What's New at the IETF#

Yingzhen Qu – Futurewei Technologies; Yaroslav Rosomakho – Zscaler

• Why: Standards-watch with an unusually dense set of identity-relevant items for this program: the wimse WG (Workload Identity in Multi-System Environments) adopted its Workload Identifier draft and split service-to-service credentials and authentication mechanisms into separate drafts; the OAuth WG adopted OAuth SPIFFE Client Authentication and published RFC 9901 (selective disclosure for JWTs); plus ECH RFCs (9848/9849), ML-KEM/SLH-DSA identifiers for X.509, and the new "plants" WG on Merkle Tree Certificates for post-quantum PKI.
• What: A survey of IETF/IRTF/IAB structure and active work across areas — routing (BGP-4 4271bis, ASPA verification, RPKI-to-router 8210bis), QUIC multipath and MoQT, DELEG for DNS, NEMOPS-derived service abstractions (ONSEN BoF), and agentic coordination work (CATALIST).
• How: Overview format; the useful artifact is the map of where each effort sits and which drafts are newly adopted vs published.
• Where applicable: Broad relevance; for this PM, the wimse, OAuth-SPIFFE, and post-quantum PKI threads are the take-homes for workload/agentic identity planning.