Subject: [mile] I-D Action: draft-ietf-mile-enum-reference-format-13.txt

From: [email-masked]
Date: Wed, 14 Jan 2015 12:32:54 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF.

        Title           : IODEF Enumeration Reference Format
        Authors         : Adam W. Montville
                          David Black
	Filename        : draft-ietf-mile-enum-reference-format-13.txt
	Pages           : 10
	Date            : 2015-01-14

Abstract:
   The Incident Object Description Exchange Format (IODEF) is an XML
   data representation framework for sharing information about computer
   security incidents.  In IODEF, the Reference class provides
   references to externally specified information such as a
   vulnerability, Intrusion Detection System (IDS) alert, malware
   sample, advisory, or attack technique.  In practice, these references
   are based on external enumeration specifications that define both the
   enumeration format and the specific enumeration values, but the IODEF
   Reference class (as specified in IODEF v1 in RFC 5070) does not
   indicate how to include both of these important pieces of
   information.

   This document establishes a stand-alone data format to include both
   the external specification and specific enumeration identification
   value, and establishes an IANA registry to manage external
   enumeration specifications.  While this document does not update
   IODEF v1, this enumeration reference format is used in IODEF v2 and
   is applicable to other formats that support this class of enumeration
   references.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-mile-enum-reference-format-13

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-mile-enum-reference-format-13

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 27 Jan 2015 17:25:03 -0500

I'm not sure why my message below and this thread has not been going
to mile as the tools address looks like it should have.  Anyway, MILE
is copied directly now.  Apologies if you get this twice.

On Tue, Jan 27, 2015 at 3:29 PM, Kathleen Moriarty
<[email-masked]> wrote:
> Hello,
>
> I am doing a final check on the draft before progressing the draft.  I
> was waiting on the shepherd review, sorry for the delay.
>
> 1. Barry had commented on the following text and I don't think the
> updated follows his guidance:
>
> <entity> use third parties for which there is a trust relationship <that meets
> these criteria>.
>
> Me: Since there is no criteria, why should someone trust the third party?
>
>       "In some cases it might be possible for a third-party to host
>       content associated with an enumeration reference ID.  In such a
>       circumstance, trust extends from the origin of the enumeration
>       reference ID to the third-party, effectively making the third-
>       party a trusted third-party in the context of providing a
>       particular set of enumeration reference IDs."
>
> I think this could be an issue and don't think this paragraph is
> needed as enough is said in the previous paragraph.  This is basically
> saying that third party sites that expand out information on
> enumeration IDs should be trusted, but doesn't tell you why or how to
> know when to trust particular third party sites.  I don't think this
> is helpful and could be detrimental if someone blindly trusts a third
> party that uses enum reference numbers.  I think it is safer to leave
> it up to the user of the enum reference number information to figure
> out what data sources they should trust.
>
>
> 2. From Stephen's comments:
> Thank you for adding in the registry entry, that looks good and the
> NVD is a good choice.  Before we push this forward, should one more be
> added, perhaps the CVE enum database for Japan or another country?  I
> think I asked this during the holidays, so if a quick answer adds
> this, I think it would be worthwhile.
>
> We can give a day or so on this one to see if a response comes in on
> this since it's been asked before.
>
> 3. IANA related review:
> Thanks for updating the example, this looks better and may help avoid confusion.
>
>
> 4. One final note, I don't see any Acknowledgements, were any
> contributions worthy of noting the person's effort?
>
> Thank you.
>
> On Wed, Jan 21, 2015 at 9:11 AM, Waltermire, David A.
> <[email-masked]> wrote:
>> I'll give this a review tomorrow and let you know if I have any comments.
>>
>> Thanks,
>> Dave
>>
>> -----Original Message-----
>> From: Kathleen Moriarty [mailto:[email-masked]]
>> Sent: Tuesday, January 20, 2015 1:36 PM
>> To: Waltermire, David A.
>> Cc: [email-masked]
>> Subject: Re: [mile] I-D Action: draft-ietf-mile-enum-reference-format-13.txt
>>
>> Dave,
>>
>> Do you know when you will have a chance to look at this?  I'll do another check to see comments were addressed after getting your okay.
>>
>> Thanks,
>> Kathleen
>>
>> On Fri, Jan 16, 2015 at 3:17 PM, Kathleen Moriarty <[email-masked]> wrote:
>>> Hi David,
>>>
>>> Let me know what you think from your shepherd review.  Once I have
>>> that, I'll take another look through the comments and draft before
>>> progressing it.
>>>
>>> Thanks.
>>>
>>>
>>> ---------- Forwarded message ----------
>>> From:  <[email-masked]>
>>> Date: Wed, Jan 14, 2015 at 3:32 PM
>>> Subject: [mile] I-D Action:
>>> draft-ietf-mile-enum-reference-format-13.txt
>>> To: [email-masked]
>>> Cc: [email-masked]
>>>
>>>
>>>
>>> Please note that it may take a couple of minutes from the time of
>>> submission until the htmlized version and diff are available at tools.ietf.org.
>>>
>>> _______________________________________________
>>> mile mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/mile
>>>
>>>
>>> --
>>>
>>> Best regards,
>>> Kathleen
>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>
>
>
> --
>
> Best regards,
> Kathleen

