From nobody Mon Mar 14 06:04:38 2022 Return-Path: X-Original-To: syslog@ietfa.amsl.com Delivered-To: syslog@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C33A73A13FF for ; Mon, 14 Mar 2022 06:04:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wZ-RSx2_HR_C for ; Mon, 14 Mar 2022 06:04:33 -0700 (PDT) Received: from mail-ot1-x332.google.com (mail-ot1-x332.google.com [IPv6:2607:f8b0:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16E283A13FC for ; Mon, 14 Mar 2022 06:04:33 -0700 (PDT) Received: by mail-ot1-x332.google.com with SMTP id 17-20020a9d0611000000b005b251571643so11697566otn.2 for ; Mon, 14 Mar 2022 06:04:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:date:mime-version:user-agent:content-language:to:from :subject:content-transfer-encoding; bh=c8eQbLRqW92RCQLxvTB+iuPy+pin7108QmJsRCbE7rk=; b=DvAnBb1tihwKwHY1EX6mDIw4Gb+sBi7KE8/2CVk67ymllGX92EtzEfnNiH7NylmWb4 cgPb1a3bJcj7xoBJSJs2hCCb6e/Esiw7DPHjR2rTkMH0W28PBs7CeiYMxQFVtnvt+cr9 8LtVIt/QxmjnmYagtdzX4UmoQVHv6cOtnlRyVN7FaklVOc+VYRF5svcYXKL5R0p9HImT mJFSgJ4vMbjwQIgk1EJ7A1YjSlJCEXN9V4X8MmJy6oeWrbnUphwvI+VX9OUkzqTUC7N7 Y7DVss/gpHuQJLgMbEzt/GMak2fpxovxkCUS2J73pgZOMTet2wHGTcOOFUukSp+N9iB9 pc2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent :content-language:to:from:subject:content-transfer-encoding; bh=c8eQbLRqW92RCQLxvTB+iuPy+pin7108QmJsRCbE7rk=; b=kMYTa2EhRIGNEdiY9fj+dFWrf+Q2DRawZh+TEPF6D3vJOFi3m31CarEBiUps2ZObFC dVeYDN9/qafNuhsvQDdU2kqxmUJmaawDA2oRxVybFbB+KCEoLRy5D/dGtaIWoQx30Io/ q1uLZIIX82o2z6lXwc+ve7+vtW+eACcsUyV2iuyBLS9R2TO0ApWFkNvWohazbrbmy8yl TgIHi7tpsy9priux9KyyMC8dL487tVo5plIIozrBPcEr9rJ+g80TA3GyZGFkBlp4FASu z7xofEV7sqI7DswrmsgH+Q4loxKKPVWupe4H4AvuPsRdu2fwJ9tIYs4O/g4yY3jYMTJP J6Ng== X-Gm-Message-State: AOAM533mDZC87qV55moAPshCQmk/FU5KXPL3vsVmosXx6H6oxTnd6YA2 UE0oUwmVC11ITTItjlGYKnpxAXCcVpE= X-Google-Smtp-Source: ABdhPJyoEna9y6ySpWDczVAkFPDA33kuttP4hFM5TBOsS5pdJ4fK5OqdDjKxEIyVKX2KxdOcOzBldg== X-Received: by 2002:a05:6830:2b10:b0:5c9:3635:1334 with SMTP id l16-20020a0568302b1000b005c936351334mr7915300otv.67.1647263071554; Mon, 14 Mar 2022 06:04:31 -0700 (PDT) Received: from ?IPV6:2600:1700:12b0:adf0:14e8:1efa:4459:6c5d? ([2600:1700:12b0:adf0:14e8:1efa:4459:6c5d]) by smtp.googlemail.com with ESMTPSA id l14-20020a056820030e00b00320edaf9b8esm7335662ooe.44.2022.03.14.06.04.30 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 14 Mar 2022 06:04:31 -0700 (PDT) Message-ID: <132b54a5-eb1e-90fb-2af2-4ba330ae035b@gmail.com> Date: Mon, 14 Mar 2022 08:04:30 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.6.1 Content-Language: en-US To: "syslog@ietf.org" From: Chris Lonvick Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Syslog] Comments and 0-RTT in draft-ciphersuites-in-sec-syslog X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Mar 2022 13:04:35 -0000 Hi Folks, Just checking to see if anyone has any comments on the ciphersuits draft? https://datatracker.ietf.org/doc/draft-ciphersuites-in-sec-syslog/01/ In there, we have a placeholder for 0-RTT. Any suggestions about that will be greatly welcome. Thanks and Regards, Chris From nobody Mon Mar 14 18:54:31 2022 Return-Path: X-Original-To: syslog@ietfa.amsl.com Delivered-To: syslog@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 555313A16ED for ; Mon, 14 Mar 2022 18:54:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_FONT_FACE_BAD=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iY_2xe75WNg4 for ; Mon, 14 Mar 2022 18:54:25 -0700 (PDT) Received: from cmccmta2.chinamobile.com (cmccmta2.chinamobile.com [221.176.66.80]) by ietfa.amsl.com (Postfix) with ESMTP id 351F23A16C9 for ; Mon, 14 Mar 2022 18:52:53 -0700 (PDT) Received: from spf.mail.chinamobile.com (unknown[172.16.121.17]) by rmmx-syy-dmz-app07-12007 (RichMail) with SMTP id 2ee7622ff1742f9-f9c85; Tue, 15 Mar 2022 09:52:52 +0800 (CST) X-RM-TRANSID: 2ee7622ff1742f9-f9c85 X-RM-TagInfo: emlType=0 X-RM-SPAM-FLAG: 00000000 Received: from cmcc-PC (unknown[10.2.51.26]) by rmsmtp-syy-appsvr09-12009 (RichMail) with SMTP id 2ee9622ff172a1a-38eb9; Tue, 15 Mar 2022 09:52:51 +0800 (CST) X-RM-TRANSID: 2ee9622ff172a1a-38eb9 Date: Tue, 15 Mar 2022 09:52:51 +0800 From: "Meiling Chen" To: syslog Cc: suli , wangfengsheng X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.2.9.115[cn] Mime-Version: 1.0 Message-ID: <2022031509525088032316@chinamobile.com> Content-Type: multipart/alternative; boundary="----=_001_NextPart833210625045_=----" Archived-At: Subject: [Syslog] Fw: New Version Notification for draft-chen-syslog-syscinfo-credibility-00.txt X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2022 01:54:29 -0000 This is a multi-part message in MIME format. ------=_001_NextPart833210625045_=---- Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SGkgZm9sa3MsDQpUaGlzIGRyYWZ0IGlzIGFib3V0IHN5c2xvZyB3aGljaCB1c2VkIHRvIGltcHJv dmUgbG9nZ2luZyBjcmVkaWJpbGl0eSBieSBhZGRpbmcgc3luY2hyb25pemF0aW9uIHRpbWUgaW5m b3JtYXRpb24uDQpUaGUgdHJpZ2dlciBvZiB0aGlzIGRyYWZ0IGlzIHRoYXQgd2UgZm91bmQgdGhl IGF0dGFjayB2dWxuZXJhYmlsaXR5IG9mIHN5c2xvZyB0aW1lIHN5bmNocm9uaXphdGlvbiBkdXJp bmcgdGhlIGV4cGVyaW1lbnQsIHRoZSBwdXJwb3NlIGlzIHRvIGltcHJvdmUgcmZjNTQyNCB3aXRo IGEgc2xpZ2h0IG1vZGlmaWNhdGlvbi4NCkFuZCB0aGUgZHJhZnQgYWltZWQgYXQgdGhlIGRpc2N1 c3Npb24gb2YgY3JlZGliaWxpdHkgd2hlbiB0aGUgdmFsdWUgIjEiIGlzIHVzZWQgZm9yICJpc1N5 bmNlZCIuDQpXZSBoYXZlIHJlY2VpdmVkIHNvbWUgc3VnZ2VzdGlvbnMgZnJvbSBTZWFuIGFuZCBs b252aWNrLCB3aWxsIGFsc28gdXBkYXRlIHRoZSB2ZXJzaW9uIGFmdGVyIG9wZW4gc3VibWlzc2lv bi4NCklmIGFueW9uZSBpcyBpbnRlcmVzdGVkIGluIHRoaXMgdG9waWMsIHBsZWFzZSBmZWVsIGZy ZWUgdG8gY29tbWVudC4NCg0KQmVzdCwNCk1laWxpbmcNCg0KRnJvbTogaW50ZXJuZXQtZHJhZnRz DQpEYXRlOiAyMDIyLTAzLTA3IDEwOjE4DQpUbzogRmVuZ3NoZW5nIFdhbmc7IExpIFN1OyBNZWls aW5nIENoZW47IGNoZW5tZWlsaW5nDQpTdWJqZWN0OiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24g Zm9yIGRyYWZ0LWNoZW4tc3lzbG9nLXN5c2NpbmZvLWNyZWRpYmlsaXR5LTAwLnR4dA0KIA0KQSBu ZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0LWNoZW4tc3lzbG9nLXN5c2NpbmZvLWNyZWRpYmlsaXR5 LTAwLnR4dA0KaGFzIGJlZW4gc3VjY2Vzc2Z1bGx5IHN1Ym1pdHRlZCBieSBNZWlsaW5nIENoZW4g YW5kIHBvc3RlZCB0byB0aGUNCklFVEYgcmVwb3NpdG9yeS4NCiANCk5hbWU6IGRyYWZ0LWNoZW4t c3lzbG9nLXN5c2NpbmZvLWNyZWRpYmlsaXR5DQpSZXZpc2lvbjogMDANClRpdGxlOiBJbXByb3Zl IGxvZ2dpbmcgY3JlZGliaWxpdHkgYnkgYWRkaW5nIHN5bmNocm9uaXphdGlvbiB0aW1lIGluZm9y bWF0aW9uDQpEb2N1bWVudCBkYXRlOiAyMDIyLTAzLTA2DQpHcm91cDogSW5kaXZpZHVhbCBTdWJt aXNzaW9uDQpQYWdlczogNg0KVVJMOiAgICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL2Fy Y2hpdmUvaWQvZHJhZnQtY2hlbi1zeXNsb2ctc3lzY2luZm8tY3JlZGliaWxpdHktMDAudHh0DQpT dGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY2hl bi1zeXNsb2ctc3lzY2luZm8tY3JlZGliaWxpdHkvDQpIdG1sOiAgICAgICAgICAgaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvYXJjaGl2ZS9pZC9kcmFmdC1jaGVuLXN5c2xvZy1zeXNjaW5mby1jcmVkaWJp bGl0eS0wMC5odG1sDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9y Zy9kb2MvaHRtbC9kcmFmdC1jaGVuLXN5c2xvZy1zeXNjaW5mby1jcmVkaWJpbGl0eQ0KIA0KIA0K QWJzdHJhY3Q6DQogICBUaGlzIGRvY3VtZW50IHByb3Bvc2VzIGEgc2NoZW1lIHRvIGltcHJvdmUg dGhlIGNyZWRpYmlsaXR5IG9mIGxvZw0KICAgcmVwb3J0aW5nIHRpbWUgYnkgYWRkaW5nIHRpbWUg c3luY2hyb25pemF0aW9uIGluZm9ybWF0aW9uLg0KIA0KICAgVGhpcyBkb2N1bWVudCB1cGRhdGVz IHRoZSAidGltZVF1YWxpdHkiIHN0cnVjdHVyZWQgRGF0YSBpbiBSRkMgNTQyNA0KICAgW1JGQzU0 MjRdLCBUaGUgU3lzbG9nIFByb3RvY29sLiAgQnkgYXBwZW5kaW5nICJTWU5DSU5GTyIgaW5mb3Jt YXRpb24NCiAgIGFmdGVyIHRoZSAiaXNTeW5jZWQiIHBhcmFtZXRlciwgdGhlIGxvZyBjb2xsZWN0 b3IgY2FuIGp1ZGdlIHRoZQ0KICAgY3JlZGliaWxpdHkgb2YgbG9ncyB3aGVuIGNvcnJlbGF0aW5n IGxvZ3Mgb2YgZGlmZmVyZW50IGRldmljZXMuDQogDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg DQogDQogDQpUaGUgSUVURiBTZWNyZXRhcmlhdA0KIA0KIA0KIA0K ------=_001_NextPart833210625045_=---- Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable =0A
Hi folks,
This draft = is about syslog which used to imp= rove logging credibility by adding synchronization time information.
The trigger of this draft i= s that we found the attack vulnerability of syslog time synchronization du= ring the experiment, = the purpose is to improve rfc5424 with a slight modification.
And the draft aimed at the discussion of credibility when the value "1" is used for "isSynced".
We have received some suggestions from Sean= and lonvick, = will also update the version after open submission.
If = anyone is interested in this topic, please feel free to comment.

Best,
<= font face=3D"=E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91, Tahoma">Meiling<= /span>

From:&= nbsp;internet-drafts
=
Date: 2022-03-07 10:18
Subject: New Vers= ion Notification for draft-chen-syslog-syscinfo-credibility-00.txt
 
=0A
A new version of I-D, draft-chen-s= yslog-syscinfo-credibility-00.txt
=0A
has been successfully submi= tted by Meiling Chen and posted to the
=0A
IETF repository.
= =0A
 
=0A
Name: draft-chen-syslog-syscinfo-credibility<= /div>=0A
Revision: 00
=0A
Title: Improve logging credibility= by adding synchronization time information
=0A
Document date: 20= 22-03-06
=0A
Group: Individual Submission
=0A
Pages: 6=
=0A
URL:         &n= bsp;  https://www.ietf.org/archive/id/draft-chen-syslog-syscinfo-cred= ibility-00.txt
=0A
Status:      &nb= sp;  https://datatracker.ietf.org/doc/draft-chen-syslog-syscinfo-cred= ibility/
=0A
Html:        = ;   https://www.ietf.org/archive/id/draft-chen-syslog-syscinfo-c= redibility-00.html
=0A
Htmlized:     &nb= sp; https://datatracker.ietf.org/doc/html/draft-chen-syslog-syscinfo-credi= bility
=0A
 
=0A
 
=0A
Abstract:=0A
   This document proposes a scheme to improve the credi= bility of log
=0A
   reporting time by adding time sync= hronization information.
=0A
 
