Issue 2: TAG Field Definition

[Chris Lonvick <clonvick@cisco.com>]

Issue 2: TAG Field Definition
http://www.employees.org/~lonvick/draft-ietf-syslog-sign-12.html#HEADER

>From Archive:
http://www.mail-archive.com/syslog-sec%40employees.org/msg01224.html
http://www.mail-archive.com/syslog-sec%40employees.org/msg01234.html
http://www.mail-archive.com/syslog-sec%40employees.org/msg01222.html

Rainer has proposed the following text:
"""
   The TAG is a string of visible (printing) characters excluding SP,
   that MUST NOT exceed 32 characters in length.

   The first occurrence of a colon (":") or SP " " character terminates
   the TAG field. Generally, the TAG contains the name of the process
   that generated the message. It may OPTIONALLY contain additional
   information such as the numerical process ID of that process bound
   within square brackets ("[" and "]"). A colon MUST be the last
   character in this field.

   To be consistent with the format described in RFC 3164, a space
   character need not follow the colon in normal syslog packets.
"""

However, anyone trying to convey information of "Myproc[PID,Threadid]:"
may have a problem with something like

  syslog[12345,C:\usr\sbin\cron]:

Albert suggests just having "syslog" in the cert/sig-block messages
but that seems to be inconsistent with the possible formats of the
normal syslog messages.

Can anyone offer a suggestion to resolve this?