Re: [cti-stix] Re: [EXT] [cti-stix] ability to use UUID5 in STIX2 identifier

[Patrick Maroney <pmaroney@darklight.ai>]

While I canât attest to HOW the three IDs referenced have the same suffix UUID value, arenât they still unique given their prefixes are unique?

 

  "id": "relationship--4832076b-7a4c-4952-8853-6446de513176"

  "id": "report--4832076b-7a4c-4952-8853-6446de513176"

  "id": "campaign--4832076b-7a4c-4952-8853-6446de513176"

 

Note also that these are NOT UUIDv5.

 

Patrick Maroney

DarkLight

www.darklight.ai

 

 

From: <cti-stix@lists.oasis-open.org> on behalf of John-Mark Gurney <jmg@newcontext.com>
Organization: New Context
Date: Wednesday, February 13, 2019 at 8:26 PM
To: Sean Barnum <sean.barnum@FireEye.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Re: [EXT] [cti-stix] ability to use UUID5 in STIX2 identifier

 

We already have an issue w/ UUID's being repeated from the same org,

but for different types of objects:

https://github.com/pan-unit42/playbook_viewer/issues/7

 

Expanding this such that the same UUID's can be generated by different

orgs, and the same type will break STIX significantly.