Internet-Draft draft-schrock-ep-revocation-statement-00.txt is now available.
Title: Portable Revocation Statements for Action-Bound Authorization Artifacts
Author: Iman Schrock
Name: draft-schrock-ep-revocation-statement-00.txt
Pages: 15
Dates: 2026-07-21
Abstract:
Signed authorization artifacts for agent actions (receipts, commits,
delegations) are being defined faster than the means to retract them.
Many deployed systems use live status services, revocation lists, or
issuer datastores. This document defines a complementary portable
form for action-bound authorization artifacts: a signed, offline-
verifiable claim that a named logical target, addressed by identifier
and action commitment, is revoked. Verification is fail-closed and
evaluates a fixed set of checks: version, closed object structure,
target binding, a revoker key pinned by the verifier and, for newly
emitted artifacts, bound to a full digest-derived key identifier (a
self-asserted key confers nothing), the presence of a strict
revocation instant that has taken effect by the verifier's decision
time, and an independently recomputed signature. The statement
proves that a named, pinned revoker revoked this specific target. It
does not prove that every relying party saw it, and offline
verification cannot prove the absence of a revocation that was not
presented. A terminal revocation never ages out; current non-
revocation requires separate authenticated, policy-fresh status
evidence. A Trust Program profile binds revocation to the complete
execution claim, and requires revocation-versus-claim to be resolved
atomically; a revocation learned after a claim never rewrites an
effect that may already have occurred.
The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-schrock-ep-revocation-statement/
There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-schrock-ep-revocation-statement-00.html
Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts
_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.