Format Preserving Encryption

Your suggested change has been received. Thank you.

Suggest A Change

We're moving!

A new home for CipherTrust documentation will be introduced on December 02, 2025! Visit https://docs-cybersec.thalesgroup.com for a preview.

Please Note:

Administration
Quick Start
Tasks
- Generate random IV
- Encrypt Data
- Decrypt Data
- Encrypt String and Write to File
- Encrypt File
- Sign and Sign Verify
  - Generate Digital Signature with RSA Private Key using message/text
  - Verify Digital Signature with RSA Public Key using message/text
  - Generating Digital Signature with RSA Private Key using pre-calculated hash
  - Verify Digital Signature with RSA Public Key using Pre-calculated Hash
- MAC Operations
  - Bulk Operations in HMAC
  - Generate MAC
  - Verify MAC
- Key Operations
  - Create global key
  - Create key with random name
  - Create key owned by the NAE user
  - Create EC key owned by NAE user
  - Create Symmetric Key Using HKDF Algorithm
  - Create Key and Assign Permissions
  - Create Key and Assign Custom Attributes
  - Modify Group Permissions for an Existing Key
  - Get Group Permissions on an Existing Key
  - Generate Global RSA Public-Private Key Pair
  - Generate Global EC Public-Private Key Pair
  - Generate KMIP Public-Private Key Pair
  - Export Global Key
  - Export Non-Global Key
  - Import Global Key
  - Delete Global Key
  - Get Size of Global Key
  - Return List of Global Keys on NAE Server
  - Return List of Available Keys on NAE Server
  - Access Non-Global Key
  - Wrap Key
  - Get Key Names
  - Create Versioned Key
  - Create New Version of Key
  - Alter State of a Key Version
  - Encryption, Decryption, and MAC Operations Using Versioned Key
  - Encrypt and Decrypt using All Key Versions
  - Export Versioned Key
- User and Group Management Tasks
  - Create User
  - Delete User
  - Create User with Custom Attributes
  - Update Custom Attribute User
  - Retrieve Custom Attribute
  - Delete Custom Attribute
  - Change User Password
  - Change Key Owner
  - List Group Membership of a Specific User
  - List All Users in All Groups
  - List All Users in Single Group
  - Create Group
  - Delete Group
  - Add Users to Group
  - List All Users in Specific Group
  - Get All Information About Group
- Certificate Management Tasks
  - Import Certificate to Key Manager
  - Export Certificate and Private Key From Key Manager
  - Export Certificate From Key Manager
  - Export CA Certificate From Key Manager
  - Delete Certificate From Key Manager
- Session Management Tasks
  - Create Global Session
  - Create Global Session Using SSL with Client Certificates
  - Create Authenticated Session using NAE Credentials
  - Create an Authenticated Session using Domain User
  - Create session with Obfuscated Credentials
  - Create Authenticated Session using SSL with Client Certificates
  - Create Authenticated Session using SessionLevelConfig
  - Create Authenticated Session with Access to Persistent Key Cache
- Add Multiple Key Managers
- Refresh Cached Keys
- KMIP Tasks
  - KMIP Session
    - Create Authenticated KMIP Session with Client Certificate
    - Create Authenticated KMIP Session with User Credentials
    - Create Authenticated KMIP Session with User Credentials and Client Certificate
  - Wrap Key
  - Verify Key
  - KMIP Encrypt and Decrypt
    - KMIP Encrypt
    - KMIP Decrypt
  - KMIP Encrypt and Decrypt Sample
- Obfuscate Credentials
- Logging Related Tasks
  - Time-based Log Rotation
  - Size-based Log Rotation
  - Time and Size based Log Rotation
  - Include GMT Timestamp Offset
  - Log_MaxBackupIndex
  - Reloading Log Configuration
  - Targeted Logging
  - Configuring Multiple Logging Outputs
  - Implement External Logger Object
- Obfuscate SSL Client Private Key Passphrase
- Chain Operations
  - Create Chained Operations
  - Return Intermediate Result in a Chain of Operations
- SSL Configuration
  - Configure SSL on CipherTrust Manager for NAE Interface
  - Configure SSL on CipherTrust Manager for KMIP Interface
- Tokenization Related Tasks
  - Initialize and close Token Service Vaultless instance
  - Create token for the plaintext
  - Return plaintext for token
  - Tokenize and detokenize Unicode blocks
    - Tokenize and detokenize Unicode blocks using AlgoSpec
    - Tokenize and detokenize Unicode blocks using Unicode.properties file
  - Tokenize and detokenize large data set
  - Java API Sample
Advanced Topics
- Configuration Parameters
  - Network Configuration Parameters
  - Connection Configuration Parameters
  - Local Encryption Parameters
  - SSL Configuration Parameters
  - Logging Parameters
  - Miscellaneous Parameters
- Connect to Server
- Connection Pooling
- Load Balancing
- Multi-Tier Load Balancing
- Format Preserving Encryption
  - FPE/AES
  - FPE/FF1
  - FPE/FF1v2
  - FPE/FF3
  - FPE Formats
  - FPE/AES/Unicode Cardinality Block-Size Table
- CADP for Java Utilities
  - CryptoDataUtility
  - GetJCEDetails Utility
- Supported Algorithms
  - Encryption and Decryption with Symmetric Keys
  - Encryption and Decryption with Asymmetric Keys
  - Message Authentication Codes
  - Digital Signatures
  - Supported Cryptographic Algorithms
- KMIP Fundamentals
  - KMIP Managed Objects
  - KMIP Attribute
  - KMIP Managed Operations
  - KMIP Multiple Operation Batching
  - KMIP Support for NAECertificates
  - Certify and Recertify
  - KMIP States and Dates
- Key Caching
  - Symmetric/Asymmetric Key Caching
  - Persistent Key Caching
- Logging
- Tokenization Concepts
  - AlgoSpec
  - TokenSpec
  - Bulk Migration Parameters
- Advisory Notes and Best Practices
Troubleshooting