# GCVE BCP-04 drafting - Recommendations and best practices for ID allocation

**URL:** <https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119>\
**Category:** GCVE\
**Tags:** gcve\
**Created:** [August 21, 2025, 6:49am UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119 "2025-08-21T06:49:43Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 21, 2025, 6:49am UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/1 "2025-08-21T06:49:44Z")

</div>

Following various discussions about the `after prefix` part in GCVE, BCP-04 will include recommendations and best practices, especially for GNAs that do not have an ID generation and allocation process.

As mentioned in [issue #4 concerning the generic regular expression](https://github.com/gcve-eu/gcve.eu/issues/4), which allows a wide range of possibilities, we would like to define best practices to help GNAs create meaningful identifiers. The document should include good examples from different organizations already performing ID allocation, such as GitHub (GHSA), the CVE Program, and others.

- FAQ: [FAQ – GCVE - Global CVE Allocation System](https://gcve.eu/faq/#q5-what-is-the-format-of-a-gcve-identifier)
- Regular expression: [Regular expression for GCVE ID · Issue #4 · gcve-eu/gcve.eu · GitHub](https://github.com/gcve-eu/gcve.eu/issues/4)

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 25, 2025, 7:29am UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/2 "2025-08-25T07:29:11Z")

</div>

# BCP-04 Draft Preparation - Work-group session 25/08/2025 - Luxembourg

Following discussions in a standard work-group with the GCVE board regarding the recommended size of GCVE identifiers, it was agreed that no strict size limit will be enforced (similar to the flexibility of URIs). However, a recommendation is provided.

The recommendation is to use identifiers of up to **128 bytes including the prefix**.

Another discussion point in the work-group concerned the use of non–7-bit character sets. Some GNAs expressed interest in supporting UTF-8 characters in identifiers. While this would improve flexibility, it could also introduce significant overhead in software implementations that process GCVE identifiers.

To capture these decisions, **two sections will be added in BCP-04** :

- **ID Format** (including size considerations)
- **Encoding** (supported character sets and constraints)

Based on input from @ClausHoumann, GCVE identifiers are not limited to describing a newly disclosed vulnerability. They may also:

- extend the description of an existing vulnerability (e.g., with additional metadata),
- serve as a reference to a patch, or
- establish a parent/child relationship with another vulnerability.

The design of GCVE explicitly allows **multiple identifiers for the same vulnerability** to provide complementary information or alternative perspectives (e.g., in cases of vendor refusal or disagreement). There is no single authoritative identifier for a given vulnerability. Instead, GNAs may provide different viewpoints on similar vulnerabilities.

The model also allows a GNA to **reference another GCVE identifier issued by a different GNA** , covering scenarios such as parallel or independent vulnerability discoveries.

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 28, 2025, 4:37am UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/3 "2025-08-28T04:37:35Z")

</div>

A first draft version has been published: [GCVE-BCP-04 - Recommendations and Best Practices for ID Allocation – GCVE - Global CVE Allocation System](https://www.gcve.eu/bcp/gcve-bcp-04/)

If you want to make some updates [gcve.eu/content/bcp/gcve-bcp-04.md at main · gcve-eu/gcve.eu · GitHub](https://github.com/gcve-eu/gcve.eu/blob/main/content/bcp/gcve-bcp-04.md) or do a comment in this thread.

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 29, 2025, 9:54am UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/4 "2025-08-29T09:54:21Z")

</div>

New draft version 1.1 published including clarification about the identifier format.

> **[GCVE-BCP-04 - Recommendations and Best Practices for ID Allocation](https://gcve.eu/bcp/gcve-bcp-04/)**
>
> Recommendations and Best Practices for ID Allocation
> 
> Version: 1.1
> Status: Draft (for Public Review)
> Date: 2025-08-27
> Authors: GCVE Working Group
> BCP ID: BCP-04
> 
> This guide is distributed and available under CC-BY-4.0.
> Copyright (C) 2025 GCVE...

> **[gcve-bcp-04.pdf](https://gcve.eu/files/bcp/gcve-bcp-04.pdf)**
>
> 67.91 KB

---

<div class="post-metadata">

**Author:** ![todb](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/todb/32/207_2.png) [@todb](https://discourse.ossbase.org/u/todb)\
**Post date:** [August 29, 2025, 3:43pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/5 "2025-08-29T15:43:07Z")

</div>

Can we base the max length on some sensible technical limit for likely other protocols? I get the desire to limit to 128 bytes, but it seems a little arbitrary.

According to [this StackOverflow discussion](https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers) (first hit for “url max length”), the longest practical length for an HTTP URL (including domain, GET parameters) is about 2000 “characters.” So, let’s reduce “characters” to “bytes” (ignoring multibyte characters for now), and just know that 2000 bytes is a very hard ceiling for an entire URL that links to a GCVE record. It would be hard to defend a GCVE ID greater than 2000 bytes. And you’ll want a little wiggle room to handle those domains and GET parameters.

But also, 2000 is way bigger than 128, so I feel like a 128-byte limit seems pretty low.

The [DNS spec](https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4) defines a max length for names, so why not just borrow from that spec and make **255 the max length**.

It’s defensible, since it comes from a well-established standard, and any future encoding will fit comfortably in a one-byte unsigned length field (if you’re using signed lengths, seek counseling). Notably, a 255 byte maxlen doesn’t invalidate the extant example of a 146-byte identifier, which is very real and serious and has very important information encoded in it. 😉

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [August 29, 2025, 9:45pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/6 "2025-08-29T21:45:45Z")

</div>

You know how to get to me, the DNS specification 😀

The 255 byte could be also a valid max length. What’s your feeling @cedric about it? I see some use-case with `TXT` records too which are also limited to 255 characters. If there are no formal objection, we could extend those to 255 byte and update the BCP-04. I have a feeling this discussion might go down in history…

---

<div class="post-metadata">

**Author:** ![cedric](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/cedric/32/112_2.png) [@cedric](https://discourse.ossbase.org/u/cedric)\
**Post date:** [August 29, 2025, 10:11pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/7 "2025-08-29T22:11:29Z")

</div>

Let’s go for 255 byte maximum length !

---

<div class="post-metadata">

**Author:** ![todb](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/todb/32/207_2.png) [@todb](https://discourse.ossbase.org/u/todb)\
**Post date:** [August 30, 2025, 6:59pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/8 "2025-08-30T18:59:27Z")

</div>

Oh heck yeah. I love a good `TXT` record.

---

<div class="post-metadata">

**Author:** ![claudex](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/claudex/32/227_2.png) [@claudex](https://discourse.ossbase.org/u/claudex)\
**Post date:** [September 16, 2025, 3:22pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/9 "2025-09-16T15:22:46Z")

</div>

I’m not sure the number of byte should be specified as the encoding is not (and I don’t think it’s relevant to specify it in this context). Moreover, since there is a reference of 7 bits character, it’s not obvious if we are talking about 255 characters or 291 characters (with a 7 bits encoding).  
So, it would be better to s/byte/character/ in the document

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [September 16, 2025, 8:17pm UTC](https://discourse.ossbase.org/t/gcve-bcp-04-drafting-recommendations-and-best-practices-for-id-allocation/119/10 "2025-09-16T20:17:35Z")

</div>

Fair point. Would you mind to do a PR on BCP-04?