IETF Internet-Drafts & RFCs — Daily Digest

Proposes adding a "Competitive Mode" to delay-based congestion-control algorithms. The aim is to improve their competitiveness and fairness when they coexist with more aggressive (e.g. loss-based) flows, which otherwise tend to starve delay-based traffic during shared-bottleneck scenarios.

Defines sub-policies that refine the "Specification Required" IANA registration policy of RFC 8126. The goal is to give registry designers finer-grained control over the level and form of specification needed before a value can be registered.

Describes how the existing BIER encapsulation of RFC 8296 operates in a non-MPLS IPv6 network, referred to as BIERin6. BIER is a multicast forwarding architecture that avoids per-flow state in the network while still giving optimal replication. As in IPv4, BIER can run directly over L2 links or over tunnels; for IPv6 tunneling a new IP "Next Header" type is to be assigned for BIER.

Provides an evaluation methodology for machine-learning-based network anomaly-detection systems operating on telemetry. It complements the NMOP working group's adopted architecture, lifecycle and semantics documents by defining which accuracy metrics to report and their failure modes, a benchmarking procedure based on controlled fault injection and replay, and the properties a benchmark dataset needs for reproducible, comparable evaluation. The document is informational.

Defines AgentEnvelope, a deterministic derived-authority model for autonomous and action-performing systems. Rather than issuing bearer credentials from a central authority, it derives scoped action capabilities from customer-held custody material and canonical action envelopes, so a verifier can check an action signature against a public action record without receiving roots, seeds, private keys or hosted access. Specifies the v1 derivation model, signing domains, public record structure, mint delegation flow, verification rules and security considerations.

Comprehensive guidelines for establishing and managing IETF working groups, clarifying the relationships between participants, WGs and the IESG and the responsibilities of WG chairs, participants and Area Directors. It supersedes RFC 2418 and RFC 3934 and incorporates updates from RFC 7475, RFC 7776, RFC 8717 and RFC 9141.

Specifies an EPP extension for provisioning and managing status sets applied to EPP objects such as the domain object (RFC 5731). A status set represents the reason for setting a list of status values (e.g. a lock service, a court order, or abuse handling), letting clients and servers manage sets in place of individual status values. Supports client status sets, disclosure of server status sets, and an enhanced authorization model using the EPP Authentication Token.

Defines an alternative HTTP proxy service configuration for TCP connections, addressing deficiencies of classic HTTP CONNECT in modern HTTP environments. The service is described by a URI Template, aligning it with the existing CONNECT-UDP and CONNECT-IP proxying protocols.

In Media over QUIC Transport (MOQT), subscribers use Range Filters to select subgroups, objects or priorities within a track, but those filters are static once set. This document extends Range Filters by binding conditional evaluation logic to specific filter sets, so a relay can autonomously adapt intra-track forwarding to real-time network conditions without the round-trip delay of explicit subscriber update signaling.

Extends the existing limit on NomCom representation by organization (RFC 8713, Section 4.17) so that not all voting members of the IETF Nominating Committee belong to the same gender.

Describes how to proxy Ethernet frames in HTTP, analogous to IP proxying in HTTP but at Layer 2 instead of Layer 3. It defines a protocol that lets an HTTP client create a tunnel to exchange Layer 2 Ethernet frames through an HTTP server that has an attached physical or virtual Ethernet segment.

Describes building an inter-domain L3VPN architecture using internal BGP, applying the BGP/MPLS IP VPN multi-domain options within a single Autonomous System where route reflectors set the NEXT_HOP attribute to self (BGP Route Reflector with Next Hop Self).

Defines the Simple Agent Management Protocol (SAMP), a lightweight management-plane protocol for heterogeneous AI agents. Managers can discover agents, query state, receive events, subscribe to streams and control operations under policy governance. Drawing on operational protocols such as SNMP, it adds AI-specific concepts (dynamic profiles, autonomy classes, enrollment, trust states, policy-gated execution) and is explicitly not for agent-to-agent communication or tool invocation. Presented as Experimental (version 0.1).

The official abstract page could not be retrieved on this run (HTTP 404 at www.ietf.org/archive/id), so this description is written from the draft name and is approximate. By its name ("ccs") this individual submission probably defines a "CCS" mechanism or format; specifics are not asserted here and will be grounded from the abstract on the next run.

Specifies Route86, a compact textual timestamp representation for constrained message transports. A Route86 timestamp combines a Base36-encoded calendar-day component with a three-digit decimal Internet Time component, occupying six ASCII characters in canonical form. Interpreting the calendar component requires a shared reference date, which may be application-specific or salted.

The official abstract page could not be retrieved on this run (HTTP 404 at www.ietf.org/archive/id), so this description is written from the draft name and is approximate. By its name ("mercurius") this is an individual submission whose scope is not asserted here; it will be grounded from the official abstract on the next run.

Specifies the State Graph Cryptographic Protocol (SGCP), a communication-security framework in which client and server establish a protected session and maintain a synchronized state graph for its lifetime. It integrates device/port/socket/session identity, ECDH shared-secret establishment, key derivation, epochs, sequence numbers, authenticated state transitions, state-dependent packet transformation, replay protection, continuous context verification and session recovery. Both endpoints independently derive the same cryptographic state from a common authenticated session secret; a full-duplex binary media transfer is used as a worked example.

Defines two DNS resource record types, UNECE and ISO, that convey numeric values paired with codes from registries maintained by external standards organizations. Neither RRTYPE duplicates the external registry into IANA; each carries codes verbatim with the external maintainer's semantics. Covers presentation and wire formats, requests RRTYPE assignments via Expert Review, and proposes a reusable design pattern for future RRTYPEs that integrate external registries without duplication.

Describes a framework for applying the Certificate Transparency protocol to publicly log Secure Telephone Identity (STI) certificates as they are issued or observed. This lets STI stakeholders audit certification-authority activity and detect unauthorized issuance of duplicate telephone-number or provider-level certificates. It adapts the log structure and API model of RFC 6962 (Merkle trees, Signed Certificate Timestamps) to the STIR ecosystem, focusing on verifiable control of telephone numbers and service-provider codes.

The Extensible Provisioning Protocol supports extensions but does not describe how they are maintained. This document defines a procedure for registering and managing EPP extensions and specifies the format of an IANA registry to record them. If approved it obsoletes RFC 7451.

Motivated by large AI training clusters that deploy thousands of GPUs over three- to five-stage CLOS networks, where non-blocking behavior is critical. Argues that adaptive routing is needed to dynamically spread traffic to a common destination across multiple equal-cost paths based on per-path capacity information (FARE), rather than relying on static hashing.

RFC 4684 defines MP-BGP procedures for exchanging Route Target reachability information to limit propagation of VPN NLRI, covering both intra- and inter-domain distribution. Operational experience shows the inter-domain model can cause issues in specific scenarios; this document proposes alternate inter-domain route-distribution rules to address them.

Segment Routing steers packets along an explicit path chosen at the ingress node, with SR Policies distributed by BGP using the Tunnel Encapsulation attribute and an SR Policy Tunnel TLV. Today the path MTU of a segment list is not carried in that attribute. This document defines BGP extensions to distribute path-MTU information within SR Policies.

Presents a framework for multi-domain IPv6-only underlay networks from a network-provider perspective, treating IPv6-only as the final IPv6-transition stage while keeping global reachability for both IPv6 and IPv4 services. It proposes stateless IPv4/IPv6 address mapping to carry IPv4 service data over IPv6-only transport (IPv4-as-a-Service), describes device behaviors, analyzes mapping-prefix allocation options and security considerations, and aims to remain compatible with existing technologies.

Provides technical detail on CVE-2026-33697 / EUVD-2026-16488 as evidence that intra-handshake attestation fails in practice, even without physical access. The authors argue that, because continuous attestation is generally required anyway, intra-handshake attestation adds unnecessary complexity. Findings are backed by ProVerif artifacts (Apache-2.0) for reproducibility and acknowledged by relevant stakeholders.

Source Address Validation aims to detect spoofed traffic without blocking legitimate traffic, but ingress allowlist filters are unreliable when incomplete. Introduces Bicone SAV, which combines a customer-cone-derived allowlist with a blocklist of prefixes unsuitable for a given ingress interface: allowlist matches are permitted, blocklist matches discarded, and packets matching neither are permitted but logged/monitored. The blocklist is built from provider-cone information augmented with customer-cone denylists.

The official abstract page could not be retrieved on this run (HTTP 404 at www.ietf.org/archive/id for the -01 revision), so this description is written from the draft name and is approximate. By its name this individual submission probably defines a "content profile" (identifier "eu2122"); no specifics are asserted here and it will be grounded from the official abstract on the next run.

