From 60a460be7fcce4e8fc272119c234b48363971668 Mon Sep 17 00:00:00 2001 From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com> Date: Mon, 18 Nov 2024 11:08:22 +0100 Subject: [PATCH] Sharing Groups - addresses parts of oasis-tcs/csaf#705 - adapt prose to reflect sharing group changes - add RFC 9562 to normative references - add RFC 4122 to informative references --- .../introduction-03-normative-references.md | 3 + .../introduction-04-informative-references.md | 3 + .../schema-elements-02-props-02-document.md | 76 ++++++++++++++++++- 3 files changed, 80 insertions(+), 2 deletions(-) diff --git a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md index ea6e9114..d90250db 100644 --- a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md +++ b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md @@ -29,3 +29,6 @@ RFC8174 RFC8259 : T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, . + +RFC9562 +: Davis, K., Peabody, B., and P. Leach, "Universally Unique IDentifiers (UUIDs)", RFC 9562, DOI 10.17487/RFC9562, May 2024, . diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md index 7794ee2f..a13b34f0 100644 --- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md +++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md @@ -69,6 +69,9 @@ RFC3552 RFC3986 : Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, . +RFC4122 +: Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005, . + RFC4880 : Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, . diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-02-document.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-02-document.md index b271922b..00daba80 100644 --- a/csaf_2.1/prose/edit/src/schema-elements-02-props-02-document.md +++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-02-document.md @@ -136,12 +136,15 @@ The single valid value for this `enum` is: #### Document Property - Distribution Rules for sharing document (`distribution`) of value type `object` with the mandatory property Traffic Light Protocol (TLP) (`tlp`) and the -optional property Text (`text`) describes any constraints on how this document might be shared. +optional properties Sharing Group (`Sharing Group`) and Text (`text`) describes any constraints on how this document might be shared. ``` "distribution": { // ... "properties": { + "sharing_group": { + // ... + }, "text": { // ... }, @@ -152,7 +155,76 @@ optional property Text (`text`) describes any constraints on how this document m }, ``` -If both values are present, the TLP information SHOULD be preferred as this aids in automation. +If multiple values are present, the TLP information SHOULD be preferred as this aids in automation. +The Sharing Group SHALL be interpreted as specification to the TLP information. +Therefore, the Sharing Group MAY also be used to convey special TLP restrictions: + +*Examples 1:* + +``` + Only releasable to European Energy sector + E-ISAC members-only + Releasable to NATO countries +``` + +> Note that for such restrictions the Sharing Group Name MUST exist and all participants MUST know the associated Sharing Group IDs to allow for automation. + +##### Document Property - Distribution - Sharing Group + +Sharing Group (`sharing_group`) of value type `object` with the mandatory property Sharing Group ID (`id`) and +the optional property Sharing Group Name (`name`) contains information about the group this document is intended to be shared with. + +``` + "sharing_group": { + // ... + "properties": { + "id": { + // ... + }, + "name": { + // ... + } + } + }, +``` + +Sharing Group ID (`id`) of value type `string` with format `uuid` and `pattern` (regular expression): + +``` + ^(([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12})|([0]{8}-([0]{4}-){3}[0]{12})|([f]{8}-([f]{4}-){3}[f]{12}))$ +``` + +Sharing Group ID provides the unique ID for the sharing group. +This ID is intended to be globally unique and MAY also be used by different issuing parties to share CSAF data within a closed group, +e.g. during a Multi-Party Coordinated Vulnerability Disclosure case. + +> Note, that participants in such cases usually differ. Therefore, it is advised to use one ID per case. +> Otherwise, the consequences of adding or removing parties from a case and the implications to other cases have to be considered. + +The ID SHOULD NOT change throughout different CSAF documents, if the same sharing group is addressed. +It MUST differ if a different sharing group is addressed. + +The ID SHALL be valid according to [cite](#RFC9562) and recorded in the 8-4-4-4-12 notation in lower case. +The ID SHALL be a UUID Version 4 for any closed sharing group, i.e. `TLP:GREEN` and above. + +The following ID values SHOULD NOT be used unless there are technical reasons for them. +Therefore, they are reserved for implementation-specific situations: + +- A system MAY use the Max UUID for `TLP:CLEAR` CSAF documents. + > For example, the system uses the UUID as an indication whether a user allowed to see the document. + > The security considerations from [cite](#RFC9562) should be reflected on. +- A system MAY use the Nil UUID for CSAF documents that MUST NOT be shared. + > For example, the CSAF document is just being drafted and the accidental leakage should be prevented. + +> Note, that both values do not indicate a closed sharing group. + +A CSAF document with `TLP:CLEAR` SHOULD NOT contain a sharing group value and SHALL NOT contain any other value for the Sharing Group ID than Max UUID (`ffffffff-ffff-ffff-ffff-ffffffffffff`). + +Sharing Group Name (`name`) of value type `string` with one or more characters contains a human-readable name for the sharing group. + +The Sharing Group Name is optional and can be chosen freely by the entity establishing the sharing group. +For the Max UUID, the value of `name` SHALL exist and be `Public`. +For the Nil UUID, the value of `name` SHALL exist and be `No Sharing allowed`. ##### Document Property - Distribution - Text