From zhou.sujing@zte.com.cn Wed Feb 1 00:08:46 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C8EF11E80CC; Wed, 1 Feb 2012 00:08:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -92.59 X-Spam-Level: X-Spam-Status: No, score=-92.59 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, RCVD_IN_DNSWL_LOW=-1, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YurmfJqzSwBl; Wed, 1 Feb 2012 00:08:45 -0800 (PST) Received: from mx7.zte.com.cn (mx7.zte.com.cn [202.103.147.169]) by ietfa.amsl.com (Postfix) with ESMTP id 6A0C711E80CA; Wed, 1 Feb 2012 00:08:43 -0800 (PST) Received: from [10.30.3.21] by [192.168.168.15] with StormMail ESMTP id 5467.3618403124; Wed, 1 Feb 2012 16:08:39 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q1188TGR075131; Wed, 1 Feb 2012 16:08:30 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: <1c680c52d4a354cdeda0a39e9cc47d32.squirrel@www.trepanning.net> To: "Dan Harkins" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Wed, 1 Feb 2012 16:08:23 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-02-01 16:08:32, Serialize complete at 2012-02-01 16:08:32 Content-Type: multipart/alternative; boundary="=_alternative 002CAA3E48257997_=" X-MAIL: mse02.zte.com.cn q1188TGR075131 Cc: cfrg-bounces@irtf.org, cfrg@irtf.org, saag@ietf.org, Steven Bellovin Subject: [Cfrg] =?gb2312?b?tPC4tDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNo?= =?gb2312?b?ZWQgUGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2012 08:08:46 -0000 This is a multipart message in MIME format. --=_alternative 002CAA3E48257997_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 SGksIFN0ZXZlbiwNCg0KDQoNCg0KY2ZyZy1ib3VuY2VzQGlydGYub3JnINC009ogMjAxMi0wMS0w NyAxNzowMzoyNToNCg0KPiANCj4gDQo+IE9uIFdlZCwgSmFudWFyeSA0LCAyMDEyIDI6NTYgcG0s IFN0ZXZlbiBCZWxsb3ZpbiB3cm90ZToNCj4gPiBHb29kIHBvaW50OyBsZXQgbWUgdGhpbmsgYWJv dXQgaXQgZm9yIC0wMS4gIEFuIG9idmlvdXMgc29sdXRpb24gaXMgdG8gDQpzZW5kDQo+ID4gdGhl IGhvc3RuYW1lIHdpdGggdGhlIGVmZmVjdGl2ZSBwYXNzd29yZC4NCj4gDQo+ICAgSG93IGlzIHRo YXQgZGlmZmVyZW50IHRoYW4gdXNpbmcgcmFuZG9tIHNhbHQgdGhlbj8gSWYgX3NvbWV0aGluZ18g aXMNCj4gZ29pbmcgdG8gYmUgc2VudCBzaG91bGRuJ3QgaXQgYmUgYSB1bmlmb3JtbHkgcmFuZG9t IGJpdHN0cmluZyBpbnN0ZWFkIG9mDQo+IGEgaG9zdG5hbWU/DQo+IA0KPiAgIEEgdW5pZm9ybWx5 IHJhbmRvbSBiaXRzdHJpbmcgd291bGQgYmUgbW9yZSBhcHByb3ByaWF0ZSBhcyBhIGtleSB0bw0K PiBITUFDIHRoYW4gYSBoaWdobHkgc3RydWN0dXJlZCBzdHJpbmcgbGlrZSBhIHBhc3N3b3JkIHRv by4gSXRlcmF0ZQ0KPiBITUFDKHNhbHQsIHBhc3N3b3JkIHwgc2VydmljZS1VUkkpIGluc3RlYWQg b2YgSE1BQyhwYXNzd29yZCwgDQpzZXJ2aWNlLVVSSSkuDQoNCkkgdGhpbmsgRGFuJ3Mgc3VnZ2Vz dGlvbiBpcyByZWFzb25hYmxlLCBJIGNoZWNrZWQgdGhlIFJGQyAyMTA0IGFuZCBmb3VuZCANCnRo ZSBmb2xsb3dpbmcgc2VjdGlvbiA6DQoNCiIzLiBLZXlzDQoNCiAgIFRoZSBrZXkgZm9yIEhNQUMg Y2FuIGJlIG9mIGFueSBsZW5ndGggKGtleXMgbG9uZ2VyIHRoYW4gQiBieXRlcyBhcmUNCiAgIGZp cnN0IGhhc2hlZCB1c2luZyBIKS4gIEhvd2V2ZXIsIGxlc3MgdGhhbiBMIGJ5dGVzIGlzIHN0cm9u Z2x5DQogICBkaXNjb3VyYWdlZCBhcyBpdCB3b3VsZCBkZWNyZWFzZSB0aGUgc2VjdXJpdHkgc3Ry ZW5ndGggb2YgdGhlDQogICBmdW5jdGlvbi4gIEtleXMgbG9uZ2VyIHRoYW4gTCBieXRlcyBhcmUg YWNjZXB0YWJsZSBidXQgdGhlIGV4dHJhDQogICBsZW5ndGggd291bGQgbm90IHNpZ25pZmljYW50 bHkgaW5jcmVhc2UgdGhlIGZ1bmN0aW9uIHN0cmVuZ3RoLiAoQQ0KICAgbG9uZ2VyIGtleSBtYXkg YmUgYWR2aXNhYmxlIGlmIHRoZSByYW5kb21uZXNzIG9mIHRoZSBrZXkgaXMNCiAgIGNvbnNpZGVy ZWQgd2Vhay4pDQoNCiAgIEtleXMgbmVlZCB0byBiZSBjaG9zZW4gYXQgcmFuZG9tIChvciB1c2lu ZyBhIGNyeXB0b2dyYXBoaWNhbGx5IHN0cm9uZw0KICAgcHNldWRvLXJhbmRvbSBnZW5lcmF0b3Ig c2VlZGVkIHdpdGggYSByYW5kb20gc2VlZCksIGFuZCBwZXJpb2RpY2FsbHkNCiAgIHJlZnJlc2hl ZC4gIChDdXJyZW50IGF0dGFja3MgZG8gbm90IGluZGljYXRlIGEgc3BlY2lmaWMgcmVjb21tZW5k ZWQNCiAgIGZyZXF1ZW5jeSBmb3Iga2V5IGNoYW5nZXMgYXMgdGhlc2UgYXR0YWNrcyBhcmUgcHJh Y3RpY2FsbHkNCiAgIGluZmVhc2libGUuICBIb3dldmVyLCBwZXJpb2RpYyBrZXkgcmVmcmVzaG1l bnQgaXMgYSBmdW5kYW1lbnRhbA0KICAgc2VjdXJpdHkgcHJhY3RpY2UgdGhhdCBoZWxwcyBhZ2Fp bnN0IHBvdGVudGlhbCB3ZWFrbmVzc2VzIG9mIHRoZQ0KICAgZnVuY3Rpb24gYW5kIGtleXMsIGFu ZCBsaW1pdHMgdGhlIGRhbWFnZSBvZiBhbiBleHBvc2VkIGtleS4pIg0KDQoNClNpbmNlIHBhc3N3 b3JkcyBhcmUgb2Z0ZW4gbm90IHRvbyBsb25nLCBhbmQgbm90IHNvIHJhbmRvbSwgaXQgaXMgYmV0 dGVyIA0KdG8gaGFzaCBpdCBiZWZvcmUgdXNpbmcgaXQgYXMgYSBrZXkgaW4gYSBITUFDLiANCg0K DQpSZWdhcmRzfn5+DQoNCi1TdWppbmcgWmhvdQ0KDQo+IA0KPiAgIFRoYXQgc2FpZCwgZ29hbCA0 IGluIHRoZSBkcmFmdC0tICJCeSBpdGVyYXRpbmcgYSBzdWZmaWNpZW50IG51bWJlciBvZg0KPiB0 aW1lcywgZGljdGlvbmFyeSBhdHRhY2tzIGNhbiBiZSBtYWRlIGFyYml0cmFyaWx5IGV4cGVuc2l2 ZSItLSBzZWVtcyBhDQo+IGJpdCBtaXNndWlkZWQuIFRoZSBBbWF6b24gY2xvdWQgc2VydmljZSBo YXMgYmVlbiB1c2VkIHRvIGxhdW5jaCBhbg0KPiBvZmYtbGluZSBkaWN0aW9uYXJ5IGF0dGFjayBh Z2FpbnN0IHRoZSBXUEEtUFNLIHByb3RvY29sIHdoaWNoIHVzZXMgDQpQQktERjINCj4gKEhNQUMt U0hBMSkgd2l0aCA0MDk2IGl0ZXJhdGlvbnMgdG8gb2JmdXNjYXRlIGEgcGFzc3dvcmQuIFRoaXMg YXR0YWNrDQo+IGNoZWNrcyAyNCwwMDAsMDAwIGNhbmRpZGF0ZSBwYXNzd29yZHMgcGVyIG1pbnV0 ZSBhdCBhIGNvc3Qgb2YgJDAuMjguDQo+IFRoYXQncyBtb3JlIHRoYW4gMSw2MDAsMDAwLDAwMCBp dGVyYXRpb25zIHBlciBzZWNvbmQgZm9yIGFib3V0IDEvMiBhIA0KY2VudC4NCj4gU28gSSBkb24n dCB0aGluayBpbmNyZWFzZWQgaXRlcmF0aW9uIG1ha2VzIGRpY3Rpb25hcnkgYXR0YWNrcyBtdWNo IG1vcmUNCj4gZXhwZW5zaXZlLg0KPiANCj4gICBXaGljaCBiZWdzIHRoZSBxdWVzdGlvbiwgaG93 IGlzIHRoaXMgcHJvcG9zYWwgZGlmZmVyZW50IHRoYW4gUEJLREYyPw0KPiBUaGF0IHRoZSAic2Fs dCIgaXMgYSBzZXJ2aWNlIFVSST8NCj4gDQo+ICAgcmVnYXJkcywNCj4gDQo+ICAgRGFuLg0KPiAN Cj4gPiBPbiBKYW4gNCwgMjAxMiwgYXQgNToyMSAwMVBNLCBKb2UgVG91Y2ggd3JvdGU6DQo+ID4N Cj4gPj4gSGksIFN0ZXZlLA0KPiA+Pg0KPiA+PiBUaGlzIGRvYyBkb2Vzbid0IGFwcGVhciB0byBh ZGRyZXNzIHRoZSBjYXNlIHdoZXJlIGEgaG9zdCBoYXMgbXVsdGlwbGUNCj4gPj4gRE5TIG5hbWVz LCB3aGljaCBjb3VsZCBtYWtlIGl0IGRpZmZpY3VsdCB0byBpbmNvcnBvcmF0ZSB0aGUgaG9zdG5h bWUNCj4gPj4gaW50byB0aGUgdHJhbnNmb3JtLiBJLmUuLCBJIGNvdWxkIGNvbnRhY3QgYSBtYWls IHNlcnZlciBhdCBhbiBJUCANCmFkZHJlc3MNCj4gPj4gdGhhdCByZXByZXNlbnRzIGFueSBvZiBk b3plbnMgb2YgRE5TIG5hbWVzIC0gaG93IGRvZXMgdGhlIHNlcnZlciBrbm93DQo+ID4+IHdoaWNo IG9uZSBJIHVzZWQgc28gaXQgY2FuIG1hdGNoIHdpdGhvdXQgZXhoYXVzdGl2ZWx5IHRyeWluZyBh bGwgaXRzDQo+ID4+IGVxdWl2YWxlbnQgbmFtZXM/DQo+ID4+DQo+ID4+IEpvZQ0KPiA+Pg0KPiA+ PiBPbiAxLzQvMjAxMiAxOjQxIFBNLCBTdGV2ZW4gQmVsbG92aW4gd3JvdGU6DQo+ID4+PiBJJ2Qg YXBwcmVjaWF0ZSBjb21tZW50cyBvbiBteSBuZXcgZHJhZnQsIGRyYWZ0LWJlbGxvdmluLWhwdy0w MC50eHQ6DQo+ID4+Pg0KPiA+Pj4gQWJzdHJhY3QNCj4gPj4+DQo+ID4+PiAgICBNYW55IHN5c3Rl bXMgKGUuZy4sIGNyeXB0b2dyYXBoaWMgcHJvdG9jb2xzIHJlbHlpbmcgb24gc3ltbWV0cmljDQo+ ID4+PiAgICBjcnlwdG9ncmFwaHkpIHJlcXVpcmUgdGhhdCBwbGFpbnRleHQgcGFzc3dvcmRzIGJl IHN0b3JlZC4gIEdpdmVuIA0KaG93DQo+ID4+PiAgICBvZnRlbiBwZW9wbGUgcmV1c2UgcGFzc3dv cmRzIG9uIGRpZmZlcmVudCBzeXN0ZW1zLCB0aGlzIHBvc2VzIGEgDQp2ZXJ5DQo+ID4+PiAgICBz ZXJpb3VzIHJpc2sgaWYgYSBzaW5nbGUgbWFjaGluZSBpcyBjb21wcm9taXNlZC4gIFdlIHByb3Bv c2UgYQ0KPiA+Pj4gc2NoZW1lDQo+ID4+PiAgICB0byBkZXJpdmUgcGFzc3dvcmRzIGxpbWl0ZWQg dG8gYSBzaW5nbGUgbWFjaGluZSBmcm9tIGEgdHlwZWQNCj4gPj4+ICAgIHBhc3N3b3JkLCBhbmQg ZXhwbGFpbiBob3cgYSBwcm90b2NvbCBkZWZpbml0aW9uIGNhbiBzcGVjaWZ5IHRoaXMNCj4gPj4+ ICAgIHNjaGVtZS4NCj4gPj4+DQo+ID4+Pg0KPiA+Pj4gICAgICAgLS1TdGV2ZSBCZWxsb3Zpbiwg aHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35zbWINCj4gPj4+DQo+ID4+Pg0KPiA+Pj4NCj4g Pj4+DQo+ID4+Pg0KPiA+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCj4gPj4+IHNhYWcgbWFpbGluZyBsaXN0DQo+ID4+PiBzYWFnQGlldGYub3JnDQo+ ID4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWcNCj4gPj4NCj4g Pg0KPiA+DQo+ID4gICAgICAgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29sdW1i aWEuZWR1L35zbWINCj4gPg0KPiA+DQo+ID4NCj4gPg0KPiA+DQo+ID4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gPiBzYWFnIG1haWxpbmcgbGlzdA0K PiA+IHNhYWdAaWV0Zi5vcmcNCj4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3NhYWcNCj4gPg0KPiANCj4gDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQo+IENmcmcgbWFpbGluZyBsaXN0DQo+IENmcmdAaXJ0Zi5vcmcNCj4g aHR0cDovL3d3dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NmcmcNCj4gDQoNCg== --=_alternative 002CAA3E48257997_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkhpLCBTdGV2ZW4sPC9mb250Pg0K PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPjx0dD48Zm9udCBzaXplPTI+Y2ZyZy1ib3VuY2Vz QGlydGYub3JnINC009ogMjAxMi0wMS0wNyAxNzowMzoyNTo8YnI+DQo8YnI+DQomZ3Q7IDxicj4N CiZndDsgPGJyPg0KJmd0OyBPbiBXZWQsIEphbnVhcnkgNCwgMjAxMiAyOjU2IHBtLCBTdGV2ZW4g QmVsbG92aW4gd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7IEdvb2QgcG9pbnQ7IGxldCBtZSB0aGluayBh Ym91dCBpdCBmb3IgLTAxLiAmbmJzcDtBbiBvYnZpb3VzIHNvbHV0aW9uDQppcyB0byBzZW5kPGJy Pg0KJmd0OyAmZ3Q7IHRoZSBob3N0bmFtZSB3aXRoIHRoZSBlZmZlY3RpdmUgcGFzc3dvcmQuPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNwOyBIb3cgaXMgdGhhdCBkaWZmZXJlbnQgdGhhbiB1c2lu ZyByYW5kb20gc2FsdCB0aGVuPyBJZiBfc29tZXRoaW5nXw0KaXM8YnI+DQomZ3Q7IGdvaW5nIHRv IGJlIHNlbnQgc2hvdWxkbid0IGl0IGJlIGEgdW5pZm9ybWx5IHJhbmRvbSBiaXRzdHJpbmcgaW5z dGVhZA0Kb2Y8YnI+DQomZ3Q7IGEgaG9zdG5hbWU/PGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNw OyBBIHVuaWZvcm1seSByYW5kb20gYml0c3RyaW5nIHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUg YXMgYQ0Ka2V5IHRvPGJyPg0KJmd0OyBITUFDIHRoYW4gYSBoaWdobHkgc3RydWN0dXJlZCBzdHJp bmcgbGlrZSBhIHBhc3N3b3JkIHRvby4gSXRlcmF0ZTxicj4NCiZndDsgSE1BQyhzYWx0LCBwYXNz d29yZCB8IHNlcnZpY2UtVVJJKSBpbnN0ZWFkIG9mIEhNQUMocGFzc3dvcmQsIHNlcnZpY2UtVVJJ KS48L2ZvbnQ+PC90dD4NCjxicj4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPkkgdGhpbmsgRGFuJ3Mg c3VnZ2VzdGlvbiBpcyByZWFzb25hYmxlLCBJIGNoZWNrZWQNCnRoZSBSRkMgMjEwNCBhbmQgZm91 bmQgdGhlIGZvbGxvd2luZyBzZWN0aW9uIDo8L2ZvbnQ+PC90dD4NCjxicj4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPiZxdW90OzMuIEtleXM8L2ZvbnQ+PC90dD4NCjxicj4NCjxicj48dHQ+PGZvbnQg c2l6ZT0yPiZuYnNwOyAmbmJzcDtUaGUga2V5IGZvciBITUFDIGNhbiBiZSBvZiBhbnkgbGVuZ3Ro DQooa2V5cyBsb25nZXIgdGhhbiBCIGJ5dGVzIGFyZTwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9u dCBzaXplPTI+Jm5ic3A7ICZuYnNwO2ZpcnN0IGhhc2hlZCB1c2luZyBIKS4gJm5ic3A7SG93ZXZl ciwNCmxlc3MgdGhhbiBMIGJ5dGVzIGlzIHN0cm9uZ2x5PC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxm b250IHNpemU9Mj4mbmJzcDsgJm5ic3A7ZGlzY291cmFnZWQgYXMgaXQgd291bGQgZGVjcmVhc2Ug dGhlDQpzZWN1cml0eSBzdHJlbmd0aCBvZiB0aGU8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQg c2l6ZT0yPiZuYnNwOyAmbmJzcDtmdW5jdGlvbi4gJm5ic3A7S2V5cyBsb25nZXIgdGhhbiBMIGJ5 dGVzDQphcmUgYWNjZXB0YWJsZSBidXQgdGhlIGV4dHJhPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxm b250IHNpemU9Mj4mbmJzcDsgJm5ic3A7bGVuZ3RoIHdvdWxkIG5vdCBzaWduaWZpY2FudGx5IGlu Y3JlYXNlDQp0aGUgZnVuY3Rpb24gc3RyZW5ndGguIChBPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxm b250IHNpemU9Mj4mbmJzcDsgJm5ic3A7bG9uZ2VyIGtleSBtYXkgYmUgYWR2aXNhYmxlIGlmIHRo ZSByYW5kb21uZXNzDQpvZiB0aGUga2V5IGlzPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNp emU9Mj4mbmJzcDsgJm5ic3A7Y29uc2lkZXJlZCB3ZWFrLik8L2ZvbnQ+PC90dD4NCjxicj4NCjxi cj48dHQ+PGZvbnQgc2l6ZT0yPiZuYnNwOyAmbmJzcDtLZXlzIG5lZWQgdG8gYmUgY2hvc2VuIGF0 IHJhbmRvbSAob3INCnVzaW5nIGEgY3J5cHRvZ3JhcGhpY2FsbHkgc3Ryb25nPC9mb250PjwvdHQ+ DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJzcDsgJm5ic3A7cHNldWRvLXJhbmRvbSBnZW5lcmF0 b3Igc2VlZGVkIHdpdGggYQ0KcmFuZG9tIHNlZWQpLCBhbmQgcGVyaW9kaWNhbGx5PC9mb250Pjwv dHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJzcDsgJm5ic3A7cmVmcmVzaGVkLiAmbmJzcDso Q3VycmVudCBhdHRhY2tzIGRvDQpub3QgaW5kaWNhdGUgYSBzcGVjaWZpYyByZWNvbW1lbmRlZDwv Zm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+Jm5ic3A7ICZuYnNwO2ZyZXF1ZW5jeSBm b3Iga2V5IGNoYW5nZXMgYXMgdGhlc2UgYXR0YWNrcw0KYXJlIHByYWN0aWNhbGx5PC9mb250Pjwv dHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJzcDsgJm5ic3A7aW5mZWFzaWJsZS4gJm5ic3A7 SG93ZXZlciwgcGVyaW9kaWMga2V5DQpyZWZyZXNobWVudCBpcyBhIGZ1bmRhbWVudGFsPC9mb250 PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJzcDsgJm5ic3A7c2VjdXJpdHkgcHJhY3Rp Y2UgdGhhdCBoZWxwcyBhZ2FpbnN0DQpwb3RlbnRpYWwgd2Vha25lc3NlcyBvZiB0aGU8L2ZvbnQ+ PC90dD4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPiZuYnNwOyAmbmJzcDtmdW5jdGlvbiBhbmQga2V5 cywgYW5kIGxpbWl0cyB0aGUgZGFtYWdlDQpvZiBhbiBleHBvc2VkIGtleS4pJnF1b3Q7PC9mb250 PjwvdHQ+DQo8YnI+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TaW5jZSBwYXNzd29yZHMg YXJlIG9mdGVuIG5vdCB0b28gbG9uZywgYW5kIG5vdCBzbw0KcmFuZG9tLCBpdCBpcyBiZXR0ZXIg PC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj50byBoYXNoIGl0IGJlZm9yZSB1c2lu ZyBpdCBhcyBhIGtleSBpbiBhIEhNQUMuIDwvZm9udD48L3R0Pg0KPGJyPg0KPGJyPg0KPGJyPjxm b250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj5SZWdhcmRzfn5+PGJyPg0KPGJyPg0KLVN1amlu ZyBaaG91PC9mb250Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7 ICZuYnNwOyBUaGF0IHNhaWQsIGdvYWwgNCBpbiB0aGUgZHJhZnQtLSAmcXVvdDtCeSBpdGVyYXRp bmcgYSBzdWZmaWNpZW50DQpudW1iZXIgb2Y8YnI+DQomZ3Q7IHRpbWVzLCBkaWN0aW9uYXJ5IGF0 dGFja3MgY2FuIGJlIG1hZGUgYXJiaXRyYXJpbHkgZXhwZW5zaXZlJnF1b3Q7LS0NCnNlZW1zIGE8 YnI+DQomZ3Q7IGJpdCBtaXNndWlkZWQuIFRoZSBBbWF6b24gY2xvdWQgc2VydmljZSBoYXMgYmVl biB1c2VkIHRvIGxhdW5jaCBhbjxicj4NCiZndDsgb2ZmLWxpbmUgZGljdGlvbmFyeSBhdHRhY2sg YWdhaW5zdCB0aGUgV1BBLVBTSyBwcm90b2NvbCB3aGljaCB1c2VzDQpQQktERjI8YnI+DQomZ3Q7 IChITUFDLVNIQTEpIHdpdGggNDA5NiBpdGVyYXRpb25zIHRvIG9iZnVzY2F0ZSBhIHBhc3N3b3Jk LiBUaGlzIGF0dGFjazxicj4NCiZndDsgY2hlY2tzIDI0LDAwMCwwMDAgY2FuZGlkYXRlIHBhc3N3 b3JkcyBwZXIgbWludXRlIGF0IGEgY29zdCBvZiAkMC4yOC48YnI+DQomZ3Q7IFRoYXQncyBtb3Jl IHRoYW4gMSw2MDAsMDAwLDAwMCBpdGVyYXRpb25zIHBlciBzZWNvbmQgZm9yIGFib3V0IDEvMg0K YSBjZW50Ljxicj4NCiZndDsgU28gSSBkb24ndCB0aGluayBpbmNyZWFzZWQgaXRlcmF0aW9uIG1h a2VzIGRpY3Rpb25hcnkgYXR0YWNrcyBtdWNoDQptb3JlPGJyPg0KJmd0OyBleHBlbnNpdmUuPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNwOyBXaGljaCBiZWdzIHRoZSBxdWVzdGlvbiwgaG93IGlz IHRoaXMgcHJvcG9zYWwgZGlmZmVyZW50IHRoYW4NClBCS0RGMj88YnI+DQomZ3Q7IFRoYXQgdGhl ICZxdW90O3NhbHQmcXVvdDsgaXMgYSBzZXJ2aWNlIFVSST88YnI+DQomZ3Q7IDxicj4NCiZndDsg Jm5ic3A7IHJlZ2FyZHMsPGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNwOyBEYW4uPGJyPg0KJmd0 OyA8YnI+DQomZ3Q7ICZndDsgT24gSmFuIDQsIDIwMTIsIGF0IDU6MjEgMDFQTSwgSm9lIFRvdWNo IHdyb3RlOjxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyZndDsgSGksIFN0ZXZlLDxicj4N CiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFRoaXMgZG9jIGRvZXNuJ3QgYXBwZWFy IHRvIGFkZHJlc3MgdGhlIGNhc2Ugd2hlcmUgYSBob3N0DQpoYXMgbXVsdGlwbGU8YnI+DQomZ3Q7 ICZndDsmZ3Q7IEROUyBuYW1lcywgd2hpY2ggY291bGQgbWFrZSBpdCBkaWZmaWN1bHQgdG8gaW5j b3Jwb3JhdGUgdGhlDQpob3N0bmFtZTxicj4NCiZndDsgJmd0OyZndDsgaW50byB0aGUgdHJhbnNm b3JtLiBJLmUuLCBJIGNvdWxkIGNvbnRhY3QgYSBtYWlsIHNlcnZlciBhdA0KYW4gSVAgYWRkcmVz czxicj4NCiZndDsgJmd0OyZndDsgdGhhdCByZXByZXNlbnRzIGFueSBvZiBkb3plbnMgb2YgRE5T IG5hbWVzIC0gaG93IGRvZXMgdGhlDQpzZXJ2ZXIga25vdzxicj4NCiZndDsgJmd0OyZndDsgd2hp Y2ggb25lIEkgdXNlZCBzbyBpdCBjYW4gbWF0Y2ggd2l0aG91dCBleGhhdXN0aXZlbHkgdHJ5aW5n DQphbGwgaXRzPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBlcXVpdmFsZW50IG5hbWVzPzxicj4NCiZndDsg Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IEpvZTxicj4NCiZndDsgJmd0OyZndDs8YnI+DQom Z3Q7ICZndDsmZ3Q7IE9uIDEvNC8yMDEyIDE6NDEgUE0sIFN0ZXZlbiBCZWxsb3ZpbiB3cm90ZTo8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBJJ2QgYXBwcmVjaWF0ZSBjb21tZW50cyBvbiBteSBuZXcg ZHJhZnQsIGRyYWZ0LWJlbGxvdmluLWhwdy0wMC50eHQ6PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBBYnN0cmFjdDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7PGJy Pg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7ICZuYnNwO01hbnkgc3lzdGVtcyAoZS5nLiwgY3J5 cHRvZ3JhcGhpYyBwcm90b2NvbHMNCnJlbHlpbmcgb24gc3ltbWV0cmljPGJyPg0KJmd0OyAmZ3Q7 Jmd0OyZndDsgJm5ic3A7ICZuYnNwO2NyeXB0b2dyYXBoeSkgcmVxdWlyZSB0aGF0IHBsYWludGV4 dCBwYXNzd29yZHMNCmJlIHN0b3JlZC4gJm5ic3A7R2l2ZW4gaG93PGJyPg0KJmd0OyAmZ3Q7Jmd0 OyZndDsgJm5ic3A7ICZuYnNwO29mdGVuIHBlb3BsZSByZXVzZSBwYXNzd29yZHMgb24gZGlmZmVy ZW50DQpzeXN0ZW1zLCB0aGlzIHBvc2VzIGEgdmVyeTxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZu YnNwOyAmbmJzcDtzZXJpb3VzIHJpc2sgaWYgYSBzaW5nbGUgbWFjaGluZSBpcyBjb21wcm9taXNl ZC4NCiZuYnNwO1dlIHByb3Bvc2UgYTxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IHNjaGVtZTxicj4N CiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAmbmJzcDt0byBkZXJpdmUgcGFzc3dvcmRzIGxpbWl0 ZWQgdG8gYSBzaW5nbGUNCm1hY2hpbmUgZnJvbSBhIHR5cGVkPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZn dDsgJm5ic3A7ICZuYnNwO3Bhc3N3b3JkLCBhbmQgZXhwbGFpbiBob3cgYSBwcm90b2NvbCBkZWZp bml0aW9uDQpjYW4gc3BlY2lmeSB0aGlzPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7ICZu YnNwO3NjaGVtZS48YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsmZ3Q7 PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLS1TdGV2ZSBCZWxs b3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7ICZndDsmZ3Q7 Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDs8YnI+DQom Z3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0 OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBzYWFnIG1haWxpbmcgbGlzdDxicj4NCiZndDsgJmd0OyZndDsm Z3Q7IHNhYWdAaWV0Zi5vcmc8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWc8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAm Z3Q7PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IC0t U3RldmUgQmVsbG92aW4sIGh0dHBzOi8vd3d3LmNzLmNvbHVtYmlhLmVkdS9+c21iPGJyPg0KJmd0 OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7PGJyPg0K Jmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KJmd0OyAmZ3Q7IHNhYWcgbWFpbGluZyBsaXN0PGJyPg0KJmd0 OyAmZ3Q7IHNhYWdAaWV0Zi5vcmc8YnI+DQomZ3Q7ICZndDsgaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9zYWFnPGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IDxicj4NCiZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQomZ3Q7IENmcmcgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyBDZnJnQGlydGYub3JnPGJy Pg0KJmd0OyBodHRwOi8vd3d3LmlydGYub3JnL21haWxtYW4vbGlzdGluZm8vY2ZyZzxicj4NCiZn dDsgPGJyPg0KPC9mb250PjwvdHQ+DQo= --=_alternative 002CAA3E48257997_=-- From zhou.sujing@zte.com.cn Wed Feb 1 00:13:27 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7918411E80CE for ; Wed, 1 Feb 2012 00:13:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -92.59 X-Spam-Level: X-Spam-Status: No, score=-92.59 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, RCVD_IN_DNSWL_LOW=-1, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OkWSDEcU+Ynj for ; Wed, 1 Feb 2012 00:13:26 -0800 (PST) Received: from mx7.zte.com.cn (mx7.zte.com.cn [202.103.147.169]) by ietfa.amsl.com (Postfix) with ESMTP id 5687521F851B for ; Wed, 1 Feb 2012 00:13:23 -0800 (PST) Received: from [10.30.3.21] by [192.168.168.15] with StormMail ESMTP id 5467.1134346943; Wed, 1 Feb 2012 16:13:20 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q118DDid080926; Wed, 1 Feb 2012 16:13:13 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: <1c680c52d4a354cdeda0a39e9cc47d32.squirrel@www.trepanning.net> To: "Dan Harkins" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Wed, 1 Feb 2012 16:13:07 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-02-01 16:13:15, Serialize complete at 2012-02-01 16:13:15 Content-Type: multipart/alternative; boundary="=_alternative 002D29C848257997_=" X-MAIL: mse02.zte.com.cn q118DDid080926 Cc: cfrg@irtf.org, Steven Bellovin Subject: [Cfrg] =?gb2312?b?tPC4tDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNo?= =?gb2312?b?ZWQgUGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2012 08:13:27 -0000 This is a multipart message in MIME format. --=_alternative 002D29C848257997_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 SGksYWxsDQoNCmNmcmctYm91bmNlc0BpcnRmLm9yZyDQtNPaIDIwMTItMDEtMDcgMTc6MDM6MjU6 DQoNCj4gDQo+IA0KPiBPbiBXZWQsIEphbnVhcnkgNCwgMjAxMiAyOjU2IHBtLCBTdGV2ZW4gQmVs bG92aW4gd3JvdGU6DQo+ID4gR29vZCBwb2ludDsgbGV0IG1lIHRoaW5rIGFib3V0IGl0IGZvciAt MDEuICBBbiBvYnZpb3VzIHNvbHV0aW9uIGlzIHRvIA0Kc2VuZA0KPiA+IHRoZSBob3N0bmFtZSB3 aXRoIHRoZSBlZmZlY3RpdmUgcGFzc3dvcmQuDQo+IA0KPiAgIEhvdyBpcyB0aGF0IGRpZmZlcmVu dCB0aGFuIHVzaW5nIHJhbmRvbSBzYWx0IHRoZW4/IElmIF9zb21ldGhpbmdfIGlzDQo+IGdvaW5n IHRvIGJlIHNlbnQgc2hvdWxkbid0IGl0IGJlIGEgdW5pZm9ybWx5IHJhbmRvbSBiaXRzdHJpbmcg aW5zdGVhZCBvZg0KPiBhIGhvc3RuYW1lPw0KPiANCj4gICBBIHVuaWZvcm1seSByYW5kb20gYml0 c3RyaW5nIHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUgYXMgYSBrZXkgdG8NCj4gSE1BQyB0aGFu IGEgaGlnaGx5IHN0cnVjdHVyZWQgc3RyaW5nIGxpa2UgYSBwYXNzd29yZCB0b28uIEl0ZXJhdGUN Cj4gSE1BQyhzYWx0LCBwYXNzd29yZCB8IHNlcnZpY2UtVVJJKSBpbnN0ZWFkIG9mIEhNQUMocGFz c3dvcmQsIA0Kc2VydmljZS1VUkkpLg0KDQoNCg0KSSB0aGluayBEYW4ncyBzdWdnZXN0aW9uIGlz IHJlYXNvbmFibGUsIEkgY2hlY2tlZCB0aGUgUkZDIDIxMDQgYW5kIGZvdW5kIA0KdGhlIGZvbGxv d2luZyBzZWN0aW9uIDoNCg0KIjMuIEtleXMNCg0KICAgVGhlIGtleSBmb3IgSE1BQyBjYW4gYmUg b2YgYW55IGxlbmd0aCAoa2V5cyBsb25nZXIgdGhhbiBCIGJ5dGVzIGFyZQ0KICAgZmlyc3QgaGFz aGVkIHVzaW5nIEgpLiAgSG93ZXZlciwgbGVzcyB0aGFuIEwgYnl0ZXMgaXMgc3Ryb25nbHkNCiAg IGRpc2NvdXJhZ2VkIGFzIGl0IHdvdWxkIGRlY3JlYXNlIHRoZSBzZWN1cml0eSBzdHJlbmd0aCBv ZiB0aGUNCiAgIGZ1bmN0aW9uLiAgS2V5cyBsb25nZXIgdGhhbiBMIGJ5dGVzIGFyZSBhY2NlcHRh YmxlIGJ1dCB0aGUgZXh0cmENCiAgIGxlbmd0aCB3b3VsZCBub3Qgc2lnbmlmaWNhbnRseSBpbmNy ZWFzZSB0aGUgZnVuY3Rpb24gc3RyZW5ndGguIChBDQogICBsb25nZXIga2V5IG1heSBiZSBhZHZp c2FibGUgaWYgdGhlIHJhbmRvbW5lc3Mgb2YgdGhlIGtleSBpcw0KICAgY29uc2lkZXJlZCB3ZWFr LikNCg0KICAgS2V5cyBuZWVkIHRvIGJlIGNob3NlbiBhdCByYW5kb20gKG9yIHVzaW5nIGEgY3J5 cHRvZ3JhcGhpY2FsbHkgc3Ryb25nDQogICBwc2V1ZG8tcmFuZG9tIGdlbmVyYXRvciBzZWVkZWQg d2l0aCBhIHJhbmRvbSBzZWVkKSwgYW5kIHBlcmlvZGljYWxseQ0KICAgcmVmcmVzaGVkLiAgKEN1 cnJlbnQgYXR0YWNrcyBkbyBub3QgaW5kaWNhdGUgYSBzcGVjaWZpYyByZWNvbW1lbmRlZA0KICAg ZnJlcXVlbmN5IGZvciBrZXkgY2hhbmdlcyBhcyB0aGVzZSBhdHRhY2tzIGFyZSBwcmFjdGljYWxs eQ0KICAgaW5mZWFzaWJsZS4gIEhvd2V2ZXIsIHBlcmlvZGljIGtleSByZWZyZXNobWVudCBpcyBh IGZ1bmRhbWVudGFsDQogICBzZWN1cml0eSBwcmFjdGljZSB0aGF0IGhlbHBzIGFnYWluc3QgcG90 ZW50aWFsIHdlYWtuZXNzZXMgb2YgdGhlDQogICBmdW5jdGlvbiBhbmQga2V5cywgYW5kIGxpbWl0 cyB0aGUgZGFtYWdlIG9mIGFuIGV4cG9zZWQga2V5LikiDQoNCg0KU2luY2UgcGFzc3dvcmRzIGFy ZSBvZnRlbiBub3QgdG9vIGxvbmcsIGFuZCBub3Qgc28gcmFuZG9tLCBpdCBpcyBiZXR0ZXIgDQp0 byBoYXNoIGl0IGJlZm9yZSB1c2luZyBpdCBhcyBhIGtleSBpbiBhIEhNQUMuIA0KDQoNClJlZ2Fy ZHN+fn4NCg0KLVN1amluZyBaaG91DQo+IA0KPiAgIFRoYXQgc2FpZCwgZ29hbCA0IGluIHRoZSBk cmFmdC0tICJCeSBpdGVyYXRpbmcgYSBzdWZmaWNpZW50IG51bWJlciBvZg0KPiB0aW1lcywgZGlj dGlvbmFyeSBhdHRhY2tzIGNhbiBiZSBtYWRlIGFyYml0cmFyaWx5IGV4cGVuc2l2ZSItLSBzZWVt cyBhDQo+IGJpdCBtaXNndWlkZWQuIFRoZSBBbWF6b24gY2xvdWQgc2VydmljZSBoYXMgYmVlbiB1 c2VkIHRvIGxhdW5jaCBhbg0KPiBvZmYtbGluZSBkaWN0aW9uYXJ5IGF0dGFjayBhZ2FpbnN0IHRo ZSBXUEEtUFNLIHByb3RvY29sIHdoaWNoIHVzZXMgDQpQQktERjINCj4gKEhNQUMtU0hBMSkgd2l0 aCA0MDk2IGl0ZXJhdGlvbnMgdG8gb2JmdXNjYXRlIGEgcGFzc3dvcmQuIFRoaXMgYXR0YWNrDQo+ IGNoZWNrcyAyNCwwMDAsMDAwIGNhbmRpZGF0ZSBwYXNzd29yZHMgcGVyIG1pbnV0ZSBhdCBhIGNv c3Qgb2YgJDAuMjguDQo+IFRoYXQncyBtb3JlIHRoYW4gMSw2MDAsMDAwLDAwMCBpdGVyYXRpb25z IHBlciBzZWNvbmQgZm9yIGFib3V0IDEvMiBhIA0KY2VudC4NCj4gU28gSSBkb24ndCB0aGluayBp bmNyZWFzZWQgaXRlcmF0aW9uIG1ha2VzIGRpY3Rpb25hcnkgYXR0YWNrcyBtdWNoIG1vcmUNCj4g ZXhwZW5zaXZlLg0KPiANCj4gICBXaGljaCBiZWdzIHRoZSBxdWVzdGlvbiwgaG93IGlzIHRoaXMg cHJvcG9zYWwgZGlmZmVyZW50IHRoYW4gUEJLREYyPw0KPiBUaGF0IHRoZSAic2FsdCIgaXMgYSBz ZXJ2aWNlIFVSST8NCj4gDQo+ICAgcmVnYXJkcywNCj4gDQo+ICAgRGFuLg0KPiANCj4gPiBPbiBK YW4gNCwgMjAxMiwgYXQgNToyMSAwMVBNLCBKb2UgVG91Y2ggd3JvdGU6DQo+ID4NCj4gPj4gSGks IFN0ZXZlLA0KPiA+Pg0KPiA+PiBUaGlzIGRvYyBkb2Vzbid0IGFwcGVhciB0byBhZGRyZXNzIHRo ZSBjYXNlIHdoZXJlIGEgaG9zdCBoYXMgbXVsdGlwbGUNCj4gPj4gRE5TIG5hbWVzLCB3aGljaCBj b3VsZCBtYWtlIGl0IGRpZmZpY3VsdCB0byBpbmNvcnBvcmF0ZSB0aGUgaG9zdG5hbWUNCj4gPj4g aW50byB0aGUgdHJhbnNmb3JtLiBJLmUuLCBJIGNvdWxkIGNvbnRhY3QgYSBtYWlsIHNlcnZlciBh dCBhbiBJUCANCmFkZHJlc3MNCj4gPj4gdGhhdCByZXByZXNlbnRzIGFueSBvZiBkb3plbnMgb2Yg RE5TIG5hbWVzIC0gaG93IGRvZXMgdGhlIHNlcnZlciBrbm93DQo+ID4+IHdoaWNoIG9uZSBJIHVz ZWQgc28gaXQgY2FuIG1hdGNoIHdpdGhvdXQgZXhoYXVzdGl2ZWx5IHRyeWluZyBhbGwgaXRzDQo+ ID4+IGVxdWl2YWxlbnQgbmFtZXM/DQo+ID4+DQo+ID4+IEpvZQ0KPiA+Pg0KPiA+PiBPbiAxLzQv MjAxMiAxOjQxIFBNLCBTdGV2ZW4gQmVsbG92aW4gd3JvdGU6DQo+ID4+PiBJJ2QgYXBwcmVjaWF0 ZSBjb21tZW50cyBvbiBteSBuZXcgZHJhZnQsIGRyYWZ0LWJlbGxvdmluLWhwdy0wMC50eHQ6DQo+ ID4+Pg0KPiA+Pj4gQWJzdHJhY3QNCj4gPj4+DQo+ID4+PiAgICBNYW55IHN5c3RlbXMgKGUuZy4s IGNyeXB0b2dyYXBoaWMgcHJvdG9jb2xzIHJlbHlpbmcgb24gc3ltbWV0cmljDQo+ID4+PiAgICBj cnlwdG9ncmFwaHkpIHJlcXVpcmUgdGhhdCBwbGFpbnRleHQgcGFzc3dvcmRzIGJlIHN0b3JlZC4g IEdpdmVuIA0KaG93DQo+ID4+PiAgICBvZnRlbiBwZW9wbGUgcmV1c2UgcGFzc3dvcmRzIG9uIGRp ZmZlcmVudCBzeXN0ZW1zLCB0aGlzIHBvc2VzIGEgDQp2ZXJ5DQo+ID4+PiAgICBzZXJpb3VzIHJp c2sgaWYgYSBzaW5nbGUgbWFjaGluZSBpcyBjb21wcm9taXNlZC4gIFdlIHByb3Bvc2UgYQ0KPiA+ Pj4gc2NoZW1lDQo+ID4+PiAgICB0byBkZXJpdmUgcGFzc3dvcmRzIGxpbWl0ZWQgdG8gYSBzaW5n bGUgbWFjaGluZSBmcm9tIGEgdHlwZWQNCj4gPj4+ICAgIHBhc3N3b3JkLCBhbmQgZXhwbGFpbiBo b3cgYSBwcm90b2NvbCBkZWZpbml0aW9uIGNhbiBzcGVjaWZ5IHRoaXMNCj4gPj4+ICAgIHNjaGVt ZS4NCj4gPj4+DQo+ID4+Pg0KPiA+Pj4gICAgICAgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93 d3cuY3MuY29sdW1iaWEuZWR1L35zbWINCj4gPj4+DQo+ID4+Pg0KPiA+Pj4NCj4gPj4+DQo+ID4+ Pg0KPiA+Pj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N Cj4gPj4+IHNhYWcgbWFpbGluZyBsaXN0DQo+ID4+PiBzYWFnQGlldGYub3JnDQo+ID4+PiBodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWcNCj4gPj4NCj4gPg0KPiA+DQo+ ID4gICAgICAgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35z bWINCj4gPg0KPiA+DQo+ID4NCj4gPg0KPiA+DQo+ID4gX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCj4gPiBzYWFnIG1haWxpbmcgbGlzdA0KPiA+IHNhYWdA aWV0Zi5vcmcNCj4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWcN Cj4gPg0KPiANCj4gDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQo+IENmcmcgbWFpbGluZyBsaXN0DQo+IENmcmdAaXJ0Zi5vcmcNCj4gaHR0cDovL3d3 dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NmcmcNCj4gDQoNCg== --=_alternative 002D29C848257997_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkhpLGFsbDwvZm9udD4NCjxicj4N Cjxicj48dHQ+PGZvbnQgc2l6ZT0yPmNmcmctYm91bmNlc0BpcnRmLm9yZyDQtNPaIDIwMTItMDEt MDcgMTc6MDM6MjU6PGJyPg0KPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgT24gV2Vk LCBKYW51YXJ5IDQsIDIwMTIgMjo1NiBwbSwgU3RldmVuIEJlbGxvdmluIHdyb3RlOjxicj4NCiZn dDsgJmd0OyBHb29kIHBvaW50OyBsZXQgbWUgdGhpbmsgYWJvdXQgaXQgZm9yIC0wMS4gJm5ic3A7 QW4gb2J2aW91cyBzb2x1dGlvbg0KaXMgdG8gc2VuZDxicj4NCiZndDsgJmd0OyB0aGUgaG9zdG5h bWUgd2l0aCB0aGUgZWZmZWN0aXZlIHBhc3N3b3JkLjxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJz cDsgSG93IGlzIHRoYXQgZGlmZmVyZW50IHRoYW4gdXNpbmcgcmFuZG9tIHNhbHQgdGhlbj8gSWYg X3NvbWV0aGluZ18NCmlzPGJyPg0KJmd0OyBnb2luZyB0byBiZSBzZW50IHNob3VsZG4ndCBpdCBi ZSBhIHVuaWZvcm1seSByYW5kb20gYml0c3RyaW5nIGluc3RlYWQNCm9mPGJyPg0KJmd0OyBhIGhv c3RuYW1lPzxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgQSB1bmlmb3JtbHkgcmFuZG9tIGJp dHN0cmluZyB3b3VsZCBiZSBtb3JlIGFwcHJvcHJpYXRlIGFzIGENCmtleSB0bzxicj4NCiZndDsg SE1BQyB0aGFuIGEgaGlnaGx5IHN0cnVjdHVyZWQgc3RyaW5nIGxpa2UgYSBwYXNzd29yZCB0b28u IEl0ZXJhdGU8YnI+DQomZ3Q7IEhNQUMoc2FsdCwgcGFzc3dvcmQgfCBzZXJ2aWNlLVVSSSkgaW5z dGVhZCBvZiBITUFDKHBhc3N3b3JkLCBzZXJ2aWNlLVVSSSkuPC9mb250PjwvdHQ+DQo8YnI+DQo8 YnI+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5JIHRoaW5rIERhbidzIHN1Z2dlc3Rpb24g aXMgcmVhc29uYWJsZSwgSSBjaGVja2VkDQp0aGUgUkZDIDIxMDQgYW5kIGZvdW5kIHRoZSBmb2xs b3dpbmcgc2VjdGlvbiA6PC9mb250PjwvdHQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4m cXVvdDszLiBLZXlzPC9mb250PjwvdHQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJz cDsgJm5ic3A7VGhlIGtleSBmb3IgSE1BQyBjYW4gYmUgb2YgYW55IGxlbmd0aA0KKGtleXMgbG9u Z2VyIHRoYW4gQiBieXRlcyBhcmU8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPiZu YnNwOyAmbmJzcDtmaXJzdCBoYXNoZWQgdXNpbmcgSCkuICZuYnNwO0hvd2V2ZXIsDQpsZXNzIHRo YW4gTCBieXRlcyBpcyBzdHJvbmdseTwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+ Jm5ic3A7ICZuYnNwO2Rpc2NvdXJhZ2VkIGFzIGl0IHdvdWxkIGRlY3JlYXNlIHRoZQ0Kc2VjdXJp dHkgc3RyZW5ndGggb2YgdGhlPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj4mbmJz cDsgJm5ic3A7ZnVuY3Rpb24uICZuYnNwO0tleXMgbG9uZ2VyIHRoYW4gTCBieXRlcw0KYXJlIGFj Y2VwdGFibGUgYnV0IHRoZSBleHRyYTwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+ Jm5ic3A7ICZuYnNwO2xlbmd0aCB3b3VsZCBub3Qgc2lnbmlmaWNhbnRseSBpbmNyZWFzZQ0KdGhl IGZ1bmN0aW9uIHN0cmVuZ3RoLiAoQTwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+ Jm5ic3A7ICZuYnNwO2xvbmdlciBrZXkgbWF5IGJlIGFkdmlzYWJsZSBpZiB0aGUgcmFuZG9tbmVz cw0Kb2YgdGhlIGtleSBpczwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+Jm5ic3A7 ICZuYnNwO2NvbnNpZGVyZWQgd2Vhay4pPC9mb250PjwvdHQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250 IHNpemU9Mj4mbmJzcDsgJm5ic3A7S2V5cyBuZWVkIHRvIGJlIGNob3NlbiBhdCByYW5kb20gKG9y DQp1c2luZyBhIGNyeXB0b2dyYXBoaWNhbGx5IHN0cm9uZzwvZm9udD48L3R0Pg0KPGJyPjx0dD48 Zm9udCBzaXplPTI+Jm5ic3A7ICZuYnNwO3BzZXVkby1yYW5kb20gZ2VuZXJhdG9yIHNlZWRlZCB3 aXRoIGENCnJhbmRvbSBzZWVkKSwgYW5kIHBlcmlvZGljYWxseTwvZm9udD48L3R0Pg0KPGJyPjx0 dD48Zm9udCBzaXplPTI+Jm5ic3A7ICZuYnNwO3JlZnJlc2hlZC4gJm5ic3A7KEN1cnJlbnQgYXR0 YWNrcyBkbw0Kbm90IGluZGljYXRlIGEgc3BlY2lmaWMgcmVjb21tZW5kZWQ8L2ZvbnQ+PC90dD4N Cjxicj48dHQ+PGZvbnQgc2l6ZT0yPiZuYnNwOyAmbmJzcDtmcmVxdWVuY3kgZm9yIGtleSBjaGFu Z2VzIGFzIHRoZXNlIGF0dGFja3MNCmFyZSBwcmFjdGljYWxseTwvZm9udD48L3R0Pg0KPGJyPjx0 dD48Zm9udCBzaXplPTI+Jm5ic3A7ICZuYnNwO2luZmVhc2libGUuICZuYnNwO0hvd2V2ZXIsIHBl cmlvZGljIGtleQ0KcmVmcmVzaG1lbnQgaXMgYSBmdW5kYW1lbnRhbDwvZm9udD48L3R0Pg0KPGJy Pjx0dD48Zm9udCBzaXplPTI+Jm5ic3A7ICZuYnNwO3NlY3VyaXR5IHByYWN0aWNlIHRoYXQgaGVs cHMgYWdhaW5zdA0KcG90ZW50aWFsIHdlYWtuZXNzZXMgb2YgdGhlPC9mb250PjwvdHQ+DQo8YnI+ PHR0Pjxmb250IHNpemU9Mj4mbmJzcDsgJm5ic3A7ZnVuY3Rpb24gYW5kIGtleXMsIGFuZCBsaW1p dHMgdGhlIGRhbWFnZQ0Kb2YgYW4gZXhwb3NlZCBrZXkuKSZxdW90OzwvZm9udD48L3R0Pg0KPGJy Pg0KPGJyPg0KPGJyPjx0dD48Zm9udCBzaXplPTI+U2luY2UgcGFzc3dvcmRzIGFyZSBvZnRlbiBu b3QgdG9vIGxvbmcsIGFuZCBub3Qgc28NCnJhbmRvbSwgaXQgaXMgYmV0dGVyIDwvZm9udD48L3R0 Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+dG8gaGFzaCBpdCBiZWZvcmUgdXNpbmcgaXQgYXMgYSBr ZXkgaW4gYSBITUFDLiA8L2ZvbnQ+PC90dD4NCjxicj4NCjxicj4NCjxicj48Zm9udCBzaXplPTIg ZmFjZT0ic2Fucy1zZXJpZiI+UmVnYXJkc35+fjxicj4NCjxicj4NCi1TdWppbmcgWmhvdTwvZm9u dD48dHQ+PGZvbnQgc2l6ZT0yPjxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgVGhhdCBzYWlk LCBnb2FsIDQgaW4gdGhlIGRyYWZ0LS0gJnF1b3Q7QnkgaXRlcmF0aW5nIGEgc3VmZmljaWVudA0K bnVtYmVyIG9mPGJyPg0KJmd0OyB0aW1lcywgZGljdGlvbmFyeSBhdHRhY2tzIGNhbiBiZSBtYWRl IGFyYml0cmFyaWx5IGV4cGVuc2l2ZSZxdW90Oy0tDQpzZWVtcyBhPGJyPg0KJmd0OyBiaXQgbWlz Z3VpZGVkLiBUaGUgQW1hem9uIGNsb3VkIHNlcnZpY2UgaGFzIGJlZW4gdXNlZCB0byBsYXVuY2gg YW48YnI+DQomZ3Q7IG9mZi1saW5lIGRpY3Rpb25hcnkgYXR0YWNrIGFnYWluc3QgdGhlIFdQQS1Q U0sgcHJvdG9jb2wgd2hpY2ggdXNlcw0KUEJLREYyPGJyPg0KJmd0OyAoSE1BQy1TSEExKSB3aXRo IDQwOTYgaXRlcmF0aW9ucyB0byBvYmZ1c2NhdGUgYSBwYXNzd29yZC4gVGhpcyBhdHRhY2s8YnI+ DQomZ3Q7IGNoZWNrcyAyNCwwMDAsMDAwIGNhbmRpZGF0ZSBwYXNzd29yZHMgcGVyIG1pbnV0ZSBh dCBhIGNvc3Qgb2YgJDAuMjguPGJyPg0KJmd0OyBUaGF0J3MgbW9yZSB0aGFuIDEsNjAwLDAwMCww MDAgaXRlcmF0aW9ucyBwZXIgc2Vjb25kIGZvciBhYm91dCAxLzINCmEgY2VudC48YnI+DQomZ3Q7 IFNvIEkgZG9uJ3QgdGhpbmsgaW5jcmVhc2VkIGl0ZXJhdGlvbiBtYWtlcyBkaWN0aW9uYXJ5IGF0 dGFja3MgbXVjaA0KbW9yZTxicj4NCiZndDsgZXhwZW5zaXZlLjxicj4NCiZndDsgPGJyPg0KJmd0 OyAmbmJzcDsgV2hpY2ggYmVncyB0aGUgcXVlc3Rpb24sIGhvdyBpcyB0aGlzIHByb3Bvc2FsIGRp ZmZlcmVudCB0aGFuDQpQQktERjI/PGJyPg0KJmd0OyBUaGF0IHRoZSAmcXVvdDtzYWx0JnF1b3Q7 IGlzIGEgc2VydmljZSBVUkk/PGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNwOyByZWdhcmRzLDxi cj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgRGFuLjxicj4NCiZndDsgPGJyPg0KJmd0OyAmZ3Q7 IE9uIEphbiA0LCAyMDEyLCBhdCA1OjIxIDAxUE0sIEpvZSBUb3VjaCB3cm90ZTo8YnI+DQomZ3Q7 ICZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IEhpLCBTdGV2ZSw8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJy Pg0KJmd0OyAmZ3Q7Jmd0OyBUaGlzIGRvYyBkb2Vzbid0IGFwcGVhciB0byBhZGRyZXNzIHRoZSBj YXNlIHdoZXJlIGEgaG9zdA0KaGFzIG11bHRpcGxlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBETlMgbmFt ZXMsIHdoaWNoIGNvdWxkIG1ha2UgaXQgZGlmZmljdWx0IHRvIGluY29ycG9yYXRlIHRoZQ0KaG9z dG5hbWU8YnI+DQomZ3Q7ICZndDsmZ3Q7IGludG8gdGhlIHRyYW5zZm9ybS4gSS5lLiwgSSBjb3Vs ZCBjb250YWN0IGEgbWFpbCBzZXJ2ZXIgYXQNCmFuIElQIGFkZHJlc3M8YnI+DQomZ3Q7ICZndDsm Z3Q7IHRoYXQgcmVwcmVzZW50cyBhbnkgb2YgZG96ZW5zIG9mIEROUyBuYW1lcyAtIGhvdyBkb2Vz IHRoZQ0Kc2VydmVyIGtub3c8YnI+DQomZ3Q7ICZndDsmZ3Q7IHdoaWNoIG9uZSBJIHVzZWQgc28g aXQgY2FuIG1hdGNoIHdpdGhvdXQgZXhoYXVzdGl2ZWx5IHRyeWluZw0KYWxsIGl0czxicj4NCiZn dDsgJmd0OyZndDsgZXF1aXZhbGVudCBuYW1lcz88YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7Jmd0OyBKb2U8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBPbiAx LzQvMjAxMiAxOjQxIFBNLCBTdGV2ZW4gQmVsbG92aW4gd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7Jmd0 OyZndDsgSSdkIGFwcHJlY2lhdGUgY29tbWVudHMgb24gbXkgbmV3IGRyYWZ0LCBkcmFmdC1iZWxs b3Zpbi1ocHctMDAudHh0Ojxicj4NCiZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0 OyZndDsgQWJzdHJhY3Q8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsm Z3Q7ICZuYnNwOyAmbmJzcDtNYW55IHN5c3RlbXMgKGUuZy4sIGNyeXB0b2dyYXBoaWMgcHJvdG9j b2xzDQpyZWx5aW5nIG9uIHN5bW1ldHJpYzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAm bmJzcDtjcnlwdG9ncmFwaHkpIHJlcXVpcmUgdGhhdCBwbGFpbnRleHQgcGFzc3dvcmRzDQpiZSBz dG9yZWQuICZuYnNwO0dpdmVuIGhvdzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAmbmJz cDtvZnRlbiBwZW9wbGUgcmV1c2UgcGFzc3dvcmRzIG9uIGRpZmZlcmVudA0Kc3lzdGVtcywgdGhp cyBwb3NlcyBhIHZlcnk8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyAmbmJzcDsgJm5ic3A7c2VyaW91 cyByaXNrIGlmIGEgc2luZ2xlIG1hY2hpbmUgaXMgY29tcHJvbWlzZWQuDQombmJzcDtXZSBwcm9w b3NlIGE8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBzY2hlbWU8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0 OyAmbmJzcDsgJm5ic3A7dG8gZGVyaXZlIHBhc3N3b3JkcyBsaW1pdGVkIHRvIGEgc2luZ2xlDQpt YWNoaW5lIGZyb20gYSB0eXBlZDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAmbmJzcDtw YXNzd29yZCwgYW5kIGV4cGxhaW4gaG93IGEgcHJvdG9jb2wgZGVmaW5pdGlvbg0KY2FuIHNwZWNp ZnkgdGhpczxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAmbmJzcDtzY2hlbWUuPGJyPg0K Jmd0OyAmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZn dDsmZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IC0tU3RldmUgQmVsbG92aW4sIGh0dHBzOi8vd3d3 LmNzLmNvbHVtYmlhLmVkdS9+c21iPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7ICZn dDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZn dDsgc2FhZyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBzYWFnQGlldGYub3Jn PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9zYWFnPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0 Ozxicj4NCiZndDsgJmd0OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAtLVN0ZXZlIEJlbGxvdmluLCBo dHRwczovL3d3dy5jcy5jb2x1bWJpYS5lZHUvfnNtYjxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsg Jmd0Ozxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0Ozxicj4NCiZn dDsgJmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxi cj4NCiZndDsgJmd0OyBzYWFnIG1haWxpbmcgbGlzdDxicj4NCiZndDsgJmd0OyBzYWFnQGlldGYu b3JnPGJyPg0KJmd0OyAmZ3Q7IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c2FhZzxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyBDZnJn IG1haWxpbmcgbGlzdDxicj4NCiZndDsgQ2ZyZ0BpcnRmLm9yZzxicj4NCiZndDsgaHR0cDovL3d3 dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nmcmc8YnI+DQomZ3Q7IDxicj4NCjwvZm9udD48 L3R0Pg0K --=_alternative 002D29C848257997_=-- From prvs=337851090d=uri@ll.mit.edu Wed Feb 1 07:50:22 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D72E211E8071 for ; Wed, 1 Feb 2012 07:50:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.7 X-Spam-Level: X-Spam-Status: No, score=-3.7 tagged_above=-999 required=5 tests=[AWL=-0.751, BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4, SARE_SUB_ENC_UTF8=0.152, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iJ0wY8Egtdce for ; Wed, 1 Feb 2012 07:50:20 -0800 (PST) Received: from mx2.ll.mit.edu (MX2.LL.MIT.EDU [129.55.12.46]) by ietfa.amsl.com (Postfix) with ESMTP id C7FF411E811C for ; Wed, 1 Feb 2012 07:50:19 -0800 (PST) Received: from LLE2K7-HUB01.mitll.ad.local (LLE2K7-HUB01.mitll.ad.local) by mx2.ll.mit.edu (unknown) with ESMTP id q11FoA4i002058 for ; Wed, 1 Feb 2012 10:50:12 -0500 From: "Blumenthal, Uri - 0668 - MITLL" To: "cfrg@irtf.org" Date: Wed, 1 Feb 2012 10:49:13 -0500 Thread-Topic: =?utf-8?B?W0NmcmddIOetlOWkjTogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNoZWQg?= =?utf-8?B?UGFzc3dvcmQgRXhjaGFuZ2U=?= Thread-Index: Aczg+RC2lj+msthfRmKs/9gBkmGtJg== Message-ID: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.12.0.110505 acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3410938159_118727070" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.6.7361, 1.0.211, 0.0.0000 definitions=2012-02-01_06:2012-01-31, 2012-02-01, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=55 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=6.0.2-1012030000 definitions=main-1202010129 Subject: Re: [Cfrg] =?utf-8?b?562U5aSNOiBSZTogIFtzYWFnXSBOZXcgZHJhZnQ6IEhhc2hl?= =?utf-8?q?d_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2012 15:50:23 -0000 --B_3410938159_118727070 Content-type: multipart/alternative; boundary="B_3410938154_118736778" --B_3410938154_118736778 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable My take on this is: if you believe that a hash-function is a good randomize= r and can be used in cryptographic key generation process =E2=80=93 then it does n= ot matter whether what you feed as a "key" input to HMAC is uniformly distributed or not (because of HMAC internal "hash spins"). And if you are uneasy on how really random your hash output is =E2=80=93 then a lot of the currently used mechanisms and primitives need revisiting. --=20 Regards, Uri Blumenthal Voice: (781) 981-1638 Cyber Systems and Technology Fax: (781) 981-0186 MIT Lincoln Laboratory From: "zhou.sujing@zte.com.cn" Date: Wed, 1 Feb 2012 03:13:07 -0500 To: Dan Harkins Cc: "cfrg@irtf.org" , Steven Bellovin Subject: [Cfrg] =E7=AD=94=E5=A4=8D: Re: [saag] New draft: Hashed Password Exchange >=20 > Hi,all >=20 > cfrg-bounces@irtf.org =E5=86=99=E4=BA=8E 2012-01-07 17:03:25: >=20 >> >=20 >> >=20 >> > On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote: >>> > > Good point; let me think about it for -01. An obvious solution is = to >>> send >>> > > the hostname with the effective password. >> >=20 >> > How is that different than using random salt then? If _something_ is >> > going to be sent shouldn't it be a uniformly random bitstring instead = of >> > a hostname? >> >=20 >> > A uniformly random bitstring would be more appropriate as a key to >> > HMAC than a highly structured string like a password too. Iterate >> > HMAC(salt, password | service-URI) instead of HMAC(password, service-U= RI). >=20 >=20 >=20 > I think Dan's suggestion is reasonable, I checked the RFC 2104 and found = the > following section : >=20 > "3. Keys >=20 > The key for HMAC can be of any length (keys longer than B bytes are > first hashed using H). However, less than L bytes is strongly > discouraged as it would decrease the security strength of the > function. Keys longer than L bytes are acceptable but the extra > length would not significantly increase the function strength. (A > longer key may be advisable if the randomness of the key is > considered weak.) >=20 > Keys need to be chosen at random (or using a cryptographically strong > pseudo-random generator seeded with a random seed), and periodically > refreshed. (Current attacks do not indicate a specific recommended > frequency for key changes as these attacks are practically > infeasible. However, periodic key refreshment is a fundamental > security practice that helps against potential weaknesses of the > function and keys, and limits the damage of an exposed key.)" >=20 >=20 > Since passwords are often not too long, and not so random, it is better > to hash it before using it as a key in a HMAC. >=20 >=20 > Regards~~~ >=20 > -Sujing Zhou >> >=20 >> > That said, goal 4 in the draft-- "By iterating a sufficient number o= f >> > times, dictionary attacks can be made arbitrarily expensive"-- seems a >> > bit misguided. The Amazon cloud service has been used to launch an >> > off-line dictionary attack against the WPA-PSK protocol which uses PBK= DF2 >> > (HMAC-SHA1) with 4096 iterations to obfuscate a password. This attack >> > checks 24,000,000 candidate passwords per minute at a cost of $0.28. >> > That's more than 1,600,000,000 iterations per second for about 1/2 a c= ent. >> > So I don't think increased iteration makes dictionary attacks much mor= e >> > expensive. >> >=20 >> > Which begs the question, how is this proposal different than PBKDF2? >> > That the "salt" is a service URI? >> >=20 >> > regards, >> >=20 >> > Dan. >> >=20 >>> > > On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote: >>> > > >>>> > >> Hi, Steve, >>>> > >> >>>> > >> This doc doesn't appear to address the case where a host has mult= iple >>>> > >> DNS names, which could make it difficult to incorporate the hostn= ame >>>> > >> into the transform. I.e., I could contact a mail server at an IP >>>> address >>>> > >> that represents any of dozens of DNS names - how does the server = know >>>> > >> which one I used so it can match without exhaustively trying all = its >>>> > >> equivalent names? >>>> > >> >>>> > >> Joe >>>> > >> >>>> > >> On 1/4/2012 1:41 PM, Steven Bellovin wrote: >>>>> > >>> I'd appreciate comments on my new draft, draft-bellovin-hpw-00.= txt: >>>>> > >>> >>>>> > >>> Abstract >>>>> > >>> >>>>> > >>> Many systems (e.g., cryptographic protocols relying on symme= tric >>>>> > >>> cryptography) require that plaintext passwords be stored. G= iven how >>>>> > >>> often people reuse passwords on different systems, this pose= s a very >>>>> > >>> serious risk if a single machine is compromised. We propose= a >>>>> > >>> scheme >>>>> > >>> to derive passwords limited to a single machine from a typed >>>>> > >>> password, and explain how a protocol definition can specify = this >>>>> > >>> scheme. >>>>> > >>> >>>>> > >>> >>>>> > >>> --Steve Bellovin, https://www.cs.columbia.edu/~smb >>>>> > >>> >>>>> > >>> >>>>> > >>> >>>>> > >>> >>>>> > >>> >>>>> > >>> _______________________________________________ >>>>> > >>> saag mailing list >>>>> > >>> saag@ietf.org >>>>> > >>> https://www.ietf.org/mailman/listinfo/saag >>>> > >> >>> > > >>> > > >>> > > --Steve Bellovin, https://www.cs.columbia.edu/~smb >>> > > >>> > > >>> > > >>> > > >>> > > >>> > > _______________________________________________ >>> > > saag mailing list >>> > > saag@ietf.org >>> > > https://www.ietf.org/mailman/listinfo/saag >>> > > >> >=20 >> >=20 >> > _______________________________________________ >> > Cfrg mailing list >> > Cfrg@irtf.org >> > http://www.irtf.org/mailman/listinfo/cfrg >> >=20 --B_3410938154_118736778 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable
My take o= n this is: if you believe that a hash-function is a good randomizer and can = be used in cryptographic key generation process – then  it does n= ot matter whether what you feed as a "key" input to HMAC is uniformly distri= buted or not (because of HMAC internal "hash spins"). And if you are uneasy = on how really random your hash output is – then a lot of the currently= used mechanisms and primitives need revisiting.
-- 
Regards,
Uri Blumenth= al                     &nb= sp;      Voice: (781) 981-1638
Cyber Systems and Technology  Fax:    (781) = 981-0186
MIT Lincoln Laborato= ry               
<= font class=3D"Apple-style-span" face=3D"Abadi MT Condensed Light">