-- 

Best regards,
Kathleen

---

From: "Black, David" <[email-masked]>
Date: Wed, 28 Jan 2015 20:54:01 +0000

Picking up the rest of the thread w/Adam’s comments (Adam>), including the mile list, and adding a few of my own (David>).

Thanks,
--David

From: Adam W. Montville [mailto:[email-masked]]
Sent: Wednesday, January 28, 2015 9:40 AM
To: Kathleen Moriarty
Cc: Dave Waltermire; [email-masked]
Subject: Re: [mile] I-D Action: draft-ietf-mile-enum-reference-format-13.txt

On Jan 27, 2015, at 2:29 PM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:

Hello,

Adam> It sounds like your recommendation is to strike that paragraph.  I have no issue with that.  The intent of that paragraph was to let the reader know that they have a trust decision to make, not that the third party would be trusted.  Saying “trust extends” doesn’t necessarily mean they’re trusted, it means there’s some level of trust relationship that exists, the quality of which may vary.  I agree that the paragraph can be misinterpreted.

David> +1 on deleting the paragraph.

Adam> I hadn’t yet heard from Take before it came time to publish the update, which is one reason this information was not included.  When I did hear from Take, he provided as sample link to JVN (http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000009.html; there is an English version also: http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000009.html).  We could conceivably link to somewhere at jvndb.jvn.jp<http://jvndb.jvn.jp>.  However, Take also noted that the schema has not been made public.

Adam> There is an instructional page that touches on the subject of IDs, but doesn’t really go into format specifics: https://jvn.jp/en/nav/jvnhelp.html.

Adam> The question is, if we include JVN as an initial registry entry, then which URL do we use for the Spec/Reference URI?

David> I’ll leave this to Adam to work out w/Take.  An alternative is to register JVN as the first use of the registration process for the new registry; the ID format appears to be publicly available (i.e., I can figure out what to expect from that help page) - Adam’s question on Spec/Reference URI still applies.

3. IANA related review:

David> And thanks for finding that subtle mismatch.  It was obvious that it needed to be fixed once it was pointed out ;-).

4. One final note, I don't see any Acknowledgements, were any contributions worthy of noting the person's effort?

Adam> The WG at large for providing feedback along the way.  There were a couple of useful suggestions early on, but I don’t recall the “who”.  David Black might have some thoughts here.

David>  We should definitely thank Roman, as the fact that this is its own schema is largely due to his input.  I would also thank Kathleen, as (after the paragraph in item 1 is deleted), about half of the security considerations section will be the result of her input.

Thank you.

On Wed, Jan 21, 2015 at 9:11 AM, Waltermire, David A.
<[email-masked]<mailto:[email-masked]>> wrote:

Thanks,
Dave

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]]
Sent: Tuesday, January 20, 2015 1:36 PM
To: Waltermire, David A.
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [mile] I-D Action: draft-ietf-mile-enum-reference-format-13.txt

Dave,

Thanks,
Kathleen

On Fri, Jan 16, 2015 at 3:17 PM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:

Hi David,

Thanks.

