From nobody Fri Oct 2 05:24:25 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D28E63A0FAC for ; Fri, 2 Oct 2020 05:24:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fqpxqes-15Q9 for ; Fri, 2 Oct 2020 05:24:22 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 767083A0F9F for ; Fri, 2 Oct 2020 05:24:22 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kOK6m-000H9n-I4 for spasm@ietf.org; Fri, 02 Oct 2020 14:24:20 +0200 Date: Fri, 2 Oct 2020 14:24:19 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG Message-ID: User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: [lamps] HP Issue: Bcc Handling X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 12:24:24 -0000 Below a summary of the issue on 'Bcc Handling'. If anybody wishes to discuss this topic further or does not agree with the conclusion, please speek up within the next 10 days! At the bottom of this email there are some open questions that need answers. cheers, Bernie Text from slide: - Encrypted Messages with Bcc need to be split: 1) The same Message to all To and Cc recipients, without Bcc HF 2) Message(s) to Bcc recipient(s) vary among implementations a) One Message per Bcc recipient Bcc HF contains recipient address the message is sent to b) The same Message for all Bcc recipients Bcc HF with an indication, e.g. "Undisclosed recipients" c) The same Message for all Bcc recipients without Bcc HF (same as same as 1) - No specification on this found in S/MIME - 2a is most privacy-preserving, but may result in many Messages - 2b and 2c are easier/more efficient to handle, but leak privacy information via encryption keys and certs Conclusion at IETF-108 (as I understood): - 2a is the way forward - 2a has been claimed to be already part of the S/MIME standards Open questions: - Where (RFC & Section) is it standardized that 2a is to be used, so that we could refer to? - What is the standardization state of 2b and 2c that appear to be implemented? forbidden, discouraged, deprecated, ... ? From nobody Fri Oct 2 07:33:15 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EF7E3A10D8 for ; Fri, 2 Oct 2020 07:33:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SVVfC9fvr1hO for ; Fri, 2 Oct 2020 07:33:12 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C55F43A108B for ; Fri, 2 Oct 2020 07:33:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 2C6C0300B53 for ; Fri, 2 Oct 2020 10:33:10 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id qobDHM_SYdTv for ; Fri, 2 Oct 2020 10:33:08 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id C8E79300ADB; Fri, 2 Oct 2020 10:33:08 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Fri, 2 Oct 2020 10:33:10 -0400 Cc: IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Bernie Hoeneisen X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] HP Issue: Bcc Handling X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 14:33:14 -0000 Bernie: Please take a look at RFC 5322, Section 3.6.3. The proposed direction = seems to be consistent, but you probably want to cite this section. Russ > On Oct 2, 2020, at 8:24 AM, Bernie Hoeneisen = wrote: >=20 > Below a summary of the issue on 'Bcc Handling'. If anybody wishes to = discuss this topic further or does not agree with the conclusion, please = speek up within the next 10 days! >=20 > At the bottom of this email there are some open questions that need = answers. >=20 > cheers, > Bernie >=20 >=20 > Text from slide: >=20 > - Encrypted Messages with Bcc need to be split: >=20 > 1) The same Message to all To and Cc recipients, without Bcc HF >=20 > 2) Message(s) to Bcc recipient(s) vary among implementations >=20 > a) One Message per Bcc recipient > Bcc HF contains recipient address the message is sent to >=20 > b) The same Message for all Bcc recipients > Bcc HF with an indication, e.g. "Undisclosed recipients" >=20 > c) The same Message for all Bcc recipients > without Bcc HF (same as same as 1) >=20 > - No specification on this found in S/MIME >=20 > - 2a is most privacy-preserving, but may result in many Messages >=20 > - 2b and 2c are easier/more efficient to handle, but leak privacy > information via encryption keys and certs >=20 >=20 > Conclusion at IETF-108 (as I understood): >=20 > - 2a is the way forward >=20 > - 2a has been claimed to be already part of the S/MIME standards >=20 >=20 > Open questions: >=20 > - Where (RFC & Section) is it standardized that 2a is to be used, > so that we could refer to? >=20 > - What is the standardization state of 2b and 2c that appear to > be implemented? forbidden, discouraged, deprecated, ... ? From nobody Fri Oct 2 08:46:09 2020 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EB6F03A0E87; Fri, 2 Oct 2020 08:46:02 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.18.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <160165356292.22875.7230909280600077627@ietfa.amsl.com> Date: Fri, 02 Oct 2020 08:46:02 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-lightweight-cmp-profile-03.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 15:46:03 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Lightweight CMP Profile Authors : Hendrik Brockhaus Steffen Fries David von Oheimb Filename : draft-ietf-lamps-lightweight-cmp-profile-03.txt Pages : 81 Date : 2020-10-02 Abstract: The goal of this document is to facilitate interoperability and automation by profiling the Certificate Management Protocol (CMP) version 2, the related Certificate Request Message Format (CRMF) version 2, and the HTTP Transfer for the Certificate Management Protocol. It specifies a subset of CMP and CRMF focusing on typical uses cases relevant for managing certificates of devices in many industrial and IoT scenarios. To limit the overhead of certificate management for more constrained devices only the most crucial types of operations are specified as mandatory. To foster interoperability in more complex scenarios, other types of operations are specified as recommended or optional. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-lightweight-cmp-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-lightweight-cmp-profile-03 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-lightweight-cmp-profile-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-lightweight-cmp-profile-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Oct 2 08:52:43 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A2383A16D8 for ; Fri, 2 Oct 2020 08:52:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ytmWq4sS3O40 for ; Fri, 2 Oct 2020 08:52:33 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60043.outbound.protection.outlook.com [40.107.6.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE2FB3A16AC for ; Fri, 2 Oct 2020 08:52:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RD5w0WrQ9FL0+y8Hsv5EmaPQ8/tVYEbve+ea0SFAJNJY/49slidmANDdvKNhwMjz6wu29LcMFlXANxmTX13huqnjJd5V5LbUHgkzk4iNwwO+mLhDTaMbENILAEbw3Rn0vabBO4lrBP1bIiFTxawYg/ROBMfF5HSXBggTciQPaor/f+mMBnGZT11FHzl++MK6GTL/Z4qtK15Q2nlrU83bs35gtHtB0gd8yxsNZwdYqlYt9DblcEjYcAap06NEq1+8QSR4gtQzZPKnWrLl7l0nJ/YoCT6KCSVLloHCSzsniWSJ6fEgxmgcrJxXwpxUv8Sus2H/Y9fQlhQKbCn3n5++Pg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6fZaA3TdaeL/j89bkLqNDf/GVtZjpHI5G85qHHlGxVc=; b=jH8icI9/QqckbjS8XR/GHE7KeAQwmhOtjyXkmeFQnC5/yfryemV53aXLhx3E+oMd0dk2k6Q6bWfRqL8+TxY0yTeOfD2qz+LX5hAI/L8LUmvC8fLtfnRi8SGbh4IGLJGdaSAcR0enmeSijxbmRin3bZwQScH5Tt2yxF7NuAzHgVfCQcERcw+JpaFdsrY/teW+hg8WCEYnjWEnFj7XmlQ/iPnYPavv5BJ0UIMPc6AEkSj4kGL+wxBGWmYHio2LPFROh7HNHu8+DnQf/3BfJS4wCP23dKIcW1mAaj9yHvD5Tl4DDZVBjjKgZZz7s0wkd/8WShFjOu2l7/Rb3onLYT7Ptg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6fZaA3TdaeL/j89bkLqNDf/GVtZjpHI5G85qHHlGxVc=; b=ihGlEv2Ze7BpSSMsBVrTM4zvV0Oy2PHA3mO2k6lYZRIU2x1dNMnDi/HO3TDkL6iDynjJyA/ptlCHchvZH3VQy4Jv9eFJGYZlSblZ+L101WHM3VRvOQXg2QjDGPzNbn2J5a9wDCkfZeCSWPpHVvH6KEFWI245UO+OT1QeJYDCAX0= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM0PR10MB2786.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:130::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3412.25; Fri, 2 Oct 2020 15:52:23 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::815c:e3e3:e2be:5eed]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::815c:e3e3:e2be:5eed%6]) with mapi id 15.20.3433.036; Fri, 2 Oct 2020 15:52:23 +0000 From: "Brockhaus, Hendrik" To: "spasm@ietf.org" CC: "david.von.oheimb@siemens.com" , "steffen.fries@siemens.com" Thread-Topic: [lamps] I-D Action: draft-ietf-lamps-lightweight-cmp-profile-03.txt Thread-Index: AQHWmNNWnbL7EtmFBUGOF+agTTnczamEdV4Q Content-Class: Date: Fri, 2 Oct 2020 15:52:22 +0000 Message-ID: References: <160165356292.22875.7230909280600077627@ietfa.amsl.com> In-Reply-To: <160165356292.22875.7230909280600077627@ietfa.amsl.com> Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-10-02T15:52:21Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=3129672a-60de-4fd0-90c3-676ed4e06fe9; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=siemens.com; x-originating-ip: [165.225.200.158] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 90211ddc-6b37-4280-71e7-08d866eb2717 x-ms-traffictypediagnostic: AM0PR10MB2786: x-ld-processed: 38ae3bcd-9579-4fd4-adda-b42e1495d55a,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 279EQu4SWoze7nNqJOYSRlFyGzr7S3TXFhfUd/908RX8F/a5mGiA7NbEynCaBtyLBv40IqX+f2IH+0OQVt0b/HoiTIPBdmLB/IzGhD+xNT1t5CpvYfgnVr3E3Ce2loG94kL3ElAcnjiJIqO5X/bz0Qq5gTCFK2OCu03e/U0naBBzQAb8+iYyppgl4pVGZHNAuMr2/69EgRDc+XYhuU3rHiM1wnG0FcfenqUvmE189KdXzV4EwOjeHnDeWzygePQ3DM6VtuDynQ5quqky/0R+Riec2uvnDz65URpZHCLvJyGCbADtEQcs68erUGOuUMfY0MWpUZcHQrluIsrlkYAhfWffiTHtj+DK8rncZy1rgXszVfyToXTfQ50M+Lkilq5QpCmo1G3k9sy5h5jr3IU7KsYLpQlSkQZofgTSUq5lI1LwBFdc9eSTdO2Ycbn93POX x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(396003)(346002)(376002)(39860400002)(366004)(136003)(76116006)(107886003)(6916009)(26005)(8676002)(64756008)(9686003)(55236004)(54906003)(52536014)(4326008)(2906002)(66946007)(55016002)(33656002)(83080400001)(5660300002)(66476007)(8936002)(71200400001)(86362001)(66556008)(66446008)(966005)(7696005)(66574015)(316002)(186003)(6506007)(478600001)(45080400002)(83380400001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: ihD2p5/0UHX85ZKlQG+lecj9WpuU76hflLgK3TYhubeeohLyPqvcg6/MvQePt7dCWoDVwMIJqsWdrpRIKRrm/YmEnc42yPi2VXSmevmPQSI45WjmGzKwgqGZb1osKt4nRo5fKfS3FGljREnA7lYGhnMPOuJXbTz6pw2oNaJdenY14AcU5xUIVtk/3TYGIgZ7/Gk+7Cc1Vcw+vNs947RS9VC4kAuSPkHwex0rU3cSags44KZdZwuqCllRJ2Lrd7LxK3aRiTbLUJH+oiO8yTaRoNpAfq2wRpls6ySlwuiPuMM/soMNIHwWYc8/71FxEO0FrLXdNXnVhQzLjI+pknDC+8EcQPHn8rbiFgI2PzLdcypEzv2dXozIa5fHWLGpRUhRwy7mZwaMUkOUO4gGZvZhg+vPC58SEuA+3GlyCLDw5bdhIgxe4t5VzSndeRbGkY8Z29lseuX2fUlLj31AzmCCSVGMr6CpBU62rYkxANhurwc6TO+PgpeK2bUUByIdqcoxgwyWySztjQAAFOxxrU7E+x8fOl9fMCnjybtAvGZjp80UhkydSee04CtTKxwkM4iNgsMDTvvbJa96qnCV6Ba98QNOwiHwgy+pcGHsgigEyQ/UIuFsl33qi0CcK1vAmKwQIdp+T+UYXe9BD7XscsDt7w== Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 90211ddc-6b37-4280-71e7-08d866eb2717 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Oct 2020 15:52:23.0141 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: s8MvuE/PfmSaG4ADgb9p0LRBrhmt18KBtohxnaVnCoOnsRzXgKJZHZ2z9TiFZpSv8Sk/jDrZKH9eUQURILpyV1hUdP6fKY6wojqYAX3Ftio= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB2786 Archived-At: Subject: Re: [lamps] I-D Action: draft-ietf-lamps-lightweight-cmp-profile-03.