Skip to content

WIMSE Workload-to-Workload Authentication — draft-ietf-wimse-s2s-protocol, draft-ietf-wimse-mutual-tls, draft-ietf-wimse-http-signature#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

  • Tier: Core
  • Why: This is the atomic unit of the architecture — how two workloads actually verify each other for one HTTP request — and it directly answers the "mTLS or app-layer tokens?" question every service-mesh deployment eventually hits, by making both interoperable in the same call chain.
  • What: s2s-protocol defines two compatible authentication protocols, one at the application layer and one over trusted TLS transport, that can be mixed hop-by-hop in a single call chain. mutual-tls profiles workload authentication using X.509 workload identity certificates over mTLS specifically. http-signature provides an HTTP Signatures–based alternative for end-to-end request (and optionally response) protection even when TLS is terminated at intermediate proxies or load balancers. (from abstract only)
  • How: Workload A→B can authenticate via mTLS while the next hop B→C authenticates at the application level, with both anchored to the same Workload Identity Token — so a mesh doesn't have to pick one model estate-wide.
  • Where applicable: General service-to-service traffic; the HTTP-signature variant is specifically useful where L7 proxies/load balancers break end-to-end TLS, i.e. most real-world meshes and API gateways.