Subject: [Id-event] Security Event Token (SET) specification preventing token confusion

From: Mike Jones <[email-masked]>
Date: Fri, 30 Jun 2017 20:40:17 +0000

A new version of the Security Event Token (SET) specification has been published containing measures that prevent any possibility of confusion between ID Tokens and SETs.  Preventing confusion between SETs, access tokens, and other kinds of JWTs is also covered.  Changes were:

  *   Added the Requirements for SET Profiles section.
  *   Expanded the Security Considerations section to describe how to prevent confusion of SETs with ID Tokens, access tokens, and other kinds of JWTs.
  *   Registered the application/secevent+jwt media type and defined how to use it for explicit typing of SETs.
  *   Clarified the misleading statement that used to say that a SET conveys a single security event.
  *   Added a note explicitly acknowledging that some SET profiles may choose to convey event subject information in the event payload.
  *   Corrected an encoded claims set example.
  *   Applied grammar corrections.

This draft is intended to provide solutions to the issues that had been discussed in IETF 98 in Chicago and subsequently on the working group mailing list.  Thanks for all the great discussions that informed this draft!

The specification is available at:

  *   https://tools.ietf.org/html/draft-ietf-secevent-token-02

An HTML-formatted version is also available at:

  *   http://self-issued.info/docs/draft-ietf-secevent-token-02.html

                                                                -- Mike

P.S.  This announcement was also posted at http://self-issued.info/?p=1709 and as @selfissued<https://twitter.com/selfissued>.

---

From: William Denniss <[email-masked]>
Date: Fri, 30 Jun 2017 13:48:54 -0700

Thank you Mike. It's good to see the SET - ID Token issue resolved, and the
other positive changes.

It would be good to publish SET soon, so the working groups that will be
profiling it can get going. With that in mind, should we initiate the WGLC?

On Fri, Jun 30, 2017 at 1:40 PM, Mike Jones <[email-masked]>
wrote:

> A new version of the Security Event Token (SET) specification has been
> published containing measures that prevent any possibility of confusion
> between ID Tokens and SETs.  Preventing confusion between SETs, access
> tokens, and other kinds of JWTs is also covered.  Changes were:
>
>    - Added the Requirements for SET Profiles section.
>    - Expanded the Security Considerations section to describe how to
>    prevent confusion of SETs with ID Tokens, access tokens, and other kinds of
>    JWTs.
>    - Registered the application/secevent+jwt media type and defined how
>    to use it for explicit typing of SETs.
>    - Clarified the misleading statement that used to say that a SET
>    conveys a single security event.
>    - Added a note explicitly acknowledging that some SET profiles may
>    choose to convey event subject information in the event payload.
>    - Corrected an encoded claims set example.
>    - Applied grammar corrections.
>
>
>
> This draft is intended to provide solutions to the issues that had been
> discussed in IETF 98 in Chicago and subsequently on the working group
> mailing list.  Thanks for all the great discussions that informed this
> draft!
>
>
>
>    - https://tools.ietf.org/html/draft-ietf-secevent-token-02
>
>
>
>    - http://self-issued.info/docs/draft-ietf-secevent-token-02.html
>
>
>
>                                                                 -- Mike
>
>
>
> P.S.  This announcement was also posted at http://self-issued.info/?p=1709
> and as @selfissued <https://twitter.com/selfissued>.
>

---

From: "M.Lizar@OCG" <[email-masked]>
Date: Sat, 1 Jul 2017 00:23:11 +0100

+1 

Appears useful and stable enough now to initiate the WGLC.

- Mark

> On 30 Jun 2017, at 21:48, William Denniss <[email-masked]> wrote:
> 
> Thank you Mike. It's good to see the SET - ID Token issue resolved, and the other positive changes.
> 
> It would be good to publish SET soon, so the working groups that will be profiling it can get going. With that in mind, should we initiate the WGLC?
> 
> On Fri, Jun 30, 2017 at 1:40 PM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:
> Added the Requirements for SET Profiles section.
> Expanded the Security Considerations section to describe how to prevent confusion of SETs with ID Tokens, access tokens, and other kinds of JWTs.
> Registered the application/secevent+jwt media type and defined how to use it for explicit typing of SETs.
> Clarified the misleading statement that used to say that a SET conveys a single security event.
> Added a note explicitly acknowledging that some SET profiles may choose to convey event subject information in the event payload.
> Corrected an encoded claims set example.
> Applied grammar corrections.
>  
> 
> https://tools.ietf.org/html/draft-ietf-secevent-token-02 <https://tools.ietf.org/html/draft-ietf-secevent-token-02>
>  
> 
> http://self-issued.info/docs/draft-ietf-secevent-token-02.html <http://self-issued.info/docs/draft-ietf-secevent-token-02.html>
>  
> 
>                                                                 -- Mike
> 
>  
> 
> P.S.  This announcement was also posted at http://self-issued.info/?p=1709 <http://self-issued.info/?p=1709> and as @selfissued <https://twitter.com/selfissued>.
> 
> 
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event