Multi tool use

Always Encrypted with Cng Key in Software KSP

When creating a CNG Key with default settings, it is created in

%APPDATA%MicrosoftCryptoKeys" which maps to "C:Users< username>...


SSMS detects this key in the MEK wizard and all works well. I'm able to encrypt the db and query the data in a Winforms test app. When I try to access the data with a deployed site on the same box with the App Pool running under NetworkService I get this error:

NetworkService

An error occurred while opening the Microsoft Cryptography API: Next Generation (CNG) key: 'Microsoft Software Key Storage Provider/Dev_CngKey'. Verify that the CNG provider name 'Microsoft Software Key Storage Provider' is valid, installed on the machine, and the key 'Dev_CngKey' exists.

Now I know this happens because the key was created with my account. So I opted to create the key with CngKey.IsMachineKey=true. When I try to create the MEK with the wizard, the key does not show in the dialog. I am, however, able to create the MEK manually with a script. But then I run into the above error again when trying to create the CEK.

CngKey.IsMachineKey=true

So my question is this, how do I create a Cng Key for use with Always Encrypted so that it is available to the NetworkService for the App Pool as well as other processes running on box (WCF service backend)?

NetworkService

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.