Re: [cti-stix] Object ID format

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I think we are getting really close to being able to start capturing this concept in to normative text and putting it in the Google Docs.  I feel like we have only a few open questions left.   So maybe we should start crafting the normative text so we can debate about the verbiage and not the idea.  John Wunder, since you are one of the key editors, do you want to take a crack at it?

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Jan 21, 2016, at 08:38, Wunder, John A. <jwunder@mitre.org> wrote:

Right, we just need to explicitly mandate a UUID as the ID portion. Neither STIX 1.2 nor the TWIGS proposals actually did this…they just said that it was some ID that the producer guarantees is unique in their namespace, which is not sufficient.

I definitely think this is the way to go.

From: <cti-stix@lists.oasis-open.org> on behalf of Sean Barnum <sbarnum@mitre.org>
Date: Thursday, January 21, 2016 at 10:34 AM
To: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Object ID format

I had the same initial reaction but if you look at the second half of his email you will see he realizes this and clarifies things.

sean

From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Thursday, January 21, 2016 at 10:24 AM
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Object ID format

"They can’t just re-use the 123 from my ID because they can’t guarantee that it’s unique. So they have to regenerate it."

I don't get this part. If the spec mandates RFC UUID and we also include the object type for even more entropy - it is essentially a guarantee it is unique.

-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail