Version 2026 Updates
We are pleased to announce the first beta release for version 2026 across our entire product line! In this update guide, we provide an overview of all the new features and updates for every toolkit. We welcome you to download the latest version of all products and try them for yourself.
This guide provides details about new functionality that applies to all libraries as well as details applicable to individual products.
Contents
Overview
2026 brings several changes that apply broadly across the entire product line, ahead of the toolkit-specific highlights further down.
Post-Quantum Cryptography Everywhere
Post-quantum algorithm support is no longer limited to the cryptography-focused toolkits. Every TLS- and SSH-enabled component across the product line now supports post-quantum key exchange and signature algorithms, so applications built on any /n software component can support PQC without waiting on a component-by-component rollout. IPWorks PGP and IPWorks Encrypt go a step further with dedicated post-quantum components and algorithm support, covered in their respective sections below.
For more details please refer to this Post Quantum Cryptography Support article.
New Go and Rust Editions
New Go and Rust editions are now available for the majority of our products. Go and Rust editions maintain the same intuitive API present in existing C++, Java, and .NET editions and provide a consistent developer experience. These new editions expand the capabilities of two of the fastest-growing languages in modern development.
Performance and Usability Improvements
We've continued to invest in general performance and usability across the board this release - from faster default compiler settings in the C++ editions, to more consistent and self-documenting APIs achieved by promoting long-standing configs to full properties and methods, converting integer flags to enums, and cleaning up inconsistent naming. Many of these show up as small, individual changes in the toolkit-specific sections below, but together they add up to a more polished experience across the entire product line.
Product Details
All products benefit from the major highlights listed above, such as new Go and Rust editions and support for Post-Quantum Cryptography. The sections below detail additional new product-specific features and improvements.
| IPWorks | IPWorks SSH | IPWorks EDI |
| IPWorks NFS | IPWorks PGP | IPWorks VoIP |
| IPWorks Encrypt | Secure PDF | IPWorks Zip |
| IPWorks Auth | Cloud Keys | Cloud Mail |
| Cloud Storage | SecureBlackbox |
IPWorks
IPWorks continues to build on the foundation of the toolkit with a number of API refinements, security defaults, and platform updates that apply across the product line.
Security and Reliability Updates
CertMgr and the Certificate class now report the EffectiveDate and ExpirationDate properties in UTC rather than local time, removing a common source of confusion around time zones and daylight saving time. TCPServer in the C++ edition now assigns unique connection IDs by default instead of reusing IDs from disconnected clients, which resolves subtle issues in server implementations that track connections by Id. FIPS mode has also been tightened: AllowPKCS1InFIPS now defaults to false. Additionally, the default value of FirewallHTTPVersion has been changed from HTTP/1.0 to HTTP/1.1.
API and Usability Improvements
Several long-requested API gaps have been closed. The POP component now includes a ResetState method to reset server-side session state, separate from the existing Reset method which only resets local component state. The WSClient component now includes PauseData and ProcessData methods to temporarily pause communication. The XML component adds an Interrupt method so that in-progress document parsing can be stopped. E-Mail based components now include OAuth capabilities directly without the need for using the standalone OAuth component.
IPWorks SSH
IPWorks SSH includes refined connection handling and modernizes several defaults to better match current SSH client conventions.
Server and Key Management
SSHServer's SSHCert property has been changed from a single value to a collection, allowing multiple host keys (for example, both an Ed25519 and an RSA key) to be configured at the same time. This preserves compatibility with legacy clients while using modern keys with clients that support them.
Fingerprint Format Updates
The default encoding for server host key fingerprints reported by the SSHServerAuthentication event and the SSHFingerprintSHA256/SHA1/MD5 configs has changed from hex to base64 to match the format used by most modern SSH clients. The SSHAcceptServerHostKeyFingerprint config now accepts fingerprints in either hex or base64 format as well.