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 15:52:42 -0000 I submitted an update of the Lightweight CMP Profile today. Theses are the main changes from version 02 -> 03: o Updated the interoperability with [UNISIG-Subset137] in Section 1.4. o Changed Section 2.3 to a tabular layout to enhanced readability o Added a ToDo to section 3.1 on aligning with the CMP Algorithms draf= t that will be set up as decided in IETF 108 o Updated section 4.1.6 to add the AsymmetricKey Package structure to = transport a newly generated private key as decided in IETF 108 o Added a ToDo to section 4.1.7 on required review of the nonce handli= ng in case an offline LRA responds and not forwards the pollReq messages o Updated Section 4 due to the definition of the new ITAV OIDs in CMP = Updates o Updated Section 4.4.4 to utilize controls instead of rsaKeyLen (see = thread "dtaft-ietf-lamps-cmp-updates and rsaKeyLen") o Deleted the section on definition and discovery of HTTP URIs and cop= ied the text to the HTTP transport section and to CMP Updates section 3.2 o Added some explanation to Section 5.1.2 and Section 5.1.3 on using n= ested messages when a protection by the RA is required. o Deleted the section on HTTP URI definition and discovery as some con= tent was moved to CMP Updates. The rest of the content was moved back to = the HTTP transport section o Deleted the ASN.1 module after moving the new OIDs id-it-caCerts, id= -it-rootCaKeyUpdate, and id-it-certReqTemplate to CMP Updates o Minor changes in wording and addition of some open ToDos Any feedback is welcome. Hendrik > -----Urspr=FCngliche Nachricht----- > Von: Spasm Im Auftrag von internet-drafts@ietf.o= rg > Gesendet: Freitag, 2. Oktober 2020 17:46 > An: i-d-announce@ietf.org > Cc: spasm@ietf.org > Betreff: [lamps] I-D Action: draft-ietf-lamps-lightweight-cmp-profile-03.= txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. > This draft is a work item of the Limited Additional Mechanisms for PKIX a= nd > SMIME WG of the IETF. >=20 > Title : Lightweight CMP Profile > Authors : Hendrik Brockhaus > Steffen Fries > David von Oheimb > Filename : draft-ietf-lamps-lightweight-cmp-profile-03.txt > Pages : 81 > Date : 2020-10-02 >=20 > Abstract: > The goal of this document is to facilitate interoperability and > automation by profiling the Certificate Management Protocol (CMP) > version 2, the related Certificate Request Message Format (CRMF) > version 2, and the HTTP Transfer for the Certificate Management > Protocol. It specifies a subset of CMP and CRMF focusing on typical > uses cases relevant for managing certificates of devices in many > industrial and IoT scenarios. To limit the overhead of certificate > management for more constrained devices only the most crucial types > of operations are specified as mandatory. To foster interoperability > in more complex scenarios, other types of operations are specified as > recommended or optional. >=20 >=20 > The IETF datatracker status page for this draft is: > https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat= rack > er.ietf.org%2Fdoc%2Fdraft-ietf-lamps-lightweight-cmp- > profile%2F&data=3D02%7C01%7Chendrik.brockhaus%40siemens.com%7C7e > b40ee17fe9488b36b108d866ea77e1%7C38ae3bcd95794fd4addab42e1495d55a > %7C1%7C0%7C637372504504442483&sdata=3D6U2m8wV00wjvzjCbxMjz7Rj > b%2B9Mdu8CaDh5vi70dR%2Bw%3D&reserved=3D0 >=20 > There are also htmlized versions available at: > https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools= .ietf. > org%2Fhtml%2Fdraft-ietf-lamps-lightweight-cmp-profile- > 03&data=3D02%7C01%7Chendrik.brockhaus%40siemens.com%7C7eb40ee17 > fe9488b36b108d866ea77e1%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7 > C0%7C637372504504442483&sdata=3DvcJFGESjAc%2B3NGhenVSeb7js36z%2 > FVUyUjbbGi%2FrdiBg%3D&reserved=3D0 > https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatat= rack > er.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-lamps-lightweight-cmp-profile- > 03&data=3D02%7C01%7Chendrik.brockhaus%40siemens.com%7C7eb40ee17 > fe9488b36b108d866ea77e1%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7 > C0%7C637372504504442483&sdata=3DvZ7CQCDIUh1tx0SMgcgyfff5GVc4kK > AMM5AAIC4hw6M%3D&reserved=3D0 >=20 > A diff from the previous version is available at: > https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf. > org%2Frfcdiff%3Furl2%3Ddraft-ietf-lamps-lightweight-cmp-profile- > 03&data=3D02%7C01%7Chendrik.brockhaus%40siemens.com%7C7eb40ee17 > fe9488b36b108d866ea77e1%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7 > C0%7C637372504504442483&sdata=3D80YLbaTQV3abMEi93td9T7BWzdXPr > T08nrqoEozjhOo%3D&reserved=3D0 >=20 >=20 > Please note that it may take a couple of minutes from the time of submiss= ion > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > https://eur01.safelinks.protection.outlook.com/?url=3Dftp%3A%2F%2Fftp.iet= f.org% > 2Finternet- > drafts%2F&data=3D02%7C01%7Chendrik.brockhaus%40siemens.com%7C7eb > 40ee17fe9488b36b108d866ea77e1%7C38ae3bcd95794fd4addab42e1495d55a > %7C1%7C0%7C637372504504442483&sdata=3DER21ZTR45lNcvZ47S3DQFny > gH%2BozhLNY3N34y7UKSKg%3D&reserved=3D0 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf. > org%2Fmailman%2Flistinfo%2Fspasm&data=3D02%7C01%7Chendrik.brockha > us%40siemens.com%7C7eb40ee17fe9488b36b108d866ea77e1%7C38ae3bcd95 > 794fd4addab42e1495d55a%7C1%7C0%7C637372504504442483&sdata=3Db > uASe6QRF5okMmV%2FwfxUa8%2Bl%2B0qql5dMMBKS5XEW0wQ%3D&res > erved=3D0 From nobody Fri Oct 2 09:06:03 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 886F83A10E0 for ; Fri, 2 Oct 2020 09:06:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQ1hpw0XvgPt for ; Fri, 2 Oct 2020 09:06:00 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D1443A0BA6 for ; Fri, 2 Oct 2020 09:06:00 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kONZG-000I3h-RN; Fri, 02 Oct 2020 18:05:58 +0200 Date: Fri, 2 Oct 2020 18:05:58 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG cc: Jim Schaad Message-ID: User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: [lamps] [dispatch] Improve UX in Encrypted Email (distinguish between forwarded and otherwise wrapped messages) (fwd) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 16:06:03 -0000 Dear LAMPS list Please be informed that I just sent the follwing Email to the IETF DISPATCH list to address a wider Email community with a matter that is also relevant to the Header Protection discussion in LAMPS. https://mailarchive.ietf.org/arch/msg/dispatch/GeaPjbvCllw5Gg1MhRlpqAfHwuU/ This discussion is expected to happen on the DISPATCH Mailing list and you are invited to share your experience there. cheers, Bernie PS: I am almost certain Jim Schaad has some relevant experience on this to share with us. ---------- Forwarded message ---------- Date: Fri, 2 Oct 2020 17:56:35 From: Bernie Hoeneisen To: IETF DISPATCH list Subject: [dispatch] Improve UX in Encrypted Email (distinguish between forwarded and otherwise wrapped messages) Hi, We are seeking advise from the Email community regarding the following: In the LAMPS WG we are working on so called "Header Protection" for Emails to achieve better privacy. This concerns in particular (but not only) the Subject Header Field that is often left unencrypted in otherwise encrypted email. The mechnism used for Protection of Header Fields is to wrap a whole email (including the Header Section) into another email and apply protection to the former. At the receiving side certain Email clients do not render such signed/encrypted emails correctly to the user, leading to "weired artefacts" and thus bad User Experience (UX). Such clients do not distinguish between forwarded mail and signed/encrypted emails (wrapped in a similar way as forwarded messages). Alexey came up with a proposal to help such email clients to make this distinction (with the intention to improve UX). Together with Alexey I wrote up this proposal to an early draft version: https://tools.ietf.org/html/draft-melnikov-iana-reg-forwarded-00 This I-D suggests a new Content-Type Header Field Parameter "forwarded": If set to "yes", the contained message was forwarded; if set to "no", the message was "wrapped" for signature/encryption with Header Protection. However, I am concerned that the (binary) scope of the Content-Type Header Field Parameter may be too narrow, as there a potentially more cases an email message is transported in the Body part of another email message and such a Parameter may be helpful, such as: - Rejected (non deliveries / bounces) - ML-hold (message to be assessed by a mailing list admin) - ML-discard-action (mailing list admin reply to this will discard) - ML-digest-item (mailing list digest item; digest is a collection of multiple emails) - even more? I am seeking advice (mainly from implemeters of MUAs) on: 1) Is it helpful/useful/needed to enhance such a Parameter for these additional cases? 2) Have there been problems in the past to distingish such cases from "forwarded" messages? We'd appeciate your feedback (preferably within the next 10 days)! cheers, Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology _______________________________________________ dispatch mailing list dispatch@ietf.org https://www.ietf.org/mailman/listinfo/dispatch From nobody Fri Oct 2 10:57:18 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 364353A1194 for ; Fri, 2 Oct 2020 10:57:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SaEUXzZUInA4 for ; Fri, 2 Oct 2020 10:57:15 -0700 (PDT) Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52CE63A1173 for ; Fri, 2 Oct 2020 10:57:15 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 092HvDbg033513; Fri, 2 Oct 2020 13:57:13 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu 092HvDbg033513 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1601661433; bh=FotmADZ8XpBirXI6izAJYNbJcd5PtWY/Ul9+jsvLPYE=; h=From:To:Subject:Date:References:In-Reply-To:From; b=ItFz1QvMb3cwcDyBIdSOtuEFhhgpBViAGcBx9LTjx92lIZNBZXU1Q3OqmhuT2/y4W He/Z43YHwtIeslmwXfwyg5AL5127u0JpnYIooEW2xMquWUoHAcdDR4cmMwzK8dnwoA jIO2IsdE5w1VPIMQwMimMcsXtyM6KeUmNy1lQON0= Received: from MURIEL.ad.sei.cmu.edu (muriel.ad.sei.cmu.edu [147.72.252.47]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 092Hv9AO029348; Fri, 2 Oct 2020 13:57:09 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MURIEL.ad.sei.cmu.edu (147.72.252.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Fri, 2 Oct 2020 13:57:08 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Fri, 2 Oct 2020 13:57:08 -0400 From: Roman Danyliw To: Mohit Sahni , LAMPS WG Thread-Topic: [lamps] I-D Action: draft-ietf-lamps-ocsp-nonce-05.txt Thread-Index: AQHWh52VSMBbnKv0Z0el19UMLhS8B6l3EOAAgA2pIDA= Date: Fri, 2 Oct 2020 17:57:07 +0000 Message-ID: References: <159976138559.5681.14788420431984800275@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.177] Content-Type: multipart/alternative; boundary="_000_d961c7b95c404f3e93513981ab6a56a4certorg_" MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] I-D Action: draft-ietf-lamps-ocsp-nonce-05.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 17:57:17 -0000 --_000_d961c7b95c404f3e93513981ab6a56a4certorg_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTW9oaXQhDQoNClRoYW5rcyBmb3IgY2xvc2luZyB0aGUgbG9vcCBpbiAtMDUgb24gYWxtb3N0 IGFsbCBvZiB0aGUgSUVTRyBDb21tZW50cy4gIEFzIHRoZSByZW1haW5pbmcgaXRlbSwgY2FuIHlv dSBwbGVhc2UgcXVpY2tseSByZXNwb25kIHRvIFJvYuKAmXMgaW5xdWlyeSBvbiB0aGUgcmF0aW9u YWwgYmVoaW5kIHRoZSBub25jZSBzaXplOg0KDQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL3NwYXNtLzJUaDBlWjU3dmhJVk80TlExcnVLQ3hwUlhVUS8NCg0KUmVnYXJkcywN ClJvbWFuDQoNCg0KDQpGcm9tOiBNb2hpdCBTYWhuaSA8bW9oaXQwNmphbkBnbWFpbC5jb20+DQpT ZW50OiBXZWRuZXNkYXksIFNlcHRlbWJlciAyMywgMjAyMCA1OjE1IFBNDQpUbzogTEFNUFMgV0cg PHNwYXNtQGlldGYub3JnPjsgUm9tYW4gRGFueWxpdyA8cmRkQGNlcnQub3JnPg0KU3ViamVjdDog UmU6IFtsYW1wc10gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1LnR4 dA0KDQpIaSBSb21hbiwNCmRyYWZ0LWlldGYtbGFtcHMtb2NzcC1ub25jZSBub3cgaGFzIGVub3Vn aCBCYWxsb3QgcG9zaXRpb25zIHRvIHBhc3MgYW5kIHRoZSBsYXRlc3QgdmVyc2lvbiAoMDUpIHRh a2VzIGNhcmUgb2YgTklUUyBmcm9tICBTRUNESVIgYW5kIEdFTkFSVC4gSXMgdGhlcmUgYW55dGhp bmcgZWxzZSByZXF1aXJlZCBmcm9tIG15IHNpZGUgYXQgdGhpcyBwb2ludD8NCg0KUmVnYXJkcywN Ck1vaGl0DQoNCi0tLS0tLS0tLS0gRm9yd2FyZGVkIG1lc3NhZ2UgLS0tLS0tLS0tDQpGcm9tOiA8 aW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPG1haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc+ Pg0KRGF0ZTogVGh1LCBTZXAgMTAsIDIwMjAgYXQgMTE6MDkgQU0NClN1YmplY3Q6IFtsYW1wc10g SS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1LnR4dA0KVG86IDxpLWQt YW5ub3VuY2VAaWV0Zi5vcmc8bWFpbHRvOmktZC1hbm5vdW5jZUBpZXRmLm9yZz4+DQpDYzogPHNw YXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+DQoNCg0KDQpBIE5ldyBJbnRlcm5l dC1EcmFmdCBpcyBhdmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGly ZWN0b3JpZXMuDQpUaGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBMaW1pdGVkIEFkZGl0 aW9uYWwgTWVjaGFuaXNtcyBmb3IgUEtJWCBhbmQgU01JTUUgV0cgb2YgdGhlIElFVEYuDQoNCiAg ICAgICAgVGl0bGUgICAgICAgICAgIDogT0NTUCBOb25jZSBFeHRlbnNpb24NCiAgICAgICAgQXV0 