RE: IPv4 and IPv6 Address Objects

["Mates, Jeffrey CIV DC3\\DCCI" <Jeffrey.Mates@dc3.mil>]

I think it had to do with the fact that we were trying to avoid the generic
CybOX 2 Address Object that could store an email address, IPv4 or IPv6
address with the type determined by a separate field.

I also don't think that JSON has anything like the XSD choice, so it
wouldn't be possible to have dedicated ipv4 and ipv6 tags that are mutually
exclusive in a larger address object.  So you would need something like:

{"type":"IP","format":"ipv6","address":"1234::5678"}

While this format is human readable it adds an additional step to machine
validation.  This is because unlike other object types you would need to
read in a format tag, which would then determine your parsing rule for your
address tag rather than just reading in the tag you wanted to validate.

Jeffrey Mates, Civ DC3/DCCI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computer Scientist
Defense Cyber Crime Institute
jeffrey.mates@dc3.mil
410-694-4335

-----Original Message-----
From: cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org]
On Behalf Of Jordan, Bret
Sent: Tuesday, August 30, 2016 4:27 PM
To: OASIS CTI TC CybOX SC list
Subject: [Non-DoD Source] [cti-cybox] IPv4 and IPv6 Address Objects

I find it interesting that we have two identical objects, one for IPv4 and
IPv6.  This was probably discussed at length in the past, but I am curious
to know the rational for having two objects vs just having an "IP" object
with a label of ipv4 or ipv6. 



Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO Blue
Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415
0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
can not be unscrambled is an egg."

Attachment: smime.p7s
Description: S/MIME cryptographic signature