Re: [siprec] Stephen Farrell's Discuss on draft-ietf-siprec-metadata-20: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Hiya,

(We're spiralling in on precision... :-)

On 02/03/16 16:26, Paul Kyzivat wrote:
> On 3/2/16 10:47 AM, Stephen Farrell wrote:
>>
>>
>> On 02/03/16 15:23, Paul Kyzivat wrote:
>>> On 3/2/16 6:08 AM, Stephen Farrell wrote:
>>>
>>>> (2) 6.10: Don't you need to say to use UUID version 4 with
>>>> random numbers and to not use MAC addresses?  IOW, refer to
>>>> RFC4122, Section 4.4 for how to generate UUIDs.
>>>
>>> I don't think we want to restrict to the section 4.4 algorithm. SRCs may
>>> need quite a lot of UUIDs. There is no reason to be using a random
>>> number generator for each one.
>>
>> Using a good PRNG for this should be fine and is allowed by 4.4.
>> There's no need to block on /dev/random for this anyway:-)
>>
>>> And there could be cases where two SRCs
>>> that are cooperating on recording might want to algorithmically
>>> synchronize their uuid generation. For both of these cases the
>>> name-based algorithm can work well. For that to be safe it is only
>>> necessary that the namespace be unique.
>>>
>>> So I would rather not be so proscriptive about *how* the UUIDs are
>>> generated, as long as they avoid accidental collisions and collisions
>>> due to malice.
>>
>> I'd be fine with allowing that too. I think the main thing is
>> to exclude using MAC addresses. So maybe saying "Follow RFC4122,
>> Section 4.3 or 4.4" would work?
> 
> Looking carefully at 4122: IIUC your objection is to using the algorithm
> in section 4.1? So 4.2 and 4.3 are ok. And I would think 4.5 is also ok?
> (But not the NIL UUID.)

Doesn't 4.2 use the node_id the same way as 4.1?

4.5 also seems fine.

> 
> If 4.3 is used, does it matter what algorithm is used to create the name
> space ID?

I guess it could, e.g. using an AoR might be a bad plan I
suppose, whereas using a DNS name associated with the SRS
could be a good plan, but I'm not sure what implementers
would be likely to use here. If I were to guess, I'd guess
that some name for the SRS would be ok.

Perhaps another way to handle it would be to say "use
4122, sections 4.3, 4.4 or 4.5 but ensure that you don't
use anything potentially personally identifying to
generate the UUIDs, so if you follow 4.3 a name for the
SRS might be a good choice."

That work?

Cheers,
S.


> 
>     Thanks,
>     Paul