Category: Specifications Page 9 of 23

The Security Event Token (SET) specification has been updated to simplify the definitions and usage of the “iat” (issued at) and “toe” (time of event) claims. The full set of changes made was:

• Simplified the definitions of the “iat” and “toe” claims in ways suggested by Annabelle Backman.
• Added privacy considerations text suggested by Annabelle Backman.
• Updated the RISC event example, courtesy of Marius Scurtescu.
• Reordered the claim definitions to place the required claims first.
• Changed to using the RFC 8174 boilerplate instead of the RFC 2119 boilerplate.

Thanks to Annabelle Backman, Marius Scurtescu, Phil Hunt, and Dick Hardt for the discussions that led to these simplifications.

The specification is available at:

• https://tools.ietf.org/html/draft-ietf-secevent-token-05

An HTML-formatted version is also available at:

• https://self-issued.info/docs/draft-ietf-secevent-token-05.html

A new version of the Security Event Token (SET) specification has been published that incorporates clarifications suggested by working group members in discussions since IETF 100. Changes were:

• Clarified that all “events” values must represent aspects of the same state change that occurred to the subject — not an aggregation of unrelated events about the subject.
• Removed ambiguities about the roles of multiple “events” values and the responsibilities of profiling specifications for defining how and when they are used.
• Corrected places where the term JWT was used when what was actually being discussed was the JWT Claims Set.
• Addressed terminology inconsistencies. In particular, standardized on using the term “issuer” to align with JWT terminology and the “iss” claim. Previously the term “transmitter” was sometimes used and “issuer” was sometimes used. Likewise, standardized on using the term “recipient” instead of “receiver” for the same reasons.
• Added a RISC event example, courtesy of Marius Scurtescu.
• Applied wording clarifications suggested by Annabelle Backman and Yaron Sheffer.
• Applied numerous grammar, syntax, and formatting corrections.

No changes to the semantics of the specification were made.

The specification is available at:

• https://tools.ietf.org/html/draft-ietf-secevent-token-04

An HTML-formatted version is also available at:

• https://self-issued.info/docs/draft-ietf-secevent-token-04.html