Topic
Digital Identity and Credentials
Within the Topic facet, Digital Identity and Credentials topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
IETF
The Message Had One Security Badge. Its Layers Did Not Share One Status: RFC 9787
The comforting part of an encrypted-mail interface is the badge. The difficult part is deciding exactly which bytes are entitled to it. RFC 9787 makes that boundary explicit: one received message gets one cryptographic summary, calculated only from the contiguous protection…
Global Cloud Services Trends
Orchid Security's agent kill switch needs an outcome test
New identity controls promise a way to intervene when AI agents stray beyond their remit. Buyers still need to distinguish a recorded response from evidence that the relevant authority has actually ended.
History
Before Email Could Be Signed, the Gateway Had to Stop Editing It: RFC 2015
A mail gateway could preserve every sentence a person cared about and still destroy a digital signature. RFC 2015 made that uncomfortable fact part of PGP/MIME's design: the evidence was not an abstract message but an exact MIME entity—content headers, transfer encoding…
IETF
The Hidden Service Answered. The Onion Key Had Not Yet Spoken: RFC 9799
The hidden service answered over Tor, the ACME account was valid, and the final CSR was ready. None of those facts yet proved that the applicant controlled the `.onion` identity. RFC 9799 makes that missing proof explicit—and shows why issuance authority, descriptor visibility…
History
The Message Opened. That Did Not Mean the Evidence Was Complete: RFC 1991
An early PGP message could pass through six visibly successful operations—ASCII decoding, packet parsing, session-key recovery, decryption, decompression and signature verification—without any one of them proving who controlled the key, when the act occurred, whether it was…
History
The Certificate Was Public. The Private Key Was Not: RFC 1984’s Trust Boundaries
In July 1996, two Internet standards bodies accepted that a government could operate a certification authority and still rejected the idea that a government, or any other third party, should hold a user’s private key. That is not a contradiction. It is the organising distinction…
IETF
A Workload Credential Is Not the Workload: Eight Proofs Between Bootstrap and Outcome
The WIMSE practices draft shows how platforms can replace embedded secrets with short-lived workload credentials. Its harder lesson is that every safer credential still sits inside a longer chain of facts that must not be compressed into one green authentication event.
IETF
Jim Schaad and the Key ID That Was Only a Hint
Two keys sit in the same verifier under the same short label. The message supplies that label, the first key is tried, and a dashboard turns the result into the name of a device. Jim Schaad’s COSE specification draws a harder boundary: the label is a search hint; identity and…
IETF
Patrik Fältström and the ENUM Answer That Did Not Complete the Call
The number resolved. A signed DNS answer yielded a URI. The phone still never rang. Patrik Fältström’s work on ENUM is most useful when those three facts remain separate.
IETF
David Harrington and the SNMP Context That Did Not Identify the Operator
The command named an engine, a context and an entity with precision. None of those fields said which human had chosen the change. David Harrington’s SNMP architecture makes that absence visible rather than filling it with an assumption.
IETF
Revision 36 Turns Voucher Renewal Into a Control Decision Without a Decision Receipt
A short-lived onboarding voucher looks like a credential with a new end date. Revision 36 of the IETF's Voucher Artifact draft now makes the deeper operation explicit: renewal confirms that an earlier relationship still holds, checks continuing access to a Domain key, consults…
IETF
Bernard Aboba and the EAP Method That Did Not Grant Network Access
The credential was valid and the authentication method finished cleanly. Yet the controlled port stayed closed. Bernard Aboba’s work on EAP explains why those two observations can coexist without contradiction.
IETF
Chris Newman and the Secure Mail Port That Did Not Authorize a User
Port 465 can require the conversation to begin with TLS, but it cannot decide who may send a message. Chris Newman’s work on secure mail access shows why transport, service identity, user authentication and authorization need separate receipts.
History
The Ticket Arrived. The Receipt Did Not: RFC 1964’s Authentication Boundaries
RFC 1964 gave Kerberos V5 a disciplined GSS-API wire vocabulary: a mechanism identifier, typed tokens, a digest for caller-supplied channel bindings, service flags and an optional delegated credential. The design is valuable precisely because each item stops at a boundary. A…
IETF
The Principal Signed the Delegation. The Issuer Still Bound the Agent Key
Two valid signatures can sit in one credential without answering the same question. A new AIC-JWT revision puts the principal’s authorization inside an issuer-signed token, yet draws a precise line between the Agent identity the principal authorized and the proof-of-possession…
Story
RIPE Database 1.124.1 Fixed Certificate Selection. Its “No Evidence” Finding Needs a Search Boundary
RIPE NCC was right to ship a reported authentication vulnerability without waiting for a routine test interval. The next duty is different: show members what time, traffic and registry history were actually examined before “no evidence of exploitation” became the public…
IETF
An Enrollment Voucher Arrives After Identity Leaves the Device
A constrained device can withhold its operational identity and still disclose enough to be enrolled. In Lightweight Authorization using EDHOC, that disclosure is deliberate: an authenticated domain authenticator receives the device’s enrollment identity and sends it to a trusted…
IETF
Nat Sakimura and the Critical Header a Valid Signature Could Not Ignore
A JSON Web Signature can pass its mathematical check and still be unusable. RFC 7515 made room for that outcome through `crit`: an integrity-protected list that tells a verifier which extensions it must understand before it may accept the message. The distinction is easy to miss…
IETF
Justin Richer and the Active Token That Could Not Approve the Request
An OAuth resource server asks about a bearer token and receives the most reassuring two-word answer in the exchange: `active: true`. The token is current, the authorization server recognizes it and the request can move forward. Yet one decision is still missing. The introspection…
IETF
Rifaat Shekh-Yusef and the Nonce Count That Could Not Number the Transaction
The first authenticated request carries `nc=00000001`. It looks uncannily like the beginning of a transaction ledger: neat, monotonic and attached to a credential check. But in the HTTP Digest scheme edited by Rifaat Shekh-Yusef, that small hexadecimal field has a narrower…