# Pre-Release Notes - August 2026
source: https://developer.mastercard.com/mdes-digital-enablement/documentation/release-notes/pre-release-notes-august-2026/index.md

## Release Change Summary {#release-change-summary}

Mastercard has deprecated support for the RSA PKCS#1 v1.5 encryption scheme and transitioned to RSA-OAEP as the supported payload encryption scheme.
This transition enhances security by leveraging the RSA-OAEP encryption scheme which provides stronger security protection and improved resilience against evolving threats.

##### Impacted APIs {#impacted-apis}

* Tokenize
* Notify Token Updated
* Transact
* Search Tokens
* Get Tokens

## Release Timeline {#release-timeline}

* MTF - Deprecated encryption support until 31st March 2027
* Production - Deprecated encryption support until 31st March 2027

### Impacted Market {#impacted-market}

* Functionality Available - Global

## Change 1 - Deprecated the RSA PKCS#1 v1.5 encryption {#change-1---deprecated-the-rsa-pkcs1-v15-encryption}

Deprecated support for the RSA PKCS#1 v1.5 encryption scheme as it no longer meets current security standards. As part of this change, the references to the PKCS#1 v1.5 encryption scheme have been removed from the `encryptedKey` parameter.

## Change 2 Mandated the OAEP Hashing Algorithm {#change-2-mandated-the-oaep-hashing-algorithm}

The `oaepHashingAlgorithm` parameter is now mandatory within the `encryptedPayload`, `tokenDetail` objects. Must be either:

* SHA256
* SHA512


API Reference: `GET /digitization/static/1/0/tokenize`


API Reference: `GET /digitization/static/1/0/notifyTokenUpdated`


API Reference: `GET /remotetransaction/static/1/0/transact`


API Reference: `GET /digitization/static/1/0/searchTokens`


API Reference: `GET /digitization/static/1/0/getToken`

<br />

For details, refer the announcement, [GLB 13915.1](https://trc-techresource.mastercard.com/r/bundle/m_an13915_en-us/page/d/en-US/lvo6227672016071.html)

## Impact {#impact}

### Existing Customers {#existing-customers}

Existing customers must update their integrations to use RSA OAEP as the encryption and decryption mechanism for payloads in both API requests and responses. After implementing and validating RSA-OAEP support, customers must submit a request through the [Support Case Management](https://www.mastercardconnect.com/case-mgmt/) application to update their configuration.

###### Error Details {#error-details}

If a customer continues to use RSA PKCS#1 v1.5 encryption scheme for request payloads after 31 March 2027, the requests may be rejected by Mastercard with a `CRYPTOGRAPHY_ERROR` or a more specific
error such as `MISSING REQUIRED FIELD -- oaepHashingAlgorithm`.

###### Testing {#testing}

Mastercard recommends customers test their implementation with the RSA-OAEP encryption scheme in MTF. Customers must adopt the RSA-OAEP encryption scheme to align with the Production timeline.

### New Customers {#new-customers}

New customers must follow the updated configuration requirements before using this functionality. Refer to the API specification for details.