<div class="content" name="Protector_List_Entry" uuid="8593a473-b726-4a19-9291-b8669b535304"><p> </p><p>Each individual Protector List Entry MUST be formatted as
follows. </p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">EFSX_Datum</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="16">ProtectorType</td>
  <td colspan="16">ProtectorFlags</td>
 </tr>
 <tr>
  <td colspan="32">Data_Fields (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
</tbody></table><p><b>EFSX_Datum (8 bytes): </b>MUST be formatted as
specified in section <a href="1d2fa232-d557-43fe-95e3-2d4ced7f7934" data-linktype="relative-path">2.2.2.2.2</a>.
The datum <b>Type</b> MUST be EFSX_TYPE_KEY_PROTECTOR (0x0003) and SHOULD have
a <b>Role</b> of EFSX_ROLE_IGNORE (0x0000). The datum <b>Flags</b> SHOULD
include 0x0002 indicating a complex datum.</p><p><b>ProtectorType (2 bytes): </b>The type of the
protector. It MUST be a 16-bit unsigned integer in little-endian format.
Possible values are specified below.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x0001</td>
  <td>The protector was derived from a public/private key pair using a key agreement. The Data Fields SHOULD include an EFSX_Datum of Type EFSX_TYPE_KEY_AGMT_DATA (0x0005) and Role 0x0002.</td>
 </tr><tr>
  <td>0x0002</td>
  <td>The protector was derived from a public/private key pair capable of performing asymmetric encryption. The Data Fields SHOULD include an EFSX_Datum of Type EFSX_TYPE_BLOB (0x0001) and Role 0x0002.</td>
 </tr><tr>
  <td>0x0003</td>
  <td>The protector was derived using a DPAPI-NG encryption provider on the endpoint. The Data Fields SHOULD include an EFSX_Datum of Type EFSX_TYPE_DPAPI_NG_DATA (0x0007) and Role 0x0002.</td>
 </tr></tbody></table>
</dd></dl><p><b>ProtectorFlags (2 bytes): </b>The flags for the
protector. It MUST be a 16-bit unsigned integer in little-endian format. The
value MUST be 0x0000 or a union of one or more of the following values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x0001</td>
  <td>The protector is a legacy protector, and stores the Encrypted FEK as specified in section 2.2.2.1.5.</td>
 </tr><tr>
  <td>0x0002</td>
  <td>If this is a legacy protector (flag 0x0001 is also set), the Encrypted FEK is encrypted using AES 256, with a key that is obtained by signing the non-terminated Unicode string &#34;MICROSOFTE&#34; (20 bytes long) with the user&#39;s RSA and computing the SHA-256 hash of the result.</td>
 </tr><tr>
  <td>0x0004</td>
  <td>If this bit is set, bit 0x0001 MUST also be set to indicate a legacy protector. This bit indicates that the legacy protector stores the File Master Key (FMK) encrypted in the Encrypted FEK structure instead of the File Encryption Key (FEK).</td>
 </tr></tbody></table>
</dd></dl><p><b>Data_Fields (variable): </b>This field contains
any number of nested EFSX_Datum structures. The nested datum structures MUST
NOT overlap and MUST be entirely contained within the protector list entry.
This field SHOULD contain a datum with a <b>Role</b> of 0x0002 (protector data)
and a datum with a <b>Type</b> of EFSX_TYPE_PROTECTOR_INFO (0x0004).</p></div>