PQ KEM guidance, hybrid IPsec auth, and protocol drafts

Post-quantum cryptography work led the day across IRTF and IETF lists, with adoption calls for KEM security considerations and hybrid IPsec authentication. Parallel threads advanced email sender policy, service discovery, OAuth AMR claims, bot egress publication, CMS signing practice, and SEAT identity use cases.

CFRG call for PQ KEM security considerations

The Crypto Forum Research Group opened a call for adoption of drafts on ML-KEM and FrodoKEM security considerations together with general KEM guidance. Multiple working groups are already incorporating these KEMs. Protocol designers need the resulting threat models and usage constraints as post-quantum migration proceeds.

IPsecME adoption call for PQC hybrid auth

The IPsec Working Group ran a call for adoption of draft-reddy-ipsecme-pqt-hybrid-auth-01 ending 2026-10-28. Support appeared alongside technical objections on security properties and complexity. The decision will determine how hybrid post-quantum authentication enters IPsec.

DKIM2 sender policy draft

Wei Chuang posted draft-chuang-dkim2-sender-policy-01, separating constraint flags from DMARC enforcement and revising alignment rules for DKIM2 forwarding. The ietf-dkim list examined the changes across a long thread. Mail operators and filter authors require clear interaction rules between DKIM2 and existing DMARC policy.

mDNS conflict reporting for ULD

The dnssd working group discussed mDNS conflict reporting and naming conventions inside the ULD specification. Participants debated how local-name conflicts should be signaled. Stable zero-configuration networking depends on predictable conflict handling.

OAuth AMR values draft review

Review of draft-skyfire-oauth-amr-values produced pull requests and debate on amr combinations, channel semantics, and a possible amr_details claim. The OAuth working group is refining how authentication methods are expressed. Multi-factor and step-up authentication implementers will be affected by the final claim set.

SAIL draft for bot egress ranges

A new Internet-Draft, draft-kelley-webbotauth-sail, proposes SAIL for publishing bot egress IP ranges. The web-bot-auth list debated TOML versus JSON formats and optional DNSSEC versus Web PKI trust. Crawler operators and sites that gate bot traffic have a direct interest in standardized egress declaration.

Last call on CMS SignedData best practices

IETF last call opened for draft-ietf-lamps-cms-euf-cma-signeddata-03 as Best Current Practice. The draft addresses existential forgery risk in CMS SignedData by restricting the id-data content type. Cryptographic library maintainers and CMS signature users should examine the recommended attribute handling.

SEAT use-cases properties rewrite

The SEAT working group debated a properties rewrite in its use-cases draft, including retention of the ID-Crisis paper, CVE references, and identity definitions. A pull request drew heated discussion among ten participants. Settled identity properties will shape the scope of later protocol work.