Subject: [Id-event] Security Event Token (SET) is now RFC 8417

From: Mike Jones <[email-masked]>
Date: Tue, 10 Jul 2018 15:14:07 +0000

The Security Event Token (SET) specification is now RFC 8417<https://www.rfc-editor.org/rfc/rfc8417.txt>.  The abstract describes the specification as:
This specification defines the Security Event Token (SET) data structure. A SET describes statements of fact from the perspective of an issuer about a subject. These statements of fact represent an event that occurred directly to or about a security subject, for example, a statement about the issuance or revocation of a token on behalf of a subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP.

SETs are already in use to represent OpenID Connect Back-Channel Logout<http://openid.net/specs/openid-connect-backchannel-1_0.html> tokens and to represent Risk and Incident Sharing and Coordination (RISC)<http://openid.net/wg/risc/> events.  Thanks to my co-editors, members of the IETF ID Events mailing list, and members of the IETF Security Events working group for making this standard a reality!

                                                       -- Mike

P.S.  This notice was also published at http://self-issued.info/?p=1891 and as @selfissued<https://twitter.com/selfissued>.

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Jul 2018 08:27:46 -0700

+1!

Many many thanks to my co-authors and to the WG.

It seems like Yokohama and was just yesterday. 

When we started, several groups were all on similar but independent incompatible approaches. Getting to a common and foundational event format is a big win!

Congrats WG!

Phil

> On Jul 10, 2018, at 8:14 AM, Mike Jones <Michael.Jones=[email-masked]> wrote:
> 
> The Security Event Token (SET) specification is now RFC 8417.  The abstract describes the specification as:
> SETs are already in use to represent OpenID Connect Back-Channel Logout tokens and to represent Risk and Incident Sharing and Coordination (RISC) events.  Thanks to my co-editors, members of the IETF ID Events mailing list, and members of the IETF Security Events working group for making this standard a reality!
>  
>                                                        -- Mike
>  
> P.S.  This notice was also published at http://self-issued.info/?p=1891 and as @selfissued.
>  
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=tDbqAeMKpjI2Z2ZVOy5DQEOdmL8SYYVuotPCKr5kUdk&s=PkAhpFisDjxFv_tXYZCXwO97HmAhmf4b8HQBv8I49UE&e=