Re: [cti-stix] Deterministic IDs - pas de deux

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I do not think there is a way to prevent the same content being offered by two different groups with different IDs.  Obviously if you detect that in your system, and if the overlap is great enough, then my guess is you would just stop consuming one of the feeds.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On May 13, 2016, at 13:20, Taylor, Marlon <Marlon.Taylor@hq.dhs.gov> wrote:

Hi Trey,

Sorry for the delay.  The ^ of Math...got it!

My last question is: does the TC want to support the ability of having multiple TLOs with the same data being addressed by different identifiers? The ballot will have the answer.

Thanks for the clarity,

-Marlon

-----Original Message-----
From: Trey Darley [mailto:trey@soltra.com]
Sent: Wednesday, May 11, 2016 5:54 AM
To: Taylor, Marlon
Cc: Wunder, John A.; Foley, Alexander - GIS; Jordan, Bret; cti-stix@lists.oasis-open.org
Subject: Re: [cti-stix] Deterministic IDs - pas de deux

On 10.05.2016 18:02:36, Taylor, Marlon wrote:

What enforces the UUIDv4 that "identifies" Object A is not used to
identify Object B?

Hey, Marlon -

It's enforced by math. According to Wikipedia [0], the probability of a UUIDv4 collision is approximately 0.00000000006. In other words, "only after generating 1 billion UUIDs every second for the next 100 years, the probability of creating just one duplicate would be about 50%." [0].

Add to that the namespace prefix and the probability of a collision decreases dramatically.

[0]: https://en.wikipedia.org/wiki/Universally_unique_identifier#Random_UUID_probability_of_duplicates

--
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430 Soltra | An FS-ISAC & DTCC Company www.soltra.com
--
"One size never fits all." --RFC 1925

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail