IETF work on TLS schedules, hybrids, and attestation

IETF lists on 2026-11-01 centered on new and revised drafts for TLS key schedules, post-quantum hybrid signatures, OAuth authentication references, and attested connections. SEAT discussion turned heated over security claims while moderator procedures and bot authentication formats also drew review.

Keccak-based TLS 1.3 key schedule draft

An IETF draft proposes a Keccak-based key schedule for TLS 1.3 under the subject draft-sullivan-tls-xof-ciphers-00. The Keccak team and formal-analysis volunteers joined the TLS working group thread on optimizations. Cryptographic implementers following TLS 1.3 agility have direct interest in whether the construction advances.

CFRG scopes SUF-CMA PQ/T hybrid signatures

CFRG participants are weighing whether the group should explore strongly unforgeable PQ/T hybrid signatures that preserve SUF-CMA, with replies requested by October 30. A poll and thread show broad interest alongside one dissent focused on migration speed. Designers of hybrid signature schemes need clarity on whether this property enters the working scope.

OAuth AMR values draft draws review and PRs

Review of draft-skyfire-oauth-amr-values in the OAuth working group produced pull requests and debate over amr combinations, channel semantics, and a possible amr_details claim. Eight participants exchanged sixteen messages. Servers and clients that emit or consume authentication method reference values will be affected by the settled claim structure.

SEAT use-cases rewrite debates security claims

A properties rewrite inside the SEAT use-cases draft shifted into dispute over security claims and attacks between competing attested-TLS proposals. Twelve participants generated fifty-three messages in a heated exchange. Readers tracking attested TLS must watch how the group resolves the conflicting models.

SAIL draft for bot egress IP ranges

A new Internet-Draft, draft-kelley-webbotauth-sail, proposes SAIL as a method for publishing bot egress IP ranges. The web-bot-auth thread examines TOML versus JSON formats and optional DNSSEC versus Web PKI trust anchors. Operators that publish or consume bot IP lists have a stake in the chosen format and trust path.

IETF moderator team procedures for comment

The IETF moderator team released draft procedures on mod-discuss for community input. Discussion concentrates on terminology, scope, and corrective versus punitive framing across thirty-three messages from fifteen participants. Anyone active on IETF lists should note potential changes to moderation practice.

Attestation binding for forward TLS connections

A new SEAT draft describes binding attestation to forward TLS connections through a sidecar endpoint and cached FAC, aimed at a confidential AI use case. Five participants posted five messages. Confidential computing and AI deployments that require attested forward paths are the primary audience.

HCTP context transfer seeks dispatch guidance

A second independent implementation of HCTP (draft-ruvalcaba-hctp-00) passed test vectors while the dispatch list considered routing for the constant-overhead agent-context protocol. Ekr questioned the level of deployment interest. Developers building agent systems can assess whether the overhead properties warrant further standards work.