No RFCs were announced in the 48-hour window (2026-10-15 to 2026-10-17). The most recent RFC announcement on the ietf-announce archive is RFC 10055, dated 2026-10-14 — just outside the window.
Defines YANG data models for managing the Resource Public Key Infrastructure (RPKI) to Router Protocol specified in RFC 6810 and RFC 8210. The RPKI-to-Router (RTR) protocol lets routers fetch validated prefix-origin (and router-key) data from a relying-party cache so that BGP route origin validation can be applied. These models give operators a standardized, vendor-neutral way to configure RTR sessions and to inspect their operational state through NETCONF/RESTCONF-based management systems.
Specifies an RDAP (Registration Data Access Protocol) extension for an extensible set of versioning types. It lets servers advertise which extension versions they support, lets responses indicate which versions they include, and lets clients request specific versions in their queries. It also defines a way to convey versioning and deprecation information so that transitions between extension versions can be coordinated, reducing the impact of breaking changes on deployed clients.
Addresses the setup needed when a network service is delivered over a Layer 3 tunnel. The links between customer endpoints and the provider network form an attachment circuit (AC), and the underlying link carrying the service is a 'bearer' — here a Layer 3 UDP tunnel. The document extends the YANG service data model for attachment circuits so that a UDP tunnel can be expressed as the Layer 3 bearer, enabling consistent provisioning of tunnel-based attachment circuits.
By its name, this LISP working-group document probably specifies NAT-traversal mechanisms for the Locator/ID Separation Protocol, allowing LISP tunnel routers (xTRs) that sit behind network address translators to establish and maintain connectivity with the mapping system and other xTRs. The official abstract could not be retrieved on this run (transient fetch error), so this description is approximate and will be grounded against the abstract on the next run.
Defines four Post-Quantum/Traditional (PQ/T) hybrid key-exchange methods for the Secure Shell (SSH) protocol. Each method pairs the Scloud+ key-encapsulation mechanism — whose security rests on the unstructured Learning With Errors problem — with Elliptic Curve Diffie-Hellman on the NIST P-384 and P-521 curves. Combining a lattice-style KEM with classical ECDH gives SSH sessions resistance against both quantum and classical attackers.
By its name ('8111bis'), this LISP working-group document is probably a revision of RFC 8111, which defines the LISP Delegated Database Tree (LISP-DDT) — a hierarchical, distributed database that maps Endpoint Identifiers (EIDs) to the authoritative Map-Servers responsible for them. The official abstract could not be fetched on this run (transient fetch error), so this summary is approximate and will be grounded against the abstract on the next run.
Updates RFC 7518 to deprecate the JWS 'none' algorithm and the JWE 'RSA1_5' algorithm, both of which have well-known security weaknesses (the 'none' algorithm removes signature protection; RSA1_5/PKCS#1 v1.5 is vulnerable to padding-oracle attacks). It also updates the Designated Experts' review instructions so that future JOSE algorithm registrations must meet baseline security requirements, hardening the registry against weak entries.
Describes use cases for agentic AI communication systems and derives protocol requirements from them. The requirements are intended to guide IETF standardization of agent-to-agent and agent-to-tool communication. The stated focus areas are dialog management, transport, multimodal communication, communication security, and agent identity and authentication. The document frames the problem space rather than specifying a wire protocol, giving the community a shared basis for later standards work.
Analyzes network-service use cases where fully homomorphic encryption (FHE) could meet privacy needs that existing non-homomorphic solutions cannot satisfy under the stated trust conditions. It covers general AI inference, integrated sensing and communication, and private information retrieval. Each use case gives a scenario, example flows, post-conditions, existing solutions, and potential requirements, then connects to common gaps and brief evaluation criteria. The document explicitly does not specify a protocol or select a cryptographic scheme.
Defines a YANG data model for Ethernet networks used as the client layer of an underlay transport network, as well as Ethernet operating as a transport network in its own right. Optical Transport Network (OTN) is given as an example of an underlay. The model aligns with the traffic-engineered (TE) topology framework so that controllers can represent Ethernet client-layer topology and its relationship to the server-layer transport network for multi-layer provisioning.
