> ## Documentation Index > Fetch the complete documentation index at: https://docs.futurex.com/llms.txt > Use this file to discover all available pages before exploring further. # FXCL application-encryption API reference > Reference for the FXCL 1.9.5 C++ and Java classes used with CryptoHub key stores, encryption, decryption, tokenization, and profiles. This reference lists the FXCL 1.9.5 C++ and Java APIs used for CryptoHub application encryption. ## Installed artifacts | Artifact | Default Linux location | Purpose | | -------------- | ------------------------------- | ----------------------------- | | C++ headers | `/usr/include/fxcl/` | Native API declarations | | Shared library | `/usr/lib/libfxcl.so` | Native FXCL implementation | | Static library | `/usr/lib/libfxcl-static.a` | Static native linking | | Java archive | `/usr/share/java/fxcl-java.jar` | Java classes and JNI bindings | | C++ examples | `/usr/share/doc/fxcl/examples/` | Packaged C++ examples | ## Connection and authentication | Task | C++ API | Java API | Description | | -------------------- | ----------------------------------- | ---------------------------------------- | ------------------------------------------------------ | | Initialize FXCL | `fxcl::Init` | `com.futurex.fxcl.JniInit` | Initializes the native library. | | Connect to CryptoHub | `fxcl::kmes::KeyServer` | `com.futurex.fxcl.kmes.server.KeyServer` | Connects to the Native Host API. | | Configure TLS | `fxcl::tls::Config` | `com.futurex.fxcl.tls.Config` | Selects TLS protocols and client-certificate behavior. | | Load TLS trust | `fxcl::tls::Credential` | `com.futurex.fxcl.tls.Credential` | Loads CA, certificate, key, and CRL material. | | Set an API key | `fxcl::ExcryptSender::setAuthToken` | `ExcryptMessage` with `RKLO` | Establishes Client Application authentication. | | Password login | `fxcl::kmes::UserLogin` | `com.futurex.fxcl.kmes.server.UserLogin` | Logs in with a CryptoHub user identity. | | PKI login | `fxcl::kmes::PkiLogin` | `com.futurex.fxcl.kmes.server.PkiLogin` | Logs in with a PKI identity. | | JWT login | `fxcl::kmes::JwtLogin` | `com.futurex.fxcl.kmes.server.JwtLogin` | Logs in with a JSON Web Token. | ## Key-store management | Task | C++ API | Java API | | ----------------------------------------------------- | ----------------------------- | --------------------------------------------- | | Describe a store | `fxcl::kmes::KeyStoreInfo` | `com.futurex.fxcl.kmes.store.KeyStoreInfo` | | Create, retrieve, enumerate, rotate, or delete stores | `fxcl::kmes::KeyStoreManager` | `com.futurex.fxcl.kmes.store.KeyStoreManager` | | Access a store and its active key | `fxcl::kmes::KeyStore` | `com.futurex.fxcl.kmes.store.KeyStore` | | Describe a key | `fxcl::KeyInfo` | `com.futurex.fxcl.crypto.KeyInfo` | | Use a retrieved symmetric key | `fxcl::SecretKey` | `com.futurex.fxcl.crypto.FxSecretKey` | | Cache keys by store | `fxcl::KeyCache` | `com.futurex.fxcl.crypto.KeyCache` | | Register keys by name | `fxcl::KeyRegistry` | `com.futurex.fxcl.crypto.KeyRegistry` | ### KeyStoreInfo fields | Field | Type | Description | | ---------------- | ----------- | --------------------------------------------------------------------- | | `name` | string | Key-store name. | | `parent` | string | Optional parent store or group. | | `rotationPeriod` | time period | Automatic rotation interval. | | `keyAlgo` | `KeyAlgo` | Key algorithm, such as AES. | | `keyUsage` | `KeyUsage` | Permitted key purpose, such as `DEK`, `Encrypt`, or `Decrypt`. | | `keyBits` | integer | Key size in bits. | | `retrievable` | boolean | Whether FXCL can retrieve the active key for a client-side operation. | ## Local symmetric cryptography | Task | C++ API | Java API | | ----------------- | ----------------------- | ----------------------------------------- | | Encryption | `fxcl::Encrypt` | `com.futurex.fxcl.crypto.Encrypt` | | Decryption | `fxcl::Decrypt` | `com.futurex.fxcl.crypto.Decrypt` | | Cipher parameters | `fxcl::SymCipherParams` | `com.futurex.fxcl.crypto.SymCipherParams` | | Block mode | `fxcl::BlockCipherMode` | `com.futurex.fxcl.crypto.BlockCipherMode` | | Padding | `fxcl::Padding` | `com.futurex.fxcl.crypto.Padding` | FXCL 1.9.5 exposes `ECB`, `CBC`, and `OFB` through `BlockCipherMode`. AES-CBC with PKCS #7 padding is the validated local application-encryption path in this guide. ## CryptoHub-backed cryptography | Task | C++ API | Java API | | -------------------- | ------------------------------------------ | -------------------------------------------------- | | Symmetric