README
¶
Keppin-OSS CNG
Windows CNG machine-key custody for Go applications.
cng is a standalone Go module exposing the windowscng package for working
with persisted, machine-scoped ECDSA P-256 keys backed by the Microsoft Software
Key Storage Provider.
Private-key operations remain inside Windows CNG. The package exposes signing
through Go's crypto.Signer interface and does not provide an API for exporting
private-key material.
The module is intentionally low-level. It does not define application identity, certificate enrollment, trust management, or provisioning workflows.
Scope
Use this module when an application needs:
- a persisted, machine-scoped ECDSA P-256 key on Windows;
- private-key custody through the Microsoft Software Key Storage Provider;
- signing through the Go
crypto.Signerinterface; - operations on exact, caller-supplied key names;
- validation of key export policy and key access-control configuration.
The caller owns key naming, application identity, provisioning orchestration, certificate lifecycle, and the decision to delete a persisted key.
The module does not implement certificate enrollment, certificate-store management, application authorization, network-overlay integration, key enumeration, wildcard deletion, private-key export, or a PEM fallback.
Resources
- Documentation — Complete API reference, security model, lifecycle guidance, and validation instructions.
- Examples — Runnable examples showing the main package workflows.
- Package source — Source code and tests for the
windowscngpackage.
Directories
¶
| Path | Synopsis |
|---|---|
|
examples
|
|
|
disposablelifecycle
command
Command disposablelifecycle demonstrates the full create/use/close/delete lifecycle with a uniquely generated, example-owned disposable container name.
|
Command disposablelifecycle demonstrates the full create/use/close/delete lifecycle with a uniquely generated, example-owned disposable container name. |
|
openexisting
command
Command openexisting demonstrates opening an exact existing machine-scoped key with windowscng.Open and correct ErrKeyNotFound handling.
|
Command openexisting demonstrates opening an exact existing machine-scoped key with windowscng.Open and correct ErrKeyNotFound handling. |
|
signverify
command
Command signverify demonstrates the shortest correct consumer flow against a disposable machine-scoped key: acquire a signer with LoadOrCreate, register cleanup immediately, sign through crypto.Signer, and verify using public material only.
|
Command signverify demonstrates the shortest correct consumer flow against a disposable machine-scoped key: acquire a signer with LoadOrCreate, register cleanup immediately, sign through crypto.Signer, and verify using public material only. |
|
Package windowscng provides shared Windows CNG/KSP machine-key primitives for Keppin.
|
Package windowscng provides shared Windows CNG/KSP machine-key primitives for Keppin. |