Re: [cti-cybox] File/Artifact Encryption & Archive Properties

[Trey Darley <trey@newcontext.com>]

On 04.10.2017 15:40:03, Kirillov, Ivan A. wrote:
> > An encrypted zip file is different than just encrypting (and
> > compressing) the file contents. Doing this would lose the
> > mime_type of the file being compressed in the archive (if this is
> > important).
> 
> That’s true, but since we’re discussing the Artifact Object in this
> case, I don’t think we care about the contents as much as the
> container (the actual “artifact”). If you need to characterize the
> contents of an archive, you can still using the existing File Object
> w/ archive-file-extension for this purpose.
> 

Exactly.

> 
> Also, I’m in agreement with Sean and others that it probably makes
> the most sense to just add a new entry of “unspecified” to the
> encryption-algo-ov, since this would cover all of our associated use
> cases.
> 

I just added that to the encryption-algo-ov in STIX 2.1, Part 3.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"No matter how hard you try, you can't make a baby in much less than 9
months. Trying to speed this up *might* make it slower, but it won't
make it happen any quicker." --RFC 1925

Attachment: signature.asc
Description: Digital signature