Your suggested change has been received. Thank you.

User Guide
Release Notes
CSEG Administration
BYOK Integration
WebServices Guide
BYOK REST APIs

All

All
CipherTrust Manager
CipherTrust Application Data Protection (CADP)
CipherTrust Application Key Management (CAKM)
CipherTrust Batch Data Transformation (BDT)
CipherTrust Cloud Key Management (CCKM)
CipherTrust Data Discovery and Classification (DDC)
CipherTrust Data Protection Gateway (DPG)
CipherTrust Database Protection (CDP)
CipherTrust Intelligent Protection (CIP)
CipherTrust Integrations
CipherTrust Migrations
CipherTrust RESTful Data Protection (CRDP)
CipherTrust Transparent Encryption (CTE)
CipherTrust Transparent Encryption Userspace (CTE-U)
CipherTrust Secrets Management (CSM)
CipherTrust Vaulted Tokenization (CTE-V)
CipherTrust Vaultless Tokenization (CT-VL)
CTE-Linux
CTE-Windows
CTE-AIX
CTE-K8s
CTE-U
Data Protection on Demand
Luna Cloud HSM
Luna Network HSM
Luna PCIe HSM
Luna USB HSM
OneWelcome Identity Platform
ProtectApp LUKS
ProtectServer 2 HSM
ProtectServer 3 HSM
SafeNet Trusted Access (STA)
SafeNet MobilePASS+
SafeNet MobilePASS+ for Android
SafeNet MobilePASS+ for Chrome
SafeNet MobilePASS+ for macOS
SafeNet MobilePASS+ for iOS
SafeNet MobilePASS+ for WatchOS
SafeNet MobilePASS+ for Widows
SafeNet Synchronization Agent
SafeNet Logging Agent
SafeNet Agent for FreeRADIUS
SafeNet Agent for NPS
SafeNet Agent for Windows Logon
SafeNet Authentication Service Private Cloud Edition (SAS PCE)
SafeNet Remote Logging Agent
SafeNet Keycloak Agent
SafeNet IDPrime Virtual (IDPV)
SafeNet FIDO Key Manager
SafeNet FIDO Key Manager for Android
SafeNet FIDO Key Manager for iOS
SafeNet FIDO Key Manager for Windows

Format Preserving Encryption

FPE/FF3-1

Please Note:

