cryptohub-cng.dll) lets Windows applications perform cryptographic operations against CryptoHub-managed keys. It exposes those keys through the standard Windows CNG (Cryptography API: Next Generation) NCrypt interface. Once the provider is registered on the machine and cryptohub.json is in place, applications open the registered provider Futurex CryptoHub Key Storage Provider by name and use CryptoHub-backed keys through normal NCrypt calls. This makes CryptoHub available to the standard Windows key ecosystem, including Authenticode code signing (SignTool and PowerShell Set-AuthenticodeSignature), TLS through the Windows certificate store, and ADCS- and Intune-family certificate services.
The provider reaches CryptoHub over the CryptoHub v2 REST API on port 443, and it exposes post-quantum ML-DSA and ML-KEM operations alongside classical RSA, ECC, and symmetric algorithms.
This guide documents the CryptoHub Client Library CNG provider (
cryptohub-cng.dll), configured with cryptohub.json. It is the CNG sibling of the Linux CryptoHub PKCS#11 module (libcryptohub-pkcs11.so); both belong to the CryptoHub Client Library family, reach CryptoHub over the same REST transport, and share a single cryptohub.json file.Choosing the right CNG provider
Futurex ships more than one Windows CNG provider. They target different backends and are configured differently. Choose the provider that matches your Futurex platform.| Provider | Library | Configuration file | Backend |
|---|---|---|---|
| CryptoHub Client Library CNG (this guide) | cryptohub-cng.dll | cryptohub.json | CryptoHub 7.2 and later, over the v2 REST API |
| FXCL CNG (legacy) | libfxcl-cng.dll | config.json | CryptoHub 7.0.3.x and legacy KMES, over the Host API |
| Futurex CNG (FXCNG / FxclCng) | FXCNG | Host-API configuration | Excrypt HSM, direct Host-API connection |
How the provider is delivered
The provider ships inside the Windows endpoint download, not as a standalone package. You deploy a CryptoHub Client Library CNG service, add a Windows endpoint to it, and download a zip file that contains the provider DLL, its installer and management tools, a pre-filledcryptohub.json, and the TLS material for that endpoint. See Installation for the full workflow.
| Item | Purpose |
|---|---|
cryptohub-cng.dll | The CNG Key Storage Provider that Windows loads after registration. Applications reach CryptoHub-backed keys through this KSP. |
cng-install.exe | Administrator installer that copies and registers the KSP. |
cng-uninstall.exe | Administrator uninstaller that unregisters the KSP. |
cng-manager.exe | Interactive utility for listing, generating, deleting, signing, and verifying keys. |
cryptohub.json | Your deployment configuration for this endpoint, pre-filled with the connection, authentication, and TLS settings. |
| TLS material | The CA and client TLS files the provider uses to reach and authenticate to CryptoHub. |
cryptohub-pkcs11.dll) and its tools; the PKCS#11 module and CLI are not required for the CNG workflow.
How applications find CryptoHub keys
Unlike PKCS#11, CNG applications do not take a module path or a connection URI. Once the Futurex CryptoHub Key Storage Provider is registered on the machine, applications find the CryptoHub-backed key implicitly. They locate it through a certificate in the Windows certificate store whose private-key reference (CERT_KEY_PROV_INFO) names the CryptoHub provider. When Windows resolves that key reference, it routes the private-key operation through the provider to CryptoHub, and any CNG-aware application can use the key without further configuration. The private key never leaves CryptoHub.
Supported platforms
The provider is a Windows Key Storage Provider and runs on Windows only. For non-Windows hosts, use the CryptoHub PKCS#11 module instead.Documentation structure
This guide walks you through installing, configuring, and using the CryptoHub Client Library CNG provider.- Installation: Deploy the service, provision a Windows endpoint, install and register the provider, and verify it reaches CryptoHub.
- Configuration: Configure the
cngblock and the sharedcryptohub.jsonsettings, including key protection and default usages. - Troubleshooting: Diagnose registration, configuration, connectivity, authentication, and key-protection problems.
- Appendix A: Reference the algorithms the provider supports.