---------- Forwarded message ----------
From:  <[email-masked]<mailto:[email-masked]>>
Date: Wed, Jan 14, 2015 at 3:32 PM
Subject: [mile] I-D Action:
draft-ietf-mile-enum-reference-format-13.txt
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight
Exchange Working Group of the IETF.

Abstract:

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format
/

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-mile-enum-reference-format
-13

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile

--

Best regards,
Kathleen

--

Best regards,
Kathleen

--

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 28 Jan 2015 17:12:45 -0500

Hi Adam & David,

Thanks for the quick responses.  As an FYI, I'll be offline a bit
tomorrow and a bunch through the weekend.  Once the changes are ready,
I will be able to push this through quickly though, so it may not have
to wait until Monday.

inline

On Wed, Jan 28, 2015 at 3:54 PM, Black, David <[email-masked]> wrote:
> Picking up the rest of the thread w/Adam’s comments (Adam>), including the
> mile list, and adding a few of my own (David>).
>
>
>
> Thanks,
> --David
>
>
>
> Cc: Dave Waltermire;
> [email-masked]
> On Jan 27, 2015, at 2:29 PM, Kathleen Moriarty
> <[email-masked]> wrote:
>
>
>
> Hello,
>
> Adam> It sounds like your recommendation is to strike that paragraph.  I
> have no issue with that.  The intent of that paragraph was to let the reader
> know that they have a trust decision to make, not that the third party would
> be trusted.  Saying “trust extends” doesn’t necessarily mean they’re
> trusted, it means there’s some level of trust relationship that exists, the
> quality of which may vary.  I agree that the paragraph can be
> misinterpreted.
>
>
>

Glad you both agree, I could make this request in an RFC editor note,
but since it's easy enough to update, that may be best as you'll need
to provide the XML version of the draft before the editor starts their
work on the draft anyway.

> Adam> I hadn’t yet heard from Take before it came time to publish the
> update, which is one reason this information was not included.  When I did
> hear from Take, he provided as sample link to JVN
> (http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000009.html; there is an
> English version also:
> http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000009.html).  We could
> conceivably link to somewhere at jvndb.jvn.jp.  However, Take also noted
> that the schema has not been made public.

OK, I didn't realize that they didn't use the CVE format.
>
>
>
> Adam> There is an instructional page that touches on the subject of IDs, but
> doesn’t really go into format specifics: https://jvn.jp/en/nav/jvnhelp.html.
>
>
>
> Adam> The question is, if we include JVN as an initial registry entry, then
> which URL do we use for the Spec/Reference URI?

Good question.
>
>
> David> I’ll leave this to Adam to work out w/Take.  An alternative is to
> register JVN as the first use of the registration process for the new
> registry; the ID format appears to be publicly available (i.e., I can figure
> out what to expect from that help page) - Adam’s question on Spec/Reference
> URI still applies.

OK, Take, would you want to test the process out once a format is published?
Anyone else is welcome to and encouraged as well once this is set up.

> David> And thanks for finding that subtle mismatch.  It was obvious that it
> needed to be fixed once it was pointed out ;-).

No problem.
> Adam> The WG at large for providing feedback along the way.  There were a
> couple of useful suggestions early on, but I don’t recall the “who”.  David
> Black might have some thoughts here.
>
>
> David>  We should definitely thank Roman, as the fact that this is its own
> schema is largely due to his input.  I would also thank Kathleen, as (after
> the paragraph in item 1 is deleted), about half of the security
> considerations section will be the result of her input.

It might be good to look through archives quickly to see if the
shepherd, Take, or other regular contributors helped.