Defines a standard profile for Traffic Origin Authorizations (TOAs), a CMS-protected content type for use with the RPKI. A TOA is a digitally signed object that lets a verifier confirm an IP address-block holder has authorized an Autonomous System to originate traffic using source addresses within that block.

Defines a mechanism for temporal anchoring of digital artifacts by committing cryptographic hashes to the Bitcoin blockchain via the OpenTimestamps protocol. The resulting proof is independently verifiable by anyone with validated Bitcoin chain data, without contacting the anchoring service. The SCITT architecture is used as the primary integration example, and no changes to SCITT are required.

Specifies a YANG module for discovering transport capabilities for YANG notifications. It augments the YANG-notifications capabilities model with the notification transport protocol, transport encoding and transport encryption, letting a client determine which notification transport options a NETCONF or RESTCONF server supports at runtime or implementation time via the YANG instance-data file format.

Specifies proactive, in-band Network Layer OAM mechanisms (RFC 9062) to detect loss-of-continuity faults affecting unicast and multi-destination paths (used by Broadcast, Unknown-unicast and Multicast traffic) in an EVPN network (RFC 7432bis). The mechanisms build on the widely deployed Bidirectional Forwarding Detection protocol (RFC 5880).

Defines an extension to HTTP caching that changes how the URI query component affects caching. It introduces the "No-Vary-Search" response header field, letting origin servers signal to caches that certain parts of the query component do not semantically affect the response and can be ignored when matching cached responses.

Describes the Fault-Avoidance Routing (FAR) protocol, a generic routing method for regular data-center topologies proposed for large-scale cloud data centers. FAR leverages any regularity in the topology to compute routing tables concisely; fat-tree is used as an example architecture to show how FAR applies in real operational scenarios.

Builds on FARE-BGP, which enables weighted ECMP load balancing via a path-bandwidth extended community, and on FARE-in-SUN, which extends the mechanism from switches to GPUs for multi-plane scale-up networks. This document further extends FARE-BGP from switches to RoCE NICs (RNICs) for multi-plane scale-out AI networks and presents two techniques to address route-scalability concerns caused by injecting many host routes.

Agent communication protocols convey many distinct security claims (user authority, agent identity, tool identity, delegation state, session continuity, action evidence) with different verifiers, freshness needs and failure modes. This document defines a verifier-facing model to separate these claims, supplying a reusable matrix format that records, per claim, the carrier field, verifying party, binding/freshness rules, required failure behavior, and the constrained result an application may consume. It also defines row-outcome semantics and dependency-closure rules so composite results stay as strong as their verified inputs and expose cyclic, stale or downgraded dependencies.

Describes Sigma Protocols for proving knowledge of preimages of linear maps in prime-order elliptic-curve groups (also called Maurer proofs, or proofs of knowledge of a preimage of a group homomorphism). Applications include zero-knowledge proofs for discrete-logarithm relations, ElGamal encryptions, Pedersen commitments and range proofs. An IRTF CFRG research-group document.

Describes the Fiat-Shamir transformation, which turns a public-coin interactive protocol into a non-interactive one using a cryptographic hash function. It specifies how to employ the hash function, encode prover messages as hash input, decode verifier messages from hash output, and serialize/deserialize the resulting non-interactive argument string. An IRTF CFRG research-group document.

Proposes flow-level load balancing for RoCEv2 networks, where classic 5-tuple hashing cannot distinguish RDMA sessions that share a 5-tuple and can pin "elephant flows" to one path. The ingress device parses QP information from the IB BTH/DETH headers, combines it with parts of the IPv6 source/destination addresses as entropy, and CRC32-hashes them into a 20-bit value written to the IPv6 Flow Label. Devices then use "5-tuple + Flow Label" for finer-grained balancing, improving high-performance AI-network transmission.

Defines the Witnessed Execution Protocol (WEXP) Core, establishing neutral appraisal semantics for execution-related evidence. It specifies four content bases, two evidence qualifiers, the Boundary Ceiling, exact-claim support, deterministic verdicts (accept, downgrade, reject), composition without inflation, and a normalized interface between evidence-carrying profiles and appraisers. WEXP Core deliberately does not define serialization, signature envelopes, action identifiers, authorization models or evidence-artifact schemas.