hashlookup / hashlookup-format Goto Github PK

I think it's a good start but the draft could need some more work w.r.t to clarity:

• is it allowed to define other fields ad-hoc?
• If yes, where to register these fields?
• rationale: why are we doing this? Give two, three use-cases (just makes it clearer for the user what cool things he/she could do with that format)
• what fields are a MUST?

You might want to consider taking a bit of an RDF style approach to linking.

Such as:

< hash value > relation_type < other object ID>

Example:

< hash of binary> contains_btc_address < btc address>

Standard keys

• MD5
• SHA-1
• SHA-256
• TLSH
• SSDEEP
• FileName
• FileSize
• PackageArch
• PackageDescription
• PackageMaintainer
• PackageName
• PackageRelease
• PackageVersion
• KnownMalicious

make a json schema, mention it in the I-D and link to it.