Search code examples
c#windowspermissionscryptographycng

Permissions to create CNG key

When I try to create machine-scoped CNG key:

CngKey.Create(CngAlgorithm2.Rsa, "TestKey", new CngKeyCreationParameters
    {
        KeyCreationOptions = CngKeyCreationOptions.MachineKey
    });

I get

System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.NCryptNative.FinalizeKey(SafeNCryptKeyHandle key)
   at System.Security.Cryptography.CngKey.Create(CngAlgorithm algorithm, String keyName, CngKeyCreationParameters creationParameters)

It works when run as administrator, but I need to do this under AD user account without adding this user to local administrators.

What are the exact permissions that grant the right to create CNG keys and where can they be set?

Solution

  • Answer found. User should be granted Modify permission on %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Keys.