Skip to content

WIMSE Workload Credentials, Proof Token, and Identifier — draft-ietf-wimse-workload-creds, draft-ietf-wimse-wpt, draft-ietf-wimse-identifier#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

  • Tier: Core
  • Why: The concrete interop surface for anyone evaluating workload-identity tooling: a credential format, a proof-of-possession mechanism, and a canonical naming scheme — the SPIFFE-ID-shaped piece of the puzzle, now with a standards track under it.
  • What: workload-creds defines the credential a workload uses to represent its identity (X.509 or token form), deliberately decoupled from proof-of-possession. wpt defines the Workload Proof Token, a signed JWT binding authentication to a specific HTTP request to prove possession of the key behind a Workload Identity Token. identifier defines the Workload Identifier as a URI unique within a trust domain, embeddable in certs and tokens. (from abstract only)
  • How: Splitting credential from proof-of-possession lets the same credential be proven different ways depending on transport; the WPT binds to the request to resist replay.
  • Where applicable: General; foundational for any cross-trust-domain federation or policy enforcement layered on top.