= Hi,all

cfrg-bounces@irtf.org =E5=86=99=E4=BA=8E 2012-01-07 17:03:25:

>
>
> On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote:
> > Good point; let me think about it for -01.  An obvious solut= ion is to send
> > the hostname with the effective password.
>
>   How is that different than using random salt then? If _somethin= g_ is
> going to be sent shouldn't it be a uniformly random bitstring instead of
> a hostname?
>
>   A uniformly random bitstring would be more appropriate as a key to
> HMAC than a highly structured string like a password too. Iterate
> HMAC(salt, password | service-URI) instead of HMAC(password, service-U= RI).



I think Dan's suggestion = is reasonable, I checked the RFC 2104 and found the following section :

"3. Keys

   The ke= y for HMAC can be of any length (keys longer than B bytes are
  &nbs= p;first hashed using H).  However, less than L bytes is strongly
  &nbs= p;discouraged as it would decrease the security strength of the
   fun= ction.  Keys longer than L bytes are acceptable but the extra
   = ;length would not significantly increase the function strength. (A
   lo= nger key may be advisable if the randomness of the key is
   considered wea= k.)

   Keys need to be chose= n at random (or using a cryptographically strong
  &= nbsp;pseudo-random generator seeded with a random seed), and periodically
  &nb= sp;refreshed.  (Current attacks do not indicate a specific recommended
 = ;  frequency for key changes as these attacks are practically
   infeasible. =  However, periodic key refreshment is a fundamental
   = ;security practice that helps against potential weaknesses of the
   = function and keys, and limits the damage of an exposed key.)"


Since passwo= rds are often not too long, and not so random, it is better
to hash it before u= sing it as a key in a HMAC.


