Also Mention UUID version 8

[gregweb]

Current

Under section "9.2. testId" the spec says:

A producer MAY use a canonical string directly, or MAY encode that canonical string as a deterministic identifier such as a UUID version 5 or hash.

Proposed Change

A producer MAY use a canonical string directly, or MAY encode that canonical string as a deterministic identifier such as a UUID version 5, UUID version 8 or hash."

Rationale

According to RFC 9562 UUIDv5 must be built from SHA-1. When basing the UUID on e.g. SHA-256, RFC 9562 explains, that UUIDv8 MUST be used.

RFC 9562, Section "5.5. UUID Version 5" says:

There may be scenarios, usually depending on organizational security policies, where SHA-1 libraries may not be available or may be deemed unsafe for use. As such, it may be desirable to generate name-based UUIDs derived from SHA-256 or newer SHA methods. These name-based UUIDs MUST NOT utilize UUIDv5 and MUST be within the UUIDv8 space defined by Section 5.8.

Source: https://www.rfc-editor.org/rfc/rfc9562.html