Topic
Digital Identity and Credentials
Within the Topic facet, Digital Identity and Credentials topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
IETF
A Workload Credential Is Not the Workload: Eight Proofs Between Bootstrap and Outcome
The WIMSE practices draft shows how platforms can replace embedded secrets with short-lived workload credentials. Its harder lesson is that every safer credential still sits inside a longer chain of facts that must not be compressed into one green authentication event.
IETF
Jim Schaad and the Key ID That Was Only a Hint
Two keys sit in the same verifier under the same short label. The message supplies that label, the first key is tried, and a dashboard turns the result into the name of a device. Jim Schaad’s COSE specification draws a harder boundary: the label is a search hint; identity and…
IETF
Patrik Fältström and the ENUM Answer That Did Not Complete the Call
The number resolved. A signed DNS answer yielded a URI. The phone still never rang. Patrik Fältström’s work on ENUM is most useful when those three facts remain separate.
IETF
David Harrington and the SNMP Context That Did Not Identify the Operator
The command named an engine, a context and an entity with precision. None of those fields said which human had chosen the change. David Harrington’s SNMP architecture makes that absence visible rather than filling it with an assumption.
IETF
Revision 36 Turns Voucher Renewal Into a Control Decision Without a Decision Receipt
A short-lived onboarding voucher looks like a credential with a new end date. Revision 36 of the IETF's Voucher Artifact draft now makes the deeper operation explicit: renewal confirms that an earlier relationship still holds, checks continuing access to a Domain key, consults…
IETF
Bernard Aboba and the EAP Method That Did Not Grant Network Access
The credential was valid and the authentication method finished cleanly. Yet the controlled port stayed closed. Bernard Aboba’s work on EAP explains why those two observations can coexist without contradiction.
IETF
Chris Newman and the Secure Mail Port That Did Not Authorize a User
Port 465 can require the conversation to begin with TLS, but it cannot decide who may send a message. Chris Newman’s work on secure mail access shows why transport, service identity, user authentication and authorization need separate receipts.
History
The Ticket Arrived. The Receipt Did Not: RFC 1964’s Authentication Boundaries
RFC 1964 gave Kerberos V5 a disciplined GSS-API wire vocabulary: a mechanism identifier, typed tokens, a digest for caller-supplied channel bindings, service flags and an optional delegated credential. The design is valuable precisely because each item stops at a boundary. A…
IETF
The Principal Signed the Delegation. The Issuer Still Bound the Agent Key
Two valid signatures can sit in one credential without answering the same question. A new AIC-JWT revision puts the principal’s authorization inside an issuer-signed token, yet draws a precise line between the Agent identity the principal authorized and the proof-of-possession…
Story
RIPE Database 1.124.1 Fixed Certificate Selection. Its “No Evidence” Finding Needs a Search Boundary
RIPE NCC was right to ship a reported authentication vulnerability without waiting for a routine test interval. The next duty is different: show members what time, traffic and registry history were actually examined before “no evidence of exploitation” became the public…
IETF
An Enrollment Voucher Arrives After Identity Leaves the Device
A constrained device can withhold its operational identity and still disclose enough to be enrolled. In Lightweight Authorization using EDHOC, that disclosure is deliberate: an authenticated domain authenticator receives the device’s enrollment identity and sends it to a trusted…
IETF
Nat Sakimura and the Critical Header a Valid Signature Could Not Ignore
A JSON Web Signature can pass its mathematical check and still be unusable. RFC 7515 made room for that outcome through `crit`: an integrity-protected list that tells a verifier which extensions it must understand before it may accept the message. The distinction is easy to miss…
IETF
Justin Richer and the Active Token That Could Not Approve the Request
An OAuth resource server asks about a bearer token and receives the most reassuring two-word answer in the exchange: `active: true`. The token is current, the authorization server recognizes it and the request can move forward. Yet one decision is still missing. The introspection…
IETF
Rifaat Shekh-Yusef and the Nonce Count That Could Not Number the Transaction
The first authenticated request carries `nc=00000001`. It looks uncannily like the beginning of a transaction ledger: neat, monotonic and attached to a credential check. But in the HTTP Digest scheme edited by Rifaat Shekh-Yusef, that small hexadecimal field has a narrower…
IETF
Peter Saint-Andre and the Certificate Match That Could Not Choose the Service
The certificate was valid for the name the client checked. That sentence sounds like the end of authentication, but it hides the first and more consequential choice: why did the client check that name? Peter Saint-Andre and Rich Salz make the order explicit in RFC 9525. The…
IETF
Alexey Melnikov and the Authentication Success That Could Not Grant a Service
The status light turned green. The credentials had been accepted, an identity had been associated with the session, and the exchange was over. Yet the next operation could still be refused without contradiction. The architecture Alexey Melnikov and Kurt Zeilenga set out in RFC…
IETF
One CA Name, Several Ways to Issue
A buyer reviewing certificate operations asks a simple question: if DNS authorizes one certification-authority name with an account and a validation method, does that restriction govern every issuing system behind the name? RFC 8657 makes the answer consequential. A shared CA…
Story
RIPE Database Is Switching to OIDC. Maintainer Authority Does Not Move With the Session
RIPE NCC plans to replace a site-wide cookie with an OIDC session for interactive RIPE Database use. That can improve authentication, but the harder acceptance question begins after login: which `mntner` authorises this identity to change this entity, under which session regime…
Leaders
Daniel Fett and the Issuer Field That Named the Server, Not the Token
An OAuth callback can contain the right state and a real authorization code and still be on its way to the wrong server. RFC 9207 adds one small comparison before that mistake becomes a disclosure: did the server named in the response match the issuer the client recorded when the…
Story
AFRINIC Reports 3,927,253 Learning Behaviours. Its Academy Signup Does Not Explain the Record
AFRINIC has published an unusually precise measure of its online teaching: 3,927,253 learning behaviours tracked after xAPI was integrated into every lesson. Precision makes the Academy look measurable. It also makes the missing join between the public measurement claim and the…