Skip to content

v1.3.0 - KeyGuard key demo (create / list / non-exportable)

Choose a tag to compare

View all tags
@gladjohn gladjohn released this 30 Jun 12:14
v1.3.0
5c58c3f

New: option 1 - KeyGuard key demo (the hardware-protected key behind token binding):

  • 1A create a VBS-isolated CNG RSA-2048 key named 'DemoKeyGuardKey' (distinct from MSAL's own key)
  • 1B list it (shows export policy = None, KeyGuard-protected = True via the 'Virtual Iso' property)
  • 1C try to export the private key -> BLOCKED (the key never leaves the VBS enclave)

Menu renumbered: 1 KeyGuard, 2 Classic bearer, 3 MSAL, 4 Identity Web, 5 AKV SDK, 6 all bound, 0 exit.
Targets net8.0-windows for the CNG/KeyGuard APIs. Requires a Trusted Launch / Confidential VM with VBS+KeyGuard.

Assets 3
Loading