=0A
   Thi= s document updates the "timeQuality" structured Data in RFC 5424
=0A<= div>   [RFC5424], The Syslog Protocol.  By appending "SYNCI= NFO" information
=0A
   after the "isSynced" parameter,= the log collector can judge the
=0A
   credibility of = logs when correlating logs of different devices.
=0A
 
= =0A
           =             &n= bsp;           &nbs= p;            =             &n= bsp;           &nbs= p;        
=0A
 =0A
 
=0A
The IETF Secretariat
=0A
 =0A
 
=0A
 
=0A
------=_001_NextPart833210625045_=------ From nobody Mon Mar 28 04:24:55 2022 Return-Path: X-Original-To: syslog@ietfa.amsl.com Delivered-To: syslog@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 686423A11CB for ; Mon, 28 Mar 2022 04:24:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jfz4V1puNYle for ; Mon, 28 Mar 2022 04:24:48 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04on0716.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0e::716]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29F693A11EC for ; Mon, 28 Mar 2022 04:24:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=I3XR0dl0NtllbbR3cYPZmXotMPcDu5XHsqq2r/pgfmYxJ6e1mTlk95fjzDDT0kMRu1mjEkmA9ZgQ/73bToNHvw7uReaK71ANBEnRa6cEEgoAWalaxswyb2quZT5f5A3Q5xnVkQlz61NOe660T5C+1gY1Ps9J59AYHtwYaLBUMNLCyzqVlAj41ayewM0SgjG3r0yyxvaOVQ+Frx8xYnBSUBo9d/nYF09pClAJqUeQTQuA3GMl3k0ImWVIfm3takrToMSgnOS2R8M12kBMms9xb/G2tqPMaYaMQU/dVo+kx3QBrT8sj5XP/8iJHGBEYtlDQlqwmqjqpa7RkOtPl522Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=eGFyo8vDF5lCHatJGeg+gXiWAwAR1N2e9Pg4ZG+G5TQ=; b=KdVQKst017Uaw9TC+RMkaQndTrm5KgUpqUo2bpoVJHNcensPlthnY6exmYBLEpSseyUzoeTq7XDSBldBWqRiVgbMEaTnplU0/3KUghd/czzFVt+O4dipHZUhi1AdilzH08l7PKtD/iG4o5SOkZBqAXOaw9xjut+bcQ/JKqSdoO00cRDXUVE70Zw4vYiIPGsBa7ojpXg8Hqrb+4ZHuKSVieUtJq8V6WeigFBDl/kzBbApk9LFfF35YNJnl62nppTf6YePERiodPxwB8vpD6ywIvXbjbIIsW5v9FLOlwwXItcFXJye10ItluPYNykoJKDFPpLA7lRN28XJq0kKRgw/7g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=btconnect.com; dmarc=pass action=none header.from=btconnect.com; dkim=pass header.d=btconnect.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector2-btconnect-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eGFyo8vDF5lCHatJGeg+gXiWAwAR1N2e9Pg4ZG+G5TQ=; b=cPYTZswMQEWIfAqanYaVjyB+9hH5c9iulimOSYjFU+/ns0vibcMnq4Bo/InpBHTRvjh+gzv+4mRU7dmttJ6f/z9bk9mVRLdXuI1CXbH9J/slQcEuKbQsMciqcCxOi0EFp5zvqFwij52MYhOnBeCHaI/mV8DxSki+qC3So0WmiOw= Received: from AM7PR07MB6248.eurprd07.prod.outlook.com (2603:10a6:20b:134::11) by AM6PR07MB4965.eurprd07.prod.outlook.com (2603:10a6:20b:3e::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.15; Mon, 28 Mar 2022 11:24:43 +0000 Received: from AM7PR07MB6248.eurprd07.prod.outlook.com ([fe80::b1c5:beb7:ddbf:b358]) by AM7PR07MB6248.eurprd07.prod.outlook.com ([fe80::b1c5:beb7:ddbf:b358%9]) with mapi id 15.20.5123.015; Mon, 28 Mar 2022 11:24:43 +0000 From: tom petch To: Meiling Chen , syslog CC: suli Thread-Topic: [Syslog] Fw: New Version Notification for draft-chen-syslog-syscinfo-credibility-00.txt Thread-Index: AQHYOA+gUhgSSaJoVUGwCPpxRUFDPazUvDSq Date: Mon, 28 Mar 2022 11:24:43 +0000 Message-ID: References: <2022031509525088032316@chinamobile.com> In-Reply-To: <2022031509525088032316@chinamobile.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: suggested_attachment_session_id: 911eeba2-fa18-6d0b-8f46-19ac468044cd authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=btconnect.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a0fb6f36-6017-4855-fdf9-08da10ad8e93 x-ms-traffictypediagnostic: AM6PR07MB4965:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: iJCCZKp+L3FtpKvQo90PiOBIA+5i1e5FGc5tMUv2/66bUH8dOeibOqv8goBUSL7dPyIqJrduNcb7s34mjc1nLxw6VzBYe/VGqbKmMLzrbJCQZVWvYnlPII/nyt61bzQOj8chZX2idoSsu3x8tg4JdUfvqOmCBFg2uHlQ5+acSUJW4+/UlzTSWvRxHPxIClYTyVotW2Em4LERzVddcegU/2dc75guBjlxHnu0zcAxFG7+3YMS/OZ6nXQXpWolqVivLEpp8HxVB/RoeIqjDU8TqLURsmOJg4srDMJUYkPzhawSrjybrGgvLI/Y3Y50B9gIIIoQrIqBkiPxnNfIwjlC/zBPTfKOj64S46Ph9eSm2aO/nU1zOr5oeL2ppv2hHChu6cO3bA9KkJ/UtbSEhbcVnSQYJMHdq+qDA8Jbeh0UpIih2SEW8NUEtO1Z6XZb75i5jbdSpi2/iKdbkjFvH3r7puvTx6xGzCdrTHF6rYYMlRwwbongjCwAQikZ61atlv5eW5ZARpnd0NN1MxUKR9BpeR74ykhx03FhKSTtp2GQ9Okw3M85CYBVkooFguQ3Gw4h7a3gHoFQxQF0Bfhqonjw7bFvig7RTBUo9jaQtnTY42Zz+8NGmIsvyeJ9mWyfOfvYjdUpkKwPm6vt7xEYJec//EvVS9wes2qIyOg2fFB090TxrN0adRmTgOMynta8teaU+BhHCbCAmr73w3RKzrLghfF5hKLQnbIVdCrTjnf2XRycGZHMHAT0qLLpQiWsCMCHAcTwyMo4GdV91A50FcCpEOladOJTF7vQm+O5/kOLVk+JpKUdw3qIBCMGwx+XFyRnRI6aDJzqv0YlnsqshtH4FA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM7PR07MB6248.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(53546011)(7696005)(6506007)(2906002)(38070700005)(83380400001)(9686003)(8676002)(91956017)(66476007)(64756008)(316002)(66556008)(15650500001)(110136005)(122000001)(71200400001)(4326008)(52536014)(508600001)(66946007)(66446008)(82960400001)(8936002)(76116006)(33656002)(5660300002)(186003)(26005)(38100700002)(66574015)(86362001)(55016003)(966005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?V6UjAqmWUuJsnrh2BMzpX/06HNU79a7JvbGe9JrJV/7tK58rkkrO6fMLLT?