Re: [Uri-review] swid and swidpath URI scheme registration request

Hi Dave,

Thanks for the reply and sorry for the delay in my response.

First, I believe the specification would benefit from additional text
laying out these rules.

Second, I believe it is legal according to what you describe for someone to
construct a free-form text id that looks like a UUID (not bright,
obviously, but legal).  Since the format doesn't have a flag to indicate
which of the forms is in use, I believe that means you also need a security
consideration to note that the URL taking the form of a UUID does not
guarantee the same statistical likelihood of uniqueness that you would
expect in a GUID.

Lastly, I believe it would be valuable to call out explicitly that you are
expecting percent encoding for IDN domain names and what to do if you
encounter a domain name that uses the ASCII-compatible encoding (so, xn--
etc.).  It's fine to say "nothing", that this is also acceptable, but
otherwise some implementations might attempt to convert it back to Unicode
and the percent encode it before comparison.

best regards,

Ted Hardie

On Fri, Oct 8, 2021 at 8:01 PM Waltermire, David A. (Fed) <
david.waltermire@nist.gov> wrote:

> Ted,
>
>
>
> These schemes will be used in the link structure of a coswid (see section
> 2.7). In a link the href is represented as text. The structure of the text
> would not need to be parsed, so a textual comparison I believe is
> appropriate.
>
>
>
> The text string form would be percent encoded as you indicated. The UUID
> form would follow the “UUID” BNF defined in RFC4122 in section 3 and would
> also be represented as text.
>
>
>
> If the text string contains Unicode characters, the codepoint would need
> to be converted to a byte sequence in UTF-8 and then each byte would be
> encoded per RFC3986 section 2.5.
>
>
>
>
>
> Regards,
>
> Dave
>
>
>
>
>
>
>
>
>
> *From:* Ted Hardie <ted.ietf@gmail.com>
> *Sent:* Friday, October 8, 2021 11:29 AM
> *To:* Waltermire, David A. (Fed) <david.waltermire@nist.gov>
> *Cc:* iana@iana.org; uri-review@ietf.org; sacm@ietf.org
> *Subject:* Re: [Uri-review] swid and swidpath URI scheme registration
> request
>
>
>
> Hi David,
>
>
>
> My apologies, but I think I'm missing part of the scheme definition.  In
> Section 5.1, I see:
>
>
>
>
>
> For URIs that use the "swid" scheme, the scheme specific part MUST
>
>    consist of a referenced software tag's tag-id.  This tag-id MUST be
>
>    URI encoded according to [RFC3986] Section 2.1.
>
>
>
>    The following expression is a valid example:
>
>
>
>    swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c
>
>
>
> I would have typically expected an ABNF production for the tag-id.
> Instead, I see the following:
>
> tag-id (index 0): A 16 byte binary string or textual identifier
>
>       uniquely referencing a software component.  The tag identifier
>
>       MUST be globally unique.  If represented as a 16 byte binary
>
>       string, the identifier MUST be a valid universally unique
>
>       identifier as defined by [RFC4122].  There are no strict
>
>       guidelines on how this identifier is structured, but examples
>
>       include a 16 byte GUID (e.g. class 4 UUID) [RFC4122], or a text
>
>       string appended to a DNS domain name to ensure uniqueness across
>
>       organizations.
>
> Given the free-form nature of the text alternative, do I understand
> correctly you intend to percent encode any reserved character?  Is this
> still the case if the DNS domain name is an IDN?
>
>
>
> Since the text format subsumes the UUID format, is there a presumption
> that the equivalence rules for text are always preferred to the arithmetic
> equivalence rules that UUIDs may use?
>
> regards,
>
> Ted Hardie
>
>
>
>
>
>
>
> On Fri, Oct 8, 2021 at 3:18 PM Waltermire, David A. (Fed)
> <david.waltermire=40nist.gov@dmarc.ietf.org> wrote:
>
> This request is for the registrations of the "swid" and "swidpath" schemes
> defined in sections 6.6.1 and 6.6.2 of
> https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/
> <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-sacm-coswid%2F18%2F&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=UYeM%2BXa%2BnhIiI%2FSAtmcmpAbA4hRPbPACzEdkNbh%2F8qY%3D&reserved=0>
> .
>
>
>
> Please let us know if there are any questions or concerns.
>
>
>
> Regards,
>
> Dave Waltermire
>
>
>
>
>
> _______________________________________________
> Uri-review mailing list
> Uri-review@ietf.org
> https://www.ietf.org/mailman/listinfo/uri-review
> <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Furi-review&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AgSzdoVPSaUOj5EOpkc%2BrehZjTA9UlsfYXFgAUNd7gA%3D&reserved=0>
>
>