Problem - Kevin Tafuro

Once a provider context has been successfully acquired, you need a key. The API
provides three ways to obtain a key object, which is stored by CryptoAPI as an
opaque object to which you’ll have only a handle:
CryptGenKey( )
Generates a random key.
CryptDeriveKey( )
Derives a key from a password or passphrase.
CryptImportKey( )
Creates a key object from key data in a buffer.
All three functions return a new key object that keeps the key data hidden and has
associated with it a symmetric encryption algorithm and a set of flags that control the
behavior of the key. The key data can be obtained from the key object using
CryptExportKey( ) if the key object allows it. The CryptExportKey( ) and
CryptImportKey( ) functions provide the means for exchanging keys.
The CryptExportKey( ) function will only allow you to export a symmetric
encryption key encrypted with another key. For maximum
portability across all versions of Windows, a public key should be
used. However, Windows 2000 introduced the ability to encrypt the
symmetric encryption key with another symmetric encryption key.
Similarly, CryptImportKey( ) can only import symmetric encryption
keys that are encrypted.
If you need the raw key data, you must first export the key in
encrypted form, then decrypt from it (see Recipe 5.27). While this may
seem like a lot of extra work, the reason is that CryptoAPI was
designed with the goal of making it very difficult (if not impossible) to
unintentionally disclose sensitive information.
Generating a new key with CryptGenKey( ) that can be exported is very simple, as
illustrated in the following code. If you don’t want the new key to be exportable,
simply remove the CRYPT_EXPORTABLE flag.
HCRYPTKEY SpcGetRandomKey(HCRYPTPROV hProvider, ALG_ID Algid, DWORD dwSize) {
DWORD dwFlags;
HCRYPTKEY hKey;
dwFlags = ((dwSize