CryptoAPI Private Key Dialog Box

owain · November 11th, 2004, 07:09 AM

I am using the Microsoft.Web.Services.Security and System.Security.Cryptography namespaces to access the certificate store and extract a private key from a certificate that I can use for decryption and digital signing.

The problem is that when I request the key a modal dialog box with the caption 'Exporting your private exchange key' is displayed stating that 'An application is requesting access to a protected item.' It states that the protected item is a 'CryptoAPI Private Key.' If the user clicks the OK button then I can use the private key, otherwise a System.Security.Cryptography.CryptographicExceptio n exception is thrown.

I can understand why this dialog box is shown and why I can not access the private key until the user allows me to do so, however I was wondering if there was a way the user could associate their certificate with my application so that they are not requested to allow access to the key every time the app starts. I do not mind the box being displayed the first time they use the certificate however I think it will annoy my user base if they have to click OK every time they start the app.

Here is a simplified example of my code:

Code:

Imports System.Security.Cryptography
Imports Microsoft.Web.Services.Security.X509

Module Module1
    Sub Main()

        Dim store As X509CertificateStore
        Dim cert As X509Certificate
        Dim privateKey As New RSACryptoServiceProvider

        store = X509CertificateStore.LocalMachineStore("My")

        If store.OpenRead() Then
            cert = store.Certificates(0)
            privateKey.FromXmlString(cert.Key.ToXmlString(True))
            'Do some fancy encryption stuff with the private key...
        End If

    End Sub
End Module

Note that this code will only work if you add a reference to the Microsoft.Web.Services.dll and have at least one certificate with a private key in it within the Personal section of the Local Computer certificate store.

Any help here would be greatly appreciated.

Regards
Owain Williams

owain · November 12th, 2004, 11:49 AM

I have found the reason why the dialog box is being displayed, it is because when I imported the certificate into the certificate store I enabled strong private key protection. If this is not enabled then no dialog box is displayed when I extract the private key.

My next question is again regarding the private key. If I do not mark the key as exportable then I can not use it, what is the point of this? I have a private key but I can not use it. Am I accessing the key in a peculiar way? Is there a way of accessing the keys without extracting them from the X509Certificate and importing it into the RSACryptoServiceProvider?

I can not seem to find many details about the CspParameters class that can be used in the constructor for the RSACryptoServiceProvider, does anyone know where I can find more details and if this class would help me gain access to the certificates?

Regards
Owain Williams