Subject: IAP/0.4 questions

From: "Michael J. Slifcak" <[email-masked]>
Date: Tue, 20 Feb 2001 12:37:34 -0500

Hi.  Please accept my apologies if these questions have been asked
and answered already.  I didn't see discussion in the IDWG e-mail
archive that indicated answers were given.

Referring to the iap-content message :
  Does the protocol allow more than one alert to be packaged in
    the IDMEF-Message section ?

Referring to the specification of the cipher suite :
  Suggest changing 'ciphersuite' to 'cipher suite'.
  Suggest changing '-' to '_' to more closely follow RFC 2595;
     Result would be "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA".

Best Regards,
-Mike Slifcak, Internet Security Systems, Inc.

---

From: Ben Feinstein <[email-masked]>
Date: Tue, 20 Feb 2001 12:59:37 -0800 (PST)

>     the IDMEF-Message section ?

The protocol should support the exchange of multiple IDMEF-Message
elements in a single iap-content-request message.  Its not clear to me
when I reread the draft that we made that explicit anywhere.  My
understanding is that an IDMEF-Message element can contain multiple Alert
elements.  So, yes, IAP supports multiple alerts per iap-content-request,
but we should be more explicit I think.

>      Result would be "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA".

Done.

Cheers,

Ben Feinstein
Harvey Mudd College, Computer Science