encrypt | `fxcl::kmes::RemoteEncrypt` | `com.futurex.fxcl.kmes.crypto.RemoteEncrypt` | | Symmetric decrypt | `fxcl::kmes::RemoteDecrypt` | `com.futurex.fxcl.kmes.crypto.RemoteDecrypt` | | Operation parameters | `fxcl::kmes::RemoteEncrypt` configuration | `com.futurex.fxcl.kmes.crypto.RemoteEncryptParams` | | RSA encrypt/decrypt | `RemoteRsaEncrypt`, `RemoteRsaDecrypt` | `RemoteRsaEncrypt`, `RemoteRsaDecrypt` | | ECC encrypt/decrypt | `RemoteEciesEncrypt`, `RemoteEciesDecrypt` | `RemoteEciesEncrypt`, `RemoteEciesDecrypt` | | Derive a key | `RemoteDeriveKey` | Corresponding Java KMES crypto binding | A DPM header can carry the key and cipher context required for later decryption. ## Tokenization and format-preserving encryption | Task | C++ API | Java API | | --------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------ | | Local tokenize/detokenize | `fxcl::Tokenize` | `com.futurex.fxcl.fpe.Tokenize` | | Profile parameters | `fxcl::TokenizeParams` | `com.futurex.fxcl.fpe.TokenizeParams` | | Character namespace | `fxcl::FpeNamespace` | `com.futurex.fxcl.fpe.FpeNamespace` | | Algorithm selection | `fxcl::FpeAlgo` | `com.futurex.fxcl.fpe.FpeAlgo` | | FF3-1 operation | `fxcl::FF3_1` | `com.futurex.fxcl.fpe.FF3_1` | | Remote tokenize/detokenize | `fxcl::kmes::RemoteTokenize` | `com.futurex.fxcl.kmes.token.RemoteTokenize` | | Remote operation parameters | Remote profile name and optional key | `com.futurex.fxcl.kmes.token.RemoteTokenizeParams`; use a new profile-only instance for detokenization | | Describe a profile | `fxcl::kmes::TokenProfile` | `com.futurex.fxcl.kmes.token.TokenProfile` | | Manage profiles | `fxcl::kmes::TokenProfileManager` | `com.futurex.fxcl.kmes.token.TokenProfileManager` | In FXCL 1.9.5, do not reuse the Java `RemoteTokenizeParams` instance that completed tokenization. Its selected-key state can produce an empty detokenization response. ### TokenProfile fields | Field | Type | Description | | -------------- | ---------------- | ------------------------------------------------------------------------- | | `name` | string | Profile name. | | `clientSide` | boolean | `true` for a local operation; `false` for a CryptoHub-backed operation. | | `keyStore` | string | Associated CryptoHub key store. | | `key` | string | Explicit active key name. Set this field for the server-side profile. | | `verifyLength` | integer | Number of verification characters. Use `0` when verification is disabled. | | `params` | `TokenizeParams` | Algorithm, character namespace, masking, preservation, and Luhn settings. | ### TokenizeParams fields | Field | Description | | ------------------ | ------------------------------------------------------------------------- | | `algo` | `FF1`, `FF3_1`, or `FxCmac` as supported by the selected execution model. | | `namespace` | Allowed character set for format-preserving encryption. | | `luhn` | Enables Luhn-aware processing. | | `staticLeading` | Fixed leading characters. | | `maskedLength` | Number of masked characters. | | `preserveLeading` | Number of leading characters left unchanged. | | `preserveTrailing` | Number of trailing characters left unchanged. | ## Host API commands | Area | Commands used by the FXCL implementation | | ----------------------- | ------------------------------------------------------ | | Login | `RKLO` | | Key-store lifecycle | `RKLN`, `RKCS`, `RKCK`, `RKES`, `RKVS`, `RKDS`, `RKRG` | | Remote encryption | `RKED` | | Token-profile lifecycle | `TKGA`, `TKGG`, `TKGD` | | Remote tokenization | `TOKA`, `TOKG` | Enable only the commands the application uses. ## Related pages * [Install and authenticate FXCL](./install-and-authenticate) * [Manage keys and encrypt with C++](./manage-keys-and-encrypt-with-cpp) * [Manage keys and encrypt with Java](./manage-keys-and-encrypt-with-java) * [Configure tokenization profiles](./configure-tokenization-profiles) ## Related topics - [Quick Reference](/Integrations/KMES_Series_3/DNS/BIND/Quick_Reference.md) - [File Encryption Agent GUI Reference](/Integrations/KMES_Series_3/Generic/File_encryption/File_Encryption_Agent_GUI_Reference.md) - [File Encryption Agent configuration reference](/Integrations/KMES_Series_3/Generic/File_encryption/File_Encryption_Agent_configuration_reference.md) - [Create an application partition for Futurex PKCS #11](/Integrations/HSM/Generic/Generic_Futurex_PKCS_11/Configure_the_Vectera_Plus/Create_an_application_partition_for_Futurex_PKCS_11.md) - [Configure KMES Series 3](/Integrations/KMES_Series_3/Endpoint_management/Microsoft_Intune/Configure_KMES_Series_3.md)