[sacm] SWIMA, data model types, and PENs

["Schmidt, Charles M." <[e-mail]>]

Hello all,

The conversation on SWIMA last week made some good progress. Below are the main points and some open issues for discussion on-list. References to the current draft are to draft-ietf-sacm-nea-swid-patnc-00 (https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swid-patnc/). References to issue numbers are from the Software Identification GitHub tracker (https://github.com/sacmwg/software-identification).

==GitHub issue 4 - Add user/vendor-defined data model support==
The new draft expands the way data models are identified. Most discussion of this procedure is in section 3.4.2. The new procedure is to use a Private Enterprise Number to allow vendors to have their own "namespace" where they define meanings for the 1-byte Data Model Type field. A PEN of 0x000000, corresponding to IANA, uses the new registry for Software Data Models (defined in section 9.4) to define meanings for the Data Model Type field. Within this registry, values of 192-255 are reserved for use by the local enterprise, allowing these enterprises to define their meaning locally.

Overall, no concerns were raised with this approach on the call. However, a question was raised with regard to how PENs are conveyed in attributes:

Currently, 3 bytes are reserved for the PENs. It was questioned whether this was sufficient. I did some researched and the answer is "maybe".

According to section 4.3 of expired Internet Draft draft-liang-iana-pen-06 (https://datatracker.ietf.org/doc/draft-liang-iana-pen/)

"Maximum value for PENs is hereby defined within 2**32-1 with 0 and
0xFFFFFF (in hex) marked as Reserved. (Note that while the original
PEN definition has no upper bound, this document defines the upper
bound, because some protocol make assumptions about how big PENs can
be. For example, DIAMETER [RFC3588] assumes that this value is no
bigger than 2**32-1.)"

In short, there is no official upper bound to PENs, although there was a suggestion to bound them at 4-bytes. In the meantime, as of this morning, the largest allocated PEN is 0xC082, so a bit over 3/4 of the way to filling 2 bytes.

The PEN and Data Model Type field are sent with every record or record identifier transmitted, so these fields get repeated a lot.

So two questions:
1) Do people agree with the new procedure for supporting data model types as managed by vendors, local enterprises, and IANA?

2) Do people agree with continuing to use 3 bytes for representing PENs in attributes?

Thanks,
Charles