Topic
Digital Identity and Credentials
Within the Topic facet, Digital Identity and Credentials topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
CASE FILE
The Algorithm Label Changed. The Key Refused to Follow: RFC 9709
An attacker can rewrite a cryptographic label without breaking the advertised cipher. RFC 9709 answers that awkward fact by making the complete encoded algorithm identity part of the key itself—and by forcing operators to separate successful processing from evidence they can…
IETF
Marshall T. Rose and the SNMP SetRequest That Changed Every Variable or None
A maintenance console sends one SNMP SetRequest containing several variable bindings. The agent answers `noError`. That is a useful receipt—but only for a deliberately narrow claim. The early SNMP design associated with Marshall T. Rose’s working-group leadership helps show why a…
Global Cloud Services Trends
SailPoint’s AI ARR needs a renewal-status column
SailPoint has put a number on its new AI business: more than US$70 million of annual recurring revenue. The number is useful precisely because it is not yet a revenue line. Its definition can keep a contract in the count after expiry while a renewal or replacement deal is still…
History
Jerry Saltzer and the Link That Carried a Name but No Permission
A path can tell a computer where a file is without answering whether the person following it may read the file. Jerry Saltzer’s account of protection in Multics turned that separation into an operating rule—and exposed how much revocation, audit and institutional power can be…
History
Eve Schooler and the Invitation That Did Not Carry the Conversation
The most consequential line in an Internet call is not the one carrying a voice. It is the one that finds the other person, proposes a session and then gets out of the way. Eve Schooler’s path from experimental conference control to the early Session Initiation Protocol helps…
History
Lixia Zhang and the Data Packet That Did Not Need Its Original Server
The revealing moment in Named Data Networking is not when a packet reaches a machine. It is when an Interest is answered by a copy found somewhere else—and the receiver can still ask who signed the data, whether that key was entitled to sign this name, and whether a fresher…
CASE FILE
The Resource Disappeared. So Did the Diagnosis: RFC 9729’s Concealed Authentication Boundary
Concealed authentication removes a useful signal from an intruder: the server no longer has to advertise a challenge before an authorized client can prove itself. The same silence can also erase the evidence an operator needs when a key is revoked late, a gateway exports the…
History
Kenneth J. Klingenstein and the Registry Between Two Login Domains
A login crossing from a university to an outside service looks like a short trip through a browser. Kenneth J. Klingenstein’s work helped expose the institution hidden in the middle: a trust fabric that must make one domain’s assertion usable in another without pretending that…
History
Klaas Wierenga and the Credential That Stayed Home
A student from Delft opens a laptop in Cape Town. The local university can offer a network, but it cannot vouch for the visitor’s account. Delft can vouch for the account, but it does not control the Cape Town network. Klaas Wierenga’s decisive contribution to eduroam was to make…
Story
ARIN Can Attach a Ticket to an Org ID. That Does Not Make It the Organization’s Decision.
ARIN fixed a mundane but costly support problem: staff no longer need to begin every ambiguous question by asking which organization it concerns. The resulting Org ID selector gives a ticket context and a durable home. That is good service design. It also makes one distinction…
IETF
A Token Status Bit Is Not a Revocation Timeline
A relying party reads one compact value and declines a credential. The decision may be correct. Yet the bit alone cannot say when the underlying state changed, who authorised that change, when the list exposed it, which cached copy was consulted or why this application treated…
History
The Target Added No Random Value. The Context ID Was Not a Bilateral Receipt: RFC 2025
A context identifier can look like proof that two peers jointly established something new. RFC 2025 makes the harder question unavoidable: whose fresh value actually went into that identifier?
IETF
The Channel Ended. The Claims Kept Moving: RFC 9781 and the UCCS Source Break
A verifier can receive an authenticated, integrity-protected claims set and still lose the basis for that assurance one function call later. RFC 9781 makes this boundary unusually concrete: tag 601 identifies an unprotected CWT Claims Set whose protection belongs to a channel…
IETF
The Header Found the Verifier. It Did Not Earn the Decision: RFC 9782
An API gateway can read `application/eat+cwt`, select a handler and produce a clean routing log before anyone has established what the bytes contain. RFC 9782 makes that first step interoperable. Its importance lies equally in what it refuses to collapse: a media type can name a…
IETF
The Message Had One Security Badge. Its Layers Did Not Share One Status: RFC 9787
The comforting part of an encrypted-mail interface is the badge. The difficult part is deciding exactly which bytes are entitled to it. RFC 9787 makes that boundary explicit: one received message gets one cryptographic summary, calculated only from the contiguous protection…
Global Cloud Services Trends
Orchid Security's agent kill switch needs an outcome test
New identity controls promise a way to intervene when AI agents stray beyond their remit. Buyers still need to distinguish a recorded response from evidence that the relevant authority has actually ended.
History
Before Email Could Be Signed, the Gateway Had to Stop Editing It: RFC 2015
A mail gateway could preserve every sentence a person cared about and still destroy a digital signature. RFC 2015 made that uncomfortable fact part of PGP/MIME's design: the evidence was not an abstract message but an exact MIME entity—content headers, transfer encoding…
IETF
The Hidden Service Answered. The Onion Key Had Not Yet Spoken: RFC 9799
The hidden service answered over Tor, the ACME account was valid, and the final CSR was ready. None of those facts yet proved that the applicant controlled the `.onion` identity. RFC 9799 makes that missing proof explicit—and shows why issuance authority, descriptor visibility…
History
The Message Opened. That Did Not Mean the Evidence Was Complete: RFC 1991
An early PGP message could pass through six visibly successful operations—ASCII decoding, packet parsing, session-key recovery, decryption, decompression and signature verification—without any one of them proving who controlled the key, when the act occurred, whether it was…
History
The Certificate Was Public. The Private Key Was Not: RFC 1984’s Trust Boundaries
In July 1996, two Internet standards bodies accepted that a government could operate a certification authority and still rejected the idea that a government, or any other third party, should hold a user’s private key. That is not a contradiction. It is the organising distinction…