Summary

  • The live IANA SFrame Cipher Suites registry says it was updated on 5 May 2026. It carries five added size columns, Nh, Nka, Nk, Nn and Nt, and three new AES-256-CTR/HMAC-SHA512 entries at 0x00060x0008. All three are marked Recommended Y and cite a provisional reference to draft revision 06.
  • The IETF Datatracker still places that revision in the RFC Editor queue. Registration is visible; final RFC publication, software support, application selection and safe use of short authentication tags require their own evidence.

The public index got its rows first

The original RFC 9605 established the SFrame cipher-suite registry with a number, name, recommendation flag, reference and change controller. It left the cryptographic sizes in prose and tables inside the specification. The successor draft asks IANA to put five of those sizes directly into the public registry. That is useful: a reader comparing an implementation with an assigned suite can inspect hash-output length, underlying encryption-key length where applicable, derived key length, nonce length and tag overhead in one row. The registry becomes a more precise index of the specification's parameters.

The live table has already made that edit. The five existing suite rows now have filled dimensions. Beside them sit 0x0006, 0x0007 and 0x0008, all using AES-256-CTR with HMAC-SHA512. Their Nh is 64 bytes, Nka 32, Nk 96 and Nn 12; their Nt values are 10, 8 and 4 bytes. The draft explains that this construction doubles the SFrame internal derived key and salt material from the 48 bytes used for AES-128-CTR/HMAC-SHA256 to 96, and changes the initial tag value from 32 to 64 bytes. It includes test vectors for both the AEAD construction and full SFrame frames. These are precise implementation handles, not a slogan about “more secure encryption.”

Every new row has Recommended Y. That flag has a specific governance meaning under RFC 9605: the ordinary Specification Required route defaults to N, while setting a Y or D recommendation requires Standards Action. The Datatracker history shows an April ballot discussion about aligning the document's Standards Track status with those recommended assignments. That is a visible decision path. It is more informative than treating the letter Y as a marketing seal.

A draft reference in a live table

IANA's new rows cite RFC-barnes-sframe-iana-256-06, a provisional label. The document is an approved IETF-stream proposal in the RFC editing queue, intended as a Proposed Standard, with IANA action status RFC-Ed-Ack. It has no numbered RFC at this check. The registry's “Last Updated” date is 5 May; revision 06 is dated 4 May. Those two records establish a table update after that revision, without establishing when an implementation shipped or which application chose these suites.

This sequence is not a scandal. It exposes the different clocks in standards production. The registry can reserve and describe an interoperable code point while the RFC Editor finishes the formal text. The provisional reference keeps the link legible in the interval. What matters to operators is to read the fields as fields: 0x0006 identifies a suite; Y records a standards recommendation; Nt=10 records ten bytes of tag overhead. None is a measured result from a call, a deployment report or an audit of an application's key management.

RFC 9605 leaves crucial choices to the application. The application decides when SFrame is used and which cipher suite it uses. Its security discussion warns that short authentication tags need defenses against forgery attempts; full-size tags are simpler in many settings. The new table includes 10-, 8- and 4-byte Nt entries. That range makes the application decision more visible, and more consequential. A four-byte tag in a registry row is a parameter. A four-byte tag in a product is a design choice whose surrounding controls need to be examined.

The sources contain no named production implementation, call trace or evidence that a new suite was selected in service. A numbered final RFC, application configuration and operational tests would change that reading. For now the already-populated table is an exact public receipt for assignments and dimensions.