How to Configure Windows Sandbox Cryptography Key Storage Provider (KSP) via XML in Windows 11

Modern Windows cryptographic operations rely on Cryptography Next Generation (CNG) architecture, which replaces legacy CryptoAPI (CAPI) with modular Cryptographic Key Storage Providers (KSP). CNG KSPs—such as the Microsoft Software Key Storage Provider, Microsoft Platform Crypto Provider (TPM-backed), and Microsoft Smart Card Key Storage Provider—isolate private key material, enforce export restrictions, and manage modern Elliptic Curve Cryptography (ECDSA, ECDH). When developing security middleware, validating certificate enrollment, or testing software that interfaces with smart card tokens, developers can configure and test custom KSP parameters inside Windows Sandbox in Windows 11.

Understanding CNG Key Storage Provider Architecture

CNG decouples cryptographic algorithms from physical key storage:

• Algorithm Providers: Handle mathematical cipher operations (e.g. AES-GCM, RSA, ECDSA).
• Key Storage Providers (KSP): Manage the lifecycle, persistence, hardware isolation, and PIN protection of asymmetric private keys.
• Smart Card KSP: Interfaces with smart card mini-drivers to perform hardware-bound signing operations without ever exposing private key bytes to operating system RAM.

Authoring the KSP Registration Provisioning Script

Create a dedicated host folder (e.g. C:\SandboxKSPTest) and save a PowerShell provisioning script named InitKSP.ps1:

# InitKSP.ps1 - Configure CNG Key Storage Provider testing environment inside Windows Sandbox
Write-Host "Configuring Cryptography Next Generation (CNG) Key Storage Provider..." -ForegroundColor Cyan

# 1. Ensure CNG isolation services are running
Start-Service -Name "KeyIso"
Set-Service -Name "KeyIso" -StartupType Automatic
Write-Host "CNG Key Isolation Service (KeyIso) started." -ForegroundColor Green

# 2. Register Custom KSP in Cryptography Configuration Registry
$kspRegPath = "HKLM:SOFTWAREMicrosoftCryptographyDefaultsProviderCustom Security KSP"
if (-not (Test-Path $kspRegPath)) { New-Item -Path $kspRegPath -Force | Out-Null }

Set-ItemProperty -Path $kspRegPath -Name "Image Path" -Value "CustomKsp.dll" -Type String
Set-ItemProperty -Path $kspRegPath -Name "Type" -Value 1 -Type DWord

# 3. Test CNG Provider Enumeration
Write-Host "Enumerating registered CNG Providers via certutil:" -ForegroundColor Yellow
certutil -csplist

Write-Host "KSP environment configuration complete." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named KspSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxKSPTest</HostFolder>
      <SandboxFolder>C:KSPShare</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:KSPShareInitKSP.ps1</Command>
  </LogonCommand>
</Configuration>

Testing Key Generation and Cryptographic Operations Inside the Sandbox

To verify that CNG KSP operations function correctly inside Windows Sandbox:

1. Double-click KspSandbox.wsb to boot the virtual container.
2. The PowerShell window starts KeyIso and displays the list of registered CNG providers.
3. Generate a modern ECDSA P-256 test key using CNG cmdlets in PowerShell:

   $cngKey = [System.Security.Cryptography.CngKey]::Create([System.Security.Cryptography.CngAlgorithm]::ECDsaP256)
   Write-Host "Generated test CNG Key: $($cngKey.KeyName)"

4. Verify that the key is stored under the default KSP without errors.
5. Perform test signing and signature verification operations inside the sandbox to ensure hardware-independent cryptographic validation works as expected.