OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti-stix] Timestamps - Proposal


No, the "Z" is not allowed.  And we had a lot of debate about doing everything in UTC versus using the offset.  What we heard from very large groups is that doing everything in UTC does not really work.  So we decided to error on the side of using the offset.  Now, you can always set your offset as +00:00 and code all of your time in UTC.  That would be an option, but you would need to include an offset, even if that offset was +00:00


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Dec 1, 2015, at 12:43, John-Mark Gurney <jmg@newcontext.com> wrote:

One question, per 3, that means that yyyy-mm-ddThh:mm:ssZ is not allowed?

I'm personally in favor of UTC only (using Z), because too often datetime stamps are mishandled, but as long as we are only allowing hour/minute offsets the math is easier for storage...

On Tue, Dec 1, 2015 at 11:31 AM, Jordan, Bret <bret.jordan@bluecoat.com> wrote:
All,

In an effort to resolve the endless timestamp debate and come to consensus, Mark, John Wunder, Jason, and I had a lively chat on Slack and have all agreed to give and take to come to middle ground on the following.  We would therefor like to propose the following as an official proposal for timestamps in STIX 2.0.  Is everyone okay with this?

1) Timestamps MUST follow RFC 3339 with the following extra requirements 
2) Timestamps MUST use the timezone offset
3) Timestamps MUST use the following format yyyy-mm-ddThh:mm:ss.mmmmmm+-hh:mm
4) There will be an optional precision field (timestamp-precision) with the following string values: year, month, day, hour, minute, second. If precision is omitted, the default value of precision is "microsecond"
5) When using the precision field, unknown values MUST be zeroed out


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 



Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]