The NCryptOpenStorageProvider function is a core part of the Windows Cryptography Next Generation (CNG) API. It is used to load and initialize a Key Storage Provider (KSP), which is essential for managing and using persistent cryptographic keys on a Windows system. Core Functionality

SECURITY_STATUS NCryptOpenStorageProvider(
  [out] NCRYPT_PROV_HANDLE *phProvider,
  [in]  LPCWSTR            pszProviderName,
  [in]  DWORD              dwFlags
);

ncryptopenstorageprovider new --tenant="client_a" --kms-path="secret/client_a" --volume-prefix="client_a_"
ncryptopenstorageprovider new --tenant="client_b" --kms-path="secret/client_b"

The NCryptOpenStorageProvider function loads and initializes a CNG key storage provider. Unlike the legacy CryptoAPI, which bundled algorithms and storage together, CNG separates these concerns. A KSP acts as a specialized "container" for private keys, ensuring they remain isolated from the application process. Syntax at a Glance CNG Key Storage Providers - Win32 apps | Microsoft Learn

Storing an Application’s RSA Signing Key
Open MS_KEY_STORAGE_PROVIDER, create a persisted key container, and use it to sign software updates.

With that, the connection was severed. The handle returned to a null state, the provider unloaded its context from his specific thread, and the vault door clicked shut.