(hKey, 0);
    }

    return 0;
}

That works on Windows 10 Pro x64.

And documentation says that minimum supported client is Windows Vista...

Thanks for your help.

score 0 · Accepted Answer · answered Jan 22 '18 at 15:48

MS_KEY_STORAGE_PROVIDER doesn't support AES or 3DES on Windows 7, it was a feature added in either 8 or 8.1. The best source I can find for that is some test state for .NET Core. Alternately, you could go by wincrypt.h:

#if (NTDDI_VERSION >= NTDDI_WIN8)
#define NCRYPT_AES_ALGORITHM            BCRYPT_AES_ALGORITHM
#define NCRYPT_RC2_ALGORITHM            BCRYPT_RC2_ALGORITHM
#define NCRYPT_3DES_ALGORITHM           BCRYPT_3DES_ALGORITHM
#define NCRYPT_DES_ALGORITHM            BCRYPT_DES_ALGORITHM
#define NCRYPT_DESX_ALGORITHM           BCRYPT_DESX_ALGORITHM
#define NCRYPT_3DES_112_ALGORITHM       BCRYPT_3DES_112_ALGORITHM

#define NCRYPT_SP800108_CTR_HMAC_ALGORITHM  BCRYPT_SP800108_CTR_HMAC_ALGORITHM
#define NCRYPT_SP80056A_CONCAT_ALGORITHM    BCRYPT_SP80056A_CONCAT_ALGORITHM
#define NCRYPT_PBKDF2_ALGORITHM             BCRYPT_PBKDF2_ALGORITHM
#define NCRYPT_CAPI_KDF_ALGORITHM           BCRYPT_CAPI_KDF_ALGORITHM
#endif // (NTDDI_VERSION >= NTDDI_WIN8)

The NCRYPT versions of the #defines didn't exist until Windows 8, suggesting that the NCrypt (persisted key) APIs didn't expect to be doing AES until Windows 8.

How to create a AES persistent key with Crypto API Next Generation on Windows 7

1 Answers1