Topic
Digital Identity and Credentials
Within the Topic facet, Digital Identity and Credentials topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
IETF
The Certificate Expires in 9999. Its Document Binding Can Still Go Unchecked.
A one-signature certificate is designed to accompany one document, one private key and one signing operation. Its proposed X.509 extension narrows scope sharply—but ordinary signature success does not prove that a verifier compared the document with that binding, or that the key…
IETF
The Composite Signature Passed. The Envelope Named a Different Algorithm.
Composite ML-DSA combines post-quantum and traditional signatures behind one interface. Its CMS profile shows why that single verdict still depends on several algorithm identifiers, exact encoded bytes and a content digest agreeing across the envelope.
History
The Country Prefix Found the Resolver. It Did Not Prove the Archive Kept the Object: RFC 3188
The prefix `fi` could tell a client where Finland's branch of the NBN world began. It could not make a harvested Web page survive, authenticate the service answering today, or prove that the returned file was the original. RFC 3188 made a federation of local library numbers…
IETF
The Issuer Signed the Envelope. It Still Could Not Swap the Agent Key.
Revision 02 of the AIC JSON Web Token profile places a principal-signed delegation inside an issuer-signed credential. The nested design matters because an issuer may certify the carrier without acquiring the right to substitute the agent key chosen by the principal.
History
The ISBN Named an Edition. It Could Resolve to Many Copies—or the Wrong Book: RFC 3187
A persistent name was supposed to survive changing locations. RFC 3187 made the bargain concrete and awkward: one ISBN URN might lead to many URLs, no digital entity at all, or two bibliographic records because a publisher had reused a number by mistake. Persistence belonged to…
IETF
The Agent Signed the Challenge. Its Embedded Key Still Wasn't Authority.
OpenA2A AIP revision 03 separates a mathematically valid response from an authenticated agent. The decisive control is not whether the supplied key verifies the signature, but who is entitled to bind that key to the claimed identity.
IETF
The Agent Went Silent. The Trust Score Punished What the Verifier Could Not See.
The proposed Network Behavioral Trust Protocol turns missing heartbeats and co-silence into score decay, SUSPECT and QUARANTINED states. That may be useful operationally, but an absence first describes a verifier's observation surface—not an agent's character.
History
The Recipient List Shrunk. The Old Key Still Opened the Message: RFC 3185
The second encrypted message named fewer recipients than the first. One omitted member could still open it. Nothing had malfunctioned: RFC 3185 warned that this was the expected consequence of deriving a later key-encryption key from content-key material already delivered to the…
History
The Domain Signed the Message. The Individual Was Still Unnamed: RFC 3183
A recipient could verify that a message had crossed an authenticated organizational boundary and still be unable to display the name of the person who sent it. RFC 3183 made that distinction unusually explicit. Its domain-security machinery did not offer one generic act called…
History
The Name Entered RSVP. Authority Still Had to Decide What It Meant: RFC 3182
In 2001, an RSVP request could carry a user name, an application name, a Kerberos ticket or a certificate toward the router deciding whether a flow deserved scarce resources. That sounds like identity becoming authority. RFC 3182 documented something more conditional. The name…
IETF
The Payment Legs Agree. The Delivery Leg Is Still Empty.
Two agents can hold matching records of money movement while the evidence for what was promised in return remains on a different, empty track.
IETF
The Batch Proof Passed. How Many Privacy Pass Tokens Did You Actually Get?
Batched Privacy Pass issuance can cut proof overhead and round trips, but it also creates a new place for operational truth to disappear. One verified proof or one successful HTTP response is not yet a receipt for the number of tokens that survived finalization, entered durable…
IETF
The Registry Can Name the Security Question. It Cannot Make It Acceptable.
An authentication-method label can improve interoperability while leaving the relying party entirely responsible for deciding whether that method is safe enough to use.
IETF
The ACME Order Named a Profile. The Certificate Still Had to Prove It.
ACME Profiles gives certificate authorities a cleaner way to expose policy choices and lets clients bind one choice to an Order. The new string is useful coordination, but leaders should resist turning it into a compliance badge: the issued certificate, its deployment and the…
IETF
The AML Method Succeeded. That Does Not Say the Customer Cleared.
A portable method code can report that screening ran without answering the legal and operational question everyone will be tempted to ask next.
IETF
What Exactly Did the Signed Conversation Container Prove?
The vCon drafts propose a portable home for parties, dialog, attachments and machine analysis. The difficult governance question begins after its signature verifies: whether the package captured the whole conversation, whether its claims are true, and whether its signer had…
IETF
The Method Succeeded. The `ivm` Label Still Is Not the Evidence.
A three-letter identity-verification code can coordinate systems without making different proofing cases equivalent.
IETF
The KYAPay Token Can Identify the Agent. The Recipient Still Decides.
A signed assertion can make automated traffic attributable without turning the issuer into the operator of somebody else’s front door.
IETF
Who Gets to Vouch for a Client? OAuth’s New Two-Key Trust Problem
An emerging OAuth proposal lets a client publisher name the attesters allowed to speak for its software. The harder lesson is what the metadata cannot do: choose the authorization server’s trust, revoke an issued grant, or turn a verified statement into permission.
IETF
The Child Token Was Valid. The Chain Still Had to Authorize It.
A delegated token can carry a perfect signature and still have no usable authority. The proposed OAuth chain works only when every parent, every narrowing step, the leaf key, current status and the resource server’s own policy agree on the same bounded operation.