Adding some text to the deterministic ID description in section 2.9 of the STIX specification

As MITRE was incorporating deterministic ids into cti-python-stix2 API, the implementer came across the issue that I mentioned on one of the working calls.  That is â what if the contributing properties are
 all optional, and none of them are present in the object?  What should the ID be? 

 

The most obvious answer (to me) is that a UUIDv4 should be used in these cases.  However, no text exists in the specification to clarify this.  Iâm suggesting the following be added to section 2.9 as the fourth
 bullet point of the paragraph which begins âSTIX Cyber-observable Objects SHOULD use UUIDv5ââ

 

If the contributing properties are all optional, and none are present on the SCO, then a UUIDv4
SHOULD be used.

 

Bret and I discussed this, and even though it is a new normative statement, we feel that it is not really a substantive change.

 

This will be discussed on the next working call.

 

                Rich

-- 

Rich Piazza

The MITRE Corporation

781-271-3760