Re: Syslog-sign: RSA support?
Martin Schütte <[email protected]>
| Newsgroups | gmane.ietf.syslog |
|---|---|
| Message-ID | <[email protected]> |
Jon Callas schrieb: > Nonetheless, if you're going to do syslog-sign over udp, there's a real > need to keep the signatures small. Good point. > That is why it is DSA. It's also why the encoding is the OpenPGP > encoding, and not DER. It's all to keep things as tight as possible. That should be more explicit. For key blob types 'C' (PKIX) and 'P' (OpenPGP certificates) I would assume a 'usual' encoding in DER and OpenPGP Key Packet format respectively. But there has to be be a better specification for blob type 'K' (public key) -- "raw key data" is not really well-defined. > Obviously, if you're going to do it over TCP, or even TLS, the tightness > is not needed as much. However, it's still nice to have a protocol that > is parsimonious on data. I think ECDSA makes much more sense than RSA > for it. I think this is mainly a compatibility concern for users who have existing PKIX certificates with RSA keys and want to use them for TLS and for signing. When creating new keys for syslog-sign then DSA or ECDSA are clearly preferable. -- Martin _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog