Re: [sacm] AD Review of draft-ietf-sacm-coswid-15

I believe CoSWID should use RFC 7049 Tag 1 (POSIX Time), with or without
the tag, defined as seconds since the epoch.  POSIX time is both more
compact and more computationally pure than strings and their myriad formats
and leap second hacks.

CoSWID is a newer document than SWID and should have the flexibility to
represent date-time, regardless of whether the current version of SWID is
restricted to date only.  Use cases should drive requirements, and it seems
plausible that software identifiers could be issued more than once per
day.  And if restriction to date resolution is desired by policy, it should
be expressed as policy rather than hard-coded into the underlying data
format.

Dave

On Fri, Feb 12, 2021 at 10:20 AM Carsten Bormann <cabo@tzi.org> wrote:

> On 2020-11-15, at 20:15, Roman Danyliw <rdd@cert.org> wrote:
> >
> >
> > ** Section 2.9.4.  The date field here is a CDDL time type.  In SWID,
> the equivalent is a xs:date.  Wouldn't it be more appropriate to use a CDDL
> tstr here?
> > [Update: I see you're tracking this and have a marker for it with
> [QUESTION: Is "time" a correct representation of XSD:date?]”
>
> By now, we have RFC 8943, which defines two representations of calendar
> date:
>
>    Tag:  1004
>    Data Item:  UTF-8 text string
>    Semantics:  [RFC3339] full-date string
>    Reference:  RFC 8943
>
>    Tag:  100 (ASCII 'd')
>    Data Item:  Unsigned or negative integer
>    Semantics:  Number of days since the epoch date 1970-01-01
>    Reference:  RFC 8943
>
> So tag 1004 is directly equivalent to xs:date’s XML text form, while tag
> 100 is a compact form of that that would be more appropriate for COSWID in
> my view.
> [Note that the conversion between the two is entirely based on the
> principles of the Gregorian calendar, it will not be messed with by
> politicians (and their desire to get a memorial monument by messing with
> time zones) or by the time-nuts and their leap seconds.]
>
>                +==================+==============+=========+
>                | Date             | Tag 1004     | Tag 100 |
>                +==================+==============+=========+
>                | October 9, 1940  | "1940-10-09" | -10676  |
>                +------------------+--------------+---------+
>                | December 8, 1980 | "1980-12-08" | 3994    |
>                +------------------+--------------+---------+
>
>                                   Table 1
>
> As usual, we can import the definitions made in this RFC into other RFCs
> without necessarily using it *as a tag* (i.e., we can use a tag in
> unwrapped form, if desired).
>
> Grüße, Carsten
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>