Subject: [Syslog] Syslog-sign: Certificate chains?

From: <[email-masked]>
Date: Wed, 23 Jul 2008 15:27:04 +0300

Most IETF protocols that send certificates around support sending
certificate chains, too. Should syslog-sign support this, too?
If not, why?

Best regards,
Pasi
_______________________________________________
Syslog mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/syslog

---

From: Jon Callas <[email-masked]>
Date: Wed, 23 Jul 2008 11:45:00 -0700

On Jul 23, 2008, at 5:27 AM, <[email-masked]> <[email-masked] 
 > wrote:

> certificate chains, too. Should syslog-sign support this, too?

The model is for a more direct trust system where the certificate  
transfered is its own trust anchor. So if I am going to send you a log  
stream that I'll be signing with a certificate, I just send you the  
cert that I'm signing with. There's no need for a chain. Perhaps that  
cert descends from a formal CA and that may contain its own goodness,  
but it is not necessary.

	Jon

---

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 24 Jul 2008 12:49:42 +0200

I think the core point is that trust models in -sign and -transport-TLS
are quite different. At least, I think, it would be useful to provide a
mapping between the two.

Rainer

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Jon Callas
> Sent: Wednesday, July 23, 2008 8:45 PM
> To: <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [Syslog] Syslog-sign: Certificate chains?
> 
>

---

From: Martin Schütte <[email-masked]>
Date: Sun, 27 Jul 2008 12:50:32 +0200

> certificate chains, too. Should syslog-sign support this, too?

As Jon said it is not required for the signing as such.

But both PKIX and OpenPGP keys can be signed and users might have a 
security policy to verify the keys used for signing.
To encourage this in verification tools we could suggest a key 
verification in Section 7 (Efficient Verification of Logs) or Section 
8.9 (Man In The Middle Attacks).

-- 
Martin