# August 2026 Pre-Release Notes
source: https://developer.mastercard.com/authentication-facilitator/documentation/pre-release-notes/august_2026_release_notes/index.md

## Release Change Summary {#release-change-summary}

Mastercard has deprecated support for the RSA PKCS#1 v1.5 encryption scheme and transitioned to RSA-OAEP as the supported payload encryption scheme.
This transition enhances security by leveraging the RSA-OAEP encryption scheme which provides stronger security protection and improved resilience against evolving threats.

##### Impacted APIs {#impacted-apis}

* Deliver Authentication Code

## Release Timeline {#release-timeline}

* MTF - Deprecated encryption support until 31st March 2027
* Production - Deprecated encryption support until 31st March 2027

### Impacted Market {#impacted-market}

* Functionality Available - Global

## Change 1 - Deprecated the RSA PKCS#1 v1.5 encryption {#change-1---deprecated-the-rsa-pkcs1-v15-encryption}

As part of this change, the references to the PKCS#1 v1.5 encryption scheme have been removed from the `encryptedKey` parameter.

## Change 2 Mandated the OAEP Hashing Algorithm {#change-2-mandated-the-oaep-hashing-algorithm}

The `oaepHashingAlgorithm` parameter is now mandatory within the `encryptedPayload` object and must be configured according to the customer's configured value. Supported values are:

* SHA256
* SHA512

Algorithm selected at the time of onboarding will be used in this field.

API Reference: `GET /deliverAuthenticationCode`

For details, refer the announcement, [GLB 13915.1](https://trc-techresource.mastercard.com/r/bundle/m_an13915_en-us/page/d/en-US/lvo6227672016071.html)

## Impact {#impact}

### Existing Customers {#existing-customers}

Existing customers must update their integrations to use RSA OAEP as the encryption and decryption mechanism for payloads in both API requests and responses. After implementing and validating RSA-OAEP support, customers must submit a request through the [Support Case Management](https://www.mastercardconnect.com/case-mgmt/) application to update their configuration.

###### Error Details {#error-details}

After 31 March 2027, Mastercard sends SHA256 or SHA512 values in the `oaepHashingAlgorithm` parameter. Customers must ensure their systems do not reject requests with a `CRYPTOGRAPHY_ERROR` due to these values.

###### Testing {#testing}

Testing is recommended for validation. Contact your Mastercard representative and submit a CIS project for testing.

### New Customers {#new-customers}

New customers must follow the updated configuration requirements before using this functionality. Refer to the API specification for details.

### Personal data \& Privacy Note {#personal-data--privacy-note}

Issuers are reminded that the information presented via the Authentication Facilitator API includes personal data which is subject to data privacy laws. Issuers must satisfy themselves that the processing of such personal data is compliant with applicable privacy laws.