Skip to main content

Changelog

All notable changes to the Qpher platform are documented here. This changelog follows the Keep a Changelog format.

2026-06-25 — Hybrid cryptography, SLH-DSA signatures, and optional key_version​

Added​

  • Hybrid PQC + classical algorithms — X-Wing (X25519 + ML-KEM-768) for key encapsulation and Composite-ML-DSA (ECDSA P-256 + ML-DSA-65) for signatures, available on the Starter plan and above. See the Hybrid Cryptography guide.
  • SLH-DSA (FIPS 205) signatures — parameter sets SLH-DSA-SHA2-128s, 128f, 192s, and 256s on /signature/sign, /signature/verify, /signature/sign-hash, and /signature/verify-hash. 192s is the recommended long-term archive parameter set.
  • GET /api/v1/kms/keys/{key_version} documented in the Key Management OpenAPI spec — fetch a specific key version (any status).

Changed​

  • key_version is now optional on encrypt, sign, and sign-hash — omit it and the server uses your current active key, returning the resolved version in the response. It remains required on decrypt, verify, verify-hash, and the KEM client-side operations (encapsulate / decapsulate / wrap / unwrap).

2026-04-20 — Multi-factor authentication and step-up re-verification​

Added​

  • Multi-factor authentication (MFA) — TOTP (RFC 6238) with any authenticator app, 10 single-use recovery codes, and email OTP as a last-resort fallback after two failed primary attempts. Available on both the SaaS Portal and the Vault iOS app. See Security → Multi-Factor Authentication.
  • Step-up re-verification for sensitive actions — subscription checkout / cancel, API key rotation, team-member removal, password change, and PQC key rotation each require a second proof of presence before they take effect. A step-up token lasts 5 minutes, is single-use, and is carried via the X-Step-Up-Token header. See API Reference → Authentication.
  • New endpoint POST /api/v1/auth/step-up — exchange a TOTP code (or password, if MFA is not enabled) for a step-up token.
  • New endpoint POST /api/v1/auth/change-password — change the account password while signed in, with a step-up check before the write and automatic revocation of all existing sessions after the change.
  • Enterprise org policy — require_mfa on the tenant policy rejects logins from members who have not enrolled, with a 7-day grace period for existing members and no grace period for new invites. Enterprise and Enterprise+ plans only.

Changed​

  • ERR_MFA_011 is now reserved for the Enterprise+ plan gate on require_mfa. Earlier versions overloaded this code.

Deprecated​

  • ERR_MFA_002 and ERR_MFA_006 are merged into ERR_MFA_001 ("Invalid code") to prevent factor-type enumeration from error messages. The legacy codes remain in the catalogue for a six-month deprecation window — treat any of them as equivalent to ERR_MFA_001.

Notes​

  • API-key integrations (SDKs and the qpher CLI) are not affected by step-up. The X-Step-Up-Token requirement and ERR_MFA_013 response apply only to Portal JWT sessions. API keys remain the highest-trust credential and bypass step-up by design.

[1.0.0] -- 2026-02-15​

Added​

  • Kyber768 KEM encryption and decryption -- Quantum-resistant key encapsulation using NIST FIPS 203 (ML-KEM-768). Supports standard and deterministic modes.
  • Dilithium3 digital signatures -- Quantum-resistant signing and verification using NIST FIPS 204 (ML-DSA-65).
  • Key management -- Full PQC key lifecycle: generate, rotate, retire, and archive. Explicit key versioning required on all operations.
  • Non-exportable private keys -- Private keys encrypted at rest with AES-256-GCM and stored exclusively inside the KMS-Orchestrator. No export API.
  • Tenant API -- Multi-tenant Organization management with API key creation and rotation.
  • API Gateway -- 7-stage authentication and authorization pipeline with per-tenant rate limiting.
  • Zero Trust Policy Engine -- Per-request authorization with fail-closed design. Plan-based access control and quota enforcement.
  • Billing integration -- Stripe-powered billing with five plans: Free, Starter ($99/mo), Growth ($179/mo), Pro ($299/mo), and Enterprise (from $999/mo). Annual billing with 20% discount.
  • User Portal -- Web dashboard at portal.qpher.ai for managing keys, viewing usage, and configuring billing.
  • Python SDK -- Official Python client library for Qpher APIs.
  • Node.js SDK -- Official Node.js client library for Qpher APIs.
  • Go SDK -- Official Go client library for Qpher APIs.
  • Audit logging -- Structured audit logs with 180-day retention for all cryptographic operations and administrative actions.
  • Documentation site -- Developer documentation at docs.qpher.ai with API reference, guides, and SDK documentation.

This changelog is updated with each release. For questions about specific changes, contact support@qpher.ai.