Subject: [Id-event] Security Event Token (SET) spec draft-ietf-secevent-token-11 addressing SecDir and IANA comments

From: Phil Hunt <[email-masked]>
Date: Mon, 7 May 2018 21:17:42 -0700

An updated Security Event Token (SET) specification has been published to address recent review comments received form Eric Rescola, Ned Freed.  A summary of changes includes:

Clarified "iss" claim language about the SET issuer versus the security subject issuer.
Changed a "SHOULD" to a "MUST" in the "sub" claim description to be consistent with the Requirements for SET Profiles section.
Described the use of the "events" claim to prevent attackers from passing off other kinds of JWTs as SETs.
Stated that SETs are to be signed by an issuer that is trusted to do so for the use case. 
Added quotes in the phrase "token revoked" SET to be issued’ in the Timing Issues section.
Added section number references to the media type and media type suffix registrations.
Changed the encodings of the media type and media type suffix registrations to binary (since no line breaks are allowed).
Replaced a "TBD" in the media type registration with descriptive text.
Updated acknowledgments
  
An HTML-formatted version is also available at:
https://tools.ietf.org/html/draft-ietf-secevent-token-11 <https://urldefense.proofpoint.com/v2/url?u=http-3A__self-2Dissued.info_docs_draft-2Dietf-2Dsecevent-2Dtoken-2D10.html&d=DwMFAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=Tl8XEap73jqdOtAvOojBWb-A7tYoqL72aSuKKUrZtds&s=JUqTv71RIdyLVNXfML80Bb2pSr4-muxMv1bAYouWO_k&e=>

-Phil