IETF protocols: ML-DSA CMS RFC and draft progress

The IETF published RFC 10082 for composite post-quantum signatures in CMS while working groups advanced NTPv5, DKIM, MPLS, and DNS drafts and debated attested TLS. Adoption calls and technical discussions addressed migration, format changes, and privacy tradeoffs.

RFC 10082 defines composite ML-DSA for CMS

The IETF published RFC 10082 on the Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for use in the Cryptographic Message Syntax (CMS). The specification supports post-quantum migration through composite signatures. Protocol implementers gain a standardized path for hybrid classical and lattice-based signatures in CMS-protected messages.

NTPv5 draft-10 adjusts root-delay format

The NTP working group released draft-ietf-ntp-ntpv5-10.txt. Discussion focused on a root-delay format change that caps maximum round-trip time at approximately 16 seconds, noted as breaking deep-space use cases. Time-synchronization developers must weigh the format impact on specialized high-latency environments.

CFRG examines attested TLS security proofs

A CFRG thread debated security proofs and RFC 9266 channel-binding applicability for intra-handshake attested TLS drafts. Participants examined the applied cryptography of the approach. Secure transport designers should track how channel bindings interact with attestation inside the handshake.

DKIM draft allows sender-specified modifications

A new individual draft, draft-clayton-dkim-canmodify-00, proposes sender-specified benign modifications for DKIM2. The working group discussed removals and per-MIME-part hashing. Email authentication maintainers gain options for controlled message alterations while preserving signature validity.

MPLS adoption call for RSVP-TE with SR-MPLS

The MPLS working group opened a call for adoption of draft-beeram-mpls-rsvp-sr-01, ending 2026-11-17. The draft extends RSVP-TE to use SR-MPLS Adj-SIDs and drew mostly support plus one technical coexistence discussion. Traffic-engineering operators should watch for integration of segment routing identifiers into RSVP signaling.

DNSOP adoption call on local root zone serving

The DNSOP working group issued a call for adoption of either draft-wkumari-dnsop-localroot-bcp or draft-hoffman-rootcache. The drafts address local root zone serving and would replace RFC 8806 and RFC 8807. Resolver operators stand to benefit from clearer guidance on serving the root locally.

SEAT weighs attestation timing versus identifier exposure

The SEAT working group debated intra-handshake versus post-handshake attestation timing to limit hardware identifier exposure. Notes on early attestation highlighted anonymity concerns. Privacy-conscious deployments must balance early proof of hardware state against linkability risks.

Draft proposes testing framework for attested TLS

An individual draft, draft-elekula-seat-attested-tls-testing-00, proposes a testing framework for attested TLS and DTLS. Discussion touched on latency metrics. Implementers receive a structured way to evaluate attestation-enabled secure transports under controlled conditions.