> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Introduces the CryptoHub Client Library CNG Key Storage Provider (cryptohub-cng.dll), how it differs from the legacy FXCL CNG and Futurex CNG providers, and the shared cryptohub.json configuration.

The CryptoHub Client Library CNG Key Storage Provider (`cryptohub-cng.dll`) lets Windows applications perform cryptographic operations against CryptoHub-managed keys. It exposes those keys through the standard Windows CNG (Cryptography API: Next Generation) NCrypt interface. Once the provider is registered on the machine and `cryptohub.json` is in place, applications open the registered provider **Futurex CryptoHub Key Storage Provider** by name and use CryptoHub-backed keys through normal NCrypt calls. This makes CryptoHub available to the standard Windows key ecosystem, including Authenticode code signing (`SignTool` and PowerShell `Set-AuthenticodeSignature`), TLS through the Windows certificate store, and ADCS- and Intune-family certificate services.

The provider reaches CryptoHub over the **CryptoHub v2 REST API on port 443**, and it exposes post-quantum ML-DSA and ML-KEM operations alongside classical RSA, ECC, and symmetric algorithms.

<Note>
  This guide documents the CryptoHub Client Library CNG provider (`cryptohub-cng.dll`), configured with `cryptohub.json`. It is the CNG sibling of the Linux [CryptoHub PKCS#11 module](../CryptoHub_PKCS11_developer_guide/Overview) (`libcryptohub-pkcs11.so`); both belong to the CryptoHub Client Library family, reach CryptoHub over the same REST transport, and share a single `cryptohub.json` file.
</Note>

## Choosing the right CNG provider

Futurex ships more than one Windows CNG provider. They target different backends and are configured differently. Choose the provider that matches your Futurex platform.

<table>
  <thead>
    <tr>
      <th><strong>Provider</strong></th>
      <th><strong>Library</strong></th>
      <th><strong>Configuration file</strong></th>
      <th><strong>Backend</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>CryptoHub Client Library CNG (this guide)</td>
      <td><code>cryptohub-cng.dll</code></td>
      <td><code>cryptohub.json</code></td>
      <td>CryptoHub 7.2 and later, over the v2 REST API</td>
    </tr>

    <tr>
      <td>FXCL CNG (legacy)</td>
      <td><code>libfxcl-cng.dll</code></td>
      <td><code>config.json</code></td>
      <td>CryptoHub 7.0.3.x and legacy KMES, over the Host API</td>
    </tr>

    <tr>
      <td>Futurex CNG (FXCNG / FxclCng)</td>
      <td>FXCNG</td>
      <td>Host-API configuration</td>
      <td>Excrypt HSM, direct Host-API connection</td>
    </tr>
  </tbody>
</table>

The CryptoHub Client Library CNG provider is the successor to the legacy FXCNG / FxclCng client. Unlike those Host-API providers, it authenticates over the CryptoHub v2 REST API on port 443 rather than the legacy Host-API port.

## How the provider is delivered

The provider ships **inside the Windows endpoint download**, not as a standalone package. You deploy a CryptoHub Client Library CNG service, add a **Windows** endpoint to it, and download a zip file that contains the provider DLL, its installer and management tools, a **pre-filled `cryptohub.json`**, and the TLS material for that endpoint. See [Installation](./Installation) for the full workflow.

<table>
  <thead>
    <tr>
      <th><strong>Item</strong></th>
      <th><strong>Purpose</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>cryptohub-cng.dll</code></td>
      <td>The CNG Key Storage Provider that Windows loads after registration. Applications reach CryptoHub-backed keys through this KSP.</td>
    </tr>

    <tr>
      <td><code>cng-install.exe</code></td>
      <td>Administrator installer that copies and registers the KSP.</td>
    </tr>

    <tr>
      <td><code>cng-uninstall.exe</code></td>
      <td>Administrator uninstaller that unregisters the KSP.</td>
    </tr>

    <tr>
      <td><code>cng-manager.exe</code></td>
      <td>Interactive utility for listing, generating, deleting, signing, and verifying keys.</td>
    </tr>

    <tr>
      <td><code>cryptohub.json</code></td>
      <td>Your deployment configuration for this endpoint, pre-filled with the connection, authentication, and TLS settings.</td>
    </tr>

    <tr>
      <td>TLS material</td>
      <td>The CA and client TLS files the provider uses to reach and authenticate to CryptoHub.</td>
    </tr>
  </tbody>
</table>

The Windows endpoint download also carries the PKCS#11 module (`cryptohub-pkcs11.dll`) and its tools; the PKCS#11 module and CLI are not required for the CNG workflow.

## How applications find CryptoHub keys

Unlike PKCS#11, CNG applications do not take a module path or a connection URI. Once the **Futurex CryptoHub Key Storage Provider** is registered on the machine, applications find the CryptoHub-backed key **implicitly**. They locate it through a certificate in the Windows certificate store whose private-key reference (`CERT_KEY_PROV_INFO`) names the CryptoHub provider. When Windows resolves that key reference, it routes the private-key operation through the provider to CryptoHub, and any CNG-aware application can use the key without further configuration. The private key never leaves CryptoHub.

## Supported platforms

The provider is a Windows Key Storage Provider and runs on Windows only. For non-Windows hosts, use the [CryptoHub PKCS#11 module](../CryptoHub_PKCS11_developer_guide/Overview) instead.

## Documentation structure

This guide walks you through installing, configuring, and using the CryptoHub Client Library CNG provider.

* **Installation**: Deploy the service, provision a Windows endpoint, install and register the provider, and verify it reaches CryptoHub.
* **Configuration**: Configure the `cng` block and the shared `cryptohub.json` settings, including key protection and default usages.
* **Troubleshooting**: Diagnose registration, configuration, connectivity, authentication, and key-protection problems.
* **Appendix A**: Reference the algorithms the provider supports.