Post-quantum certs, KEM adoption, and protocol disputes

Post-quantum transition work led the day, with a proposal to embed alternate issuer certificates and a CFRG adoption call on KEM security considerations. Other lists took up AI training preference signals, a contested attestation analysis, and several operational drafts.

Alternate issuer certificates for the post-quantum Web PKI

A new LAMPS draft proposes embedding alternate post-quantum issuer certificates to support legacy servers during the Web PKI transition. The thread ran to 21 messages among eight participants. Certificate operators should watch the idea because it aims to keep older servers usable while issuer material moves to post-quantum algorithms.

CFRG opens adoption call on PQ KEM security considerations

The Crypto Forum Research Group opened a call for adoption of post-quantum KEM security considerations, covering a common document plus ML-KEM and FrodoKEM drafts. Twenty-two messages from 19 participants showed broad support. Adoption would give protocol designers a shared security write-up as those KEMs are taken up.

Draft proposes robots.txt signals for AI training preferences

An Anthropic-submitted draft, draft-kelley-aipref-training-preference-signal-00, proposes robots.txt signals for AI-training preferences. Working group chairs and participants debated scope, process, and acknowledgments across 17 messages from 10 people. The exchange matters because it tests how training opt-outs would be expressed, and how the working group will handle the submission.

Reviewers contest early-attestation vulnerability claims

A paper asked CFRG to review a formal analysis that claims vulnerabilities in two early-attestation IETF drafts. Reviewers contested the fidelity of the model and end-of-life claims in a 38-message thread among seven participants. The dispute is unresolved, so implementers of those binding mechanisms should not treat the claimed breaks as settled.

ACME challenge using workload identity tokens

A new individual draft, draft-rasmussen-acme-wif-00, proposes a wif-01 ACME challenge that uses OIDC workload tokens from GitHub, Kubernetes, and AWS. The stated aim is to replace external account binding or DNS and HTTP validation. Six participants discussed the approach over 23 messages.

ATProto floats data model draws no objections

The IETF ATProto working group summarized a floats data model proposal, including a blog post, a pull request, and implementation details. Nine participants exchanged 19 messages and raised no objections. The lack of recorded opposition is the main signal for anyone tracking the ATProto data model.

DNSOP weighs a harder ban on QTYPE ANY

DNSOP discussed strengthening the deprecation of QTYPE ANY, beyond RFC 8482, to MUST NOT, citing attack amplification and a lack of legitimate use. Fifteen messages from nine participants stayed technical. Operators that still answer ANY queries would face a clearer prohibition if the change is adopted.

First SID-file publication process under review

IANA and designated experts discussed expert review for draft-ietf-anima-rfc8366bis, described as the first IESG-approved draft that requires SID file publication. The thread covered extraction, verification, and the registry process under RFC 9595, in 13 messages from nine participants. The handling of this request is likely to set the pattern for later YANG SID registrations.