Опубликованные RFC, связи обновления и замены, официальные статусы и русские переводы.
Реестр · 9 842 документов
YANG Data Model for the OSPF Protocol
This document defines a YANG data model that can be used to configure and manage OSPF. The model is based on YANG 1.1 as defined in RFC 7950 and conforms to the Network Management Datastore Architecture (NMDA) as described in RFC 8342.
YANG Data Model for Protocol Independent Multicast (PIM)
This document defines a YANG data model that can be used to configure and manage devices supporting Protocol Independent Multicast (PIM). The model covers the PIM protocol configuration, operational state, and event notifications data.
YANG Data Model for Bidirectional Forwarding Detection (BFD)
This document defines a YANG data model that can be used to configure and manage Bidirectional Forwarding Detection (BFD). The YANG modules in this document conform to the Network Management Datastore Architecture (NMDA) (RFC 8342).
OAuth 2.0 Pushed Authorization Requests
This document defines the pushed authorization request (PAR) endpoint, which allows clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request and provides them with a request URI that is used as reference to the data in a subsequent call to the authorization endpoint.
Gateway Auto-Discovery and Route Advertisement for Site Interconnection Using Segment Routing
Data centers are attached to the Internet or a backbone network by gateway routers. One data center typically has more than one gateway for commercial, load-balancing, and resiliency reasons. Other sites, such as access networks, also need to be connected across backbone networks through gateways. This document defines a mechanism using the BGP Tunnel Encapsulation attribute to allow data center g…
A Manifest Information Model for Firmware Updates in Internet of Things (IoT) Devices
Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. Ensuring that devices function and remain secure over their service lifetime requires such an update mechanism to fix vulnerabilities, update configuration settings, and add new functionality. One component of such a firmware …
IANA Registry for Sieve Actions
The Sieve Email Filtering Language (RFC 5228) is a popular email filtering language used upon final mail delivery. This document creates a registry for Sieve actions to help developers and Sieve extension writers track interactions between different extensions.
Deprecating Infrastructure "int" Domains
This document deprecates the use of any "int" domain names that were designated for infrastructure purposes by the IETF, and it identifies them for removal from the "int" top-level domain. Any implementations that involve these domains are now deprecated. This document also changes the status of RFC 1528 and RFC 1706 to Historic.
Nameservers for the Address and Routing Parameter Area ("arpa") Domain
This document describes revisions to operational practices to separate the function of the "arpa" top-level domain in the DNS from its historical operation alongside the DNS root zone.
Multicast Considerations over IEEE 802 Wireless Media
Well-known issues with multicast have prevented the deployment of multicast in 802.11 (Wi-Fi) and other local-area wireless environments. This document describes the known limitations of wireless (primarily 802.11) Layer 2 multicast. Also described are certain multicast enhancement features that have been specified by the IETF and by IEEE 802 for wireless media, as well as some operational choices…
Enhanced JSON Web Token (JWT) Claim Constraints for Secure Telephone Identity Revisited (STIR) Certificates
RFC 8226 specifies the use of certificates for Secure Telephone Identity Credentials; these certificates are often called "Secure Telephone Identity Revisited (STIR) Certificates". RFC 8226 provides a certificate extension to constrain the JSON Web Token (JWT) claims that can be included in the Personal Assertion Token (PASSporT), as defined in RFC 8225. If the PASSporT signer includes a JWT claim…
Revised Validation Procedure for BGP Flow Specifications
This document describes a modification to the validation procedure defined for the dissemination of BGP Flow Specifications. The dissemination of BGP Flow Specifications as specified in RFC 8955 requires that the originator of the Flow Specification match the originator of the best-match unicast route for the destination prefix embedded in the Flow Specification. For an Internal Border Gateway Pro…
A File Format to Aid in Security Vulnerability Disclosure
When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.
An Automatic Certificate Management Environment (ACME) Profile for Generating Delegated Certificates
This document defines a profile of the Automatic Certificate Management Environment (ACME) protocol by which the holder of an identifier (e.g., a domain name) can allow a third party to obtain an X.509 certificate such that the certificate subject is the delegated identifier while the certified public key corresponds to a private key controlled by the third party. A primary use case is that of a C…
HTTP/3
Определяет отображение семантики HTTP на транспорт QUIC, включая потоки управления и сжатие заголовков QPACK. Устраняет блокировку независимых HTTP-потоков потерей TCP-пакета, но наследует эксплуатационные особенности UDP и QUIC.
HTTP/2
Определяет двоичное кадрирование HTTP/2, мультиплексирование потоков, управление потоком и сжатие полей заголовка поверх одного соединения. Семантика HTTP задаётся отдельно RFC 9110.
