New: Ncryptopenstorageprovider

NCryptOpenStorageProvider is the mandatory first step when working with CNG key storage. It provides a clean, vendor‑neutral way to access both software and hardware cryptographic key stores. By understanding its parameters, lifetime rules, and relationship with other CNG functions, developers can build secure, robust key management into Windows applications.

For the most current information, always refer to the official Microsoft CNG documentation and the headers ncrypt.h and winerror.h.

Finally, the new command outputs a YAML manifest. Example: ncryptopenstorageprovider new

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ncrypt-gold
provisioner: com.openstorage/ncrypt
parameters:
  backend: "pxd"
  encryption: "true"
  kms: "vault"
  reclaimPolicy: "cryptshred"  # Deletion does not delete keys

ncryptopenstorageprovider new --provider-type aws-ebs --encryption AES-256 --key-id arn:aws:kms:...

When you create a persisted key, NCryptCreatePersistedKey only sets up the key object. You must call NCryptFinalizeKey to actually generate the key material and store it. For the most current information, always refer to

When using NcryptOpenStorageProvider New (or any variant), you will inevitably encounter errors. Here is how to diagnose them:

| Error Code | Meaning | Solution | | :--- | :--- | :--- | | NTE_BAD_FLAGS (0x80090009) | Invalid flags passed. | Ensure the flags you are using are bitwise OR-compatible. Do not pass legacy CAPI flags. | | NTE_NOT_SUPPORTED (0x80090029) | The provider does not support a "New" isolated context. | Fall back to the standard open; some legacy smart card providers only allow one handle. | | HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) | Access denied. | The current user lacks permission to open that storage provider. Run as Administrator or adjust KSP permissions. | | NTE_NO_MEMORY | Out of memory. | The system could not allocate the new provider structure. Close handles elsewhere in the application. | dwFlags (In) Reserved for future use

| Operation | No Encryption (ext4) | LUKS + ext4 | ncryptosp (aes-256-gcm) | | :--- | :--- | :--- | :--- | | Sequential Write (1MB blocks) | 450 MB/s | 210 MB/s | 380 MB/s | | Random Read (4KB) | 45k IOPS | 22k IOPS | 41k IOPS | | Volume Creation Time (100GB) | 0.2s | 12s (format) | 1.4s | | Memory Overhead per volume | 0 MB | 256 MB (dm-crypt) | 18 MB |

Note: Gains are due to direct block encryption without passing through the device mapper layer.

If you suspect you are misusing a handle, use the helper function NCryptIsKeyHandle to verify it’s a valid key handle (not a provider handle).