Windows CNG virtualization-based security

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[krwq]

Fixes: #102492

One of the Windows 11 builds has added framework to help secure Windows keys with virtualization-based security (VBS). With this new capability, keys can be protected from admin-level key theft attacks with negligible effect on performance, reliability, or scale.

Blog post:
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/advancing-key-protection-in-windows-using-vbs/ba-p/4050988

Win API:
https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey

The proposal is to extend existing CngKeyCreationOptions API to include the new flags.

API Proposal

namespaceSystem.Security.Cryptography;[Flags]publicenumCngKeyCreationOptions:int{// existing:// None = 0x00000000,// MachineKey = 0x00000020, // NCRYPT_MACHINE_KEY_FLAG// OverwriteExistingKey = 0x00000080, // NCRYPT_OVERWRITE_KEY_FLAG// new APIs:PreferVbs=0x00010000,// NCRYPT_PREFER_VBS_FLAGRequireVbs=0x00020000,// NCRYPT_REQUIRE_VBS_FLAGUsePerBootKey=0x00040000,// NCRYPT_USE_PER_BOOT_KEY_FLAG}

Example usage

// Note: this API is Windows onlyusingSystem.Security.Cryptography;CngKeyCreationParameterscngCreationParams=new(){Provider=CngProvider.MicrosoftSoftwareKeyStorageProvider,KeyCreationOptions=CngKeyCreationOptions.RequireVbs|CngKeyCreationOptions.OverwriteExistingKey,};using(CngKeykey=CngKey.Create(CngAlgorithm.ECDsaP256,"mySoftwareKey",cngCreationParams))using(ECDsaCngecdsa=newECDsaCng(key)){// do stuff with the key}

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.