Thank you & I'll look out for the update.
Kathleen

> Do you know when you will have a chance to look at this?  I'll do another
> check to see comments were addressed after getting your okay.
>
> Thanks,
> Kathleen
>
> On Fri, Jan 16, 2015 at 3:17 PM, Kathleen Moriarty

-- 

Best regards,
Kathleen

---

From: "Adam W. Montville" <[email-masked]>
Date: Thu, 29 Jan 2015 08:49:15 -0600

> On Jan 28, 2015, at 4:12 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
>> [snip]

I can make this change.  The XML bit is interesting to me.  I started this draft in nroff and there it remains.  I’m not aware of any tool or convenient way to convert from nroff to XML format, and have been under the impression that the RFC Editor produces the XML.  Can you (or someone else) verify that the Editor does not provide the XML?

> [snip]

Ok, we can do this.  

David, thanks for reminding me about Roman’s significant contributions!

Roman, sorry I forgot.

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 29 Jan 2015 10:28:54 -0500

Sent from my iPhone

> On Jan 29, 2015, at 9:49 AM, "Adam W. Montville" <[email-masked]> wrote:
> 
> 

Txt is still the canonical format, I believe it hasn't switched yet.  I think you'll be able to just provide the txt version, but they prefer XML if they can get it.  You should be okay.
> David, thanks for reminding me about Roman’s significant contributions!

Thanks for taking care of this!
Kathleen

---

From: Eric Burger <[email-masked]>
Date: Thu, 29 Jan 2015 11:25:17 -0500

The RFC editor’s preference is for XML (XML2RFC <http://xml.resource.org/>). However, if there is nroff available, that would be preferred to raw text.

> On Jan 29, 2015, at 10:28 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> 
> Sent from my iPhone
> 
> On Jan 29, 2015, at 9:49 AM, "Adam W. Montville" <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> 
>>> On Jan 28, 2015, at 4:12 PM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>>> [snip]
>>>> <[email-masked] <mailto:[email-masked]>> wrote:
>>>> 
>>>> From: Kathleen Moriarty [mailto:[email-masked] <mailto:[email-masked]>]
>>>> Cc: [email-masked] <mailto:[email-masked]>
>>>> <[email-masked] <mailto:[email-masked]>> wrote:
>>>> 
>>>> Hi David,
>>>> 
>>>> From:  <[email-masked] <mailto:[email-masked]>>
>>>> To: [email-masked] <mailto:[email-masked]>
>>>> Cc: [email-masked] <mailto:[email-masked]>
>>>> 
>>>> 
>>>> 
>>>> https://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format <https://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format>
>>>> /
>>>> 
>>>> http://tools.ietf.org/html/draft-ietf-mile-enum-reference-format-13 <http://tools.ietf.org/html/draft-ietf-mile-enum-reference-format-13>
>>>> 
>>>> http://www.ietf.org/rfcdiff?url2=draft-ietf-mile-enum-reference-format <http://www.ietf.org/rfcdiff?url2=draft-ietf-mile-enum-reference-format>
>>>> -13
>>>> 
>>>> 
>>>> submission until the htmlized version and diff are available at
>>>> tools.ietf.org <http://tools.ietf.org/>.
>>>> 
>>>> ftp://ftp.ietf.org/internet-drafts/ <ftp://ftp.ietf.org/internet-drafts/>
>>>> 
>>>> [email-masked] <mailto:[email-masked]>
>>>> https://www.ietf.org/mailman/listinfo/mile <https://www.ietf.org/mailman/listinfo/mile>
>>>> 
>>>> 
>>>> --
>>>> 
>>>> Best regards,
>>>> Kathleen
>>>> 
>>>> 
>>>> 
>>>> 
>>>> --
>>>> 
>>>> Best regards,
>>>> Kathleen
>>>> 
>>>> 
>>>> 
>>>> 
>>>> --
>>>> 
>>>> Best regards,
>>>> Kathleen
>>>> 
>>>> 
>>> 
>>> 
>>> 
>>> --
>>> 
>>> Best regards,
>>> Kathleen
>>

---

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 30 Jan 2015 07:57:52 -0600

I just updated the draft.  Added acknowledgments, removed a security considerations paragraph.

http://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format/ <http://datatracker.ietf.org/doc/draft-ietf-mile-enum-reference-format/>

> On Jan 29, 2015, at 9:28 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> 
> Sent from my iPhone
>