Proposes adding a "Competitive Mode" to delay-based congestion control algorithms. The goal is to improve how these algorithms compete and share bandwidth fairly when coexisting with more aggressive (e.g. loss-based) flows, addressing the common problem of delay-based schemes being starved during coexistence.
Defines sub-policies that refine the "Specification Required" IANA registration policy from RFC 8126. It gives registries finer-grained variants of that policy so that registration requirements can be stated and tailored more precisely for individual registries.
BIER is a stateless multicast forwarding architecture that still provides optimal packet replication. This document (BIERin6) describes how the existing BIER encapsulation from RFC 8296 operates in a non-MPLS IPv6 network — over Layer-2 links directly or over IPv6 tunnels. For the IPv6 tunneling case it calls for a new IP "Next Header" value to be assigned for BIER.
Provides an evaluation methodology for machine-learning-based network anomaly detection systems, complementing adopted NMOP anomaly-detection work. It defines the accuracy metrics to report and their known failure modes, a benchmarking procedure using controlled fault injection and replay, and the properties a benchmark dataset needs to support reproducible, comparable evaluation. The methodology is informational.
Specifies AgentEnvelope, a deterministic derived-authority model for autonomous, action-performing systems. Instead of issuing bearer credentials from a central authority, scoped action capabilities are derived from customer-held custody material and canonical action envelopes. A verifier can check an action signature against a public record without receiving roots, seeds or private keys. Covers the v1 derivation model, signing domains, record structure, mint delegation, verification rules and security considerations.
Updates the guidelines and procedures for forming and operating IETF working groups, and the relationship between WG participants and the IESG, including the duties of Chairs, participants and Area Directors. It obsoletes RFC 2418 and RFC 3934, folds in RFC 7475, and incorporates changes from RFC 7776, RFC 8717 and RFC 9141.
Defines an EPP extension for provisioning and managing "status sets" on EPP objects such as domain names. A status set represents the reason for applying a group of status values (e.g. a lock service, a court order, or an abuse response), letting clients and servers manage overlapping reasons instead of individual status values. Supports client status sets, disclosure of server status sets, and an enhanced authorization model using the EPP Authentication Token.
TCP proxying via HTTP CONNECT has several deficiencies in modern HTTP environments. This specification defines an alternative HTTP proxy configuration for TCP connections described by a URI Template, similar to the CONNECT-UDP and CONNECT-IP protocols, giving TCP proxying a template-based configuration that fits better in current HTTP deployments.
In Media over QUIC Transport (MOQT), subscription Range Filters are static once established and change only through explicit subscriber signaling. This document proposes binding conditional evaluation logic directly to Range Filter sets so a relay can autonomously adapt intra-track forwarding based on real-time network conditions, avoiding the round-trip delay of explicit subscriber update signaling.
Extends the existing limit on NomCom representation by organization (RFC 8713, Section 4.17) so that not all voting members of the IETF Nominating Committee (NomCom) belong to the same gender.
Describes how to proxy Ethernet (Layer-2) frames in HTTP, analogous to IP proxying in HTTP but at Layer 2 instead of Layer 3. It defines a protocol that lets an HTTP client build a tunnel to exchange Ethernet frames through an HTTP server that has an attached physical or virtual Ethernet segment.
Describes building an inter-domain L3VPN architecture using internal BGP, applying the multi-domain BGP/MPLS IP VPN options within a single Autonomous System, where route reflectors set the NEXT_HOP attribute to self as in BGP Route Reflector with Next Hop Self.
Defines the Simple Agent Management Protocol (SAMP), a lightweight management-plane protocol for heterogeneous AI agents. It lets a management system discover agents, query state, receive and subscribe to event streams, and optionally configure or execute exposed operations under policy control. Inspired by SNMP but built around AI-agent concepts (dynamic profiles, autonomy classes, enrollment, trust states, policy-gated execution). SAMP v0.1 is defined as an Experimental protocol.
The abstract page was not reachable on the fast source, so this description is approximate. By its name ("ccs"), the draft probably specifies a protocol or format abbreviated CCS; its exact scope could not be confirmed on this run and will be grounded from the official abstract on the next run.
Specifies Route86, a compact six-character ASCII textual timestamp intended for constrained message transports. It combines a Base36-encoded calendar-day component with a three-digit decimal Internet Time component; interpreting the calendar part requires knowledge of a shared reference date that may be application-specific or salted.
The abstract page could not be opened on the fast source, so this description is approximate. By its name ("mercurius"), the draft is likely an individual proposal, but its subject could not be confirmed on this run; it will be grounded from the official abstract on the next run.
Specifies the State Graph Cryptographic Protocol (SGCP), a communication-security framework in which a client and server establish a protected session and maintain a synchronized state graph for the session's lifetime. It combines device/port/socket/session identity, ECDH shared-secret establishment, key derivation, epochs, sequence numbers, authenticated state transitions, replay protection, continuous context verification, reauthentication and session recovery. Both endpoints independently derive the same state from a common secret; a worked full-duplex media-transfer example is included.
Defines two DNS resource record types, UNECE and ISO, that carry numeric values paired with codes from external standards-body registries (the UN Economic Commission for Europe and ISO). Neither RRTYPE duplicates the external registries into IANA; codes are carried verbatim with the external maintainer's semantics. Specifies presentation and wire formats, requests two RRTYPE identifiers under BCP 42 Expert Review, and suggests a reusable pattern for future RRTYPEs referencing external registries.
Describes a framework for applying Certificate Transparency to Secure Telephone Identity (STI) certificates, publicly logging their issuance so any party in the STIR ecosystem can audit CA activity and detect suspect certificates. Relying parties would honor only logged certificates, tying STI certificates to authorized providers or telephone-number assignees and helping detect unauthorized certificate creation used for spoofing. It borrows the log structure, Merkle tree and SCT model from RFC 6962, contextualizing them for the STIR ecosystem.
EPP can be extended to add functionality but does not itself describe how those extensions are maintained. This document defines a procedure for registering and managing EPP extensions and specifies the format for an IANA registry to record them. If approved, it obsoletes RFC 7451.
Motivates adaptive routing for large AI training clusters, where thousands of GPUs and multi-stage CLOS networks make non-blocking behavior increasingly critical. It argues that adaptive routing is needed to dynamically distribute traffic to the same destination across multiple equal-cost paths based on network capacity information along those paths, as part of the FARE mechanism.
RFC 4684 defines MP-BGP procedures for exchanging Route Target reachability information to limit VPN NLRI propagation, covering both intra- and inter-domain distribution. Operational experience shows the inter-domain distribution model can cause issues in specific scenarios. This document proposes alternate inter-domain route distribution rules to address them.
BGP distributes SR Policy candidate paths using the Tunnel Encapsulation attribute's SR Policy Tunnel TLV, but path MTU information for a segment list is not currently carried in that attribute. This document defines BGP extensions to distribute path MTU information within SR policies.
Presents a framework for a multi-domain IPv6-only underlay network from a network provider's perspective, treating IPv6-only as the final transition stage while keeping global reachability for both IPv6 and IPv4 services. It proposes stateless address mapping to carry IPv4 service data across a multi-domain IPv6-only environment (IPv4-as-a-Service), covering the mapping methodology, device behaviors, mapping-prefix allocation options and security considerations, while remaining compatible with existing IPv6-only technologies.
Provides technical detail on CVE-2026-33697 / EUVD-2026-16488 as evidence that intra-handshake attestation fails in practice, even without physical access. It argues that, since continuous attestation is generally required anyway, intra-handshake attestation adds unnecessary complexity. The claims are backed by ProVerif artifacts released under Apache-2.0 for reproducibility and acknowledged by relevant stakeholders.
Describes Bicone SAV, a source address validation approach that jointly uses an allowlist derived from customer-cone information and a blocklist of prefixes positively identified as inappropriate on a given ingress interface. When the allowlist is incomplete, allowlist-matching packets are permitted, blocklist-matching packets are dropped, and packets matching neither list are permitted but logged or monitored. The blocklist is built from provider-cone information plus denylist data derived from customer cones.
The abstract page was not reachable on the fast source, so this description is approximate. By its name, the draft likely defines a "content profile" associated with an "eu2122" identifier or program; its precise scope could not be confirmed on this run and will be grounded from the official abstract on the next run.
Defines a standard profile for Traffic Origin Authorizations (TOAs), a CMS-protected content type for use with the RPKI. A TOA is a digitally signed object that lets a verifier confirm that an IP address block holder has authorized an Autonomous System to originate traffic using source IP addresses within that block.
Defines a mechanism for temporal anchoring of digital artifacts by committing cryptographic hashes to the Bitcoin blockchain via the OpenTimestamps protocol. The resulting proof is independently verifiable by anyone with validated Bitcoin chain data, without contacting the anchoring service. The SCITT architecture is used as the primary integration example, and no changes to SCITT are required.
Specifies a YANG module for discovering transport capabilities for YANG notifications. It augments the YANG notification-capabilities model with capabilities for the notification transport protocol, transport encoding and transport encryption, so a client can determine the notification transport options a NETCONF or RESTCONF server supports at runtime or implementation time using YANG instance data.
Specifies proactive, in-band Network Layer OAM (RFC 9062) mechanisms to detect loss-of-continuity faults on unicast and multi-destination paths (used by broadcast, unknown-unicast and multicast traffic) in an EVPN network. The mechanisms build on the widely deployed Bidirectional Forwarding Detection (BFD, RFC 5880) protocol.
