Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
IETF
The Chain Validated Against the Anchor It Carried. The Relying Party Had Not Trusted It.
The did:x509 resolver can finish every check it was asked to perform and still leave the decisive question untouched. A supplied certificate chain may be internally valid, its CA fingerprint exact and its leaf predicates true, while the relying party has not yet accepted the…
History
The KDC Carried the Trust That Every IPsec Peer Could Not: RFC 3129
In June 2001, RFC 3129 treated Internet key exchange less as a contest between cryptographic algorithms than as a problem of institutional placement. Its question was blunt: if every IPsec peer had to carry policy, certificates, computation and pairwise secrets, could a Kerberos…
IETF
The Backup Lost Sight of the Primary. The Multicast Path Was Still Alive.
A BIER backup ingress can lose its monitoring path to the selected ingress while every protected receiver path still works. If that narrow observation is allowed to command a takeover, resilience creates the very duplicate traffic it was meant to contain.
History
The First Fragment Passed. The Overlap Changed the Port: RFC 3128
In 2001, a short security note exposed a difficult truth about packet filtering: a firewall could approve one set of bytes while the receiving host later assembled another. RFC 3128 did not discover fragmentation, or even overlapping fragments. Its contribution was to show how…
History
Long-Term Proof Had to Outlive the Key: RFC 3126
RFC 3126 treated an old signature as an evidence-preservation problem. A valid calculation made in 2001 would not explain itself decades later if certificates, revocation records, exact signed bytes or trustworthy algorithms had disappeared. Its answer was a ladder of timestamps…
IETF
It Opened the Handshake. It Still Needed the Group's Memory.
An MLS external receiver can open the same commit or proposal seen by group members and still lack the state needed to authenticate who sent it. The missing receipt is not more ciphertext. It is the current GroupContext that joins an epoch, a sender leaf, a credential and an…
IETF
The Protocol Admitted the Number. The 32-Bit Field Did Not.
A LAKE extension value can be valid in the proposed registry range and perfectly formed on the wire, yet still fall outside the integer type chosen by an implementation. That is not a parsing footnote. It is the point where two peers can authenticate the same exchange while…
History
A Valid Signature Still Needed a Policy: RFC 3125
RFC 3125 tried to make the rules around an electronic signature addressable as data. A correct cryptographic calculation remained only the first gate: validity under a transaction still depended on which policy bytes were referenced, which commitments and trust conditions…
IETF
The Active Key Signed Its Successor. That Was the Problem.
A signature can show that the key accepted by yesterday’s policy approved a change. It cannot answer the harder question: should that key, acting alone, have been allowed to decide every key that will control the identifier tomorrow?
IETF
Every Neighbor Authenticated the Node. They Still Received Different Maps.
Two receivers accept integrity-protected bundles from the same delay-tolerant networking node. One learns an IPv6 convergence-layer instance and a small neighbor set. The other learns a private credential, another transport and no overlapping topology. The disagreement is not…
IETF
The Prefix Was Registered. The Interpreter Was Still Local.
One readable literal enters two production gates. The first interpreter recognizes its prefix and constructs a value. The second recognizes the same name but refuses to run the extension because the operator never allowed it. Nothing in the source file changed. The disagreement…
History
The Password Matched. The User Was Not Yet Authenticated: RFC 3112
RFC 3112 gave LDAP a way to test a password against a derived value in the directory. It also drew a hard line around the answer: a match could be true while no directory association had authenticated the client.
IETF
The String Was Exact. The Authority Was Still Local
A service can now hand a customer a precise DNS change instead of a paragraph of instructions. That removes one class of ambiguity. It does not tell the DNS operator who authored the request, whether the customer may alter the named zone, whether local policy should accept the…
IETF
The AS2 Names Matched. The Signer Was Still a Local Decision
A certificate rollover can leave every visible signal green—TLS connected, names reflected, signature valid, MIC matched—while one decisive fact remains outside the protocol transcript: who authorized this key to speak for this partner, in this direction, now?
IETF
The Channel Stayed Secure. Its Attested State Did Not Stay Current
Binding fresh attestation evidence to a TLS connection closes a dangerous substitution gap at the handshake. It does not freeze the endpoint’s software, policy or authorization state for the lifetime of that connection.
CASE FILE
The Draft Had Eight Numbers. The Registry Still Had None
On 1 October 2026, an OpenPGP implementer could place two official-looking documents side by side and receive two different answers. Revision 05 of a working-group draft called eight composite algorithms 37 through 44. The live IANA registry still called the entire range from 37…
IETF
The Site Reported Zero. Its Routes Could Still Remain in BGP
A revised edge-metadata draft turns one zero-value update into a site-wide forwarding decision. The control is compact; proving which routes, routers and live flows actually obeyed it is not.
History
The Firewall Allowed HTTP. It Had Not Approved the Packet Inside: RFC 3093
RFC 3093 proposed putting a complete IP datagram inside an HTTP message, passing it through the ordinary web opening, and reinserting it behind the firewall. Published on 1 April 2001, the comic design exposed a serious limit: a policy decision about an outer envelope says…
IETF
The PSP Key Arrived. No Protected Packet Had Crossed the NIC
The IKEv2 exchange can finish with two authenticated peers, an agreed PSP proposal, traffic selectors, SPIs and a wrapped receive key travelling in each direction. The control plane has done real work. Yet neither peer has proved that its sender installed the returned key, that a…
IETF
The Allowlist Could Reach Zero Errors. First the Configuration Had to Be Complete
A new IntraSAV draft replaces route inference with explicit source-prefix authorization. Its strongest promise begins where the operational proof is still missing: the completeness of the configuration installed on each interface.