Muokkaa

Jaa

RSA/Schannel Keys

  • Artikkeli

Generating and Retrieving RSA/Schannel Keys

RSA/Schannel keys can be generated by calling the CryptGenKey function. The call to CryptGenKey requires an AT_KEYEXCHANGE algorithm identifier passed in the Algid parameter.

To generate an RSA/Schannel public/private key pair

  1. Call the CryptAcquireContext function to get a handle to the Microsoft RSA/Schannel Cryptographic Provider.
  2. Call the CryptGenKey function to generate the keys. AT_KEYEXCHANGE must be passed in for the Algid parameter, and the upper 16 bits of the dwFlags parameter must be set to the desired key size (512 bits). An HCRYPTKEY structure handle is returned in the hKey parameter.

To retrieve a pointer to previously generated RSA/Schannel user keys

  1. Call the CryptAcquireContext function to get a handle to the Microsoft RSA/Schannel Cryptographic Provider.
  2. Call the CryptGetUserKey function, with the dwKeySpec parameter set to AT_KEYEXCHANGE.

Exporting RSA/Schannel Keys

Master keys can be exported into simple key BLOB structures. This should be implemented the same way as the export of normal RC4 or Data Encryption Standard (DES) bulk encryption keys, as described in Simple Key BLOB. The aiKeyAlg member of the PUBLICKEYSTRUC structure is set to the algorithm identifier of the master key (CALG_PCT1_MASTER, CALG_SSL2_MASTER, CALG_SSL3_MASTER, or CALG_TLS1_MASTER).

If the CPExportKey function is exporting an SSL2 master key and the CRYPT_SSL2_FALLBACK flag is set, then, to help prevent version rollback attacks, set the first eight bytes of the encryption block padding to 0x03 rather than to random data.

If the CRYPT_DESTROYKEY constant is specified in the dwFlags parameter of the CPExportKey function, the CSP destroys the key or key handle after exporting the key. This flag is intended for use only with opaque BLOBs.