Enumeration Reference Format for the Incident Object Description Exchange Format (IODEF)
Extracted elements (15)
The Abbreviation field in the registry is constrained to uppercase ASCII (at least two characters) to avoid mismatches caused by case differences. The Designated Expert is also instructed to prefer short Abbreviations over long ones for usability.
The IODEF Reference class originally used a free-form ML_STRING for ReferenceName, making it impossible for implementers to determine what type of enumeration (CVE, CCE, CPE, etc.) was referenced or how to parse it. The solution adopted here is to require a specific structured format for ReferenceName and use an IANA registry to map specIndex values to enumeration specifications.
Although scoped to IODEF, the ReferenceName enumeration reference format is designed for reuse by any standard that needs to reference an enumeration identified by a specially formatted string. It provides a standardized interface allowing loose coupling between a standard and the enumeration identifiers it references.
This document does not update IODEF v1 (RFC 5070). The ReferenceName format is used in IODEF v2 and is applicable to other formats, but its use is not specified for IODEF v1.
All fields in the 'Security External Enumeration Registry' entry — Full Name, Abbreviation, SpecIndex, Version, and Specification URI/Reference — are mandatory; no field may be omitted.
Multiple registry entries MAY use the same Abbreviation but MUST have different Version values. This allows multiple versions of the same enumeration specification to coexist in the registry.
The Specification URI/Reference registered in the IANA registry MUST be readily and publicly available from the listed URI. The URI SHOULD be a stable reference to a specific version of the specification.
The specIndex attribute is REQUIRED and its value MUST correspond to an entry in the IANA 'Enumeration Reference Type Identifiers' registry with an identical SpecIndex value.
URIs that designate the latest version of a specification (which changes when a new version appears) SHOULD NOT be used as the Specification URI in the IANA registry, to ensure stable references.
While an enumeration format itself is unlikely to raise privacy concerns, combining an enumeration value with other data in an IODEF document (e.g., attack vectors or system descriptions in a privacy-related incident) could expose sensitive information. Implementers are referred to the IODEF Security Considerations for guidance on protecting documents in transit and at rest, recipient authentication, and use of IODEF's restriction attribute.
The ReferenceName class provides an XML representation for identifying an external enumeration and specifying a value from it. It has a required integer attribute 'specIndex' that uniquely identifies the enumeration specification via an IANA registry entry, and a child 'ID' element of type xs:NCName that holds the specific enumeration value.
This document creates the IANA 'Security External Enumeration Registry' (located at http://www.iana.org/assignments/sec-ext-enum) to manage external enumeration specifications. Each entry records: Full Name, Abbreviation (>=2 uppercase ASCII letters), IANA-assigned positive integer SpecIndex, Version, and one or more Specification URIs. Allocation policy is Specification Required with Expert Review by the MILE WG. The initial entry is CVE 1.0 with SpecIndex 1.
Correct mapping of enumeration reference ID elements to the corresponding SpecIndex is critical; incorrect mappings can result in inaccurate references and distribution of misinformation. Use of enumeration reference IDs from trusted sources is preferred to mitigate this risk.
Receiving an IODEF document containing an unknown ReferenceName (i.e., a SpecIndex that does not exist in the IANA table) may indicate a misled or malicious source. Recipients should treat unknown SpecIndex values with suspicion.
The ReferenceName XML element is defined in namespace 'urn:ietf:params:xml:ns:iodef-enum-1.0'. It contains a required sequence with a single 'ID' element (xs:NCName) and a required integer attribute 'specIndex'. The schema is provided in Section 5.