= =?iso-8859-1?Q?FD090e01l8NE1gm3PNJRUe9BEC2I7X9hvVKQ7U8CUof1xSA5rYocireTb9?= =?iso-8859-1?Q?BoPWP/7lwEHynvm6wvbDJllWDAqlRuF/fZDLPPGd0+r1z4hZ9qP7h6KiT0?= =?iso-8859-1?Q?Uez5IA3FlabXja5cIS712r/82hSGSpn3487406vvX5ZJYCMbNSShMyI3k6?= =?iso-8859-1?Q?tlyUv3Zfeh3pRZpoO6d9j4l1Hkk2A38sJCOQYtgKAsKyY5p/vA0iRIs6uR?= =?iso-8859-1?Q?aWYX9y4+ttg1xl0ZHv8lbZaHrpncX69tkEpsKIB1mjjTQGylpry9ibohKc?= =?iso-8859-1?Q?t7KJYhtie7q8hvDqKKIRkKDRpWv44wQQaQL88ofiofJTvVlLZskr/bPbU9?= =?iso-8859-1?Q?DeZJrq55AueTJxM7ytIgCd5joj1nXCGkFf55582op2qBk7fz7oAPtgZTYP?= =?iso-8859-1?Q?T6+PgvcR/W2Imjy8lFtx8mMMOdJZ9fR5EBB4icLX/AWihveabYOhYOA8Pc?= =?iso-8859-1?Q?3CagrP7Lyheg3CPCCPIIv5SXVL2SeKSzCBrPpQQkTZepdsFZ9/K0wFBDa5?= =?iso-8859-1?Q?4iv9Js8ZWrWGthr5YkGNHe+VuakjdbJxBlMe4ZPjumXfotHxsqKJAc14U6?= =?iso-8859-1?Q?g1/F4uIhMgm3gPvoMmPk6ZvsM3BLuvZ37IuNZ/FxzRU1X3CaPZAcnJeC+a?= =?iso-8859-1?Q?v+a8/MmiK5os195cnEkWax0ecMXat50H3EThyhH34uUwmTXJrOYcyn+sJF?= =?iso-8859-1?Q?PeJhoJbC7Y6pXdUFn46kOSuvWkm5JqQ/L0l4AAfgYpycC5dY94CRn+WmMh?= =?iso-8859-1?Q?wYZiWRDd9HTz2YO3KZSJ3x7An/AL0kuqpC3jg+KTwpAr6ATAiKai2IwKq6?= =?iso-8859-1?Q?AuCR19W/0/iGqmC3OyWnGngupd/CZfcg5dDVhxzdW47jgMvEYhhPAMfsER?= =?iso-8859-1?Q?kEYAtD5AiNpv57BEgRevAHf9GbvXfqN5gEULoEUM6KF664kvRBFgYshNI1?= =?iso-8859-1?Q?gMghLlf4zWwpksJeLHJjTz3XvN58KsEH3PE3dUhLSDWHXqkgyankr2C8Bo?= =?iso-8859-1?Q?1jytOv6muOuRgkUr4dxiYuRqlLQPN7mRBIBgMkI+PGbwUZbN64dc9m8qN6?= =?iso-8859-1?Q?0DhCGc/6KIcuIeuRXxWLagZQ6zIJsFA6Q1+iQFQjTs35bGsyvMaTsFW9NY?= =?iso-8859-1?Q?tModDoSrJGGyOTG7Bzar5xHJCmBXtJ7PH5t0o/PoZMXNhafpNaUtJ6yupX?= =?iso-8859-1?Q?zCiOR76x6lqSuUFTBfGpxC2ukp1ZAyao/bqPBAwIoDH9UAmju2pq9T6k3H?= =?iso-8859-1?Q?XDn3a6H7+ayJ2DWA8JSy35JWzmtWTEHUrwzqCVKRPA3FsFHBSYqRxe+0IQ?= =?iso-8859-1?Q?ftBFAgk+JvkiePcxRr+A/lE4zv44H0kBTWaPRxAMJhCiKKz2/WLqumMgYI?= =?iso-8859-1?Q?FbuC+l4qs7idxwtedUC3H2OArFO9x6vtiMPrlTqOfEn9mvQz8GxdXRaVhF?= =?iso-8859-1?Q?Zj/CuQWQhvNXCuUvIiyhf6HIT3Mz4JnVimvyi+lB5dkObq2sBTjltbNPor?= =?iso-8859-1?Q?UtzL94wkrGcQToI0ExYoTEYBk0mZjl5Fvma57cWDyMXD2AhVcJUa/6Uk2w?= =?iso-8859-1?Q?DUl6cF6+Ty2DDWmixxZU/hV2fYC1IgA4AAxUuH2bADXQockLAm20zzW4pn?= =?iso-8859-1?Q?FQ3WrZbOhQ/k39gZtP4v0A1zGc25yMjwzNfKg7N1Hl0AjcrC6PP768wi33?= =?iso-8859-1?Q?3UOkufBhl3QLCevkhcPanCNDbXA74IB8ptDdjw8juRKyqGaU/jN7GmUkrx?= =?iso-8859-1?Q?nxJ1WQC3LQ=3D=3D?= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM7PR07MB6248.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a0fb6f36-6017-4855-fdf9-08da10ad8e93 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2022 11:24:43.3484 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf8853ed-96e5-465b-9185-806bfe185e30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dmFqi1Jh/fCHvI1PmmzdCCTpmZKOuoYl9pY9sz19v2Qv5cG8qJudmsvu1PywTmej4DczhkCbJIzK7OLNOb40lQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR07MB4965 Archived-At: Subject: Re: [Syslog] Fw: New Version Notification for draft-chen-syslog-syscinfo-credibility-00.txt X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Mar 2022 11:24:53 -0000 From: Syslog on behalf of Meiling Chen =0A= Sent: 15 March 2022 01:52=0A= =0A= Hi folks,=0A= This draft is about syslog which used to improve logging credibility by add= ing synchronization time information.=0A= The trigger of this draft is that we found the attack vulnerability of sysl= og time synchronization during the experiment, the purpose is to improve rf= c5424 with a slight modification.=0A= And the draft aimed at the discussion of credibility when the value "1" is = used for "isSynced".=0A= We have received some suggestions from Sean and lonvick, will also update t= he version after open submission.=0A= If anyone is interested in this topic, please feel free to comment.=0A= =0A= =0A= There is no syslog WG in the IETF so if the work is to progress, it likely = needs to find a home in a a WG that is.=0A= =0A= Tom Petch=0A= =0A= Best,=0A= Meiling=0A= =0A= From: internet-drafts=0A= Date: 2022-03-07 10:18=0A= To: Fengsheng Wang; Li Su; Meiling Chen; chenme= iling=0A= Subject: New Version Notification for draft-chen-syslog-syscinfo-credibilit= y-00.txt=0A= =0A= A new version of I-D, draft-chen-syslog-syscinfo-credibility-00.txt=0A= has been successfully submitted by Meiling Chen and posted to the=0A= IETF repository.=0A= =0A= Name: draft-chen-syslog-syscinfo-credibility=0A= Revision: 00=0A= Title: Improve logging credibility by adding synchronization time informati= on=0A= Document date: 2022-03-06=0A= Group: Individual Submission=0A= Pages: 6=0A= URL: https://www.ietf.org/archive/id/draft-chen-syslog-syscinfo-= credibility-00.txt=0A= Status: https://datatracker.ietf.org/doc/draft-chen-syslog-syscinfo= -credibility/=0A= Html: https://www.ietf.org/archive/id/draft-chen-syslog-syscinfo-= credibility-00.html=0A= Htmlized: https://datatracker.ietf.org/doc/html/draft-chen-syslog-sys= cinfo-credibility=0A= =0A= =0A= Abstract:=0A= This document proposes a scheme to improve the credibility of log=0A= reporting time by adding time synchronization information.