This function is used to export cryptographic keys out of a cryptographic service provider (CSP) in a secure manner.
A handle to the key to be exported is passed into the function and the function returns a key Binary Large Object (BLOB) to the caller. This key BLOB can be sent over a nonsecure transport or stored in a nonsecure storage location. The key BLOB is useless until the intended recipient uses the CryptImportKey function on it, which then imports the key into the recipient’s CSP.
At a Glance
| Header file: | Wincrypt.h |
| Windows CE versions: | 2.10 and later |
Syntax
BOOL CRYPTFUNC CryptExportKet( HCRYPTKEY hKey,
HCRYPTKEY hExpKey, DWORD dwBlobType, DWORD dwFlags,
BYTE *pbData, DWORD *pdwDataLen );
Parameters
hKey
[in] Handle to the key to be exported.
hExpKey
[in] Handle to a cryptographic key belonging to the destination user. The key data within the key BLOB created is encrypted by using this key. This ensures that only the destination user will be able to make use of the key BLOB.
Most often, this will be the key exchange public key of the destination user. However, certain protocols in some CSPs require that a session key belonging to the destination user be used for this purpose. (Neither the Microsoft Base Cryptographic Provider or the Microsoft Enhanced Cryptographic Provider currently support this.)
If the key BLOB type specified by dwBlobType is PUBLICKEYBLOB, then this parameter is unused and should be set to zero.
If the key BLOB type specified by dwBlobType is PRIVATEKEYBLOB, then this is typically a handle to a session key that is to be used to encrypt the key BLOB. Some CSPs allow this parameter to be zero, in which case the application should encrypt the private key BLOB manually so as to protect it.
To determine how Microsoft Cryptographic Providers respond to this parameter, see Cryptography.
dwBlobType
[in] Specifies the type of key BLOB to be exported. This must be one of the following constants:
| Constant | Description |
| SIMPLEBLOB | used to transport session keys. |
| PUBLICKEYBLOB | used to transport public keys. |
| PRIVATEKEYBLOB | used to transport public/private key pairs. |
| OPAQUEBLOB | used to store session keys in a Schannel CSP. OPAQUEBLOBs are non-transferrable and must be used within the CSP that generated the BLOB. |
For more information about exchanging cryptographic keys, see Cryptography.
dwFlags
[in] Specifies a bitmask of flags. This parameter is reserved for future use and should always be zero.
pbData
[out] Pointer to a buffer that receives the key BLOB.
This parameter can be NULL to set the size of this information for memory allocation purposes.
pdwcbDataLen
[in/out] Pointer to a variable that specifies the size, in bytes, of the buffer pointed to by the pbData parameter. When the function returns, the variable pointed to by the pdwDataLen parameter contains the number of bytes stored in the buffer.
Note
When processing the data returned in the buffer, applications need to use the actual size of the data returned. The actual size may be slightly smaller than the size of the buffer specified on input. (On input, buffer sizes are usually specified large enough to ensure that the largest possible output data will fit in the buffer.) On output, the variable pointed to by this parameter is updated to reflect the actual size of the data copied to the buffer.
Return Values
TRUE indicates success. FALSE indicates failure. To get extended error information, call GetLastError. Common values for GetLastError are described in the following table. The error values prefaced by "NTE" are generated by the particular CSP you are using.
| Value | Description |
| ERROR_INVALID_HANDLE | One of the parameters specifies an invalid handle. |
| ERROR_INVALID_PARAMETER | One of the parameters contains an invalid value. This is most often an illegal pointer. |
| ERROR_MORE_DATA | If the buffer specified by the pbData parameter is not large enough to hold the returned data, the function sets the ERROR_MORE_DATA code, and stores the required buffer size, in bytes, into the variable pointed to by pdwcbDataLen. |
| NTE_BAD_FLAGS | The dwFlags parameter is nonzero. |
| NTE_BAD_KEY | One or both of the keys specified by hKey and hExpKey are invalid. |
| NTE_BAD_KEY_STATE | You do not have permission to export the key. That is, when the hKey key was created, the CRYPT_EXPORTABLE flag was not specified. |
| NTE_BAD_PUBLIC_KEY | The key BLOB type specified by dwBlobType is PUBLICKEYBLOB, but hExpKey does not contain a public key handle. |
| NTE_BAD_TYPE | The dwBlobType parameter specifies an unknown BLOB type. |
| NTE_BAD_UID | The CSP context that was specified when the hKey key was created cannot be found. |
| NTE_NO_KEY | A session key is being exported and the hExpKey parameter does not specify a public key. |
Example
#include <wincrypt.h>
HCRYPTPROV hProv; // Handle to CSP
HCRYPTKEY hKey; // Handle to session key
HCRYPTKEY hXchgKey; // Handle to receiver's exchange public key
BYTE *pbKeyBlob = NULL;
DWORD dwBlobLen;
...
// Determine the size of the key BLOB and allocate memory.
if(!CryptExportKey(hKey, hXchgKey, SIMPLEBLOB, 0, NULL, &dwBlobLen)) {
printf("Error %x computing BLOB length!\n", GetLastError());
...
}
if((pbKeyBlob = malloc(dwBlobLen)) == NULL) {
printf("Out of memory!\n");
...
}
// Export the key into a simple key BLOB.
if(!CryptExportKey(hKey, hXchgKey, SIMPLEBLOB, 0, pbKeyBlob, &dwBlobLen)) {
printf("Error %x during CryptExportKey!\n", GetLastError());
...
}
See Also