BCryptExportKey

The BCryptExportKey function exports a key to a memory BLOB that can be persisted for later use.

Syntax

NTSTATUS BCryptExportKey(
         BCRYPT_KEY_HANDLE hKey,
         BCRYPT_KEY_HANDLE hExportKey,
         LPCWSTR pszBlobType,
         PUCHAR pbOutput,
         ULONG cbOutput,
         ULONG *pcbResult,
         ULONG dwFlags
)

Parameters

hKey
Type: BCRYPT_KEY_HANDLE

[in] The handle of the key to export.

hExportKey
Type: BCRYPT_KEY_HANDLE

[in, optional]

The handle of the key with which to wrap the exported key. Use this parameter when exporting BLOBs of type BCRYPT_AES_WRAP_KEY_BLOB; otherwise, set it to NULL.

Note

The hExportKey handle must be supplied by the same provider that supplied the hKey handle, and hExportKey must be a handle to a symmetric key that can be used in the Advanced Encryption Standard (AES) key wrap algorithm. When the hKey handle is from the Microsoft provider, hExportKey must be an AES key handle.

Note

This parameter is not used and should be set to NULL.

pszBlobType
Type: LPCWSTR

[in] A null-terminated Unicode string that contains an identifier that specifies the type of BLOB to export. This can be one of the following values.

pbOutput
Type: PUCHAR

[out, optional] The address of a buffer that receives the key BLOB. The cbOutput parameter contains the size of this buffer. If this parameter is NULL, this function will place the required size, in bytes, in the ULONG pointed to by the pcbResult parameter.

cbOutput
Type: ULONG

[in] Contains the size, in bytes, of the pbOutput buffer.

pcbResult
Type: ULONG *

[out] A pointer to a ULONG that receives the number of bytes that were copied to the pbOutput buffer. If the pbOutput parameter is NULL, this function will place the required size, in bytes, in the ULONG pointed to by this parameter.

dwFlags
Type: ULONG

[in] A set of flags that modify the behavior of this function. No flags are defined for this function.

Return value

Type: NTSTATUS

Returns a status code that indicates the success or failure of the function.

Return codes

Possible return codes include, but are not limited to, the following.

Return code	Description
STATUS_SUCCESS	The function was successful.
STATUS_BUFFER_TOO_SMALL	The size specified by the cbOutput parameter is not large enough to hold the ciphertext.
STATUS_INVALID_HANDLE	The key handle in the hKey parameter is not valid.
STATUS_INVALID_PARAMETER	One or more parameters are not valid.
STATUS_NOT_SUPPORTED	The specified BLOB type is not supported by the provider.

Remarks

Depending on what processor modes a provider supports, BCryptExportKey can be called either from user mode or kernel mode. Kernel mode callers can execute either at PASSIVE_LEVELIRQL or DISPATCH_LEVEL IRQL. If the current IRQL level is DISPATCH_LEVEL, the handle provided in the hKey parameter must be derived from an algorithm handle returned by a provider that was opened with the BCRYPT_PROV_DISPATCH flag, and any pointers passed to the BCryptExportKey function must refer to nonpaged (or locked) memory.

Requirements

Header: Declared in bcrypt.h.

Library: Use bcrypt.lib.