FXCL application encryption

The Futurex Client Library (FXCL) gives C++ and Java applications a native object model for CryptoHub key stores, encryption keys, cryptographic operations, and tokenization profiles. FXCL connects to the CryptoHub Native Host API over TLS. This guide covers FXCL 1.9.5 with CryptoHub 7.2.0.x. It is separate from the CryptoHub Client Library PKCS #11 and CNG providers, which connect through the CryptoHub REST API.

​

Explore FXCL application encryption

​

The application encryption model

FXCL supports two execution models: The application always uses CryptoHub to create, identify, rotate, and authorize the key store. The key-store configuration determines whether FXCL can retrieve the active key for a local operation.

​

Connection and trust flow

1. The application loads the FXCL native library.
2. KeyServer connects to the CryptoHub Native Host API over TLS on port 2001.
3. The application verifies the CryptoHub production CA and expected server identity.
4. A Client Application API key, user login, PKI login, or JWT establishes the authorized Host API context.
5. FXCL sends key-store, cryptographic, or token-profile commands through that context.
6. CryptoHub applies the identity, partition, key-store, and HSM policies before it returns a key or operation result.

​

Choose an interface

Use FXCL when the application needs the FXCL key-store and token-profile object model. Use another CryptoHub interface when it fits the application better:

• Use the CryptoHub PKCS #11 module for a standard Cryptoki integration.
• Use the CryptoHub CNG provider for the Windows CNG key ecosystem.
• Use the REST cryptographic operations for a language-neutral HTTP integration.
• Use KMIP when the application already implements a standards-based KMIP client.

​

Version and scope

This guide is validated with:

• FXCL 1.9.5 for Linux AMD64 and OpenSSL 3
• CryptoHub 7.2.0.7
• Ubuntu 22.04
• GCC 11
• OpenJDK 17

CryptoHub 7.3.0.x, Windows, macOS, Python, C#, high availability, concurrent-session limits, throughput, and offline cache behavior are outside this validated scope.