HTTP/1.1
Определяет синтаксис сообщений и управление соединениями HTTP/1.1. Семантика методов и состояний вынесена в RFC 9110, поэтому оба документа применяются совместно.
HTTP Caching
The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document defines HTTP caches and the associated header fields that control cache behavior or indicate cacheable response messages. This document obsoletes RFC 7234.
HTTP Semantics
Определяет общую семантику HTTP независимо от конкретной версии передачи: методы, состояния, поля, представления, согласование содержимого, кэширование и условия запросов. Это основной смысловой слой для HTTP/1.1, HTTP/2 и HTTP/3. Документ описывает архитектуру HTTP, общую терминологию, механизмы расширения и схемы URI «http» и «https».
Читать русский перевод →Network Time Protocol Version 4: Port Randomization
The Network Time Protocol (NTP) can operate in several modes. Some of these modes are based on the receipt of unsolicited packets and therefore require the use of a well-known port as the local port. However, in the case of NTP modes where the use of a well-known port is not required, employing such a well-known port unnecessarily facilitates the ability of attackers to perform blind/off-path atta…
YANG Types for DNS Classes and Resource Record Types
This document introduces the YANG module "iana-dns-class-rr-type", which contains derived types reflecting two IANA registries: DNS CLASSes and Resource Record (RR) TYPEs. These YANG types are intended as the minimum basis for future data modeling work.
BGP Optimal Route Reflection (BGP ORR)
This document defines an extension to BGP route reflectors. On route reflectors, BGP route selection is modified in order to choose the best route from the standpoint of their clients, rather than from the standpoint of the route reflectors themselves. Depending on the scaling and precision requirements, route selection can be specific for one client, common for a set of clients, or common for all…
Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications
RFC 9106 описывает Argon2 версии 1.3 — функцию с высокой требовательностью к памяти для хеширования паролей и приложений proof-of-work. Документ даёт ориентированное на реализатора описание алгоритма, его входов, операций, выбора параметров и тестовых векторов. Основной вариант Argon2id объединяет свойства Argon2i и Argon2d; его должна поддерживать любая реализация документа. RFC приводит рекоменд…
Читать русский перевод →A YANG Data Model for Terminal Access Controller Access-Control System Plus (TACACS+)
This document defines a Terminal Access Controller Access-Control System Plus (TACACS+) client YANG module that augments the System Management data model, defined in RFC 7317, to allow devices to make use of TACACS+ servers for centralized Authentication, Authorization, and Accounting (AAA). Though being a standard module, this module does not endorse the security mechanisms of the TACACS+ protoco…
Distribution of Traffic Engineering Extended Administrative Groups Using the Border Gateway Protocol - Link State (BGP-LS)
Administrative groups are link attributes used for traffic engineering. This document defines an extension to the Border Gateway Protocol - Link State (BGP-LS) for advertisement of extended administrative groups (EAGs).
DNS Zone Transfer over TLS
DNS zone transfers are transmitted in cleartext, which gives attackers the opportunity to collect the content of a zone by eavesdropping on network connections. The DNS Transaction Signature (TSIG) mechanism is specified to restrict direct zone transfer to authorized clients only, but it does not add confidentiality. This document specifies the use of TLS, rather than cleartext, to prevent zone co…
TLS DNSSEC Chain Extension
This document describes an experimental TLS extension for the in-band transport of the complete set of records that can be validated by DNSSEC and that are needed to perform DNS-Based Authentication of Named Entities (DANE) of a TLS server. This extension obviates the need to perform separate, out-of-band DNS lookups. When the requisite DNS records do not exist, the extension conveys a denial-of-e…
The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
RFC 9101 определяет передачу параметров запроса авторизации OAuth 2.0 в объекте запроса (Request Object), представленном JWT. Объект подписывается с помощью JWS для защиты целостности и аутентификации источника; дополнительное шифрование с помощью JWE обеспечивает конфиденциальность. Объект передаётся непосредственно в параметре request либо по ссылке в request_uri. Сервер авторизации проверяет по…
Читать русский перевод →Sensor Measurement Lists (SenML) Features and Versions
This short document updates RFC 8428, "Sensor Measurement Lists (SenML)", by specifying the use of independently selectable "SenML Features" and mapping them to SenML version numbers.
Operational Security Considerations for IPv6 Networks
Knowledge and experience on how to operate IPv4 networks securely is available, whether the operator is an Internet Service Provider (ISP) or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes security issues in the protocol, but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages …