Re: Can exchange key pair be exported and used on another machine?

Mounir,

Specifying CRYPT_EXPORTABLE when generating the key and then exporting the
pair using PRIVATEKEYBLOB type will work for me. At this point I'm still
free to re-generate the exchange key.

Thanks,
Bogdan


"Mounir IDRASSI" <moonidra@xxxxxxxxxxxxxxxxx> wrote in message
news:F3B9227B-D139-45F0-9C32-6C686C668940@xxxxxxxxxxxxxxxx
Hi,

Did you specify the flag CRYPT_EXPORTABLE when you first generated the key
on your machine? If yes, then the key pair is exportable and you can
import
back to another machine. To do so, just call CryptExportKey and specify
PRIVATEKEYBLOB as dwBlobType. Use the returned data in a call to
CryptImportKey. Be aware that the private key data is not protected that
way
and it's your responsibility to ensure its confidentiality during its
transport.

If on the other hand you didn't specify the exportable flag during the key
pair generation, then you must go through a hack to achieve this. First,
you
must create a certificate associated with this key pair (the certificate
can
be self signed, so you can use CertCreateSelfSignCertificate for this) and
add it into the IE "My" certificate store (use
CertAddCertificateContextToStore ). Then, using the free tool JailBreak
(download link : http://www.isecpartners.com/files/jailbreak-3.2.zip),
export
a PFX file that will container the key pair and the dummy certificate. Use
this PFX file to import the key pair on the intended machines.

I hope this will give clues on how to proceed. Good luck.

Cheers,
--
Mounir IDRASSI
IDRIX
http://www.idrix.fr

To reach me: mounir_idrix_fr (replace the underscores with the at and dot
characters respectively)


"Bogdan" wrote:

Hi,

In the past I used Crypto API to generate exchange key pair on one
machine
and then send exported public key blob to other machines so they could
encrypt data and send it back to the machine where the key pair was
generated. Does anyone know if I can export the exchange key pair and
use
it on a machine other than the one that generated the pair?

I'd like to be able to decrypt data on multiple machines that operate in
a
safe and secure environment. For example, I'd like to create an exchange
key pair on machine A and then export it to machine B, C, and D. Then
I'd
like to send exported public key of the pair to remote machines w, x, y,
and
z. I'd like w, x, y, and z to send data encrypted using the public key
to
A, B, C, and D. A single remote machine should be able to send encrypted
data to any of the 'secure' machines. Is this possible? If not, is
there
another way of accomplishing it using Crypt API?

Thanks,
Bogdan






.

Relevant Pages

  • Re: exporting number fields
    ... So all I had to do was specify a spec that reflected the field lengths I need not the default 255 length. ... I Format Fixed. ... And I right justify )) & trim. ... what I'd recommend is exporting into a pre-built empty table, ...
    (microsoft.public.access.forms)
  • Re: Removing certificates on MS Windows.
    ... <MIG> ... Simply exporting does not affect the certificate or linked key. ... Default behaviour should have been to remove linked private key also. ...
    (microsoft.public.platformsdk.security)
  • Re: Exporting/ importing certificates
    ... Are you just exporting the public certificate, ... You should be able to export any public certificate from your Windows ... "Certificate Stores" via IE Windows certs panels. ...
    (microsoft.public.security)
  • Re: Removing certificates on MS Windows.
    ... On Mon, 10 Apr 2006, Mitch Gallant wrote: ... Simply exporting does not affect the certificate or linked key. ... RSA keypairs, so you should definitely NOT blanket nuke them all :-) ...
    (microsoft.public.platformsdk.security)
  • Re: Export Data to excel
    ... exporting as well. ... I need a set of code which could specify the folder where I want to ... presently I have zilched code from Chip Pearson Excel MVP ...
    (microsoft.public.access.externaldata)
Loading