[saag] Re: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer

Thanks, Eric.

In my email to dispatch@[email protected]<mailto:dispatch@[email protected]> I included 8 pages describing the use cases. Maybe it would describe what the I-D would do even if not in I-D format? Would it help that I forward that email to this group?

Cheers

Thi Nguyen-Huu | CEO

Tel: +1 905.502.7000 x 3288  |  Toll Free: 888.879.5879
[email protected]<mailto:[email protected]> |  www.winmagic.com<http://www.winmagic.com/>

WinMagic Corp. | 11-80 Galaxy Blvd.
Toronto, ON  |  M9W 4Y8 |  Canada | www.winmagic.com<http://www.winmagic.com/>
[cid:[email protected]]<http://www.facebook.com/WinMagicInc>  [cid:[email protected]] <https://twitter.com/winmagic>   [cid:[email protected]] <http://www.linkedin.com/company/winmagic>   [cid:[email protected]] <https://www.winmagic.com/blog/>
[A person holding a phone and typing on a computer  AI-generated content may be incorrect.]<https://winmagic.com/en/secure_internet/>

From: Eric Rescorla <[email protected]>
Sent: Monday, August 18, 2025 12:29 PM
To: Thi Nguyen-Huu <[email protected]>
Cc: [email protected]; StJohns, Michael <[email protected]>; Salz, Rich <[email protected]>; Paul Wouters <[email protected]>; Sergei Nikitin <[email protected]>
Subject: Re: [saag] Re: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
CAUTION:This email originated from outside of the organization. Do not click links, open attachments or respond unless you recognize the sender and know that the content is safe.



On Mon, Aug 18, 2025 at 7:07 AM Thi Nguyen-Huu <[email protected]<mailto:[email protected]>> wrote:
Dear SAAG members,
I’m writing to follow up on my earlier outreach regarding The Secure Internet architecture. After further reflection and community feedback, I believe this initiative is best introduced through a BOF (Birds of a Feather) session rather than a standalone Internet-Draft.

Typically the Internet-Draft is the basis on which the community determines (1) whether a BOF is warranted and (2) whether the WG should be chartered.

At the end of the day, the IETF publishes specifications as RFCs, and so the I-D serves as some indication of what specification will eventually be published.



The Secure Internet (SI) enables what legacy architectures deemed infeasible — and what users have long dreamed of:

  *   No user action: No passwords, no MFA, no friction.
  *   Protocol-native protection: Cryptographic defense against session hijacking and adversary-in-the-middle (AitM) attacks.

SI proposes a new trust model for the Internet — one that replaces static credentials and certificate-based authentication with policy-bound cryptographic keys anchored in hardware, available only when organizational trust conditions are met. This enables non-interactive, mutual authentication via mTLS without certificates, transforming how endpoints and services establish trust.
Given the architectural scope — spanning transport security, endpoint identity, and trust enforcement — SI does not fit neatly into existing working groups. It introduces foundational concepts such as:

  *   Live Key: A dynamic identity signal tied to verified user presence and device integrity.
  *   LIM/TIM (The Identity Machine): A system that governs Live Key availability based on policy.
  *   MagicEndpoint: A trusted channel between endpoint and IdP, enabling continuous identity signaling.
I believe a BOF is the right venue to:

  *   Explore the feasibility of a new working group
  *   Discuss technical foundations and deployment models
  *   Align with existing standards (TLS, FIDO2, RATS)
  *   Define a roadmap for multiple RFCs under the Secure Internet umbrella

This may or may not be true, but nevertheless, an I-D is the right place to lay out this argument.

-Ekr

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]