Post-quantum crypto and OAuth authorization dominate IETF lists

IRTF and IETF working groups advanced several post-quantum cryptography proposals while OAuth discussions focused on fine-grained controls and authentication method references. DNS, SEAT, AT Protocol, and QUIC threads also saw concrete draft and design debate.

CFRG opens adoption call for PQ KEM security considerations

The Crypto Forum Research Group issued a call for adoption covering a common post-quantum KEM security considerations document together with ML-KEM and FrodoKEM drafts. Sixteen participants across sixteen messages expressed broad support. The material aims to give implementers shared guidance on security properties of these key encapsulation mechanisms.

IPsecme weighs hybrid PQC authentication draft

The IPsec working group ran a call for adoption of draft-reddy-ipsecme-pqt-hybrid-auth-01 that closed on 2026-10-28. Fifteen participants produced nineteen messages showing general support mixed with technical objections about security properties and added complexity. The draft addresses hybrid post-quantum authentication for IPsec.

OAuth solicits interest in fine-grained authorization

The OAuth working group opened a call for interest in fine-grained authorization, framed as an IETF 126 follow-up and aimed in part at AI agents. Twelve participants generated forty-six messages that referenced existing drafts on missions and RAR remediation. The discussion explores whether current OAuth mechanisms need extension for more precise permission models.

DNSOP rejects UTXO RRtype, debates generic binary type

A proposal for a UTXO data RRTYPE met resistance on the DNSOP list, with seven participants in fourteen messages arguing against a specialized type. Conversation shifted toward whether a generic BINARY or CONTAINER RRtype would be preferable to continued use of TXT. The outcome bears on how blockchain-related or opaque data might be published in DNS.

OAuth AMR values draft draws review and PRs

Review of draft-skyfire-oauth-amr-values produced fifteen messages from eight participants and triggered pull requests. Debate centered on amr value combinations, channel semantics, and a possible amr_details claim. Clarifying these authentication method reference details affects how clients and servers express multi-factor and channel-bound authentication.

SEAT use-cases rewrite sparks security claims dispute

A properties rewrite in the SEAT working group use-cases draft became a heated forty-seven-message thread among twelve participants. Discussion moved from editorial changes to competing security claims and attacks between attested-TLS drafts. The exchange highlights unresolved differences over what properties the group should assert.

AT Protocol URI syntax proposals for public and private namespaces

The ATP list examined potential 'at:public/' and 'at:space/' URI forms intended to make AT Protocol identifiers valid IETF URIs. Seven participants in fourteen messages considered support for both public and non-public namespaces. A workable URI scheme would improve interoperability of AT Protocol identifiers with existing URI tooling.

Draft proposes delegating QUIC stateless resets

A new draft on the QUIC working group list suggests delegating QUIC stateless resets to external components such as the operating system. Seven participants offered thirteen messages of initial feedback that included objections. The idea would let implementations offload reset handling while preserving protocol correctness.