Defines an extension to HTTP caching that changes how the URI query component affects caching. The new "No-Vary-Search" response header field lets origin servers signal to caches that certain parts of the query string do not semantically affect the response and can be ignored for cache-matching purposes.
Describes the Fault-Avoidance Routing (FAR) protocol, a generic routing method for the regular data-center network topologies proposed for large-scale cloud data centers. FAR leverages any regularity in the topology to compute its routing table concisely, using fat-tree as an illustrative architecture for real operational scenarios.
FARE-BGP enables weighted ECMP load balancing using a path-bandwidth extended community. This document extends FARE-BGP from switches to RoCE NICs (RNICs) for the multi-plane scale-out networks increasingly used by large AI training clusters, and presents two techniques to address route-scalability concerns caused by injecting many host routes.
Agent communication protocols carry claims about user authority, agent identity, tool/resource identity, delegation state, session continuity and action evidence, each with different verifiers and failure modes. This document defines a verifier-facing model to separate those claims, providing a reusable matrix that states, per claim, which field carries it, who verifies it, the binding/freshness rule, the required failure behavior and the constrained result an application may consume. It also defines row-outcome semantics and dependency-closure rules so a composite result never becomes stronger than its verified inputs.
Describes Sigma Protocols (also called Maurer proofs) for proving knowledge of preimages of linear maps in prime-order elliptic curve groups. Examples include zero-knowledge proofs for discrete-logarithm relations, ElGamal encryptions, Pedersen commitments and range proofs.
Describes the Fiat-Shamir transformation, which turns a public-coin interactive protocol into a non-interactive one using a cryptographic hash function. It specifies how the hash function is employed, how prover messages are encoded as hash input and verifier messages decoded from hash output, and the serialization and deserialization of the resulting non-interactive argument string.
Proposes flow-level load balancing for RoCEv2 networks, where traditional 5-tuple hashing cannot distinguish RDMA sessions that share the same 5-tuple and can hash "elephant flows" onto the same path. The ingress device parses QP information from the IB BTH/DETH headers and combines it with parts of the IPv6 source/destination addresses as an entropy source; a CRC32 hash produces a 20-bit value written into the IPv6 Flow Label, enabling more granular "5-tuple + Flow Label" load balancing for AI and other high-performance networks.
Defines the Witnessed Execution Protocol (WEXP) Core: carrier-neutral appraisal semantics for execution-related evidence. It establishes four content bases, two independent evidence qualifiers, a "Boundary Ceiling", exact-claim support, deterministic accept/downgrade/reject verdicts, composition without inflation, and a normalized interface between evidence-carrying profiles and appraisers. It deliberately does not define a record serialization, signature envelope, action identifier or authorization model; a companion Native Record profile can encode its normalized inputs.
Describes procedures for Performance Measurement in SR-MPLS networks using the Simple Two-Way Active Measurement Protocol (STAMP, RFC 8762) together with its optional extensions (RFC 8972, RFC 9503). The procedures apply to SR-MPLS paths — including SR Policy segment lists, IGP best paths and Flexible Algorithm paths — and to Layer-2 and Layer-3 services carried over those paths.
Defines two evidence structures that extend audit receipts for automated data access. Transformation Evidence is a per-disclosure statement of which classes of values were transformed and how (carrying counts and class names but never values). Coverage Reconciliation compares a data source's own activity counters against a receipt set over a time window and classifies the result (matched, observed-without-receipt, receipted-without-observation, excluded or indeterminate). Both are designed to be registered as SCITT Signed Statements; the document defines evidence payloads, not a new receipt or signature format.
Defines the EMILIA Protocol (EP) authorization receipt, an evidence artifact binding an enrolled approver key to one canonical action before execution. An approver key signs an Authorization Context (action hash, policy reference, authorization instance, nonce, audience, validity window), and a Trust Receipt carries the signed contexts, consumption record and Merkle inclusion material for offline verification. The receipt is explicitly evidence, not authorization: it establishes only its verification profile's guarantees and does not by itself prove revocation status or execution. This revision defines the closed EP-AUTHORIZATION-BUNDLE-v1 pre-execution profile and its verification algorithm.
Defines the Action Evidence Boundary (AEB), an executor-side processing model for consequential agent actions that cross identity, transport, authorization, policy and execution systems. AEB requires native artifact verification, Canonical Action Identifier matching, Authorization Evidence Chain satisfaction, a separate local authorization decision, durable atomic consumption or reservation, invocation, closed effect outcomes and authenticated reconciliation. It deliberately defines no receipt or token format, policy language, universal evidence taxonomy or new registry.