Presents a two-layer federated reference architecture for initial agent discovery. The first layer handles zero-configuration advertisement and collection of discovery information within a site; the second is a federation among site gateways that exchange lightweight records across administrative domains while protecting their integrity. It stresses data sovereignty via an Export Policy Engine and supports referrals, delegation, and indirection. The preferred federation method uses DNS with DNSSEC validation (Mode A), with non-DNS synchronization (Mode B) also described. Informational; open-ended search, semantic matchmaking, and capability selection are out of scope.
Defines nine TLS 1.3 key-exchange algorithms based on HQC-KEM, the code-based KEM selected by NIST for standardization in the forthcoming FIPS 207. They fall into four groups: three standalone HQC variants; two PQ/T hybrids pairing HQC with X25519 or X448; two PQ/PQ hybrids pairing HQC with ML-KEM; and two PQ/PQ/T hybrids combining HQC and ML-KEM with X25519 or X448. Because HQC relies on different hardness assumptions than lattice-based ML-KEM, it adds algorithmic diversity. The algorithms target TLS 1.3, DTLS 1.3, and QUIC, with hybrids following the standard TLS 1.3 hybrid construction.
Describes how to build Segment Routing (SR) based Network Resource Partitions (NRPs) using resource-aware Segment Identifiers (SIDs). Enhanced VPNs need guarantees such as dedicated resources, bounded latency, and jitter, which requires integrating the overlay VPN with the underlay network. An NRP is a subset of network resources and policies across a set of connected links and can serve as the underlay for one or more enhanced VPN services. Resource-aware SIDs bind SR instructions to specific resources, so a set of them can define an NRP's topology and resource attributes, enabling enhanced VPN delivery in SR networks.
By its name, this individual submission probably defines a YANG data model for a multi-interface IGMP/MLD proxy, extending multicast group-membership proxying so that it operates across several upstream/downstream interfaces rather than a single pair. The official abstract could not be retrieved on this run (transient fetch error), so this description is approximate and will be grounded against the abstract on the next run.
Presents a two-layer federated reference architecture for initial agent discovery. The first layer handles zero-configuration advertisement and collection of discovery information within a site; the second is a federation among site gateways that exchange lightweight records across administrative domains while protecting their integrity. It stresses data sovereignty via an Export Policy Engine and supports referrals, delegation, and indirection. The preferred federation method uses DNS with DNSSEC validation (Mode A), with non-DNS synchronization (Mode B) also described. Informational; open-ended search, semantic matchmaking, and capability selection are out of scope.
Addresses a flaw in protocol conformance testing: a published test vector is treated as a correct reference even when it is malformed, inconsistent, ambiguous, or mathematically wrong, which can mark a correct implementation as failing or let a faulty one pass. It proposes Verification Defect Quarantine (VDQ), a transport-neutral model that separates the status of the tested subject from the verifier's fault-detection performance. Reproducible defects are recorded, affected vectors are blocked from supporting stronger assurance claims, unconfirmed defects stay INDETERMINATE, and corrections are added as new superseding records. VDQ does not change an I-D/RFC or replace the errata process.
By its name, this PIM working-group draft probably defines a YANG data model for EVPN multicast, covering configuration and operational state for multicast forwarding within Ethernet VPN deployments (for example selective multicast and IGMP/MLD handling in EVPN). The official abstract could not be fetched on this run (transient fetch error), so this description is approximate and will be grounded against the abstract on the next run.
By its name, this PIM working-group draft probably defines a YANG data-model extension for IGMP/MLD snooping in Layer 2 VPN contexts, controlling how multicast group membership is learned and constrained within L2VPN services such as VPLS or EVPN bridge domains. The official abstract could not be retrieved on this run (transient fetch error), so this description is approximate and will be grounded against the abstract on the next run.
Offers guidance on bringing post-quantum cryptography to resource-constrained devices — such as IoT nodes and dedicated key-storage hardware — that have tight limits on processing power, memory, and flash storage and may run on batteries. It treats hardware security as the foundation for secure operation and covers techniques such as deriving keys from seeds to cut persistent storage, handling short-lived keys efficiently, and offloading cryptographic work. It also examines how post-quantum cryptography affects firmware-update mechanisms on these systems.