Regards~~~

-Sujing Zhou
>
>   That said, goal 4 in the draft-- "By iterating a sufficient number of
> times, dictionary attacks can be made arbitrarily expensive"-- seems a
> bit misguided. The Amazon cloud service has been used to launch an
= > off-line dictionary attack against the WPA-PSK protocol which uses PBKDF2
> (HMAC-SHA1) with 4096 iterations to obfuscate a password. This attack<= br> > checks 24,000,000 candidate passwords per minute at a cost of $0.28. > That's more than 1,600,000,000 iterations per second for about 1/2 a cent.
> So I don't think increased iteration makes dictionary attacks much more
> expensive.
>
>   Which begs the question, how is this proposal different than PBKDF2?
> That the "salt" is a service URI?
>
>   regards,
>
>   Dan.
>
> > On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote:
> >
> >> Hi, Steve,
> >>
> >> This doc doesn't appear to address the case where a host has multiple
> >> DNS names, which could make it difficult to incorporate the hostname
> >> into the transform. I.e., I could contact a mail server at an IP address
> >> that represents any of dozens of DNS names - how does the server know
> >> which one I used so it can match without exhaustively trying all its
> >> equivalent names?
> >>
> >> Joe
> >>
> >> On 1/4/2012 1:41 PM, Steven Bellovin wrote:
> >>> I'd appreciate comments on my new draft, draft-bellovin-h= pw-00.txt:
> >>>
> >>> Abstract
> >>>
> >>>    Many systems (e.g., cryptographic protocols relying on symmetric
> >>>    cryptography) require that plaintext passwor= ds be stored.  Given how
> >>>    often people reuse passwords on different systems, this poses a very
> >>>    serious risk if a single machine is compromi= sed.  We propose a
> >>> scheme
> >>>    to derive passwords limited to a single machine from a typed
> >>>    password, and explain how a protocol definit= ion can specify this
> >>>    scheme.
> >>>
> >>>
> >>>       --Steve Bellovin, https://www.cs.columbia.edu/~smb
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> _______________________________________________
> >>> saag mailing list
> >>> saag@ietf.org
> >>> http= s://www.ietf.org/mailman/listinfo/saag
> >>
> >
> >
> >       --Steve Bellovin, https://www.cs.columbia.edu/~smb
> >
> >
> >
> >
> >
> > _______________________________________________
> > saag mailing list
> > saag@ietf.org
> > https://www.= ietf.org/mailman/listinfo/saag
> >
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.or= g/mailman/listinfo/cfrg
>
--B_3410938154_118736778-- --B_3410938159_118727070 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUAAYJKoZIhvcNAQcCoIIT8TCCE+0CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EeMwggTLMIIDs6ADAgECAgoYeP+3AAAAAByAMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYT AlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzAR BgNVBAMTCk1JVExMIENBLTIwHhcNMTEwNzEzMjAyMzU1WhcNMTIwNzEyMjAyMzU1WjBhMQsw CQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMG UGVvcGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAL4TeQPMpFpVQVbz3C9Es122DpioIq8JSZDol89SV3kYUPMj G8K3uynPscCziyfPlF6dJveeRp2DneKKkmgWbCrwN2zPOEu8fBqNHfWsRqsPA66SkA9XrkpQ v0wgw9sZNOf4oU1l+KGCn6bbZkHdbNLrlUV3R99TpQwY6qolZMy/uvYjWLmH3NutWEDsODl6 FP0nKt5nKiuG9t2FGPUYVyOKdf/u39VMzDApcOgKub3NlkXW+zzQZ7zF2aW4GQdUf7BUYMRX x0B5p1YiBRAoX8orCW5FFZ0vrUlTyNKu7NHMZwWm899JIVYD+EBASC40fNB/afphCsAgXDsh QTikAkkCAwEAAaOCAZMwggGPMB0GA1UdDgQWBBSQq3VtNOCIqvvszUnlxLlhFXsEFDAOBgNV HQ8BAf8EBAMCBsAwHwYDVR0jBBgwFoAUjkp9iaFjFxyBiDRXNyZFXhmKfiQwMwYDVR0fBCww KjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9MTENBMjBiBggrBgEFBQcB AQRWMFQwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0by9MTENBMjAj BggrBgEFBQcwAYYXaHR0cDovL29jc3AubGwubWl0LmVkdS8wDAYDVR0TAQH/BAIwADA9Bgkr BgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+KcwIB ZAIBBTAiBgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAYBgNVHSAEETAPMA0G CyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MA0GCSqGSIb3DQEBCwUA A4IBAQCfzOm9Ms0oupY104yKv6x3gTnVunF9Yc0Jok2zUUy8DNPLzUMYeVaV9SQu7Z6JmQXB gqgjnnpfVjCO0kg61uyL9bpovn2E4mmneRmetQdNq56/rtrxnlh3gNbGidWH+FfvxL97AVpD bccsV7wDBT2MQgaLVtUHNqDrPEC+0dtkMFK/6vgrShfUh3pCm6G3BhDFlBFMSTl/mcxO/x10 KbXVbhMUz7biweTBbiJUQdG7iemRG//HXOpMHtKZ94ro3YUJ52nhkjfnMJMqzX+aKM116CbM gmJji36vaZK2l6Y7+Es59SZUTwxkTupZTqXADFXO9LWAmYdZjZYcumaToubrMIIEtzCCA5+g AwIBAgIBFDANBgkqhkiG9w0BAQsFADBUMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExp bmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRYwFAYDVQQDEw1NSVRMTCBSb290IENB MB4XDTA5MTIxNDEyMDAwMFoXDTE1MTIzMTIzNTk1OVowUTELMAkGA1UEBhMCVVMxHzAdBgNV BAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTETMBEGA1UEAxMKTUlU TEwgQ0EtMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKcEyyNhSIfsN6AzBwVh Zkzo6SdjNGAQ7mA2A8T0kmdCB8MH6jWjVVMwFZwlg9cgjgLKEuEO9KN8K9M8jgeZEMoinlRf k3YELPC7sEkkzBQkcVpLhEwALue9iHowgSLGmXZpYKmRhfvhvYJ4MNCuIaWpcK/GaDZCE+U2 aTg42kv/zQrH3AoqFX81OF7niwXNnanP1hQRfkMTRrnaEW8DX0TMaG/t9Ry5xSMrLTNc9DvQ tjA5ZcuWnECiUpyDBFWxLr9yx7xgf1/LwgCxcoBeKSBBoWzkQmKAsgMo9Mq1Fp/nnIqw5FKm gOs7Vy+6e0Dk+cgf+oAV8AK8ZFMQrVE0uH0CAwEAAaOCAZUwggGRMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFI5KfYmhYxccgYg0VzcmRV4Zin4kMB8GA1UdIwQYMBaAFGeqes/0 Cqa5crWKoNKd8hDDQ+0pMA4GA1UdDwEB/wQEAwIBhjBhBggrBgEFBQcBAQRVMFMwLQYIKwYB BQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0bz9MTFJDQTAiBggrBgEFBQcwAYYW aHR0cDovL29jc3AubGwubWl0LmVkdTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmxs Lm1pdC5lZHUvZ2V0Y3JsP0xMUkNBMIGSBgNVHSAEgYowgYcwDQYLKoZIhvcSAgEDAQYwDQYL KoZIhvcSAgEDAQgwDQYLKoZIhvcSAgEDAQcwDQYLKoZIhvcSAgEDAQkwDQYLKoZIhvcSAgED AQowDQYLKoZIhvcSAgEDAQswDQYLKoZIhvcSAgEDAQ4wDQYLKoZIhvcSAgEDAQ8wDQYLKoZI hvcSAgEDARAwDQYJKoZIhvcNAQELBQADggEBAIh3BqHQ/XH8C6DCL+eEGroOzxBcCqTNItms v4MANaOTodgU2jrjHcGjXlzqhpb8ZxOlkAK3dK09rc6+yACcoK2TzVtDRZXYxov/SqZRjI3d ufU2JatAPxosCyy/1otjl1TKUY47Wvft31vdf5i0XK2DQVEJ+XlqtgBiFTVIMIfBJwPajrsi z+pgFEYwhhwJxvs8flSi0FLCE77VYLEioP5hxG6zIPeQRxzh1bogbfphWHHtoiTDkBSZ4Ufv GXQTVf7QjhD5yYw10yICtjHmtgbfgBkH5/vvR92NY9RSlNPzZqmGKIia61bJCmagRYGyexfe dVNF0cJWL4J/cLHhgNYwggODMIICa6ADAgECAgEBMA0GCSqGSIb3DQEBBQUAMFQxCzAJBgNV BAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kx FjAUBgNVBAMTDU1JVExMIFJvb3QgQ0EwHhcNMDgwOTIzMTIwMDAwWhcNMjkxMjMxMjM1OTU5 WjBUMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoG A1UECxMDUEtJMRYwFAYDVQQDEw1NSVRMTCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAxU4pF1iyJrL5rYq/XBAKg93kCTATG7Bw0NGFpEJ1A3Xsr6UIIq9/1VJB OgCwDqrVsAK1lRwy/lkrHzPkobiMr1wzjQ28SR/9sg5kAcmrMqBYbc302qtwCGKZxdNdhAh2 nUOCO10AMpUsCNdpikPY9ukT8lsA+eorM4Q1rc/L0J6AHRptOU7IuDBdZj+tdNb7gv+GKknr 6wj9m2sVGawoaG7AAqhsWvQUM/q4h/H5FpYlwnVAEh2AzhqiG9bwl6uJJIzJ/8uUWldNkVwz 1I5fR/vCaxiLXIW4oUydBuRKTG+ekEoxHGuD73yx5JtsSciS8HQL2oEM8tv+VAC+albqgwID AQABo2AwXjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRnqnrP9AqmuXK1iqDSnfIQw0Pt KTAfBgNVHSMEGDAWgBRnqnrP9AqmuXK1iqDSnfIQw0PtKTALBgNVHQ8EBAMCAYYwDQYJKoZI hvcNAQEFBQADggEBAD4bbQVg0Hh42EpYX4/JPkNS3OUAEWR/YgzZUY1QGi9rQZ4pfcjU1/Ta oNT8Y7Yf0RO+e9NiG9+BDhQH/kQiZOQo9rv9NUb8xDtKCYCad7zEQtVsYsWuvK2XLw/Ji1m2 eBvoOB4RS/5LAWfNws7W+DWt2ayzeTCyrLSrx7ZVgBjzNOm0TPIkbfppdwgxuo7FZL8ts+M2 492Al87d3VasevUS1pprRBEupChmPTt1hjtajkQOpT4BQAzP1lVEYrWzlv+O/lbP9iujKpYW cfYqQ3FGf37YCvuDeues4xm+nqmyraNsNeI8Gh3XDIwqfzHnLhy4Y80VyqN/Jj8df3SK9AAw ggTOMIIDtqADAgECAgpbJUqmAAAAAA8TMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYTAlVT MR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNV BAMTCk1JVExMIENBLTIwHhcNMTEwMzI0MTIyNjExWhcNMTIwMzIzMTIyNjExWjBhMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMGUGVv cGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAJgc1a1sochMa7t5yY+uE41Zbsv3nHOSCIrCSh4rMUGd7uQLJev7 yg12DVeG5aD0Mh4CfvWY4aPqpLbKmgvtQwRGK7Q4AI8LkmXsrHTPePj8q1xl9D9iLOLJB7NI 6tIWBLoRUpdnpTXpVY48vYh3EawGOoyATcjGIgFDxdQRduCdOfgnhwV5VKLidwTa2u3c1jYr FiCnGwiWRzKFSoNORzEp+Ya9+3IxAoXv1njOCRSsjs0NW1Dk0NRbcQ8GvomFNv0l9wVbKZFP SOxfIdaImNOR6plD0hZXyS1R3AM2rmC+8sHhTe8SjTCH4wTU5GDl3ggMma9Hs9TaH5tQt8AT nj0CAwEAAaOCAZYwggGSMB0GA1UdDgQWBBQQR4g7yYztZ0FyMkiRO+qlMFa91jAOBgNVHQ8B Af8EBAMCBSAwHwYDVR0jBBgwFoAUjkp9iaFjFxyBiDRXNyZFXhmKfiQwMwYDVR0fBCwwKjAo oCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9MTENBMjBiBggrBgEFBQcBAQRW MFQwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0by9MTENBMjAjBggr BgEFBQcwAYYXaHR0cDovL29jc3AubGwubWl0LmVkdS8wDAYDVR0TAQH/BAIwADA9BgkrBgEE AYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIB BDAlBgNVHSUEHjAcBgRVHSUABggrBgEFBQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0G CyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MA0GCSqGSIb3DQEBCwUA A4IBAQBTX15euArO0iAXeKleS4RByMTW91D/0ihJOIbxiqNkYtyBau2nj11c4njjB58a0pGk YEfxa+LK/bWrOIw1NuZ1f00GcorNcfxixxH4JpiMdC55PYH5aN0r3s3HFTd/Irbdr0J4XA2s K7MyhyiOaOY1rTV7idWdyL8KJW+Y38sOVHLwe0JHpF/TUbF1wmtyam1kj5VJvrBEIjbuEKjl +bPzgCx6ZaTajuo16Op5xFK3ABdq+zKXgXmFGR2NT0nNQ7OnqCpGnVyoOvahFZk1Chr/zUvb V6rINQxtvgnCUGLbaKROfVlmes/vtbLALimVsPRVseBE4I/bpyzfI9F8NwRXMYIB5TCCAeEC AQEwXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEM MAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0yAgoYeP+3AAAAAByAMAkGBSsOAwIa BQCgXTAjBgkqhkiG9w0BCQQxFgQUyFwAQD2BIi7boX7qAMEp3x2XKBcwGAYJKoZIhvcNAQkD MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwMjAxMTU0OTE0WjANBgkqhkiG9w0B AQEFAASCAQCMyABzaBLdcZfWls+Tlm1H2ljBYvCdglJGUtCeLeM2B0hNk4/90wpD+FpZgWfC p8tv83U+qZpnk8T0l83AnIvbeQAQIHZcQAMI73o3k4waLe0gpXigOg2mSOuWvmOgEyvwz6OB Kr1MbsEirZKDHO8xABXHjV1vkDexDn3YzunMhzbPeaauiaqs7JDKehIUpeiVco+atiNDDpPw QR+DrGAUw/DVkRn/YExYR1CDKlEQ4noYfX5Lh0Hdqg1FskcaR0LpfTkWTOWmS4ODp6dcdIm6 45pzZc90YJvYx/Hzi5//ySQKCvjg7h+qz8eWLUJxkRItl4uT/d9u/EikXlJBFJDc --B_3410938159_118727070-- From ggr@qualcomm.com Wed Feb 1 09:11:50 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A217B11E8132 for ; Wed, 1 Feb 2012 09:11:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.099 X-Spam-Level: X-Spam-Status: No, score=-103.099 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n93khn93a2OZ for ; Wed, 1 Feb 2012 09:11:49 -0800 (PST) Received: from wolverine01.qualcomm.com (wolverine01.qualcomm.com [199.106.114.254]) by ietfa.amsl.com (Postfix) with ESMTP id E517D11E812B for ; Wed, 1 Feb 2012 09:11:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qualcomm.com; i=ggr@qualcomm.com; q=dns/txt; s=qcdkim; t=1328116309; x=1359652309; h=from:to:cc:subject:thread-topic:thread-index:date: message-id:references:in-reply-to:accept-language: content-language:x-ms-has-attach:x-ms-tnef-correlator: x-originating-ip:content-type:content-id: content-transfer-encoding:mime-version; z=From:=20"Rose,=20Greg"=20|To:=20"=20=20"=0D=0A =09|CC:=20"Rose,=20Greg"=20,=20"cfrg@irtf.org"=20 |Subject:=20=3D?big5?B?UmU6IFtDZnJnXSC1qs5gOiBSZTogIFtzYW FnXSBOZXcgZHJhZnQ6IEhhc2hlZCBQ?=3D=0D=0A=20=3D?big5?Q?ass word_Exchange?=3D|Thread-Topic:=20=3D?big5?B?W0NmcmddILWq zmA6IFJlOiAgW3NhYWddIE5ldyBkcmFmdDogSGFzaGVkIFBhc3N3?=3D =0D=0A=20=3D?big5?Q?ord_Exchange?=3D|Thread-Index:=20AQHM 4QSRjummxzsoaUqVGiZC5NcTNw=3D=3D|Date:=20Wed,=201=20Feb =202012=2017:11:44=20+0000|Message-ID:=20<1872CE9C-C36C-4 E76-90A5-59271631610B@qualcomm.com>|References:=20|In-Reply-To:=20|Accept-Language:=20en -US|Content-Language:=20en-US|X-MS-Has-Attach: |X-MS-TNEF-Correlator:|x-originating-ip:=20[172.30.39.5] |Content-Type:=20text/plain=3B=20charset=3D"big5" |Content-ID:=20|Content-Transfer-Encoding:=20base64|MIME-Version: =201.0; bh=EHZmuA/zVa3xeawwMBHEG/1B9NGp7NAYssHzP+O2sTg=; b=K+ri8NYLnGMQiS3yVve3hIvYoJ7o85PjRqrBv9QY0wfrrx3pcQfVf4io 8pp6UKvJHgTaQyRJBo5F/3txcoUqij+deZQ3P0hdb7RSphgLjQ6Zlq96W ddmV1pkRGb2eXBVqTmshcq6Az50G86LQPOy5EXwLZgVKL2EdedkNzTqSK k=; X-IronPort-AV: E=McAfee;i="5400,1158,6606"; a="159685845" Received: from ironmsg04-r.qualcomm.com ([172.30.46.18]) by wolverine01.qualcomm.com with ESMTP; 01 Feb 2012 09:11:49 -0800 X-IronPort-AV: E=Sophos;i="4.71,601,1320652800"; d="scan'208";a="248662282" Received: from nasanexhc07.na.qualcomm.com ([172.30.39.190]) by Ironmsg04-R.qualcomm.com with ESMTP/TLS/AES128-SHA; 01 Feb 2012 09:11:49 -0800 Received: from NASANEXD01D.na.qualcomm.com ([169.254.4.71]) by nasanexhc07.na.qualcomm.com ([172.30.39.190]) with mapi id 14.01.0339.001; Wed, 1 Feb 2012 09:11:48 -0800 From: "Rose, Greg" To: " " Thread-Topic: =?big5?B?W0NmcmddILWqzmA6IFJlOiAgW3NhYWddIE5ldyBkcmFmdDogSGFzaGVkIFBhc3N3?= =?big5?Q?ord_Exchange?= Thread-Index: AQHM4QSRjummxzsoaUqVGiZC5NcTNw== Date: Wed, 1 Feb 2012 17:11:44 +0000 Message-ID: <1872CE9C-C36C-4E76-90A5-59271631610B@qualcomm.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.30.39.5] Content-Type: text/plain; charset="big5" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Cc: "Rose, Greg" , "cfrg@irtf.org" Subject: Re: [Cfrg] =?big5?b?tarOYDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNoZWQg?= =?big5?b?UGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2012 17:11:50 -0000 DQpPbiAyMDEyIEZlYiAxLCBhdCAwOjEzICwgPHpob3Uuc3VqaW5nQHp0ZS5jb20uY24+DQo8emhv dS5zdWppbmdAenRlLmNvbS5jbj4gd3JvdGU6DQo+IFNpbmNlIHBhc3N3b3JkcyBhcmUgb2Z0ZW4g bm90IHRvbyBsb25nLCBhbmQgbm90IHNvIHJhbmRvbSwgaXQgaXMgYmV0dGVyIA0KPiB0byBoYXNo IGl0IGJlZm9yZSB1c2luZyBpdCBhcyBhIGtleSBpbiBhIEhNQUMuIA0KDQpJJ20gYWZyYWlkIHRo aXMgaXMgYSBmYWxsYWN5LiBXaGlsZSBpdCB3aWxsIGJlIGxvbmdlciwgYW5kIHdpbGwgbG9vayBy YW5kb20sIHRoZXJlIGlzIGV4YWN0bHkgdGhlIHNhbWUgKGxhY2sgb2YpIGVudHJvcHkgaW4gYSBo YXNoZWQgd2VhayBwYXNzd29yZCBhcyB0aGVyZSBpcyBpbiB0aGUgb3JpZ2luYWwgcGFzc3dvcmQu IEl0J3Mgc3RpbGwgdnVsbmVyYWJsZSB0byBwYXNzd29yZCBzZWFyY2gsIGFsdGhvdWdoIHdpdGgg YSBzbGlnaHRseSBpbmNyZWFzZWQgd29ya2xvYWQgZHVlIHRvIHRoZSAoc2luZ2xlKSBleHRyYSBo YXNoIGludm9jYXRpb24uDQoNCkdyZWcu From prvs=337851090d=uri@ll.mit.edu Wed Feb 1 13:45:46 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D53F111E80F2 for ; Wed, 1 Feb 2012 13:45:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.399 X-Spam-Level: X-Spam-Status: No, score=-3.399 tagged_above=-999 required=5 tests=[AWL=-0.301, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 619m3bt8erV9 for ; Wed, 1 Feb 2012 13:45:46 -0800 (PST) Received: from mx2.ll.mit.edu (MX2.LL.MIT.EDU [129.55.12.46]) by ietfa.amsl.com (Postfix) with ESMTP id 37E6B11E80D3 for ; Wed, 1 Feb 2012 13:45:46 -0800 (PST) Received: from LLE2K7-HUB01.mitll.ad.local (LLE2K7-HUB01.mitll.ad.local) by mx2.ll.mit.edu (unknown) with ESMTP id q11Ljd7b017911 for ; Wed, 1 Feb 2012 16:45:39 -0500 From: "Blumenthal, Uri - 0668 - MITLL" To: "cfrg@irtf.org" Date: Wed, 1 Feb 2012 16:45:35 -0500 Thread-Topic: =?big5?B?W0NmcmddILWqzmA6IFJlOiAgW3NhYWddIE5ldyBkcmFmdDogSGFzaGVkIFBhc3M=?= =?big5?B?d29yZCBFeGNoYW5nZQ==?= Thread-Index: AczhKtX/OtNEbfTsTlGGOKbUr1guRA== Message-ID: In-Reply-To: <1872CE9C-C36C-4E76-90A5-59271631610B@qualcomm.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.12.0.110505 acceptlanguage: en-US Content-Type: text/plain; charset="big5" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.6.7361, 1.0.260, 0.0.0000 definitions=2012-02-01_08:2012-02-01, 2012-02-01, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=52 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=6.0.2-1012030000 definitions=main-1202010225 Subject: Re: [Cfrg] =?big5?b?tarOYDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNoZWQg?= =?big5?b?UGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Feb 2012 21:45:47 -0000 T24gMi8xLzEyIDEyOjExICwgIlJvc2UsIEdyZWciIDxnZ3JAcXVhbGNvbW0uY29tPiB3cm90ZToN Cg0KPk9uIDIwMTIgRmViIDEsIGF0IDA6MTMgLCA8emhvdS5zdWppbmdAenRlLmNvbS5jbj4NCj48 emhvdS5zdWppbmdAenRlLmNvbS5jbj4gd3JvdGU6DQo+PiBTaW5jZSBwYXNzd29yZHMgYXJlIG9m dGVuIG5vdCB0b28gbG9uZywgYW5kIG5vdCBzbyByYW5kb20sIGl0IGlzIGJldHRlcg0KPj4gdG8g aGFzaCBpdCBiZWZvcmUgdXNpbmcgaXQgYXMgYSBrZXkgaW4gYSBITUFDLg0KPg0KPkknbSBhZnJh aWQgdGhpcyBpcyBhIGZhbGxhY3kuIFdoaWxlIGl0IHdpbGwgYmUgbG9uZ2VyLCBhbmQgd2lsbCBs b29rDQo+cmFuZG9tLCB0aGVyZSBpcyBleGFjdGx5IHRoZSBzYW1lIChsYWNrIG9mKSBlbnRyb3B5 IGluIGEgaGFzaGVkIHdlYWsNCj5wYXNzd29yZCBhcyB0aGVyZSBpcyBpbiB0aGUgb3JpZ2luYWwg cGFzc3dvcmQuIEl0J3Mgc3RpbGwgdnVsbmVyYWJsZSB0bw0KPnBhc3N3b3JkIHNlYXJjaCwgYWx0 aG91Z2ggd2l0aCBhIHNsaWdodGx5IGluY3JlYXNlZCB3b3JrbG9hZCBkdWUgdG8gdGhlDQo+KHNp bmdsZSkgZXh0cmEgaGFzaCBpbnZvY2F0aW9uLg0KDQpDb25jdXIgMTAwJS4NCg0K From zhou.sujing@zte.com.cn Wed Feb 1 17:22:36 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D31B71F0C40; Wed, 1 Feb 2012 17:22:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -92.29 X-Spam-Level: X-Spam-Status: No, score=-92.29 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, RCVD_IN_DNSWL_LOW=-1, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id As6x55LDGHNq; Wed, 1 Feb 2012 17:22:35 -0800 (PST) Received: from mx7.zte.com.cn (mx7.zte.com.cn [202.103.147.169]) by ietfa.amsl.com (Postfix) with ESMTP id A61371F0C49; Wed, 1 Feb 2012 17:22:33 -0800 (PST) Received: from [10.30.3.21] by [192.168.168.15] with StormMail ESMTP id 5467.3858719218; Thu, 2 Feb 2012 09:22:31 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q121MOlw057426; Thu, 2 Feb 2012 09:22:24 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: "Blumenthal, Uri - 0668 - MITLL" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Thu, 2 Feb 2012 09:22:10 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-02-02 09:22:25, Serialize complete at 2012-02-02 09:22:25 Content-Type: multipart/alternative; boundary="=_alternative 00078BA448257998_=" X-MAIL: mse02.zte.com.cn q121MOlw057426 Cc: cfrg-bounces@irtf.org, "cfrg@irtf.org" Subject: [Cfrg] =?gb2312?b?tPC4tDogUmU6ICC08Li0OiBSZTogIFtzYWFnXSBOZXcg?= =?gb2312?b?ZHJhZnQ6IEhhc2hlZCBQYXNzd29yZCBFeGNoYW5nZQ==?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2012 01:22:37 -0000 This is a multipart message in MIME format. --=_alternative 00078BA448257998_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 V2VsbKOsIGl0IGlzIHRoZSByZXF1aXJlbWVudCBvZiB0aGUgSE1BQyBmb3Iga2V5IGJlaW5nIGxv bmcgYW5kIHJhbmRvbS4NClRoZW4gaW4gdGhlIGNhc2Ugb2YgdGhlIGRyYWZ0LCBvcmRpbmFyeSBo YXNoIGlzIGVub3VnaCBJIGd1ZXNzPyANCg0KDQpSZWdhcmRzfn5+DQoNCg0KY2ZyZy1ib3VuY2Vz QGlydGYub3JnINC009ogMjAxMi0wMi0wMSAyMzo0OToxMzoNCg0KPiBNeSB0YWtlIG9uIHRoaXMg aXM6IGlmIHlvdSBiZWxpZXZlIHRoYXQgYSBoYXNoLWZ1bmN0aW9uIGlzIGEgZ29vZCANCj4gcmFu ZG9taXplciBhbmQgY2FuIGJlIHVzZWQgaW4gY3J5cHRvZ3JhcGhpYyBrZXkgZ2VuZXJhdGlvbiBw cm9jZXNzIKhDDQo+IHRoZW4gIGl0IGRvZXMgbm90IG1hdHRlciB3aGV0aGVyIHdoYXQgeW91IGZl ZWQgYXMgYSAia2V5IiBpbnB1dCB0byANCj4gSE1BQyBpcyB1bmlmb3JtbHkgZGlzdHJpYnV0ZWQg b3Igbm90IChiZWNhdXNlIG9mIEhNQUMgaW50ZXJuYWwgImhhc2gNCj4gc3BpbnMiKS4gQW5kIGlm IHlvdSBhcmUgdW5lYXN5IG9uIGhvdyByZWFsbHkgcmFuZG9tIHlvdXIgaGFzaCBvdXRwdXQNCj4g aXMgqEMgdGhlbiBhIGxvdCBvZiB0aGUgY3VycmVudGx5IHVzZWQgbWVjaGFuaXNtcyBhbmQgcHJp bWl0aXZlcyBuZWVkDQo+IHJldmlzaXRpbmcuDQo+IC0tIA0KPiBSZWdhcmRzLA0KPiBVcmkgQmx1 bWVudGhhbCAgICAgICAgICAgICAgICAgICAgICAgICAgICBWb2ljZTogKDc4MSkgOTgxLTE2MzgN Cj4gQ3liZXIgU3lzdGVtcyBhbmQgVGVjaG5vbG9neSAgRmF4OiAgICAoNzgxKSA5ODEtMDE4Ng0K PiBNSVQgTGluY29sbiBMYWJvcmF0b3J5IA0KPiANCj4gRnJvbTogInpob3Uuc3VqaW5nQHp0ZS5j b20uY24iIDx6aG91LnN1amluZ0B6dGUuY29tLmNuPg0KPiBEYXRlOiBXZWQsIDEgRmViIDIwMTIg MDM6MTM6MDcgLTA1MDANCj4gVG86IERhbiBIYXJraW5zIDxkaGFya2luc0Bsb3VuZ2Uub3JnPg0K PiBDYzogImNmcmdAaXJ0Zi5vcmciIDxjZnJnQGlydGYub3JnPiwgU3RldmVuIEJlbGxvdmluIA0K PHNtYkBjcy5jb2x1bWJpYS5lZHU+DQo+IFN1YmplY3Q6IFtDZnJnXSC08Li0OiBSZTogW3NhYWdd IE5ldyBkcmFmdDogSGFzaGVkIFBhc3N3b3JkIEV4Y2hhbmdlDQo+IA0KPiANCj4gSGksYWxsDQo+ IA0KPiBjZnJnLWJvdW5jZXNAaXJ0Zi5vcmcg0LTT2iAyMDEyLTAxLTA3IDE3OjAzOjI1Og0KPiAN Cj4gPiANCj4gPiANCj4gPiBPbiBXZWQsIEphbnVhcnkgNCwgMjAxMiAyOjU2IHBtLCBTdGV2ZW4g QmVsbG92aW4gd3JvdGU6DQo+ID4gPiBHb29kIHBvaW50OyBsZXQgbWUgdGhpbmsgYWJvdXQgaXQg Zm9yIC0wMS4gIEFuIG9idmlvdXMgc29sdXRpb24gaXMgDQp0byBzZW5kDQo+ID4gPiB0aGUgaG9z dG5hbWUgd2l0aCB0aGUgZWZmZWN0aXZlIHBhc3N3b3JkLg0KPiA+IA0KPiA+ICAgSG93IGlzIHRo YXQgZGlmZmVyZW50IHRoYW4gdXNpbmcgcmFuZG9tIHNhbHQgdGhlbj8gSWYgX3NvbWV0aGluZ18g aXMNCj4gPiBnb2luZyB0byBiZSBzZW50IHNob3VsZG4ndCBpdCBiZSBhIHVuaWZvcm1seSByYW5k b20gYml0c3RyaW5nIGluc3RlYWQgDQpvZg0KPiA+IGEgaG9zdG5hbWU/DQo+ID4gDQo+ID4gICBB IHVuaWZvcm1seSByYW5kb20gYml0c3RyaW5nIHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUgYXMg YSBrZXkgdG8NCj4gPiBITUFDIHRoYW4gYSBoaWdobHkgc3RydWN0dXJlZCBzdHJpbmcgbGlrZSBh IHBhc3N3b3JkIHRvby4gSXRlcmF0ZQ0KPiA+IEhNQUMoc2FsdCwgcGFzc3dvcmQgfCBzZXJ2aWNl LVVSSSkgaW5zdGVhZCBvZiBITUFDKHBhc3N3b3JkLCANCnNlcnZpY2UtVVJJKS4NCj4gDQo+IA0K PiANCj4gSSB0aGluayBEYW4ncyBzdWdnZXN0aW9uIGlzIHJlYXNvbmFibGUsIEkgY2hlY2tlZCB0 aGUgUkZDIDIxMDQgYW5kIA0KPiBmb3VuZCB0aGUgZm9sbG93aW5nIHNlY3Rpb24gOg0KPiANCj4g IjMuIEtleXMNCj4gDQo+ICAgIFRoZSBrZXkgZm9yIEhNQUMgY2FuIGJlIG9mIGFueSBsZW5ndGgg KGtleXMgbG9uZ2VyIHRoYW4gQiBieXRlcyBhcmUNCj4gICAgZmlyc3QgaGFzaGVkIHVzaW5nIEgp LiAgSG93ZXZlciwgbGVzcyB0aGFuIEwgYnl0ZXMgaXMgc3Ryb25nbHkNCj4gICAgZGlzY291cmFn ZWQgYXMgaXQgd291bGQgZGVjcmVhc2UgdGhlIHNlY3VyaXR5IHN0cmVuZ3RoIG9mIHRoZQ0KPiAg ICBmdW5jdGlvbi4gIEtleXMgbG9uZ2VyIHRoYW4gTCBieXRlcyBhcmUgYWNjZXB0YWJsZSBidXQg dGhlIGV4dHJhDQo+ICAgIGxlbmd0aCB3b3VsZCBub3Qgc2lnbmlmaWNhbnRseSBpbmNyZWFzZSB0 aGUgZnVuY3Rpb24gc3RyZW5ndGguIChBDQo+ICAgIGxvbmdlciBrZXkgbWF5IGJlIGFkdmlzYWJs ZSBpZiB0aGUgcmFuZG9tbmVzcyBvZiB0aGUga2V5IGlzDQo+ICAgIGNvbnNpZGVyZWQgd2Vhay4p DQo+IA0KPiAgICBLZXlzIG5lZWQgdG8gYmUgY2hvc2VuIGF0IHJhbmRvbSAob3IgdXNpbmcgYSBj cnlwdG9ncmFwaGljYWxseSBzdHJvbmcNCj4gICAgcHNldWRvLXJhbmRvbSBnZW5lcmF0b3Igc2Vl ZGVkIHdpdGggYSByYW5kb20gc2VlZCksIGFuZCBwZXJpb2RpY2FsbHkNCj4gICAgcmVmcmVzaGVk LiAgKEN1cnJlbnQgYXR0YWNrcyBkbyBub3QgaW5kaWNhdGUgYSBzcGVjaWZpYyByZWNvbW1lbmRl ZA0KPiAgICBmcmVxdWVuY3kgZm9yIGtleSBjaGFuZ2VzIGFzIHRoZXNlIGF0dGFja3MgYXJlIHBy YWN0aWNhbGx5DQo+ICAgIGluZmVhc2libGUuICBIb3dldmVyLCBwZXJpb2RpYyBrZXkgcmVmcmVz aG1lbnQgaXMgYSBmdW5kYW1lbnRhbA0KPiAgICBzZWN1cml0eSBwcmFjdGljZSB0aGF0IGhlbHBz IGFnYWluc3QgcG90ZW50aWFsIHdlYWtuZXNzZXMgb2YgdGhlDQo+ICAgIGZ1bmN0aW9uIGFuZCBr ZXlzLCBhbmQgbGltaXRzIHRoZSBkYW1hZ2Ugb2YgYW4gZXhwb3NlZCBrZXkuKSINCj4gDQo+IA0K PiBTaW5jZSBwYXNzd29yZHMgYXJlIG9mdGVuIG5vdCB0b28gbG9uZywgYW5kIG5vdCBzbyByYW5k b20sIGl0IGlzIGJldHRlciANCj4gdG8gaGFzaCBpdCBiZWZvcmUgdXNpbmcgaXQgYXMgYSBrZXkg aW4gYSBITUFDLiANCj4gDQo+IA0KPiBSZWdhcmRzfn5+DQo+IA0KPiAtU3VqaW5nIFpob3UNCj4g PiANCj4gPiAgIFRoYXQgc2FpZCwgZ29hbCA0IGluIHRoZSBkcmFmdC0tICJCeSBpdGVyYXRpbmcg YSBzdWZmaWNpZW50IG51bWJlciANCm9mDQo+ID4gdGltZXMsIGRpY3Rpb25hcnkgYXR0YWNrcyBj YW4gYmUgbWFkZSBhcmJpdHJhcmlseSBleHBlbnNpdmUiLS0gc2VlbXMgYQ0KPiA+IGJpdCBtaXNn dWlkZWQuIFRoZSBBbWF6b24gY2xvdWQgc2VydmljZSBoYXMgYmVlbiB1c2VkIHRvIGxhdW5jaCBh bg0KPiA+IG9mZi1saW5lIGRpY3Rpb25hcnkgYXR0YWNrIGFnYWluc3QgdGhlIFdQQS1QU0sgcHJv dG9jb2wgd2hpY2ggdXNlcyANClBCS0RGMg0KPiA+IChITUFDLVNIQTEpIHdpdGggNDA5NiBpdGVy YXRpb25zIHRvIG9iZnVzY2F0ZSBhIHBhc3N3b3JkLiBUaGlzIGF0dGFjaw0KPiA+IGNoZWNrcyAy NCwwMDAsMDAwIGNhbmRpZGF0ZSBwYXNzd29yZHMgcGVyIG1pbnV0ZSBhdCBhIGNvc3Qgb2YgJDAu MjguDQo+ID4gVGhhdCdzIG1vcmUgdGhhbiAxLDYwMCwwMDAsMDAwIGl0ZXJhdGlvbnMgcGVyIHNl Y29uZCBmb3IgYWJvdXQgMS8yIGEgDQpjZW50Lg0KPiA+IFNvIEkgZG9uJ3QgdGhpbmsgaW5jcmVh c2VkIGl0ZXJhdGlvbiBtYWtlcyBkaWN0aW9uYXJ5IGF0dGFja3MgbXVjaCANCm1vcmUNCj4gPiBl eHBlbnNpdmUuDQo+ID4gDQo+ID4gICBXaGljaCBiZWdzIHRoZSBxdWVzdGlvbiwgaG93IGlzIHRo aXMgcHJvcG9zYWwgZGlmZmVyZW50IHRoYW4gUEJLREYyPw0KPiA+IFRoYXQgdGhlICJzYWx0IiBp cyBhIHNlcnZpY2UgVVJJPw0KPiA+IA0KPiA+ICAgcmVnYXJkcywNCj4gPiANCj4gPiAgIERhbi4N Cj4gPiANCj4gPiA+IE9uIEphbiA0LCAyMDEyLCBhdCA1OjIxIDAxUE0sIEpvZSBUb3VjaCB3cm90 ZToNCj4gPiA+DQo+ID4gPj4gSGksIFN0ZXZlLA0KPiA+ID4+DQo+ID4gPj4gVGhpcyBkb2MgZG9l c24ndCBhcHBlYXIgdG8gYWRkcmVzcyB0aGUgY2FzZSB3aGVyZSBhIGhvc3QgaGFzIA0KbXVsdGlw bGUNCj4gPiA+PiBETlMgbmFtZXMsIHdoaWNoIGNvdWxkIG1ha2UgaXQgZGlmZmljdWx0IHRvIGlu Y29ycG9yYXRlIHRoZSANCmhvc3RuYW1lDQo+ID4gPj4gaW50byB0aGUgdHJhbnNmb3JtLiBJLmUu LCBJIGNvdWxkIGNvbnRhY3QgYSBtYWlsIHNlcnZlciBhdCBhbiBJUCANCmFkZHJlc3MNCj4gPiA+ PiB0aGF0IHJlcHJlc2VudHMgYW55IG9mIGRvemVucyBvZiBETlMgbmFtZXMgLSBob3cgZG9lcyB0 aGUgc2VydmVyIA0Ka25vdw0KPiA+ID4+IHdoaWNoIG9uZSBJIHVzZWQgc28gaXQgY2FuIG1hdGNo IHdpdGhvdXQgZXhoYXVzdGl2ZWx5IHRyeWluZyBhbGwgDQppdHMNCj4gPiA+PiBlcXVpdmFsZW50 IG5hbWVzPw0KPiA+ID4+DQo+ID4gPj4gSm9lDQo+ID4gPj4NCj4gPiA+PiBPbiAxLzQvMjAxMiAx OjQxIFBNLCBTdGV2ZW4gQmVsbG92aW4gd3JvdGU6DQo+ID4gPj4+IEknZCBhcHByZWNpYXRlIGNv bW1lbnRzIG9uIG15IG5ldyBkcmFmdCwgDQpkcmFmdC1iZWxsb3Zpbi1ocHctMDAudHh0Og0KPiA+ ID4+Pg0KPiA+ID4+PiBBYnN0cmFjdA0KPiA+ID4+Pg0KPiA+ID4+PiAgICBNYW55IHN5c3RlbXMg KGUuZy4sIGNyeXB0b2dyYXBoaWMgcHJvdG9jb2xzIHJlbHlpbmcgb24gDQpzeW1tZXRyaWMNCj4g PiA+Pj4gICAgY3J5cHRvZ3JhcGh5KSByZXF1aXJlIHRoYXQgcGxhaW50ZXh0IHBhc3N3b3JkcyBi ZSBzdG9yZWQuIEdpdmVuIA0KaG93DQo+ID4gPj4+ICAgIG9mdGVuIHBlb3BsZSByZXVzZSBwYXNz d29yZHMgb24gZGlmZmVyZW50IHN5c3RlbXMsIHRoaXMgcG9zZXMgYSANCnZlcnkNCj4gPiA+Pj4g ICAgc2VyaW91cyByaXNrIGlmIGEgc2luZ2xlIG1hY2hpbmUgaXMgY29tcHJvbWlzZWQuICBXZSBw cm9wb3NlIGENCj4gPiA+Pj4gc2NoZW1lDQo+ID4gPj4+ICAgIHRvIGRlcml2ZSBwYXNzd29yZHMg bGltaXRlZCB0byBhIHNpbmdsZSBtYWNoaW5lIGZyb20gYSB0eXBlZA0KPiA+ID4+PiAgICBwYXNz d29yZCwgYW5kIGV4cGxhaW4gaG93IGEgcHJvdG9jb2wgZGVmaW5pdGlvbiBjYW4gc3BlY2lmeSAN CnRoaXMNCj4gPiA+Pj4gICAgc2NoZW1lLg0KPiA+ID4+Pg0KPiA+ID4+Pg0KPiA+ID4+PiAgICAg ICAtLVN0ZXZlIEJlbGxvdmluLCBodHRwczovL3d3dy5jcy5jb2x1bWJpYS5lZHUvfnNtYg0KPiA+ ID4+Pg0KPiA+ID4+Pg0KPiA+ID4+Pg0KPiA+ID4+Pg0KPiA+ID4+Pg0KPiA+ID4+PiBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ID4+PiBzYWFnIG1h aWxpbmcgbGlzdA0KPiA+ID4+PiBzYWFnQGlldGYub3JnDQo+ID4gPj4+IGh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vc2FhZw0KPiA+ID4+DQo+ID4gPg0KPiA+ID4NCj4gPiA+ ICAgICAgIC0tU3RldmUgQmVsbG92aW4sIGh0dHBzOi8vd3d3LmNzLmNvbHVtYmlhLmVkdS9+c21i DQo+ID4gPg0KPiA+ID4NCj4gPiA+DQo+ID4gPg0KPiA+ID4NCj4gPiA+IF9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ID4gPiBzYWFnIG1haWxpbmcgbGlz dA0KPiA+ID4gc2FhZ0BpZXRmLm9yZw0KPiA+ID4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9zYWFnDQo+ID4gPg0KPiA+IA0KPiA+IA0KPiA+IF9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+ID4gQ2ZyZyBtYWlsaW5nIGxpc3QNCj4g PiBDZnJnQGlydGYub3JnDQo+ID4gaHR0cDovL3d3dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2NmcmcNCj4gPiBbuL28/iAic21pbWUucDdzIiCxuyDW3MvVvrIwMDEzMjgzMS91c2VyL3p0ZV9s dGQgyb6z/V0NCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCj4gQ2ZyZyBtYWlsaW5nIGxpc3QNCj4gQ2ZyZ0BpcnRmLm9yZw0KPiBodHRwOi8vd3d3Lmly dGYub3JnL21haWxtYW4vbGlzdGluZm8vY2ZyZw0KDQo= --=_alternative 00078BA448257998_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPldlbGyjrCBpdCBpcyB0aGUgcmVx dWlyZW1lbnQgb2YgdGhlDQpITUFDIGZvciBrZXkgYmVpbmcgbG9uZyBhbmQgcmFuZG9tLjwvZm9u dD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+VGhlbiBpbiB0aGUgY2FzZSBv ZiB0aGUgZHJhZnQsIG9yZGluYXJ5DQpoYXNoIGlzIGVub3VnaCBJIGd1ZXNzPyAmbmJzcDs8L2Zv bnQ+DQo8YnI+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlJlZ2Fy ZHN+fn48YnI+DQo8YnI+DQo8L2ZvbnQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5jZnJnLWJvdW5j ZXNAaXJ0Zi5vcmcg0LTT2iAyMDEyLTAyLTAxIDIzOjQ5OjEzOjxicj4NCjxicj4NCiZndDsgTXkg dGFrZSBvbiB0aGlzIGlzOiBpZiB5b3UgYmVsaWV2ZSB0aGF0IGEgaGFzaC1mdW5jdGlvbiBpcyBh IGdvb2QNCjxicj4NCiZndDsgcmFuZG9taXplciBhbmQgY2FuIGJlIHVzZWQgaW4gY3J5cHRvZ3Jh cGhpYyBrZXkgZ2VuZXJhdGlvbiBwcm9jZXNzDQqoQzxicj4NCiZndDsgdGhlbiAmbmJzcDtpdCBk b2VzIG5vdCBtYXR0ZXIgd2hldGhlciB3aGF0IHlvdSBmZWVkIGFzIGEgJnF1b3Q7a2V5JnF1b3Q7 DQppbnB1dCB0byA8YnI+DQomZ3Q7IEhNQUMgaXMgdW5pZm9ybWx5IGRpc3RyaWJ1dGVkIG9yIG5v dCAoYmVjYXVzZSBvZiBITUFDIGludGVybmFsICZxdW90O2hhc2g8YnI+DQomZ3Q7IHNwaW5zJnF1 b3Q7KS4gQW5kIGlmIHlvdSBhcmUgdW5lYXN5IG9uIGhvdyByZWFsbHkgcmFuZG9tIHlvdXIgaGFz aA0Kb3V0cHV0PGJyPg0KJmd0OyBpcyCoQyB0aGVuIGEgbG90IG9mIHRoZSBjdXJyZW50bHkgdXNl ZCBtZWNoYW5pc21zIGFuZCBwcmltaXRpdmVzDQpuZWVkPGJyPg0KJmd0OyByZXZpc2l0aW5nLjwv Zm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+Jmd0OyAtLSA8L2ZvbnQ+PC90dD4NCjxi cj48dHQ+PGZvbnQgc2l6ZT0yPiZndDsgUmVnYXJkcyw8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPiZndDsgVXJpIEJsdW1lbnRoYWwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDtWb2ljZTogKDc4MSkNCjk4MS0xNjM4PC9mb250PjwvdHQ+DQo8YnI+PHR0 Pjxmb250IHNpemU9Mj4mZ3Q7IEN5YmVyIFN5c3RlbXMgYW5kIFRlY2hub2xvZ3kgJm5ic3A7RmF4 OiAmbmJzcDsNCiZuYnNwOyg3ODEpIDk4MS0wMTg2PC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250 IHNpemU9Mj4mZ3Q7IE1JVCBMaW5jb2xuIExhYm9yYXRvcnkgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyA8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQg c2l6ZT0yPiZndDsgPGJyPg0KJmd0OyBGcm9tOiAmcXVvdDt6aG91LnN1amluZ0B6dGUuY29tLmNu JnF1b3Q7ICZsdDt6aG91LnN1amluZ0B6dGUuY29tLmNuJmd0Ozxicj4NCiZndDsgRGF0ZTogV2Vk LCAxIEZlYiAyMDEyIDAzOjEzOjA3IC0wNTAwPGJyPg0KJmd0OyBUbzogRGFuIEhhcmtpbnMgJmx0 O2RoYXJraW5zQGxvdW5nZS5vcmcmZ3Q7PGJyPg0KJmd0OyBDYzogJnF1b3Q7Y2ZyZ0BpcnRmLm9y ZyZxdW90OyAmbHQ7Y2ZyZ0BpcnRmLm9yZyZndDssIFN0ZXZlbiBCZWxsb3Zpbg0KJmx0O3NtYkBj cy5jb2x1bWJpYS5lZHUmZ3Q7PGJyPg0KJmd0OyBTdWJqZWN0OiBbQ2ZyZ10gtPC4tDogUmU6IFtz YWFnXSBOZXcgZHJhZnQ6IEhhc2hlZCBQYXNzd29yZCBFeGNoYW5nZTwvZm9udD48L3R0Pg0KPGJy Pjx0dD48Zm9udCBzaXplPTI+Jmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgSGksYWxsPGJyPg0K Jmd0OyA8YnI+DQomZ3Q7IGNmcmctYm91bmNlc0BpcnRmLm9yZyDQtNPaIDIwMTItMDEtMDcgMTc6 MDM6MjU6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IDxicj4NCiZn dDsgJmd0OyBPbiBXZWQsIEphbnVhcnkgNCwgMjAxMiAyOjU2IHBtLCBTdGV2ZW4gQmVsbG92aW4g d3JvdGU6PGJyPg0KJmd0OyAmZ3Q7ICZndDsgR29vZCBwb2ludDsgbGV0IG1lIHRoaW5rIGFib3V0 IGl0IGZvciAtMDEuICZuYnNwO0FuIG9idmlvdXMNCnNvbHV0aW9uIGlzIHRvIHNlbmQ8YnI+DQom Z3Q7ICZndDsgJmd0OyB0aGUgaG9zdG5hbWUgd2l0aCB0aGUgZWZmZWN0aXZlIHBhc3N3b3JkLjxi cj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJm5ic3A7IEhvdyBpcyB0aGF0IGRpZmZlcmVu dCB0aGFuIHVzaW5nIHJhbmRvbSBzYWx0IHRoZW4/IElmDQpfc29tZXRoaW5nXyBpczxicj4NCiZn dDsgJmd0OyBnb2luZyB0byBiZSBzZW50IHNob3VsZG4ndCBpdCBiZSBhIHVuaWZvcm1seSByYW5k b20gYml0c3RyaW5nDQppbnN0ZWFkIG9mPGJyPg0KJmd0OyAmZ3Q7IGEgaG9zdG5hbWU/PGJyPg0K Jmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyAmbmJzcDsgQSB1bmlmb3JtbHkgcmFuZG9tIGJpdHN0 cmluZyB3b3VsZCBiZSBtb3JlIGFwcHJvcHJpYXRlDQphcyBhIGtleSB0bzxicj4NCiZndDsgJmd0 OyBITUFDIHRoYW4gYSBoaWdobHkgc3RydWN0dXJlZCBzdHJpbmcgbGlrZSBhIHBhc3N3b3JkIHRv by4gSXRlcmF0ZTxicj4NCiZndDsgJmd0OyBITUFDKHNhbHQsIHBhc3N3b3JkIHwgc2VydmljZS1V UkkpIGluc3RlYWQgb2YgSE1BQyhwYXNzd29yZCwNCnNlcnZpY2UtVVJJKS48YnI+DQomZ3Q7IDxi cj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEkgdGhpbmsgRGFuJ3Mgc3VnZ2VzdGlvbiBp cyByZWFzb25hYmxlLCBJIGNoZWNrZWQgdGhlIFJGQyAyMTA0IGFuZA0KPGJyPg0KJmd0OyBmb3Vu ZCB0aGUgZm9sbG93aW5nIHNlY3Rpb24gOjxicj4NCiZndDsgPGJyPg0KJmd0OyAmcXVvdDszLiBL ZXlzPGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZuYnNwOyAmbmJzcDtUaGUga2V5IGZvciBITUFDIGNh biBiZSBvZiBhbnkgbGVuZ3RoIChrZXlzIGxvbmdlciB0aGFuDQpCIGJ5dGVzIGFyZTxicj4NCiZn dDsgJm5ic3A7ICZuYnNwO2ZpcnN0IGhhc2hlZCB1c2luZyBIKS4gJm5ic3A7SG93ZXZlciwgbGVz cyB0aGFuIEwgYnl0ZXMNCmlzIHN0cm9uZ2x5PGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7ZGlzY291 cmFnZWQgYXMgaXQgd291bGQgZGVjcmVhc2UgdGhlIHNlY3VyaXR5IHN0cmVuZ3RoDQpvZiB0aGU8 YnI+DQomZ3Q7ICZuYnNwOyAmbmJzcDtmdW5jdGlvbi4gJm5ic3A7S2V5cyBsb25nZXIgdGhhbiBM IGJ5dGVzIGFyZSBhY2NlcHRhYmxlDQpidXQgdGhlIGV4dHJhPGJyPg0KJmd0OyAmbmJzcDsgJm5i c3A7bGVuZ3RoIHdvdWxkIG5vdCBzaWduaWZpY2FudGx5IGluY3JlYXNlIHRoZSBmdW5jdGlvbg0K c3RyZW5ndGguIChBPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7bG9uZ2VyIGtleSBtYXkgYmUgYWR2 aXNhYmxlIGlmIHRoZSByYW5kb21uZXNzIG9mIHRoZQ0Ka2V5IGlzPGJyPg0KJmd0OyAmbmJzcDsg Jm5ic3A7Y29uc2lkZXJlZCB3ZWFrLik8YnI+DQomZ3Q7IDxicj4NCiZndDsgJm5ic3A7ICZuYnNw O0tleXMgbmVlZCB0byBiZSBjaG9zZW4gYXQgcmFuZG9tIChvciB1c2luZyBhIGNyeXB0b2dyYXBo aWNhbGx5DQpzdHJvbmc8YnI+DQomZ3Q7ICZuYnNwOyAmbmJzcDtwc2V1ZG8tcmFuZG9tIGdlbmVy YXRvciBzZWVkZWQgd2l0aCBhIHJhbmRvbSBzZWVkKSwgYW5kDQpwZXJpb2RpY2FsbHk8YnI+DQom Z3Q7ICZuYnNwOyAmbmJzcDtyZWZyZXNoZWQuICZuYnNwOyhDdXJyZW50IGF0dGFja3MgZG8gbm90 IGluZGljYXRlIGEgc3BlY2lmaWMNCnJlY29tbWVuZGVkPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7 ZnJlcXVlbmN5IGZvciBrZXkgY2hhbmdlcyBhcyB0aGVzZSBhdHRhY2tzIGFyZSBwcmFjdGljYWxs eTxicj4NCiZndDsgJm5ic3A7ICZuYnNwO2luZmVhc2libGUuICZuYnNwO0hvd2V2ZXIsIHBlcmlv ZGljIGtleSByZWZyZXNobWVudCBpcw0KYSBmdW5kYW1lbnRhbDxicj4NCiZndDsgJm5ic3A7ICZu YnNwO3NlY3VyaXR5IHByYWN0aWNlIHRoYXQgaGVscHMgYWdhaW5zdCBwb3RlbnRpYWwgd2Vha25l c3Nlcw0Kb2YgdGhlPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7ZnVuY3Rpb24gYW5kIGtleXMsIGFu ZCBsaW1pdHMgdGhlIGRhbWFnZSBvZiBhbiBleHBvc2VkDQprZXkuKSZxdW90Ozxicj4NCiZndDsg PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFNpbmNlIHBhc3N3b3JkcyBhcmUgb2Z0ZW4gbm90IHRvbyBs b25nLCBhbmQgbm90IHNvIHJhbmRvbSwgaXQgaXMgYmV0dGVyDQo8YnI+DQomZ3Q7IHRvIGhhc2gg aXQgYmVmb3JlIHVzaW5nIGl0IGFzIGEga2V5IGluIGEgSE1BQy4gPGJyPg0KJmd0OyA8YnI+DQom Z3Q7IDxicj4NCiZndDsgUmVnYXJkc35+fjxicj4NCiZndDsgPGJyPg0KJmd0OyAtU3VqaW5nIFpo b3U8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7ICZuYnNwOyBUaGF0IHNhaWQsIGdvYWwg NCBpbiB0aGUgZHJhZnQtLSAmcXVvdDtCeSBpdGVyYXRpbmcgYQ0Kc3VmZmljaWVudCBudW1iZXIg b2Y8YnI+DQomZ3Q7ICZndDsgdGltZXMsIGRpY3Rpb25hcnkgYXR0YWNrcyBjYW4gYmUgbWFkZSBh cmJpdHJhcmlseSBleHBlbnNpdmUmcXVvdDstLQ0Kc2VlbXMgYTxicj4NCiZndDsgJmd0OyBiaXQg bWlzZ3VpZGVkLiBUaGUgQW1hem9uIGNsb3VkIHNlcnZpY2UgaGFzIGJlZW4gdXNlZCB0byBsYXVu Y2gNCmFuPGJyPg0KJmd0OyAmZ3Q7IG9mZi1saW5lIGRpY3Rpb25hcnkgYXR0YWNrIGFnYWluc3Qg dGhlIFdQQS1QU0sgcHJvdG9jb2wgd2hpY2gNCnVzZXMgUEJLREYyPGJyPg0KJmd0OyAmZ3Q7IChI TUFDLVNIQTEpIHdpdGggNDA5NiBpdGVyYXRpb25zIHRvIG9iZnVzY2F0ZSBhIHBhc3N3b3JkLiBU aGlzDQphdHRhY2s8YnI+DQomZ3Q7ICZndDsgY2hlY2tzIDI0LDAwMCwwMDAgY2FuZGlkYXRlIHBh c3N3b3JkcyBwZXIgbWludXRlIGF0IGEgY29zdCBvZg0KJDAuMjguPGJyPg0KJmd0OyAmZ3Q7IFRo YXQncyBtb3JlIHRoYW4gMSw2MDAsMDAwLDAwMCBpdGVyYXRpb25zIHBlciBzZWNvbmQgZm9yIGFi b3V0DQoxLzIgYSBjZW50Ljxicj4NCiZndDsgJmd0OyBTbyBJIGRvbid0IHRoaW5rIGluY3JlYXNl ZCBpdGVyYXRpb24gbWFrZXMgZGljdGlvbmFyeSBhdHRhY2tzDQptdWNoIG1vcmU8YnI+DQomZ3Q7 ICZndDsgZXhwZW5zaXZlLjxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJm5ic3A7IFdo aWNoIGJlZ3MgdGhlIHF1ZXN0aW9uLCBob3cgaXMgdGhpcyBwcm9wb3NhbCBkaWZmZXJlbnQNCnRo YW4gUEJLREYyPzxicj4NCiZndDsgJmd0OyBUaGF0IHRoZSAmcXVvdDtzYWx0JnF1b3Q7IGlzIGEg c2VydmljZSBVUkk/PGJyPg0KJmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyAmbmJzcDsgcmVnYXJk cyw8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7ICZuYnNwOyBEYW4uPGJyPg0KJmd0OyAm Z3Q7IDxicj4NCiZndDsgJmd0OyAmZ3Q7IE9uIEphbiA0LCAyMDEyLCBhdCA1OjIxIDAxUE0sIEpv ZSBUb3VjaCB3cm90ZTo8YnI+DQomZ3Q7ICZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0 OyBIaSwgU3RldmUsPGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsm Z3Q7IFRoaXMgZG9jIGRvZXNuJ3QgYXBwZWFyIHRvIGFkZHJlc3MgdGhlIGNhc2Ugd2hlcmUgYQ0K aG9zdCBoYXMgbXVsdGlwbGU8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsgRE5TIG5hbWVzLCB3aGlj aCBjb3VsZCBtYWtlIGl0IGRpZmZpY3VsdCB0byBpbmNvcnBvcmF0ZQ0KdGhlIGhvc3RuYW1lPGJy Pg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7IGludG8gdGhlIHRyYW5zZm9ybS4gSS5lLiwgSSBjb3VsZCBj b250YWN0IGEgbWFpbCBzZXJ2ZXINCmF0IGFuIElQIGFkZHJlc3M8YnI+DQomZ3Q7ICZndDsgJmd0 OyZndDsgdGhhdCByZXByZXNlbnRzIGFueSBvZiBkb3plbnMgb2YgRE5TIG5hbWVzIC0gaG93IGRv ZXMNCnRoZSBzZXJ2ZXIga25vdzxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyB3aGljaCBvbmUgSSB1 c2VkIHNvIGl0IGNhbiBtYXRjaCB3aXRob3V0IGV4aGF1c3RpdmVseQ0KdHJ5aW5nIGFsbCBpdHM8 YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsgZXF1aXZhbGVudCBuYW1lcz88YnI+DQomZ3Q7ICZndDsg Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsgSm9lPGJyPg0KJmd0OyAmZ3Q7ICZndDsm Z3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7IE9uIDEvNC8yMDEyIDE6NDEgUE0sIFN0ZXZlbiBC ZWxsb3ZpbiB3cm90ZTo8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7IEknZCBhcHByZWNpYXRl IGNvbW1lbnRzIG9uIG15IG5ldyBkcmFmdCwgZHJhZnQtYmVsbG92aW4taHB3LTAwLnR4dDo8YnI+ DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7Jmd0OyBBYnN0 cmFjdDxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsm Z3Q7ICZuYnNwOyAmbmJzcDtNYW55IHN5c3RlbXMgKGUuZy4sIGNyeXB0b2dyYXBoaWMgcHJvdG9j b2xzDQpyZWx5aW5nIG9uIHN5bW1ldHJpYzxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyZndDsgJm5i c3A7ICZuYnNwO2NyeXB0b2dyYXBoeSkgcmVxdWlyZSB0aGF0IHBsYWludGV4dA0KcGFzc3dvcmRz IGJlIHN0b3JlZC4gJm5ic3A7R2l2ZW4gaG93PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7Jmd0OyAm bmJzcDsgJm5ic3A7b2Z0ZW4gcGVvcGxlIHJldXNlIHBhc3N3b3JkcyBvbiBkaWZmZXJlbnQNCnN5 c3RlbXMsIHRoaXMgcG9zZXMgYSB2ZXJ5PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7Jmd0OyAmbmJz cDsgJm5ic3A7c2VyaW91cyByaXNrIGlmIGEgc2luZ2xlIG1hY2hpbmUgaXMNCmNvbXByb21pc2Vk LiAmbmJzcDtXZSBwcm9wb3NlIGE8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7IHNjaGVtZTxi cj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7ICZuYnNwO3RvIGRlcml2ZSBwYXNzd29y ZHMgbGltaXRlZCB0byBhIHNpbmdsZQ0KbWFjaGluZSBmcm9tIGEgdHlwZWQ8YnI+DQomZ3Q7ICZn dDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyAmbmJzcDtwYXNzd29yZCwgYW5kIGV4cGxhaW4gaG93IGEg cHJvdG9jb2wNCmRlZmluaXRpb24gY2FuIHNwZWNpZnkgdGhpczxicj4NCiZndDsgJmd0OyAmZ3Q7 Jmd0OyZndDsgJm5ic3A7ICZuYnNwO3NjaGVtZS48YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7 PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyZndDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29s dW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7 ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyAmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsg Jmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyAm Z3Q7Jmd0OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQomZ3Q7ICZndDsgJmd0OyZndDsmZ3Q7IHNhYWcgbWFpbGluZyBsaXN0PGJyPg0KJmd0 OyAmZ3Q7ICZndDsmZ3Q7Jmd0OyBzYWFnQGlldGYub3JnPGJyPg0KJmd0OyAmZ3Q7ICZndDsmZ3Q7 Jmd0OyBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWc8YnI+DQomZ3Q7 ICZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyAmZ3Q7PGJy Pg0KJmd0OyAmZ3Q7ICZndDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLS1TdGV2ZSBCZWxsb3Zpbiwg aHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7ICZndDsgJmd0Ozxicj4N CiZndDsgJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDs8YnI+DQomZ3Q7ICZndDsgJmd0Ozxi cj4NCiZndDsgJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7ICZndDsgX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7ICZndDsgJmd0OyBzYWFnIG1h aWxpbmcgbGlzdDxicj4NCiZndDsgJmd0OyAmZ3Q7IHNhYWdAaWV0Zi5vcmc8YnI+DQomZ3Q7ICZn dDsgJmd0OyBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWc8YnI+DQom Z3Q7ICZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAm Z3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K Jmd0OyAmZ3Q7IENmcmcgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyAmZ3Q7IENmcmdAaXJ0Zi5vcmc8 YnI+DQomZ3Q7ICZndDsgaHR0cDovL3d3dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nmcmc8 YnI+DQomZ3Q7ICZndDsgW7i9vP4gJnF1b3Q7c21pbWUucDdzJnF1b3Q7ILG7INbcy9W+sjAwMTMy ODMxL3VzZXIvenRlX2x0ZA0Kyb6z/V08YnI+DQomZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyBDZnJnIG1haWxpbmcgbGlzdDxicj4N CiZndDsgQ2ZyZ0BpcnRmLm9yZzxicj4NCiZndDsgaHR0cDovL3d3dy5pcnRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2Nmcmc8YnI+DQo8L2ZvbnQ+PC90dD4NCg== --=_alternative 00078BA448257998_=-- From dharkins@lounge.org Thu Feb 2 10:46:35 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 944C321F861F; Thu, 2 Feb 2012 10:46:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.945 X-Spam-Level: X-Spam-Status: No, score=-3.945 tagged_above=-999 required=5 tests=[AWL=-1.269, BAYES_05=-1.11, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w8-mp-yfWG20; Thu, 2 Feb 2012 10:46:34 -0800 (PST) Received: from colo.trepanning.net (colo.trepanning.net [69.55.226.174]) by ietfa.amsl.com (Postfix) with ESMTP id 8E63821F85AF; Thu, 2 Feb 2012 10:46:34 -0800 (PST) Received: from www.trepanning.net (localhost [127.0.0.1]) by colo.trepanning.net (Postfix) with ESMTP id BDB18A88810C; Thu, 2 Feb 2012 10:46:33 -0800 (PST) Received: from 69.12.173.8 (SquirrelMail authenticated user dharkins@lounge.org) by www.trepanning.net with HTTP; Thu, 2 Feb 2012 10:46:33 -0800 (PST) Message-ID: In-Reply-To: References: Date: Thu, 2 Feb 2012 10:46:33 -0800 (PST) From: "Dan Harkins" To: zhou.sujing@zte.com.cn User-Agent: SquirrelMail/1.4.14 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Cc: "cfrg@irtf.org" , cfrg-bounces@irtf.org Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2012 18:46:35 -0000 The issue is that hashing a password doesn't make it "random" (while it might make it "long"). So no, an ordinary hash is not enough. As I suggested, I think a non-secret salt exchanged in the protocol can be used as a key to a HMAC and the password can be included in the data to be HMAC'd. Dan. On Wed, February 1, 2012 5:22 pm, zhou.sujing@zte.com.cn wrote: > Well£¬ it is the requirement of the HMAC for key being long and random. > Then in the case of the draft, ordinary hash is enough I guess? > > > Regards~~~ > > > cfrg-bounces@irtf.org дÓÚ 2012-02-01 23:49:13: > >> My take on this is: if you believe that a hash-function is a good >> randomizer and can be used in cryptographic key generation process ¨C >> then it does not matter whether what you feed as a "key" input to >> HMAC is uniformly distributed or not (because of HMAC internal "hash >> spins"). And if you are uneasy on how really random your hash output >> is ¨C then a lot of the currently used mechanisms and primitives need >> revisiting. >> -- >> Regards, >> Uri Blumenthal Voice: (781) 981-1638 >> Cyber Systems and Technology Fax: (781) 981-0186 >> MIT Lincoln Laboratory >> >> From: "zhou.sujing@zte.com.cn" >> Date: Wed, 1 Feb 2012 03:13:07 -0500 >> To: Dan Harkins >> Cc: "cfrg@irtf.org" , Steven Bellovin > >> Subject: [Cfrg] ´ð¸´: Re: [saag] New draft: Hashed Password Exchange >> >> >> Hi,all >> >> cfrg-bounces@irtf.org дÓÚ 2012-01-07 17:03:25: >> >> > >> > >> > On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote: >> > > Good point; let me think about it for -01. An obvious solution is > to send >> > > the hostname with the effective password. >> > >> > How is that different than using random salt then? If _something_ >> is >> > going to be sent shouldn't it be a uniformly random bitstring instead > of >> > a hostname? >> > >> > A uniformly random bitstring would be more appropriate as a key to >> > HMAC than a highly structured string like a password too. Iterate >> > HMAC(salt, password | service-URI) instead of HMAC(password, > service-URI). >> >> >> >> I think Dan's suggestion is reasonable, I checked the RFC 2104 and >> found the following section : >> >> "3. Keys >> >> The key for HMAC can be of any length (keys longer than B bytes are >> first hashed using H). However, less than L bytes is strongly >> discouraged as it would decrease the security strength of the >> function. Keys longer than L bytes are acceptable but the extra >> length would not significantly increase the function strength. (A >> longer key may be advisable if the randomness of the key is >> considered weak.) >> >> Keys need to be chosen at random (or using a cryptographically >> strong >> pseudo-random generator seeded with a random seed), and periodically >> refreshed. (Current attacks do not indicate a specific recommended >> frequency for key changes as these attacks are practically >> infeasible. However, periodic key refreshment is a fundamental >> security practice that helps against potential weaknesses of the >> function and keys, and limits the damage of an exposed key.)" >> >> >> Since passwords are often not too long, and not so random, it is better >> to hash it before using it as a key in a HMAC. >> >> >> Regards~~~ >> >> -Sujing Zhou >> > >> > That said, goal 4 in the draft-- "By iterating a sufficient number > of >> > times, dictionary attacks can be made arbitrarily expensive"-- seems >> a >> > bit misguided. The Amazon cloud service has been used to launch an >> > off-line dictionary attack against the WPA-PSK protocol which uses > PBKDF2 >> > (HMAC-SHA1) with 4096 iterations to obfuscate a password. This attack >> > checks 24,000,000 candidate passwords per minute at a cost of $0.28. >> > That's more than 1,600,000,000 iterations per second for about 1/2 a > cent. >> > So I don't think increased iteration makes dictionary attacks much > more >> > expensive. >> > >> > Which begs the question, how is this proposal different than >> PBKDF2? >> > That the "salt" is a service URI? >> > >> > regards, >> > >> > Dan. >> > >> > > On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote: >> > > >> > >> Hi, Steve, >> > >> >> > >> This doc doesn't appear to address the case where a host has > multiple >> > >> DNS names, which could make it difficult to incorporate the > hostname >> > >> into the transform. I.e., I could contact a mail server at an IP > address >> > >> that represents any of dozens of DNS names - how does the server > know >> > >> which one I used so it can match without exhaustively trying all > its >> > >> equivalent names? >> > >> >> > >> Joe >> > >> >> > >> On 1/4/2012 1:41 PM, Steven Bellovin wrote: >> > >>> I'd appreciate comments on my new draft, > draft-bellovin-hpw-00.txt: >> > >>> >> > >>> Abstract >> > >>> >> > >>> Many systems (e.g., cryptographic protocols relying on > symmetric >> > >>> cryptography) require that plaintext passwords be stored. Given > how >> > >>> often people reuse passwords on different systems, this poses a > very >> > >>> serious risk if a single machine is compromised. We propose a >> > >>> scheme >> > >>> to derive passwords limited to a single machine from a typed >> > >>> password, and explain how a protocol definition can specify > this >> > >>> scheme. >> > >>> >> > >>> >> > >>> --Steve Bellovin, https://www.cs.columbia.edu/~smb >> > >>> >> > >>> >> > >>> >> > >>> >> > >>> >> > >>> _______________________________________________ >> > >>> saag mailing list >> > >>> saag@ietf.org >> > >>> https://www.ietf.org/mailman/listinfo/saag >> > >> >> > > >> > > >> > > --Steve Bellovin, https://www.cs.columbia.edu/~smb >> > > >> > > >> > > >> > > >> > > >> > > _______________________________________________ >> > > saag mailing list >> > > saag@ietf.org >> > > https://www.ietf.org/mailman/listinfo/saag >> > > >> > >> > >> > _______________________________________________ >> > Cfrg mailing list >> > Cfrg@irtf.org >> > http://www.irtf.org/mailman/listinfo/cfrg >> > [¸½¼þ "smime.p7s" ±» ÖÜËÕ¾²00132831/user/zte_ltd ɾ³ý] >> _______________________________________________ >> Cfrg mailing list >> Cfrg@irtf.org >> http://www.irtf.org/mailman/listinfo/cfrg > > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > http://www.irtf.org/mailman/listinfo/cfrg > From smb@cs.columbia.edu Thu Feb 2 15:38:15 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEC8121F85F0; Thu, 2 Feb 2012 15:38:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.882 X-Spam-Level: X-Spam-Status: No, score=-4.882 tagged_above=-999 required=5 tests=[AWL=-0.383, BAYES_00=-2.599, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nA8Mfjs8a99q; Thu, 2 Feb 2012 15:38:14 -0800 (PST) Received: from brinza.cc.columbia.edu (brinza.cc.columbia.edu [128.59.29.8]) by ietfa.amsl.com (Postfix) with ESMTP id 76A7521F8548; Thu, 2 Feb 2012 15:38:14 -0800 (PST) Received: from [10.9.0.70] (fireball.cs.columbia.edu [128.59.13.10]) (user=smb2132 mech=PLAIN bits=0) by brinza.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q12NcBwp002473 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Thu, 2 Feb 2012 18:38:12 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1257) Content-Type: text/plain; charset=iso-8859-1 From: Steven Bellovin X-Priority: 3 (Normal) In-Reply-To: Date: Thu, 2 Feb 2012 18:38:11 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> References: To: Dan Harkins X-Mailer: Apple Mail (2.1257) X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.8 Cc: cfrg-bounces@irtf.org, "cfrg@irtf.org" Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2012 23:38:15 -0000 I'll be revising my draft soon. For now, let me explain a few points. First -- the primary goal of the draft is avoiding storage of cleartext passwords, because even strong passwords are easily compromised if the device or server is hacked. A second goal is to conceal that the same password is used for two different users or the same user on two = different services. It's obviously true that attackers can still launch password-guessing = attacks. This does increase their work factor. While the difference in work = factor may not be important for targeted attacks, it does help against = broad-scale attacks: can any single password be retrieved? The way I look at it is this: for a given effort, how many passwords can the attacker get? If = the iteration count is doubled, the yield per given effort is obviously = halved. There are no large-scale precomputation attacks possible, because every hashed password is unique for a given triple. I do not see how a random salt would help at all -- it still requires about the same amount of computation per user per service per guess. The essential difference between a random salt and my scheme is that if I change my password to itself, with a random salt the hashed = password would be different; with my scheme, it would be the same. The = attacker's effort would remain the same. In addition, a random salt would hurt usability and/or security. For the former, consider that I (and many other people) have many devices with stored passwords. I personally use three or four computers and two iToys to read mail. So -- I set a = new password from one. I now have to copy down that string and enter it on five other devices. Not very user-friendly. Assume, then, that the salt is sent as part of the protocol. That not only hurts = adoptability, since the protocol would now have to have a way to transmit it at the = right point, after it knows the userid but before the authenticator is entered (quick -- what will that do to, say, IKEv2?), it means that the user's node would have to have the cleartext password available in order to hash it with the salt. But that defeats the purpose of my scheme. HPW requires no changes to the protocol, and the only possible change to the implementation is a longer input buffer. Finally, I'm quite convinced that focusing on strong passwords is = fighting the last war (and, I might add, a war we've lost). *NO ONE* is using strong, unique, memorized passwords ubiquitously -- people have too many=20= of them to remember. By actual count, I have >100 web site passwords, plus login passwords, root passwords, mail passwords, ATM PINs, phone unlock codes, and more. Sorry -- EBRAINFULL. I think that far bigger dangers are password reuse and node compromise. HPW is designed to deal with those threats. "In a world of smart cards, hand-held authenticators, and zero- knowledge proofs, it seems pointless to be worrying about poorly- chosen passwords. Were the world like that, we might agree. Today, it is not." Mike Merritt and I wrote that about 20 years ago, in the original EKE paper. Fortunately, passwords are no longer in use,=20 since they've been replaced by better technology, right? Oh, wait. On Feb 2, 2012, at 1:46 PM, Dan Harkins wrote: >=20 > The issue is that hashing a password doesn't make it "random" > (while it might make it "long"). So no, an ordinary hash is not > enough. As I suggested, I think a non-secret salt exchanged in > the protocol can be used as a key to a HMAC and the password can > be included in the data to be HMAC'd. >=20 > Dan. >=20 > On Wed, February 1, 2012 5:22 pm, zhou.sujing@zte.com.cn wrote: >> Well=A3=AC it is the requirement of the HMAC for key being long and = random. >> Then in the case of the draft, ordinary hash is enough I guess? >>=20 >>=20 >> Regards~~~ >>=20 >>=20 >> cfrg-bounces@irtf.org =D0=B4=D3=DA 2012-02-01 23:49:13: >>=20 >>> My take on this is: if you believe that a hash-function is a good >>> randomizer and can be used in cryptographic key generation process = =A8C >>> then it does not matter whether what you feed as a "key" input to >>> HMAC is uniformly distributed or not (because of HMAC internal "hash >>> spins"). And if you are uneasy on how really random your hash output >>> is =A8C then a lot of the currently used mechanisms and primitives = need >>> revisiting. >>> -- >>> Regards, >>> Uri Blumenthal Voice: (781) 981-1638 >>> Cyber Systems and Technology Fax: (781) 981-0186 >>> MIT Lincoln Laboratory >>>=20 >>> From: "zhou.sujing@zte.com.cn" >>> Date: Wed, 1 Feb 2012 03:13:07 -0500 >>> To: Dan Harkins >>> Cc: "cfrg@irtf.org" , Steven Bellovin >> >>> Subject: [Cfrg] =B4=F0=B8=B4: Re: [saag] New draft: Hashed Password = Exchange >>>=20 >>>=20 >>> Hi,all >>>=20 >>> cfrg-bounces@irtf.org =D0=B4=D3=DA 2012-01-07 17:03:25: >>>=20 >>>>=20 >>>>=20 >>>> On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote: >>>>> Good point; let me think about it for -01. An obvious solution is >> to send >>>>> the hostname with the effective password. >>>>=20 >>>> How is that different than using random salt then? If _something_ >>> is >>>> going to be sent shouldn't it be a uniformly random bitstring = instead >> of >>>> a hostname? >>>>=20 >>>> A uniformly random bitstring would be more appropriate as a key to >>>> HMAC than a highly structured string like a password too. Iterate >>>> HMAC(salt, password | service-URI) instead of HMAC(password, >> service-URI). >>>=20 >>>=20 >>>=20 >>> I think Dan's suggestion is reasonable, I checked the RFC 2104 and >>> found the following section : >>>=20 >>> "3. Keys >>>=20 >>> The key for HMAC can be of any length (keys longer than B bytes = are >>> first hashed using H). However, less than L bytes is strongly >>> discouraged as it would decrease the security strength of the >>> function. Keys longer than L bytes are acceptable but the extra >>> length would not significantly increase the function strength. (A >>> longer key may be advisable if the randomness of the key is >>> considered weak.) >>>=20 >>> Keys need to be chosen at random (or using a cryptographically >>> strong >>> pseudo-random generator seeded with a random seed), and = periodically >>> refreshed. (Current attacks do not indicate a specific = recommended >>> frequency for key changes as these attacks are practically >>> infeasible. However, periodic key refreshment is a fundamental >>> security practice that helps against potential weaknesses of the >>> function and keys, and limits the damage of an exposed key.)" >>>=20 >>>=20 >>> Since passwords are often not too long, and not so random, it is = better >>> to hash it before using it as a key in a HMAC. >>>=20 >>>=20 >>> Regards~~~ >>>=20 >>> -Sujing Zhou >>>>=20 >>>> That said, goal 4 in the draft-- "By iterating a sufficient number >> of >>>> times, dictionary attacks can be made arbitrarily expensive"-- = seems >>> a >>>> bit misguided. The Amazon cloud service has been used to launch an >>>> off-line dictionary attack against the WPA-PSK protocol which uses >> PBKDF2 >>>> (HMAC-SHA1) with 4096 iterations to obfuscate a password. This = attack >>>> checks 24,000,000 candidate passwords per minute at a cost of = $0.28. >>>> That's more than 1,600,000,000 iterations per second for about 1/2 = a >> cent. >>>> So I don't think increased iteration makes dictionary attacks much >> more >>>> expensive. >>>>=20 >>>> Which begs the question, how is this proposal different than >>> PBKDF2? >>>> That the "salt" is a service URI? >>>>=20 >>>> regards, >>>>=20 >>>> Dan. >>>>=20 >>>>> On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote: >>>>>=20 >>>>>> Hi, Steve, >>>>>>=20 >>>>>> This doc doesn't appear to address the case where a host has >> multiple >>>>>> DNS names, which could make it difficult to incorporate the >> hostname >>>>>> into the transform. I.e., I could contact a mail server at an IP >> address >>>>>> that represents any of dozens of DNS names - how does the server >> know >>>>>> which one I used so it can match without exhaustively trying all >> its >>>>>> equivalent names? >>>>>>=20 >>>>>> Joe >>>>>>=20 >>>>>> On 1/4/2012 1:41 PM, Steven Bellovin wrote: >>>>>>> I'd appreciate comments on my new draft, >> draft-bellovin-hpw-00.txt: >>>>>>>=20 >>>>>>> Abstract >>>>>>>=20 >>>>>>> Many systems (e.g., cryptographic protocols relying on >> symmetric >>>>>>> cryptography) require that plaintext passwords be stored. = Given >> how >>>>>>> often people reuse passwords on different systems, this poses = a >> very >>>>>>> serious risk if a single machine is compromised. We propose a >>>>>>> scheme >>>>>>> to derive passwords limited to a single machine from a typed >>>>>>> password, and explain how a protocol definition can specify >> this >>>>>>> scheme. >>>>>>>=20 >>>>>>>=20 >>>>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> saag mailing list >>>>>>> saag@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/saag >>>>>>=20 >>>>>=20 >>>>>=20 >>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> saag mailing list >>>>> saag@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/saag >>>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> Cfrg mailing list >>>> Cfrg@irtf.org >>>> http://www.irtf.org/mailman/listinfo/cfrg >>>> [=B8=BD=BC=FE "smime.p7s" =B1=BB =D6=DC=CB=D5=BE=B200132831/user/zte_= ltd =C9=BE=B3=FD] >>> _______________________________________________ >>> Cfrg mailing list >>> Cfrg@irtf.org >>> http://www.irtf.org/mailman/listinfo/cfrg >>=20 >> _______________________________________________ >> Cfrg mailing list >> Cfrg@irtf.org >> http://www.irtf.org/mailman/listinfo/cfrg >>=20 >=20 >=20 > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > http://www.irtf.org/mailman/listinfo/cfrg >=20 --Steve Bellovin, https://www.cs.columbia.edu/~smb From kmigoe@nsa.gov Fri Feb 3 06:08:04 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AC7C21F85CE for ; Fri, 3 Feb 2012 06:08:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.951 X-Spam-Level: X-Spam-Status: No, score=-2.951 tagged_above=-999 required=5 tests=[AWL=-3.647, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, MIME_8BIT_HEADER=0.3, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_MED=-4, SARE_SUB_ENC_GB2312=1.345] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kRjzd9ve6KHf for ; Fri, 3 Feb 2012 06:08:03 -0800 (PST) Received: from msux-gh1-uea01.nsa.gov (msux-gh1-uea01.nsa.gov [63.239.65.39]) by ietfa.amsl.com (Postfix) with ESMTP id 6638221F8535 for ; Fri, 3 Feb 2012 06:08:03 -0800 (PST) Received: from MSCS-GH1-UEA02.corp.nsa.gov (localhost [127.0.0.1]) by msux-gh1-uea01.nsa.gov (8.12.10/8.12.10) with ESMTP id q13E81ni029912; Fri, 3 Feb 2012 14:08:01 GMT Received: from MSIS-GH1-UEA06.corp.nsa.gov ([10.215.228.137]) by MSCS-GH1-UEA02.corp.nsa.gov with Microsoft SMTPSVC(6.0.3790.3959); Fri, 3 Feb 2012 09:08:01 -0500 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.5 Date: Fri, 3 Feb 2012 09:08:01 -0500 Message-ID: <80F9AC969A517A4DA0DE3E7CF74CC1BB425BAD@MSIS-GH1-UEA06.corp.nsa.gov> In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: =?gb2312?B?W0NmcmddILTwuLQ6IFJlOiAgW3NhYWddIE5ldyBkcmFmdDogSGFzaA==?= =?gb2312?B?ZWQgUGFzc3dvcmQgRXhjaGFuZ2U=?= Thread-Index: AczhKtX/OtNEbfTsTlGGOKbUr1guRABTl2iA References: <1872CE9C-C36C-4E76-90A5-59271631610B@qualcomm.com> From: "Igoe, Kevin M." To: "Blumenthal, Uri - 0668 - MITLL" , X-OriginalArrivalTime: 03 Feb 2012 14:08:01.0545 (UTC) FILETIME=[3D60DF90:01CCE27D] Subject: Re: [Cfrg] =?gb2312?b?tPC4tDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNo?