Release Notes

Audience: customers, operators and evaluators of ANKASecure©.

What this section holds: the notes of every generally available release, and the history of how the platform grew from its first line of code to its first general availability.

Releases

Supported upgrade path: 3.1.0 → 3.2.0 → 3.3.0 upgrade one release at a time. 3.4.0 is installed from scratch: its databases start from one initial schema, it declares no predecessor, and an environment of an earlier release is recreated (destroy-env.sh, then create-env.sh). A later release upgrades from 3.4.0. 3.1.0 is installed new; no release earlier than 3.1.0 was distributed.

Product evolution

ANKASecure© was built over twenty months before its first general availability. The versions below 3.1.0 were internal development milestones: they were never distributed, carry no support, and have no upgrade path. They are listed to show how the platform reached the shape it ships in.

The figures in the timeline are read from the source of each milestone. Algorithm counts from 3.0.0 onward count the profiles of the shared algorithm catalogue (single-algorithm and composite); earlier counts are the identifiers the platform offered at the time, so the two are comparable in trend, not one for one.

At a glance

2025-02-22 — Development starts

The first commit of the cryptographic API is recorded on 22 February 2025.

1.1.1 — March 2025

The first versioned build: one cryptographic API service and a licence server.

• Post-quantum and classical key generation, encryption and signing over a REST API, with a supported-algorithms endpoint: ML-KEM, HQC, Dilithium, FALCON and SPHINCS+ beside RSA, elliptic curves and AES.
• Keys addressed by a key identifier (kid) on every operation; key export in a JWK structure.
• A command-line client and a Java SDK.

1.2.0 — March 2025

• RSA-3072, standardized HQC parameter-set names, and stricter per-algorithm validation of key operations.
• A reworked command-line client and SDK.

2.0.0 — May 2025

The platform becomes a set of services.

• Authentication, administration and licensing move out of the cryptographic API into their own services; a PQC handshake service and a documentation hub are added (six services).
• Post-quantum signatures under their FIPS names, ML-DSA and SLH-DSA; FrodoKEM, XMSS and LMS; AES-GCM and AES-CCM; message authentication codes.
• Multi-tenancy, key lifecycle policy and scheduled key rotation.
• An ML-KEM-1024 session that protects request and response payloads in transit.

2025 — internal builds on the 2.x line

• JOSE support: JWE encryption and JWS signatures.
• Algorithm rotation policy and algorithm availability policy.
• RSA-signed access tokens and automatic tenant provisioning.
• An Android demonstration application and a cryptographic toolkit CLI.
• Deployment on Docker Swarm with production installation scripts.

December 2025 — 3.0.0 release candidates

• Composite hybrid keys that pair a post-quantum algorithm with a classical one, in the API, the SDK and the CLI; GOST and ARIA.
• Random numbers from a hardware source through PKCS#11, behind an SP 800-90A deterministic random bit generator.
• Streaming encryption with a unique initialization vector per chunk.
• Per-tenant key-encryption keys held in a hardware security module over PKCS#11.
• Policies propagated to the cryptographic service in real time, with a persistent fail-safe cache.
• A Java SDK and two command-line clients, one for cryptographic operations and one for administration.

First half of 2026

• A signed, tamper-evident audit trail for cryptographic, administrative and authentication events, with a dedicated audit query service and export.
• Multi-factor authentication, password policies, refresh tokens and signing-key rotation.
• Key rotation, a multi-state key lifecycle, and keystore import from PKCS#12 and JKS.
• The administration console: tenants, users, keys, policies, audit and analytics.
• Capability grants and cryptographic exchange contexts, so a third party can use a capability without receiving the key, governed by constraint policies.
• Email notifications, OpenTelemetry observability and trial licensing.

Third quarter of 2026

• Single sign-on with OIDC and SAML, and LDAP directories.
• RFC 3161 time-stamping from an external time-stamping authority.
• Bring-your-own-key to AWS KMS, Google Cloud KMS and Azure Key Vault, and multiple hardware security module vendors over PKCS#11.
• Security event forwarding to a SIEM or XDR in CEF or OCSF, over Syslog, Splunk HEC, Microsoft Sentinel or a webhook.
• A catalogue of regulatory compliance packs.
• An Admin SDK for control-plane automation, and a dedicated notification service with email, SMS and WhatsApp channels.

3.0.0 — September 2026

The platform reaches its complete service set: ten services plus the administration console, and 124 algorithm profiles in one shared catalogue — 83 single-algorithm profiles across post-quantum, classical and symmetric families, and 41 composite profiles (27 hybrid key-encapsulation pairings and 14 composite signatures).

3.0.1 — October 2026

• Stateful hash-based signatures XMSS and XMSS^MT with index reservation, and SMAUG-T.
• The cryptographic API runs as two services, one for compact operations and one for streaming.
• Versioned database schema migrations.
• One identity per person, with tenants as memberships.
• Compliance posture evaluation per pack, and a signed compliance evidence package with a cryptographic bill of materials (CBOM).
• The platform licence bound to its installation; backup custody and recovery readiness shown in the console.

3.1.0 — October 2026

The first generally available release. See Release notes 3.1.0.