Release Notes 3.1.0

Release: 3.1.0
Date: 2026-10-13
Type: first generally available release
Installation: new installation only

Overview

ANKASecure© 3.1.0 is the first generally available release of the Cryptographic Control Plane. It governs cryptographic operations across applications and organizations — key generation, encryption, signing, re-encryption and key custody — as policy-driven, auditable capabilities, with post-quantum, classical and composite hybrid algorithms side by side.

Earlier versions were internal development milestones and were never distributed. Their history is in Product evolution.

Highlights

• 130 algorithm profiles in one catalogue: ML-KEM, ML-DSA, SLH-DSA, FALCON, HQC, FrodoKEM, Classic McEliece, XMSS, XMSS^MT, LMS and SMAUG-T beside RSA, elliptic curves, EdDSA, SM2 and GOST, plus 41 composite hybrid profiles.
• Crypto-agility without application changes: algorithms change by policy; data protected under one key is re-encrypted or re-signed under another, including streaming payloads.
• Key custody by the owner: hardware security modules over PKCS#11, or bring-your-own-key to AWS KMS, Google Cloud KMS or Azure Key Vault.
• Mediated use of keys by third parties: capability grants and exchange contexts let a partner use a cryptographic capability without ever receiving the key.
• A signed audit trail for every cryptographic, administrative and authentication event, with forwarding to a SIEM or XDR.
• Regulatory compliance packs with posture evaluation, a signed evidence package and remediation plans.
• Scheduled key rotation with deployment, tenant and per-key schedules bounded by the cryptoperiods a compliance pack sets.
• A supported upgrade path: from 3.1.0 on, each release upgrades in place from the previous one.

Capabilities

Post-quantum and composite cryptography

• Key generation, encryption, decryption, signing and verification for every profile in the algorithm catalogue, with the catalogue and each profile's status available over the API.
• Composite hybrid keys: 27 hybrid key-encapsulation pairings (X25519, X448, NIST P-curves or Brainpool with ML-KEM or HQC) and 14 composite signatures (Ed25519, Ed448, NIST P-curves or Brainpool with ML-DSA).
• Stateful hash-based signatures (XMSS, XMSS^MT, LMS) with signature-index reservation.
• Symmetric encryption and message authentication: AES-GCM and AES-CCM, ChaCha20-Poly1305, Camellia, ARIA, SEED, SM4, CMAC, HMAC and KMAC.
• JOSE wire formats: JWE and JWS in compact and General JSON serialization.
• Server-side randomness from an SP 800-90A deterministic random bit generator, seeded from a hardware source when one is available.
• An optional ML-KEM session that protects request and response payloads in transit, on top of TLS.

Key management and lifecycle

• A key lifecycle with expiry periods and usage limits; an expired or exhausted key stops protecting new data and still opens what it protected.
• Key rotation that carries the key's expiry period and usage limits forward.
• Import from PKCS#12 and JKS keystores, with the purpose of each key resolved from its certificate or declared per alias.
• Key history and key versions addressed by key identifier.

Re-encryption and crypto-agility

• Re-encryption and re-signing from one key to another, including from a composite key to a simple one, without exposing plaintext to the caller.
• Streaming encryption, decryption, signing and verification for large payloads, with an integrity verdict at the end of the stream.
• PKCS#7 / CMS analysis and conversion to JOSE, for migrating data protected by existing systems.

Key protection and custody

• Per-tenant key-encryption keys in a hardware security module over PKCS#11 (for example Thales Luna and AWS CloudHSM); SoftHSM for test environments.
• Bring-your-own-key: a tenant's keys wrapped under the tenant's own key in AWS KMS, Google Cloud KMS or Azure Key Vault.
• Key material zeroized after use; a destroyed key's wrapped material is erased.

Multi-tenancy, identity and access

• Tenant isolation on every operation, query and cache.
• One identity per person, with tenant memberships and roles.
• Single sign-on with OIDC and SAML, LDAP directories, multi-factor authentication and password policies.
• Applications and service credentials with scoped access.
• Capability grants, cryptographic exchange contexts and constraint policies (usage limits, rate limits, time windows) for mediated third-party use.

Audit and security event forwarding

• Every operation recorded in a tamper-evident audit trail: each event is signed by its producer and verified before it is stored, and records whether the operation succeeded, failed or was denied.
• Audit queries, filters and export per tenant, per platform and by correlation identifier.
• Forwarding of security events to a SIEM or XDR in CEF or OCSF, over Syslog, Splunk HEC, Microsoft Sentinel or a webhook, with per-destination filtering, retry and a dead-letter queue.
• RFC 3161 time-stamping from an external time-stamping authority.

Compliance

• Compliance packs for NIST post-quantum transition, NIST CSWP 39 crypto-agility, NSA CNSA 2.0, BSI TR-02102-1, ANSSI post-quantum guidance and the EU post-quantum roadmap.
• Posture evaluation per tenant and per pack, a signed compliance evidence package with a cryptographic bill of materials (CBOM), and remediation plans.
• The packs available on an installation follow its licence; a trial licence evaluates every pack.

Scheduling and automation

• Key rotation schedules at deployment, tenant and key level, bounded by the cryptoperiod ceilings of the active compliance packs.
• Idempotent rotation commands, safe to retry.

Administration console

• Tenants, users, applications, keys, policies, grants, exchange contexts, compliance, audit and platform settings in one console, with in-screen help in English and Spanish.
• A per-user display time zone; all stored and signed times remain UTC.
• Licence and recovery-readiness views for the platform operator.

Developer and operator tooling

• Java SDK (co.ankatech:ankasecure-sdk) and Admin SDK (co.ankatech:ankasecure-admin-sdk) 3.1.0 on Maven Central.
• Crypto CLI and Admin CLI installers for Windows, macOS and Linux.
• OpenAPI specifications for every public service.
• The admin bundle: prerequisite checks, environment creation, health checks, backup and restore, and in-place upgrade.

Platform components

3.1.0 runs as 14 ANKASecure container images — the platform services, the administration console and the schema migrator — together with these third-party components:

Every image is admitted by the digest recorded in the release manifest, which is signed with the ANKATech release key.

Installation and upgrade

• 3.1.0 is a new installation. No earlier release was distributed, so there is no upgrade into 3.1.0.
• From 3.1.0 on, an installation upgrades in place to the next release with envctl.sh <env> upgrade plan, apply and finalize. plan verifies the signed release manifest and lists the steps; apply takes a backup first and rolls back automatically on failure; a release can be rolled back until it is finalized.

Known issues

These are corrected in 3.2.0.

• The key history of a tenant with few audit records can time out (HTTP 504) when that tenant shares an audit storage partition with a tenant that has many records.
• When a PKCS#7 streaming operation is denied, its audit record can carry the key reference as the request wrote it instead of the resolved key identifier.
• A key lifecycle operation refused by policy is recorded in the audit trail as FAILURE instead of DENIED.