Subject: [Syslog] draft-ietf-syslog-sign-21.txt

From: "Alexander Clemm \(alex\)" <[email-masked]>
Date: Fri, 16 Mar 2007 10:56:40 -0700

Hello,

I have just submitted syslog-sign-21, which should be posted shortly.  

Here is the summary of changes, based on the review comments: 

* The new draft reflects the decision by the working group to drop
support for RFC 3164 and 3195, instead require syslog protocol.  The
previous draft allowed for both possibilities.  The various sections
have been updated accordingly.  

* The draft still requires support for messages of 2048 octets minimum
length, reflecting recommendations for the support of messages of
according length on syslog receiver (and syslog relay) side.  

* Section 4.1, section 5.3.1: The specifications of Signature From [email-masked] Fri Mar 16 13:57:49 2007
Content-class: urn:content-classes:message
Date: Fri, 16 Mar 2007 10:56:40 -0700
From: "Alexander Clemm \(alex\)" <[email-masked]>
To: <[email-masked]>
Cc: [email-masked]
Subject: [Syslog] draft-ietf-syslog-sign-21.txt

Hello,

I have just submitted syslog-sign-21, which should be posted shortly.  

Here is the summary of changes, based on the review comments: 

* The new draft reflects the decision by the working group to drop
support for RFC 3164 and 3195, instead require syslog protocol.  The
previous draft allowed for both possibilities.  The various sections
have been updated accordingly.  

* The draft still requires support for messages of 2048 octets minimum
length, reflecting recommendations for the support of messages of
according length on syslog receiver (and syslog relay) side.  

* Section 4.1, section 5.3.1: The specifications of Signature Block
messages and Certificate Block messages have been updated to no longer
include a value as requirement for APP-NAME, MSGID, and PROCID, per
discussion on the mailer.  The specification has been updated to
establish that the differentiating feature (that makes a Signature Block
message a Signature Block message and a Certificate Block message a
Certificate Block message) is the presence of Structured Data of the
respective type (with the respective SD-ID).  

* Section 4.1, section 5.3.1: Having said that, the specifications of
the Signature Block and Certificate Block messages now state that
whichever values an implementation chooses for APP-NAME, MSGID, and
PROCID, that these values SHOULD be applied consistently.  

* Section 4.1, section 5.3.1: The requirement for a PRI of 110 for the
Signature Block and Certificate Block messages has been changed from a
MUST to a RECOMMENDED, per the same rational that the defining feature
now is the Structured Data only.  

* Section 4.2.1: Added a value to the hash algorithm field to allow for
SHA256 as hash algorithm.  

* Section 4.2.1: Moved the description of the semantics of the protocol
version field from the IANA considerations section into this section;
rephrased the way in which extensibility beyond 9 values for hash
algorithm and signature scheme can be achieved; clarified that the
values for hash algorithm and signature scheme are protocol version
dependent.  

* Section 4.2.5: Meaning of Message Number is clarified: message number
is relative to signature group.  Also, Message Number behavior when it
reaches 9999999999 is clarified (it simply latches; a "latched" number
can be distinguished from a "non-latched" number by virtue of the Global
Block Counter).  

* References to bytes have been changed to octets, as requested per
Rainer's review.  

* Section 5.2: The time stamp is now required per syslog protocol, not
just per RFC 3339.  

* Section 5.3.2.6: Fragment length can be expressed with one to four
octets, not one to three.  (Also reflected in table in 5.3.2)

* IANA considerations: removed the mention of APP-NAME, MSGID per bullet
items above.  Rewrote most of the considerations and requested
registries as appropriate.  

* References: removed UDP, RFC 3164, and RFC 3195 references.  Moved RFC
4648, draft-ietf-syslog-protocol-19.txt,
draft-ietf-syslog-transport-udp-08.txt, and
draft-ietf-syslog-transport-tls-06.rxt references to normative
references.  

Other comments:

* Rainer had suggested to allow for 999 sig groups in case of SG=3,
instead of 192.  While technically this would be possible, it appears
that it unnecessarily makes the implementation more complex because the
restriction (999 vs. 192) would become context dependent, as opposed to
context independent, with no real tangible benefit.  

Best regards
--- Alex

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Rainer Gerhards" <[email-masked]>
Date: Tue, 20 Mar 2007 11:34:41 +0100

I am finally back. I was distracted from some really urgent "physical
world" local matters, sorry for the silence...

> context independent, with no real tangible benefit.

I agree to this. 192 should be sufficient.

Rainer