aG9yICAgICAgICAgIDogTW9oaXQgU2FobmkNCiAgICAgICAgRmlsZW5hbWUgICAgICAgIDogZHJh ZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1LnR4dA0KICAgICAgICBQYWdlcyAgICAgICAgICAg OiA2DQogICAgICAgIERhdGUgICAgICAgICAgICA6IDIwMjAtMDktMTANCg0KQWJzdHJhY3Q6DQog ICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyB0aGUgdXBkYXRlZCBmb3JtYXQgb2YgdGhlIE5vbmNl IGV4dGVuc2lvbiBpbg0KICAgdGhlIE9ubGluZSBDZXJ0aWZpY2F0ZSBTdGF0dXMgUHJvdG9jb2wg KE9DU1ApIHJlcXVlc3QgYW5kIHJlc3BvbnNlDQogICBtZXNzYWdlcy4gIE9DU1AgaXMgdXNlZCB0 byBjaGVjayB0aGUgc3RhdHVzIG9mIGEgY2VydGlmaWNhdGUgYW5kIHRoZQ0KICAgTm9uY2UgZXh0 ZW5zaW9uIGlzIHVzZWQgdG8gY3J5cHRvZ3JhcGhpY2FsbHkgYmluZCBhbiBPQ1NQIHJlc3BvbnNl DQogICBtZXNzYWdlIHRvIGEgcGFydGljdWxhciBPQ1NQIHJlcXVlc3QgbWVzc2FnZS4gIFRoaXMg ZG9jdW1lbnQgdXBkYXRlcw0KICAgUkZDIDY5NjAuDQoNCg0KVGhlIElFVEYgZGF0YXRyYWNrZXIg c3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2RvYy9kcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2UvDQoNClRoZXJlIGFyZSBhbHNvIGh0 bWxpemVkIHZlcnNpb25zIGF2YWlsYWJsZSBhdDoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2UtMDUNCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1DQoNCkEgZGlmZiBm cm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBhdDoNCmh0dHBzOi8vd3d3Lmll dGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2UtMDUNCg0KDQpQ bGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUg dGltZSBvZiBzdWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBh cmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnPGh0dHA6Ly90b29scy5pZXRmLm9yZz4uDQoN CkludGVybmV0LURyYWZ0cyBhcmUgYWxzbyBhdmFpbGFibGUgYnkgYW5vbnltb3VzIEZUUCBhdDoN CmZ0cDovL2Z0cC5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvDQoNCg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClNwYXNtIG1haWxpbmcgbGlzdA0KU3Bh c21AaWV0Zi5vcmc8bWFpbHRvOlNwYXNtQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9zcGFzbQ0K --_000_d961c7b95c404f3e93513981ab6a56a4certorg_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJn aW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBk aXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0 eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9u bHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBp bjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBNb2hpdCE8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzIGZvciBjbG9zaW5nIHRoZSBsb29wIGluIC0wNSBvbiBh bG1vc3QgYWxsIG9mIHRoZSBJRVNHIENvbW1lbnRzLiZuYnNwOyBBcyB0aGUgcmVtYWluaW5nIGl0 ZW0sIGNhbiB5b3UgcGxlYXNlIHF1aWNrbHkgcmVzcG9uZCB0byBSb2LigJlzIGlucXVpcnkgb24g dGhlIHJhdGlvbmFsIGJlaGluZCB0aGUgbm9uY2Ugc2l6ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9zcGFzbS8y VGgwZVo1N3ZoSVZPNE5RMXJ1S0N4cFJYVVEvIj5odHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL3NwYXNtLzJUaDBlWjU3dmhJVk80TlExcnVLQ3hwUlhVUS88L2E+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Sb21hbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gTW9oaXQgU2FobmkgJmx0O21vaGl0MDZqYW5AZ21haWwu Y29tJmd0OyA8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBTZXB0ZW1iZXIgMjMsIDIwMjAg NToxNSBQTTxicj4NCjxiPlRvOjwvYj4gTEFNUFMgV0cgJmx0O3NwYXNtQGlldGYub3JnJmd0Ozsg Um9tYW4gRGFueWxpdyAmbHQ7cmRkQGNlcnQub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBS ZTogW2xhbXBzXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2UtMDUudHh0 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgUm9tYW4s PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ZHJhZnQtaWV0Zi1s YW1wcy1vY3NwLW5vbmNlIG5vdyBoYXMgZW5vdWdoIEJhbGxvdCBwb3NpdGlvbnMgdG8gcGFzcyBh bmQgdGhlIGxhdGVzdCB2ZXJzaW9uICgwNSkgdGFrZXMgY2FyZSBvZiBOSVRTIGZyb20mbmJzcDsg U0VDRElSIGFuZCBHRU5BUlQuIElzIHRoZXJlIGFueXRoaW5nIGVsc2UgcmVxdWlyZWQgZnJvbSBt eSBzaWRlIGF0IHRoaXMgcG9pbnQ/Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Nb2hpdCZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tLS0tLS0tLS0gRm9yd2FyZGVk IG1lc3NhZ2UgLS0tLS0tLS0tPGJyPg0KRnJvbTogJmx0OzxhIGhyZWY9Im1haWx0bzppbnRlcm5l dC1kcmFmdHNAaWV0Zi5vcmciPmludGVybmV0LWRyYWZ0c0BpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0K RGF0ZTogVGh1LCBTZXAgMTAsIDIwMjAgYXQgMTE6MDkgQU08YnI+DQpTdWJqZWN0OiBbbGFtcHNd IEktRCBBY3Rpb246IGRyYWZ0LWlldGYtbGFtcHMtb2NzcC1ub25jZS0wNS50eHQ8YnI+DQpUbzog Jmx0OzxhIGhyZWY9Im1haWx0bzppLWQtYW5ub3VuY2VAaWV0Zi5vcmciPmktZC1hbm5vdW5jZUBp ZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KQ2M6ICZsdDs8YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5v cmciPnNwYXNtQGlldGYub3JnPC9hPiZndDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPGJyPg0KQSBOZXcgSW50ZXJuZXQtRHJhZnQgaXMg YXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVzLjxi cj4NClRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIExpbWl0ZWQgQWRkaXRpb25hbCBN ZWNoYW5pc21zIGZvciBQS0lYIGFuZCBTTUlNRSBXRyBvZiB0aGUgSUVURi48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgVGl0bGUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOzogT0NTUCBOb25jZSBFeHRlbnNpb248YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgQXV0aG9yJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA6 IE1vaGl0IFNhaG5pPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEZpbGVuYW1lJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IDogZHJhZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1 LnR4dDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBQYWdlcyZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7OiA2PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IERhdGUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA6IDIw MjAtMDktMTA8YnI+DQo8YnI+DQpBYnN0cmFjdDo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBkb2N1 bWVudCBzcGVjaWZpZXMgdGhlIHVwZGF0ZWQgZm9ybWF0IG9mIHRoZSBOb25jZSBleHRlbnNpb24g aW48YnI+DQombmJzcDsgJm5ic3A7dGhlIE9ubGluZSBDZXJ0aWZpY2F0ZSBTdGF0dXMgUHJvdG9j b2wgKE9DU1ApIHJlcXVlc3QgYW5kIHJlc3BvbnNlPGJyPg0KJm5ic3A7ICZuYnNwO21lc3NhZ2Vz LiZuYnNwOyBPQ1NQIGlzIHVzZWQgdG8gY2hlY2sgdGhlIHN0YXR1cyBvZiBhIGNlcnRpZmljYXRl IGFuZCB0aGU8YnI+DQombmJzcDsgJm5ic3A7Tm9uY2UgZXh0ZW5zaW9uIGlzIHVzZWQgdG8gY3J5 cHRvZ3JhcGhpY2FsbHkgYmluZCBhbiBPQ1NQIHJlc3BvbnNlPGJyPg0KJm5ic3A7ICZuYnNwO21l c3NhZ2UgdG8gYSBwYXJ0aWN1bGFyIE9DU1AgcmVxdWVzdCBtZXNzYWdlLiZuYnNwOyBUaGlzIGRv Y3VtZW50IHVwZGF0ZXM8YnI+DQombmJzcDsgJm5ic3A7UkZDIDY5NjAuPGJyPg0KPGJyPg0KPGJy Pg0KVGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6PGJy Pg0KPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1s YW1wcy1vY3NwLW5vbmNlLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvZG9jL2RyYWZ0LWlldGYtbGFtcHMtb2NzcC1ub25jZS88L2E+PGJyPg0KPGJyPg0KVGhl cmUgYXJlIGFsc28gaHRtbGl6ZWQgdmVyc2lvbnMgYXZhaWxhYmxlIGF0Ojxicj4NCjxhIGhyZWY9 Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2Ut MDUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0 Zi1sYW1wcy1vY3NwLW5vbmNlLTA1PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1sYW1wcy1vY3NwLW5vbmNlLTA1IiB0YXJn ZXQ9Il9ibGFuayI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1p ZXRmLWxhbXBzLW9jc3Atbm9uY2UtMDU8L2E+PGJyPg0KPGJyPg0KQSBkaWZmIGZyb20gdGhlIHBy ZXZpb3VzIHZlcnNpb24gaXMgYXZhaWxhYmxlIGF0Ojxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3 LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWxhbXBzLW9jc3Atbm9uY2UtMDUiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0 Zi1sYW1wcy1vY3NwLW5vbmNlLTA1PC9hPjxicj4NCjxicj4NCjxicj4NClBsZWFzZSBub3RlIHRo YXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1p c3Npb248YnI+DQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxh YmxlIGF0IDxhIGhyZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPg0K dG9vbHMuaWV0Zi5vcmc8L2E+Ljxicj4NCjxicj4NCkludGVybmV0LURyYWZ0cyBhcmUgYWxzbyBh dmFpbGFibGUgYnkgYW5vbnltb3VzIEZUUCBhdDo8YnI+DQo8YSBocmVmPSJmdHA6Ly9mdHAuaWV0 Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLyIgdGFyZ2V0PSJfYmxhbmsiPmZ0cDovL2Z0cC5pZXRmLm9y Zy9pbnRlcm5ldC1kcmFmdHMvPC9hPjxicj4NCjxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KU3Bhc20gbWFpbGluZyBsaXN0PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOlNwYXNtQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+U3Bhc21A aWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zcGFzbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vc3Bhc208L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_d961c7b95c404f3e93513981ab6a56a4certorg_-- From nobody Fri Oct 2 11:08:17 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBFCA3A1664 for ; Fri, 2 Oct 2020 11:08:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paloaltonetworks.com header.b=PJfEpE6p; dkim=pass (2048-bit key) header.d=paloaltonetworks-com.20150623.gappssmtp.com header.b=HcbjoHSa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OfilG2-eKPL8 for ; Fri, 2 Oct 2020 11:08:14 -0700 (PDT) Received: from mx0b-00169c01.pphosted.com (mx0b-00169c01.pphosted.com [67.231.156.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 686653A165C for ; Fri, 2 Oct 2020 11:08:14 -0700 (PDT) Received: from pps.filterd (m0048189.ppops.net [127.0.0.1]) by mx0b-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 092I5rjM006359 for ; Fri, 2 Oct 2020 11:08:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : references : in-reply-to : from : date : message-id : subject : to : cc : content-type; s=PPS12012017; bh=AnV1diiQMGDcnYG0gWybgQq20/97qncRIkQa/fUd/LQ=; b=PJfEpE6p971ADIHc2UDe9gOmIJSkKZns9IYTH+Mu5S7l0woHDAImN22WByZmTLaC0ZpH D9JENUZLz3wA+OYlUkJFWLSNOGgs2G4g+I1GkrXblPMCTStWiQLgNS6bPJi5ZDeSUGaw GDngZtxt55/mYlSJx3uyp1oW5LwvB6oqR+DaTsrJ1i0YURHxyeRjY8tR6380eEsaqTyK zirzFIaOi4CaqLvf5gKYKTJ3O0aa/BL0bweKcqT+Ijn1ywghGrrqLjXw2AWOtZjZU5at jajHlRsWdX0mf9Hg15cXLmSI+PfXLMNZ7yk45nK5Nwrr3IDI5e3m63orE9YiAf0EDrh1 dQ== Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) by mx0b-00169c01.pphosted.com with ESMTP id 33x96ag08p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Fri, 02 Oct 2020 11:08:13 -0700 Received: by mail-ed1-f72.google.com with SMTP id 63so983417edy.9 for ; Fri, 02 Oct 2020 11:08:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AnV1diiQMGDcnYG0gWybgQq20/97qncRIkQa/fUd/LQ=; b=HcbjoHSaTe1Xi5aScKXMBppv304GHa0NoHo2zRKNk9PDFRzdnAYCRlXY8ZcJVuoSj1 VYkqjNfzB9kyzHK8CQBxISnBvdCKmNS9diCGrsrksJIzMI1GIYgUShaIxlgbSYyu+AZn OSftLGZIfkowIeK8RRZpLLlDyT1U6m4+IT6JbinDiG3RSw087/waT+pi+L1OdsTOcFn9 OkVhXBr1N/qy8ABRTCCnefxavHy3Zw1m6uXM7n79Mh8R4pO6i0xXWK0/Ukisu97gm9S1 WRMNev9oFX2n2TpUnNJDqKo450YTQ8a3/5uX9OCyJkV+iGswnZgarePS9Ja3b1TiUkwF eeiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AnV1diiQMGDcnYG0gWybgQq20/97qncRIkQa/fUd/LQ=; b=NUU32X81dLZZV2U7gW35b+qERifvSU0nszFSVqXCIOY+YTfxuLF7ASDu8z+D9unRyr 9UB7hwqbW6khihejeEIA/oHSb2V9iHKdoYvHrA+5LnM93/5M3jkP9tUNoF/gNRexZddO zi0opb4X6TY8fc4HUzLhcsTBtoPsCb+LZsXGQ/u7ePOqnGFRcftxyEpNM805+X4DODMA G/tY9qL3Mt+Fn8g17XBZydT1vrtr41pbktTL58fkAkQXC1vLffaBH1eZn98yKC9PukY1 t6qp85Nxep71c7A7izZNV9x36I2LQw2CmTttIYW33r8V+dKlpQ1AnR1umjHxclzFtnol Lzdg== X-Gm-Message-State: AOAM530NLLxhCaDOBnBhmHxVw0dzIrEf6wYJ/BLqjzhacrOpQtDIqKlY kcxgG7l1UgPy+20pyfX9W/d00Y2gLHjFuDIZg/34fejNL1gu8Au9T84K9AiyUC8PyNn2oEwouTN nV5IdNsb6uxmMAihSsdA3bA== X-Received: by 2002:aa7:da89:: with SMTP id q9mr3700226eds.111.1601662092084; Fri, 02 Oct 2020 11:08:12 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxd1HYw7vSPfbisuIQykZQkStwrEaUU2pEWEyQz7JbjtIxJw1tvMdt5wlCv+w8yjtRXyPZpAMfBRSnO/1AidQk= X-Received: by 2002:aa7:da89:: with SMTP id q9mr3700201eds.111.1601662091826; Fri, 02 Oct 2020 11:08:11 -0700 (PDT) MIME-Version: 1.0 References: <19A4DED1-8D98-4294-A8CB-6A31E15706D0@akamai.com> In-Reply-To: <19A4DED1-8D98-4294-A8CB-6A31E15706D0@akamai.com> From: Mohit Sahni Date: Fri, 2 Oct 2020 11:08:00 -0700 Message-ID: To: "Salz, Rich" Cc: "Rob Wilton (rwilton)" , Russ Housley , The IESG , LAMPS WG , Roman Danyliw Content-Type: multipart/alternative; boundary="00000000000008b15805b0b4042f" X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-10-02_11:2020-10-02, 2020-10-02 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxlogscore=696 spamscore=0 priorityscore=1501 malwarescore=0 lowpriorityscore=0 suspectscore=1 adultscore=0 bulkscore=0 clxscore=1011 mlxscore=0 impostorscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010020131 Archived-At: Subject: Re: [lamps] Robert Wilton's No Objection on draft-ietf-lamps-ocsp-nonce-04: (with COMMENT) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 18:08:16 -0000 --00000000000008b15805b0b4042f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Adding LAMPS WG mailer list. On Tue, Sep 8, 2020 at 4:36 AM Salz, Rich wrote: > As Mohit said, it=E2=80=99s more of a freshness guarantee that the respon= se that > came back is replying to the query. It doesn=E2=80=99t have to be global= ly unique; > it has to be unique for a specific responder, for the time period covered > by the validity of the response. > > > > As for the term nonce, wow. There=E2=80=99s already work in gendispatch = to look > at possibly problematic words, and I hope that this small RFC update > doesn=E2=80=99t have to wait for that work to be done. > --00000000000008b15805b0b4042f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Adding LAMPS WG mailer list.=C2=A0
