Shared Signals Framework (SSF)

The Shared Signals Framework is the OpenID Foundation's transport layer for security event exchange between systems: how transmitters and receivers establish streams, verify each other, and deliver signed event tokens. CAEP and RISC define what events mean; SSF defines how they move reliably from the system that observed a compromise to every system that should care.

The division of labour is worth keeping straight when reading the specifications. SSF covers stream configuration, authorization and delivery, including the push and poll transports; CAEP and RISC define the event types that travel over it.

A receiver therefore implements SSF once and then adds event handlers, which is what makes the ecosystem tractable for anyone consuming signals from more than one transmitter.

Keeping the layers straight makes the specifications much easier to read. The framework covers stream configuration, authorization, delivery and the push and poll transports; the event profiles that ride on it define what an event means. A receiver implements the framework once and then adds handlers, which is what makes consuming signals from several transmitters tractable.

Delivery semantics are the part that decides reliability in practice. Push is immediate and depends on the receiver being reachable; poll is resilient and adds latency bounded by the interval. Neither guarantees exactly-once, so a receiver has to be able to process the same event twice without doing the work twice, which is an ordinary requirement that is easy to defer until it causes a duplicate revocation.

Stream configuration is also a security surface in its own right. Who may create a stream, which subjects it may cover, and how a transmitter is authenticated all decide whether the channel can be abused to assert events about identities the transmitter has no standing to speak for, which would undermine every CAEP event that travels over it.

A receiver that implements it once can consume CAEP events and the account-level events defined alongside them.

Receivers use it to act on revocation while a session is live, which is the continuous authentication problem.