User Guide
Quick Start
- Deploy CADP for Java using Maven Distribution
- Deploy CADP for Java using installer
Tasks
- Generate random IV
- Encrypt Data
- Decrypt Data
- Encrypt String and Write to File
- Encrypt File
- Tokenize/Detokenize Date
- Sign and Sign Verify
  - Generate Digital Signature with RSA Private Key using message/text
  - Verify Digital Signature with RSA Public Key using message/text
  - Generating Digital Signature with RSA Private Key using pre-calculated hash
  - Verify Digital Signature with RSA Public Key using Pre-calculated Hash
- MAC Operations
  - Bulk Operations in HMAC
  - Generate MAC
  - Verify MAC
- Key Operations
  - Create global key
  - Create key with random name
  - Create key owned by the NAE user
  - Create EC key owned by NAE user
  - Create Symmetric Key Using HKDF Algorithm
  - Create Key and Assign Permissions
  - Create Key and Assign Custom Attributes
  - Modify Group Permissions for an Existing Key
  - Get Group Permissions on an Existing Key
  - Generate Global RSA Public-Private Key Pair
  - Generate Global EC Public-Private Key Pair
  - Generate KMIP Public-Private Key Pair
  - Export Global Key
  - Export Non-Global Key
  - Import Global Key
  - Delete Global Key
  - Get Size of Global Key
  - Return List of Global Keys on NAE Server
  - Return List of Available Keys on NAE Server
  - Access Non-Global Key
  - Wrap Key
  - Get Key Names
  - Create Versioned Key
  - Create New Version of Key
  - Alter State of a Key Version
  - Encryption, Decryption, and MAC Operations Using Versioned Key
  - Encrypt and Decrypt using All Key Versions
  - Export Versioned Key
- User and Group Management Tasks
  - Create User
  - Delete User
  - Create User with Custom Attributes
  - Update Custom Attribute User
  - Retrieve Custom Attribute
  - Delete Custom Attribute
  - Change User Password
  - Change Key Owner
  - List Group Membership of a Specific User
  - List All Users in All Groups
  - List All Users in Single Group
  - Create Group
  - Delete Group
  - Add Users to Group
  - List All Users in Specific Group
  - Get All Information About Group
- Certificate Management Tasks
  - Import Certificate to Key Manager
  - Export Certificate and Private Key From Key Manager
  - Export Certificate From Key Manager
  - Export CA Certificate From Key Manager
  - Delete Certificate From Key Manager
- Session Management Tasks
  - Create Global Session
  - Create Global Session Using SSL with Client Certificates
  - Create Authenticated Session using NAE Credentials
  - Create an Authenticated Session using Domain User
  - Create session with Obfuscated Credentials
  - Create Authenticated Session using SSL with Client Certificates
  - Create Authenticated Session using SessionLevelConfig
  - Create Authenticated Session with Access to Persistent Key Cache
- Add Multiple Key Managers
- Refresh Cached Keys
- KMIP Tasks
  - KMIP Session
    - Create Authenticated KMIP Session with Client Certificate
    - Create Authenticated KMIP Session with User Credentials
    - Create Authenticated KMIP Session with User Credentials and Client Certificate
  - Wrap Key
  - Verify Key
  - KMIP Encrypt and Decrypt
    - KMIP Encrypt
    - KMIP Decrypt
  - KMIP Encrypt and Decrypt Sample
- Obfuscate Credentials
- Logging Related Tasks
  - Time-based Log Rotation
  - Size-based Log Rotation
  - Time and Size -based Log Rotation
  - Include GMT Timestamp Offset
  - Log_MaxBackupIndex
  - Reloading Log Configuration
  - Targeted Logging
  - Configuring Multiple Logging Outputs
  - Implement External Logger Object
- Obfuscate SSL Client Private Key Passphrase
- Chain Operations
  - Create Chained Operations
  - Return Intermediate Result in a Chain of Operations
- SSL Configuration
  - Configure SSL on CipherTrust Manager for NAE Interface
  - Configure SSL on CipherTrust Manager for KMIP Interface
- Tokenization Related Tasks
  - Initialize and close Token Service Vaultless instance
  - Create token for the plaintext
  - Return plaintext for token
  - Tokenize and detokenize Unicode blocks
    - Tokenize and detokenize Unicode blocks using AlgoSpec
    - Tokenize and detokenize Unicode blocks using Unicode.properties file
  - Tokenize and detokenize large data set
  - Java API Sample
  - REST APIs
    - Deploy Vaultless Tokenization on HTTPS Server
    - Return plaintext for token
    - Create token for the plaintext
Advanced Topics
- Configuration Parameters
  - Network Configuration Parameters
  - Connection Configuration Parameters
  - Local Encryption Parameters
  - SSL Configuration Parameters
  - Logging Parameters
  - Miscellaneous Parameters
- Connect to Server
- Connection Pooling
- Load Balancing
- Multi-Tier Load Balancing
- Format Preserving Encryption
  - FPE/AES
  - FPE/FF1
  - FPE/FF1v2
  - FPE/FF3
  - FPE/FF3-1
  - FPE Formats
  - FPE/AES/Unicode Cardinality Block-Size Table
- CADP for Java Utilities
  - CryptoDataUtility
  - GetJCEDetails Utility
- Supported Algorithms
  - Encryption and Decryption with Symmetric Keys
  - Encryption and Decryption with Asymmetric Keys
  - Message Authentication Codes
  - Digital Signatures
  - Supported Cryptographic Algorithms
- KMIP Fundamentals
  - KMIP Managed Objects
  - KMIP Attribute
  - KMIP Managed Operations
  - KMIP Multiple Operation Batching
  - KMIP Support for NAECertificates
  - Certify and Recertify
  - KMIP States and Dates
- Key Caching
  - Symmetric/Asymmetric Key Caching
  - Persistent Key Caching
- Logging
- Tokenization Concepts
  - AlgoSpec
  - TokenSpec
  - Bulk Migration Parameters
- Advisory Notes and Best Practices
Troubleshooting

CADP for Java
User Guide
Advanced Topics
Format Preserving Encryption
FPE/FF3-1
- Version 8.17.1

FPE/FF3-1

This algorithm supports following cardinalities for different types of data.

CARD10 for digits in range 0 - 9
CARD26 for lower case alphabets (a-z)
CARD62 for digits (0 - 9), lower case alphabets (a - z), and upper case alphabets (A - Z)
ASCII to support 128 characters
UNICODE to support various languages. The maximum supported cardinality size is 65535.

The steps to encrypt/decrypt data using FPE/FF3-1 algorithm is provided in the FF1EncryptionDecryptionSample.java sample. The sample is available on Github.

Important notes

Only CARD10 is supported in both local and remote mode. Other cardinalities are supported in the local mode only.
The bulk operation is supported for all the variants of FPE/FF3-1.
On performing crypto operations with FPE/FF3-1, the characters in the input data other than those specified by the cardinality, remains preserved and do not get encrypted.
FPE/FF3-1 requires minimum two characters to perform encryption. The maximum data length can be 128000 characters.
FPE/FF3-1 algorithms support FPE formats.
In FPE/FF3-1, if tweak algorithm is None, the tweak data length should be 14 characters HEX encoded string.
For tweak algorithms SHA1 and SHA256, the tweak data length should be ≤ 256 characters.

On this page

Important notes

CADP for Java

© Copyright 2019-2025, Thales Group

+1 410-469-1651 supportportal.thalesgroup.com

Support
- Support Contacts
- Text Conventions
Legal

© Copyright 2019-2025, Thales Group

+1 410-469-1651 supportportal.thalesgroup.com

Suggest A Change

Thank you! Your suggestion has been submitted.

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

There are some errors in your form.

Your Name This field is required

Your Email This field is required

How can we improve this content? This field is required

Print

Suggest An Edit

Download this Page

Download Project

Copy Link