Introduces Verification Promotion Boundaries (VPB), a protocol-neutral profile for government and critical-infrastructure relying parties whose purpose is to stop a verification result from one assurance stage being treated as a stronger claim. It defines six ordered stages, from registration through release eligibility, and states that passing one stage does not imply the next. It separates negative findings against a tested artifact from positive findings that a verifier caught a defect, and makes arithmetic and protocol checks (for example validating curve points before metamorphic tests) mandatory before promotion. It is explicitly not a U.S. Government standard.
Specifies how to signal Opus multistream (multichannel) audio in RTP/SDP sessions so that endpoints can negotiate layouts such as 5.1 and 7.1. It defines SDP format parameters for describing these configurations and Offer/Answer procedures for interoperable negotiation. It adds no new Opus codec behavior, continuing to use the RTP payload format from RFC 7587 and the channel mapping semantics from RFC 7845. The goal is to standardize an alternative to the deployment-specific approaches known informally as 'multiopus'.
Defines the Agent Decision Commitment (ADC), a salted hash commitment to a record of what a payment agent relied on when it made a decision — the content given to the model, the model calls, and the resulting answer and action. The commitment travels in the payment mandate or payload and is registered with a transparency service before authorization, while the full record is disclosed only to dispute participants. The draft also describes bindings to three agent payment protocols and to account-to-account transfers, plus a witnessed exchange in which two parties' agents evidence what passed between them.
Argues that an AI agent can pass authentication and hold a valid authorization yet still be unsafe to run — common gaps include missing evidence, insufficient software maturity, outdated authority versions, unresolved revocations, and unmet human-approval requirements. It introduces the High-Assurance Agent Control Envelope (HAACE), a protocol-neutral profile that ties each agent action to its identity status, authorization, policy, assurance level, evidence, authority version, revocation status, oversight requirements, and a decision taken at the moment of action. Missing or unclear prerequisites lead to denial, authorization is kept separate from execution, and receipts cannot be reused as credentials. It complements OAuth, workload identity, and attestation rather than replacing them.
Notes that existing SCIM events cannot express that one User resource was retired in favor of another representing the same subject, because deletion and supersession have different semantics for downstream systems. It proposes two provisioning events: a User supersession event and a supersession-correction event. It separates supersession from identity-attribute convergence and explains how ordinary SCIM provisioning events convey the surviving User's resulting state. Matching algorithms, convergence and conflict-resolution policy, identity proofing, and non-SCIM data are out of scope; pre-authentication or pseudonymous linkage is future work.
Presents a framework, from the network operator's perspective, for building and operating IPv6-only core networks, including multi-domain cores spanning multiple Autonomous Systems. For carrying residual IPv4 traffic it proposes stateless IPv4/IPv6 address mapping as the basis for IPv4-as-a-Service, with translation at the network edge and no per-flow state or conversion gateways on the data path. It is framed as a problem statement, guidance, and requirements for operators rather than a protocol specification, covering applicability and trust boundaries, IPv6 mapping-prefix allocation, and operational, manageability, and security considerations.
Specifies how to automatically configure core network-infrastructure services on Autonomic Control Plane (ACP) nodes through GRASP, with centralized or decentralized options. These services are chiefly needed to bootstrap a network but remain relevant throughout its lifecycle. Covered services include secure remote access to zero-touch bootstrapped ANI devices over SSH/NETCONF with RADIUS/Diameter authentication and authorization, plus automatic configuration of syslog, NTP for clock synchronization, and DNS for operational purposes.
Defines how GRASP can announce and discover services using DNS-SD-style features while keeping GRASP itself simple. DNS Service Discovery provides a framework for announcing and discovering services — service names, instance names, and selection parameters such as priority and weight — and in autonomic networks GRASP is meant to handle service discovery alongside basic connectivity setup. Rather than duplicate DNS-SD inside GRASP, the document maps the needed features onto GRASP and defines name discovery plus reusable elements for GRASP objectives.
Defines a YANG module for managing SLA assurance in optical transport networks. The module gives a standard way to represent and report issues that may affect service and network availability and supports consistent reporting of impairments and risks across optical transport domains. It is intended for closed-loop operations, where automated monitoring, analysis, and remediation help keep services reliable and SLA-compliant.
Provides a practical guide to deploying 464XLAT-based IPv6-only technology on the user plane in 3GPP 5G networks. It also covers key 5G concepts and architectures, configuration methods, and the operational challenges of running an IPv6-only user plane while still serving IPv4-dependent applications through stateless/stateful translation.