=0A= =0A= This document updates the "timeQuality" structured Data in RFC 5424=0A= [RFC5424], The Syslog Protocol. By appending "SYNCINFO" information=0A= after the "isSynced" parameter, the log collector can judge the=0A= credibility of logs when correlating logs of different devices.=0A= =0A= =0A= =0A= =0A= The IETF Secretariat=0A= =0A= =0A= =0A= From nobody Mon Mar 28 04:28:32 2022 Return-Path: X-Original-To: syslog@ietfa.amsl.com Delivered-To: syslog@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36AA83A11F9 for ; Mon, 28 Mar 2022 04:28:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=btconnect.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nf0iuQ-SBLxJ for ; Mon, 28 Mar 2022 04:28:26 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-db3eur04on071a.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0c::71a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83C643A11F7 for ; Mon, 28 Mar 2022 04:28:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oYw8NO2uwWYG6GejSnPxp775OrhodFueV2YxEVykBx+5bsMxMWotVoGYBOCH78eKsSFxCXlHqHSxG7S0yUI/zJG92Z6GlxXp972NpTJztneJFB2VP1P4OUOaFLI9zHXMD+JSdsl3nJyuJz6PdLsVsrkOEAFVecuGt29Dh5MHyG0zbWBPVIA9W2OFYHiEmdahL0nUMlBIh4i5RXhP3mDgRODZThbdD+CF+kqjUiu/zNMnyuVmqE4w7UbpQI8VAtA5O+5+hvJ11vDM8egTrina1Im3wCPxdfKXBNPdPV5CqJmiHunyGc/0ffg5gcbDR+9BIjDCA0BbgiHc1obmfUGqiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qy0MN/TtHvKrqcj6Nj90cahkpD9POMrpxfBDb5o6bsw=; b=TN2hNuGmpzzrcvSwCDJQNOeja5KcVT4GyT7O4teP4YBAQ1HkMcLP20LVQLTvT+tjHD6PaKF2UTLTfD2AxbjHGnAhcX8zRtnXlGHIL+jUybpG9Kwm4AouIvWTs+LMGQYSD0EOQ4M6dkfRu4vNXa3V9CIm84YpyZOb45PpfLIPhGOI90gZTj5zw0dRKmUKJJiW4rsJu3G0ZwfUhVS03rDarfoTjrSQaK5YX5WDHLbswABPP3Ic9ZJqjWINFssgZlNfGkTNgjeNs6Rz6PesMv1hqZM1b0e7N77ySkfN5gBzTG8BAvAyBEnuJlbXgsz4Ik5gle9KBC9/e8bAwCpd1dId6w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=btconnect.com; dmarc=pass action=none header.from=btconnect.com; dkim=pass header.d=btconnect.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btconnect.onmicrosoft.com; s=selector2-btconnect-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qy0MN/TtHvKrqcj6Nj90cahkpD9POMrpxfBDb5o6bsw=; b=FIqxc3j/cyBB2aGjlWeQnL1PIXLenRXLIYAV1jvsARxpPj7Wxf4yQg9u/cWqdK1L9AE4+ESdQh9t7jy3POt+yLHK9YxBixJ986nYoqHUC7R7+y13g7aT59U6lABU8rW54M1ZuabrUwBfju4TDxSgFN+MvU+r04LJ6MofdRtpyuE= Received: from AM7PR07MB6248.eurprd07.prod.outlook.com (2603:10a6:20b:134::11) by AM0PR0702MB3650.eurprd07.prod.outlook.com (2603:10a6:208:25::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5123.14; Mon, 28 Mar 2022 11:28:21 +0000 Received: from AM7PR07MB6248.eurprd07.prod.outlook.com ([fe80::b1c5:beb7:ddbf:b358]) by AM7PR07MB6248.eurprd07.prod.outlook.com ([fe80::b1c5:beb7:ddbf:b358%9]) with mapi id 15.20.5123.015; Mon, 28 Mar 2022 11:28:21 +0000 From: tom petch To: Chris Lonvick , "syslog@ietf.org" Thread-Topic: [Syslog] Comments and 0-RTT in draft-ciphersuites-in-sec-syslog Thread-Index: AQHYN6QTCr313Ksuz0m2NFVFTj5KrKzUvafk Date: Mon, 28 Mar 2022 11:28:21 +0000 Message-ID: References: <132b54a5-eb1e-90fb-2af2-4ba330ae035b@gmail.com> In-Reply-To: <132b54a5-eb1e-90fb-2af2-4ba330ae035b@gmail.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: suggested_attachment_session_id: b3a7aa61-bba3-1217-8ef4-36875e2bf7e7 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=btconnect.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 64195a96-920f-49f2-d4be-08da10ae1055 x-ms-traffictypediagnostic: AM0PR0702MB3650:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 41bIEvzVOh5+wZFWWa1wrFdef94iSOh4WFH8gKd8TOmW5cW9+e8iYzl9RLqJB5JYC8QUfAoMixMTatrMF9PJmzNyl8p4uAcVOiK4n1Gy2lb+2/saLlVLysOzvUpQrNeC59KlFew3a4QL3uJJJSd6IuWhe9R3ivr/iQ6At4Fh4DgVLJ2haUij/wz1GTPnLGB1u3uXMVG49++TdLxIo1cFMItVYrZULFBgjljRZYcfbTZLoXEjmA5SnLoFeidbr7lxAbffFtpMl5wrEZbjHoo/4LSK9GCIQWawLkDCjRwNP4gJvPruvh5Khp1LREBQQ6tiPoDQdx4cYUMpwKL83ZLfxyOeZxmV6Bb1o0uvHcn3pDWKyrpZ98FQ0EuLytNSATWRr6p9eaf0WeRjy+Tc9dTfHzLwVgA68qfv78hychalpPR9D6f7TqA3791ZemsGSXOcK6sfx+c4Y1u+KFd5YyR73OzoDoKiQgfSL8ZNoQn4q7Gt0THKMZHaurNY9FnDebp6NpLuYuSqxlJVM1sbmJVxppJZw7TlzI7WUvBMJ+BjGckF7i7df5H67ZHcLTBVeRIBak7y6xlwqGfjrW3J9E7qImRSM6FQXHOgWsFSOAsfiwrOG4oSwAi1MNnr+YCsGGq/kD3t6Wvtf6mbVdR9e88kgpMulaVZZ1wDTEesTvf02E8OKzqbqnIG4TJ/sZk3de05n6/h9qTLXFovUnERgjdh8kA6UqmttR5HyEBMAwVrlnhPBcxrPi4E/pFPOp6JcSq7ISIJXt5G9xo1UzT595qAwO0SDgFRMU27XnIIT7P/fKK94g8sdZrtk682asepxTrqxwZtVu55eTig1Ya6yLKXrFaT3VSYbVaaBWz12u3RwDCrpnad15Dzc/OksXRYQF2U x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM7PR07MB6248.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(6506007)(26005)(186003)(7696005)(9686003)(110136005)(64756008)(55016003)(966005)(71200400001)(33656002)(76116006)(91956017)(66556008)(66946007)(66476007)(8676002)(66446008)(38070700005)(508600001)(86362001)(4744005)(8936002)(316002)(83380400001)(5660300002)(2906002)(122000001)(38100700002)(82960400001)(52536014); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?uNW+XIIiMrdLO/ydw86xcgp19MpsQbbd4ZJevRH5wVAAJqs0NGEqOY/1Wb?