Internet and Protocols: EST bindings, PQC IPsec, DKIM2

IETF lists on 2026-10-25 advanced work on channel binding, post-quantum authentication, and email signing policy. Several adoption and design threads also refined naming, signature transitions, and NTP identification fields.

LAMPS revisits EST and tls-unique

The LAMPS working group reopened a long-dormant issue in RFC7030 on EST use of tls-unique channel binding. Participants are seeking a TLS 1.3-compatible binding approach or errata so certificate enrollment remains secure across TLS versions. Developers relying on EST need a stable channel-binding story as TLS 1.3 deployments dominate.

IPsec call for PQC hybrid authentication draft

The IPsec working group issued a call for adoption of draft-reddy-ipsecme-pqt-hybrid-auth-01, closing 2026-10-28. Discussion showed support mixed with objections over security properties and added complexity. The outcome will shape how hybrid post-quantum authentication is standardized for IPsec.

DKIM2 sender policy draft for DMARC

Wei Chuang posted draft-chuang-dkim2-sender-policy-01, which separates constraint flags from DMARC enforcement and revises alignment rules for DKIM2 forwarding. The proposal aims to clarify how sender policy interacts with the newer signature framework. Email operators and implementers tracking DKIM2 should watch the resulting policy model.

mDNS conflict reporting for ULD

The dnssd list examined how mDNS conflicts should be reported and what naming conventions fit the ULD specification. Participants worked through practical reporting and naming details needed by the draft. The decisions affect service-discovery behavior in unique local domain deployments.

DKIM2 PQC threat model and transitions

The DKIM list continued debate on the post-quantum threat model, including ML-DSA algorithm choices, hybrid constructions, and OR versus AND transition rules for DKIM2 signatures. The thread focuses on how to migrate signing algorithms without weakening authentication. Mail-system developers need clear transition rules before deploying PQC DKIM2.

NTPv5 server identification field sizing

NTP working-group discussion of the NTPv5 draft centered on extension-field sizing and truncation for server and node identification, with the goal of limiting amplification risk. Participants weighed operational identification needs against attack surface. The design choices will influence safe deployment of NTPv5 identification features.