Akira platform version 1.99.23 has been released (tagged at 1.99.23.20261015053924.dce1b9848c). This is in a series of releases made from the 1.99 development branch.

The following are release notes for Akira, Loop, and Dora 1.99.23.

Akira

Security

Sensitive authentication and manager-connection information is cleared more thoroughly from memory when it is no longer needed. This reduces unnecessary retention of secrets during management operations.

Loop

GPU-accelerated DNSSEC signing and verification

Optional Vulkan GPU acceleration is now available for DNSSEC zone signing and signature verification, including for the new MLDSA44 post-quantum algorithm. dnssec-signzone(1) and dnssec-verify(1) can use a selected GPU when requested, and fall back to CPU processing if Vulkan initialization fails. CPU execution remains the default.

Signing and verification can prepare and process signatures asynchronously using multiple workers and bounded batches. Large-zone signing, output generation, and final verification have also been improved. Statistics are available to operators to examine verification performance and resource use.

Post-quantum DNSSEC resolution

When a DNSSEC delegation advertises MLDSA44, the validating resolver can query the delegated authoritative servers directly over TCP. This avoids an initial UDP exchange that is likely to produce a truncated response because of larger RRSIGs. The behavior is enabled by default and can be controlled with the resolver-tcp-directly-for-large-algorithms option in named.conf(5).

Protection of sensitive data

Cryptographic keys, signing intermediates, and other sensitive data are cleared more thoroughly after use. This includes additional cleanup of sensitive data held in GPU memory during accelerated signing.

Compatibility and testing

Support for MLDSA44 has received additional correctness, boundary-case, and system-test coverage. Tests that require MLDSA44 are now skipped when the necessary cryptographic support is unavailable in the OpenSSL library (older than version 3.5). Compiler and build portability have also been improved.

Dora

DHCP reliability

Error handling has been strengthened in DHCP failover and management protocol processing. The changes reduce the risk of using incomplete protocol data or invalid references when an operation fails.

Maintenance and build compatibility

Internal memory handling has been improved, including the replacement of a variable-length stack buffer in DHCP class processing. Compiler warnings across the DHCP server, relay, and related components have also been addressed.

Changes

Akira

• Improve clearing of sensitive authentication and manager-connection information after use. [RT2434, RT2439]

Loop

• Add optional Vulkan GPU acceleration for DNSSEC signing and verification, with CPU fallback when the GPU cannot be initialized. [RT2440]
• Improve asynchronous signing and verification of large zones, including bounded parallel processing, final verification, and operational statistics. [RT2440]
• Use TCP directly for DNSSEC delegations using large-signature algorithms such as MLDSA44, with a configuration option to restore UDP-first behavior. [RT2438]
• More thoroughly clear sensitive cryptographic and GPU signing data after use. [RT2434, RT2439, RT2440]
• Expand MLDSA44 correctness and system tests, including signing boundary conditions and support-dependent test execution. [RT2430, RT2436, RT2437, RT2440]
• Standardize MLDSA44 terminology and improve compiler compatibility. [RT2433, RT2435, RT2464]

Dora

• Improve handling of failed reads and incomplete data in DHCP failover and management protocol operations. [RT2464]
• Improve lease-reference initialization and memory handling in DHCP class processing. [RT2435, RT2464]
• Fix compiler warnings and improve build compatibility across DHCP tools and libraries. [RT2435, RT2464]

Some more development releases will be made from this branch until Akira 2.0 is ready to be branched.