[SCITT] FW: FYI: Feedback received on the ztdnaid URI scheme request

[Dick Brooks <[e-mail]>]

FYI, feedback regarding my ztdnaid URI scheme used to assert a Zero Trust
identity, which can be validated using a Trust Registry, like SAG-CTR.

I sent this to the uri list today.

 

From: Dick Brooks <[e-mail]> 
Sent: Monday, May 18, 2026 2:15 PM
To: '[e-mail]' <[e-mail]>
Subject: FYI: Feedback received on the ztdnaid URI scheme request

 

 

Hello,

 

I have received critical feedback about the proposed  ztdnaid scheme, which
I created specifically to enable the DOD/DOW DIB to implement a low cost,
light weight Zero Trust implementation in practice without the complexity of
SPIFFE AND SPIRE.

DIB = Defense Industrial Base.

 

 

Here are the two criticisms I have received:

1.	The Digital DNA ID DDR record could be easily guessed which makes
the ztdnaid easily guessed
2.	This seems to compete with the NIST recommendations of SPIFFE and
SPIRE for Zero Trust identities

 

Responses:

1.	The example DDR record contained in the ztdnaid URI scheme Internet
Draft is simply an example. I've been recommending that DIB users create
DDR's that are not easily guessable, i.e.

Entity ztdnaid = sha256("OwnerInformation/EntityInformation/EntityUUID")

Resource ztdnaid =
sha256("OwnerInformation/ResourceInformation/ResourceUUID")

 

The ZTBOND record, used to verify a trust relationship between an Entity and
Resource contains:

Zero Trust Bond ztdnaid = sha256("ZeroTrustDomainIdentifier, Entity ztdnaid,
Resource ztdnaid")

                None of these ztdnaid's is easily guessable and are unlikely
to be successful in a brute-force attack.

 

2.	In the past. NIST recommended the use of SPIFFE and SPIRE to assert
a Zero Trust identity. But this can be a heavy lift for many smaller DIB
entities. The ztdnaid is deliberately light weight and well within the reach
of many DIB entities. They simply need to use a text editor, like notepad,
to create 3  text files:, 1 containing the ZTEntity DDR, 1 containing the
ZTResource DDR and a ZTBond DDR for each "trust relationship" between a
Resource and an Entity. The max DDR records are, one per Entity, one per
Resource and one "trust bond" per trust relationship, max number of records
=  Count(Entity)*Count(Resource). Each DDR translates into a single ztdnaid
that is used to check zero trust against a high integrity "Trust Registry",
like SCITT.

DIB entities only need a text editor, like notepad, to create their DDR
files which can be registered in a Trust Registry, like SAG-CTR.

 

I hope you will consider these insights when you take up the ztdnaid URI
scheme proposal.

 

Thanks,

 

Dick Brooks

  

Active Member of the CISA Critical Manufacturing Sector, 

Sector Coordinating Council - A Public-Private Partnership

Lifetime IEEE Member

Never trust software, always verify and report!
<https://reliableenergyanalytics.com/products>  T

Risk always exists, but trust must be earned and awarded.T 

 <https://businesscyberguardian.com/> https://businesscyberguardian.com/ 

Email: [e-mail]
<mailto:[e-mail]> 

Tel: [phone]