Changelog

July 1st, 2026

Versions

Database: 7.14.0
Node Communication: 36.2
Node Configuration: 28.4
Client API: 64.7
Client Communication: 33.5

Changelog

Node Configuration:
    - Removed presignature features from Aleo
Client API:
    - Added support for getting key attributes
Client Communication:
    - Added endpoint for getting key attributes
Patch changes (no effect on compatibility):
    - Improve error message when out of presignatures or requesting a non-existing presignature ID
    - Fixed method name withMtlsAuthentication in Configuration class of the Java SDK to align with other casing

May 6th, 2026

Versions

Database: 7.14.0
Node Communication: 36.2
Node Configuration: 28.3
Client API: 64.6
Client Communication: 33.4

Changelog

Node Configuration:
    - Added MPCWebSocketPath to the SDKServer configuration. Can be used for MPC communication via the SDK server.
Client API:
    - Aleo: Updated SDK with new input format. This breaks compatibility and the SDK is still experimental
    - Added support for disabling HTTP keepalives
Client Communication:
    - Aleo: Updated communication to the server
    - Added support for multi-instance with TLS (except mTLS)
    - Added an MPC-RoutingID header to requests from the SDK. Can be used for session affinity when doing load balancing.
    - Added a query parameter called mpc_routing_id to requests from the SDK. Can be used for session affinity when doing load balancing.
Patch changes (no effect on compatibility):
    - Fixed bug in gmpc decoding for minPlayers less than playerCount

April 23rd, 2026

Versions

Database: 7.14.0
Node Communication: 36.2
Node Configuration: 28.2
Client API: 64.4
Client Communication: 33.1

Changelog

Client API:
    - ECDH sdk: Added two utility methods to convert JSON public keys to and from PKIX/SPKI public keys for e.g. Java integration
    - Added better error handling in C: a new Tsm_GetLastError can return more information
    - Added better error handling in Java: Now throws a TsmRuntimeException that contains methods to give return code and SDK message
    - Added better error handling in Node.JS: Error string now contains additional information from the SDK.
Patch changes (no effect on compatibility):
    - Fixed a potential DoS issue in DirectMPCServer

March 26th, 2026

Versions

Database: 7.14.0
Node Communication: 36.2 (!)
Node Configuration: 28.2 (!)
Client API: 64.2 (!)
Client Communication: 33.1 (!)

Changelog

Database:
    - Remove obsolete tables and columns
Node Communication:
    - Added support for BLS
    - Added support for EC-KCDSA
    - Added support for Aleo (experimental)
    - Added MPCDirectServer. A new method for direct communication between nodes using TCP and WebSockets
    - Changes in the BIP32 hardened derivation methods for DKLs19 and DKLs23
    - Changes in protocol implementation of AES, HMAC, AN10922, RFC5649
    - Removed support for the WRK17 general MPC protocol
    - Removed WebSocket support from the MPCTCPServer
Node Configuration:
    - Added support for BLS
    - Added support for EC-KCDSA
    - Added support for ECDH
    - Added support for Aleo (experimental)
    - Added support for getting randomness from an external device.
    - Added MPCDirectServer to handle both TCP and WebSocket connections
    - The MRZ15 protocol now works with any number of two or more players and any threshold
    - Removed support for the WRK17 general MPC protocol
    - Removed MPCWebSocketServer and removed PacketCommunication from MPCTCPServer
Client API:
    - Added support for BLS
    - Added support for EC-KCDSA
    - Added support for ECDH
    - Added support for Aleo (experimental)
    - Added support for setting the address of a dynamic player
    - Added support for an external decryption function when recovering private keys (Go SDK)
    - Added support for MPC unwrap of RSA and secure (MPC) unwrapping of all keys in the PKCS #11 module
    - WASM: Added the possibility to use an embedded node, e. g. running a node in a browser, or other platforms that support WASM.
    - AES, HMAC: Key generation and import methods now require an additional parameter MinPlayers
    - AES, HMAC: Sensitive input such as plaintexts must now be input as secret shares using the SplitInput method in the SDK
    - BIP32 hardened derivation: Seed generation and import now requires an additional parameter MinPlayers (currently only MinPlayers=3 supported)
    - AN10922, RFC5649: Input sharings must now be computed using the SplitInput method in the SDK
    - Removed NewStaticSessionConfigWithTenant
Client Communication:
    - Added support for BLS
    - Added support for EC-KCDSA
    - Added support for ECDH
    - Added support for Aleo (experimental)
    - AES, HMAC, AN10922, RFC5649: Changes to several endpoints
    - DKLs19, DKLs23: Changes to endpoints for BIP32 hardened derivation
    - Management API: Added endpoints for counting, listing, and deleting keys, and applications.
    - Added support for setting the address of a dynamic player
Patch changes (no effect on compatibility):
    - Audit logging of count and list keys
    - No longer collects metrics when metrics are disabled
    - Update libmpc to fix DKLS23 presignature security issue
    - Upgrade debian bullseye to trixie
    - Allow a mix of message broker and TCP/WS communication in a session.

October 8th, 2025

Versions

Node Configuration: 26.6
Client API: 62.3
Client Communication: 32.5
Database: 7.13.0
Node Communication: 34.2

Changelog

Node Configuration:
    - Added support for running MPC operations in a secure enclave. This is configured via the [Enclave] section.
    - DKLS23 now supports NONE as the DeactivatedPlayersCache in addition to MEMORY and DATABASE.
Patch changes (no effect on compatibility):
    - Made it possible to control for how long dynamic API keys are cached. Also changed the default from 10 to 30 seconds
    - Make fewer calls to the database encryptor

Secure Enclaves

We’ve added support for running MPC operations inside a secure enclave, providing stronger isolation and protection of key material.

Enclaves can be configured via the [Enclave] section by specifying the address and port of the enclave server. When enabled:

• All MPC operations and key material usage are handled within the enclave, separate from the rest of the TSM.
• The enclave encrypts sensitive data, ensuring that the TSM never has access to key material in clear text.

Deactivated players

In DKLS23, it is possible to reuse certain key material data when signing and generating presignatures. This significantly improves performance by reducing computation time and protocol rounds.

However, this optimization introduces a trade-off: if a player is detected cheating during the protocol, any precomputed data associated with that key material must be discarded and never reused.

To manage this, the TSM tracks which players have been deactivated due to cheating. The way this information is stored and accessed is controlled by the DeactivatedPlayersCache setting under [DKLS23].

Available Modes for DeactivatedPlayersCache

• MEMORY

• DATABASE

• NONE

Management API Swagger/OpenAPI UI and Download

When the management server is enabled, it now includes Swagger UI documentation, and a URL for downloading the OpenAPI yaml definitions, found under:

/management/docs

/management/openapi.yaml

Unauthenticated access to Management API

Specifying an empty API key under the management server API keys, grants unauthenticated access with the specified permissions. Previously you would need to enter a hash of the empty string to achieve the same result.

Debug information with duration

When running the TSM with a log level of DEBUG many operations are now logged together with a duration indicating how long time the operation took. If the operations fails, then no duration is logged.