= =?gb2312?b?ZWQgUGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2012 14:08:04 -0000 Applying a function to a random variable can never increase its entopy. See chapter 2 of Cover & Thomas' "Elements of Information Theory", exercise 5, which shows that for any function g and random variable X in the domain of g, H( g(X) ) <=3D H(X)=20 (where H(Z) =3D the entropy of a random variable Z). =20 In our case g is a hash function, X is the original password and=20 g(X) is the hash of the password. Then a hashed password cannot have more entropy than the original password and may in fact=20 have less entropy. > -----Original Message----- > From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf = Of > Blumenthal, Uri - 0668 - MITLL > Sent: Wednesday, February 01, 2012 4:46 PM > To: cfrg@irtf.org > Subject: Re: [Cfrg] =B4=F0=B8=B4: Re: [saag] New draft: Hashed = Password > Exchange >=20 > On 2/1/12 12:11 , "Rose, Greg" wrote: >=20 > >On 2012 Feb 1, at 0:13 , > > wrote: > >> Since passwords are often not too long, and not so random, it is > better > >> to hash it before using it as a key in a HMAC. > > > >I'm afraid this is a fallacy. While it will be longer, and will look > >random, there is exactly the same (lack of) entropy in a hashed weak > >password as there is in the original password. It's still vulnerable > to > >password search, although with a slightly increased workload due to > the > >(single) extra hash invocation. >=20 > Concur 100%. >=20 > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > http://www.irtf.org/mailman/listinfo/cfrg From prvs=338045c413=uri@ll.mit.edu Fri Feb 3 07:46:28 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C01A21F8613 for ; Fri, 3 Feb 2012 07:46:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.923 X-Spam-Level: X-Spam-Status: No, score=-2.923 tagged_above=-999 required=5 tests=[AWL=-0.576, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, SARE_OBFU_ALL=0.751, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KmNQwWgkR7Y for ; Fri, 3 Feb 2012 07:46:27 -0800 (PST) Received: from mx2.ll.mit.edu (MX2.LL.MIT.EDU [129.55.12.46]) by ietfa.amsl.com (Postfix) with ESMTP id 366A721F8610 for ; Fri, 3 Feb 2012 07:46:27 -0800 (PST) Received: from LLE2K7-HUB02.mitll.ad.local (LLE2K7-HUB02.mitll.ad.local) by mx2.ll.mit.edu (unknown) with ESMTP id q13FkCi2002212; Fri, 3 Feb 2012 10:46:21 -0500 From: "Blumenthal, Uri - 0668 - MITLL" To: "Igoe, Kevin M." , "cfrg@irtf.org" Date: Fri, 3 Feb 2012 10:45:54 -0500 Thread-Topic: =?big5?B?W0NmcmddILWqzmA6IFJlOiAgW3NhYWddIE5ldyBkcmFmdDogSGFzaGVkIFBhc3M=?= =?big5?B?d29yZCBFeGNoYW5nZQ==?= Thread-Index: AcziiuvZralO01ZATtGSzKnRilvCdA== Message-ID: In-Reply-To: <80F9AC969A517A4DA0DE3E7CF74CC1BB425BAD@MSIS-GH1-UEA06.corp.nsa.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.12.0.110505 acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3411110754_7626301" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.6.7361, 1.0.260, 0.0.0000 definitions=2012-02-03_05:2012-02-02, 2012-02-03, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=57 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=6.0.2-1012030000 definitions=main-1202030133 Subject: Re: [Cfrg] =?big5?b?tarOYDogUmU6ICBbc2FhZ10gTmV3IGRyYWZ0OiBIYXNoZWQg?= =?big5?b?UGFzc3dvcmQgRXhjaGFuZ2U=?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2012 15:46:28 -0000 --B_3411110754_7626301 Content-type: text/plain; charset="Big5" Content-transfer-encoding: quoted-printable The real benefit of hashing a password is making the result more-or-less uniformly distributed in the key-space of the subsequent consumer (some cryptographers argue that all the proofs about block cipher constructs hold only if the key is random & uniformly distributed :). In this particular case, it shouldn't matter what kind of input HMAC (or the underlying hash) is fed. My $0.02. --=20 Regards, Uri uri@ll.mit.edu On 2/3/12 09:08 AM, "Igoe, Kevin M." wrote: >Applying a function to a random variable can never increase its >entopy. See chapter 2 of Cover & Thomas' "Elements of Information >Theory", exercise 5, which shows that for any function g and random >variable X in the domain of g, > > H( g(X) ) <=3D H(X) > >(where H(Z) =3D the entropy of a random variable Z). >=20 >In our case g is a hash function, X is the original password and >g(X) is the hash of the password. Then a hashed password cannot >have more entropy than the original password and may in fact >have less entropy. > > >> -----Original Message----- >> From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf Of >> Blumenthal, Uri - 0668 - MITLL >> Sent: Wednesday, February 01, 2012 4:46 PM >> To: cfrg@irtf.org >> Subject: Re: [Cfrg] =B5=AA=CE`: Re: [saag] New draft: Hashed Password >> Exchange >>=20 >> On 2/1/12 12:11 , "Rose, Greg" wrote: >>=20 >> >On 2012 Feb 1, at 0:13 , >> > wrote: >> >> Since passwords are often not too long, and not so random, it is >> better >> >> to hash it before using it as a key in a HMAC. >> > >> >I'm afraid this is a fallacy. While it will be longer, and will look >> >random, there is exactly the same (lack of) entropy in a hashed weak >> >password as there is in the original password. It's still vulnerable >> to >> >password search, although with a slightly increased workload due to >> the >> >(single) extra hash invocation. >>=20 >> Concur 100%. >>=20 >> _______________________________________________ >> Cfrg mailing list >> Cfrg@irtf.org >> http://www.irtf.org/mailman/listinfo/cfrg --B_3411110754_7626301 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUAAYJKoZIhvcNAQcCoIIT8TCCE+0CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EeMwggTLMIIDs6ADAgECAgocykucAAAAABz0MA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYT AlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzAR BgNVBAMTCk1JVExMIENBLTIwHhcNMTEwNzE0MTYzMTE0WhcNMTIwNzEzMTYzMTE0WjBhMQsw CQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMG UGVvcGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBANv2QbmKZtfoxOVYMXLUdwjqMm8jsN4GK0n18a6R9uyRcEp4 NLdVAFZ6JeImmxZWNEWXmDyCC+ykliyIJwIUER3zT2LJyIbpELsIv1tkIhWcuLfAYZMsH+kT cKk1LpDm0tE4Z5cCrqTJvS8lUSrglJKOyy9mSG4lySkqqIMg5eRw/oZ/RstqIHy+EJgHgJDY pxleRZbl7s9w1VYKbp8kbHarX9zCzOfp6HW/xtovwP07Z7lUBOWlw7AXXehwC1flwWbG9Eq8 5fDeIKIPj+xS9TmUYguPfJBdDOZYOlUfoRspJ0nwujjeoP9rX3NKyq6cmbOEuP/yTEkDwBrS lEUpNCkCAwEAAaOCAZMwggGPMB0GA1UdDgQWBBREe8exSTToHSIt2geg++QNUdKYHDAOBgNV HQ8BAf8EBAMCBsAwHwYDVR0jBBgwFoAUjkp9iaFjFxyBiDRXNyZFXhmKfiQwMwYDVR0fBCww KjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9MTENBMjBiBggrBgEFBQcB AQRWMFQwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0by9MTENBMjAj BggrBgEFBQcwAYYXaHR0cDovL29jc3AubGwubWl0LmVkdS8wDAYDVR0TAQH/BAIwADA9Bgkr BgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+KcwIB ZAIBBTAiBgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAYBgNVHSAEETAPMA0G CyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MA0GCSqGSIb3DQEBCwUA A4IBAQB17CA8es2u0zGsL5JSMclcdzRDtQHW7cH4HgCJ8neeWltNXQ6x/OhYPFCWAz8x84mQ AnbIycHLKDuuBn17b35Ct3zTs6jbJj0T0m8Elnj6ONk9z/uwmB+fWh43rMjlUyWNVmNOm7sG X2EmZHm7EqHyMzNW3f8bqw+pw9sC5BHQvkPgmBNFxI18YNmpeQYg48ZRP0cRHKaNPTm7AECj up9wxnuW8CnDKW6bzaNErKEQt4HOGvcbHqlLkRwZK1CXEXesI9vCB2Nrytdkbovr2BkvzmUr 5QpGJ+YsLHl2WrM0+yHHW3SKRPJyo3cJylni86AbehQ6k0dZha6exy/UBwmLMIIEtzCCA5+g AwIBAgIBFDANBgkqhkiG9w0BAQsFADBUMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExp bmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRYwFAYDVQQDEw1NSVRMTCBSb290IENB MB4XDTA5MTIxNDEyMDAwMFoXDTE1MTIzMTIzNTk1OVowUTELMAkGA1UEBhMCVVMxHzAdBgNV BAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTETMBEGA1UEAxMKTUlU TEwgQ0EtMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKcEyyNhSIfsN6AzBwVh Zkzo6SdjNGAQ7mA2A8T0kmdCB8MH6jWjVVMwFZwlg9cgjgLKEuEO9KN8K9M8jgeZEMoinlRf k3YELPC7sEkkzBQkcVpLhEwALue9iHowgSLGmXZpYKmRhfvhvYJ4MNCuIaWpcK/GaDZCE+U2 aTg42kv/zQrH3AoqFX81OF7niwXNnanP1hQRfkMTRrnaEW8DX0TMaG/t9Ry5xSMrLTNc9DvQ tjA5ZcuWnECiUpyDBFWxLr9yx7xgf1/LwgCxcoBeKSBBoWzkQmKAsgMo9Mq1Fp/nnIqw5FKm gOs7Vy+6e0Dk+cgf+oAV8AK8ZFMQrVE0uH0CAwEAAaOCAZUwggGRMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFI5KfYmhYxccgYg0VzcmRV4Zin4kMB8GA1UdIwQYMBaAFGeqes/0 Cqa5crWKoNKd8hDDQ+0pMA4GA1UdDwEB/wQEAwIBhjBhBggrBgEFBQcBAQRVMFMwLQYIKwYB BQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0bz9MTFJDQTAiBggrBgEFBQcwAYYW aHR0cDovL29jc3AubGwubWl0LmVkdTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmxs Lm1pdC5lZHUvZ2V0Y3JsP0xMUkNBMIGSBgNVHSAEgYowgYcwDQYLKoZIhvcSAgEDAQYwDQYL KoZIhvcSAgEDAQgwDQYLKoZIhvcSAgEDAQcwDQYLKoZIhvcSAgEDAQkwDQYLKoZIhvcSAgED AQowDQYLKoZIhvcSAgEDAQswDQYLKoZIhvcSAgEDAQ4wDQYLKoZIhvcSAgEDAQ8wDQYLKoZI hvcSAgEDARAwDQYJKoZIhvcNAQELBQADggEBAIh3BqHQ/XH8C6DCL+eEGroOzxBcCqTNItms v4MANaOTodgU2jrjHcGjXlzqhpb8ZxOlkAK3dK09rc6+yACcoK2TzVtDRZXYxov/SqZRjI3d ufU2JatAPxosCyy/1otjl1TKUY47Wvft31vdf5i0XK2DQVEJ+XlqtgBiFTVIMIfBJwPajrsi z+pgFEYwhhwJxvs8flSi0FLCE77VYLEioP5hxG6zIPeQRxzh1bogbfphWHHtoiTDkBSZ4Ufv GXQTVf7QjhD5yYw10yICtjHmtgbfgBkH5/vvR92NY9RSlNPzZqmGKIia61bJCmagRYGyexfe dVNF0cJWL4J/cLHhgNYwggODMIICa6ADAgECAgEBMA0GCSqGSIb3DQEBBQUAMFQxCzAJBgNV BAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kx FjAUBgNVBAMTDU1JVExMIFJvb3QgQ0EwHhcNMDgwOTIzMTIwMDAwWhcNMjkxMjMxMjM1OTU5 WjBUMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoG A1UECxMDUEtJMRYwFAYDVQQDEw1NSVRMTCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAxU4pF1iyJrL5rYq/XBAKg93kCTATG7Bw0NGFpEJ1A3Xsr6UIIq9/1VJB OgCwDqrVsAK1lRwy/lkrHzPkobiMr1wzjQ28SR/9sg5kAcmrMqBYbc302qtwCGKZxdNdhAh2 nUOCO10AMpUsCNdpikPY9ukT8lsA+eorM4Q1rc/L0J6AHRptOU7IuDBdZj+tdNb7gv+GKknr 6wj9m2sVGawoaG7AAqhsWvQUM/q4h/H5FpYlwnVAEh2AzhqiG9bwl6uJJIzJ/8uUWldNkVwz 1I5fR/vCaxiLXIW4oUydBuRKTG+ekEoxHGuD73yx5JtsSciS8HQL2oEM8tv+VAC+albqgwID AQABo2AwXjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRnqnrP9AqmuXK1iqDSnfIQw0Pt KTAfBgNVHSMEGDAWgBRnqnrP9AqmuXK1iqDSnfIQw0PtKTALBgNVHQ8EBAMCAYYwDQYJKoZI hvcNAQEFBQADggEBAD4bbQVg0Hh42EpYX4/JPkNS3OUAEWR/YgzZUY1QGi9rQZ4pfcjU1/Ta oNT8Y7Yf0RO+e9NiG9+BDhQH/kQiZOQo9rv9NUb8xDtKCYCad7zEQtVsYsWuvK2XLw/Ji1m2 eBvoOB4RS/5LAWfNws7W+DWt2ayzeTCyrLSrx7ZVgBjzNOm0TPIkbfppdwgxuo7FZL8ts+M2 492Al87d3VasevUS1pprRBEupChmPTt1hjtajkQOpT4BQAzP1lVEYrWzlv+O/lbP9iujKpYW cfYqQ3FGf37YCvuDeues4xm+nqmyraNsNeI8Gh3XDIwqfzHnLhy4Y80VyqN/Jj8df3SK9AAw ggTOMIIDtqADAgECAgpbJUqmAAAAAA8TMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYTAlVT MR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNV BAMTCk1JVExMIENBLTIwHhcNMTEwMzI0MTIyNjExWhcNMTIwMzIzMTIyNjExWjBhMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMGUGVv cGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAJgc1a1sochMa7t5yY+uE41Zbsv3nHOSCIrCSh4rMUGd7uQLJev7 yg12DVeG5aD0Mh4CfvWY4aPqpLbKmgvtQwRGK7Q4AI8LkmXsrHTPePj8q1xl9D9iLOLJB7NI 6tIWBLoRUpdnpTXpVY48vYh3EawGOoyATcjGIgFDxdQRduCdOfgnhwV5VKLidwTa2u3c1jYr FiCnGwiWRzKFSoNORzEp+Ya9+3IxAoXv1njOCRSsjs0NW1Dk0NRbcQ8GvomFNv0l9wVbKZFP SOxfIdaImNOR6plD0hZXyS1R3AM2rmC+8sHhTe8SjTCH4wTU5GDl3ggMma9Hs9TaH5tQt8AT nj0CAwEAAaOCAZYwggGSMB0GA1UdDgQWBBQQR4g7yYztZ0FyMkiRO+qlMFa91jAOBgNVHQ8B Af8EBAMCBSAwHwYDVR0jBBgwFoAUjkp9iaFjFxyBiDRXNyZFXhmKfiQwMwYDVR0fBCwwKjAo oCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9MTENBMjBiBggrBgEFBQcBAQRW MFQwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXR0by9MTENBMjAjBggr BgEFBQcwAYYXaHR0cDovL29jc3AubGwubWl0LmVkdS8wDAYDVR0TAQH/BAIwADA9BgkrBgEE AYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIB BDAlBgNVHSUEHjAcBgRVHSUABggrBgEFBQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0G CyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVyaUBsbC5taXQuZWR1MA0GCSqGSIb3DQEBCwUA A4IBAQBTX15euArO0iAXeKleS4RByMTW91D/0ihJOIbxiqNkYtyBau2nj11c4njjB58a0pGk YEfxa+LK/bWrOIw1NuZ1f00GcorNcfxixxH4JpiMdC55PYH5aN0r3s3HFTd/Irbdr0J4XA2s K7MyhyiOaOY1rTV7idWdyL8KJW+Y38sOVHLwe0JHpF/TUbF1wmtyam1kj5VJvrBEIjbuEKjl +bPzgCx6ZaTajuo16Op5xFK3ABdq+zKXgXmFGR2NT0nNQ7OnqCpGnVyoOvahFZk1Chr/zUvb V6rINQxtvgnCUGLbaKROfVlmes/vtbLALimVsPRVseBE4I/bpyzfI9F8NwRXMYIB5TCCAeEC AQEwXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEM MAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0yAgocykucAAAAABz0MAkGBSsOAwIa BQCgXTAjBgkqhkiG9w0BCQQxFgQUvKq0iiQBWTzKLrXCw1Z8bWmJKSYwGAYJKoZIhvcNAQkD MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwMjAzMTU0NTU0WjANBgkqhkiG9w0B AQEFAASCAQAWhjggoInJAL/L/3Vyh+t5//rRUOlXpnYfnSKBUmtGxBqgbH8y4QizOTXz2G08 gWGcG0MHB9vYKEXdQmjOQu+8yu6sTUGvLUmsGTLgRX6kEq7osdUbsB6aCFvwh8OKuTwQ8hf8 YhMnkDWNo5XjTniECYQgAip4AgZxkeGwS8EnRj69I0Ls3LNgqk780DrjA7pyDjtjzzcXdOE5 +OQy6oOXlWDZJN4ibpU8uoRJWZI+BFE4AKYYLdA/FDLTrNoiFehfJZi1L2OGJCmnWFOdYwB9 k5SWzjBGpr8rIjuZjrKa5a8rUQRRvFThnA7hsummd+qXN8gZtEfVSO6zj3VYisY7 --B_3411110754_7626301-- From stephen.farrell@cs.tcd.ie Sun Feb 5 05:59:02 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05C5621F8537 for ; Sun, 5 Feb 2012 05:59:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5aDU8yPv3YA4 for ; Sun, 5 Feb 2012 05:59:01 -0800 (PST) Received: from scss.tcd.ie (hermes.cs.tcd.ie [IPv6:2001:770:10:200:889f:cdff:fe8d:ccd2]) by ietfa.amsl.com (Postfix) with ESMTP id B9DE721F8530 for ; Sun, 5 Feb 2012 05:59:00 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by hermes.scss.tcd.ie (Postfix) with ESMTP id 19271171CAA; Sun, 5 Feb 2012 13:58:59 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; h= content-type:in-reply-to:references:subject:mime-version :user-agent:from:date:message-id:received:received: x-virus-scanned; s=cs; t=1328450338; bh=ePTr7Z+kZ1TjBrlA4w3HpSIk yWlBBvhrDErIk2zFvAo=; b=VLHTI3R1hsiDGCmo6+R4WsN8GDY667vXo6ccIAgy XEMEChkISUzFnLF3ztQ+LvNY/sTNoD0BqQPcC1LzwsM/61bM5lcrzMXqzzTaxiK/ uf5zGLWoq7PzpPQQfy6eVKnlDYOyoSbQlXIDcHStfj2NO5X9/z8JgTQ5jTDI7Tmp uDaqKCYcco5F/KUPK1ySgRZ9BysdphmqxtVCqmP/9V4xvuTCRoaU/dhWF6j1mXbs MFNH7X/huyQqfRfmQqLIRd27tw2Tc8E+CbOI6JWsLNwK9iGznptdReSz06jCzyn4 VaWn7S/dhOgYSuqYLoq/ZrG5gKds58Thq1ThJuJUHumZ8g== X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from scss.tcd.ie ([127.0.0.1]) by localhost (scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10027) with ESMTP id MDEiGrDWMkQM; Sun, 5 Feb 2012 13:58:58 +0000 (GMT) Received: from [10.87.48.9] (unknown [86.45.50.113]) by smtp.scss.tcd.ie (Postfix) with ESMTPSA id A0ED4171BFF; Sun, 5 Feb 2012 13:58:57 +0000 (GMT) Message-ID: <4F2E8B21.4050509@cs.tcd.ie> Date: Sun, 05 Feb 2012 13:58:57 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: "cfrg@irtf.org" References: <20120205114344.BF4A262176@rfc-editor.org> In-Reply-To: <20120205114344.BF4A262176@rfc-editor.org> X-Forwarded-Message-Id: <20120205114344.BF4A262176@rfc-editor.org> Content-Type: multipart/mixed; boundary="------------020304070608060503030503" Cc: "Turner, Sean P." Subject: [Cfrg] Fwd: [Technical Errata Reported] RFC4086 (3105) X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Feb 2012 13:59:02 -0000 This is a multi-part message in MIME format. --------------020304070608060503030503 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Opinions welcome, Thanks, Stephen. -------- Original Message -------- Subject: [Technical Errata Reported] RFC4086 (3105) Date: Sun, 5 Feb 2012 03:43:44 -0800 (PST) From: RFC Errata System To: Donald.Eastlake@motorola.com, jis@mit.edu, steve@stevecrocker.com, iesg@ietf.org CC: fw@deneb.enyo.de, rfc-editor@rfc-editor.org The following errata report has been submitted for RFC4086, "Randomness Requirements for Security". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=4086&eid=3105 -------------------------------------- Type: Technical Reported by: Florian Weimer Section: 6.2.2 Original Text ------------- If one uses no more than the: log ( log ( s ) ) 2 2 i low-order bits, then predicting any additional bits from a sequence generated in this manner is provably as hard as factoring n. Corrected Text -------------- (see below) Notes ----- As noted by Koblitz and Menezes in "Another look at provable security II", , this recommendation is based on a misinterpretation of the big-O notation. The claim about provable security is therefore misleading. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC4086 (draft-eastlake-randomness2-10) -------------------------------------- Title : Randomness Requirements for Security Publication Date : June 2005 Author(s) : D. Eastlake 3rd, J. Schiller, S. Crocker Category : BEST CURRENT PRACTICE Source : IETF - NON WORKING GROUP Area : N/A Stream : IETF Verifying Party : IESG --------------020304070608060503030503 Content-Type: text/plain; name="Attached Message Part" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Attached Message Part" --------------020304070608060503030503-- From stephen.farrell@cs.tcd.ie Sun Feb 5 05:59:34 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 091CD21F8537 for ; Sun, 5 Feb 2012 05:59:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qeuSFl8LACB7 for ; Sun, 5 Feb 2012 05:59:33 -0800 (PST) Received: from scss.tcd.ie (hermes.cs.tcd.ie [IPv6:2001:770:10:200:889f:cdff:fe8d:ccd2]) by ietfa.amsl.com (Postfix) with ESMTP id 3B35521F852F for ; Sun, 5 Feb 2012 05:59:33 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by hermes.scss.tcd.ie (Postfix) with ESMTP id A4AED171BFF; Sun, 5 Feb 2012 13:59:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; h= content-type:in-reply-to:references:subject:mime-version :user-agent:from:date:message-id:received:received: x-virus-scanned; s=cs; t=1328450372; bh=pTgErChUw/a0orkxvE3Qa8/Q RmnjdrpLIlRYFFimAP4=; b=tRq1a3WJdvclzzUY7qMITSmyXMTwiKlRzE+pjCZw E4YJYzPmlYAV8wS79qZl5JneGf2P632ZPrWJ653w4nOScL5doeJ5DX7CVZ2pMisQ tnPA3KNd1YV+NzNeEOuOl4uBSvgwxCQ3vQ2docmchUkEo0MmoAqWwiBjO1zZiQe9 XYS/pi0Bl66IXrGTf6uLZgVwtVyfUrFhW7U98L6rdaUzYpbBsrRBWkEF95ahgq2n n7pFJneU0GWNjPkjvl485jRWOfIoKUHp3H/b9ii+dwmHor9yDzTQhdHFpcYtebky ZnadUXyCryYsLSsK0fxuK2j7HbnBWkV8cwqfK14wiNVjrQ== X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from scss.tcd.ie ([127.0.0.1]) by localhost (scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10027) with ESMTP id r3P88oM5nI55; Sun, 5 Feb 2012 13:59:32 +0000 (GMT) Received: from [10.87.48.9] (unknown [86.45.50.113]) by smtp.scss.tcd.ie (Postfix) with ESMTPSA id 3325F171BFD; Sun, 5 Feb 2012 13:59:32 +0000 (GMT) Message-ID: <4F2E8B43.5060205@cs.tcd.ie> Date: Sun, 05 Feb 2012 13:59:31 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: "cfrg@irtf.org" , "Turner, Sean P." References: <20120205115237.D6A1262176@rfc-editor.org> In-Reply-To: <20120205115237.D6A1262176@rfc-editor.org> X-Forwarded-Message-Id: <20120205115237.D6A1262176@rfc-editor.org> Content-Type: multipart/mixed; boundary="------------080000090108060704080407" Subject: [Cfrg] Fwd: [Technical Errata Reported] RFC4086 (3106) X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Feb 2012 13:59:34 -0000 This is a multi-part message in MIME format. --------------080000090108060704080407 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit More opinions still welcome:-) Thanks, Stephen. -------- Original Message -------- Subject: [Technical Errata Reported] RFC4086 (3106) Date: Sun, 5 Feb 2012 03:52:37 -0800 (PST) From: RFC Errata System To: Donald.Eastlake@motorola.com, jis@mit.edu, steve@stevecrocker.com, iesg@ietf.org CC: fw@deneb.enyo.de, rfc-editor@rfc-editor.org The following errata report has been submitted for RFC4086, "Randomness Requirements for Security". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=4086&eid=3106 -------------------------------------- Type: Technical Reported by: Florian Weimer Section: 4.4 Original Text ------------- (see below) Corrected Text -------------- (remove entire section) Notes ----- Compression is not suitable for de-skewing, even if headers are removed. For most compression algorithms, discriminators are known. For instance, in gzip output, the most significant bit of each byte is set with a frequency somewhat above 0.501 (except for small inputs). This means that the output is not uniformly distributed even when looking at isolated bytes. I recommend removal of the entire section. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC4086 (draft-eastlake-randomness2-10) -------------------------------------- Title : Randomness Requirements for Security Publication Date : June 2005 Author(s) : D. Eastlake 3rd, J. Schiller, S. Crocker Category : BEST CURRENT PRACTICE Source : IETF - NON WORKING GROUP Area : N/A Stream : IETF Verifying Party : IESG --------------080000090108060704080407 Content-Type: text/plain; name="Attached Message Part" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Attached Message Part" --------------080000090108060704080407-- From hotz@jpl.nasa.gov Mon Feb 6 15:30:47 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1896511E80B8; Mon, 6 Feb 2012 15:30:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.449 X-Spam-Level: X-Spam-Status: No, score=-6.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8LaRIM2F8i1z; Mon, 6 Feb 2012 15:30:46 -0800 (PST) Received: from mail.jpl.nasa.gov (mailhost.jpl.nasa.gov [128.149.139.106]) by ietfa.amsl.com (Postfix) with ESMTP id 9D37711E80B4; Mon, 6 Feb 2012 15:30:46 -0800 (PST) Received: from laphotz.jpl.nasa.gov (laphotz.jpl.nasa.gov [128.149.133.44]) (authenticated (0 bits)) by smtp.jpl.nasa.gov (Switch-3.4.3/Switch-3.4.3) with ESMTP id q16NUcRt004415 (using TLSv1/SSLv3 with cipher AES128-SHA (128 bits) verified NO); Mon, 6 Feb 2012 15:30:39 -0800 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: "Henry B. Hotz" In-Reply-To: <9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> Date: Mon, 6 Feb 2012 15:30:38 -0800 Content-Transfer-Encoding: 7bit Message-Id: <09A8326E-89A7-4CE7-89AD-A8078995485F@jpl.nasa.gov> References: <9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> To: Steven Bellovin X-Mailer: Apple Mail (2.1084) X-Source-IP: laphotz.jpl.nasa.gov [128.149.133.44] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized Cc: "cfrg@irtf.org" , "cfrg-bounces@irtf.org" Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Feb 2012 23:30:47 -0000 On Feb 2, 2012, at 3:38 PM, Steven Bellovin wrote: > "In a world of smart cards, hand-held authenticators, and zero- > knowledge proofs, it seems pointless to be worrying about poorly- > chosen passwords. Were the world like that, we might agree. Today, > it is not." Mike Merritt and I wrote that about 20 years ago, in > the original EKE paper. Fortunately, passwords are no longer in use, > since they've been replaced by better technology, right? Oh, wait. ;-) ------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From yaronf.ietf@gmail.com Wed Feb 8 01:31:50 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA77E21F86EB for ; Wed, 8 Feb 2012 01:31:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.11 X-Spam-Level: X-Spam-Status: No, score=-102.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 99aJi4XmreMS for ; Wed, 8 Feb 2012 01:31:49 -0800 (PST) Received: from mail-bk0-f54.google.com (mail-bk0-f54.google.com [209.85.214.54]) by ietfa.amsl.com (Postfix) with ESMTP id 6806621F86E4 for ; Wed, 8 Feb 2012 01:31:49 -0800 (PST) Received: by bkbzx1 with SMTP id zx1so349098bkb.13 for ; Wed, 08 Feb 2012 01:31:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=OJ7KRZjQHQyNiU5kZdq7cHoc3px67h8zrszrx4GkEdg=; b=oJ8Q26/MpRi+Yr/R8huDQkqImVRVKEhe2SsxbUTsoUeIYWVI/vVdq8yeWwQSuSrGR4 eBRostFWUWSbI4BJj5g/CTeg7ZJ08jyZO/aZ4KFNUoStD+4Cs1UBZZM0Y3WQcfwWfj+Z IXJ8w4LVPQm4eHuPjkQVwZQ7Ja7GWjP0QSwMk= Received: by 10.204.174.13 with SMTP id r13mr11793252bkz.122.1328693508373; Wed, 08 Feb 2012 01:31:48 -0800 (PST) Received: from [10.0.0.6] (bzq-79-177-156-198.red.bezeqint.net. [79.177.156.198]) by mx.google.com with ESMTPS id d2sm2506863bky.11.2012.02.08.01.31.47 (version=SSLv3 cipher=OTHER); Wed, 08 Feb 2012 01:31:47 -0800 (PST) Message-ID: <4F324101.6080202@gmail.com> Date: Wed, 08 Feb 2012 11:31:45 +0200 From: Yaron Sheffer User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111229 Thunderbird/9.0 MIME-Version: 1.0 To: cfrg@irtf.org References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Cfrg] [saag] New draft: Hashed Password Exchange X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2012 09:31:50 -0000 Hi Steve, to answer your parenthetical question, no, this scheme with a salt added would not fit well into IKEv2, because the user ID is sent along with the user-side authenticator. But then again, this scheme (with or without a salt) is not secure when used in IKEv2-PSK, for the same reasons that a plain password must not be used as an IKEv2 PSK, i.e. it is vulnerable to a dictionary attack by a MITM attacker. Another alternative in IKEv2 is to use a password with one of the "secure EAP methods" listed in Sec. 4 of http://tools.ietf.org/html/rfc5998. These methods either use a long shared secret in lieu of a password, or are zero-knowledge password proof mechanisms. For the latter, storing a password hashed per your proposal may be valuable, and in fact a similar option is mentioned in http://tools.ietf.org/html/rfc6124#section-5.1. Thanks, Yaron > > Message: 1 > Date: Thu, 2 Feb 2012 18:38:11 -0500 > From: Steven Bellovin > To: Dan Harkins > Cc: cfrg-bounces@irtf.org, "cfrg@irtf.org" > Subject: Re: [Cfrg] ????: Re: ????: Re: [saag] New draft: Ha shed > Password Exchange > Message-ID:<9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> > Content-Type: text/plain; charset=iso-8859-1 > > I'll be revising my draft soon. For now, let me explain a few points. > > First -- the primary goal of the draft is avoiding storage of cleartext > passwords, because even strong passwords are easily compromised if the > device or server is hacked. A second goal is to conceal that the same > password is used for two different users or the same user on two different > services. > > It's obviously true that attackers can still launch password-guessing attacks. > This does increase their work factor. While the difference in work factor > may not be important for targeted attacks, it does help against broad-scale > attacks: can any single password be retrieved? The way I look at it is > this: for a given effort, how many passwords can the attacker get? If the > iteration count is doubled, the yield per given effort is obviously halved. > > There are no large-scale precomputation attacks possible, because every > hashed password is unique for a given triple. > > I do not see how a random salt would help at all -- it still requires > about the same amount of computation per user per service per guess. > The essential difference between a random salt and my scheme is that > if I change my password to itself, with a random salt the hashed password > would be different; with my scheme, it would be the same. The attacker's > effort would remain the same. In addition, a random salt would hurt > usability and/or security. For the former, consider that I (and many > other people) have many devices with stored passwords. I personally > use three or four computers and two iToys to read mail. So -- I set a new > password from one. I now have to copy down that string and enter it > on five other devices. Not very user-friendly. Assume, then, that > the salt is sent as part of the protocol. That not only hurts adoptability, > since the protocol would now have to have a way to transmit it at the right > point, after it knows the userid but before the authenticator is entered > (quick -- what will that do to, say, IKEv2?), it means that the user's > node would have to have the cleartext password available in order to > hash it with the salt. But that defeats the purpose of my scheme. > HPW requires no changes to the protocol, and the only possible change > to the implementation is a longer input buffer. > > Finally, I'm quite convinced that focusing on strong passwords is fighting > the last war (and, I might add, a war we've lost). *NO ONE* is using > strong, unique, memorized passwords ubiquitously -- people have too many > of them to remember. By actual count, I have>100 web site passwords, > plus login passwords, root passwords, mail passwords, ATM PINs, phone > unlock codes, and more. Sorry -- EBRAINFULL. I think that far bigger > dangers are password reuse and node compromise. HPW is designed to deal > with those threats. > > "In a world of smart cards, hand-held authenticators, and zero- > knowledge proofs, it seems pointless to be worrying about poorly- > chosen passwords. Were the world like that, we might agree. Today, > it is not." Mike Merritt and I wrote that about 20 years ago, in > the original EKE paper. Fortunately, passwords are no longer in use, > since they've been replaced by better technology, right? Oh, wait. > > From smb@cs.columbia.edu Wed Feb 8 07:21:34 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E239C21F8601 for ; Wed, 8 Feb 2012 07:21:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.664 X-Spam-Level: X-Spam-Status: No, score=-5.664 tagged_above=-999 required=5 tests=[AWL=0.935, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GanJWzREzYyr for ; Wed, 8 Feb 2012 07:21:33 -0800 (PST) Received: from paneer.cc.columbia.edu (paneer.cc.columbia.edu [128.59.29.4]) by ietfa.amsl.com (Postfix) with ESMTP id 4D8FB21F85F9 for ; Wed, 8 Feb 2012 07:21:32 -0800 (PST) Received: from [192.168.2.166] (74-92-112-54-Philadelphia.hfc.comcastbusiness.net [74.92.112.54]) (user=smb2132 mech=PLAIN bits=0) by paneer.