Subject: Re: [calsify] UID value

From: Cyrus Daboo <[email-masked]>
Date: Wed, 10 Aug 2016 11:21:51 -0400

Hi folks,
Sorry, I got tied up with other things and did not follow up on the UID 
format discussion. Below are the full set of changes I am proposing to 
address this issue (with modifications based on earlier list discussion).

---
Added to the end of section "5.3.  UID Property":

   The description of the "UID" property in [RFC5545] contains some
   recommendations on how the value can be constructed.  In particular,
   it suggests use of host names, IP addresses, and domain names to
   construct the value.  However, this is no longer considered good
   practice, particularly from a security and privacy standpoint, since
   use of such values can leak key information about a calendar user, or
   their client and network environment.  This specification updates
   [RFC5545] by stating that "UID" values MUST NOT include any data that
   might identify a user, host, domain, or any other security or privacy
   sensitive information.  It is RECOMMENDED that calendar user agents
   now generate "UID" values that are hex-encoded random UUID values as
   defined in Sections 4.4 and 4.5 of [RFC4122].

   The following is an example of such a property value:

   UID:5FC53010-1267-4F8E-BC28-1D7AE55A7C99

   Additionally, if calendar user agents choose to use other forms of
   opaque identifiers for the "UID" value, they MUST have a length less
   than 255 octets, and MUST conform to the "iana-token" ABNF syntax
   defined in Section 3.1 of [RFC5545].
---
Added to the end of "7.  Security Considerations":

   This specification changes the recommendations on how "UID" property
   values are constructed to minimize leaking any information that might
   be security sensitive.
---
Added to the end of "8.  Privacy Considerations":

   This specification changes the recommendations on how "UID" property
   values are constructed to minimize leaking any information that might
   be privacy sensitive.
---

-- 
Cyrus Daboo

---

From: Michael Douglass <[email-masked]>
Date: Wed, 17 Aug 2016 11:17:29 -0400

I'm fine with these changes

---

From: Ken Murchison <[email-masked]>
Date: Wed, 17 Aug 2016 11:22:08 -0400

Looks good to me.

On 08/10/2016 11:21 AM, Cyrus Daboo wrote:
> Hi folks,
> Sorry, I got tied up with other things and did not follow up on the 
> UID format discussion. Below are the full set of changes I am 
> proposing to address this issue (with modifications based on earlier 
> list discussion).
>
> ---

-- 
Kenneth Murchison
Principal Systems Software Engineer
Carnegie Mellon University