Roadmap
Where Nen is headed
What's shipped, what's in progress, what we're exploring — and the things we've decided notto build. No dates: cryptography ships when it's right, not when a calendar says so.
Shipped · Available today
NEN-PROTOCOL-V3 — hybrid HKDF key schedule
No key material crosses the wire. Both sides derive k_enc and k_mac with HKDF-SHA256 from a hybrid X25519 + ML-KEM-768 shared secret, so a session stays safe unless both the classical and post-quantum legs break.
Session resumption + rekey ratchet
Sealed resumption tickets re-establish a session without a fresh KEM, and HKDF(k, "nen/v3 ratchet") advances keys forward for forward secrecy (client.rekey()).
Transcript-bound server identity (ML-DSA-65)
The server can sign a transcript hash binding the handshake; the client verifies it and rejects tampered or substituted handshakes.
Bidirectional, method-agnostic encryption (V2)
Every method is authenticated and every response is encrypted, bodyless GET/HEAD/DELETE included. Mandatory per-request HMAC over a canonical string, with a stable ISO-xxxx error contract.
Secure AI SDK
createSecureOpenAI / createSecureAnthropic encrypt the browser-to-your-backend hop — keeping prompts out of your own logs and intermediaries (not from the model provider, which needs plaintext to infer).
In progress · Being worked on
External security review
Our own KATs, fuzzing, and negative-path tests are green; the next step is independent eyes on the crypto and wire format. Tracked in Audit Readiness.
create-nen-app refresh
Bringing the scaffolding CLI fully in line with the V3 packages so a new project is post-quantum from the first commit.
Signed compliance attestation
An ML-DSA-signed runtime evidence export — the headline of the paid tier — moving toward a managed dashboard.
Exploring · Under consideration (no commitment)
Multi-recipient sessions
An envelope scheme so one encrypted payload can be opened by several independent key-holders. Deferred until a design partner needs it — it requires a key directory and carries real design weight.
Post-quantum media confidentiality
Extending the engine to keep images and video ciphertext through the delivery pipeline for long-secrecy use cases (medical, legal, defense). A dormant feature we'd revive for a specific compliance partner — explicitly not DRM.
More framework adapters
First-class adapters beyond Next.js route handlers as demand appears.
Won't build · Deliberately out of scope
"Unstealable" media / anti-screenshot DRM
Anything that can be displayed can be screen-recorded — the analog hole. We won't sell a promise physics breaks. (See our notes on why layered/anti-capture schemes don't hold up.)
A TLS replacement
Nen is additive: TLS protects the channel, Nen protects the payload past TLS termination. It is not a VPN and not a TLS substitute.
Hiding prompts from the model provider
Inference needs plaintext. The Secure AI SDK protects your own infrastructure, never the provider boundary — we say so plainly.
Want something prioritized?
The roadmap moves with real use cases. Read the protocol spec or the changelog to see exactly where things stand.