Subject: [Insipid] MUST or SHOULD for Type 4 / 5 UUIDs?

From: Paul Giralt <[email-masked]>
Date: Thu, 2 Jun 2016 00:00:24 -0400

INSIPID WG, 

Ben pointed out that we have an inconsistency in the draft. Section 4 states that endpoints SHOULD use Type 4 or Type 5 UUIDs when generating a Session Identifier, however Section 12 states that Type 4 or 5 MUST be used for privacy reasons. 

I’m inclined to change the first to MUST and thereby require that only Type 4 or Type 5 UUID’s be used. 

Does anyone have an issue with this change? 

-Paul

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 2 Jun 2016 07:01:09 +0000

Hi,

Is there a reason we put SHOULD in section 4? Backward compatibility?

Regards,

Christer

On 02/06/16 07:00, "insipid on behalf of Paul Giralt"
<[email-masked] on behalf of [email-masked]> wrote:

>INSIPID WG, 
>
>Ben pointed out that we have an inconsistency in the draft. Section 4
>states that endpoints SHOULD use Type 4 or Type 5 UUIDs when generating a
>Session Identifier, however Section 12 states that Type 4 or 5 MUST be
>used for privacy reasons.
>
>I¹m inclined to change the first to MUST and thereby require that only
>Type 4 or Type 5 UUID¹s be used.
>
>_______________________________________________
>insipid mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/insipid

---

From: "Paul Giralt (pgiralt)" <[email-masked]>
Date: Thu, 2 Jun 2016 11:01:03 +0000

I don’t see how having a MUST causes a backward compatibility issue. At the end of the day, a UUID is just a string of 32 characters and as long as that criteria is met, it really doesn’t matter how the string was generated. Any device following this draft would generate a Type 4 or 5 UUID and a pre-standard device might generate it in some other way and everything will work fine. We are specifically addressing how a behavior implementing this draft generates a UUID. An endpoint could end up using a non Type 4/5 UUID as a remote-uuid when interoperating with a pre-standard device, but the device following the standard is not generating the UUID in that case, so it is not violating the MUST clause in that case.

-Paul

> On Jun 2, 2016, at 3:01 AM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
>