= =?iso-8859-1?Q?l0aEIkSeLy9kqWiwIp2pTuPVjDWnWEuS6mR/XYC5FKCUlnuCtEvG5NXiBE?= =?iso-8859-1?Q?LfHpaxhvv9eTYT0ZN6M44fDBsnlSUd80JEqAdd2ZfLX5o5AnxCAc7A5YCJ?= =?iso-8859-1?Q?VNmePwtwfjaiBwS+wW9Pr/ttsjmVdVMpsQTN3+BzPp7kWCN7TvZJTzKqLb?= =?iso-8859-1?Q?nbai4GGENNKChneF8W9OvAS6AcYezcDTU9IYK1tKUvfklFYX8T3Z5rxjbe?= =?iso-8859-1?Q?GNys/T6L5ZwYH6bmLDcskSI2dGue4DkUKXpugrx4u2GLTqkHEB3Oxf8OFZ?= =?iso-8859-1?Q?eTQFbMwtZlWYWE7c3Fv6EhZp8R4klFeVa1VPeJKv+qlL0LvWilqs8Qy0+s?= =?iso-8859-1?Q?HxhuVDVFJw1eg/YzGvOy2uc66cmNz7ookCTCjiBS4QK1jnHGWWEXopSoKq?= =?iso-8859-1?Q?jsHBXsI+6QIrJM0pHtH5DQDlCgSenTsZ8yjE8n/UHpGRckqv9Vz8myQyjQ?= =?iso-8859-1?Q?WSNgycg5AiuPQ//mfyWdHIUSztCznH9ZmfgitoQTxIPk+2KJDvSgtiioKS?= =?iso-8859-1?Q?KP/dlDSOT1TozlwtRtctmlmNF5MbPmR6Pm7TYs9kbAwT0vrsvoFrXBQg78?= =?iso-8859-1?Q?4ZAQp/k8XJLPIR5/k30g7UjgS3K/ZvgcqbJkNdCezW61am+BsaKPc2TNhz?= =?iso-8859-1?Q?44AQ3UTQJLh38XmMqUxqY5P1r1mVegwxHBAgMKjoqdChJ2sTpPg2QXKWe/?= =?iso-8859-1?Q?YHin31k7t8Hm1EQ6izt/3A2YVtVQBa/yyerd/YnuyhaZCLYYnogiiRXGc1?= =?iso-8859-1?Q?sf31+s+/7VcSnq2FlcAkpPRjsWESqiKLrUuA9CS0v8lzh0J4DwtiXa6BFx?= =?iso-8859-1?Q?xWLRAO8b44C94g6iI2mXpEwUep/aSAmFevms06qa6hB42Du1tz8q+TAqFk?= =?iso-8859-1?Q?YSU9f9q/LBBqio2Q6Lm6S4mnsM5pV+d+eRdNhlN0XVFVhpq+XLLhkYWdb7?= =?iso-8859-1?Q?E0GCU1pGpq/zk2DgpLnF+WruWKfYwilv/XEJlFKrUZgN+L1gC/bt+NrnrJ?= =?iso-8859-1?Q?1R0kpu5SQn3669pnR4C5QRg9RTu7EvT6cwq0NhU//2Di7XBlVGU+tCLGsD?= =?iso-8859-1?Q?3m/64kBg/j3Y53vtXOmX6gSpt4sQd1o3QQhuqWR35rpsUG+nTzzVH7LiUm?= =?iso-8859-1?Q?cSXUUoOmeM5fmIdmI8uF/kHsUtrFjbUTxN+JQcxCKS2IBtmV2wAblBZYYg?= =?iso-8859-1?Q?5W5EXVda6Zk8uVMg0XJDqEfK8GbGg8LYOzr9vayfAjLwE3C5FTNt0YZxiT?= =?iso-8859-1?Q?7t2jZVefZRefmqHnBsRyX7DCV5Vs7vfI+tbhZC+BiPO6nf0zifPB+hpXyf?= =?iso-8859-1?Q?n96BCZ4PSAFZGGxC4gsaPFydnzyF/7iebdVWAPi1btbfkEP6hUerKDJkcP?= =?iso-8859-1?Q?grc9Y/oUZBPhw2OP0HrVAg6UqViRIM6vE+J9XyYo0RbKR9PY/YwaglLo7N?= =?iso-8859-1?Q?N5W20412z+AoCLq4k/hdPLzBpb60nanRO1S5/UV9t3QnJRi+z2niZHZBPJ?= =?iso-8859-1?Q?s11pEauxDmWTEwdSJpyHN+McCRce13FL0tgIn4WZY89xGofDnf3HJd/8NV?= =?iso-8859-1?Q?Wj5kJxY/xTiCIoof8Q0iGdRZFDq5II2thQCITgmbwRXLzuI8sDH1bnvCfb?= =?iso-8859-1?Q?TTQrNuLnnLkkTFqOPGFovmjoitjfywaiR7tj+uA5wb8SyJKRCli5hFj4Pm?= =?iso-8859-1?Q?mfwLGnmMDypO8AX4JJ9Fro0azG+oMQoDTsND63bkWZmnCxErMz0DOehw+w?= =?iso-8859-1?Q?IaJ1lgK4Dg=3D=3D?= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: btconnect.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM7PR07MB6248.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 64195a96-920f-49f2-d4be-08da10ae1055 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2022 11:28:21.0448 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf8853ed-96e5-465b-9185-806bfe185e30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: YJzsaHywcCLvDoYXdEmrfpVQUzM3CumjCfq0POP7i7MP7zceIKqmtlLrQXYFWMjGlA6/mA4HoT6qL/E7utl91g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR0702MB3650 Archived-At: Subject: Re: [Syslog] Comments and 0-RTT in draft-ciphersuites-in-sec-syslog X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Mar 2022 11:28:31 -0000 From: Syslog on behalf of Chris Lonvick =0A= Sent: 14 March 2022 13:04=0A= =0A= Hi Folks,=0A= =0A= Just checking to see if anyone has any comments on the ciphersuits draft?= =0A= =0A= =0A= Since there is no syslog WG in the IETF, I think that this I-D is in need o= f a home if it is to progress, then perhaps a name change. As intensely as= I dislike changing an I-D name, except at adoption, since it makes the wor= k so hard for me to track, as and when it finds a home a name change to ref= lect that WG would perhaps be the least bad option.=0A= =0A= Tom Petch=0A= =0A= https://datatracker.ietf.org/doc/draft-ciphersuites-in-sec-syslog/01/=0A= =0A= In there, we have a placeholder for 0-RTT. Any suggestions about that=0A= will be greatly welcome.=0A= =0A= Thanks and Regards,=0A= =0A= Chris=0A= =0A= _______________________________________________=0A= Syslog mailing list=0A= Syslog@ietf.org=0A= https://www.ietf.org/mailman/listinfo/syslog=0A= From nobody Tue Mar 29 18:55:53 2022 Return-Path: X-Original-To: syslog@ietfa.amsl.com Delivered-To: syslog@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 260B23A19EE for ; Tue, 29 Mar 2022 18:55:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GMwJjG7yq390 for ; Tue, 29 Mar 2022 18:55:46 -0700 (PDT) Received: from cmccmta1.chinamobile.com (cmccmta1.chinamobile.com [221.176.66.79]) by ietfa.amsl.com (Postfix) with ESMTP id 3F4783A19ED for ; Tue, 29 Mar 2022 18:55:45 -0700 (PDT) X-RM-TagInfo: emlType=0 X-RM-SPAM-FLAG: 00000000 Received: from spf.mail.chinamobile.com (unknown[172.16.121.9]) by rmmx-syy-dmz-app03-12003 (RichMail) with SMTP id 2ee36243b89f0e0-b5b47; Wed, 30 Mar 2022 09:55:43 +0800 (CST) X-RM-TRANSID: 2ee36243b89f0e0-b5b47 X-RM-TagInfo: emlType=0 X-RM-SPAM-FLAG: 00000000 Received: from cmcc-PC (unknown[10.2.51.26]) by rmsmtp-syy-appsvr05-12005 (RichMail) with SMTP id 2ee56243b89dbdf-88ea6; Wed, 30 Mar 2022 09:55:43 +0800 (CST) X-RM-TRANSID: 2ee56243b89dbdf-88ea6 Date: Wed, 30 Mar 2022 09:55:47 +0800 From: "Meiling Chen" To: "tom petch" , syslog Cc: suli References: <2022031509525088032316@chinamobile.com>, X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.2.9.115[cn] Mime-Version: 1.0 Message-ID: <202203300955470254831@chinamobile.com> Content-Type: multipart/alternative; boundary="----=_001_NextPart872110134171_=----" Archived-At: Subject: Re: [Syslog] Fw: New Version Notification for draft-chen-syslog-syscinfo-credibility-00.txt X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Mar 2022 01:55:52 -0000 This is a multi-part message in MIME format. ------=_001_NextPart872110134171_=---- Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: base64 SGkgdG9tLA0KV2UgaGF2ZSBpbmRlZWQgY29uc2lkZXJlZCB0aGlzIGlzc3VlLiBXZSBoYXZlIHJl Y2VpdmVkIHNvbWUgc3VnZ2VzdGlvbnMgZnJvbSB0aGUgd29ya2luZyBncm91cC4gDQpPZiBjb3Vy c2UsIHdlIGFsc28gaG9wZSB0byBnZXQgbW9yZSBzdWdnZXN0aW9ucyBieSBzZW5kaW5nIHRoZW0g b24gdGhlIGVtYWlsIGxpc3QuDQoNCkJlc3QsDQpNZWlsaW5nIA0KRnJvbTogdG9tIHBldGNoDQpE YXRlOiAyMDIyLTAzLTI4IDE5OjI0DQpUbzogTWVpbGluZyBDaGVuOyBzeXNsb2cNCkNDOiBzdWxp DQpTdWJqZWN0OiBSZTogW1N5c2xvZ10gRnc6IE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBmb3Ig ZHJhZnQtY2hlbi1zeXNsb2ctc3lzY2luZm8tY3JlZGliaWxpdHktMDAudHh0DQpGcm9tOiBTeXNs b2cgPHN5c2xvZy1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgTWVpbGluZyBDaGVuIDxj aGVubWVpbGluZ0BjaGluYW1vYmlsZS5jb20+DQpTZW50OiAxNSBNYXJjaCAyMDIyIDAxOjUyDQog DQpIaSBmb2xrcywNClRoaXMgZHJhZnQgaXMgYWJvdXQgc3lzbG9nIHdoaWNoIHVzZWQgdG8gaW1w cm92ZSBsb2dnaW5nIGNyZWRpYmlsaXR5IGJ5IGFkZGluZyBzeW5jaHJvbml6YXRpb24gdGltZSBp bmZvcm1hdGlvbi4NClRoZSB0cmlnZ2VyIG9mIHRoaXMgZHJhZnQgaXMgdGhhdCB3ZSBmb3VuZCB0 aGUgYXR0YWNrIHZ1bG5lcmFiaWxpdHkgb2Ygc3lzbG9nIHRpbWUgc3luY2hyb25pemF0aW9uIGR1 cmluZyB0aGUgZXhwZXJpbWVudCwgdGhlIHB1cnBvc2UgaXMgdG8gaW1wcm92ZSByZmM1NDI0IHdp dGggYSBzbGlnaHQgbW9kaWZpY2F0aW9uLg0KQW5kIHRoZSBkcmFmdCBhaW1lZCBhdCB0aGUgZGlz Y3Vzc2lvbiBvZiBjcmVkaWJpbGl0eSB3aGVuIHRoZSB2YWx1ZSAiMSIgaXMgdXNlZCBmb3IgImlz U3luY2VkIi4NCldlIGhhdmUgcmVjZWl2ZWQgc29tZSBzdWdnZXN0aW9ucyBmcm9tIFNlYW4gYW5k IGxvbnZpY2ssIHdpbGwgYWxzbyB1cGRhdGUgdGhlIHZlcnNpb24gYWZ0ZXIgb3BlbiBzdWJtaXNz aW9uLg0KSWYgYW55b25lIGlzIGludGVyZXN0ZWQgaW4gdGhpcyB0b3BpYywgcGxlYXNlIGZlZWwg ZnJlZSB0byBjb21tZW50Lg0KIA0KPHRwPg0KVGhlcmUgaXMgbm8gc3lzbG9nIFdHIGluIHRoZSBJ RVRGIHNvIGlmIHRoZSB3b3JrIGlzIHRvIHByb2dyZXNzLCBpdCBsaWtlbHkgbmVlZHMgdG8gZmlu ZCBhIGhvbWUgaW4gYSBhIFdHIHRoYXQgaXMuDQogDQpUb20gUGV0Y2gNCiANCkJlc3QsDQpNZWls aW5nDQogDQpGcm9tOiBpbnRlcm5ldC1kcmFmdHM8bWFpbHRvOmludGVybmV0LWRyYWZ0c0BpZXRm Lm9yZz4NCkRhdGU6IDIwMjItMDMtMDcgMTA6MTgNClRvOiBGZW5nc2hlbmcgV2FuZzxtYWlsdG86 d2FuZ2ZlbmdzaGVuZ0BjaGluYW1vYmlsZS5jb20+OyBMaSBTdTxtYWlsdG86c3VsaUBjaGluYW1v YmlsZS5jb20+OyBNZWlsaW5nIENoZW48bWFpbHRvOmNoZW5tZWlsaW5nQGNoaW5hbW9iaWxlLmNv bT47IGNoZW5tZWlsaW5nPG1haWx0bzpjaGVubWVpbGluZ0BjaGluYW1vYmlsZS5jb20+DQpTdWJq ZWN0OiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LWNoZW4tc3lzbG9nLXN5c2Np bmZvLWNyZWRpYmlsaXR5LTAwLnR4dA0KIA0KQSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0LWNo ZW4tc3lzbG9nLXN5c2NpbmZvLWNyZWRpYmlsaXR5LTAwLnR4dA0KaGFzIGJlZW4gc3VjY2Vzc2Z1 bGx5IHN1Ym1pdHRlZCBieSBNZWlsaW5nIENoZW4gYW5kIHBvc3RlZCB0byB0aGUNCklFVEYgcmVw b3NpdG9yeS4NCiANCk5hbWU6IGRyYWZ0LWNoZW4tc3lzbG9nLXN5c2NpbmZvLWNyZWRpYmlsaXR5 DQpSZXZpc2lvbjogMDANClRpdGxlOiBJbXByb3ZlIGxvZ2dpbmcgY3JlZGliaWxpdHkgYnkgYWRk aW5nIHN5bmNocm9uaXphdGlvbiB0aW1lIGluZm9ybWF0aW9uDQpEb2N1bWVudCBkYXRlOiAyMDIy LTAzLTA2DQpHcm91cDogSW5kaXZpZHVhbCBTdWJtaXNzaW9uDQpQYWdlczogNg0KVVJMOiAgICAg ICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL2FyY2hpdmUvaWQvZHJhZnQtY2hlbi1zeXNsb2ct c3lzY2luZm8tY3JlZGliaWxpdHktMDAudHh0DQpTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY2hlbi1zeXNsb2ctc3lzY2luZm8tY3JlZGliaWxp dHkvDQpIdG1sOiAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvYXJjaGl2ZS9pZC9kcmFm dC1jaGVuLXN5c2xvZy1zeXNjaW5mby1jcmVkaWJpbGl0eS0wMC5odG1sDQpIdG1saXplZDogICAg ICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1jaGVuLXN5c2xv Zy1zeXNjaW5mby1jcmVkaWJpbGl0eQ0KIA0KIA0KQWJzdHJhY3Q6DQogICBUaGlzIGRvY3VtZW50 IHByb3Bvc2VzIGEgc2NoZW1lIHRvIGltcHJvdmUgdGhlIGNyZWRpYmlsaXR5IG9mIGxvZw0KICAg cmVwb3J0aW5nIHRpbWUgYnkgYWRkaW5nIHRpbWUgc3luY2hyb25pemF0aW9uIGluZm9ybWF0aW9u Lg0KIA0KICAgVGhpcyBkb2N1bWVudCB1cGRhdGVzIHRoZSAidGltZVF1YWxpdHkiIHN0cnVjdHVy ZWQgRGF0YSBpbiBSRkMgNTQyNA0KICAgW1JGQzU0MjRdLCBUaGUgU3lzbG9nIFByb3RvY29sLiAg QnkgYXBwZW5kaW5nICJTWU5DSU5GTyIgaW5mb3JtYXRpb24NCiAgIGFmdGVyIHRoZSAiaXNTeW5j ZWQiIHBhcmFtZXRlciwgdGhlIGxvZyBjb2xsZWN0b3IgY2FuIGp1ZGdlIHRoZQ0KICAgY3JlZGli aWxpdHkgb2YgbG9ncyB3aGVuIGNvcnJlbGF0aW5nIGxvZ3Mgb2YgZGlmZmVyZW50IGRldmljZXMu DQogDQogDQogDQogDQpUaGUgSUVURiBTZWNyZXRhcmlhdA0KIA0KIA0KIA0KIA0K ------=_001_NextPart872110134171_=---- Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable =0A
Hi tom,
We have indeed considered this = issue. We have received some suggestions from the working group. 
Of course, we also hope to get more suggestions by sending them on = the email list.