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q18FLQar019450 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 8 Feb 2012 10:21:27 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1251.1) Content-Type: text/plain; charset=us-ascii From: Steven Bellovin In-Reply-To: <4F324101.6080202@gmail.com> Date: Wed, 8 Feb 2012 10:21:26 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <763B9C01-E30A-471D-A1E0-29B0F2AEECF4@cs.columbia.edu> References: <4F324101.6080202@gmail.com> To: Yaron Sheffer X-Mailer: Apple Mail (2.1251.1) X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.4 Cc: cfrg@irtf.org Subject: Re: [Cfrg] [saag] New draft: Hashed Password Exchange X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Feb 2012 15:21:34 -0000 Thanks. As you imply, my scheme does nothing about guessing attacks on the wire, from either passive eavesdropping or MITM. It wasn't intended to, and of course that's been a subject of research for 20 years by many people including me. I'd missed 6124. The purpose of my document is more to address the concerns raised in 8.5 of that document. On Feb 8, 2012, at 4:31 45AM, Yaron Sheffer wrote: > Hi Steve, >=20 > to answer your parenthetical question, no, this scheme with a salt = added would not fit well into IKEv2, because the user ID is sent along = with the user-side authenticator. But then again, this scheme (with or = without a salt) is not secure when used in IKEv2-PSK, for the same = reasons that a plain password must not be used as an IKEv2 PSK, i.e. it = is vulnerable to a dictionary attack by a MITM attacker. >=20 > Another alternative in IKEv2 is to use a password with one of the = "secure EAP methods" listed in Sec. 4 of = http://tools.ietf.org/html/rfc5998. These methods either use a long = shared secret in lieu of a password, or are zero-knowledge password = proof mechanisms. For the latter, storing a password hashed per your = proposal may be valuable, and in fact a similar option is mentioned in = http://tools.ietf.org/html/rfc6124#section-5.1. >=20 > Thanks, > Yaron >=20 >>=20 >> Message: 1 >> Date: Thu, 2 Feb 2012 18:38:11 -0500 >> From: Steven Bellovin >> To: Dan Harkins >> Cc: cfrg-bounces@irtf.org, "cfrg@irtf.org" >> Subject: Re: [Cfrg] ????: Re: ????: Re: [saag] New draft: Ha shed >> Password Exchange >> Message-ID:<9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> >> Content-Type: text/plain; charset=3Diso-8859-1 >>=20 >> I'll be revising my draft soon. For now, let me explain a few = points. >>=20 >> First -- the primary goal of the draft is avoiding storage of = cleartext >> passwords, because even strong passwords are easily compromised if = the >> device or server is hacked. A second goal is to conceal that the = same >> password is used for two different users or the same user on two = different >> services. >>=20 >> It's obviously true that attackers can still launch password-guessing = attacks. >> This does increase their work factor. While the difference in work = factor >> may not be important for targeted attacks, it does help against = broad-scale >> attacks: can any single password be retrieved? The way I look at it = is >> this: for a given effort, how many passwords can the attacker get? = If the >> iteration count is doubled, the yield per given effort is obviously = halved. >>=20 >> There are no large-scale precomputation attacks possible, because = every >> hashed password is unique for a given triple. >>=20 >> I do not see how a random salt would help at all -- it still requires >> about the same amount of computation per user per service per guess. >> The essential difference between a random salt and my scheme is that >> if I change my password to itself, with a random salt the hashed = password >> would be different; with my scheme, it would be the same. The = attacker's >> effort would remain the same. In addition, a random salt would hurt >> usability and/or security. For the former, consider that I (and many >> other people) have many devices with stored passwords. I personally >> use three or four computers and two iToys to read mail. So -- I set = a new >> password from one. I now have to copy down that string and enter it >> on five other devices. Not very user-friendly. Assume, then, that >> the salt is sent as part of the protocol. That not only hurts = adoptability, >> since the protocol would now have to have a way to transmit it at the = right >> point, after it knows the userid but before the authenticator is = entered >> (quick -- what will that do to, say, IKEv2?), it means that the = user's >> node would have to have the cleartext password available in order to >> hash it with the salt. But that defeats the purpose of my scheme. >> HPW requires no changes to the protocol, and the only possible change >> to the implementation is a longer input buffer. >>=20 >> Finally, I'm quite convinced that focusing on strong passwords is = fighting >> the last war (and, I might add, a war we've lost). *NO ONE* is using >> strong, unique, memorized passwords ubiquitously -- people have too = many >> of them to remember. By actual count, I have>100 web site passwords, >> plus login passwords, root passwords, mail passwords, ATM PINs, phone >> unlock codes, and more. Sorry -- EBRAINFULL. I think that far = bigger >> dangers are password reuse and node compromise. HPW is designed to = deal >> with those threats. >>=20 >> "In a world of smart cards, hand-held authenticators, and zero- >> knowledge proofs, it seems pointless to be worrying about poorly- >> chosen passwords. Were the world like that, we might agree. Today, >> it is not." Mike Merritt and I wrote that about 20 years ago, in >> the original EKE paper. Fortunately, passwords are no longer in use, >> since they've been replaced by better technology, right? Oh, wait. >>=20 >>=20 > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > http://www.irtf.org/mailman/listinfo/cfrg >=20 --Steve Bellovin, https://www.cs.columbia.edu/~smb From zhou.sujing@zte.com.cn Thu Feb 9 01:50:16 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F29621F86CB for ; Thu, 9 Feb 2012 01:50:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.488 X-Spam-Level: X-Spam-Status: No, score=-96.488 tagged_above=-999 required=5 tests=[AWL=4.098, BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, RCVD_DOUBLE_IP_LOOSE=0.76, RCVD_IN_DNSWL_LOW=-1, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eCq1VsioTC7I for ; Thu, 9 Feb 2012 01:50:14 -0800 (PST) Received: from mx7.zte.com.cn (mx7.zte.com.cn [202.103.147.169]) by ietfa.amsl.com (Postfix) with ESMTP id 3012B21F86CA for ; Thu, 9 Feb 2012 01:50:12 -0800 (PST) Received: from [10.30.3.21] by [192.168.168.15] with StormMail ESMTP id 5467.412906327; Thu, 9 Feb 2012 17:50:08 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q199nlGQ005108; Thu, 9 Feb 2012 17:49:48 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: <9E8EB80F-5D1E-4C68-8D52-4B2432DBF15D@cs.columbia.edu> To: Steven Bellovin MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Thu, 9 Feb 2012 17:49:39 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-02-09 17:49:51, Serialize complete at 2012-02-09 17:49:51 Content-Type: multipart/alternative; boundary="=_alternative 003600CB4825799F_=" X-MAIL: mse02.zte.com.cn q199nlGQ005108 Cc: "cfrg@irtf.org" Subject: [Cfrg] =?utf-8?b?562U5aSNOiBSZTogIMK0w7DCuMK0OiBSZTogIMK0w7DCuMK0?= =?utf-8?q?=3A_Re=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2012 09:50:16 -0000 This is a multipart message in MIME format. --=_alternative 003600CB4825799F_= Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SSB1bmRlcnN0YW5kIHRoZSBhaW0gb2YgeW91ciBwcm9wb3NhbCwgYW5kIHNpbWlsYXIgaWRlYXMg aGF2ZSBhbHNvIGJlZW4gDQpwcm9wb3NlZCwgc3VjaCBhcyBwd2RoYXNoIGJ5IFN0YW5kZm9yZCB1 bml2ZXJzaXR5LA0KYSBvbmx5ICBzaW1wbGUgaGFzaCBiZWZvcmUgc2VuZGluZyBwYXNzd29lZCBj YW4gcHJldmVudCBtb3JlIHNlY3VyaXR5IGxvc3MgDQp3aGVuIGEgc2VydmVyIGlzIGJyb2tlbiwg YmVjYXVzZSBpdCBpcyBodW1hbidzIHdlYWtuZXNzIHRvIGhhdmUgb25seSBhIGZldyANCnNldHMg b2YgcGFzc3dvcmRzLA0KZXZlbiB3b3JzZSwgdGhlIGZldyBwYXNzd29yZHMgYXJlIG9mdGVuIHJh bmRvbWxlc3MgZm9yIG1lbW9yeSBlYXNpbmVzcy4NCg0KQnV0IG9ubHkgaGFzaGluZyBwYXNzd29y ZCB3aWxsIG5vdCBpbmNyZWFzZSBlbnRyb3B5LCBtYXliZSBhbiBvcHRpb24gY2FuIA0KYmUgYWRk ZWQgdG8geW91ciBzY2hlbWUgdGhhdCANCmFub3RoZXIgbG9uZyBhbmQgcmFuZG9tIGtleSBLIGNh biBiZSBzdG9yZWQgZXhjbHVzaXZlbHkgaW4gdGhlIHVzZXIncyANCmRldmljZSwgDQphbmQgdGhl IGVmZmVjdGl2ZSBwYXNzd29yZCBlcXVhbHMgaGFzaCBvZiA8cGFzc3dvcmQsdXNlcixzZXJ2aWNl PiBhbmQgSz8NCg0KDQoNCg0KUmVnYXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KU3RldmVuIEJl bGxvdmluIDxzbWJAY3MuY29sdW1iaWEuZWR1PiDlhpnkuo4gMjAxMi0wMi0wMyAwNzozODoxMToN Cg0KPiBJJ2xsIGJlIHJldmlzaW5nIG15IGRyYWZ0IHNvb24uICBGb3Igbm93LCBsZXQgbWUgZXhw bGFpbiBhIGZldyBwb2ludHMuDQo+IA0KPiBGaXJzdCAtLSB0aGUgcHJpbWFyeSBnb2FsIG9mIHRo ZSBkcmFmdCBpcyBhdm9pZGluZyBzdG9yYWdlIG9mIGNsZWFydGV4dA0KPiBwYXNzd29yZHMsIGJl Y2F1c2UgZXZlbiBzdHJvbmcgcGFzc3dvcmRzIGFyZSBlYXNpbHkgY29tcHJvbWlzZWQgaWYgdGhl DQo+IGRldmljZSBvciBzZXJ2ZXIgaXMgaGFja2VkLiAgQSBzZWNvbmQgZ29hbCBpcyB0byBjb25j ZWFsIHRoYXQgdGhlIHNhbWUNCj4gcGFzc3dvcmQgaXMgdXNlZCBmb3IgdHdvIGRpZmZlcmVudCB1 c2VycyBvciB0aGUgc2FtZSB1c2VyIG9uIHR3byANCmRpZmZlcmVudA0KPiBzZXJ2aWNlcy4NCj4g DQo+IEl0J3Mgb2J2aW91c2x5IHRydWUgdGhhdCBhdHRhY2tlcnMgY2FuIHN0aWxsIGxhdW5jaCBw YXNzd29yZC1ndWVzc2luZyANCmF0dGFja3MuDQo+IFRoaXMgZG9lcyBpbmNyZWFzZSB0aGVpciB3 b3JrIGZhY3Rvci4gIFdoaWxlIHRoZSBkaWZmZXJlbmNlIGluIHdvcmsgDQpmYWN0b3INCj4gbWF5 IG5vdCBiZSBpbXBvcnRhbnQgZm9yIHRhcmdldGVkIGF0dGFja3MsIGl0IGRvZXMgaGVscCBhZ2Fp bnN0IA0KYnJvYWQtc2NhbGUNCj4gYXR0YWNrczogY2FuIGFueSBzaW5nbGUgcGFzc3dvcmQgYmUg cmV0cmlldmVkPyAgVGhlIHdheSBJIGxvb2sgYXQgaXQgaXMNCj4gdGhpczogZm9yIGEgZ2l2ZW4g ZWZmb3J0LCBob3cgbWFueSBwYXNzd29yZHMgY2FuIHRoZSBhdHRhY2tlciBnZXQ/ICBJZiANCnRo ZQ0KPiBpdGVyYXRpb24gY291bnQgaXMgZG91YmxlZCwgdGhlIHlpZWxkIHBlciBnaXZlbiBlZmZv cnQgaXMgb2J2aW91c2x5IA0KaGFsdmVkLg0KPiANCj4gVGhlcmUgYXJlIG5vIGxhcmdlLXNjYWxl IHByZWNvbXB1dGF0aW9uIGF0dGFja3MgcG9zc2libGUsIGJlY2F1c2UgZXZlcnkNCj4gaGFzaGVk IHBhc3N3b3JkIGlzIHVuaXF1ZSBmb3IgYSBnaXZlbiA8cGFzc3dvcmQsdXNlcixzZXJ2aWNlPiB0 cmlwbGUuDQo+IA0KPiBJIGRvIG5vdCBzZWUgaG93IGEgcmFuZG9tIHNhbHQgd291bGQgaGVscCBh dCBhbGwgLS0gaXQgc3RpbGwgcmVxdWlyZXMNCj4gYWJvdXQgdGhlIHNhbWUgYW1vdW50IG9mIGNv bXB1dGF0aW9uIHBlciB1c2VyIHBlciBzZXJ2aWNlIHBlciBndWVzcy4NCj4gVGhlIGVzc2VudGlh bCBkaWZmZXJlbmNlIGJldHdlZW4gYSByYW5kb20gc2FsdCBhbmQgbXkgc2NoZW1lIGlzIHRoYXQN Cj4gaWYgSSBjaGFuZ2UgbXkgcGFzc3dvcmQgdG8gaXRzZWxmLCB3aXRoIGEgcmFuZG9tIHNhbHQg dGhlIGhhc2hlZCANCnBhc3N3b3JkDQo+IHdvdWxkIGJlIGRpZmZlcmVudDsgd2l0aCBteSBzY2hl bWUsIGl0IHdvdWxkIGJlIHRoZSBzYW1lLiAgVGhlIA0KYXR0YWNrZXIncw0KPiBlZmZvcnQgd291 bGQgcmVtYWluIHRoZSBzYW1lLiAgSW4gYWRkaXRpb24sIGEgcmFuZG9tIHNhbHQgd291bGQgaHVy dA0KPiB1c2FiaWxpdHkgYW5kL29yIHNlY3VyaXR5LiAgRm9yIHRoZSBmb3JtZXIsIGNvbnNpZGVy IHRoYXQgSSAoYW5kIG1hbnkNCj4gb3RoZXIgcGVvcGxlKSBoYXZlIG1hbnkgZGV2aWNlcyB3aXRo IHN0b3JlZCBwYXNzd29yZHMuICBJIHBlcnNvbmFsbHkNCj4gdXNlIHRocmVlIG9yIGZvdXIgY29t cHV0ZXJzIGFuZCB0d28gaVRveXMgdG8gcmVhZCBtYWlsLiAgU28gLS0gSSBzZXQgYSANCm5ldw0K PiBwYXNzd29yZCBmcm9tIG9uZS4gIEkgbm93IGhhdmUgdG8gY29weSBkb3duIHRoYXQgc3RyaW5n IGFuZCBlbnRlciBpdA0KPiBvbiBmaXZlIG90aGVyIGRldmljZXMuICBOb3QgdmVyeSB1c2VyLWZy aWVuZGx5LiAgQXNzdW1lLCB0aGVuLCB0aGF0DQo+IHRoZSBzYWx0IGlzIHNlbnQgYXMgcGFydCBv ZiB0aGUgcHJvdG9jb2wuICBUaGF0IG5vdCBvbmx5IGh1cnRzIA0KYWRvcHRhYmlsaXR5LA0KPiBz aW5jZSB0aGUgcHJvdG9jb2wgd291bGQgbm93IGhhdmUgdG8gaGF2ZSBhIHdheSB0byB0cmFuc21p dCBpdCBhdCB0aGUgDQpyaWdodA0KPiBwb2ludCwgYWZ0ZXIgaXQga25vd3MgdGhlIHVzZXJpZCBi dXQgYmVmb3JlIHRoZSBhdXRoZW50aWNhdG9yIGlzIGVudGVyZWQNCj4gKHF1aWNrIC0tIHdoYXQg d2lsbCB0aGF0IGRvIHRvLCBzYXksIElLRXYyPyksIGl0IG1lYW5zIHRoYXQgdGhlIHVzZXIncw0K PiBub2RlIHdvdWxkIGhhdmUgdG8gaGF2ZSB0aGUgY2xlYXJ0ZXh0IHBhc3N3b3JkIGF2YWlsYWJs ZSBpbiBvcmRlciB0bw0KPiBoYXNoIGl0IHdpdGggdGhlIHNhbHQuICBCdXQgdGhhdCBkZWZlYXRz IHRoZSBwdXJwb3NlIG9mIG15IHNjaGVtZS4NCj4gSFBXIHJlcXVpcmVzIG5vIGNoYW5nZXMgdG8g dGhlIHByb3RvY29sLCBhbmQgdGhlIG9ubHkgcG9zc2libGUgY2hhbmdlDQo+IHRvIHRoZSBpbXBs ZW1lbnRhdGlvbiBpcyBhIGxvbmdlciBpbnB1dCBidWZmZXIuDQo+IA0KPiBGaW5hbGx5LCBJJ20g cXVpdGUgY29udmluY2VkIHRoYXQgZm9jdXNpbmcgb24gc3Ryb25nIHBhc3N3b3JkcyBpcyANCmZp Z2h0aW5nDQo+IHRoZSBsYXN0IHdhciAoYW5kLCBJIG1pZ2h0IGFkZCwgYSB3YXIgd2UndmUgbG9z dCkuICAqTk8gT05FKiBpcyB1c2luZw0KPiBzdHJvbmcsIHVuaXF1ZSwgbWVtb3JpemVkIHBhc3N3 b3JkcyB1YmlxdWl0b3VzbHkgLS0gcGVvcGxlIGhhdmUgdG9vIG1hbnkgDQoNCj4gb2YgdGhlbSB0 byByZW1lbWJlci4gIEJ5IGFjdHVhbCBjb3VudCwgSSBoYXZlID4xMDAgd2ViIHNpdGUgcGFzc3dv cmRzLA0KPiBwbHVzIGxvZ2luIHBhc3N3b3Jkcywgcm9vdCBwYXNzd29yZHMsIG1haWwgcGFzc3dv cmRzLCBBVE0gUElOcywgcGhvbmUNCj4gdW5sb2NrIGNvZGVzLCBhbmQgbW9yZS4gIFNvcnJ5IC0t IEVCUkFJTkZVTEwuICBJIHRoaW5rIHRoYXQgZmFyIGJpZ2dlcg0KPiBkYW5nZXJzIGFyZSBwYXNz d29yZCByZXVzZSBhbmQgbm9kZSBjb21wcm9taXNlLiAgSFBXIGlzIGRlc2lnbmVkIHRvIGRlYWwN Cj4gd2l0aCB0aG9zZSB0aHJlYXRzLg0KPiANCj4gIkluIGEgd29ybGQgb2Ygc21hcnQgY2FyZHMs IGhhbmQtaGVsZCBhdXRoZW50aWNhdG9ycywgYW5kIHplcm8tDQo+IGtub3dsZWRnZSBwcm9vZnMs IGl0IHNlZW1zIHBvaW50bGVzcyB0byBiZSB3b3JyeWluZyBhYm91dCBwb29ybHktDQo+IGNob3Nl biBwYXNzd29yZHMuICBXZXJlIHRoZSB3b3JsZCBsaWtlIHRoYXQsIHdlIG1pZ2h0IGFncmVlLiAg VG9kYXksDQo+IGl0IGlzIG5vdC4iICBNaWtlIE1lcnJpdHQgYW5kIEkgd3JvdGUgdGhhdCBhYm91 dCAyMCB5ZWFycyBhZ28sIGluDQo+IHRoZSBvcmlnaW5hbCBFS0UgcGFwZXIuICBGb3J0dW5hdGVs eSwgcGFzc3dvcmRzIGFyZSBubyBsb25nZXIgaW4gdXNlLCANCj4gc2luY2UgdGhleSd2ZSBiZWVu IHJlcGxhY2VkIGJ5IGJldHRlciB0ZWNobm9sb2d5LCByaWdodD8gIE9oLCB3YWl0Lg0KPiANCj4g DQo+IA0KPiBPbiBGZWIgMiwgMjAxMiwgYXQgMTo0NiBQTSwgRGFuIEhhcmtpbnMgd3JvdGU6DQo+ IA0KPiA+IA0KPiA+ICBUaGUgaXNzdWUgaXMgdGhhdCBoYXNoaW5nIGEgcGFzc3dvcmQgZG9lc24n dCBtYWtlIGl0ICJyYW5kb20iDQo+ID4gKHdoaWxlIGl0IG1pZ2h0IG1ha2UgaXQgImxvbmciKS4g U28gbm8sIGFuIG9yZGluYXJ5IGhhc2ggaXMgbm90DQo+ID4gZW5vdWdoLiBBcyBJIHN1Z2dlc3Rl ZCwgSSB0aGluayBhIG5vbi1zZWNyZXQgc2FsdCBleGNoYW5nZWQgaW4NCj4gPiB0aGUgcHJvdG9j b2wgY2FuIGJlIHVzZWQgYXMgYSBrZXkgdG8gYSBITUFDIGFuZCB0aGUgcGFzc3dvcmQgY2FuDQo+ ID4gYmUgaW5jbHVkZWQgaW4gdGhlIGRhdGEgdG8gYmUgSE1BQydkLg0KPiA+IA0KPiA+ICBEYW4u DQo+ID4gDQo+ID4gT24gV2VkLCBGZWJydWFyeSAxLCAyMDEyIDU6MjIgcG0sIHpob3Uuc3VqaW5n QHp0ZS5jb20uY24gd3JvdGU6DQo+ID4+IFdlbGzCo8KsIGl0IGlzIHRoZSByZXF1aXJlbWVudCBv ZiB0aGUgSE1BQyBmb3Iga2V5IGJlaW5nIGxvbmcgYW5kIA0KcmFuZG9tLg0KPiA+PiBUaGVuIGlu IHRoZSBjYXNlIG9mIHRoZSBkcmFmdCwgb3JkaW5hcnkgaGFzaCBpcyBlbm91Z2ggSSBndWVzcz8N Cj4gPj4gDQo+ID4+IA0KPiA+PiBSZWdhcmRzfn5+DQo+ID4+IA0KPiA+PiANCj4gPj4gY2ZyZy1i b3VuY2VzQGlydGYub3JnIMOQwrTDk8OaIDIwMTItMDItMDEgMjM6NDk6MTM6DQo+ID4+IA0KPiA+ Pj4gTXkgdGFrZSBvbiB0aGlzIGlzOiBpZiB5b3UgYmVsaWV2ZSB0aGF0IGEgaGFzaC1mdW5jdGlv biBpcyBhIGdvb2QNCj4gPj4+IHJhbmRvbWl6ZXIgYW5kIGNhbiBiZSB1c2VkIGluIGNyeXB0b2dy YXBoaWMga2V5IGdlbmVyYXRpb24gcHJvY2VzcyANCsKoQw0KPiA+Pj4gdGhlbiAgaXQgZG9lcyBu b3QgbWF0dGVyIHdoZXRoZXIgd2hhdCB5b3UgZmVlZCBhcyBhICJrZXkiIGlucHV0IHRvDQo+ID4+ PiBITUFDIGlzIHVuaWZvcm1seSBkaXN0cmlidXRlZCBvciBub3QgKGJlY2F1c2Ugb2YgSE1BQyBp bnRlcm5hbCAiaGFzaA0KPiA+Pj4gc3BpbnMiKS4gQW5kIGlmIHlvdSBhcmUgdW5lYXN5IG9uIGhv dyByZWFsbHkgcmFuZG9tIHlvdXIgaGFzaCBvdXRwdXQNCj4gPj4+IGlzIMKoQyB0aGVuIGEgbG90 IG9mIHRoZSBjdXJyZW50bHkgdXNlZCBtZWNoYW5pc21zIGFuZCBwcmltaXRpdmVzIA0KbmVlZA0K PiA+Pj4gcmV2aXNpdGluZy4NCj4gPj4+IC0tDQo+ID4+PiBSZWdhcmRzLA0KPiA+Pj4gVXJpIEJs dW1lbnRoYWwgICAgICAgICAgICAgICAgICAgICAgICAgICAgVm9pY2U6ICg3ODEpIDk4MS0xNjM4 DQo+ID4+PiBDeWJlciBTeXN0ZW1zIGFuZCBUZWNobm9sb2d5ICBGYXg6ICAgICg3ODEpIDk4MS0w MTg2DQo+ID4+PiBNSVQgTGluY29sbiBMYWJvcmF0b3J5DQo+ID4+PiANCj4gPj4+IEZyb206ICJ6 aG91LnN1amluZ0B6dGUuY29tLmNuIiA8emhvdS5zdWppbmdAenRlLmNvbS5jbj4NCj4gPj4+IERh dGU6IFdlZCwgMSBGZWIgMjAxMiAwMzoxMzowNyAtMDUwMA0KPiA+Pj4gVG86IERhbiBIYXJraW5z IDxkaGFya2luc0Bsb3VuZ2Uub3JnPg0KPiA+Pj4gQ2M6ICJjZnJnQGlydGYub3JnIiA8Y2ZyZ0Bp cnRmLm9yZz4sIFN0ZXZlbiBCZWxsb3Zpbg0KPiA+PiA8c21iQGNzLmNvbHVtYmlhLmVkdT4NCj4g Pj4+IFN1YmplY3Q6IFtDZnJnXSDCtMOwwrjCtDogUmU6IFtzYWFnXSBOZXcgZHJhZnQ6IEhhc2hl ZCBQYXNzd29yZCBFeGNoYW5nZQ0KPiA+Pj4gDQo+ID4+PiANCj4gPj4+IEhpLGFsbA0KPiA+Pj4g DQo+ID4+PiBjZnJnLWJvdW5jZXNAaXJ0Zi5vcmcgw5DCtMOTw5ogMjAxMi0wMS0wNyAxNzowMzoy NToNCj4gPj4+IA0KPiA+Pj4+IA0KPiA+Pj4+IA0KPiA+Pj4+IE9uIFdlZCwgSmFudWFyeSA0LCAy MDEyIDI6NTYgcG0sIFN0ZXZlbiBCZWxsb3ZpbiB3cm90ZToNCj4gPj4+Pj4gR29vZCBwb2ludDsg bGV0IG1lIHRoaW5rIGFib3V0IGl0IGZvciAtMDEuICBBbiBvYnZpb3VzIHNvbHV0aW9uIGlzDQo+ ID4+IHRvIHNlbmQNCj4gPj4+Pj4gdGhlIGhvc3RuYW1lIHdpdGggdGhlIGVmZmVjdGl2ZSBwYXNz d29yZC4NCj4gPj4+PiANCj4gPj4+PiAgSG93IGlzIHRoYXQgZGlmZmVyZW50IHRoYW4gdXNpbmcg cmFuZG9tIHNhbHQgdGhlbj8gSWYgX3NvbWV0aGluZ18NCj4gPj4+IGlzDQo+ID4+Pj4gZ29pbmcg dG8gYmUgc2VudCBzaG91bGRuJ3QgaXQgYmUgYSB1bmlmb3JtbHkgcmFuZG9tIGJpdHN0cmluZyAN Cmluc3RlYWQNCj4gPj4gb2YNCj4gPj4+PiBhIGhvc3RuYW1lPw0KPiA+Pj4+IA0KPiA+Pj4+ICBB IHVuaWZvcm1seSByYW5kb20gYml0c3RyaW5nIHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUgYXMg YSBrZXkgdG8NCj4gPj4+PiBITUFDIHRoYW4gYSBoaWdobHkgc3RydWN0dXJlZCBzdHJpbmcgbGlr ZSBhIHBhc3N3b3JkIHRvby4gSXRlcmF0ZQ0KPiA+Pj4+IEhNQUMoc2FsdCwgcGFzc3dvcmQgfCBz ZXJ2aWNlLVVSSSkgaW5zdGVhZCBvZiBITUFDKHBhc3N3b3JkLA0KPiA+PiBzZXJ2aWNlLVVSSSku DQo+ID4+PiANCj4gPj4+IA0KPiA+Pj4gDQo+ID4+PiBJIHRoaW5rIERhbidzIHN1Z2dlc3Rpb24g aXMgcmVhc29uYWJsZSwgSSBjaGVja2VkIHRoZSBSRkMgMjEwNCBhbmQNCj4gPj4+IGZvdW5kIHRo ZSBmb2xsb3dpbmcgc2VjdGlvbiA6DQo+ID4+PiANCj4gPj4+ICIzLiBLZXlzDQo+ID4+PiANCj4g Pj4+ICAgVGhlIGtleSBmb3IgSE1BQyBjYW4gYmUgb2YgYW55IGxlbmd0aCAoa2V5cyBsb25nZXIg dGhhbiBCIGJ5dGVzIA0KYXJlDQo+ID4+PiAgIGZpcnN0IGhhc2hlZCB1c2luZyBIKS4gIEhvd2V2 ZXIsIGxlc3MgdGhhbiBMIGJ5dGVzIGlzIHN0cm9uZ2x5DQo+ID4+PiAgIGRpc2NvdXJhZ2VkIGFz IGl0IHdvdWxkIGRlY3JlYXNlIHRoZSBzZWN1cml0eSBzdHJlbmd0aCBvZiB0aGUNCj4gPj4+ICAg ZnVuY3Rpb24uICBLZXlzIGxvbmdlciB0aGFuIEwgYnl0ZXMgYXJlIGFjY2VwdGFibGUgYnV0IHRo ZSBleHRyYQ0KPiA+Pj4gICBsZW5ndGggd291bGQgbm90IHNpZ25pZmljYW50bHkgaW5jcmVhc2Ug dGhlIGZ1bmN0aW9uIHN0cmVuZ3RoLiAoQQ0KPiA+Pj4gICBsb25nZXIga2V5IG1heSBiZSBhZHZp c2FibGUgaWYgdGhlIHJhbmRvbW5lc3Mgb2YgdGhlIGtleSBpcw0KPiA+Pj4gICBjb25zaWRlcmVk IHdlYWsuKQ0KPiA+Pj4gDQo+ID4+PiAgIEtleXMgbmVlZCB0byBiZSBjaG9zZW4gYXQgcmFuZG9t IChvciB1c2luZyBhIGNyeXB0b2dyYXBoaWNhbGx5DQo+ID4+PiBzdHJvbmcNCj4gPj4+ICAgcHNl dWRvLXJhbmRvbSBnZW5lcmF0b3Igc2VlZGVkIHdpdGggYSByYW5kb20gc2VlZCksIGFuZCANCnBl cmlvZGljYWxseQ0KPiA+Pj4gICByZWZyZXNoZWQuICAoQ3VycmVudCBhdHRhY2tzIGRvIG5vdCBp bmRpY2F0ZSBhIHNwZWNpZmljIA0KcmVjb21tZW5kZWQNCj4gPj4+ICAgZnJlcXVlbmN5IGZvciBr ZXkgY2hhbmdlcyBhcyB0aGVzZSBhdHRhY2tzIGFyZSBwcmFjdGljYWxseQ0KPiA+Pj4gICBpbmZl YXNpYmxlLiAgSG93ZXZlciwgcGVyaW9kaWMga2V5IHJlZnJlc2htZW50IGlzIGEgZnVuZGFtZW50 YWwNCj4gPj4+ICAgc2VjdXJpdHkgcHJhY3RpY2UgdGhhdCBoZWxwcyBhZ2FpbnN0IHBvdGVudGlh bCB3ZWFrbmVzc2VzIG9mIHRoZQ0KPiA+Pj4gICBmdW5jdGlvbiBhbmQga2V5cywgYW5kIGxpbWl0 cyB0aGUgZGFtYWdlIG9mIGFuIGV4cG9zZWQga2V5LikiDQo+ID4+PiANCj4gPj4+IA0KPiA+Pj4g U2luY2UgcGFzc3dvcmRzIGFyZSBvZnRlbiBub3QgdG9vIGxvbmcsIGFuZCBub3Qgc28gcmFuZG9t LCBpdCBpcyANCmJldHRlcg0KPiA+Pj4gdG8gaGFzaCBpdCBiZWZvcmUgdXNpbmcgaXQgYXMgYSBr ZXkgaW4gYSBITUFDLg0KPiA+Pj4gDQo+ID4+PiANCj4gPj4+IFJlZ2FyZHN+fn4NCj4gPj4+IA0K PiA+Pj4gLVN1amluZyBaaG91DQo+ID4+Pj4gDQo+ID4+Pj4gIFRoYXQgc2FpZCwgZ29hbCA0IGlu IHRoZSBkcmFmdC0tICJCeSBpdGVyYXRpbmcgYSBzdWZmaWNpZW50IG51bWJlcg0KPiA+PiBvZg0K PiA+Pj4+IHRpbWVzLCBkaWN0aW9uYXJ5IGF0dGFja3MgY2FuIGJlIG1hZGUgYXJiaXRyYXJpbHkg ZXhwZW5zaXZlIi0tIA0Kc2VlbXMNCj4gPj4+IGENCj4gPj4+PiBiaXQgbWlzZ3VpZGVkLiBUaGUg QW1hem9uIGNsb3VkIHNlcnZpY2UgaGFzIGJlZW4gdXNlZCB0byBsYXVuY2ggYW4NCj4gPj4+PiBv ZmYtbGluZSBkaWN0aW9uYXJ5IGF0dGFjayBhZ2FpbnN0IHRoZSBXUEEtUFNLIHByb3RvY29sIHdo aWNoIHVzZXMNCj4gPj4gUEJLREYyDQo+ID4+Pj4gKEhNQUMtU0hBMSkgd2l0aCA0MDk2IGl0ZXJh dGlvbnMgdG8gb2JmdXNjYXRlIGEgcGFzc3dvcmQuIFRoaXMgDQphdHRhY2sNCj4gPj4+PiBjaGVj a3MgMjQsMDAwLDAwMCBjYW5kaWRhdGUgcGFzc3dvcmRzIHBlciBtaW51dGUgYXQgYSBjb3N0IG9m IA0KJDAuMjguDQo+ID4+Pj4gVGhhdCdzIG1vcmUgdGhhbiAxLDYwMCwwMDAsMDAwIGl0ZXJhdGlv bnMgcGVyIHNlY29uZCBmb3IgYWJvdXQgMS8yIA0KYQ0KPiA+PiBjZW50Lg0KPiA+Pj4+IFNvIEkg ZG9uJ3QgdGhpbmsgaW5jcmVhc2VkIGl0ZXJhdGlvbiBtYWtlcyBkaWN0aW9uYXJ5IGF0dGFja3Mg bXVjaA0KPiA+PiBtb3JlDQo+ID4+Pj4gZXhwZW5zaXZlLg0KPiA+Pj4+IA0KPiA+Pj4+ICBXaGlj aCBiZWdzIHRoZSBxdWVzdGlvbiwgaG93IGlzIHRoaXMgcHJvcG9zYWwgZGlmZmVyZW50IHRoYW4N Cj4gPj4+IFBCS0RGMj8NCj4gPj4+PiBUaGF0IHRoZSAic2FsdCIgaXMgYSBzZXJ2aWNlIFVSST8N Cj4gPj4+PiANCj4gPj4+PiAgcmVnYXJkcywNCj4gPj4+PiANCj4gPj4+PiAgRGFuLg0KPiA+Pj4+ IA0KPiA+Pj4+PiBPbiBKYW4gNCwgMjAxMiwgYXQgNToyMSAwMVBNLCBKb2UgVG91Y2ggd3JvdGU6 DQo+ID4+Pj4+IA0KPiA+Pj4+Pj4gSGksIFN0ZXZlLA0KPiA+Pj4+Pj4gDQo+ID4+Pj4+PiBUaGlz IGRvYyBkb2Vzbid0IGFwcGVhciB0byBhZGRyZXNzIHRoZSBjYXNlIHdoZXJlIGEgaG9zdCBoYXMN Cj4gPj4gbXVsdGlwbGUNCj4gPj4+Pj4+IEROUyBuYW1lcywgd2hpY2ggY291bGQgbWFrZSBpdCBk aWZmaWN1bHQgdG8gaW5jb3Jwb3JhdGUgdGhlDQo+ID4+IGhvc3RuYW1lDQo+ID4+Pj4+PiBpbnRv IHRoZSB0cmFuc2Zvcm0uIEkuZS4sIEkgY291bGQgY29udGFjdCBhIG1haWwgc2VydmVyIGF0IGFu IElQDQo+ID4+IGFkZHJlc3MNCj4gPj4+Pj4+IHRoYXQgcmVwcmVzZW50cyBhbnkgb2YgZG96ZW5z IG9mIEROUyBuYW1lcyAtIGhvdyBkb2VzIHRoZSBzZXJ2ZXINCj4gPj4ga25vdw0KPiA+Pj4+Pj4g d2hpY2ggb25lIEkgdXNlZCBzbyBpdCBjYW4gbWF0Y2ggd2l0aG91dCBleGhhdXN0aXZlbHkgdHJ5 aW5nIGFsbA0KPiA+PiBpdHMNCj4gPj4+Pj4+IGVxdWl2YWxlbnQgbmFtZXM/DQo+ID4+Pj4+PiAN Cj4gPj4+Pj4+IEpvZQ0KPiA+Pj4+Pj4gDQo+ID4+Pj4+PiBPbiAxLzQvMjAxMiAxOjQxIFBNLCBT dGV2ZW4gQmVsbG92aW4gd3JvdGU6DQo+ID4+Pj4+Pj4gSSdkIGFwcHJlY2lhdGUgY29tbWVudHMg b24gbXkgbmV3IGRyYWZ0LA0KPiA+PiBkcmFmdC1iZWxsb3Zpbi1ocHctMDAudHh0Og0KPiA+Pj4+ Pj4+IA0KPiA+Pj4+Pj4+IEFic3RyYWN0DQo+ID4+Pj4+Pj4gDQo+ID4+Pj4+Pj4gICBNYW55IHN5 c3RlbXMgKGUuZy4sIGNyeXB0b2dyYXBoaWMgcHJvdG9jb2xzIHJlbHlpbmcgb24NCj4gPj4gc3lt bWV0cmljDQo+ID4+Pj4+Pj4gICBjcnlwdG9ncmFwaHkpIHJlcXVpcmUgdGhhdCBwbGFpbnRleHQg cGFzc3dvcmRzIGJlIHN0b3JlZC4gDQpHaXZlbg0KPiA+PiBob3cNCj4gPj4+Pj4+PiAgIG9mdGVu IHBlb3BsZSByZXVzZSBwYXNzd29yZHMgb24gZGlmZmVyZW50IHN5c3RlbXMsIHRoaXMgcG9zZXMg DQphDQo+ID4+IHZlcnkNCj4gPj4+Pj4+PiAgIHNlcmlvdXMgcmlzayBpZiBhIHNpbmdsZSBtYWNo aW5lIGlzIGNvbXByb21pc2VkLiAgV2UgcHJvcG9zZSBhDQo+ID4+Pj4+Pj4gc2NoZW1lDQo+ID4+ Pj4+Pj4gICB0byBkZXJpdmUgcGFzc3dvcmRzIGxpbWl0ZWQgdG8gYSBzaW5nbGUgbWFjaGluZSBm cm9tIGEgdHlwZWQNCj4gPj4+Pj4+PiAgIHBhc3N3b3JkLCBhbmQgZXhwbGFpbiBob3cgYSBwcm90 b2NvbCBkZWZpbml0aW9uIGNhbiBzcGVjaWZ5DQo+ID4+IHRoaXMNCj4gPj4+Pj4+PiAgIHNjaGVt ZS4NCj4gPj4+Pj4+PiANCj4gPj4+Pj4+PiANCj4gPj4+Pj4+PiAgICAgIC0tU3RldmUgQmVsbG92 aW4sIGh0dHBzOi8vd3d3LmNzLmNvbHVtYmlhLmVkdS9+c21iDQo+ID4+Pj4+Pj4gDQo+ID4+Pj4+ Pj4gDQo+ID4+Pj4+Pj4gDQo+ID4+Pj4+Pj4gDQo+ID4+Pj4+Pj4gDQo+ID4+Pj4+Pj4gX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gPj4+Pj4+PiBzYWFn IG1haWxpbmcgbGlzdA0KPiA+Pj4+Pj4+IHNhYWdAaWV0Zi5vcmcNCj4gPj4+Pj4+PiBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NhYWcNCj4gPj4+Pj4+IA0KPiA+Pj4+PiAN Cj4gPj4+Pj4gDQo+ID4+Pj4+ICAgICAgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3Mu Y29sdW1iaWEuZWR1L35zbWINCj4gPj4+Pj4gDQo+ID4+Pj4+IA0KPiA+Pj4+PiANCj4gPj4+Pj4g DQo+ID4+Pj4+IA0KPiA+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KPiA+Pj4+PiBzYWFnIG1haWxpbmcgbGlzdA0KPiA+Pj4+PiBzYWFnQGlldGYu b3JnDQo+ID4+Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc2FhZw0K PiA+Pj4+PiANCj4gPj4+PiANCj4gPj4+PiANCj4gPj4+PiBfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+Pj4+IENmcmcgbWFpbGluZyBsaXN0DQo+ID4+ Pj4gQ2ZyZ0BpcnRmLm9yZw0KPiA+Pj4+IGh0dHA6Ly93d3cuaXJ0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9jZnJnDQo+ID4+Pj4gW8K4wr3CvMO+ICJzbWltZS5wN3MiIMKxwrsgw5bDnMOLw5XCvsKy MDAxMzI4MzEvdXNlci96dGVfbHRkIMOJwr7Cs8O9XQ0KPiA+Pj4gX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gPj4+IENmcmcgbWFpbGluZyBsaXN0DQo+ ID4+PiBDZnJnQGlydGYub3JnDQo+ID4+PiBodHRwOi8vd3d3LmlydGYub3JnL21haWxtYW4vbGlz dGluZm8vY2ZyZw0KPiA+PiANCj4gPj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4gPj4gQ2ZyZyBtYWlsaW5nIGxpc3QNCj4gPj4gQ2ZyZ0BpcnRmLm9y Zw0KPiA+PiBodHRwOi8vd3d3LmlydGYub3JnL21haWxtYW4vbGlzdGluZm8vY2ZyZw0KPiA+PiAN Cj4gPiANCj4gPiANCj4gPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPiA+IENmcmcgbWFpbGluZyBsaXN0DQo+ID4gQ2ZyZ0BpcnRmLm9yZw0KPiA+IGh0 dHA6Ly93d3cuaXJ0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZnJnDQo+ID4gDQo+IA0KPiANCj4g ICAgICAgLS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35zbWIN Cj4gDQo+IA0KPiANCj4gDQo+IA0KPiANCg0K --=_alternative 003600CB4825799F_= Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkkgdW5kZXJzdGFuZCB0aGUgYWlt IG9mIHlvdXIgcHJvcG9zYWwsDQphbmQgc2ltaWxhciBpZGVhcyBoYXZlIGFsc28gYmVlbiBwcm9w b3NlZCwgc3VjaCBhcyBwd2RoYXNoIGJ5IFN0YW5kZm9yZA0KdW5pdmVyc2l0eSw8L2ZvbnQ+DQo8 YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPmEgb25seSAmbmJzcDtzaW1wbGUgaGFz aCBiZWZvcmUgc2VuZGluZw0KcGFzc3dvZWQgY2FuIHByZXZlbnQgbW9yZSBzZWN1cml0eSBsb3Nz IHdoZW4gYSBzZXJ2ZXIgaXMgYnJva2VuLCBiZWNhdXNlDQppdCBpcyBodW1hbidzIHdlYWtuZXNz IHRvIGhhdmUgb25seSBhIGZldyBzZXRzIG9mIHBhc3N3b3Jkcyw8L2ZvbnQ+DQo8YnI+PGZvbnQg c2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPmV2ZW4gd29yc2UsIHRoZSBmZXcgcGFzc3dvcmRzIGFy ZSBvZnRlbg0KcmFuZG9tbGVzcyBmb3IgbWVtb3J5IGVhc2luZXNzLjwvZm9udD4NCjxicj4NCjxi cj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+QnV0IG9ubHkgaGFzaGluZyBwYXNzd29y ZCB3aWxsIG5vdCBpbmNyZWFzZQ0KZW50cm9weSwgbWF5YmUgYW4gb3B0aW9uIGNhbiBiZSBhZGRl ZCB0byB5b3VyIHNjaGVtZSB0aGF0IDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fu cy1zZXJpZiI+YW5vdGhlciBsb25nIGFuZCByYW5kb20ga2V5IEsgY2FuIGJlDQpzdG9yZWQgZXhj bHVzaXZlbHkgaW4gdGhlIHVzZXIncyBkZXZpY2UsIDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIg ZmFjZT0ic2Fucy1zZXJpZiI+YW5kIHRoZSBlZmZlY3RpdmUgcGFzc3dvcmQgZXF1YWxzIDwvZm9u dD48dHQ+PGZvbnQgc2l6ZT0yPmhhc2gNCm9mICZsdDtwYXNzd29yZCx1c2VyLHNlcnZpY2UmZ3Q7 IGFuZCBLPzwvZm9udD48L3R0Pg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPjxmb250IHNp emU9MiBmYWNlPSJzYW5zLXNlcmlmIj5SZWdhcmRzfn5+PGJyPg0KPGJyPg0KLVN1amluZyBaaG91 PC9mb250Pg0KPGJyPg0KPGJyPjx0dD48Zm9udCBzaXplPTI+U3RldmVuIEJlbGxvdmluICZsdDtz bWJAY3MuY29sdW1iaWEuZWR1Jmd0OyDlhpnkuo4NCjIwMTItMDItMDMgMDc6Mzg6MTE6PGJyPg0K PGJyPg0KJmd0OyBJJ2xsIGJlIHJldmlzaW5nIG15IGRyYWZ0IHNvb24uICZuYnNwO0ZvciBub3cs IGxldCBtZSBleHBsYWluIGEgZmV3DQpwb2ludHMuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEZpcnN0 IC0tIHRoZSBwcmltYXJ5IGdvYWwgb2YgdGhlIGRyYWZ0IGlzIGF2b2lkaW5nIHN0b3JhZ2Ugb2Yg Y2xlYXJ0ZXh0PGJyPg0KJmd0OyBwYXNzd29yZHMsIGJlY2F1c2UgZXZlbiBzdHJvbmcgcGFzc3dv cmRzIGFyZSBlYXNpbHkgY29tcHJvbWlzZWQgaWYNCnRoZTxicj4NCiZndDsgZGV2aWNlIG9yIHNl cnZlciBpcyBoYWNrZWQuICZuYnNwO0Egc2Vjb25kIGdvYWwgaXMgdG8gY29uY2VhbCB0aGF0DQp0 aGUgc2FtZTxicj4NCiZndDsgcGFzc3dvcmQgaXMgdXNlZCBmb3IgdHdvIGRpZmZlcmVudCB1c2Vy cyBvciB0aGUgc2FtZSB1c2VyIG9uIHR3byBkaWZmZXJlbnQ8YnI+DQomZ3Q7IHNlcnZpY2VzLjxi cj4NCiZndDsgPGJyPg0KJmd0OyBJdCdzIG9idmlvdXNseSB0cnVlIHRoYXQgYXR0YWNrZXJzIGNh biBzdGlsbCBsYXVuY2ggcGFzc3dvcmQtZ3Vlc3NpbmcNCmF0dGFja3MuPGJyPg0KJmd0OyBUaGlz IGRvZXMgaW5jcmVhc2UgdGhlaXIgd29yayBmYWN0b3IuICZuYnNwO1doaWxlIHRoZSBkaWZmZXJl bmNlIGluDQp3b3JrIGZhY3Rvcjxicj4NCiZndDsgbWF5IG5vdCBiZSBpbXBvcnRhbnQgZm9yIHRh cmdldGVkIGF0dGFja3MsIGl0IGRvZXMgaGVscCBhZ2FpbnN0IGJyb2FkLXNjYWxlPGJyPg0KJmd0 OyBhdHRhY2tzOiBjYW4gYW55IHNpbmdsZSBwYXNzd29yZCBiZSByZXRyaWV2ZWQ/ICZuYnNwO1Ro ZSB3YXkgSSBsb29rDQphdCBpdCBpczxicj4NCiZndDsgdGhpczogZm9yIGEgZ2l2ZW4gZWZmb3J0 LCBob3cgbWFueSBwYXNzd29yZHMgY2FuIHRoZSBhdHRhY2tlciBnZXQ/DQombmJzcDtJZiB0aGU8 YnI+DQomZ3Q7IGl0ZXJhdGlvbiBjb3VudCBpcyBkb3VibGVkLCB0aGUgeWllbGQgcGVyIGdpdmVu IGVmZm9ydCBpcyBvYnZpb3VzbHkNCmhhbHZlZC48YnI+DQomZ3Q7IDxicj4NCiZndDsgVGhlcmUg YXJlIG5vIGxhcmdlLXNjYWxlIHByZWNvbXB1dGF0aW9uIGF0dGFja3MgcG9zc2libGUsIGJlY2F1 c2UNCmV2ZXJ5PGJyPg0KJmd0OyBoYXNoZWQgcGFzc3dvcmQgaXMgdW5pcXVlIGZvciBhIGdpdmVu ICZsdDtwYXNzd29yZCx1c2VyLHNlcnZpY2UmZ3Q7DQp0cmlwbGUuPGJyPg0KJmd0OyA8YnI+DQom Z3Q7IEkgZG8gbm90IHNlZSBob3cgYSByYW5kb20gc2FsdCB3b3VsZCBoZWxwIGF0IGFsbCAtLSBp dCBzdGlsbCByZXF1aXJlczxicj4NCiZndDsgYWJvdXQgdGhlIHNhbWUgYW1vdW50IG9mIGNvbXB1 dGF0aW9uIHBlciB1c2VyIHBlciBzZXJ2aWNlIHBlciBndWVzcy48YnI+DQomZ3Q7IFRoZSBlc3Nl bnRpYWwgZGlmZmVyZW5jZSBiZXR3ZWVuIGEgcmFuZG9tIHNhbHQgYW5kIG15IHNjaGVtZSBpcyB0 aGF0PGJyPg0KJmd0OyBpZiBJIGNoYW5nZSBteSBwYXNzd29yZCB0byBpdHNlbGYsIHdpdGggYSBy YW5kb20gc2FsdCB0aGUgaGFzaGVkIHBhc3N3b3JkPGJyPg0KJmd0OyB3b3VsZCBiZSBkaWZmZXJl bnQ7IHdpdGggbXkgc2NoZW1lLCBpdCB3b3VsZCBiZSB0aGUgc2FtZS4gJm5ic3A7VGhlDQphdHRh Y2tlcidzPGJyPg0KJmd0OyBlZmZvcnQgd291bGQgcmVtYWluIHRoZSBzYW1lLiAmbmJzcDtJbiBh ZGRpdGlvbiwgYSByYW5kb20gc2FsdCB3b3VsZA0KaHVydDxicj4NCiZndDsgdXNhYmlsaXR5IGFu ZC9vciBzZWN1cml0eS4gJm5ic3A7Rm9yIHRoZSBmb3JtZXIsIGNvbnNpZGVyIHRoYXQgSSAoYW5k DQptYW55PGJyPg0KJmd0OyBvdGhlciBwZW9wbGUpIGhhdmUgbWFueSBkZXZpY2VzIHdpdGggc3Rv cmVkIHBhc3N3b3Jkcy4gJm5ic3A7SSBwZXJzb25hbGx5PGJyPg0KJmd0OyB1c2UgdGhyZWUgb3Ig Zm91ciBjb21wdXRlcnMgYW5kIHR3byBpVG95cyB0byByZWFkIG1haWwuICZuYnNwO1NvIC0tDQpJ IHNldCBhIG5ldzxicj4NCiZndDsgcGFzc3dvcmQgZnJvbSBvbmUuICZuYnNwO0kgbm93IGhhdmUg dG8gY29weSBkb3duIHRoYXQgc3RyaW5nIGFuZCBlbnRlcg0KaXQ8YnI+DQomZ3Q7IG9uIGZpdmUg b3RoZXIgZGV2aWNlcy4gJm5ic3A7Tm90IHZlcnkgdXNlci1mcmllbmRseS4gJm5ic3A7QXNzdW1l LA0KdGhlbiwgdGhhdDxicj4NCiZndDsgdGhlIHNhbHQgaXMgc2VudCBhcyBwYXJ0IG9mIHRoZSBw cm90b2NvbC4gJm5ic3A7VGhhdCBub3Qgb25seSBodXJ0cw0KYWRvcHRhYmlsaXR5LDxicj4NCiZn dDsgc2luY2UgdGhlIHByb3RvY29sIHdvdWxkIG5vdyBoYXZlIHRvIGhhdmUgYSB3YXkgdG8gdHJh bnNtaXQgaXQgYXQNCnRoZSByaWdodDxicj4NCiZndDsgcG9pbnQsIGFmdGVyIGl0IGtub3dzIHRo ZSB1c2VyaWQgYnV0IGJlZm9yZSB0aGUgYXV0aGVudGljYXRvciBpcyBlbnRlcmVkPGJyPg0KJmd0 OyAocXVpY2sgLS0gd2hhdCB3aWxsIHRoYXQgZG8gdG8sIHNheSwgSUtFdjI/KSwgaXQgbWVhbnMg dGhhdCB0aGUgdXNlcidzPGJyPg0KJmd0OyBub2RlIHdvdWxkIGhhdmUgdG8gaGF2ZSB0aGUgY2xl YXJ0ZXh0IHBhc3N3b3JkIGF2YWlsYWJsZSBpbiBvcmRlcg0KdG88YnI+DQomZ3Q7IGhhc2ggaXQg d2l0aCB0aGUgc2FsdC4gJm5ic3A7QnV0IHRoYXQgZGVmZWF0cyB0aGUgcHVycG9zZSBvZiBteSBz Y2hlbWUuPGJyPg0KJmd0OyBIUFcgcmVxdWlyZXMgbm8gY2hhbmdlcyB0byB0aGUgcHJvdG9jb2ws IGFuZCB0aGUgb25seSBwb3NzaWJsZSBjaGFuZ2U8YnI+DQomZ3Q7IHRvIHRoZSBpbXBsZW1lbnRh dGlvbiBpcyBhIGxvbmdlciBpbnB1dCBidWZmZXIuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEZpbmFs bHksIEknbSBxdWl0ZSBjb252aW5jZWQgdGhhdCBmb2N1c2luZyBvbiBzdHJvbmcgcGFzc3dvcmRz IGlzDQpmaWdodGluZzxicj4NCiZndDsgdGhlIGxhc3Qgd2FyIChhbmQsIEkgbWlnaHQgYWRkLCBh IHdhciB3ZSd2ZSBsb3N0KS4gJm5ic3A7Kk5PIE9ORSoNCmlzIHVzaW5nPGJyPg0KJmd0OyBzdHJv bmcsIHVuaXF1ZSwgbWVtb3JpemVkIHBhc3N3b3JkcyB1YmlxdWl0b3VzbHkgLS0gcGVvcGxlIGhh dmUgdG9vDQptYW55IDxicj4NCiZndDsgb2YgdGhlbSB0byByZW1lbWJlci4gJm5ic3A7QnkgYWN0 dWFsIGNvdW50LCBJIGhhdmUgJmd0OzEwMCB3ZWIgc2l0ZQ0KcGFzc3dvcmRzLDxicj4NCiZndDsg cGx1cyBsb2dpbiBwYXNzd29yZHMsIHJvb3QgcGFzc3dvcmRzLCBtYWlsIHBhc3N3b3JkcywgQVRN IFBJTnMsIHBob25lPGJyPg0KJmd0OyB1bmxvY2sgY29kZXMsIGFuZCBtb3JlLiAmbmJzcDtTb3Jy eSAtLSBFQlJBSU5GVUxMLiAmbmJzcDtJIHRoaW5rIHRoYXQNCmZhciBiaWdnZXI8YnI+DQomZ3Q7 IGRhbmdlcnMgYXJlIHBhc3N3b3JkIHJldXNlIGFuZCBub2RlIGNvbXByb21pc2UuICZuYnNwO0hQ VyBpcyBkZXNpZ25lZA0KdG8gZGVhbDxicj4NCiZndDsgd2l0aCB0aG9zZSB0aHJlYXRzLjxicj4N CiZndDsgPGJyPg0KJmd0OyAmcXVvdDtJbiBhIHdvcmxkIG9mIHNtYXJ0IGNhcmRzLCBoYW5kLWhl bGQgYXV0aGVudGljYXRvcnMsIGFuZCB6ZXJvLTxicj4NCiZndDsga25vd2xlZGdlIHByb29mcywg aXQgc2VlbXMgcG9pbnRsZXNzIHRvIGJlIHdvcnJ5aW5nIGFib3V0IHBvb3JseS08YnI+DQomZ3Q7 IGNob3NlbiBwYXNzd29yZHMuICZuYnNwO1dlcmUgdGhlIHdvcmxkIGxpa2UgdGhhdCwgd2UgbWln aHQgYWdyZWUuDQombmJzcDtUb2RheSw8YnI+DQomZ3Q7IGl0IGlzIG5vdC4mcXVvdDsgJm5ic3A7 TWlrZSBNZXJyaXR0IGFuZCBJIHdyb3RlIHRoYXQgYWJvdXQgMjAgeWVhcnMNCmFnbywgaW48YnI+ DQomZ3Q7IHRoZSBvcmlnaW5hbCBFS0UgcGFwZXIuICZuYnNwO0ZvcnR1bmF0ZWx5LCBwYXNzd29y ZHMgYXJlIG5vIGxvbmdlcg0KaW4gdXNlLCA8YnI+DQomZ3Q7IHNpbmNlIHRoZXkndmUgYmVlbiBy ZXBsYWNlZCBieSBiZXR0ZXIgdGVjaG5vbG9neSwgcmlnaHQ/ICZuYnNwO09oLA0Kd2FpdC48YnI+ DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IE9uIEZlYiAyLCAyMDEyLCBh dCAxOjQ2IFBNLCBEYW4gSGFya2lucyB3cm90ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDsgJmd0OyA8 YnI+DQomZ3Q7ICZndDsgJm5ic3A7VGhlIGlzc3VlIGlzIHRoYXQgaGFzaGluZyBhIHBhc3N3b3Jk IGRvZXNuJ3QgbWFrZSBpdCAmcXVvdDtyYW5kb20mcXVvdDs8YnI+DQomZ3Q7ICZndDsgKHdoaWxl IGl0IG1pZ2h0IG1ha2UgaXQgJnF1b3Q7bG9uZyZxdW90OykuIFNvIG5vLCBhbiBvcmRpbmFyeQ0K aGFzaCBpcyBub3Q8YnI+DQomZ3Q7ICZndDsgZW5vdWdoLiBBcyBJIHN1Z2dlc3RlZCwgSSB0aGlu ayBhIG5vbi1zZWNyZXQgc2FsdCBleGNoYW5nZWQgaW48YnI+DQomZ3Q7ICZndDsgdGhlIHByb3Rv Y29sIGNhbiBiZSB1c2VkIGFzIGEga2V5IHRvIGEgSE1BQyBhbmQgdGhlIHBhc3N3b3JkDQpjYW48 YnI+DQomZ3Q7ICZndDsgYmUgaW5jbHVkZWQgaW4gdGhlIGRhdGEgdG8gYmUgSE1BQydkLjxicj4N CiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJm5ic3A7RGFuLjxicj4NCiZndDsgJmd0OyA8YnI+ DQomZ3Q7ICZndDsgT24gV2VkLCBGZWJydWFyeSAxLCAyMDEyIDU6MjIgcG0sIHpob3Uuc3VqaW5n QHp0ZS5jb20uY24gd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBXZWxswqPCrCBpdCBpcyB0aGUg cmVxdWlyZW1lbnQgb2YgdGhlIEhNQUMgZm9yIGtleSBiZWluZyBsb25nDQphbmQgcmFuZG9tLjxi cj4NCiZndDsgJmd0OyZndDsgVGhlbiBpbiB0aGUgY2FzZSBvZiB0aGUgZHJhZnQsIG9yZGluYXJ5 IGhhc2ggaXMgZW5vdWdoIEkNCmd1ZXNzPzxicj4NCiZndDsgJmd0OyZndDsgPGJyPg0KJmd0OyAm Z3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7IFJlZ2FyZHN+fn48YnI+DQomZ3Q7ICZndDsmZ3Q7 IDxicj4NCiZndDsgJmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBjZnJnLWJvdW5jZXNAaXJ0 Zi5vcmcgw5DCtMOTw5ogMjAxMi0wMi0wMSAyMzo0OToxMzo8YnI+DQomZ3Q7ICZndDsmZ3Q7IDxi cj4NCiZndDsgJmd0OyZndDsmZ3Q7IE15IHRha2Ugb24gdGhpcyBpczogaWYgeW91IGJlbGlldmUg dGhhdCBhIGhhc2gtZnVuY3Rpb24NCmlzIGEgZ29vZDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IHJh bmRvbWl6ZXIgYW5kIGNhbiBiZSB1c2VkIGluIGNyeXB0b2dyYXBoaWMga2V5IGdlbmVyYXRpb24N CnByb2Nlc3MgwqhDPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgdGhlbiAmbmJzcDtpdCBkb2VzIG5v dCBtYXR0ZXIgd2hldGhlciB3aGF0IHlvdSBmZWVkIGFzDQphICZxdW90O2tleSZxdW90OyBpbnB1 dCB0bzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IEhNQUMgaXMgdW5pZm9ybWx5IGRpc3RyaWJ1dGVk IG9yIG5vdCAoYmVjYXVzZSBvZiBITUFDDQppbnRlcm5hbCAmcXVvdDtoYXNoPGJyPg0KJmd0OyAm Z3Q7Jmd0OyZndDsgc3BpbnMmcXVvdDspLiBBbmQgaWYgeW91IGFyZSB1bmVhc3kgb24gaG93IHJl YWxseSByYW5kb20NCnlvdXIgaGFzaCBvdXRwdXQ8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBpcyDC qEMgdGhlbiBhIGxvdCBvZiB0aGUgY3VycmVudGx5IHVzZWQgbWVjaGFuaXNtcyBhbmQNCnByaW1p dGl2ZXMgbmVlZDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IHJldmlzaXRpbmcuPGJyPg0KJmd0OyAm Z3Q7Jmd0OyZndDsgLS08YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBSZWdhcmRzLDxicj4NCiZndDsg Jmd0OyZndDsmZ3Q7IFVyaSBCbHVtZW50aGFsICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7Vm9pY2U6ICg3ODEpIDk4MS0xNjM4PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsg Q3liZXIgU3lzdGVtcyBhbmQgVGVjaG5vbG9neSAmbmJzcDtGYXg6ICZuYnNwOyAmbmJzcDsoNzgx KQ0KOTgxLTAxODY8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBNSVQgTGluY29sbiBMYWJvcmF0b3J5 PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgRnJvbTogJnF1 b3Q7emhvdS5zdWppbmdAenRlLmNvbS5jbiZxdW90OyAmbHQ7emhvdS5zdWppbmdAenRlLmNvbS5j biZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBEYXRlOiBXZWQsIDEgRmViIDIwMTIgMDM6MTM6 MDcgLTA1MDA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBUbzogRGFuIEhhcmtpbnMgJmx0O2RoYXJr aW5zQGxvdW5nZS5vcmcmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgQ2M6ICZxdW90O2NmcmdA aXJ0Zi5vcmcmcXVvdDsgJmx0O2NmcmdAaXJ0Zi5vcmcmZ3Q7LA0KU3RldmVuIEJlbGxvdmluPGJy Pg0KJmd0OyAmZ3Q7Jmd0OyAmbHQ7c21iQGNzLmNvbHVtYmlhLmVkdSZndDs8YnI+DQomZ3Q7ICZn dDsmZ3Q7Jmd0OyBTdWJqZWN0OiBbQ2ZyZ10gwrTDsMK4wrQ6IFJlOiBbc2FhZ10gTmV3IGRyYWZ0 OiBIYXNoZWQgUGFzc3dvcmQNCkV4Y2hhbmdlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgPGJyPg0K Jmd0OyAmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgSGksYWxsPGJyPg0KJmd0 OyAmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgY2ZyZy1ib3VuY2VzQGlydGYu b3JnIMOQwrTDk8OaIDIwMTItMDEtMDcgMTc6MDM6MjU6PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsg PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyA8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgT24gV2VkLCBKYW51YXJ5IDQsIDIwMTIgMjo1NiBw bSwgU3RldmVuIEJlbGxvdmluDQp3cm90ZTo8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7 IEdvb2QgcG9pbnQ7IGxldCBtZSB0aGluayBhYm91dCBpdCBmb3IgLTAxLiAmbmJzcDtBbg0Kb2J2 aW91cyBzb2x1dGlvbiBpczxicj4NCiZndDsgJmd0OyZndDsgdG8gc2VuZDxicj4NCiZndDsgJmd0 OyZndDsmZ3Q7Jmd0OyZndDsgdGhlIGhvc3RuYW1lIHdpdGggdGhlIGVmZmVjdGl2ZSBwYXNzd29y ZC48YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7 ICZuYnNwO0hvdyBpcyB0aGF0IGRpZmZlcmVudCB0aGFuIHVzaW5nIHJhbmRvbSBzYWx0DQp0aGVu PyBJZiBfc29tZXRoaW5nXzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IGlzPGJyPg0KJmd0OyAmZ3Q7 Jmd0OyZndDsmZ3Q7IGdvaW5nIHRvIGJlIHNlbnQgc2hvdWxkbid0IGl0IGJlIGEgdW5pZm9ybWx5 IHJhbmRvbQ0KYml0c3RyaW5nIGluc3RlYWQ8YnI+DQomZ3Q7ICZndDsmZ3Q7IG9mPGJyPg0KJmd0 OyAmZ3Q7Jmd0OyZndDsmZ3Q7IGEgaG9zdG5hbWU/PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7 IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyAmbmJzcDtBIHVuaWZvcm1seSByYW5kb20gYml0 c3RyaW5nIHdvdWxkIGJlIG1vcmUNCmFwcHJvcHJpYXRlIGFzIGEga2V5IHRvPGJyPg0KJmd0OyAm Z3Q7Jmd0OyZndDsmZ3Q7IEhNQUMgdGhhbiBhIGhpZ2hseSBzdHJ1Y3R1cmVkIHN0cmluZyBsaWtl IGEgcGFzc3dvcmQNCnRvby4gSXRlcmF0ZTxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyBITUFD KHNhbHQsIHBhc3N3b3JkIHwgc2VydmljZS1VUkkpIGluc3RlYWQgb2YgSE1BQyhwYXNzd29yZCw8 YnI+DQomZ3Q7ICZndDsmZ3Q7IHNlcnZpY2UtVVJJKS48YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7 ICZndDsmZ3Q7Jmd0OyBJIHRoaW5rIERhbidzIHN1Z2dlc3Rpb24gaXMgcmVhc29uYWJsZSwgSSBj aGVja2VkIHRoZQ0KUkZDIDIxMDQgYW5kPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgZm91bmQgdGhl IGZvbGxvd2luZyBzZWN0aW9uIDo8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZn dDsmZ3Q7Jmd0OyAmcXVvdDszLiBLZXlzPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0 OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7IFRoZSBrZXkgZm9yIEhNQUMgY2FuIGJlIG9mIGFueSBsZW5n dGggKGtleXMgbG9uZ2VyDQp0aGFuIEIgYnl0ZXMgYXJlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsg Jm5ic3A7IGZpcnN0IGhhc2hlZCB1c2luZyBIKS4gJm5ic3A7SG93ZXZlciwgbGVzcyB0aGFuDQpM IGJ5dGVzIGlzIHN0cm9uZ2x5PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7IGRpc2NvdXJh Z2VkIGFzIGl0IHdvdWxkIGRlY3JlYXNlIHRoZSBzZWN1cml0eQ0Kc3RyZW5ndGggb2YgdGhlPGJy Pg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7IGZ1bmN0aW9uLiAmbmJzcDtLZXlzIGxvbmdlciB0 aGFuIEwgYnl0ZXMgYXJlIGFjY2VwdGFibGUNCmJ1dCB0aGUgZXh0cmE8YnI+DQomZ3Q7ICZndDsm Z3Q7Jmd0OyAmbmJzcDsgbGVuZ3RoIHdvdWxkIG5vdCBzaWduaWZpY2FudGx5IGluY3JlYXNlIHRo ZSBmdW5jdGlvbg0Kc3RyZW5ndGguIChBPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgJm5ic3A7IGxv bmdlciBrZXkgbWF5IGJlIGFkdmlzYWJsZSBpZiB0aGUgcmFuZG9tbmVzcw0Kb2YgdGhlIGtleSBp czxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyBjb25zaWRlcmVkIHdlYWsuKTxicj4NCiZn dDsgJmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyBLZXlzIG5lZWQg dG8gYmUgY2hvc2VuIGF0IHJhbmRvbSAob3IgdXNpbmcgYSBjcnlwdG9ncmFwaGljYWxseTxicj4N CiZndDsgJmd0OyZndDsmZ3Q7IHN0cm9uZzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyBw c2V1ZG8tcmFuZG9tIGdlbmVyYXRvciBzZWVkZWQgd2l0aCBhIHJhbmRvbSBzZWVkKSwNCmFuZCBw ZXJpb2RpY2FsbHk8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyAmbmJzcDsgcmVmcmVzaGVkLiAmbmJz cDsoQ3VycmVudCBhdHRhY2tzIGRvIG5vdCBpbmRpY2F0ZQ0KYSBzcGVjaWZpYyByZWNvbW1lbmRl ZDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7ICZuYnNwOyBmcmVxdWVuY3kgZm9yIGtleSBjaGFuZ2Vz IGFzIHRoZXNlIGF0dGFja3MgYXJlDQpwcmFjdGljYWxseTxicj4NCiZndDsgJmd0OyZndDsmZ3Q7 ICZuYnNwOyBpbmZlYXNpYmxlLiAmbmJzcDtIb3dldmVyLCBwZXJpb2RpYyBrZXkgcmVmcmVzaG1l bnQNCmlzIGEgZnVuZGFtZW50YWw8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyAmbmJzcDsgc2VjdXJp dHkgcHJhY3RpY2UgdGhhdCBoZWxwcyBhZ2FpbnN0IHBvdGVudGlhbA0Kd2Vha25lc3NlcyBvZiB0 aGU8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyAmbmJzcDsgZnVuY3Rpb24gYW5kIGtleXMsIGFuZCBs aW1pdHMgdGhlIGRhbWFnZSBvZiBhbg0KZXhwb3NlZCBrZXkuKSZxdW90Ozxicj4NCiZndDsgJmd0 OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7 IFNpbmNlIHBhc3N3b3JkcyBhcmUgb2Z0ZW4gbm90IHRvbyBsb25nLCBhbmQgbm90IHNvIHJhbmRv bSwNCml0IGlzIGJldHRlcjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IHRvIGhhc2ggaXQgYmVmb3Jl IHVzaW5nIGl0IGFzIGEga2V5IGluIGEgSE1BQy48YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8YnI+ DQomZ3Q7ICZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyBSZWdhcmRzfn5+PGJy Pg0KJmd0OyAmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgLVN1amluZyBaaG91 PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyAm bmJzcDtUaGF0IHNhaWQsIGdvYWwgNCBpbiB0aGUgZHJhZnQtLSAmcXVvdDtCeSBpdGVyYXRpbmcN CmEgc3VmZmljaWVudCBudW1iZXI8YnI+DQomZ3Q7ICZndDsmZ3Q7IG9mPGJyPg0KJmd0OyAmZ3Q7 Jmd0OyZndDsmZ3Q7IHRpbWVzLCBkaWN0aW9uYXJ5IGF0dGFja3MgY2FuIGJlIG1hZGUgYXJiaXRy YXJpbHkNCmV4cGVuc2l2ZSZxdW90Oy0tIHNlZW1zPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsgYTxi cj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyBiaXQgbWlzZ3VpZGVkLiBUaGUgQW1hem9uIGNsb3Vk IHNlcnZpY2UgaGFzIGJlZW4NCnVzZWQgdG8gbGF1bmNoIGFuPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZn dDsmZ3Q7IG9mZi1saW5lIGRpY3Rpb25hcnkgYXR0YWNrIGFnYWluc3QgdGhlIFdQQS1QU0sgcHJv dG9jb2wNCndoaWNoIHVzZXM8YnI+DQomZ3Q7ICZndDsmZ3Q7IFBCS0RGMjxicj4NCiZndDsgJmd0 OyZndDsmZ3Q7Jmd0OyAoSE1BQy1TSEExKSB3aXRoIDQwOTYgaXRlcmF0aW9ucyB0byBvYmZ1c2Nh dGUgYSBwYXNzd29yZC4NClRoaXMgYXR0YWNrPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7IGNo ZWNrcyAyNCwwMDAsMDAwIGNhbmRpZGF0ZSBwYXNzd29yZHMgcGVyIG1pbnV0ZQ0KYXQgYSBjb3N0 IG9mICQwLjI4Ljxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyBUaGF0J3MgbW9yZSB0aGFuIDEs NjAwLDAwMCwwMDAgaXRlcmF0aW9ucyBwZXIgc2Vjb25kDQpmb3IgYWJvdXQgMS8yIGE8YnI+DQom Z3Q7ICZndDsmZ3Q7IGNlbnQuPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7IFNvIEkgZG9uJ3Qg dGhpbmsgaW5jcmVhc2VkIGl0ZXJhdGlvbiBtYWtlcyBkaWN0aW9uYXJ5DQphdHRhY2tzIG11Y2g8 YnI+DQomZ3Q7ICZndDsmZ3Q7IG1vcmU8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgZXhwZW5z aXZlLjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZn dDsgJm5ic3A7V2hpY2ggYmVncyB0aGUgcXVlc3Rpb24sIGhvdyBpcyB0aGlzIHByb3Bvc2FsDQpk aWZmZXJlbnQgdGhhbjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IFBCS0RGMj88YnI+DQomZ3Q7ICZn dDsmZ3Q7Jmd0OyZndDsgVGhhdCB0aGUgJnF1b3Q7c2FsdCZxdW90OyBpcyBhIHNlcnZpY2UgVVJJ Pzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsg Jm5ic3A7cmVnYXJkcyw8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7 Jmd0OyZndDsmZ3Q7ICZuYnNwO0Rhbi48YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0K Jmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBPbiBKYW4gNCwgMjAxMiwgYXQgNToyMSAwMVBNLCBK b2UgVG91Y2ggd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7 ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBIaSwgU3RldmUsPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZn dDsmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsgVGhpcyBk b2MgZG9lc24ndCBhcHBlYXIgdG8gYWRkcmVzcyB0aGUgY2FzZQ0Kd2hlcmUgYSBob3N0IGhhczxi cj4NCiZndDsgJmd0OyZndDsgbXVsdGlwbGU8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7 Jmd0OyBETlMgbmFtZXMsIHdoaWNoIGNvdWxkIG1ha2UgaXQgZGlmZmljdWx0DQp0byBpbmNvcnBv cmF0ZSB0aGU8YnI+DQomZ3Q7ICZndDsmZ3Q7IGhvc3RuYW1lPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZn dDsmZ3Q7Jmd0OyZndDsgaW50byB0aGUgdHJhbnNmb3JtLiBJLmUuLCBJIGNvdWxkIGNvbnRhY3QN CmEgbWFpbCBzZXJ2ZXIgYXQgYW4gSVA8YnI+DQomZ3Q7ICZndDsmZ3Q7IGFkZHJlc3M8YnI+DQom Z3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyB0aGF0IHJlcHJlc2VudHMgYW55IG9mIGRvemVu cyBvZiBETlMgbmFtZXMNCi0gaG93IGRvZXMgdGhlIHNlcnZlcjxicj4NCiZndDsgJmd0OyZndDsg a25vdzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IHdoaWNoIG9uZSBJIHVzZWQg c28gaXQgY2FuIG1hdGNoIHdpdGhvdXQNCmV4aGF1c3RpdmVseSB0cnlpbmcgYWxsPGJyPg0KJmd0 OyAmZ3Q7Jmd0OyBpdHM8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBlcXVpdmFs ZW50IG5hbWVzPzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsg Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IEpvZTxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZn dDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IE9uIDEvNC8yMDEyIDE6 NDEgUE0sIFN0ZXZlbiBCZWxsb3ZpbiB3cm90ZTo8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsm Z3Q7Jmd0OyZndDsgSSdkIGFwcHJlY2lhdGUgY29tbWVudHMgb24gbXkgbmV3IGRyYWZ0LDxicj4N CiZndDsgJmd0OyZndDsgZHJhZnQtYmVsbG92aW4taHB3LTAwLnR4dDo8YnI+DQomZ3Q7ICZndDsm Z3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZn dDsmZ3Q7IEFic3RyYWN0PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxi cj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyAmbmJzcDsgTWFueSBzeXN0ZW1z IChlLmcuLCBjcnlwdG9ncmFwaGljDQpwcm90b2NvbHMgcmVseWluZyBvbjxicj4NCiZndDsgJmd0 OyZndDsgc3ltbWV0cmljPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7ICZu YnNwOyBjcnlwdG9ncmFwaHkpIHJlcXVpcmUgdGhhdCBwbGFpbnRleHQNCnBhc3N3b3JkcyBiZSBz dG9yZWQuIEdpdmVuPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBob3c8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0 OyZndDsmZ3Q7Jmd0OyZndDsgJm5ic3A7IG9mdGVuIHBlb3BsZSByZXVzZSBwYXNzd29yZHMgb24N CmRpZmZlcmVudCBzeXN0ZW1zLCB0aGlzIHBvc2VzIGE8YnI+DQomZ3Q7ICZndDsmZ3Q7IHZlcnk8 YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsgJm5ic3A7IHNlcmlvdXMgcmlz ayBpZiBhIHNpbmdsZSBtYWNoaW5lDQppcyBjb21wcm9taXNlZC4gJm5ic3A7V2UgcHJvcG9zZSBh PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IHNjaGVtZTxicj4NCiZndDsg Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyAmbmJzcDsgdG8gZGVyaXZlIHBhc3N3b3JkcyBs aW1pdGVkIHRvDQphIHNpbmdsZSBtYWNoaW5lIGZyb20gYSB0eXBlZDxicj4NCiZndDsgJmd0OyZn dDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyAmbmJzcDsgcGFzc3dvcmQsIGFuZCBleHBsYWluIGhvdyBh IHByb3RvY29sDQpkZWZpbml0aW9uIGNhbiBzcGVjaWZ5PGJyPg0KJmd0OyAmZ3Q7Jmd0OyB0aGlz PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7ICZuYnNwOyBzY2hlbWUuPGJy Pg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsm Z3Q7Jmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZn dDsgJm5ic3A7ICZuYnNwOyAmbmJzcDstLVN0ZXZlIEJlbGxvdmluLA0KaHR0cHM6Ly93d3cuY3Mu Y29sdW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsg PGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZn dDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0 OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsg Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0 OyBzYWFnIG1haWxpbmcgbGlzdDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0 OyBzYWFnQGlldGYub3JnPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc2FhZzxicj4NCiZndDsgJmd0OyZn dDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0K Jmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7LS1TdGV2ZSBCZWxsb3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29s dW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsg Jmd0OyZndDsmZ3Q7Jmd0OyZndDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyA8YnI+ DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZn dDsgPGJyPg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsg c2FhZyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IHNhYWdAaWV0 Zi5vcmc8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vc2FhZzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsgPGJy Pg0KJmd0OyAmZ3Q7Jmd0OyZndDsmZ3Q7IDxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyA8YnI+ DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgQ2ZyZyBtYWlsaW5nIGxp c3Q8YnI+DQomZ3Q7ICZndDsmZ3Q7Jmd0OyZndDsgQ2ZyZ0BpcnRmLm9yZzxicj4NCiZndDsgJmd0 OyZndDsmZ3Q7Jmd0OyBodHRwOi8vd3d3LmlydGYub3JnL21haWxtYW4vbGlzdGluZm8vY2ZyZzxi cj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyBbwrjCvcK8w74gJnF1b3Q7c21pbWUucDdzJnF1b3Q7 IMKxwrsgw5bDnMOLw5XCvsKyMDAxMzI4MzEvdXNlci96dGVfbHRkDQrDicK+wrPDvV08YnI+DQom Z3Q7ICZndDsmZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IENmcmcgbWFpbGluZyBsaXN0PGJyPg0KJmd0 OyAmZ3Q7Jmd0OyZndDsgQ2ZyZ0BpcnRmLm9yZzxicj4NCiZndDsgJmd0OyZndDsmZ3Q7IGh0dHA6 Ly93d3cuaXJ0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZnJnPGJyPg0KJmd0OyAmZ3Q7Jmd0OyA8 YnI+DQomZ3Q7ICZndDsmZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBDZnJnIG1haWxpbmcgbGlzdDxicj4NCiZndDsg Jmd0OyZndDsgQ2ZyZ0BpcnRmLm9yZzxicj4NCiZndDsgJmd0OyZndDsgaHR0cDovL3d3dy5pcnRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nmcmc8YnI+DQomZ3Q7ICZndDsmZ3Q7IDxicj4NCiZndDsg Jmd0OyA8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IF9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyAmZ3Q7IENmcmcgbWFpbGluZyBs aXN0PGJyPg0KJmd0OyAmZ3Q7IENmcmdAaXJ0Zi5vcmc8YnI+DQomZ3Q7ICZndDsgaHR0cDovL3d3 dy5pcnRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nmcmc8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0 OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgLS1TdGV2ZSBCZWxs b3ZpbiwgaHR0cHM6Ly93d3cuY3MuY29sdW1iaWEuZWR1L35zbWI8YnI+DQomZ3Q7IDxicj4NCiZn dDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQo8L2Zv bnQ+PC90dD4NCg== --=_alternative 003600CB4825799F_=-- From smb@cs.columbia.edu Thu Feb 9 04:32:13 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E24621F8713 for ; Thu, 9 Feb 2012 04:32:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.821 X-Spam-Level: X-Spam-Status: No, score=-3.821 tagged_above=-999 required=5 tests=[AWL=-0.871, BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4, SARE_SUB_ENC_UTF8=0.152] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4YKGmklCzqTu for ; Thu, 9 Feb 2012 04:32:11 -0800 (PST) Received: from paneer.cc.columbia.edu (paneer.cc.columbia.edu [128.59.29.4]) by ietfa.amsl.com (Postfix) with ESMTP id DA38721F8703 for ; Thu, 9 Feb 2012 04:32:10 -0800 (PST) Received: from [192.168.2.47] (74-92-112-54-Philadelphia.hfc.comcastbusiness.net [74.92.112.54]) (user=smb2132 mech=PLAIN bits=0) by paneer.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q19CW7jo008340 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Thu, 9 Feb 2012 07:32:08 -0500 (EST) References: In-Reply-To: Mime-Version: 1.0 (1.0) Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary=Apple-Mail-B10CD237-99BA-480B-8D4A-4C9293C497F9 Message-Id: X-Mailer: iPad Mail (9A405) From: Steven Bellovin Date: Thu, 9 Feb 2012 07:32:07 -0500 To: "zhou.sujing@zte.com.cn" X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.4 Cc: "cfrg@irtf.org" Subject: Re: [Cfrg] =?utf-8?b?562U5aSNOiBSZTogIMK0w7DCuMK0OiBSZTogIMK0w7DCuMK0?= =?utf-8?q?=3A_Re=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2012 12:32:13 -0000 --Apple-Mail-B10CD237-99BA-480B-8D4A-4C9293C497F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I dealt with that in my note: how do you deal with multiple devices? Sent from my iPad On Feb 9, 2012, at 4:49 AM, zhou.sujing@zte.com.cn wrote: >=20 > I understand the aim of your proposal, and similar ideas have also been pr= oposed, such as pwdhash by Standford university,=20 > a only simple hash before sending passwoed can prevent more security loss= when a server is broken, because it is human's weakness to have only a few s= ets of passwords,=20 > even worse, the few passwords are often randomless for memory easiness.=20= >=20 > But only hashing password will not increase entropy, maybe an option can b= e added to your scheme that=20 > another long and random key K can be stored exclusively in the user's devi= ce,=20 > and the effective password equals hash of and K?=20= >=20 >=20 >=20 >=20 > Regards~~~ >=20 > -Sujing Zhou=20 >=20 > Steven Bellovin =E5=86=99=E4=BA=8E 2012-02-03 07:38:= 11: >=20 > > I'll be revising my draft soon. For now, let me explain a few points. > >=20 > > First -- the primary goal of the draft is avoiding storage of cleartext > > passwords, because even strong passwords are easily compromised if the > > device or server is hacked. A second goal is to conceal that the same > > password is used for two different users or the same user on two differe= nt > > services. > >=20 > > It's obviously true that attackers can still launch password-guessing at= tacks. > > This does increase their work factor. While the difference in work fact= or > > may not be important for targeted attacks, it does help against broad-sc= ale > > attacks: can any single password be retrieved? The way I look at it is > > this: for a given effort, how many passwords can the attacker get? If t= he > > iteration count is doubled, the yield per given effort is obviously halv= ed. > >=20 > > There are no large-scale precomputation attacks possible, because every > > hashed password is unique for a given triple. > >=20 > > I do not see how a random salt would help at all -- it still requires > > about the same amount of computation per user per service per guess. > > The essential difference between a random salt and my scheme is that > > if I change my password to itself, with a random salt the hashed passwor= d > > would be different; with my scheme, it would be the same. The attacker'= s > > effort would remain the same. In addition, a random salt would hurt > > usability and/or security. For the former, consider that I (and many > > other people) have many devices with stored passwords. I personally > > use three or four computers and two iToys to read mail. So -- I set a n= ew > > password from one. I now have to copy down that string and enter it > > on five other devices. Not very user-friendly. Assume, then, that > > the salt is sent as part of the protocol. That not only hurts adoptabil= ity, > > since the protocol would now have to have a way to transmit it at the ri= ght > > point, after it knows the userid but before the authenticator is entered= > > (quick -- what will that do to, say, IKEv2?), it means that the user's > > node would have to have the cleartext password available in order to > > hash it with the salt. But that defeats the purpose of my scheme. > > HPW requires no changes to the protocol, and the only possible change > > to the implementation is a longer input buffer. > >=20 > > Finally, I'm quite convinced that focusing on strong passwords is fighti= ng > > the last war (and, I might add, a war we've lost). *NO ONE* is using > > strong, unique, memorized passwords ubiquitously -- people have too many= =20 > > of them to remember. By actual count, I have >100 web site passwords, > > plus login passwords, root passwords, mail passwords, ATM PINs, phone > > unlock codes, and more. Sorry -- EBRAINFULL. I think that far bigger > > dangers are password reuse and node compromise. HPW is designed to deal= > > with those threats. > >=20 > > "In a world of smart cards, hand-held authenticators, and zero- > > knowledge proofs, it seems pointless to be worrying about poorly- > > chosen passwords. Were the world like that, we might agree. Today, > > it is not." Mike Merritt and I wrote that about 20 years ago, in > > the original EKE paper. Fortunately, passwords are no longer in use,=20= > > since they've been replaced by better technology, right? Oh, wait. > >=20 > >=20 > >=20 > > On Feb 2, 2012, at 1:46 PM, Dan Harkins wrote: > >=20 > > >=20 > > > The issue is that hashing a password doesn't make it "random" > > > (while it might make it "long"). So no, an ordinary hash is not > > > enough. As I suggested, I think a non-secret salt exchanged in > > > the protocol can be used as a key to a HMAC and the password can > > > be included in the data to be HMAC'd. > > >=20 > > > Dan. > > >=20 > > > On Wed, February 1, 2012 5:22 pm, zhou.sujing@zte.com.cn wrote: > > >> Well=C2=A3=C2=AC it is the requirement of the HMAC for key being long= and random. > > >> Then in the case of the draft, ordinary hash is enough I guess? > > >>=20 > > >>=20 > > >> Regards~~~ > > >>=20 > > >>=20 > > >> cfrg-bounces@irtf.org =C3=90=C2=B4=C3=93=C3=9A 2012-02-01 23:49:13: > > >>=20 > > >>> My take on this is: if you believe that a hash-function is a good > > >>> randomizer and can be used in cryptographic key generation process =C2= =A8C > > >>> then it does not matter whether what you feed as a "key" input to > > >>> HMAC is uniformly distributed or not (because of HMAC internal "hash= > > >>> spins"). And if you are uneasy on how really random your hash output= > > >>> is =C2=A8C then a lot of the currently used mechanisms and primitive= s need > > >>> revisiting. > > >>> -- > > >>> Regards, > > >>> Uri Blumenthal Voice: (781) 981-1638 > > >>> Cyber Systems and Technology Fax: (781) 981-0186 > > >>> MIT Lincoln Laboratory > > >>>=20 > > >>> From: "zhou.sujing@zte.com.cn" > > >>> Date: Wed, 1 Feb 2012 03:13:07 -0500 > > >>> To: Dan Harkins > > >>> Cc: "cfrg@irtf.org" , Steven Bellovin > > >> > > >>> Subject: [Cfrg] =C2=B4=C3=B0=C2=B8=C2=B4: Re: [saag] New draft: Hash= ed Password Exchange > > >>>=20 > > >>>=20 > > >>> Hi,all > > >>>=20 > > >>> cfrg-bounces@irtf.org =C3=90=C2=B4=C3=93=C3=9A 2012-01-07 17:03:25: > > >>>=20 > > >>>>=20 > > >>>>=20 > > >>>> On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote: > > >>>>> Good point; let me think about it for -01. An obvious solution is= > > >> to send > > >>>>> the hostname with the effective password. > > >>>>=20 > > >>>> How is that different than using random salt then? If _something_ > > >>> is > > >>>> going to be sent shouldn't it be a uniformly random bitstring inste= ad > > >> of > > >>>> a hostname? > > >>>>=20 > > >>>> A uniformly random bitstring would be more appropriate as a key to= > > >>>> HMAC than a highly structured string like a password too. Iterate > > >>>> HMAC(salt, password | service-URI) instead of HMAC(password, > > >> service-URI). > > >>>=20 > > >>>=20 > > >>>=20 > > >>> I think Dan's suggestion is reasonable, I checked the RFC 2104 and > > >>> found the following section : > > >>>=20 > > >>> "3. Keys > > >>>=20 > > >>> The key for HMAC can be of any length (keys longer than B bytes ar= e > > >>> first hashed using H). However, less than L bytes is strongly > > >>> discouraged as it would decrease the security strength of the > > >>> function. Keys longer than L bytes are acceptable but the extra > > >>> length would not significantly increase the function strength. (A > > >>> longer key may be advisable if the randomness of the key is > > >>> considered weak.) > > >>>=20 > > >>> Keys need to be chosen at random (or using a cryptographically > > >>> strong > > >>> pseudo-random generator seeded with a random seed), and periodical= ly > > >>> refreshed. (Current attacks do not indicate a specific recommende= d > > >>> frequency for key changes as these attacks are practically > > >>> infeasible. However, periodic key refreshment is a fundamental > > >>> security practice that helps against potential weaknesses of the > > >>> function and keys, and limits the damage of an exposed key.)" > > >>>=20 > > >>>=20 > > >>> Since passwords are often not too long, and not so random, it is bet= ter > > >>> to hash it before using it as a key in a HMAC. > > >>>=20 > > >>>=20 > > >>> Regards~~~ > > >>>=20 > > >>> -Sujing Zhou > > >>>>=20 > > >>>> That said, goal 4 in the draft-- "By iterating a sufficient number= > > >> of > > >>>> times, dictionary attacks can be made arbitrarily expensive"-- seem= s > > >>> a > > >>>> bit misguided. The Amazon cloud service has been used to launch an > > >>>> off-line dictionary attack against the WPA-PSK protocol which uses > > >> PBKDF2 > > >>>> (HMAC-SHA1) with 4096 iterations to obfuscate a password. This atta= ck > > >>>> checks 24,000,000 candidate passwords per minute at a cost of $0.28= . > > >>>> That's more than 1,600,000,000 iterations per second for about 1/2 a= > > >> cent. > > >>>> So I don't think increased iteration makes dictionary attacks much > > >> more > > >>>> expensive. > > >>>>=20 > > >>>> Which begs the question, how is this proposal different than > > >>> PBKDF2? > > >>>> That the "salt" is a service URI? > > >>>>=20 > > >>>> regards, > > >>>>=20 > > >>>> Dan. > > >>>>=20 > > >>>>> On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote: > > >>>>>=20 > > >>>>>> Hi, Steve, > > >>>>>>=20 > > >>>>>> This doc doesn't appear to address the case where a host has > > >> multiple > > >>>>>> DNS names, which could make it difficult to incorporate the > > >> hostname > > >>>>>> into the transform. I.e., I could contact a mail server at an IP > > >> address > > >>>>>> that represents any of dozens of DNS names - how does the server > > >> know > > >>>>>> which one I used so it can match without exhaustively trying all > > >> its > > >>>>>> equivalent names? > > >>>>>>=20 > > >>>>>> Joe > > >>>>>>=20 > > >>>>>> On 1/4/2012 1:41 PM, Steven Bellovin wrote: > > >>>>>>> I'd appreciate comments on my new draft, > > >> draft-bellovin-hpw-00.txt: > > >>>>>>>=20 > > >>>>>>> Abstract > > >>>>>>>=20 > > >>>>>>> Many systems (e.g., cryptographic protocols relying on > > >> symmetric > > >>>>>>> cryptography) require that plaintext passwords be stored. Give= n > > >> how > > >>>>>>> often people reuse passwords on different systems, this poses a= > > >> very > > >>>>>>> serious risk if a single machine is compromised. We propose a= > > >>>>>>> scheme > > >>>>>>> to derive passwords limited to a single machine from a typed > > >>>>>>> password, and explain how a protocol definition can specify > > >> this > > >>>>>>> scheme. > > >>>>>>>=20 > > >>>>>>>=20 > > >>>>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb > > >>>>>>>=20 > > >>>>>>>=20 > > >>>>>>>=20 > > >>>>>>>=20 > > >>>>>>>=20 > > >>>>>>> _______________________________________________ > > >>>>>>> saag mailing list > > >>>>>>> saag@ietf.org > > >>>>>>> https://www.ietf.org/mailman/listinfo/saag > > >>>>>>=20 > > >>>>>=20 > > >>>>>=20 > > >>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb > > >>>>>=20 > > >>>>>=20 > > >>>>>=20 > > >>>>>=20 > > >>>>>=20 > > >>>>> _______________________________________________ > > >>>>> saag mailing list > > >>>>> saag@ietf.org > > >>>>> https://www.ietf.org/mailman/listinfo/saag > > >>>>>=20 > > >>>>=20 > > >>>>=20 > > >>>> _______________________________________________ > > >>>> Cfrg mailing list > > >>>> Cfrg@irtf.org > > >>>> http://www.irtf.org/mailman/listinfo/cfrg > > >>>> [=C2=B8=C2=BD=C2=BC=C3=BE "smime.p7s" =C2=B1=C2=BB =C3=96=C3=9C=C3=8B= =C3=95=C2=BE=C2=B200132831/user/zte_ltd =C3=89=C2=BE=C2=B3=C3=BD] > > >>> _______________________________________________ > > >>> Cfrg mailing list > > >>> Cfrg@irtf.org > > >>> http://www.irtf.org/mailman/listinfo/cfrg > > >>=20 > > >> _______________________________________________ > > >> Cfrg mailing list > > >> Cfrg@irtf.org > > >> http://www.irtf.org/mailman/listinfo/cfrg > > >>=20 > > >=20 > > >=20 > > > _______________________________________________ > > > Cfrg mailing list > > > Cfrg@irtf.org > > > http://www.irtf.org/mailman/listinfo/cfrg > > >=20 > >=20 > >=20 > > --Steve Bellovin, https://www.cs.columbia.edu/~smb > >=20 > >=20 > >=20 > >=20 > >=20 > >=20 --Apple-Mail-B10CD237-99BA-480B-8D4A-4C9293C497F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
I dealt with that in my no= te: how do you deal with multiple devices?

