Search code examples
winapicryptographycng

NCryptOpenStorageProvider + KeyIso

Restarting the service after opening the provider breaks the connection and forces you to restart the entire application.

Step by step:

  1. Open the provider NCryptOpenStorageProvider(myProvider, MS_KEY_STORAGE_PROVIDER, 0) — will be "00000000" (ERROR_SUCCESS)

  2. Restart the CNG Key Isolation service

  3. Reopen the provider NCryptOpenStorageProvider(myProvider, MS_KEY_STORAGE_PROVIDER, 0) — will be "80070006" (ERROR_INVALID_HANDLE)

How to properly reopen the provider after restarting the service without restarting the application?

Solution

  • when you first call

    NCryptOpenStorageProvider(&hProvider, MS_KEY_STORAGE_PROVIDER, 0);

    the ncryptprov.dll is loaded and when it function MsProvCryptOpenProvider_KeyIso called ( it is NCryptOpenStorageProviderFn from NCRYPT_KEY_STORAGE_FUNCTION_TABLE ) first time (the MsProvCryptOpenProvider_KeyIso called every time when you open MS_KEY_STORAGE_PROVIDER ) it call KeyIsoServerBind and cache some handle to KeyIso service. which of course became invalid after service restart. how i view, the KeyIsoServerUnbind (internal function in ncryptprov.dll) called only when ncryptprov.dll is unloaded. and ncrypt byself never unload already loaded providers, even after all handles to it was closed ( via NCryptFreeObject). so really no way fix this without process restart.

    however i note that some windows buil-in components also affected. when i lock workstation and then try unlock it back, by using PIN provider, i got next error enter image description here