New Drafts for HTTP Message Signatures and Bot Authentication Released

On July 14, 2026, two drafts were published by the IETF focusing on HTTP Message Signatures and bot authentication. The first draft outlines an architecture for automated traffic identification using cryptographic signatures, addressing limitations of current methods like IP allowlisting and User-Agent strings. The second draft introduces a key directory format for clients to advertise their signing keys, facilitating in-band key discovery. Both drafts aim to enhance security and trust in automated systems, particularly in light of increasing agent traffic on the Internet. The drafts are currently in the Internet-Draft stage and will expire on September 3, 2026. They are not yet RFCs and are subject to further revisions.

Key Points: • Two IETF drafts released on July 14, 2026, focus on HTTP Message Signatures and bot authentication. • The drafts aim to improve security for automated traffic by using cryptographic signatures. • Current identification methods for bots are deemed inadequate due to their vulnerabilities.