Sent from my iPad

On Feb 9, 2012, at 4:49 AM, = zhou.sujing@zte.com.cn wrote:


I understand the aim of your propos= al, and similar ideas have also been proposed, such as pwdhash by Standford university,
a only  simple hash before sen= ding passwoed can prevent more security loss when a server is broken, because it is human's weakness to have only a few sets of passwords,
even worse, the few passwords are o= ften randomless for memory easiness.

But only hashing password will not i= ncrease entropy, maybe an option can be added to your scheme that
another long and random key K can b= e stored exclusively in the user's device,
and the effective password equals <= /font>hash of <password,user,service> and K?




Regards~~~

-Sujing Zhou

Steven Bellovin <smb@cs.columbia.edu> =E5=86=99=E4=BA=8E 2012-02-03 07:38:11:

> I'll be revising my draft soon.  For now, let me explain a few points.
>
> First -- the primary goal of the draft is avoiding storage of cleartext=
> passwords, because even strong passwords are easily compromised if the
> device or server is hacked.  A second goal is to conceal that the same
> password is used for two different users or the same user on two differ= ent
> services.
>
> It's obviously true that attackers can still launch password-guessing attacks.
> This does increase their work factor.  While the difference in work factor
> may not be important for targeted attacks, it does help against broad-s= cale
> attacks: can any single password be retrieved?  The way I look at it is
> this: for a given effort, how many passwords can the attacker get?  If the
> iteration count is doubled, the yield per given effort is obviously halved.
>
> There are no large-scale precomputation attacks possible, because every
> hashed password is unique for a given <password,user,service> triple.
>
> I do not see how a random salt would help at all -- it still requires > about the same amount of computation per user per service per guess. > The essential difference between a random salt and my scheme is that > if I change my password to itself, with a random salt the hashed passwo= rd
> would be different; with my scheme, it would be the same.  The attacker's
> effort would remain the same.  In addition, a random salt would hurt
> usability and/or security.  For the former, consider that I (and many
> other people) have many devices with stored passwords.  I personal= ly
> use three or four computers and two iToys to read mail.  So -- I set a new
> password from one.  I now have to copy down that string and enter it
> on five other devices.  Not very user-friendly.  Assume, then, that
> the salt is sent as part of the protocol.  That not only hurts adoptability,
> since the protocol would now have to have a way to transmit it at the right
> point, after it knows the userid but before the authenticator is entere= d
> (quick -- what will that do to, say, IKEv2?), it means that the user's<= br> > node would have to have the cleartext password available in order to
> hash it with the salt.  But that defeats the purpose of my scheme.=
> HPW requires no changes to the protocol, and the only possible change > to the implementation is a longer input buffer.
>
> Finally, I'm quite convinced that focusing on strong passwords is fighting
> the last war (and, I might add, a war we've lost).  *NO ONE* is using
> strong, unique, memorized passwords ubiquitously -- people have too many
> of them to remember.  By actual count, I have >100 web site passwords,
> plus login passwords, root passwords, mail passwords, ATM PINs, phone > unlock codes, and more.  Sorry -- EBRAINFULL.  I think that far bigger
> dangers are password reuse and node compromise.  HPW is designed to deal
> with those threats.
>
> "In a world of smart cards, hand-held authenticators, and zero-
> knowledge proofs, it seems pointless to be worrying about poorly-
> chosen passwords.  Were the world like that, we might agree.  Today,
> it is not."  Mike Merritt and I wrote that about 20 years ago, in
> the original EKE paper.  Fortunately, passwords are no longer in use,
> since they've been replaced by better technology, right?  Oh, wait.
>
>
>
> On Feb 2, 2012, at 1:46 PM, Dan Harkins wrote:
>
> >
> >  The issue is that hashing a password doesn't make it "random= "
> > (while it might make it "long"). So no, an ordinary hash is not
> > enough. As I suggested, I think a non-secret salt exchanged in
= > > the protocol can be used as a key to a HMAC and the password can
> > be included in the data to be HMAC'd.
> >
> >  Dan.
> >
> > On Wed, February 1, 2012 5:22 pm, zhou.sujing@zte.com.cn wrote:
> >> Well=C2=A3=C2=AC it is the requirement of the HMAC for key bei= ng long and random.
> >> Then in the case of the draft, ordinary hash is enough I guess?
> >>
> >>
> >> Regards~~~
> >>
> >>
> >> cfrg-bounces@irtf.org= =C3=90=C2=B4=C3=93=C3=9A 2012-02-01 23:49:13:
> >>
> >>> My take on this is: if you believe that a hash-function is a good
> >>> randomizer and can be used in cryptographic key generation= process =C2=A8C
> >>> then  it does not matter whether what you feed as a "key" input to
> >>> HMAC is uniformly distributed or not (because of HMAC internal "hash
> >>> spins"). And if you are uneasy on how really random your hash output
> >>> is =C2=A8C then a lot of the currently used mechanisms and= primitives need
> >>> revisiting.
> >>> --
> >>> Regards,
> >>> Uri Blumenthal                            Voice: (781) 981-1638=
> >>> Cyber Systems and Technology  Fax:    (781)= 981-0186
> >>> MIT Lincoln Laboratory
> >>>
> >>> From: "zhou.suji= ng@zte.com.cn" <zhou.sujing= @zte.com.cn>
> >>> Date: Wed, 1 Feb 2012 03:13:07 -0500
> >>> To: Dan Harkins <dharkins@lounge.org>
> >>> Cc: "cfrg@irtf.org" &= lt;cfrg@irtf.org>, Steven Bellovin
> >> <smb@cs.columbia.edu= >
> >>> Subject: [Cfrg] =C2=B4=C3=B0=C2=B8=C2=B4: Re: [saag] New d= raft: Hashed Password Exchange
> >>>
> >>>
> >>> Hi,all
> >>>
> >>> cfrg-bounces@irtf= .org =C3=90=C2=B4=C3=93=C3=9A 2012-01-07 17:03:25:
> >>>
> >>>>
> >>>>
> >>>> On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote:
> >>>>> Good point; let me think about it for -01.  A= n obvious solution is
> >> to send
> >>>>> the hostname with the effective password.
> >>>>
> >>>>  How is that different than using random salt then? If _something_
> >>> is
> >>>> going to be sent shouldn't it be a uniformly random bitstring instead
> >> of
> >>>> a hostname?
> >>>>
> >>>>  A uniformly random bitstring would be more appropriate as a key to
> >>>> HMAC than a highly structured string like a password too. Iterate
> >>>> HMAC(salt, password | service-URI) instead of HMAC(pas= sword,
> >> service-URI).
> >>>
> >>>
> >>>
> >>> I think Dan's suggestion is reasonable, I checked the RFC 2104 and
> >>> found the following section :
> >>>
> >>> "3. Keys
> >>>
> >>>   The key for HMAC can be of any length (keys longer than B bytes are
> >>>   first hashed using H).  However, less than L bytes is strongly
> >>>   discouraged as it would decrease the security strength of the
> >>>   function.  Keys longer than L bytes are accept= able but the extra
> >>>   length would not significantly increase the functio= n strength. (A
> >>>   longer key may be advisable if the randomness of the key is
> >>>   considered weak.)
> >>>
> >>>   Keys need to be chosen at random (or using a crypto= graphically
> >>> strong
> >>>   pseudo-random generator seeded with a random seed),= and periodically
> >>>   refreshed.  (Current attacks do not indicate a specific recommended
> >>>   frequency for key changes as these attacks are practically
> >>>   infeasible.  However, periodic key refreshment= is a fundamental
> >>>   security practice that helps against potential weaknesses of the
> >>>   function and keys, and limits the damage of an exposed key.)"
> >>>
> >>>
> >>> Since passwords are often not too long, and not so random,= it is better
> >>> to hash it before using it as a key in a HMAC.
> >>>
> >>>
> >>> Regards~~~
> >>>
> >>> -Sujing Zhou
> >>>>
> >>>>  That said, goal 4 in the draft-- "By iterating a sufficient number
> >> of
> >>>> times, dictionary attacks can be made arbitrarily expensive"-- seems
> >>> a
> >>>> bit misguided. The Amazon cloud service has been used to launch an
> >>>> off-line dictionary attack against the WPA-PSK protoco= l which uses
> >> PBKDF2
> >>>> (HMAC-SHA1) with 4096 iterations to obfuscate a passwo= rd. This attack
> >>>> checks 24,000,000 candidate passwords per minute at a cost of $0.28.
> >>>> That's more than 1,600,000,000 iterations per second for about 1/2 a
> >> cent.
> >>>> So I don't think increased iteration makes dictionary attacks much
> >> more
> >>>> expensive.
> >>>>
> >>>>  Which begs the question, how is this proposal different than
> >>> PBKDF2?
> >>>> That the "salt" is a service URI?
> >>>>
> >>>>  regards,
> >>>>
> >>>>  Dan.
> >>>>
> >>>>> On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote:
= > >>>>>
> >>>>>> Hi, Steve,
> >>>>>>
> >>>>>> This doc doesn't appear to address the case where a host has
> >> multiple
> >>>>>> DNS names, which could make it difficult to incorporate the
> >> hostname
> >>>>>> into the transform. I.e., I could contact a mail server at an IP
> >> address
> >>>>>> that represents any of dozens of DNS names - how does the server
> >> know
> >>>>>> which one I used so it can match without exhaustively trying all
> >> its
> >>>>>> equivalent names?
> >>>>>>
> >>>>>> Joe
> >>>>>>
> >>>>>> On 1/4/2012 1:41 PM, Steven Bellovin wrote: > >>>>>>> I'd appreciate comments on my new draft, > >> draft-bellovin-hpw-00.txt:
> >>>>>>>
> >>>>>>> Abstract
> >>>>>>>
> >>>>>>>   Many systems (e.g., cryptographic protocols relying on
> >> symmetric
> >>>>>>>   cryptography) require that plaintex= t passwords be stored. Given
> >> how
> >>>>>>>   often people reuse passwords on different systems, this poses a
> >> very
> >>>>>>>   serious risk if a single machine is compromised.  We propose a
> >>>>>>> scheme
> >>>>>>>   to derive passwords limited to a single machine from a typed
> >>>>>>>   password, and explain how a protoco= l definition can specify
> >> this
> >>>>>>>   scheme.
> >>>>>>>
> >>>>>>>
> >>>>>>>      --Steve Bellovin, https://www.cs.columbia.edu/~sm= b
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> __________________________________________= _____
> >>>>>>> saag mailing list
> >>>>>>> saag@ietf= .org
> >>>>>>> https://www.ietf.org/mailman/listinfo/saag
> >>>>>>
> >>>>>
> >>>>>
> >>>>>      --Steve Bellovin, https://www.cs.columbia.edu/~smb
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>> _______________________________________________ > >>>>> saag mailing list
> >>>>> saag@ietf.org=
> >>>>> https://www.ietf.org/mailman/listinfo/saag
> >>>>>
> >>>>
> >>>>
> >>>> _______________________________________________
> >>>> Cfrg mailing list
> >>>> Cfrg@irtf.org
= > >>>> = http://www.irtf.org/mailman/listinfo/cfrg
> >>>> [=C2=B8=C2=BD=C2=BC=C3=BE "smime.p7s" =C2=B1=C2=BB =C3= =96=C3=9C=C3=8B=C3=95=C2=BE=C2=B200132831/user/zte_ltd =C3=89=C2=BE=C2=B3=C3=BD]
> >>> _______________________________________________
> >>> Cfrg mailing list
> >>> Cfrg@irtf.org
> >>> http= ://www.irtf.org/mailman/listinfo/cfrg
> >>
> >> _______________________________________________
> >> Cfrg mailing list
> >> Cfrg@irtf.org
> >> http://w= ww.irtf.org/mailman/listinfo/cfrg
> >>
> >
> >
> > _______________________________________________
> > Cfrg mailing list
> > Cfrg@irtf.org
> > http://www.i= rtf.org/mailman/listinfo/cfrg
> >
>
>
>       --Steve Bellovin, https://www.cs.columbia.edu/~smb
>
>
>
>
>
>
= --Apple-Mail-B10CD237-99BA-480B-8D4A-4C9293C497F9-- From smb@cs.columbia.edu Sat Feb 11 14:08:46 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FF8821F8554 for ; Sat, 11 Feb 2012 14:08:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[AWL=-2.198, BAYES_50=0.001, J_CHICKENPOX_23=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, MIME_8BIT_HEADER=0.3, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5u2q+bCdwup for ; Sat, 11 Feb 2012 14:08:44 -0800 (PST) Received: from paneer.cc.columbia.edu (paneer.cc.columbia.edu [128.59.29.4]) by ietfa.amsl.com (Postfix) with ESMTP id B8ACA21F8552 for ; Sat, 11 Feb 2012 14:08:44 -0800 (PST) Received: from [192.168.2.180] (74-92-112-54-Philadelphia.hfc.comcastbusiness.net [74.92.112.54]) (user=smb2132 mech=PLAIN bits=0) by paneer.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q1BM8fKP008338 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sat, 11 Feb 2012 17:08:42 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1257) Content-Type: text/plain; charset=utf-8 From: Steven Bellovin In-Reply-To: Date: Sat, 11 Feb 2012 17:08:41 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: zhou.sujing@zte.com.cn X-Mailer: Apple Mail (2.1257) X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.4 Cc: "cfrg@irtf.org" Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Feb 2012 22:08:46 -0000 On Feb 9, 2012, at 7:35 PM, zhou.sujing@zte.com.cn wrote: >=20 >=20 > Steven Bellovin =E5=86=99=E4=BA=8E 2012-02-09 = 20:32:07: >=20 > > I dealt with that in my note: how do you deal with multiple devices?=20= >=20 > Just copy and paste to all the devices, or retrieve the required long = key from a USB key.=20 > It is seldom required to change, so it does not bring much = inconvenience, and just an option for users to choose. =20 >=20 Apart from the fact that I think that that's user-unfriendly, I still = don't understand what problem you are trying to solve. =20 > >=20 > > Sent from my iPad=20 > >=20 > > On Feb 9, 2012, at 4:49 AM, zhou.sujing@zte.com.cn wrote: >=20 > >=20 > > I understand the aim of your proposal, and similar ideas have also=20= > > been proposed, such as pwdhash by Standford university,=20 > > a only simple hash before sending passwoed can prevent more=20 > > security loss when a server is broken, because it is human's=20 > > weakness to have only a few sets of passwords,=20 > > even worse, the few passwords are often randomless for memory = easiness.=20 > >=20 > > But only hashing password will not increase entropy, maybe an option > > can be added to your scheme that=20 > > another long and random key K can be stored exclusively in the = user's device,=20 > > and the effective password equals hash of = and K?=20 > >=20 > >=20 > >=20 > >=20 > > Regards~~~ > >=20 > > -Sujing Zhou=20 > >=20 > > Steven Bellovin =E5=86=99=E4=BA=8E 2012-02-03 = 07:38:11: > >=20 > > > I'll be revising my draft soon. For now, let me explain a few = points. > > >=20 > > > First -- the primary goal of the draft is avoiding storage of = cleartext > > > passwords, because even strong passwords are easily compromised if = the > > > device or server is hacked. A second goal is to conceal that the = same > > > password is used for two different users or the same user on two = different > > > services. > > >=20 > > > It's obviously true that attackers can still launch password- > > guessing attacks. > > > This does increase their work factor. While the difference in = work factor > > > may not be important for targeted attacks, it does help against = broad-scale > > > attacks: can any single password be retrieved? The way I look at = it is > > > this: for a given effort, how many passwords can the attacker get? = If the > > > iteration count is doubled, the yield per given effort is = obviously halved. > > >=20 > > > There are no large-scale precomputation attacks possible, because = every > > > hashed password is unique for a given = triple. > > >=20 > > > I do not see how a random salt would help at all -- it still = requires > > > about the same amount of computation per user per service per = guess. > > > The essential difference between a random salt and my scheme is = that > > > if I change my password to itself, with a random salt the hashed = password > > > would be different; with my scheme, it would be the same. The = attacker's > > > effort would remain the same. In addition, a random salt would = hurt > > > usability and/or security. For the former, consider that I (and = many > > > other people) have many devices with stored passwords. I = personally > > > use three or four computers and two iToys to read mail. So -- I = set a new > > > password from one. I now have to copy down that string and enter = it > > > on five other devices. Not very user-friendly. Assume, then, = that > > > the salt is sent as part of the protocol. That not only hurts = adoptability, > > > since the protocol would now have to have a way to transmit it at = the right > > > point, after it knows the userid but before the authenticator is = entered > > > (quick -- what will that do to, say, IKEv2?), it means that the = user's > > > node would have to have the cleartext password available in order = to > > > hash it with the salt. But that defeats the purpose of my scheme. > > > HPW requires no changes to the protocol, and the only possible = change > > > to the implementation is a longer input buffer. > > >=20 > > > Finally, I'm quite convinced that focusing on strong passwords is = fighting > > > the last war (and, I might add, a war we've lost). *NO ONE* is = using > > > strong, unique, memorized passwords ubiquitously -- people have = too many=20 > > > of them to remember. By actual count, I have >100 web site = passwords, > > > plus login passwords, root passwords, mail passwords, ATM PINs, = phone > > > unlock codes, and more. Sorry -- EBRAINFULL. I think that far = bigger > > > dangers are password reuse and node compromise. HPW is designed = to deal > > > with those threats. > > >=20 > > > "In a world of smart cards, hand-held authenticators, and zero- > > > knowledge proofs, it seems pointless to be worrying about poorly- > > > chosen passwords. Were the world like that, we might agree. = Today, > > > it is not." Mike Merritt and I wrote that about 20 years ago, in > > > the original EKE paper. Fortunately, passwords are no longer in = use,=20 > > > since they've been replaced by better technology, right? Oh, = wait. > > >=20 > > >=20 > > >=20 > > > On Feb 2, 2012, at 1:46 PM, Dan Harkins wrote: > > >=20 > > > >=20 > > > > The issue is that hashing a password doesn't make it "random" > > > > (while it might make it "long"). So no, an ordinary hash is not > > > > enough. As I suggested, I think a non-secret salt exchanged in > > > > the protocol can be used as a key to a HMAC and the password can > > > > be included in the data to be HMAC'd. > > > >=20 > > > > Dan. > > > >=20 > > > > On Wed, February 1, 2012 5:22 pm, zhou.sujing@zte.com.cn wrote: > > > >> Well=C2=A3=C2=AC it is the requirement of the HMAC for key = being long and random. > > > >> Then in the case of the draft, ordinary hash is enough I guess? > > > >>=20 > > > >>=20 > > > >> Regards~~~ > > > >>=20 > > > >>=20 > > > >> cfrg-bounces@irtf.org =C3=90=C2=B4=C3=93=C3=9A 2012-02-01 = 23:49:13: > > > >>=20 > > > >>> My take on this is: if you believe that a hash-function is a = good > > > >>> randomizer and can be used in cryptographic key generation = process =C2=A8C > > > >>> then it does not matter whether what you feed as a "key" = input to > > > >>> HMAC is uniformly distributed or not (because of HMAC internal = "hash > > > >>> spins"). And if you are uneasy on how really random your hash = output > > > >>> is =C2=A8C then a lot of the currently used mechanisms and = primitives need > > > >>> revisiting. > > > >>> -- > > > >>> Regards, > > > >>> Uri Blumenthal Voice: (781) = 981-1638 > > > >>> Cyber Systems and Technology Fax: (781) 981-0186 > > > >>> MIT Lincoln Laboratory > > > >>>=20 > > > >>> From: "zhou.sujing@zte.com.cn" > > > >>> Date: Wed, 1 Feb 2012 03:13:07 -0500 > > > >>> To: Dan Harkins > > > >>> Cc: "cfrg@irtf.org" , Steven Bellovin > > > >> > > > >>> Subject: [Cfrg] =C2=B4=C3=B0=C2=B8=C2=B4: Re: [saag] New = draft: Hashed Password Exchange > > > >>>=20 > > > >>>=20 > > > >>> Hi,all > > > >>>=20 > > > >>> cfrg-bounces@irtf.org =C3=90=C2=B4=C3=93=C3=9A 2012-01-07 = 17:03:25: > > > >>>=20 > > > >>>>=20 > > > >>>>=20 > > > >>>> On Wed, January 4, 2012 2:56 pm, Steven Bellovin wrote: > > > >>>>> Good point; let me think about it for -01. An obvious = solution is > > > >> to send > > > >>>>> the hostname with the effective password. > > > >>>>=20 > > > >>>> How is that different than using random salt then? If = _something_ > > > >>> is > > > >>>> going to be sent shouldn't it be a uniformly random bitstring = instead > > > >> of > > > >>>> a hostname? > > > >>>>=20 > > > >>>> A uniformly random bitstring would be more appropriate as a = key to > > > >>>> HMAC than a highly structured string like a password too. = Iterate > > > >>>> HMAC(salt, password | service-URI) instead of HMAC(password, > > > >> service-URI). > > > >>>=20 > > > >>>=20 > > > >>>=20 > > > >>> I think Dan's suggestion is reasonable, I checked the RFC 2104 = and > > > >>> found the following section : > > > >>>=20 > > > >>> "3. Keys > > > >>>=20 > > > >>> The key for HMAC can be of any length (keys longer than B = bytes are > > > >>> first hashed using H). However, less than L bytes is = strongly > > > >>> discouraged as it would decrease the security strength of = the > > > >>> function. Keys longer than L bytes are acceptable but the = extra > > > >>> length would not significantly increase the function = strength. (A > > > >>> longer key may be advisable if the randomness of the key is > > > >>> considered weak.) > > > >>>=20 > > > >>> Keys need to be chosen at random (or using a = cryptographically > > > >>> strong > > > >>> pseudo-random generator seeded with a random seed), and = periodically > > > >>> refreshed. (Current attacks do not indicate a specific = recommended > > > >>> frequency for key changes as these attacks are practically > > > >>> infeasible. However, periodic key refreshment is a = fundamental > > > >>> security practice that helps against potential weaknesses of = the > > > >>> function and keys, and limits the damage of an exposed = key.)" > > > >>>=20 > > > >>>=20 > > > >>> Since passwords are often not too long, and not so random, it = is better > > > >>> to hash it before using it as a key in a HMAC. > > > >>>=20 > > > >>>=20 > > > >>> Regards~~~ > > > >>>=20 > > > >>> -Sujing Zhou > > > >>>>=20 > > > >>>> That said, goal 4 in the draft-- "By iterating a sufficient = number > > > >> of > > > >>>> times, dictionary attacks can be made arbitrarily = expensive"-- seems > > > >>> a > > > >>>> bit misguided. The Amazon cloud service has been used to = launch an > > > >>>> off-line dictionary attack against the WPA-PSK protocol which = uses > > > >> PBKDF2 > > > >>>> (HMAC-SHA1) with 4096 iterations to obfuscate a password. = This attack > > > >>>> checks 24,000,000 candidate passwords per minute at a cost of = $0.28. > > > >>>> That's more than 1,600,000,000 iterations per second for = about 1/2 a > > > >> cent. > > > >>>> So I don't think increased iteration makes dictionary attacks = much > > > >> more > > > >>>> expensive. > > > >>>>=20 > > > >>>> Which begs the question, how is this proposal different than > > > >>> PBKDF2? > > > >>>> That the "salt" is a service URI? > > > >>>>=20 > > > >>>> regards, > > > >>>>=20 > > > >>>> Dan. > > > >>>>=20 > > > >>>>> On Jan 4, 2012, at 5:21 01PM, Joe Touch wrote: > > > >>>>>=20 > > > >>>>>> Hi, Steve, > > > >>>>>>=20 > > > >>>>>> This doc doesn't appear to address the case where a host = has > > > >> multiple > > > >>>>>> DNS names, which could make it difficult to incorporate the > > > >> hostname > > > >>>>>> into the transform. I.e., I could contact a mail server at = an IP > > > >> address > > > >>>>>> that represents any of dozens of DNS names - how does the = server > > > >> know > > > >>>>>> which one I used so it can match without exhaustively = trying all > > > >> its > > > >>>>>> equivalent names? > > > >>>>>>=20 > > > >>>>>> Joe > > > >>>>>>=20 > > > >>>>>> On 1/4/2012 1:41 PM, Steven Bellovin wrote: > > > >>>>>>> I'd appreciate comments on my new draft, > > > >> draft-bellovin-hpw-00.txt: > > > >>>>>>>=20 > > > >>>>>>> Abstract > > > >>>>>>>=20 > > > >>>>>>> Many systems (e.g., cryptographic protocols relying on > > > >> symmetric > > > >>>>>>> cryptography) require that plaintext passwords be = stored. Given > > > >> how > > > >>>>>>> often people reuse passwords on different systems, this = poses a > > > >> very > > > >>>>>>> serious risk if a single machine is compromised. We = propose a > > > >>>>>>> scheme > > > >>>>>>> to derive passwords limited to a single machine from a = typed > > > >>>>>>> password, and explain how a protocol definition can = specify > > > >> this > > > >>>>>>> scheme. > > > >>>>>>>=20 > > > >>>>>>>=20 > > > >>>>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb > > > >>>>>>>=20 > > > >>>>>>>=20 > > > >>>>>>>=20 > > > >>>>>>>=20 > > > >>>>>>>=20 > > > >>>>>>> _______________________________________________ > > > >>>>>>> saag mailing list > > > >>>>>>> saag@ietf.org > > > >>>>>>> https://www.ietf.org/mailman/listinfo/saag > > > >>>>>>=20 > > > >>>>>=20 > > > >>>>>=20 > > > >>>>> --Steve Bellovin, https://www.cs.columbia.edu/~smb > > > >>>>>=20 > > > >>>>>=20 > > > >>>>>=20 > > > >>>>>=20 > > > >>>>>=20 > > > >>>>> _______________________________________________ > > > >>>>> saag mailing list > > > >>>>> saag@ietf.org > > > >>>>> https://www.ietf.org/mailman/listinfo/saag > > > >>>>>=20 > > > >>>>=20 > > > >>>>=20 > > > >>>> _______________________________________________ > > > >>>> Cfrg mailing list > > > >>>> Cfrg@irtf.org > > > >>>> http://www.irtf.org/mailman/listinfo/cfrg > > > >>>> [=C2=B8=C2=BD=C2=BC=C3=BE "smime.p7s" =C2=B1=C2=BB = =C3=96=C3=9C=C3=8B=C3=95=C2=BE=C2=B200132831/user/zte_ltd =C3=89=C2=BE=C2=B3= =C3=BD] > > > >>> _______________________________________________ > > > >>> Cfrg mailing list > > > >>> Cfrg@irtf.org > > > >>> http://www.irtf.org/mailman/listinfo/cfrg > > > >>=20 > > > >> _______________________________________________ > > > >> Cfrg mailing list > > > >> Cfrg@irtf.org > > > >> http://www.irtf.org/mailman/listinfo/cfrg > > > >>=20 > > > >=20 > > > >=20 > > > > _______________________________________________ > > > > Cfrg mailing list > > > > Cfrg@irtf.org > > > > http://www.irtf.org/mailman/listinfo/cfrg > > > >=20 > > >=20 > > >=20 > > > --Steve Bellovin, https://www.cs.columbia.edu/~smb > > >=20 > > >=20 > > >=20 > > >=20 > > >=20 > > > --Steve Bellovin, https://www.cs.columbia.edu/~smb From smb@cs.columbia.edu Sun Feb 12 16:36:59 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4FC521F8743 for ; Sun, 12 Feb 2012 16:36:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.687 X-Spam-Level: X-Spam-Status: No, score=-5.687 tagged_above=-999 required=5 tests=[AWL=0.613, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TBuT8oM2-cyy for ; Sun, 12 Feb 2012 16:36:58 -0800 (PST) Received: from paneer.cc.columbia.edu (paneer.cc.columbia.edu [128.59.29.4]) by ietfa.amsl.com (Postfix) with ESMTP id 9EFF121F8742 for ; Sun, 12 Feb 2012 16:36:58 -0800 (PST) Received: from [10.9.0.18] (fireball.cs.columbia.edu [128.59.13.10]) (user=smb2132 mech=PLAIN bits=0) by paneer.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q1D0aukb023803 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sun, 12 Feb 2012 19:36:57 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1257) Content-Type: text/plain; charset=utf-8 From: Steven Bellovin In-Reply-To: Date: Sun, 12 Feb 2012 19:37:08 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <6776D5F8-33B2-4266-BB0B-696AB64F41B9@cs.columbia.edu> References: To: zhou.sujing@zte.com.cn X-Mailer: Apple Mail (2.1257) X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.4 Cc: "cfrg@irtf.org" Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2012 00:36:59 -0000 On Feb 12, 2012, at 7:23 PM, zhou.sujing@zte.com.cn wrote: >=20 > Regards~~~ >=20 > -Sujing Zhou=20 >=20 > Steven Bellovin =E5=86=99=E4=BA=8E 2012-02-12 = 06:08:41: >=20 > >=20 > > On Feb 9, 2012, at 7:35 PM, zhou.sujing@zte.com.cn wrote: > >=20 > > >=20 > > >=20 > > > Steven Bellovin =E5=86=99=E4=BA=8E = 2012-02-09 20:32:07: > > >=20 > > > > I dealt with that in my note: how do you deal with multiple = devices?=20 > > >=20 > > > Just copy and paste to all the devices, or retrieve the required=20= > > long key from a USB key.=20 > > > It is seldom required to change, so it does not bring much=20 > > inconvenience, and just an option for users to choose. =20 > > >=20 > > Apart from the fact that I think that that's user-unfriendly, I = still don't > > understand what problem you are trying to solve. =20 >=20 > To resolve the problem of people haveing almost the same passwords = saved in almost all the service providers,=20 > by combining a long secret keys and some easy-to-remmeber passwords, = with some sacrifice of user-friendliness.=20 > It is an option for people put security ahead of a liitle = inconvenience.=20 >=20 Because the hashing includes the the service provider, the same password = on different sites will hash to different values, solving that problem = without the inconvenience. --Steve Bellovin, https://www.cs.columbia.edu/~smb From zhou.sujing@zte.com.cn Sun Feb 12 16:43:15 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 458A221F8623 for ; Sun, 12 Feb 2012 16:43:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.859 X-Spam-Level: X-Spam-Status: No, score=-96.859 tagged_above=-999 required=5 tests=[AWL=0.324, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e77ciV0D3ho2 for ; Sun, 12 Feb 2012 16:43:14 -0800 (PST) Received: from mx5.zte.com.cn (mx5.zte.com.cn [63.217.80.70]) by ietfa.amsl.com (Postfix) with ESMTP id ED5C321F8606 for ; Sun, 12 Feb 2012 16:43:10 -0800 (PST) Received: from [10.30.17.100] by mx5.zte.com.cn with surfront esmtp id 53829344249031; Mon, 13 Feb 2012 08:36:41 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.16] with StormMail ESMTP id 90429.412906327; Mon, 13 Feb 2012 08:43:06 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q1D0h3nq030342; Mon, 13 Feb 2012 08:43:03 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: <6776D5F8-33B2-4266-BB0B-696AB64F41B9@cs.columbia.edu> To: Steven Bellovin MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Mon, 13 Feb 2012 08:43:03 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-02-13 08:43:04, Serialize complete at 2012-02-13 08:43:04 Content-Type: multipart/alternative; boundary="=_alternative 0003F27A482579A3_=" X-MAIL: mse01.zte.com.cn q1D0h3nq030342 Cc: "cfrg@irtf.org" Subject: [Cfrg] =?utf-8?b?562U5aSNOiBSZTogIMK0w7DCuMK0OiBSZTogIMK0w7DCuMK0?= =?utf-8?q?=3A_Re=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2012 00:43:15 -0000 This is a multipart message in MIME format. --=_alternative 0003F27A482579A3_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 UmVnYXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KU3RldmVuIEJlbGxvdmluIDxzbWJAY3MuY29s dW1iaWEuZWR1PiDQtNPaIDIwMTItMDItMTMgMDg6Mzc6MDg6DQoNCj4gDQo+IE9uIEZlYiAxMiwg MjAxMiwgYXQgNzoyMyBQTSwgemhvdS5zdWppbmdAenRlLmNvbS5jbiB3cm90ZToNCj4gDQo+ID4g DQo+ID4gUmVnYXJkc35+fg0KPiA+IA0KPiA+IC1TdWppbmcgWmhvdSANCj4gPiANCj4gPiBTdGV2 ZW4gQmVsbG92aW4gPHNtYkBjcy5jb2x1bWJpYS5lZHU+INC009ogMjAxMi0wMi0xMiAwNjowODo0 MToNCj4gPiANCj4gPiA+IA0KPiA+ID4gT24gRmViIDksIDIwMTIsIGF0IDc6MzUgUE0sIHpob3Uu c3VqaW5nQHp0ZS5jb20uY24gd3JvdGU6DQo+ID4gPiANCj4gPiA+ID4gDQo+ID4gPiA+IA0KPiA+ ID4gPiBTdGV2ZW4gQmVsbG92aW4gPHNtYkBjcy5jb2x1bWJpYS5lZHU+INC009ogMjAxMi0wMi0w OSAyMDozMjowNzoNCj4gPiA+ID4gDQo+ID4gPiA+ID4gSSBkZWFsdCB3aXRoIHRoYXQgaW4gbXkg bm90ZTogaG93IGRvIHlvdSBkZWFsIHdpdGggbXVsdGlwbGUgDQpkZXZpY2VzPyANCj4gPiA+ID4g DQo+ID4gPiA+IEp1c3QgY29weSBhbmQgcGFzdGUgdG8gYWxsIHRoZSBkZXZpY2VzLCBvciByZXRy aWV2ZSB0aGUgcmVxdWlyZWQgDQo+ID4gPiBsb25nIGtleSBmcm9tIGEgVVNCIGtleS4gDQo+ID4g PiA+IEl0IGlzIHNlbGRvbSByZXF1aXJlZCB0byBjaGFuZ2UsIHNvIGl0IGRvZXMgbm90IGJyaW5n IG11Y2ggDQo+ID4gPiBpbmNvbnZlbmllbmNlLCBhbmQganVzdCBhbiBvcHRpb24gZm9yIHVzZXJz IHRvIGNob29zZS4gDQo+ID4gPiA+IA0KPiA+ID4gQXBhcnQgZnJvbSB0aGUgZmFjdCB0aGF0IEkg dGhpbmsgdGhhdCB0aGF0J3MgdXNlci11bmZyaWVuZGx5LCBJIA0KPiBzdGlsbCBkb24ndA0KPiA+ ID4gdW5kZXJzdGFuZCB3aGF0IHByb2JsZW0geW91IGFyZSB0cnlpbmcgdG8gc29sdmUuIA0KPiA+ IA0KPiA+IFRvIHJlc29sdmUgdGhlIHByb2JsZW0gb2YgcGVvcGxlIGhhdmVpbmcgYWxtb3N0IHRo ZSBzYW1lIHBhc3N3b3Jkcw0KPiBzYXZlZCBpbiBhbG1vc3QgYWxsIHRoZSBzZXJ2aWNlIHByb3Zp ZGVycywgDQo+ID4gYnkgY29tYmluaW5nIGEgbG9uZyBzZWNyZXQga2V5cyBhbmQgc29tZSBlYXN5 LXRvLXJlbW1lYmVyIA0KPiBwYXNzd29yZHMsIHdpdGggc29tZSBzYWNyaWZpY2Ugb2YgdXNlci1m cmllbmRsaW5lc3MuIA0KPiA+IEl0IGlzIGFuIG9wdGlvbiBmb3IgcGVvcGxlIHB1dCBzZWN1cml0 eSBhaGVhZCBvZiBhIGxpaXRsZSANCmluY29udmVuaWVuY2UuIA0KPiA+IA0KPiANCj4gQmVjYXVz ZSB0aGUgaGFzaGluZyBpbmNsdWRlcyB0aGUgdGhlIHNlcnZpY2UgcHJvdmlkZXIsIHRoZSBzYW1l IHBhc3N3b3JkIA0Kb24NCj4gZGlmZmVyZW50IHNpdGVzIHdpbGwgaGFzaCB0byBkaWZmZXJlbnQg dmFsdWVzLCBzb2x2aW5nIHRoYXQgcHJvYmxlbSANCndpdGhvdXQNCj4gdGhlIGluY29udmVuaWVu Y2UuDQpZZXMsIEkga25vdyB5b3VyIHByb3Bvc2FsIGFuZCBJoaF1bmRlcnN0YW5kIGl0Lg0KSSBt ZWFuIHlvdXIgcHJvcG9zYWwgY2FuIGhhdmUgYW4gZXh0cmEgb3B0aW9uIG9mIGhhc2hpbmcgKGxv bmcgc2VjcmV0IA0Ka2V5fHxwYXNzd29yZHx8dXNlcm5hbWV8fHNlcnZpdmUgcHJvdmlkZXIgbmFt ZSkNCmluIGNhc2UgcGVvcGxlIGFyZSB3b3JyeSBkaWN0aW9uYXJ5IGF0dGFjayBhZnRlciBwYXNz d29yZHMgc2F2ZWQgYXQgdGhlIA0Kc2lkZSBvZiBzZXJ2aWNlIHByb3ZpZGVyIGFyZSBleHBvc2Vk LA0KaW4gb3RoZXIgd29yZHMsIHRvIGFkZCBzb21lIGVudHJvcHkuIA0KDQo+ICAgICAgIC0tU3Rl dmUgQmVsbG92aW4sIGh0dHBzOi8vd3d3LmNzLmNvbHVtYmlhLmVkdS9+c21iDQo+IA0KPiANCj4g DQo+IA0KPiANCj4gDQoNCg== --=_alternative 0003F27A482579A3_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlJlZ2FyZHN+fn48YnI+DQo8YnI+ DQotU3VqaW5nIFpob3U8L2ZvbnQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TdGV2ZW4g QmVsbG92aW4gJmx0O3NtYkBjcy5jb2x1bWJpYS5lZHUmZ3Q7INC009oNCjIwMTItMDItMTMgMDg6 Mzc6MDg6PGJyPg0KPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IE9uIEZlYiAxMiwgMjAxMiwgYXQgNzoy MyBQTSwgemhvdS5zdWppbmdAenRlLmNvbS5jbiB3cm90ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDsg Jmd0OyA8YnI+DQomZ3Q7ICZndDsgUmVnYXJkc35+fjxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7 ICZndDsgLVN1amluZyBaaG91IDxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgU3RldmVu IEJlbGxvdmluICZsdDtzbWJAY3MuY29sdW1iaWEuZWR1Jmd0OyDQtNPaIDIwMTItMDItMTINCjA2 OjA4OjQxOjxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJmd0OyA8YnI+DQomZ3Q7ICZn dDsgJmd0OyBPbiBGZWIgOSwgMjAxMiwgYXQgNzozNSBQTSwgemhvdS5zdWppbmdAenRlLmNvbS5j biB3cm90ZTo8YnI+DQomZ3Q7ICZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJmd0OyAmZ3Q7IDxi cj4NCiZndDsgJmd0OyAmZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7ICZndDsgJmd0OyBTdGV2ZW4g QmVsbG92aW4gJmx0O3NtYkBjcy5jb2x1bWJpYS5lZHUmZ3Q7INC009oNCjIwMTItMDItMDkgMjA6 MzI6MDc6PGJyPg0KJmd0OyAmZ3Q7ICZndDsgJmd0OyA8YnI+DQomZ3Q7ICZndDsgJmd0OyAmZ3Q7 ICZndDsgSSBkZWFsdCB3aXRoIHRoYXQgaW4gbXkgbm90ZTogaG93IGRvIHlvdSBkZWFsDQp3aXRo IG11bHRpcGxlIGRldmljZXM/IDxicj4NCiZndDsgJmd0OyAmZ3Q7ICZndDsgPGJyPg0KJmd0OyAm Z3Q7ICZndDsgJmd0OyBKdXN0IGNvcHkgYW5kIHBhc3RlIHRvIGFsbCB0aGUgZGV2aWNlcywgb3Ig cmV0cmlldmUNCnRoZSByZXF1aXJlZCA8YnI+DQomZ3Q7ICZndDsgJmd0OyBsb25nIGtleSBmcm9t IGEgVVNCIGtleS4gPGJyPg0KJmd0OyAmZ3Q7ICZndDsgJmd0OyBJdCBpcyBzZWxkb20gcmVxdWly ZWQgdG8gY2hhbmdlLCBzbyBpdCBkb2VzIG5vdCBicmluZw0KbXVjaCA8YnI+DQomZ3Q7ICZndDsg Jmd0OyBpbmNvbnZlbmllbmNlLCBhbmQganVzdCBhbiBvcHRpb24gZm9yIHVzZXJzIHRvIGNob29z ZS4gJm5ic3A7DQo8YnI+DQomZ3Q7ICZndDsgJmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyAmZ3Q7 IEFwYXJ0IGZyb20gdGhlIGZhY3QgdGhhdCBJIHRoaW5rIHRoYXQgdGhhdCdzIHVzZXItdW5mcmll bmRseSwNCkkgPGJyPg0KJmd0OyBzdGlsbCBkb24ndDxicj4NCiZndDsgJmd0OyAmZ3Q7IHVuZGVy c3RhbmQgd2hhdCBwcm9ibGVtIHlvdSBhcmUgdHJ5aW5nIHRvIHNvbHZlLiAmbmJzcDs8YnI+DQom Z3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IFRvIHJlc29sdmUgdGhlIHByb2JsZW0gb2YgcGVvcGxl IGhhdmVpbmcgYWxtb3N0IHRoZSBzYW1lIHBhc3N3b3Jkczxicj4NCiZndDsgc2F2ZWQgaW4gYWxt b3N0IGFsbCB0aGUgc2VydmljZSBwcm92aWRlcnMsIDxicj4NCiZndDsgJmd0OyBieSBjb21iaW5p bmcgYSBsb25nIHNlY3JldCBrZXlzIGFuZCBzb21lIGVhc3ktdG8tcmVtbWViZXIgPGJyPg0KJmd0 OyBwYXNzd29yZHMsIHdpdGggc29tZSBzYWNyaWZpY2Ugb2YgdXNlci1mcmllbmRsaW5lc3MuIDxi cj4NCiZndDsgJmd0OyBJdCBpcyBhbiBvcHRpb24gZm9yIHBlb3BsZSBwdXQgc2VjdXJpdHkgYWhl YWQgb2YgYSBsaWl0bGUgaW5jb252ZW5pZW5jZS4NCjxicj4NCiZndDsgJmd0OyA8YnI+DQomZ3Q7 IDxicj4NCiZndDsgQmVjYXVzZSB0aGUgaGFzaGluZyBpbmNsdWRlcyB0aGUgdGhlIHNlcnZpY2Ug cHJvdmlkZXIsIHRoZSBzYW1lIHBhc3N3b3JkDQpvbjxicj4NCiZndDsgZGlmZmVyZW50IHNpdGVz IHdpbGwgaGFzaCB0byBkaWZmZXJlbnQgdmFsdWVzLCBzb2x2aW5nIHRoYXQgcHJvYmxlbQ0Kd2l0 aG91dDxicj4NCiZndDsgdGhlIGluY29udmVuaWVuY2UuPGJyPg0KWWVzLCBJIGtub3cgeW91ciBw cm9wb3NhbCBhbmQgSaGhdW5kZXJzdGFuZCBpdC48L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQg c2l6ZT0yPkkgbWVhbiB5b3VyIHByb3Bvc2FsIGNhbiBoYXZlIGFuIGV4dHJhIG9wdGlvbiBvZiBo YXNoaW5nDQoobG9uZyBzZWNyZXQga2V5fHxwYXNzd29yZHx8dXNlcm5hbWV8fHNlcnZpdmUgcHJv dmlkZXIgbmFtZSk8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPmluIGNhc2UgcGVv cGxlIGFyZSB3b3JyeSBkaWN0aW9uYXJ5IGF0dGFjayBhZnRlciBwYXNzd29yZHMNCnNhdmVkIGF0 IHRoZSBzaWRlIG9mIHNlcnZpY2UgcHJvdmlkZXIgYXJlIGV4cG9zZWQsPC9mb250PjwvdHQ+DQo8 YnI+PHR0Pjxmb250IHNpemU9Mj5pbiBvdGhlciB3b3JkcywgdG8gYWRkIHNvbWUgZW50cm9weS4g Jm5ic3A7IDwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+PGJyPg0KJmd0OyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAtLVN0ZXZlIEJlbGxvdmluLCBodHRwczovL3d3dy5jcy5jb2x1bWJp YS5lZHUvfnNtYjxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCjwvZm9udD48L3R0Pg0K --=_alternative 0003F27A482579A3_=-- From smb@cs.columbia.edu Sun Feb 12 16:50:46 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB0A21F86B0 for ; Sun, 12 Feb 2012 16:50:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.584 X-Spam-Level: X-Spam-Status: No, score=-2.584 tagged_above=-999 required=5 tests=[AWL=-2.735, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, MIME_CHARSET_FARAWAY=2.45] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J2+tmFfIiwi9 for ; Sun, 12 Feb 2012 16:50:45 -0800 (PST) Received: from rambutan.cc.columbia.edu (rambutan.cc.columbia.edu [128.59.29.5]) by ietfa.amsl.com (Postfix) with ESMTP id 6DE5321F86AA for ; Sun, 12 Feb 2012 16:50:45 -0800 (PST) Received: from [10.9.0.18] (fireball.cs.columbia.edu [128.59.13.10]) (user=smb2132 mech=PLAIN bits=0) by rambutan.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q1D0ofx8007301 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sun, 12 Feb 2012 19:50:42 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1257) Content-Type: text/plain; charset=GB2312 From: Steven Bellovin In-Reply-To: Date: Sun, 12 Feb 2012 19:50:54 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: zhou.sujing@zte.com.cn X-Mailer: Apple Mail (2.1257) X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.68 on 128.59.29.5 Cc: "cfrg@irtf.org" Subject: Re: [Cfrg] =?iso-8859-1?q?=B4=F0=B8=B4=3A_Re=3A__=B4=F0=B8=B4=3A_Re?= =?iso-8859-1?q?=3A__=5Bsaag=5D_New_draft=3A_Ha__shed_Password_Exchange?= X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2012 00:50:46 -0000 On Feb 12, 2012, at 7:43 PM, zhou.sujing@zte.com.cn wrote: >=20 > Regards~~~ >=20 > -Sujing Zhou=20 >=20 > Steven Bellovin =D0=B4=D3=DA 2012-02-13 = 08:37:08: >=20 > >=20 > > On Feb 12, 2012, at 7:23 PM, zhou.sujing@zte.com.cn wrote: > >=20 > > >=20 > > > Regards~~~ > > >=20 > > > -Sujing Zhou=20 > > >=20 > > > Steven Bellovin =D0=B4=D3=DA 2012-02-12 = 06:08:41: > > >=20 > > > >=20 > > > > On Feb 9, 2012, at 7:35 PM, zhou.sujing@zte.com.cn wrote: > > > >=20 > > > > >=20 > > > > >=20 > > > > > Steven Bellovin =D0=B4=D3=DA 2012-02-09 = 20:32:07: > > > > >=20 > > > > > > I dealt with that in my note: how do you deal with multiple = devices?=20 > > > > >=20 > > > > > Just copy and paste to all the devices, or retrieve the = required=20 > > > > long key from a USB key.=20 > > > > > It is seldom required to change, so it does not bring much=20 > > > > inconvenience, and just an option for users to choose. =20 > > > > >=20 > > > > Apart from the fact that I think that that's user-unfriendly, I=20= > > still don't > > > > understand what problem you are trying to solve. =20 > > >=20 > > > To resolve the problem of people haveing almost the same passwords > > saved in almost all the service providers,=20 > > > by combining a long secret keys and some easy-to-remmeber=20 > > passwords, with some sacrifice of user-friendliness.=20 > > > It is an option for people put security ahead of a liitle = inconvenience.=20 > > >=20 > >=20 > > Because the hashing includes the the service provider, the same = password on > > different sites will hash to different values, solving that problem = without > > the inconvenience. > Yes, I know your proposal and I=A1=A1understand it.=20 > I mean your proposal can have an extra option of hashing (long secret = key||password||username||servive provider name)=20 > in case people are worry dictionary attack after passwords saved at = the side of service provider are exposed,=20 > in other words, to add some entropy. =20 >=20 Ah, a secret salt. I'll think about it -- that's a very different = meaning to "salt" than is customarily used. --Steve Bellovin, https://www.cs.columbia.edu/~smb From mcgrew@cisco.com Thu Feb 16 10:50:23 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5361D11E80A1 for ; Thu, 16 Feb 2012 10:50:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.261 X-Spam-Level: X-Spam-Status: No, score=-108.261 tagged_above=-999 required=5 tests=[AWL=2.338, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s9pMifbExWPi for ; Thu, 16 Feb 2012 10:50:18 -0800 (PST) Received: from mtv-iport-1.cisco.com (mtv-iport-1.cisco.com [173.36.130.12]) by ietfa.amsl.com (Postfix) with ESMTP id E003921F87FF for ; Thu, 16 Feb 2012 10:50:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=mcgrew@cisco.com; l=514; q=dns/txt; s=iport; t=1329418218; x=1330627818; h=from:content-transfer-encoding:subject:date:message-id: to:mime-version; bh=ZqM24F5mCdex/I2n3D5PGDwP9FUtWw0khQYgsLEi9xU=; b=bDVWoazgduoydlzxgIH7/XivGxYjGRzqhwIFjMEhs6ZZbjl5/sMhx4/S wylw8MB5tW76LYiJ8OwKs3Ntghy3pTn17qc4zICRE1XbqLKTvzKpFY63d RsQtWZiisIp9VMdtzcWiFi1qlHEVM8qMtqB5duHl077whDDC5tPW+ZFU0 Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AiwGAItOPU+rRDoI/2dsb2JhbABEgw6tWoEHggsBCh2BCnMBGxmHZppQAZ5Ji3wlBQgMDAIMAQkBAwECAQICg2IuCQQFDQ+COGMEiE6MaYVdjSk X-IronPort-AV: E=Sophos;i="4.73,430,1325462400"; d="scan'208";a="29161115" Received: from mtv-core-3.cisco.com ([171.68.58.8]) by mtv-iport-1.cisco.com with ESMTP; 16 Feb 2012 18:50:18 +0000 Received: from [10.32.254.210] ([10.32.254.210]) by mtv-core-3.cisco.com (8.14.3/8.14.3) with ESMTP id q1GIoHNQ006713; Thu, 16 Feb 2012 18:50:18 GMT From: David McGrew Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Thu, 16 Feb 2012 13:50:17 -0500 Message-Id: To: cfrg@irtf.org, "Kevin M. Igoe" Mime-Version: 1.0 (Apple Message framework v1257) X-Mailer: Apple Mail (2.1257) Subject: [Cfrg] CFRG at IETF83 X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Feb 2012 18:50:23 -0000 The Crypto Forum RG will be meeting at the IETF83 venue in Paris = This is a call for agenda = items; please send your requests for time to give presentations to the = group, and your suggestions on topics that should be discussed. =20 Some topics that have been suggested already: =20 - Hash-based passwords =20 - Password authenticated key exchange =20 - draft-irtf-cfrg-cipher-catalog =20 =20 - draft-krovetz-ocb-03 regards, =20 Kevin and David= From mcgrew@cisco.com Thu Feb 23 15:15:03 2012 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A50E221F86C2 for ; Thu, 23 Feb 2012 15:15:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -109.639 X-Spam-Level: X-Spam-Status: No, score=-109.639 tagged_above=-999 required=5 tests=[AWL=0.960, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EZhzjbHmZgp7 for ; Thu, 23 Feb 2012 15:15:03 -0800 (PST) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by ietfa.amsl.com (Postfix) with ESMTP id 0EA7A21F86B2 for ; Thu, 23 Feb 2012 15:15:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=mcgrew@cisco.com; l=931; q=dns/txt; s=iport; t=1330038903; x=1331248503; h=mime-version:subject:from:in-reply-to:date: content-transfer-encoding:message-id:references:to; bh=LMbKIURORzgvKduEURNJKC2PuHVtX3h8Xenp4DC21lM=; b=EN1QHQ2lemIXoinNDgayG+rJw9ng6oSmO+DkWr9L1L5Y48sAt9npbooB Ptao9YoZUklaFR8kfyxohD9NqEd5Ak2n7TTdIaXSekkHe2L8dGq5vZvbb k30QYxZmVbgFvGjwvmr5wmPDXqS+oo6lNm1NyCDpcajNa0x9qTdycqW1/ 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EAE7IRk+tJV2b/2dsb2JhbABEskCBB4FzAQEBAwEBAQEPAQodNBALCzAWJzAGARIJGYdfCZpOAZBmjXmMbwkuCAsDDw0CBxABDAIDAwKFVAwGCBIggjljBIhPjGmTCw X-IronPort-AV: E=Sophos;i="4.73,472,1325462400"; d="scan'208";a="61391670" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-3.cisco.com with ESMTP; 23 Feb 2012 23:14:58 +0000 Received: from rtp-vpn5-524.cisco.com (rtp-vpn5-524.cisco.com [10.82.234.14]) by rcdn-core-4.cisco.com (8.14.3/8.14.3) with ESMTP id q1NNEwkt023492; Thu, 23 Feb 2012 23:14:58 GMT Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1257) From: David McGrew In-Reply-To: Date: Thu, 23 Feb 2012 18:14:57 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <4494A168-7446-4FAD-800F-0B2E877A4457@cisco.com> References: To: cfrg@irtf.org, "Kevin M. Igoe" X-Mailer: Apple Mail (2.1257) Subject: Re: [Cfrg] CFRG at IETF83 X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Feb 2012 23:15:03 -0000 OK, we now have a time slot and room: CFRG Session 1 (2 hours) Friday, Afternoon Session I 1120-1220 Room Name: 212/213 The room seats 60 people, which should be plenty. Kevin and David On Feb 16, 2012, at 1:50 PM, David McGrew wrote: > The Crypto Forum RG will be meeting at the IETF83 venue in Paris = This is a call for agenda = items; please send your requests for time to give presentations to the = group, and your suggestions on topics that should be discussed. >=20 > Some topics that have been suggested already: >=20 > - Hash-based passwords >=20 > - Password authenticated key exchange >=20 > - draft-irtf-cfrg-cipher-catalog =20 >=20 > - draft-krovetz-ocb-03 >=20 > regards, >=20 > Kevin and David > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > http://www.irtf.org/mailman/listinfo/cfrg