cryptography – Windows CNG Does Keystore support exporting a key or key pair in encrypted text?

As Windows CNG Keystorage offers an API to export keys (pairs):

SECURITY_STATUS NCryptExportKey(
  /* The handle of the key(pair) to export */
  NCRYPT_KEY_HANDLE hKey,
  /* The handle of a key to encrypt exported key(pair) */
  NCRYPT_KEY_HANDLE hExportKey,
  LPCWSTR           pszBlobType,
  NCryptBufferDesc  *pParameterList,
  PBYTE             pbOutput,
  DWORD             cbOutput,
  DWORD             *pcbResult,
  DWORD             dwFlags
);

It seems that the exported key blob could be encrypted with hExportKey, but I did not find any definition of the encrypted text format. For example, to export a DH key pair by setting the parameter pszBlobType at BCRYPT_DH_PRIVATE_BLOB, the manual has just said ambiguously

Export a Diffie-Hellman public / private key pair. The pbOutput buffer
receives a BCRYPT_DH_KEY_BLOB structure immediately followed by the
key data.

And the BCRYPT_DH_KEY_BLOB is defined as follows:

typedef struct _BCRYPT_DH_KEY_BLOB {
  ULONG dwMagic;//BCRYPT_DH_PUBLIC_MAGIC or BCRYPT_DH_PRIVATE_MAGIC
  ULONG cbKey;//The length, in bytes, of the key
} BCRYPT_DH_KEY_BLOB, *PBCRYPT_DH_KEY_BLOB;

As the structure above is a header followed by actual data from contiguous memory, the BCRYPT_DH_PRIVATE_BLOB (also the key data mentioned above) is composed as

BCRYPT_DH_KEY_BLOB
Modulus(cbKey) // Big-endian.
Generator(cbKey) // Big-endian.
Public(cbKey) // Big-endian.
PrivateExponent(cbKey) // Big-endian.

Now I wonder that:

Because Keystore does not support symmetric key generation and storage, the parameter hExportKey of NCryptExportKey really valid?

If yes:

  1. Where does the exportKey come from?

  2. What format does it BCRYPT_DH_PRIVATE_BLOB to be encrypted at? Just
    an unreadable blob with about cbKey * 4 bytes?