> Chris asked me to review this draft. Comments below. Likewise. Glad to look at it.
Sorry for the lateness of these comments. I think the draft is in good shape, and, in view of the comments already posted, ready to go to the AD after one more pass. I have not followed this work, because the applications with which I am involved already implement RFCs 4301-4303-4306. These seem to me to provide all of the same security coverage, and there is reluctance to add another security suite. (Taking this another step, the same goes for syslog over TCP in my case.) Just a few comments: 1. RFC 5746 updates DTLS, so it is worth a normative reference. 2. Last week, at Fast Software Encryption, Xiaoyun Wang estimated that SHA-1 collisions would be found within one to two years, so perhaps one of the AES-based MACs or combined modes is a safer mandatory-to- implemement cipher suite. AES-without-SHA is also a smaller crypto- footprint for constrained devices. (Of course, collisions do not necessarily compromise HMACs, but ...) 3. The Introduction states that a high rate of lost packets is a reason for using UDP. It is also a reason for using TCP. 4. Do relays guarantee ordering? I thought timestamps (or syslog-sign) was all one had to go on. 5. In Section 5.1, paragraph 2, sentence 2, a word or two may be missing: " ... may not be able to assure ..."? 6. Then, also in 5.1: "When TCP is used syslog over DTLS MUST NOT be used." Well, I have not seen much discussion of this, but does anything say that I cannot use TCP for some syslog messages and UDP for others? 7. Why have pre-shared keys as an alternative to certificates been rejected? Richard Graveman RFG Security, LLC [email protected] _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