<= br>
On Tue,= Sep 8, 2020 at 4:36 AM Salz, Rich <= rsalz@akamai.com> wrote:

As Mohit said, it=E2=80=99s more of a freshness guar= antee that the response that came back is replying to the query.=C2=A0 It d= oesn=E2=80=99t have to be globally unique; it has to be unique for a specif= ic responder, for the time period covered by the validity of the response.

=C2=A0

As for the term nonce, wow.=C2=A0 There=E2=80=99s al= ready work in gendispatch to look at possibly problematic words, and I hope= that this small RFC update doesn=E2=80=99t have to wait for that work to b= e done.

--00000000000008b15805b0b4042f-- From nobody Fri Oct 2 11:43:31 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCF543A1698 for ; Fri, 2 Oct 2020 11:43:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OcHLk8YbzXnO for ; Fri, 2 Oct 2020 11:43:28 -0700 (PDT) Received: from mail-ot1-x333.google.com (mail-ot1-x333.google.com [IPv6:2607:f8b0:4864:20::333]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BC063A1693 for ; Fri, 2 Oct 2020 11:43:28 -0700 (PDT) Received: by mail-ot1-x333.google.com with SMTP id n61so2311037ota.10 for ; Fri, 02 Oct 2020 11:43:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=ZMUJxe+x76gWEknfkRt4nmWqQT7/dbAEmnAEFnxQNBo=; b=tPtrBkQ9Aw0BUEjqIH1bw0xmLkOfYh8RFidY5n2ZJejs+CTe01o5ey6uuJW1kA9UWX xPI8rY8/K00LEY2LtelEI7d1+qhG4xdQ4NEKXPdA32PtoKl7SOhyMVthMSNK0K2Q3onn 3fVtu6FJjPwWxehmHZm9FWsNNzrpIfQzxEhlV3CKv0e5GxflPng62vm36NlXcLam4h51 +bxtAoZXRgaX0qBmvNytpWorsm9N4/IJHzyoPf+ekBZJaga1+v98T6eQ9vX7oBx1QNhO kvCI7jSyobkFEhOh70jLRfTPXEk/Mxt86Pmi+sj5LcrtEdWx/t2gQuKDiwC0xF7PdI/2 NONw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=ZMUJxe+x76gWEknfkRt4nmWqQT7/dbAEmnAEFnxQNBo=; b=LD6k60gNoqe8VTBxvxoQwHdLtIBrcQng9no2GB+OHPmeeSqUq1LuaFLYwnw5u8KjLl d6mX5V24crADalGG7mKk+qZTgDBMlKAT+ZRJc/WAM3ddR/Ih6LTunC4JsI4n04OcT+Lv bHDLtROCQKVarFKIN2mvUpfkObDJVFwGdBFZHl6UshrUMKNhRBwSaqk8T1ysKb9h6q6g cZPXXbWy1XtoUJadVUE/TctcublE6tCVtbxy2m3NIYcEjQSDWUq1uHCeFcgDIqMIXdMn b20rvxYxlrXJPyZqaFG9zNF9VPyTHFtQyGOnZBq/WHHk8NzUD/DAcCegW4r8rLHsziK2 eDaw== X-Gm-Message-State: AOAM531Og/npppgp0O62NC1PR//YhODTWHuV3Vhc8XVIjahSMBi2Gg+R SgS0UZH3qB1gl4YlrF1FmKWM1tGfpOc83kZBeaetmWfRIuo= X-Google-Smtp-Source: ABdhPJw9tqGbXqWvbRyFN63X6Jb0QIvmkg3yV2So8UpOUPBD1T73kAFT5F1ZO0XMqdZhxQD+BZEXvMzpvK1TMCf25ds= X-Received: by 2002:a9d:4b18:: with SMTP id q24mr2603736otf.265.1601664207512; Fri, 02 Oct 2020 11:43:27 -0700 (PDT) MIME-Version: 1.0 References: <6874A1B2-AD64-413B-ABEF-765F1231657A@vigilsec.com> In-Reply-To: <6874A1B2-AD64-413B-ABEF-765F1231657A@vigilsec.com> From: Jonathan Hammell Date: Fri, 2 Oct 2020 14:43:16 -0400 Message-ID: To: Russ Housley Cc: Bernie Hoeneisen , IETF LAMPS WG Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [lamps] HP Issue - Obfuscation of Header Fields X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 18:43:30 -0000 I agree with only obfuscating the Subject and only when Encryption is applied. I also agree with Russ that it should be optional (at the sender's discretion) since it does make managing email more difficult. I prefer "[...]" versus "...". I support recommending that a new Message-ID is generated if Subject obfuscation is used. However, I am curious if any MUAs use the subject in support of message threading, resulting in unrelated messages displayed as related. From a simple test, Gmail does not; but I believe that the IETF MailArchive might (likely in combination with matching other HFs) because I have sent message list replies as a new message with a Subject and Body extracted from the daily digest and the tool surprisingly threaded it to the original message correctly. (A great bit of engineering work there!) Jonathan On Wed, Sep 30, 2020 at 5:22 PM Russ Housley wrote: > > The thing I recall is that we only want to obfuscate the Subject. I reca= ll someone suggested "Encrypted Message". Also, the obfuscation should be = at the senders discretion. > > Russ > > > > On Sep 30, 2020, at 4:17 PM, Bernie Hoeneisen wrote: > > > > Below a summary of the issue on 'Obfuscation of Header Fields'. If anyb= ody wishes to discuss this topic further or does not agree with the conclus= ion, please speek up within the next 10 days! > > > > cheers, > > Bernie > > > > > > Text from slide: > > - Should we recommend any specific format for obfuscation? > > e.g. > > - Subject: ... > > - Subject: [...] > > - Date: Thu, 01 Jan 1970 00:00:00 +0000 (UTC) > > - Impact to certificate checking? > > - Date: > > - Message-ID: > > - From: Obfuscated > > - To: Obfuscated > > > > - Impact to Spam filtering? > > > > > > Conclusion at IETF-108 (as I understood): > > > > - Only specify obfuscation if encryption is applied > > - Only recommend obfuscation for the Subject HF, but not for > > Date HF, From HF, To HF > > > > We did not discuss about whether or not to recommend a new Message-ID f= or the Outer Message, as the Message-ID often leaves a trace to the origina= tor host. Unless there are strong reasons not to do so, I'd be in favour of= recommending a new randomly generated Messsage-ID. Any opinions on this? > > > > _______________________________________________ > > Spasm mailing list > > Spasm@ietf.org > > https://www.ietf.org/mailman/listinfo/spasm > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Fri Oct 2 17:34:51 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA49F3A1763 for ; Fri, 2 Oct 2020 17:34:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paloaltonetworks.com header.b=XCGQH8DV; dkim=pass (2048-bit key) header.d=paloaltonetworks-com.20150623.gappssmtp.com header.b=FQmoJebe Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lp0wmPtOLjpC for ; Fri, 2 Oct 2020 17:34:46 -0700 (PDT) Received: from mx0b-00169c01.pphosted.com (mx0a-00169c01.pphosted.com [67.231.148.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A52FB3A175E for ; Fri, 2 Oct 2020 17:34:46 -0700 (PDT) Received: from pps.filterd (m0045114.ppops.net [127.0.0.1]) by mx0a-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0930YkeY030796 for ; Fri, 2 Oct 2020 17:34:46 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : references : in-reply-to : from : date : message-id : subject : to : cc : content-type; s=PPS12012017; bh=xNyWiyDJA9vVZnsCSbcLnkScbtQ+Zeh/4sSPLXsKv8M=; b=XCGQH8DV8hMvhRmpWDg86dMEs0a4qLk9jZPJOBTPPNQXqEGAOdPriQBysIBuiYmFK88M pWHVAq9YIbnn432YhkhCqmeAJ50vWkoXuPaoOuPU/Uyl2AN+SzjFOxN4h3pi/f95FpbD NscVBI1rNOGCFyB8VXOk9udSsCuoDYLKkBXzQCh0yGgkyw77Lt4dZI5tNgixsAM24uk8 lVs+UTfEylcMtw5WBp7k7ljvEv2ppxBv3DKMq3fFKdfHmdxnMdvpuLJXhOdMRfOyRo5D uEBaYQldbhOz6L2lQtgNx4IWmVFDukzlTpegNacxD6fArz7AQhL0/2RqbLlRyNVGA14B Fw== Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) by mx0a-00169c01.pphosted.com with ESMTP id 33x99as3qv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Fri, 02 Oct 2020 17:34:46 -0700 Received: by mail-ed1-f71.google.com with SMTP id g16so1495945edy.22 for ; Fri, 02 Oct 2020 17:34:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xNyWiyDJA9vVZnsCSbcLnkScbtQ+Zeh/4sSPLXsKv8M=; b=FQmoJebe+cUBp0eJQWFN5SWha+U83SE61V31HQiaCeLWdYWOT+gJJhJLZ5aZrEOe7V cXFYu5EDpYsGyrbgpHjR6em2TqnxHjunP7I15K0dFZzWBHjgWEiDESG4zPLfSCv5k57Z r4/jiJJlj0en/rJ5VkFmy2O3j55cj3H/aZHVNeJHuWiGn4Hy/vAfXy48lYDziicCHS+/ lU06f8xKqY3tbMbJjeaPNEWxHqdy7ALACYBS9GB2Tzv3K2XVlSB2Ge12VxfhS6I4L2Kr VGLYgDtYFJAWm9Duo1EYbJC/RGoMJ+NO1b/glOEGEfHNQHXpv9Ns4RDCBf3CWHz43OoE rSkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xNyWiyDJA9vVZnsCSbcLnkScbtQ+Zeh/4sSPLXsKv8M=; b=ovA57aba9NWrHgPrSDjNhx56qbFXrUXyeYg+qL39upx+JcUIJ5NisEEYUlT+KtDOFu DqUV615ogQ03UEeA7ALNnvgGUmKk0pbuNlLsGe+OxuRer48sB2iYwRcdt5IdS4S7eaGl 4QKl7rKRirjSY+9mdwXVntc4WxrpZbe7BtewNCAADej+5GNYZeWeIhkKKAAamVymuDnw AW72g1+XR2dOWBh8JmC67ITX/NdBBni4PCCo64l4WrjGLy/pmlkw+ALhUR55oIvbz8Ge +n3u6n6fKRNnPai/fnYjmpiR0lgWDzYOTkWeHP4PtZOYcjxfptzHd2Y88FKKzU4clAn6 eFtw== X-Gm-Message-State: AOAM530TlY5oe53RlqcZtqZfKz0jHqU8uQ6anSyGzdlsznOxFp9ozsuH ZY5yfQ/GKV854RJ+/a5/hBHhfYin+T/moCa/D11ofFJfnd7SfxORpzqpqCIytPTguGEmEywY6Ld Y77MrAoTXCGa6CSyGbt3BeQ== X-Received: by 2002:aa7:df14:: with SMTP id c20mr5539389edy.334.1601685284370; Fri, 02 Oct 2020 17:34:44 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyQlvuSy9tglRX9/MX92eSVR4HZxCyIp6B5gQSSg4TNC1P0ep0IW2cv2hU+Vck6lRPYnPa0Uh2T/6D1nkhWgx4= X-Received: by 2002:aa7:df14:: with SMTP id c20mr5539374edy.334.1601685284075; Fri, 02 Oct 2020 17:34:44 -0700 (PDT) MIME-Version: 1.0 References: <19A4DED1-8D98-4294-A8CB-6A31E15706D0@akamai.com> In-Reply-To: From: Mohit Sahni Date: Fri, 2 Oct 2020 17:34:33 -0700 Message-ID: To: "Salz, Rich" Cc: "Rob Wilton (rwilton)" , Russ Housley , The IESG , LAMPS WG , Roman Danyliw Content-Type: multipart/alternative; boundary="000000000000664faa05b0b96ab9" X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-10-02_14:2020-10-02, 2020-10-02 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 suspectscore=1 mlxlogscore=665 phishscore=0 impostorscore=0 mlxscore=0 adultscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 malwarescore=0 spamscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2010030004 Archived-At: Subject: Re: [lamps] Robert Wilton's No Objection on draft-ietf-lamps-ocsp-nonce-04: (with COMMENT) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2020 00:34:50 -0000 --000000000000664faa05b0b96ab9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Rob, Apologies for the delay in responding to your email, I just realized that I have not addressed your comment completely. We choose a 32 byte long random number as it is a common practice to use a 16 to 32 byte long random number in many widely used protocols for the same purpose. One such example is the client random and server random fields in the TLS handshake. I hope I addressed your concerns about why we choose a 32 byte value for Nonce. Thanks Mohit On Fri, Oct 2, 2020 at 11:08 AM Mohit Sahni wrote: > Adding LAMPS WG mailer list. > > On Tue, Sep 8, 2020 at 4:36 AM Salz, Rich wrote: > >> As Mohit said, it=E2=80=99s more of a freshness guarantee that the respo= nse that >> came back is replying to the query. It doesn=E2=80=99t have to be globa= lly unique; >> it has to be unique for a specific responder, for the time period covere= d >> by the validity of the response. >> >> >> >> As for the term nonce, wow. There=E2=80=99s already work in gendispatch= to look >> at possibly problematic words, and I hope that this small RFC update >> doesn=E2=80=99t have to wait for that work to be done. >> > --000000000000664faa05b0b96ab9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Rob,
Apologies for the delay in responding to your = email, I just realized that I have not addressed your comment completely. W= e choose a 32 byte long random number as it is a common practice to use a 1= 6 to 32 byte long random number in many widely used=C2=A0protocols=C2=A0for= the same purpose. One such example is the client random and server random = fields in the TLS handshake. I hope I addressed your concerns about why we = choose a 32 byte value for Nonce.=C2=A0

Thanks
Mohit=C2=A0

=C2=A0

On Fri, Oct 2, 2020= at 11:08 AM Mohit Sahni <msahni@paloaltonetworks.com> wrote:
Adding LAMPS = WG mailer list.=C2=A0

On Tue, Sep 8, 2020 at 4:36 AM Salz, Rich <rsalz@akamai.com> wro= te:

As Mohit said, it=E2=80=99s more of a freshness guar= antee that the response that came back is replying to the query.=C2=A0 It d= oesn=E2=80=99t have to be globally unique; it has to be unique for a specif= ic responder, for the time period covered by the validity of the response.

=C2=A0

