Subject: [sacm] swid and swidpath URI scheme registration request

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 8 Oct 2021 14:18:13 +0000

This request is for the registrations of the "swid" and "swidpath" schemes defined in sections 6.6.1 and 6.6.2 of https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/.

Please let us know if there are any questions or concerns.

Regards,
Dave Waltermire

---

From: Ted Hardie <[email-masked]>
Date: Fri, 8 Oct 2021 16:28:49 +0100

Hi David,

My apologies, but I think I'm missing part of the scheme definition.  In
Section 5.1, I see:

For URIs that use the "swid" scheme, the scheme specific part MUST
   consist of a referenced software tag's tag-id.  This tag-id MUST be
   URI encoded according to [RFC3986] Section 2.1.

   The following expression is a valid example:

   swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c

I would have typically expected an ABNF production for the tag-id.
Instead, I see the following:

tag-id (index 0): A 16 byte binary string or textual identifier
      uniquely referencing a software component.  The tag identifier
      MUST be globally unique.  If represented as a 16 byte binary
      string, the identifier MUST be a valid universally unique
      identifier as defined by [RFC4122].  There are no strict
      guidelines on how this identifier is structured, but examples
      include a 16 byte GUID (e.g. class 4 UUID) [RFC4122], or a text
      string appended to a DNS domain name to ensure uniqueness across
      organizations.

Given the free-form nature of the text alternative, do I understand
correctly you intend to percent encode any reserved character?  Is this
still the case if the DNS domain name is an IDN?

Since the text format subsumes the UUID format, is there a presumption that
the equivalence rules for text are always preferred to the arithmetic
equivalence rules that UUIDs may use?

regards,

Ted Hardie

On Fri, Oct 8, 2021 at 3:18 PM Waltermire, David A. (Fed) <david.waltermire=
[email-masked]> wrote:

> This request is for the registrations of the "swid" and "swidpath" schemes
> defined in sections 6.6.1 and 6.6.2 of
> https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/.
>
>
>
> _______________________________________________
> Uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uri-review
>

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 8 Oct 2021 19:01:09 +0000

Ted,

These schemes will be used in the link structure of a coswid (see section 2.7). In a link the href is represented as text. The structure of the text would not need to be parsed, so a textual comparison I believe is appropriate.

The text string form would be percent encoded as you indicated. The UUID form would follow the "UUID" BNF defined in RFC4122 in section 3 and would also be represented as text.

If the text string contains Unicode characters, the codepoint would need to be converted to a byte sequence in UTF-8 and then each byte would be encoded per RFC3986 section 2.5.

Regards,
Dave

From: Ted Hardie <[email-masked]>
Sent: Friday, October 8, 2021 11:29 AM
To: Waltermire, David A. (Fed) <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Uri-review] swid and swidpath URI scheme registration request

Hi David,

My apologies, but I think I'm missing part of the scheme definition.  In Section 5.1, I see:

I would have typically expected an ABNF production for the tag-id.  Instead, I see the following:

      organizations.
Given the free-form nature of the text alternative, do I understand correctly you intend to percent encode any reserved character?  Is this still the case if the DNS domain name is an IDN?

Since the text format subsumes the UUID format, is there a presumption that the equivalence rules for text are always preferred to the arithmetic equivalence rules that UUIDs may use?

regards,

Ted Hardie

On Fri, Oct 8, 2021 at 3:18 PM Waltermire, David A. (Fed) <david.waltermire=[email-masked]<mailto:[email-masked]>> wrote:
This request is for the registrations of the "swid" and "swidpath" schemes defined in sections 6.6.1 and 6.6.2 of https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-sacm-coswid%2F18%2F&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=UYeM%2BXa%2BnhIiI%2FSAtmcmpAbA4hRPbPACzEdkNbh%2F8qY%3D&reserved=0>.

Regards,
Dave Waltermire

_______________________________________________
Uri-review mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/uri-review<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Furi-review&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AgSzdoVPSaUOj5EOpkc%2BrehZjTA9UlsfYXFgAUNd7gA%3D&reserved=0>

---

From: Ted Hardie <[email-masked]>
Date: Wed, 13 Oct 2021 11:20:36 +0100

Hi Dave,

Thanks for the reply and sorry for the delay in my response.

First, I believe the specification would benefit from additional text
laying out these rules.

Second, I believe it is legal according to what you describe for someone to
construct a free-form text id that looks like a UUID (not bright,
obviously, but legal).  Since the format doesn't have a flag to indicate
which of the forms is in use, I believe that means you also need a security
consideration to note that the URL taking the form of a UUID does not
guarantee the same statistical likelihood of uniqueness that you would
expect in a GUID.

Lastly, I believe it would be valuable to call out explicitly that you are
expecting percent encoding for IDN domain names and what to do if you
encounter a domain name that uses the ASCII-compatible encoding (so, xn--
etc.).  It's fine to say "nothing", that this is also acceptable, but
otherwise some implementations might attempt to convert it back to Unicode
and the percent encode it before comparison.

best regards,

Ted Hardie

On Fri, Oct 8, 2021 at 8:01 PM Waltermire, David A. (Fed) <
[email-masked]> wrote:

> Ted,
>
>
>
> These schemes will be used in the link structure of a coswid (see section
> 2.7). In a link the href is represented as text. The structure of the text
> would not need to be parsed, so a textual comparison I believe is
> appropriate.
>
>
>
> The text string form would be percent encoded as you indicated. The UUID
> form would follow the “UUID” BNF defined in RFC4122 in section 3 and would
> also be represented as text.
>
>
>
> If the text string contains Unicode characters, the codepoint would need
> to be converted to a byte sequence in UTF-8 and then each byte would be
> encoded per RFC3986 section 2.5.
>
>
>
>
>
> Regards,
>
> Dave
>
>
>
>
>
>
>
>
>
> *From:* Ted Hardie <[email-masked]>
> *Sent:* Friday, October 8, 2021 11:29 AM
> *To:* Waltermire, David A. (Fed) <[email-masked]>
> *Cc:* [email-masked]; [email-masked]; [email-masked]
> *Subject:* Re: [Uri-review] swid and swidpath URI scheme registration
> request
>
>
>
> Hi David,
>
>
>
> Since the text format subsumes the UUID format, is there a presumption
> that the equivalence rules for text are always preferred to the arithmetic
> On Fri, Oct 8, 2021 at 3:18 PM Waltermire, David A. (Fed)
> <david.waltermire=[email-masked]> wrote:
>
> https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/
> <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-sacm-coswid%2F18%2F&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=UYeM%2BXa%2BnhIiI%2FSAtmcmpAbA4hRPbPACzEdkNbh%2F8qY%3D&reserved=0>
> .
>
>
>
> <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Furi-review&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AgSzdoVPSaUOj5EOpkc%2BrehZjTA9UlsfYXFgAUNd7gA%3D&reserved=0>
>
>