Best,
Meiling=  
From: tom petch
Date:&n= bsp;2022-03-28 19:24
CC: suli
Subject: Re: [Syslog] Fw: New Versio= n Notification for draft-chen-syslog-syscinfo-credibility-00.txt
From: Syslog <syslog-bounces@ietf.org> on behalf o= f Meiling Chen <chenmeiling@chinamobile.com>
=0A
Sent: 15 M= arch 2022 01:52
=0A
 
=0A
Hi folks,
=0A
Th= is draft is about syslog which used to improve logging credibility by addi= ng synchronization time information.
=0A
The trigger of this draf= t is that we found the attack vulnerability of syslog time synchronization= during the experiment, the purpose is to improve rfc5424 with a slight mo= dification.
=0A
And the draft aimed at the discussion of credibil= ity when the value "1" is used for "isSynced".
=0A
We have receiv= ed some suggestions from Sean and lonvick, will also update the version af= ter open submission.
=0A
If anyone is interested in this topic, p= lease feel free to comment.
=0A
 
=0A
<tp>=0A
There is no syslog WG in the IETF so if the work is to progress= , it likely needs to find a home in a a WG that is.
=0A
 =0A
Tom Petch
=0A
 
=0A
Best,
=0A
M= eiling
=0A
 
=0A
From: internet-drafts<mailto:in= ternet-drafts@ietf.org>
=0A
Date: 2022-03-07 10:18
=0ATo: Fengsheng Wang<mailto:wangfengsheng@chinamobile.com>; Li Su<= ;mailto:suli@chinamobile.com>; Meiling Chen<mailto:chenmeiling@china= mobile.com>; chenmeiling<mailto:chenmeiling@chinamobile.com>=0A
Subject: New Version Notification for draft-chen-syslog-syscinfo-= credibility-00.txt
=0A
 
=0A
A new version of I-D, = draft-chen-syslog-syscinfo-credibility-00.txt
=0A
has been succes= sfully submitted by Meiling Chen and posted to the
=0A
IETF repos= itory.
=0A
 
=0A
Name: draft-chen-syslog-syscinfo-c= redibility
=0A
Revision: 00
=0A
Title: Improve logging c= redibility by adding synchronization time information
=0A
Documen= t date: 2022-03-06
=0A
Group: Individual Submission
=0A
= Pages: 6
=0A
URL:        =     https://www.ietf.org/archive/id/draft-chen-syslog-sysci= nfo-credibility-00.txt
=0A
Status:     &= nbsp;   https://datatracker.ietf.org/doc/draft-chen-syslog-sysci= nfo-credibility/
=0A
Html:      &nb= sp;    https://www.ietf.org/archive/id/draft-chen-syslog-sy= scinfo-credibility-00.html
=0A
Htmlized:    &= nbsp;  https://datatracker.ietf.org/doc/html/draft-chen-syslog-syscin= fo-credibility
=0A
 
=0A
 
=0A
Abstra= ct:
=0A
   This document proposes a scheme to improve t= he credibility of log
=0A
   reporting time by adding t= ime synchronization information.
=0A
 
=0A
 &n= bsp; This document updates the "timeQuality" structured Data in RFC 5424=0A
   [RFC5424], The Syslog Protocol.  By appendin= g "SYNCINFO" information
=0A
   after the "isSynced" pa= rameter, the log collector can judge the
=0A
   credibi= lity of logs when correlating logs of different devices.
=0A
&nbs= p;
=0A
 
=0A
 
=0A
 
=0AThe IETF Secretariat
=0A
 
=0A
 
=0A 
=0A
 
=0A
------=_001_NextPart872110134171_=------