# Analysis of Key Storage Mechanism of Asymmetric Key-Related Functions in CNG Crypto Library
## 1 Introduction  
Data protection technology using cryptography is an essential element for e-commerce, privacy protection, etc. [1; 2; 3]. Many organizations and companies have deployed cryptographic libraries to support the implementation of cryptographic systems, and these are often referred to as cryptographic APIs. There are many kinds of cryptographic libraries, and the current representative industry cryptography libraries are PKCS#11 of RSA and CAPI of Microsoft, which are applied to various cryptographic application systems. In particular, the industry needs to satisfy these requirements for hardware-dependent products, such as smart cards, USB tokens, and hardware security modules, because hardware security products require interoperability with cryptographic libraries. However, PKCS#11 and CAPI were designed without considering scalability, so this causes a problem for the development of a new library when new requirements are met. In the case of PKCS#11, this can be extended in various ways due to the source code being open to the public. Nevertheless, excessive transformation causes a problem. In the case of CAPI, it provides an SCP structure for scalability. However, CAPI also has problems in terms of cost and reliability since this is not a plug-in method provided in the existing infrastructure [4; 5].  
Thus, early-developed and relatively distributed existing libraries do not keep up with the diversification and rapid change in the execution environment, including the hardware platform, operating system, etc. This problem is caused by structural problems in library design. In particular, Microsoft has dominated the commercial operating market, and its operating system was rapidly upgraded to Vista, Windows 7, and Windows 8 in a short period of time, which led to the agility of CAPI. Microsoft released Cryptography API: Next Generation (CNG) to solve this problem [6]. CNG supports the latest cryptographicalgorithms, kernel mode, and audit functions as a next-generation cryptographic library, and in particular, to compensate for the disadvantages of capital, agility is provided as the most important feature to flexibly cope with new requirements or environmental changes [7].  
On the other hand, there is no verification tool to verify execution results for developers, users, or cryptographic system engineers using CNG. Moreover, CNG has difficulty proving keys in real-time processing because it performs functions through a handle that deals with cryptography-related operations, such as encryption and decryption [8]. Accordingly, it is necessary to trace the position where the encryption and decryption keys are stored from the handle so that the information about the key used for encryption and decryption can be confirmed. However, sufficient research of this kind has not previously been reported. Therefore, in this paper, we analyze the key storage mechanism in the NCrypt library of the CNG library. In detail, this is a study on the method for checking key information in real-time processing of the implemented program to verify the safety of the implemented product and debugging during the development process. To perform this, we analyze the programming techniques that utilize the CNG library and implement sample programs based on the analysis results. After that, we also analyze the key storage mechanism by reverse engineering based on the implemented programs. Finally, in this paper, we propose a method to verify the keys used by developers in real-time processing.