2.2.2 IIS_CRYPTO_BLOB

  • Article

The IIS_CRYPTO_BLOB message defines a block of data, possibly encrypted, that is transferred between client and server. It is used to transfer public keys, hash information, and encrypted and cleartext data.

 typedef struct _IIS_CRYPTO_BLOB{
     DWORD BlobSignature;
     DWORD BlobDataLength;
     [size_is(BlobDataLength)] unsigned char BlobData[*];
 } IIS_CRYPTO_BLOB;

BlobSignature: The structure signature for this binary large object (BLOB).

Value

Meaning

SESSION_KEY_BLOB_SIGNATURE

0x624b6349

The BlobData member contains the session key used to encrypt sensitive data exchanged between client and server. See SESSION_KEY_BLOB (section 2.2.2.2) for more information about the BlobData layout.

PUBLIC_KEY_BLOB_SIGNATURE

0x62506349

The BlobData member contains the public key for a particular IIS encryption behavior. See PUBLIC_KEY_BLOB (section 2.2.2.1) for more information about the BlobData layout.

ENCRYPTED_DATA_BLOB_SIGNATURE

0x62446349

The BlobData member contains encrypted data. See ENCRYPTED_DATA_BLOB (section 2.2.2.5) for more information about the BlobData layout.

HASH_BLOB_SIGNATURE

0x62486349

The BlobData member contains a hash. See HASH_BLOB (section 2.2.2.3) for more information about the BlobData layout.

CLEARTEXT_DATA_BLOB_SIGNATURE

0x62436349

The BlobData member contains cleartext data. See CLEARTEXT DATA_BLOB (section 2.2.2.4) for more information about the BlobData layout.

BlobDataLength: The size, in bytes, of BlobData.

BlobData: A block of bytes that can be interpreted based on BlobSignature.