As for the term nonce, wow.=C2=A0 There=E2=80=99s al= ready work in gendispatch to look at possibly problematic words, and I hope= that this small RFC update doesn=E2=80=99t have to wait for that work to b= e done.

--000000000000664faa05b0b96ab9-- From nobody Mon Oct 5 07:30:43 2020 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E978B3A086B; Mon, 5 Oct 2020 07:30:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 7.19.0 Auto-Submitted: auto-generated Precedence: bulk Cc: rdd@cert.org, lamps-chairs@ietf.org, draft-ietf-lamps-ocsp-nonce@ietf.org, rfc-editor@rfc-editor.org, Russ Housley , housley@vigilsec.com, The IESG , spasm@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <160190823394.26573.7297835233708675721@ietfa.amsl.com> Date: Mon, 05 Oct 2020 07:30:33 -0700 Archived-At: Subject: [lamps] Protocol Action: 'OCSP Nonce Extension' to Proposed Standard (draft-ietf-lamps-ocsp-nonce-05.txt) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Oct 2020 14:30:34 -0000 The IESG has approved the following document: - 'OCSP Nonce Extension' (draft-ietf-lamps-ocsp-nonce-05.txt) as Proposed Standard This document is the product of the Limited Additional Mechanisms for PKIX and SMIME Working Group. The IESG contact persons are Benjamin Kaduk and Roman Danyliw. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-ocsp-nonce/ Technical Summary This document updates RFC 6960 to specify a maximum size for a nonce in the Online Certificate Status Protocol (OCSP), The nonce is used in the OCSP request and response messages to detect replay attacks. Working Group Summary There is consensus for this document in the LAMPS WG to provide this clarity. Document Quality OCSP has wide deployment and support. Personnel Russ Housley is the document shepherd. Roman Danyliw is the responsible area director. From nobody Thu Oct 8 05:40:43 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B4E93A0DD8 for ; Thu, 8 Oct 2020 05:40:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ka7SCdoyr1HZ for ; Thu, 8 Oct 2020 05:40:40 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 312513A0DD7 for ; Thu, 8 Oct 2020 05:40:39 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id DEF9BF40714; Thu, 8 Oct 2020 05:40:26 -0700 (PDT) To: housley@vigilsec.com, rdd@cert.org, kaduk@mit.edu, housley@vigilsec.com, tim.hollebeek@digicert.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: mohsin.gujjar0429@gmail.com, spasm@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20201008124026.DEF9BF40714@rfc-editor.org> Date: Thu, 8 Oct 2020 05:40:26 -0700 (PDT) Archived-At: Subject: [lamps] [Technical Errata Reported] RFC8649 (6304) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2020 12:40:41 -0000 The following errata report has been submitted for RFC8649, "Hash Of Root Key Certificate Extension". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid6304 -------------------------------------- Type: Technical Reported by: Mohsin Section: Global Original Text ------------- Can't allow to open the page help me in removing this person and block her and deleete her data Corrected Text -------------- Notes ----- Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8649 (draft-ietf-lamps-hash-of-root-key-cert-extn-07) -------------------------------------- Title : Hash Of Root Key Certificate Extension Publication Date : August 2019 Author(s) : R. Housley Category : INFORMATIONAL Source : Limited Additional Mechanisms for PKIX and SMIME Area : Security Stream : IETF Verifying Party : IESG From nobody Thu Oct 8 07:05:32 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F03D03A099E for ; Thu, 8 Oct 2020 07:05:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id get5XfwDJ_P5 for ; Thu, 8 Oct 2020 07:05:28 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5D263A09E0 for ; Thu, 8 Oct 2020 07:05:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id A6A6C300BA3 for ; Thu, 8 Oct 2020 10:05:25 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id FrcLRcfdEblf for ; Thu, 8 Oct 2020 10:05:23 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id B5698300AA4; Thu, 8 Oct 2020 10:05:22 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: <20201008124026.DEF9BF40714@rfc-editor.org> Date: Thu, 8 Oct 2020 10:05:24 -0400 Cc: "Roman D. Danyliw" , Ben Kaduk , Tim Hollebeek , IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: <3AF5AFB7-C033-4CB5-94DB-DB7EC22F176F@vigilsec.com> References: <20201008124026.DEF9BF40714@rfc-editor.org> To: RFC Editor X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] [Technical Errata Reported] RFC8649 (6304) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2020 14:05:31 -0000 This looks like noise to me. Please delete. Russ > On Oct 8, 2020, at 8:40 AM, RFC Errata System = wrote: >=20 > The following errata report has been submitted for RFC8649, > "Hash Of Root Key Certificate Extension". >=20 > -------------------------------------- > You may review the report below and at: > https://www.rfc-editor.org/errata/eid6304 >=20 > -------------------------------------- > Type: Technical > Reported by: Mohsin >=20 > Section: Global >=20 > Original Text > ------------- > Can't allow to open the page help me in removing this person and block = her and deleete her data =20 >=20 > Corrected Text > -------------- >=20 >=20 > Notes > ----- >=20 >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8649 (draft-ietf-lamps-hash-of-root-key-cert-extn-07) > -------------------------------------- > Title : Hash Of Root Key Certificate Extension > Publication Date : August 2019 > Author(s) : R. Housley > Category : INFORMATIONAL > Source : Limited Additional Mechanisms for PKIX and SMIME > Area : Security > Stream : IETF > Verifying Party : IESG >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Fri Oct 9 15:28:27 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03AE63A1569; Fri, 9 Oct 2020 15:28:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yS0WRN316Km6; Fri, 9 Oct 2020 15:28:23 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 896853A0EDB; Fri, 9 Oct 2020 15:28:23 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 659F8F406D5; Fri, 9 Oct 2020 15:28:09 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, spasm@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20201009222809.659F8F406D5@rfc-editor.org> Date: Fri, 9 Oct 2020 15:28:09 -0700 (PDT) Archived-At: Subject: [lamps] =?utf-8?q?RFC_8933_on_Update_to_the_Cryptographic_Messag?= =?utf-8?q?e_Syntax_=28CMS=29_for_Algorithm_Identifier_Protection?= X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2020 22:28:25 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8933 Title: Update to the Cryptographic Message Syntax (CMS) for Algorithm Identifier Protection Author: R. Housley Status: Standards Track Stream: IETF Date: October 2020 Mailbox: housley@vigilsec.com Pages: 8 Updates: RFC 5652 I-D Tag: draft-ietf-lamps-cms-update-alg-id-protect-05.txt URL: https://www.rfc-editor.org/info/rfc8933 DOI: 10.17487/RFC8933 This document updates the Cryptographic Message Syntax (CMS) specified in RFC 5652 to ensure that algorithm identifiers in signed-data and authenticated-data content types are adequately protected. This document is a product of the Limited Additional Mechanisms for PKIX and SMIME Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Tue Oct 13 15:25:43 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A3113A11C2 for ; Tue, 13 Oct 2020 15:25:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJ3ph9ALyreV for ; Tue, 13 Oct 2020 15:25:40 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66E213A11C3 for ; Tue, 13 Oct 2020 15:25:40 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kSSjh-0008vv-Ai for spasm@ietf.org; Wed, 14 Oct 2020 00:25:37 +0200 Date: Wed, 14 Oct 2020 00:25:37 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG In-Reply-To: <6874A1B2-AD64-413B-ABEF-765F1231657A@vigilsec.com> Message-ID: References: <6874A1B2-AD64-413B-ABEF-765F1231657A@vigilsec.com> User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [lamps] HP Issue - Obfuscation of Header Fields X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2020 22:25:42 -0000 The latest (not yet published) version regarding Obfuscation reads as follows: For further Data Minimization, the value of the Subject Header Field SHOULD be obfuscated as follows: ~~ * Subject: [...] ~~ and it is RECOMMENDED to replace the Message-ID by a new randomly generated Message-ID. In addition, the value of other Essential Header Fields MAY be obfuscated. Also further (non-Essential) Header Fields MAY be obfuscated, though simply not adding those to the Outer Message Header Section SHOULD be preferred over obfuscation. Header Fields not obfuscated should contain the same values as in the Original Message. Any objections or suggestions to change this text? cheers Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology On Wed, 30 Sep 2020, Russ Housley wrote: > The thing I recall is that we only want to obfuscate the Subject. I recall someone suggested "Encrypted Message". Also, the obfuscation should be at the senders discretion. > > Russ > > >> On Sep 30, 2020, at 4:17 PM, Bernie Hoeneisen wrote: >> >> Below a summary of the issue on 'Obfuscation of Header Fields'. If anybody wishes to discuss this topic further or does not agree with the conclusion, please speek up within the next 10 days! >> >> cheers, >> Bernie >> >> >> Text from slide: >> - Should we recommend any specific format for obfuscation? >> e.g. >> - Subject: ... >> - Subject: [...] >> - Date: Thu, 01 Jan 1970 00:00:00 +0000 (UTC) >> - Impact to certificate checking? >> - Date: >> - Message-ID: >> - From: Obfuscated >> - To: Obfuscated >> >> - Impact to Spam filtering? >> >> >> Conclusion at IETF-108 (as I understood): >> >> - Only specify obfuscation if encryption is applied >> - Only recommend obfuscation for the Subject HF, but not for >> Date HF, From HF, To HF >> >> We did not discuss about whether or not to recommend a new Message-ID for the Outer Message, as the Message-ID often leaves a trace to the originator host. Unless there are strong reasons not to do so, I'd be in favour of recommending a new randomly generated Messsage-ID. Any opinions on this? >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > From nobody Tue Oct 13 15:29:59 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02EC13A11D3 for ; Tue, 13 Oct 2020 15:29:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T9qUEejWH5u7 for ; Tue, 13 Oct 2020 15:29:56 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B1053A11CF for ; Tue, 13 Oct 2020 15:29:55 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kSSnq-0008xx-0e for spasm@ietf.org; Wed, 14 Oct 2020 00:29:54 +0200 Date: Wed, 14 Oct 2020 00:29:53 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG In-Reply-To: <02DC7D2F-FEA8-46C9-9A1D-EB8E0CA6A3BA@vigilsec.com> Message-ID: References: <02DC7D2F-FEA8-46C9-9A1D-EB8E0CA6A3BA@vigilsec.com> User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [lamps] HP Issue: Protection Levels X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2020 22:29:58 -0000 The latest (not yet published) section regarding protection levels reads as follows: 3.2. Protection Levels 3.2.1. In-Scope The following Protection Levels are in scope for this document: a) Signature and encryption Messages containing a cryptographic signature, which are also encrypted. b) Signature only Messages containing a cryptographic signature, but which are not encrypted. 