如何提取UWP应用通过KeyCredentialManager生成的公钥？

Great question—let's break this down based on the Windows UWP security model and how KeyCredentialManager works:

For your own application #

Absolutely. The UWP API explicitly allows your app to retrieve the public key associated with a KeyCredential you've created. Here's how:

After creating a key pair via KeyCredentialManager.RequestCreateAsync, you can use the RetrievePublicKeyAsync method on the resulting KeyCredential object to get the raw public key bytes. You can then process these bytes (like calculating their hash, as you mentioned) or store them as needed.

Example code snippet:

var createResult = await KeyCredentialManager.RequestCreateAsync("MyAppSecretKey", KeyCredentialCreationOption.ReplaceExisting);
if (createResult.Status == KeyCredentialStatus.Success)
{
    KeyCredential credential = createResult.Credential;
    IBuffer publicKeyBuffer = await credential.RetrievePublicKeyAsync();
    byte[] publicKeyBytes = publicKeyBuffer.ToArray();
    
    // Use the public key bytes here (e.g., compute hash, encrypt data)
}

Note that the private key remains locked in the TPM and cannot be exported—this is by design to maintain security.

For another application's public key #

No, you cannot retrieve the public key of a KeyCredential owned by another application through legitimate means. Here's why:

• The KeyCredential system enforces strict package identity isolation. Each app's key container is tied to its unique package SID (security identifier), and Windows blocks cross-app access to these containers at the system level.
• Even with administrative privileges, you can't bypass this restriction. The TPM itself binds the key pair to the app's identity, so it will only allow the owning app to access the public key (and use the private key for operations like signing).

This isolation is exactly what makes the TPM-backed KeyCredential approach secure—applications can't snoop on each other's credential material.

内容的提问来源于stack exchange，提问作者Chris Berland