CryptImportKey

The CryptImportKey function is used to transfer a cryptographic key from a key blob to the CSP.

#include <wincrypt.h>
BOOL WINAPI CryptImportKey(
  HCRYPTPROV hProv,  // in
  BYTE *pbData,      // in
  DWORD dwDataLen,      // in
  HCRYPTKEY hPubKey, // in
  DWORD dwFlags,     // in
  HCRYPTKEY *phKey   // out
);

Parameters

hProv
A handle to the application's CSP. An application obtains this handle by using the CryptAcquireContext function.
pbData
The buffer containing the key blob. This key blob was generated by the CryptExportKey function, either by this same application or by another application running on a different computer.

This key blob consists of a standard header followed by the encrypted key.

dwDataLen
The length, in bytes, of the key blob.
hPubKey
The meaning of this parameter differs, depending on the CSP type and the type of key blob being imported.

If a signed key blob is being imported, this key is used to validate the signature of the key blob. In this case, this parameter should contain a handle to the key exchange public key of the party that created the key blob.

If the key blob is encrypted with the key exchange key pair (for example, a SIMPLEBLOB), then this parameter may be the handle to the key exchange key.

If the key blob is encrypted with a session key (for example, an encrypted PRIVATEKEYBLOB), then this parameter should contain a handle to this session key.

If the key blob is not encrypted (for example, a PUBLICKEYBLOB), then this parameter is not used, and should be zero.

dwFlags
The flag values. This parameter is currently used only when a public/private key pair is being imported into the CSP (in the form of a PRIVATEKEYBLOB). In this case, if the key being imported is eventually to be re-exported, then the CRYPT_EXPORTABLE flag must be placed in this parameter. If this flag is not used then calls to CryptExportKey with the key handle will fail.

CRYPT_NO_SALT. Specifies that a no-salt value gets allocated for a 40-bit symmetric key. For more information, see Microsoft Cryptographic Providers—Release Notes.

phKey
The address to which the function copies a handle to the key that was imported.

Return Values

If the function succeeds, the return value is TRUE. If it fails, the return value is FALSE. To retrieve extended error information, use the GetLastError function.

The following table lists the error codes most commonly returned by the GetLastError function. The error codes prefaced by "NTE" are generated by the particular CSP you are using.

Error code Description
ERROR_INVALID_HANDLE One of the parameters specifies an invalid handle.
ERROR_INVALID_PARAMETER One of the parameters contains an invalid value. This is most often an illegal pointer.
NTE_BAD_ALGID The simple key blob you are trying to import is not encrypted with the expected key exchange algorithm.
NTE_BAD_DATA Either the algorithm that works with the public key you are trying to import is not supported by this CSP, or an attempt was made to import a session key that was encrypted with something other than one of YOUR public keys.
NTE_BAD_FLAGS The dwFlags parameter is nonzero.
NTE_BAD_TYPE The key blob type is not supported by this CSP and is possibly invalid.
NTE_BAD_UID The hProv parameter does not contain a valid context handle.
NTE_BAD_VER The key blob's version number does not match the CSP version. This usually indicates that the CSP needs to be upgraded.

Example

#include <wincrypt.h>

FILE *hSourceFile = NULL;
HCRYPTPROV hProv = 0;
HCRYPTKEY hKey = 0;
BYTE *pbKeyBlob = NULL;
DWORD dwBlobLen;

// Open the file, getting the file handle 'hSourceFile'.
...

// Get a handle to the default provider.
if(!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, 0)) {
    printf("Error %x during CryptAcquireContext!\n", GetLastError());
    goto done;
}

// Read the key blob length from the file and allocate memory.
fread(&dwBlobLen, sizeof(DWORD), 1, hSourceFile);
pbKeyBlob = malloc(dwBlobLen);

// Read the key blob from the file.
fread(pbKeyBlob, 1, dwBlobLen, hSourceFile);

// Import the key blob into the CSP.
if(!CryptImportKey(hProv, pbKeyBlob, dwBlobLen, 0, 0, &hKey)) {
    printf("Error %x during CryptImportKey!\n", GetLastError());
    free(pbKeyBlob);
    goto done;
}

// Free memory.
free(pbKeyBlob);

// Use 'hKey' to perform cryptographic operations.
...

done:

// Destroy the session key.
if(hKey) CryptDestroyKey(hKey);

// Release the provider handle.
if(hProv) CryptReleaseContext(hProv, 0);

Another example is located in Sender Code Example.

QuickInfo

  Windows NT: Requires version 4.0 or later.
  Windows: Requires Windows 95 OSR2 or later (or Windows 95 with IE 3.02 or later).
  Windows CE: Unsupported.
  Header: Declared in wincrypt.h.
  Import Library: Use advapi32.lib.

See Also

CryptAcquireContext, CryptDestroyKey, CryptExportKey