Partition CVE ID assignments by CNA

[zmanion]

Motivated by emergency contingency planning last week, this issue is to discuss the possibility of and options for changing how CVE IDs are assigned (or more correctly, reserved) by CNAs.

One option is to partition assignment by CNA, in a way that guarantees unique assignments between CNAs and removes the need for a central assignment service.

This design would require that CNAs (GNAs in the GCVE model) are registered sufficiently (to receive a partition of IDs) and rules to manage CNA changes (names, mergers, acquisitions, deprecation, etc.). There may be additional requirements. CNAs would be responsible for unique assignments within their space (and the year portion).

My individual idea is similar to GCVE but keeping the curent CVE ID syntax. For example:

CVE-YYYY-1234567890123456789
       A ^^^
       B    ^^^^
       C        ^^^^^^^^^^^^

A: (3)  reserved for Program use
B: (4)  CNA ID, or "1000 CNAs should be enough for anyone"
C: (12) assignments within CNA partition

Note the GCVE approach:

A: A GCVE ID uses a four-part format: GCVE-<GNA ID>-<YEAR>-<UNIQUE ID>.

Also similar to VIN.