SSH PQ signatures, Verifpal 1.0, and multi-alg DNSSEC

IETF lists spent the day on post-quantum signature adoption for SSH, multi-algorithm DNSSEC rules, and AI-related identity drafts, alongside a major release of the Verifpal verifier. Governance and CBOR specification threads rounded out a technical, often heated session.

SSH WG call for ML-DSA signature drafts

The SSHM working group ran a call for adoption of hybrid and pure ML-DSA signature drafts that closed August 17. The thread produced 88 messages from 33 participants, with Daniel J. Bernstein and the chairs clashing over safety arguments and new AI cryptanalysis. The outcome will shape how SSH incorporates lattice-based signatures for remote access.

Verifpal protocol verifier reaches 1.0

Verifpal, described as usable protocol modeling software, reached version 1.0 after seven years of development. The release adds a new soundness theorem and an engine redesign. Protocol designers gain a more mature tool for checking security properties with lighter formal-methods overhead.

DNSOP multi-algorithm DNSSEC adoption call

DNSOP opened a call for adoption of draft-huque-dnsop-multi-alg-rules-08, closing 2026-08-31. Nineteen messages from 12 participants mixed support with strong objections on validator compatibility and post-quantum cryptography implications. Operators planning multi-algorithm DNSSEC need clearer rules for how validators handle mixed algorithm sets.

NomCom gender representation draft under debate

Gendispatch discussed draft-knodel-nomcom-gender-representation, which proposes a gender opt-in pool and skips in IETF Nominating Committee random selection. Twenty messages from 12 participants kept the temperature high on composition and comportment of the NomCom. The result affects how the IETF builds its leadership selection pool.

WIMSE call for AI agent authentication

The WIMSE working group issued a call for adoption of draft-klrc-aiagent-auth covering AI agent authentication and authorization. Thirty-two messages from 27 participants focused on agent versus workload identity and on delegation chains. Developers of agent systems need identity models that align with existing workload frameworks.

AI preference vocabulary categories proposed

The aipref working group examined proposed "AI System Inference" and "AI User Input" categories. Thirty-nine messages from 14 participants showed disagreement on scope, process ordering, and full opt-out coverage. Publishers and AI operators watching preference signals will care how these categories partition control.

CBOR CDDL integer and bignum matching

A CBOR thread debated whether CDDL #0 must match only major-type-0 integers or also bignum tags under RFC 8610 section 2.3.2. Thirty-five messages from nine participants treated the question as a validation dispute. Implementers of CDDL validators need a consistent reading to avoid interoperability failures.

EDN literals draft faces feature removals

The CBOR working group discussed removing or fixing controversial features from draft-ietf-cbor-edn-literals, including the CRI app-extension, the unknown-app CPA999 tag, and block comments. Thirty-nine messages from seven participants aimed at consensus through simplification. Users of Concise Diagnostic Notation need a stable, agreed feature set.