Subject: [Cbor] An Information-based CBOR schema language?

From: David Kemp <[email-masked]>
Date: Wed, 21 Aug 2019 10:19:45 -0400

CBOR-bis describes the need to specify document content without needing the
specification to parse the document:

  "Of course, in real-world implementations, the encoder and the decoder
   will have a shared view of what should be in a CBOR data item.  For
   example, an agreed-to format might be "the item is an array whose
   first value is a UTF-8 string, second value is an integer, and
   subsequent values are zero or more floating-point numbers" or "the
   item is a map that has byte strings for keys and contains at least
   one pair whose key is 0xab01".

CDDL is a schema language for CBOR.   JADN (JSON Abstract Data Notation) is
another.  JADN differs from CDDL in that it:
  1) Specifies an Information Model rather than a Data Model (RFC 3444), and
  2) Is itself structured data (JSON or CBOR) rather than text that
requires parsing

JADN was created as the schema language for the OpenC2 security automation
protocol (
https://www.csoonline.com/article/3386161/openc2-can-accelerate-security-operations-automation-and-orchestration.html),
but there is now a need to separate the schema language from any particular
application protocol.   There is currently a draft in OASIS format (
https://github.com/oasis-tcs/openc2-jadn/blob/working/jadn-v1.0-wd01.md),
but it seems possible that the IETF is a more appropriate venue to develop
an Information Model standard.

This message is to gauge interest in creating a JADN Internet Draft and to
either initiate a BOF or adopt the draft as a work product of an existing
WG.  If you are interested in working on such a spec, or have suggestions
for where it should be worked, please let me know.

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 21 Aug 2019 16:49:52 +0200

Hi David,

I cannot answer your question on the level of interest in doing work on another data description language, but I want to quickly address two statements in your email:

> On Aug 21, 2019, at 16:19, David Kemp <[email-masked]> wrote:
> 
> CDDL is a schema language for CBOR.   JADN (JSON Abstract Data Notation) is another.  JADN differs from CDDL in that it:

The prose around JADN says so, but then goes ahead and does approximately what CDDL does (actually it appears to me that in some places it is even more concerned with serialization issues than CDDL is).

Since the boundary between information and data models is not strict (and, indeed, one may want to make several refinement steps on the way from a conceptual model to a data model that directly binds to a serialization scheme), this is not very surprising.

As one data point, I would like to point out that CDDL is very much in use as an information modeling language; this can be mostly done by stopping short of giving a specific mapping to JSON or CBOR constructs (or by using container/composition abstractions that only have default mappings, which enables the information model to be “executable”, without actually tying down the serialization mappings of those abstractions).

JADN does address one point CDDL doesn’t do very well yet: Having a single model that maps to both idiomatic JSON and concise CBOR.  I believe that the next version of CDDL will need to provide more functionality for this, as well.

>   2) Is itself structured data (JSON or CBOR) rather than text that requires parsing

Please see https://tools.ietf.org/html/draft-bormann-cbor-cddl-freezer-02#section-8 for why this may not be a distinction for much longer.  Actually, JADN also defines a human notation (JADN-IDL), and I applaud you for this decision.  (I don’t know why humans, outside of debugging, should ever need to see the JSON formats of either JADN or CDDL.)

In summary, I do believe that JADN is an interesting development that we as a WG should take note of.

Grüße, Carsten

---

From: David Kemp <[email-masked]>
Date: Wed, 21 Aug 2019 12:57:19 -0400

> Hi Carsten,

Thank you for the information and kind words; I look forward to learning
about cddl-freezer.  A script to translate JADN to JSON Schema is
surprisingly brief, about 300 lines of Python, because JSON Schema is
JSON.  I shied away from doing the same for CDDL because of the many
inconveniences of working with text, but using freezer format should make
the job much easier.

> Since the boundary between information and data models is not strict ...

Unfortunately the English language is ambiguous and easily overloaded.
Fortunately Shannon provides a more rigorous definition of information than
Webster:

"My greatest concern was what to call it. I thought of calling it
> 'information,' but the word was overly used, so I decided to call it
> 'uncertainty.' When I discussed it with John von Neumann, he had a better
> idea. Von Neumann told me, 'You should call it entropy, for two reasons. In
> the first place your uncertainty function has been used in statistical
> mechanics under that name, so it already has a name. In the second place,
> and more important, no one really knows what entropy really is, so in a
> debate you will always have the advantage.'"

There may be a large gray area between information models and data models,
but there is a sharp dividing line between information and data: RFC 791
defines the information in an IPv4 address - a network with 2^32
addressable hosts can be addressed using no more than 32 bits of
information regardless of how many bits of data are used for that purpose.
JADN is more than an "Information Model" language in Webster's sense, it is
a "Model of Information" language in the Shannon sense.   I believe
modeling Shannon information is the critical key to addressing:

>  Having a single model that maps to both idiomatic JSON and concise
CBOR.

Respectfully,
Dave