Addresses holding autonomous agent actions accountable to a regulator, auditor or counterparty who does not trust the operator, via independently-verifiable profiles answering whether the agent could act (CAN), which accountable human authorized the action (WHO), what the agent did (WHAT) and whether the runtime enforced correctly (AUDIT). It specifies, in Informational terms, how such profiles compose via a shared action-digest, each verifying independently, and defines a shared conformance-vector suite, aiming to make an anchored, third-party-verifiable tier (via SCITT) reachable rather than mandating a single record format.
Updates RFC 9970. The baseline PASSporT construction (RFC 8224) does not bind the SIP request method, CSeq number, Call-ID or dialog tags, so a valid mid-dialog PASSporT can remain valid when a signed in-dialog request is transformed into a different request whose identity fields are unchanged. This document defines the "sipctx" PASSporT type, which binds the SIP request method and dialog/sequence context to the PASSporT for mid-dialog request authenticity.
Specifies a format for action receipts: compact, individually signed JSON records asserting that a specific AI agent attempted a specific action at a specific time under a specific policy decision, with its outcome. Receipts are linked into an append-only hash chain so that deletion, insertion, reordering or modification of any prior receipt is detectable by a verifier that holds only the records and the signer's public key. Verification needs no network access or producer-operated service; the document defines the fields, the signed canonical byte sequence, the chain linkage rule, the verification procedure and test vectors.
Specifies the FAF Agent Format (.fafa), a declarative YAML format describing an agent's identity, exposed capabilities and endpoints — it describes an agent, never instructs one. Registered as application/vnd.fafa+yaml in the IANA vendor tree, it is the agent member of the FAF family (alongside .faf project context and .fafm agent memory), acting as a portable "passport" answering who the agent is, what it may do, where it is reached and what it must never do; it complements rather than replaces protocol-native cards and AGENTS.md files. The document records the existing vendor-tree registration.
The abstract page was not reachable on the fast source, so this description is approximate. By its name ("aigov"), the draft probably concerns AI governance; its exact scope could not be confirmed on this run and will be grounded from the official abstract on the next run.
The abstract page was not reachable on the fast source, so this description is approximate. By its name, this IPPM working group draft most likely specifies version 2 of an encrypted Performance and Diagnostic Metrics (PDM) IPv6 destination option for performance measurement; the precise details could not be confirmed on this run and will be grounded from the official abstract on the next run.
Defines an Extended CONNECT protocol for relaying UDP between two clients authenticated by the same proxy. A Listener registers with the proxy and a Client uses the resulting Rendezvous ID to connect to it, without allocating any public UDP address.
Specifies the Erik Synchronization Protocol for use with the RPKI: a data-replication system using Merkle trees, a content-addressable naming scheme, concurrency control via monotonically increasing sequence numbers and HTTP transport. It interacts with "Erik Relays", a new intermediary layer between the Repository Publication Point and Relying Parties that improves scalability, and can be combined with other RPKI transport protocols. The design aims to be efficient, fast, easy to implement and robust under network partitions or faults.
Defines ba64, a text encoding for binary data that is never larger than standard base64. An encoder races DEFLATE compression against plain base64 and emits whichever is shorter; compressed output is marked by a leading "=" that survives base64-safe channels yet can never start a valid base64 string, keeping the two forms unambiguous. A CRC-32 over the decoded bytes prevents silently returning wrong data, and the plain form is byte-identical to base64, making ba64 decoders a drop-in replacement; an optional padding method decouples emitted length from input compressibility.
Defines implementation-neutral requirements for persistent node identity, declared state, governed admission, suspension, revocation, re-admission and succession in "Web4-class" federations. It distinguishes a node from its network and credential representations, identifies the minimum information required for externally inspectable participation, and specifies lifecycle and failure semantics for future protocol bindings, without mandating a transport, serialization, credential technology, storage system or coordination mechanism.
Defines a SCITT profile for Physical-Site Engagement Receipts (PSER): tamper-evident, signed, offline-verifiable records describing an autonomous or human-directed physical engagement at a specific real-world site under a defined operating envelope. Each receipt is a SCITT Signed Statement (COSE single-signer, JCS-canonicalized JSON) with a five-artifact vocabulary covering the site, operator/actor, engagement window/envelope, TEE attestation evidence and an adapter write-in. It makes a deliberately narrow claim (a tamper-evident record that an engagement occurred), not that it was safe or correct, and uses a three-party trust model (site owner, TEE silicon vendor, issuer) that implementations must not collapse.
QUIC endpoints typically use 1200-byte datagrams during the handshake and only begin Path MTU Discovery afterward, which limits MASQUE protocols and WebTransport. This document defines Parallel Probing DPLPMTUD (PPDPLPMTUD), which probes several packet sizes early during the QUIC handshake so a larger discovered size is usable during later handshake phases and especially after handshake completion; the same discovery process is reused for path migration.