SFTP Improvements
The SFTPClient component now includes CopyRemoteFile and CopyRemoteData methods to copy files remotely without needing to download and re-upload the file. This functionality may be used with servers that support the copy-data extension.
IPWorks EDI
IPWorks EDI has been updated with support for AS2 version 1.3, and general cleanup to keep the toolkit aligned with current EDI practices.
The AS2 default encryption algorithm for AS2 profiles has moved from 3DES to AES-CBC-256. For AS2 version 1.3 specifically, outgoing messages now reject weak digest, MDN MIC, and encryption algorithms, and incoming messages and generated MDNs are held to the same standard. AS2 1.3 messages and MDNs also now include an AS2-Product header. The AS2Version property defines which version is enabled. For compatibility, AS2 Version 1.2 is the default and AS2 Version 1.3 may be optionally enabled.
IPWorks NFS
IPWorks NFS includes updated support for NFSv4.1. NFS 4.1 is fully supported including robust support for NFS sessions. This update also includes a number of performance improvements to transfer speeds.
IPWorks PGP
IPWorks PGP includes numerous updates including support for Post-Quantum Cryptography and enhanced interoperability.
Post-Quantum Cryptography Support
IPWorks PGP now supports the post-quantum algorithms defined in RFC 9980: ML-KEM-768+X25519 and ML-KEM-1024+X448 for encryption, and ML-DSA-65+Ed25519 and ML-DSA-87+Ed448 for signing. When one of these algorithms is selected, the associated curve is implied by the algorithm name and the Curve/SubKeyCurve configs no longer apply. GnuPG's own ML-KEM variant is also supported for interoperability with recent GnuPG builds.
GnuPG v5 Interoperability
GnuPG has adopted its own LibrePGP standard rather than the OpenPGP v6 format defined in RFC 9580. To maintain interoperability, a new CompatibilityProfile config has been added to KeyMgr and OpenPGP, allowing you to switch between the standard "RFC9580" profile (the default) and "LibrePGP". Messages and keys in either format can be parsed regardless of which profile is active.
IPWorks VoIP
IPWorks VoIP improves audio handling and adds presence-style status subscriptions.
Busy Lamp Field Support
New SubscribeUserStatus and UnsubscribeUserStatus methods, along with a UserStatusChanged event, allow an application to monitor the call status of other endpoints (idle, ringing, in a call, and so on) and be notified as that status changes - commonly known as Busy Lamp Field (BLF) functionality. The initial implementation has been tested against FreePBX.
Audio Handling Improvements
The Record event now includes a Direction parameter indicating whether an audio frame is incoming or outgoing, replacing the previous AudioDirection config. AudioEncoding has been promoted from a config to a full property, and EnableDynamicRecording now defaults to true.
Secure PDF
Secure PDF continues the modernization of the PDF signing and forms API. This release includes updates for remote signing capabilities. The RemoteSignatureData, RemoteSignatureDigest, and RemoteSignatureMethod properties allow the PDF itself to remain locally while signing is performed remotely.
IPWorks Zip
IPWorks Zip adds support for batching multiple Zip modifications into a single pass. The Zip component adds StartBatch, ProcessBatch, and AbortBatch methods. Once a batch session is started, AppendFiles, Delete, and Update operations are queued in memory rather than applied immediately; ProcessBatch then rewrites the archive once with the final queued state, avoiding repeated decompress/compress cycles when making several changes at once. AbortBatch discards any queued operations and leaves the archive unchanged.
IPWorks Encrypt
IPWorks Encrypt significantly expands the toolkit's cryptographic primitives, with a particular focus on post-quantum readiness.
New MLKEM Component
The new MLKEM component implements the FIPS 203 key-encapsulation algorithm. All three standard parameter sets are supported (512, 768, and 1024, selected via the ParamSet config), and the component exposes CreateKey, Encapsulate, and Decapsulate methods.
New MLDSA Component
The new MLDSA component implements the FIPS 204 signature algorithm. All three standard parameter sets are supported (44, 65, and 87, selected via the ParamSet config), along with both pure ML-DSA and pre-hashed HashML-DSA signing; SHA256, SHA384, and SHA512 are available as hash algorithms for the pre-hashed mode.
New CMAC Component
The new CMAC component adds AES-CMAC support, with platform-accelerated implementations available via CNG on Windows and FIPS-validated implementations available across the Java, .NET, and C++ editions.
New HMAC Component
The new HMAC component provides full support for Hash-Based Message Authentication Code including support for SHA1, SHA256, and SHA512.
JWT Updates
The JWT component adds SignAndEncrypt and DecryptAndVerify methods along with a new SigningKey property, which is used for the HMAC signature step while the existing Key property continues to be used for AES encryption.
IPWorks Auth
IPWorks Auth 2026 includes the new WebAuthn component. The WebAuthn component provides a simple way to implement a WebAuthn Relying Party server, enabling passwordless authentication in your web application.
Cloud Storage
Cloud Storage adds support for Supabase (a new S3-compatible provider) and improved user identify operations. More providers coming soon.
Account and Identity Improvements
The new GetCurrentUser method has been added to the Microsoft-based components, making it easier to identify which account an access token is tied to - something that's otherwise difficult to determine from the access token alone, especially for personal accounts. The result is exposed through a new CurrentUser type, and is currently available in the OneDrive and SharePoint components, with more components to follow.
Provider Updates
S3 now supports Supabase as a service provider, since Supabase's storage API is S3-compatible. More providers are coming soon.
SecureBlackbox
In line with our other products, SecureBlackbox underwent a major re-evaluation of security baselines. All the major technologies received a boost of their security defaults. This includes TLS and SSH, which have older and weaker security mechanisms now switched off and come with prioritized post-quantum security.
Post-Quantum Cryptography Support
This release comes with support for post-quantum algorithms across the board. The transport components on both sides have received support for ML-KEM key exchange as well as its hybrid variants based on NIST and Edwards elliptic curves. ML-DSA signature support has been integrated fully into the PKI and AdES stack, allowing for a qualitative shift in the security level provided.
Support for the post-quantum technology was integrated seamlessly into the existing components, which results in next-to-zero learning curve.
Advances in the digital signature ecosystem
The electronic signature stack received multiple improvements in all areas. The chain validation subsystem now fully supports Trusted Lists v6, which have now become standard across Europe. Support for Delta CRL allows for wider coverage of PKI ecosystem and faster chain validations. Support for CSC v2 signature protocol provides for increased interoperability and smoother integration with third-party providers.
Secure transports
A number of long-awaited features are now supported in the transport components. SecureBlackbox 2026 fully supports OpenSSH certificates for trust-based authentication on the client and server sides. These integrate seamlessly into the existing API. The refreshed HTTP components come with support for the HTTP SSE (Server-Sent Events) technology, providing for easier integration with modern real-time architectures.
Supporting modern development tools
SecureBlackbox 2026 includes support for the most recent versions of Visual Studio, Java, Delphi, Free Pascal/Lazarus, and other development toolchains and platforms. At the same time, we continue our long-time commitment to those tied to older development environments by providing dependable backward compatibility packs.
Additional Updates
We have reviewed and updated our API to make sure it provides efficient, rewarding, easy-to-understand experience. Some of the component declarations were updated to match those criteria better. The SSH key management API, as well as TLS settings, were updated to reflect the respective subject areas better. WebDAVClient and WebSocketClient were updated with new features that expand their capabilities by providing better access to the HTTP layer.
In addition to public API changes, we conducted a major cleanup of the underlying code to make sure it provides a secure and efficient foundation for your project's needs.
API Changes
The following articles detail major API changs between version 2024 and version 2026. Please refer to the documentation for a complete reference.
We appreciate your feedback. If you have any questions, comments, or suggestions about this article please contact our support team at support@nsoftware.com.