Over the course of a reasonably long session, syslog-sign will transmit the certificate, public key, or key ID on which its signatures are based several times. Syslog-sign will provide data integrity, data origin authentication, replay detection, and gap detection. How the administrator sets things up to support this is outside the scope of this document, but if messages from the same signature group are somehow separated during transmission or forwarding, we will generally be unable to authenticate the messages stored by any one collector. However, syslog-sign can be configured on the sender side to add redundancy to its messages, to decrease the likelihood that any messages will be impossible to verify. These are encoded in its version field.
Larger signatures lead to more bandwidth required by syslog-sign.
Syslog-sign even supports symmetric cryptosystems. That means that all of its messages have to fit inside legal syslog-syslog messages. This determines most of the design. A certificate block contains some or all of the information needed to uniquely identify the key being used in these signatures. A signature block contains a signature for a sequence of messages sent by syslog-sign.