Week ending November 6, 2026 — Sector Watch

The IESG approved Short-Lived Certificates for Secure Telephone Identity as a Proposed Standard on November 4, and its privacy section compares it favorably with the freshness mechanism STIR approved before it. A verifier that checks a certificate’s status over OCSP sends a network query that can reveal the source and destination of a call, and a STIR certificate also carries the list of telephone numbers it covers. A certificate valid for hours needs no status check: the signer fetches a new one, through ACME or a similar mechanism, and a compromised key stops working when the certificate expires. The OCSP profile for STIR certificates, by the same author, is already with the RFC Editor. Both are open specifications from the same working group.

Standards in motion

Telecom trust

STIR approved short-lived certificates for telephone identity. Short-Lived Certificates for Secure Telephone Identity, by Jon Peterson of TransUnion, was approved by the IESG on November 4 and sent to the RFC Editor. It replaces revocation checking with expiry, for certificates valid for days or hours. Verification services must accept the certificate chain carried inside the PASSporT in the x5c header, and signers must use that form for any certificate valid for less than a week, the same threshold below which the Web PKI exempts certificates from revocation requirements. That removes the certificate fetch at call time and makes the Identity header larger. ACME is the named acquisition path, building on the telephone-number authority token in RFC 9448 and ACME STAR for automatic renewal.

No status query leaves the verifier, so certificate use reveals no more about the caller than the call signaling already does, and a short lifetime lets each certificate’s TN Authorization List stay small. Peterson’s OCSP profile for STIR certificates, written with Sean Turner, defines real-time status checks for delegate certificates whose number list is carried by reference; it is in the RFC Editor’s queue. The short-lived document measures itself against current practice: certificates carrying a Service Provider Code authorize signing for any calling number and are valid for a year or more. Adoption read: approved, not yet deployed.

STIR’s new charter is approved. The IESG approved the charter on November 5, with the scope covered October 30: standards-track work binding a PASSporT to an identifier for the entity that holds a number, certificate transparency for telephone identity credentials, and out-of-band discovery of STIR credentials and services, including connected identity. The three Proposed Standard milestones carry no dates yet. Only certificate transparency has a working-group document.

The STI certificate transparency draft finished IETF Last Call with a question open on which CT version it builds on. STI Certificate Transparency, by authors at Somos, TransNexus and Twilio, requires STI certificates to be listed in a public log and verifiers to refuse certificates that are not, so that duplicate or unauthorized delegate and provider certificates can be detected. Last Call ended November 5. The draft takes its log structure and API from RFC 6962, which RFC 9162 obsoleted. The security directorate review asks the authors to check whether the reference can move to CT 2.0, and the document needs a revision explaining the choice before it goes to the IESG. The approved charter keeps governance of transparency services out of scope, so who operates STI logs is outside what the RFC will define. Adoption read: open, spec-stage.

Email authentication & anti-abuse

DKIM2 will let a subdomain’s signature authenticate the parent domain’s From address unless the parent opts out. Revision 09 of the mechanism draft, posted November 2, adds an upward match. A From address at example.com is now Authentic when the signing domain is a subdomain such as mail.example.com; revision 08 matched only downward, from the signing domain to its subdomains. The draft’s reason is existing practice: domain owners delegate sending subdomains to the intermediaries that send mail for them, and receivers have come to treat DKIM1 signatures from those subdomains as equivalent to the parent’s.

A parent domain that does not want this publishes a Domain Policy Record, a TXT record at _domainkey.example.com carrying v=DKIM1 and the flag f=strict. With no record, or no flag, subdomains are authorized. The policy applies only to the domain that publishes it and does not inherit up or down the DNS tree. The record is defined in the DNS specification, revised the same day and retitled to cover DKIM1 and DKIM2. It now updates RFC 6376 as well: the h=, n=, s= and t= key-record tags are deprecated for DKIM1, and DKIM2 ignores them.

The protective setting is opt-in. A domain that has handed a subdomain to an email service provider lets that provider make mail from the parent domain verify, unless the parent publishes the record. Adoption read: open, spec-stage, with the working group’s IESG submission milestone at March 2027.

Implementations & adoption

New Zealand’s first government-issued digital credential is for businesses. MBIE announced on November 3 a trial of the NZBN Business Passport, held in the Govt.nz app’s wallet, with selected Westpac business customers. It lets a business share verified information, including whether a person can act on its behalf, and is used alongside Westpac’s bank-account credential, accredited in September. It is the second credential accredited under the Digital Identity Services Trust Framework, whose authority assessed it against privacy and security requirements; the holder chooses when and where to present it. The wallet is built by MATTR. Neither MBIE nor the coverage names the credential format or presentation protocol, so whether a verifier outside the Govt.nz ecosystem can accept it is unclassifiable from what is public. That is the question for MBIE before wider rollout, which it says depends on feedback from the trial. Adoption read: one bank, a selected set of its customers.