Sharing Groups

- addresses parts of oasis-tcs#705
- adapt prose to reflect sharing group changes
- add RFC 9562 to normative references
- add RFC 4122 to informative references

csaf_2.1/prose/edit/src/introduction-03-normative-references.md

@@ -29,3 +29,6 @@ RFC8174
 
 RFC8259
 :    T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, <https://www.rfc-editor.org/info/rfc8259>.
+
+RFC9562
+:    Davis, K., Peabody, B., and P. Leach, "Universally Unique IDentifiers (UUIDs)", RFC 9562, DOI 10.17487/RFC9562, May 2024, <https://www.rfc-editor.org/info/rfc9562>.

csaf_2.1/prose/edit/src/introduction-04-informative-references.md

@@ -69,6 +69,9 @@ RFC3552
 RFC3986
 :    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>.
 
+RFC4122
+:    Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005, <https://www.rfc-editor.org/info/rfc4122>.
+
 RFC4880
 :    Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, <https://www.rfc-editor.org/info/rfc4880>.
 

csaf_2.1/prose/edit/src/schema-elements-02-props-02-document.md

@@ -136,12 +136,15 @@ The single valid value for this `enum` is:
 #### Document Property - Distribution
 
 Rules for sharing document (`distribution`) of value type `object` with the mandatory property Traffic Light Protocol (TLP) (`tlp`) and the
-optional property Text (`text`) describes any constraints on how this document might be shared.
+optional properties Sharing Group (`Sharing Group`) and Text (`text`) describes any constraints on how this document might be shared.
 
 ```
     "distribution": {
       // ...
       "properties": {
+        "sharing_group": {
+          // ...
+        },
         "text": {
           // ...
         },
@@ -152,7 +155,76 @@ optional property Text (`text`) describes any constraints on how this document m
     },
 ```
 
-If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+If multiple values are present, the TLP information SHOULD be preferred as this aids in automation.
+The Sharing Group SHALL be interpreted as specification to the TLP information.
+Therefore, the Sharing Group MAY also be used to convey special TLP restrictions:
+
+*Examples 1:*
+
+```
+    Only releasable to European Energy sector
+    E-ISAC members-only
+    Releasable to NATO countries
+```
+
+> Note that for such restrictions the Sharing Group Name MUST exist and all participants MUST know the associated Sharing Group IDs to allow for automation.
+
+##### Document Property - Distribution - Sharing Group
+
+Sharing Group (`sharing_group`) of value type `object` with the mandatory property Sharing Group ID (`id`) and
+the optional property Sharing Group Name (`name`) contains information about the group this document is intended to be shared with.
+
+```
+        "sharing_group": {
+          // ...
+          "properties": {
+            "id": {
+              // ...
+            },
+            "name": {
+              // ...
+            }
+          }
+        },
+```
+
+Sharing Group ID (`id`) of value type `string` with format `uuid` and `pattern` (regular expression):
+
+```
+    ^(([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12})|([0]{8}-([0]{4}-){3}[0]{12})|([f]{8}-([f]{4}-){3}[f]{12}))$
+```
+
+Sharing Group ID provides the unique ID for the sharing group.
+This ID is intended to be globally unique and MAY also be used by different issuing parties to share CSAF data within a closed group,
+e.g. during a Multi-Party Coordinated Vulnerability Disclosure case.
+
+> Note, that participants in such cases usually differ. Therefore, it is advised to use one ID per case.
+> Otherwise, the consequences of adding or removing parties from a case and the implications to other cases have to be considered.
+
+The ID SHOULD NOT change throughout different CSAF documents, if the same sharing group is addressed.
+It MUST differ if a different sharing group is addressed.
+
+The ID SHALL be valid according to [cite](#RFC9562) and recorded in the 8-4-4-4-12 notation in lower case.
+The ID SHALL be a UUID Version 4 for any closed sharing group, i.e. `TLP:GREEN` and above.
+
+The following ID values SHOULD NOT be used unless there are technical reasons for them.
+Therefore, they are reserved for implementation-specific situations:
+
+- A system MAY use the Max UUID for `TLP:CLEAR` CSAF documents.
+  > For example, the system uses the UUID as an indication whether a user allowed to see the document.
+  > The security considerations from [cite](#RFC9562) should be reflected on.
+- A system MAY use the Nil UUID for CSAF documents that MUST NOT be shared.
+  > For example, the CSAF document is just being drafted and the accidental leakage should be prevented.
+
+> Note, that both values do not indicate a closed sharing group.
+
+A CSAF document with `TLP:CLEAR` SHOULD NOT contain a sharing group value and SHALL NOT contain any other value for the Sharing Group ID than Max UUID (`ffffffff-ffff-ffff-ffff-ffffffffffff`).
+
+Sharing Group Name (`name`) of value type `string` with one or more characters contains a human-readable name for the sharing group.
+
+The Sharing Group Name is optional and can be chosen freely by the entity establishing the sharing group.
+For the Max UUID, the value of `name` SHALL exist and be `Public`.
+For the Nil UUID, the value of `name` SHALL exist and be `No Sharing allowed`.
 
 ##### Document Property - Distribution - Text