3.2.2. Out-of-Scope Legacy implementations, implementations not (fully) compliant with this document or corner-cases may lead to further Protection Levels to pop up at the receiving side, such as (list not exhaustive): * Triple wrap * Encryption only * Encryption before signature * Signature and encryption, but: - Signature fails to validate - Signature validates but the signing certificate revoked * Signature only, but: - with multiple valid signatures, layered atop each other? These Protection Levels as well as any further Protection Levels not listed in Section 3.2.1 are beyond the scope of this document. Any objections or suggestions to improve the text? cheers Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology On Wed, 30 Sep 2020, Russ Housley wrote: > This matches my memory of the discussion. > > Russ > > >> On Sep 30, 2020, at 4:04 PM, Bernie Hoeneisen wrote: >> >> Below a summary of the issue on 'Protection Levels'. If anybody wishes to discuss this topic further or does not agree with the conclusion, please speek up within the next 10 days! >> >> cheers, >> Bernie >> >> >> Text from slide: >> >> - Specification is targeted for >> - Signature and encryption >> - Signature only >> >> - Variations / corner-cases may pop up at receiving side, e.g. >> - Encryption only >> - Encryption before signature >> - Signature and encryption, but >> - Signature fails to validate >> - Signature validates but the signing certificate revoked >> - Signature only, but >> - with multiple valid signatures, layered atop each other? >> >> - Which of those and to what extent do we need to document those? >> >> >> Conclusion at IETF-108 (as I understood): >> >> - For the time being only specify cases (for sending and receiving side): >> - Signature and encryption >> - Signature only >> >> - Decide lateron whether or not to include more guiance on how to deal >> with (some of the) other cases on the receiving side. >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm > > From nobody Tue Oct 13 16:23:48 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C97DB3A1222 for ; Tue, 13 Oct 2020 16:23:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u5m2QzLPfskv for ; Tue, 13 Oct 2020 16:23:46 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4751E3A121D for ; Tue, 13 Oct 2020 16:23:45 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kSTdv-00096F-Hg for spasm@ietf.org; Wed, 14 Oct 2020 01:23:43 +0200 Date: Wed, 14 Oct 2020 01:23:43 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG Message-ID: User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: [lamps] HP Issue - What to display to the user? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2020 23:23:48 -0000 Below a summary of the issue on 'What to display to the User?'. This certainly needs more discussion cheers, Bernie Text from slide: 1) The Receiving User Facing Message (RUFM) is the same as the Inner Message Any other variants to consider? 2) As a consequence, the RUFM contains no information on the Outer Message HS Preserving Outer Message HS might be useful, e.g. for - Debugging (Trace HFs) - Detecting attacks (HFs different) Do we need to standardize a means to provide the Outer Message HS to the user? Conclusion at IETF-108 (as I understood): - The Message to be displayed to the user shall be the Inner Message - There needs to be more meta-information displayed to the user, - We need to describe what the MUA must display to the user, but no details of the (graphical) representation Open questions: - What exactely is this additional (meta-)information to be displayed to the user? https://tools.ietf.org/html/draft-marques-pep-rating-03#section-2.1 may serve as a basis for this. - Do we need to standardize a means to provide the Outer Message HS to the user? I don't think so. From nobody Wed Oct 14 07:29:35 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC7543A0E91 for ; Wed, 14 Oct 2020 07:29:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WoCDDy0PPuxj for ; Wed, 14 Oct 2020 07:29:26 -0700 (PDT) Received: from mail.amsl.com (c8a.amsl.com [4.31.198.40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C421A3A0E90 for ; Wed, 14 Oct 2020 07:29:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by c8a.amsl.com (Postfix) with ESMTP id 0B9BB3C03D7; Wed, 14 Oct 2020 07:29:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from c8a.amsl.com ([127.0.0.1]) by localhost (c8a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hMZUHVBQeSNa; Wed, 14 Oct 2020 07:29:20 -0700 (PDT) Received: from [192.168.68.111] (pool-173-48-33-241.bstnma.fios.verizon.net [173.48.33.241]) by c8a.amsl.com (Postfix) with ESMTPA id 5A1863C03CA; Wed, 14 Oct 2020 07:29:20 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Megan Ferguson In-Reply-To: <20201008124026.DEF9BF40714@rfc-editor.org> Date: Wed, 14 Oct 2020 10:29:19 -0400 Cc: Russ Housley , "Roman D. Danyliw" , kaduk@mit.edu, Tim Hollebeek , spasm@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20201008124026.DEF9BF40714@rfc-editor.org> To: RFC System X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: Re: [lamps] [Technical Errata Reported] RFC8649 (6304) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2020 14:29:34 -0000 Greetings, FYI - This report has been deleted as junk. Thank you. RFC Editor/mf On Oct 8, 2020, at 8:40 AM, RFC Errata System = wrote: > The following errata report has been submitted for RFC8649, > "Hash Of Root Key Certificate Extension". >=20 > -------------------------------------- > You may review the report below and at: > https://www.rfc-editor.org/errata/eid6304 >=20 > -------------------------------------- > Type: Technical > Reported by: Mohsin >=20 > Section: Global >=20 > Original Text > ------------- > Can't allow to open the page help me in removing this person and block = her and deleete her data =20 >=20 > Corrected Text > -------------- >=20 >=20 > Notes > ----- >=20 >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8649 (draft-ietf-lamps-hash-of-root-key-cert-extn-07) > -------------------------------------- > Title : Hash Of Root Key Certificate Extension > Publication Date : August 2019 > Author(s) : R. Housley > Category : INFORMATIONAL > Source : Limited Additional Mechanisms for PKIX and SMIME > Area : Security > Stream : IETF > Verifying Party : IESG >=20 From nobody Mon Oct 19 19:58:08 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B879C3A1030 for ; Mon, 19 Oct 2020 19:58:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GyLE0hT9dQoz for ; Mon, 19 Oct 2020 19:58:04 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D89DB3A102E for ; Mon, 19 Oct 2020 19:58:04 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 0981AF40737; Mon, 19 Oct 2020 19:58:02 -0700 (PDT) To: housley@vigilsec.com, rdd@cert.org, kaduk@mit.edu, housley@vigilsec.com, tim.hollebeek@digicert.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: arvinfernandez372@gmail.com, spasm@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20201020025802.0981AF40737@rfc-editor.org> Date: Mon, 19 Oct 2020 19:58:02 -0700 (PDT) Archived-At: Subject: [lamps] [Editorial Errata Reported] RFC8649 (6311) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Oct 2020 02:58:07 -0000 The following errata report has been submitted for RFC8649, "Hash Of Root Key Certificate Extension". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid6311 -------------------------------------- Type: Editorial Reported by: Arvin Fernandez Section: 16196369644 Original Text ------------- Arvin Corrected Text -------------- Fernandez Notes ----- Help! Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8649 (draft-ietf-lamps-hash-of-root-key-cert-extn-07) -------------------------------------- Title : Hash Of Root Key Certificate Extension Publication Date : August 2019 Author(s) : R. Housley Category : INFORMATIONAL Source : Limited Additional Mechanisms for PKIX and SMIME Area : Security Stream : IETF Verifying Party : IESG From nobody Fri Oct 23 09:12:26 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12EA03A102F for ; Fri, 23 Oct 2020 09:12:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WpJ8o0VBxFmt for ; Fri, 23 Oct 2020 09:12:17 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80057.outbound.protection.outlook.com [40.107.8.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F4543A1002 for ; Fri, 23 Oct 2020 09:12:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lRh2YAA1V88xlkvTrJQOTUUjyZrpiNaI4CNX2pr9x8FzsNvlfvtspz8dDmgLSbI8zWWUMDIEYJR9yfGELePyLROiQw5rCZpMlCqEQmrPiQspLBXF3ov8zyg67qvWgHeSK6IJK7/Ey9nQzq410nu9z+AeR1fSL743UGjqBiZepTVj5WVg2VgUXTEGCdYGk5oOeYfSWcHtBXLuSao1tPwSGvAGQ/R+Ch6URRGG+vhBvomAujiWMhqdaD0ki3ftJBhdlr1j0uYHIPJIWq2WwNnq8pjF5SmYKIwZXLM/lXhBL/K9SK4Cs47YyBZtpS8Kyg6vPu8XyFA54qO1z9+dIoSTpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yKeKhlRAaBO97xuGij2MPKoMzAMPyZGY5203LDB149s=; b=fPaul4iaW0AbNyYQa7Bj/mv9pRDV9nQyNCLGRcfEOrZ3tIrES1nOFKGhPO90jMvejBxrKnUu+zQKUNiOPEE4J3GzmAgPibYuko6VwTh1bcxFWSoNgtDCkGweyAqWHrqAcyqo9fuJT+4ZIqVA1K30FUjWMwbYn3thS3bj4Q85PFVOW4RF934fuHdP+bM3LxpLzoc7KzVSLOeF9VbgoSwGoJ97MTaigrpSMIC279YzT3/QQ2c8QND/XJBeESoiuXxlw1/xeSGpHnHhrqVlaxuAcXG8Pc59il0r07XQ0OZ4+kWqNJvwPByzKVAlpFmnquBw6Up0Ca6XQRvuuSQOV9ECGQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yKeKhlRAaBO97xuGij2MPKoMzAMPyZGY5203LDB149s=; b=h9DjY9HKEhWlk8RL6TGxXFNd5Soof6G93Fc6cJu/xSmceiFPbrtl+PychpIndONg/3YRJtfhppbF5c16CZ098mMlU2uLDR2EVZZDaYxM3n7hQqYD2trpF3rZcqUCcKKagz30/bMu8jVEmpc/BXgAenMLopSh4Dq0wMEzXkSxyJ0= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM0PR10MB1860.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:47::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3477.25; Fri, 23 Oct 2020 16:12:13 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6%6]) with mapi id 15.20.3477.027; Fri, 23 Oct 2020 16:12:13 +0000 From: "Brockhaus, Hendrik" To: "spasm@ietf.org" Thread-Topic: How to deal with Triple-DES in CMP Algorithms Thread-Index: AdapViCSMWwWKJULS/2/jU6xZnWaUw== Date: Fri, 23 Oct 2020 16:12:13 +0000 Message-ID: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-10-23T16:12:12Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=573d050f-0720-43cc-9f39-a41614716c89; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=siemens.com; x-originating-ip: [165.225.200.185] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 098a6bdd-ae6a-4f7b-d551-08d8776e677d x-ms-traffictypediagnostic: AM0PR10MB1860: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 3ESDJKDKuelHA0Zlic0qgIOuckkd5rDDMewyhF93c6HtQJLPFSInLsJTMUiGpW2Kj9syWJE3MUT25sAAPFQMuGF1CgmNWyBqIFSuEPT81I22uapbexGHmpvNURWK/zN3RgatAOwJMKNBhgPPIJA3xg7koQmeNmrDVOve0Fm0mxWKoDLnPG3rkQpjhntXUnYDw7OuPSxK4tqsNnxinTCQhsppdXsF2UlBNkqVhfwEgPSR+7b0UL/isTRm/ts4Qvc9504M+Ucw8oEGiP3WhX4+zb16AsDQc8wsQVoo93h56u9IxYz2F8kSTXMKDxHnx8kO2/3SOOmwOfVl00vFKQbTL+UDijkMMOTTDuFvjbtXf0kNIkkKoBAsJKKU5p1TRpW4kwWsOn4NnPpTI0j2vX046A== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(376002)(366004)(136003)(396003)(39860400002)(346002)(86362001)(66476007)(8936002)(5660300002)(71200400001)(66946007)(55236004)(8676002)(66556008)(33656002)(15974865002)(76116006)(26005)(9686003)(6916009)(4744005)(7696005)(66446008)(316002)(186003)(64756008)(6506007)(478600001)(2906002)(55016002)(52536014); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: PLOqrOPOqJu7CnKVFANO9dKgCjkBEyiAYp8k+CpFzergl2UQqol4TQEyO7JE0maF261R7DKJz1hMaUSJUsG8yDBFDV5S82FDKgv9E07smnGZm+RGd8b+hSTUsY4I8eGGr4mvjRH2uIoYns+qVOIT4906UaS3r4h3EVirFmtRSHajCpJiSPbuFrMV88J+ZQ4Nq5X0SSZLGu7MQSWAdEOA113npCi8zF1KlhRBAKq83VTetj28Waply7PoD+ee41phU9Btw+CzuwCbX4bRrssLduYQEACtwaCSk/ePBM8oOx03CwEZ6lX30mPuzCMq6g8I5bd1isT4RXgmY6NByAvVmtfeoRYpUli4GavkqnNH5fN73C6xjSnMV4xjuhLNTPzwnm4KkIkwNLUih1HoL33F+aESBB2jsEYT1P9sUaV12QryRTEGnCPeX3FRT/f+zokMp+yNSVFyBCF/mQrklefbHgQipt99IjRf5OSH7M2tdmXZnukhjojCREnW2b4Ab51LmZNj5PqOdzgGY/2dKZAXbztLkDpCZ9p/ui9+hgRFcnRpYiqMSEI+dpcjsou3zxBQJMtgdVMo1oDA/d40+XsI3i70BESllkPSXYDiFc3l/rqVBh6o0MapjZ5lzVsG/YNJy7jxGibxHiYLshR13Y0nZA== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 098a6bdd-ae6a-4f7b-d551-08d8776e677d X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2020 16:12:13.8553 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: obM6irQgbpzxGLXCzawkFdYm8106qW44hrjFkxibO83b62mBOW38Jqgd9suI57yHWgwi/EeF2yYmbAGzwCbbJXwQSOQjTAjb14qZajUbK0w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB1860 Archived-At: Subject: [lamps] How to deal with Triple-DES in CMP Algorithms X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Oct 2020 16:12:25 -0000 In CMP (RFC 4210) Triple-DES CBC is used for encrypted key transport. In CMS Algorithms (RFC 3370) Triple-DES key wrap and CBC is specified. In RFC 8429 Triple-DES is deprecated for use in Kerberos. I see Triple-DES still in use for S/MIME and elsewhere. Currently I am writing the I-D on CMP Algorithms. Should I specify Triple-DES as an alternative to AES or should I drop it? Hendrik Hendrik Brockhaus Siemens AG mailto:hendrik.brockhaus@siemens.com www.siemens.com Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann= Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive= Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, R= alf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany= ; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684= ; WEEE-Reg.-No. DE 23691322 From nobody Fri Oct 23 09:24:12 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E4813A0C73 for ; Fri, 23 Oct 2020 09:24:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0CY3OVRYXwtx for ; Fri, 23 Oct 2020 09:24:08 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77C073A0C61 for ; Fri, 23 Oct 2020 09:24:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D3156300AF2 for ; Fri, 23 Oct 2020 12:24:05 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id nB2gTHL-uP78 for ; Fri, 23 Oct 2020 12:24:04 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 87B9E300A3B; Fri, 23 Oct 2020 12:24:04 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Fri, 23 Oct 2020 12:24:05 -0400 Cc: "spasm@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: "Brockhaus, Hendrik" X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] How to deal with Triple-DES in CMP Algorithms X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Oct 2020 16:24:10 -0000 S/MIME has moved to AES. First it became a SHOULD, and then a MUST. Changes from S/MIME v3 to S/MIME v3.1 included: - The AES symmetric encryption algorithm has been included as a SHOULD implement. Changes from S/MIME v3.1 to S/MIME v3.2 includes: - Section 2.5.2: Replaced reference "sha1WithRSAEncryption" with "sha256WithRSAEncryption", replaced "DES-3EDE-CBC" with "AES-128 CBC", and deleted the RC5 example. Changes for S/MIME v4.0 includes: - Updated the content-encryption algorithms (Sections 2.7 and 2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added ChaCha20-Poly1305, removed mention of AES-192 Cipher Block Chaining (CBC), and marked tripleDES as historic. Russ > On Oct 23, 2020, at 12:12 PM, Brockhaus, Hendrik = wrote: >=20 > In CMP (RFC 4210) Triple-DES CBC is used for encrypted key transport. > In CMS Algorithms (RFC 3370) Triple-DES key wrap and CBC is specified. > In RFC 8429 Triple-DES is deprecated for use in Kerberos. > I see Triple-DES still in use for S/MIME and elsewhere. >=20 > Currently I am writing the I-D on CMP Algorithms. > Should I specify Triple-DES as an alternative to AES or should I drop = it? >=20 > Hendrik >=20 >=20 > Hendrik Brockhaus > Siemens AG > mailto:hendrik.brockhaus@siemens.com >=20 > www.siemens.com >=20 > Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim = Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and = Chief Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, = Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: = Berlin and Munich, Germany; Commercial registries: = Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE = 23691322 From nobody Fri Oct 23 14:17:26 2020 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 777DE3A1092; Fri, 23 Oct 2020 14:15:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: spasm@ietf.org, rdd@cert.org X-Test-IDTracker: no X-IETF-IDTracker: 7.20.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160348774748.5087.13196888537610235193@ietfa.amsl.com> Date: Fri, 23 Oct 2020 14:15:47 -0700 Archived-At: Subject: [lamps] lamps - Requested session has been scheduled for IETF 109 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Oct 2020 21:15:51 -0000 Dear Russ Housley, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. lamps Session 1 (1:00 requested) Tuesday, 17 November 2020, Session III 1600-1800 Room Name: Room 7 size: 507 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/109/sessions/lamps.ics Request Information: --------------------------------------------------------- Working Group Name: Limited Additional Mechanisms for PKIX and SMIME Area Name: Security Area Session Requester: Russ Housley Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 45 Conflicts to Avoid: Chair Conflict: ipwave suit stir Technology Overlap: acme cfrg ace Key Participant Conflict: oauth secdispatch saag sipbrandy tls mls teep emu People who must be present: Russ Housley Rich Salz Sean Turner Alexey Melnikov Michael Richardson Roman Danyliw Bernie Hoeneisen Jim Schaad Tim Hollebeek Hendrik Brockhaus Resources Requested: Special Requests: --------------------------------------------------------- From nobody Fri Oct 23 15:03:30 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2683C3A098A; Fri, 23 Oct 2020 15:03:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SfVBSugkY99h; Fri, 23 Oct 2020 15:03:28 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A075A3A0985; Fri, 23 Oct 2020 15:03:26 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kW59g-000I2h-9h; Sat, 24 Oct 2020 00:03:24 +0200 Date: Sat, 24 Oct 2020 00:03:24 +0200 (CEST) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG cc: agenda@ietf.org In-Reply-To: <160348774748.5087.13196888537610235193@ietfa.amsl.com> Message-ID: References: <160348774748.5087.13196888537610235193@ietfa.amsl.com> User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [lamps] lamps - Requested session has been scheduled for IETF 109 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Oct 2020 22:03:30 -0000 Looks like time zone information is missing. According to the .ics the times appear to be in Bangkok time (UTC+7). Thus the LAMPS WG session appears to take place on Tuesday, 17 November 2020, 0900-1100 UTC cheers, Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology On Fri, 23 Oct 2020, "IETF Secretariat" wrote: > Dear Russ Housley, > > The session(s) that you have requested have been scheduled. > Below is the scheduled session information followed by > the original request. > > > lamps Session 1 (1:00 requested) > Tuesday, 17 November 2020, Session III 1600-1800 > Room Name: Room 7 size: 507 > --------------------------------------------- > > > iCalendar: https://datatracker.ietf.org/meeting/109/sessions/lamps.ics > > Request Information: > > > --------------------------------------------------------- > Working Group Name: Limited Additional Mechanisms for PKIX and SMIME > Area Name: Security Area > Session Requester: Russ Housley > > > Number of Sessions: 1 > Length of Session(s): 1 Hour > Number of Attendees: 45 > Conflicts to Avoid: > Chair Conflict: ipwave suit stir > Technology Overlap: acme cfrg ace > Key Participant Conflict: oauth secdispatch saag sipbrandy tls mls teep emu > > > > > > People who must be present: > Russ Housley > Rich Salz > Sean Turner > Alexey Melnikov > Michael Richardson > Roman Danyliw > Bernie Hoeneisen > Jim Schaad > Tim Hollebeek > Hendrik Brockhaus > > Resources Requested: > > Special Requests: > > --------------------------------------------------------- > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > From nobody Sat Oct 24 06:26:00 2020 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C6D593A0B71; Sat, 24 Oct 2020 06:25:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.20.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <160354595770.7879.15679860927050038513@ietfa.amsl.com> Date: Sat, 24 Oct 2020 06:25:57 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-cmp-algorithms-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Oct 2020 13:25:58 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : CMP Algorithms Author : Hendrik Brockhaus Filename : draft-ietf-lamps-cmp-algorithms-00.txt Pages : 13 Date : 2020-10-24 Abstract: This document describes the conventions for using several cryptographic algorithms with the Certificate Management Protocol (CMP). CMP is used to enroll and further manage the lifecycle of X.509 certificates. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-cmp-algorithms/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-cmp-algorithms-00 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cmp-algorithms-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Oct 25 10:22:36 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 580CD3A0B8B for ; Sun, 25 Oct 2020 10:22:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R__rINgj97MR for ; Sun, 25 Oct 2020 10:22:33 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE52D3A0B8A for ; Sun, 25 Oct 2020 10:22:33 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 2D955300AF2 for ; Sun, 25 Oct 2020 13:22:31 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id e398O5tpj_2m for ; Sun, 25 Oct 2020 13:22:30 -0400 (EDT) Received: from [192.168.1.159] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 2622B300AA4 for ; Sun, 25 Oct 2020 13:22:30 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) Message-Id: Date: Sun, 25 Oct 2020 13:22:31 -0400 To: IETF LAMPS WG X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: [lamps] draft-housley-lamps-crmf-update-algs X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Oct 2020 17:22:35 -0000 https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ In order for the CMP algorithm document to drop SHA-1, this needs to = happen too. I think it is super straightforward. The only real point to discuss in the SHOULD in the MAC algorithm = section. The choices are: - Stick with AES-CMAC, - Pick some other MAC (perhaps AES-GMAC), - Drop the SHOULD altogether. Once this question is resolved, I will ask Tim to make a call for = adoption. Russ From nobody Mon Oct 26 07:24:06 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 510283A0C1B for ; Mon, 26 Oct 2020 07:24:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kUnbECLIGiZm for ; Mon, 26 Oct 2020 07:23:59 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77CBE3A0BCF for ; Mon, 26 Oct 2020 07:23:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D28E9300B53 for ; Mon, 26 Oct 2020 10:23:56 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 25MJk7bzytwI for ; Mon, 26 Oct 2020 10:23:55 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 8CC5D300ABE for ; Mon, 26 Oct 2020 10:23:55 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) Message-Id: <0CC6285E-36E8-4E93-A35E-8555826B133E@vigilsec.com> Date: Mon, 26 Oct 2020 10:23:57 -0400 To: IETF LAMPS WG X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: [lamps] DRAFT LAMPS Agenda for IETF 109 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Oct 2020 14:24:06 -0000 Dear LAMPS WG: Here is the DRAFT Agenda. Any changes needed? Russ ** ** ** ** ** ** ** ** ** ** LAMPS WG Agenda at Virtual IETF 109 0) Minute Taker, Jabber Scribe, Bluesheets 1) Agenda Bash 2) Documents with the RFC Editor a) draft-ietf-lamps-ocsp-nonce (Mohit) b) draft-ietf-lamps-rfc7030est-clarify (Michael, Thomas, Wei) 3) Active Working Group Documents a) draft-ietf-lamps-cmp-updates (Hendrik) b) draft-ietf-lamps-cmp-algorithms (Hendrik) c) draft-ietf-lamps-lightweight-cmp-profile (Hendrik, Steffen, David) d) draft-ietf-lamps-header-protection (Alexey, Bernie) 4) Prospective Active Working Group Documents a) draft-housley-lamps-crmf-update-algs (Russ) 5) Wrap Up = = = = = = = = = Etherpad: https://codimd.ietf.org/notes-ietf-109-lamps# Slides: https://datatracker.ietf.org/meeting/109/session/lamps Jabber: xmpp:lamps@jabber.ietf.org From nobody Mon Oct 26 10:12:43 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82E173A0D9A for ; Mon, 26 Oct 2020 10:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n3sLcE7AuHv3 for ; Mon, 26 Oct 2020 10:12:41 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40067.outbound.protection.outlook.com [40.107.4.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E997C3A0D97 for ; Mon, 26 Oct 2020 10:12:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=F07Q09Zz3ZwsjNReD30ZLCz91aXP1grXVMqhU4IpD0oMv3RfMtM+iw/ltIB87OiIsi1CEsysMVceLz60ODUuGgfIfnN0tu6O4UTtfcc7Z0FRguTAfURHRFMVZ8RhJi5ZuYK18+4Z6ghmCpxEkRbeyVNK0AIuaewle6KVLevTnrC8TXkGY+boDML+1LiNrRnOauGXzTMaNd43o5HRUJhgfIuLSwp2BC6whaqFufd+iOVqYPT8gW8PW7Uq1GxIDipP5tksZzoAfV80NJtO7EviFYsXfXCn3nbLHr/B5RZG7go+TAvlWf5TmLswKHVtsF+/eK528+J6IWrEBMIFPAGQhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rykPmOWPfx4XJ8U6xo6qEKDgk2CnQn5RBfQH/WNHWxc=; b=N9EJgfeoL9gPdX/UH2UZP1CERmCxK6COIS96srfpQKsyzRlPcyB5UBKTV8iOeJ5E3enzan3Peh4DM6/MZfYw+Lvb6FJOz6VypoZGqI+N5CPPbjo3j+T1DYCdgu7l0ETyep1DNsgdBveqVQlzT7+TtMWl9jKwynSSOnwpYcyDO9+hLpgCTSKCHjL5YRkbTX1Im7SQ8Xj/PJhn5NAYP7gjNjKMMJEiaxGrA0wOh62Nl5crN/5Vx7srGjnOLeWPTpGPynednFmCk8oX0xBwaOEcs02EpfcENfrXKujExOVDFidWIdFalTLwYh7JH5SCDQkeLCnYsWAmeFlqGxT+o/EvUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rykPmOWPfx4XJ8U6xo6qEKDgk2CnQn5RBfQH/WNHWxc=; b=ihPpN1UtYDxxu23XeZb6ubBwTUQPHGzfNm4DWoio1/xviEv7uwIsYdAhHR9Cl2LkQPKviZJdVXMlyiylMiZ/bmHQFOsj7ikMJEYMOVgBvGLG5v3D0sfB1FJDl2+xlbxQ0BnYu3d+FiFMG81lZaIXdOVv100PgyDk8tarIrfR3Gk= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM0PR10MB2692.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:12c::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3477.28; Mon, 26 Oct 2020 17:12:38 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6%6]) with mapi id 15.20.3477.027; Mon, 26 Oct 2020 17:12:38 +0000 From: "Brockhaus, Hendrik" To: "spasm@ietf.org" Thread-Topic: [CMP Algorithms] Use Key-Wrap with or without padding in Section 4.3 and Section 5 Thread-Index: Adaruf01J5o8GQNXSnKFZnSnQvB7Ng== Date: Mon, 26 Oct 2020 17:12:38 +0000 Message-ID: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-10-26T17:12:37Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=72e86615-d0fd-4805-aa15-c3c754555261; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=siemens.com; x-originating-ip: [165.225.200.179] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: aad4fc94-71fb-4cac-8ea5-08d879d25744 x-ms-traffictypediagnostic: AM0PR10MB2692: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 8kpeu8UMCM/vnrSJz66MMerQaZgWAR1yc0pOxMdLLlnG8M6HLpba4P7P/qFYuy0esl5IOjAJXvuRXajSItdZC5X1HbtdR+MEEl5mt4wm1s4OCZi/DDMxvodK0zwgXzV99zxtHr0qW/cgsr1vCQlCePXNhxBJfHHTFPnJTLJ/79HrpxjmoUq6+Ktgx8IdQLn8TaH7KyWpxhmPhzQOeX2i9yz2qQ1YX1tFWr7I7/+61Swfu3RP8td5G3gfqfhLIkA6MDN0+3beUdFkEY64Hc6ZJOhNYH4z7vtng+t80UtuH6Gp+SscRnPBrAxt0eGHDztYmvnrEHffBLdrJTW48rxhWw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(396003)(39860400002)(346002)(366004)(478600001)(5660300002)(76116006)(6506007)(4744005)(52536014)(186003)(2906002)(7696005)(33656002)(55236004)(26005)(66476007)(83380400001)(6916009)(66556008)(9686003)(8936002)(66446008)(8676002)(64756008)(55016002)(71200400001)(316002)(86362001)(66946007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: sFMV5t0miM0dA9rrbznp8ECH+Zu1BLm2kFG78o3qW6qCp5nEEyPazr2pSsV4/e0qTeVCfIL7MK8knTglIiZQA3wrT5vJmgGd2eZTACfSsTqrZvuMiI3lL1BFjM2J7TAUK10w3NYYa/QD49F4IiDKWBuJYerf6s4UIOFlIv3TfhSsNBUZItE/T/LUGhzb0/mQS4dWTXJtlB6huJKf/X4BziBQhYCVTkfX0o/+agd5FfUCghe6wiYgJ3s6uR6GOWzjWCKNp+SZA7qh3c0IT2lxR1NPAwNkVhubSgkZJurX9d7UnECtcTjum0bVGGKMEWac/PYy52aOuvZp2y5NUg+eEaQAZRU1k5urGHv0khn6lIwcXrhbtbXIFR7TMTqQZS+8EcknjHtC4aU5Dc619AfI8qBGGJYa+OVZNozQD7ySdAQMNNFXJ7R7oLGxkPVYki6VWnciirQygiqCzI2F+bbCsZb3EO5990OCSywBYSDN8olBEAFAiHRQ4ZO1FHn/ussJiu9FZa52Ah8T94H6xQPyJK4CewaovXLTi68/mpU4nNGtl62BPg/A5N/NhNDlJ7JDsEK2oxMWnJupVg596au3UQBhbSVI3JvKHhT54//di9DUtWicYLmVZmNEyWRPERjCHwkEj5XooQ/K0H5k/bdIDg== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: aad4fc94-71fb-4cac-8ea5-08d879d25744 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Oct 2020 17:12:38.6129 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: IgcacjVbpZB2PE7j4wsci7gz3roDvvqBIgPtk7GdLTzJlJO4RWR/XK76shlTC3zDY4iy7/ro1w+0EUyQJGWrFboCv4ghh+Iijo2ZxYiDSLg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB2692 Archived-At: Subject: [lamps] [CMP Algorithms] Use Key-Wrap with or without padding in Section 4.3 and Section 5 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Oct 2020 17:12:43 -0000 I am looking for some guidance regarding encryption algorithms required for= CMP, especially when using EnvelopedData. Encryption is needed for encryption of the content-encryption key and for e= ncryption of the content itself.=20 In case of CMP the content is a Signed Data wrapped AsymmetricKeyPackage, a= Certificates or a Password. I am uncertain whether to use AES key wrapping with or without padding? I am also uncertain if I can uses the same algorithm for CEK and content en= cryption? Any guidance is welcome. Hendrik Hendrik Brockhaus Siemens AG mailto:hendrik.brockhaus@siemens.com Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann= Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive= Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, R= alf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany= ; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684= ; WEEE-Reg.-No. DE 23691322 From nobody Mon Oct 26 11:53:27 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B90383A0D99 for ; Mon, 26 Oct 2020 11:53:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n6EqbplYaCY2 for ; Mon, 26 Oct 2020 11:53:24 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F4AC3A0BFD for ; Mon, 26 Oct 2020 11:53:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 153F0300B65 for ; Mon, 26 Oct 2020 14:53:22 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id i4T18J9S_kg6 for ; Mon, 26 Oct 2020 14:53:20 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id CF158300ABE; Mon, 26 Oct 2020 14:53:20 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Mon, 26 Oct 2020 14:53:22 -0400 Cc: "spasm@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: "Brockhaus, Hendrik" X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] [CMP Algorithms] Use Key-Wrap with or without padding in Section 4.3 and Section 5 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Oct 2020 18:53:26 -0000 > On Oct 26, 2020, at 1:12 PM, Brockhaus, Hendrik = wrote: >=20 > I am looking for some guidance regarding encryption algorithms = required for CMP, especially when using EnvelopedData. >=20 > Encryption is needed for encryption of the content-encryption key and = for encryption of the content itself.=20 > In case of CMP the content is a Signed Data wrapped = AsymmetricKeyPackage, a Certificates or a Password. >=20 > I am uncertain whether to use AES key wrapping with or without = padding? > I am also uncertain if I can uses the same algorithm for CEK and = content encryption? >=20 > Any guidance is welcome. >=20 > Hendrik It seems that alignment with RFC 8551 would be a reasonable way forward, = which would use different algorithms for key wrap and content = encryption: The underlying encryption functions for the key wrap and content- encryption algorithms [RFC3370] [RFC3565] and the key sizes for the two algorithms MUST be the same (e.g., AES-128 key wrap algorithm with AES-128 content-encryption algorithm). As both 128-bit and 256-bit AES modes are mandatory to implement as content-encryption algorithms (Section 2.7), both the AES-128 and AES-256 key wrap algorithms MUST be supported. Russ= From nobody Mon Oct 26 17:35:26 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DDFF3A1115 for ; Mon, 26 Oct 2020 17:35:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lsfw0N1a1_LS for ; Mon, 26 Oct 2020 17:35:20 -0700 (PDT) Received: from mail.amsl.com (c8a.amsl.com [4.31.198.40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD5313A111C for ; Mon, 26 Oct 2020 17:35:20 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by c8a.amsl.com (Postfix) with ESMTP id 1582C3C2AFC; Mon, 26 Oct 2020 17:35:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from c8a.amsl.com ([127.0.0.1]) by localhost (c8a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S3HBKtc8by-S; Mon, 26 Oct 2020 17:35:09 -0700 (PDT) Received: from [192.168.1.31] (cpe-76-95-228-63.socal.res.rr.com [76.95.228.63]) by c8a.amsl.com (Postfix) with ESMTPSA id BACE83C2A79; Mon, 26 Oct 2020 17:35:09 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Chris Smiley In-Reply-To: <20201020025802.0981AF40737@rfc-editor.org> Date: Mon, 26 Oct 2020 17:35:19 -0700 Cc: Russ Housley , Roman Danyliw , Benjamin Kaduk , tim.hollebeek@digicert.com, spasm@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20201020025802.0981AF40737@rfc-editor.org> To: RFC Errata System X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [lamps] [Editorial Errata Reported] RFC8649 (6311) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Oct 2020 00:35:25 -0000 Greetings, FYI - this report has been deleted as junk. Thank you. RFC Editor/cs > On Oct 19, 2020, at 7:58 PM, RFC Errata System = wrote: >=20 > The following errata report has been submitted for RFC8649, > "Hash Of Root Key Certificate Extension". >=20 > -------------------------------------- > You may review the report below and at: > https://www.rfc-editor.org/errata/eid6311 >=20 > -------------------------------------- > Type: Editorial > Reported by: Arvin Fernandez >=20 > Section: 16196369644 >=20 > Original Text > ------------- > Arvin >=20 > Corrected Text > -------------- > Fernandez >=20 > Notes > ----- > Help! >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8649 (draft-ietf-lamps-hash-of-root-key-cert-extn-07) > -------------------------------------- > Title : Hash Of Root Key Certificate Extension > Publication Date : August 2019 > Author(s) : R. Housley > Category : INFORMATIONAL > Source : Limited Additional Mechanisms for PKIX and SMIME > Area : Security > Stream : IETF > Verifying Party : IESG >=20 From nobody Thu Oct 29 10:23:22 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44A293A0C8E for ; Thu, 29 Oct 2020 10:23:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7WgpwXzYXq6V for ; Thu, 29 Oct 2020 10:23:13 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD8033A0C43 for ; Thu, 29 Oct 2020 10:23:10 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kYBdk-000Zzq-8G for spasm@ietf.org; Thu, 29 Oct 2020 18:23:08 +0100 Date: Thu, 29 Oct 2020 18:23:08 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: IETF LAMPS WG Message-ID: User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 17:23:21 -0000 Hi! One reason why we are working on Header Protection is that there have been reports that S/MIME Clients are not rendering Header Protected messages correctly. I was told that some clients e.g. display it as fowarded message and do not show the content at all or garbled. However, so far we have been unable to reproduce that there is (still) a problem with S/MIME clients applying the currently standardized S/MIME. May I ask those who experienced such issues to let us know which S/MIME clients were effected and how those (mis-)rendered the message? Our intension is to research and better understand the extent of the problem, to help the WG to make an informed decision on whether or not we should change the MIME format for Header Protection in S/MIME. In addition, we'd be also interested in the same information regarding PGP/MIME. Looking forward to your answers! cheers Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology From nobody Thu Oct 29 10:48:26 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B985D3A0BF7 for ; Thu, 29 Oct 2020 10:48:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R8NDz_JPBPEo for ; Thu, 29 Oct 2020 10:48:23 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D3F43A0BE5 for ; Thu, 29 Oct 2020 10:48:23 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D63F0300B2B for ; Thu, 29 Oct 2020 13:48:20 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id jRfu30ogaMM3 for ; Thu, 29 Oct 2020 13:48:19 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 91972300A02; Thu, 29 Oct 2020 13:48:19 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Thu, 29 Oct 2020 13:48:20 -0400 Cc: IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> References: To: Bernie Hoeneisen X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 17:48:25 -0000 As part of the DKG experiment, I saw the rendering as a attached .eml = file. Russ > On Oct 29, 2020, at 1:23 PM, Bernie Hoeneisen = wrote: >=20 > Hi! >=20 > One reason why we are working on Header Protection is that there have = been reports that S/MIME Clients are not rendering Header Protected = messages correctly. I was told that some clients e.g. display it as = fowarded message and do not show the content at all or garbled. > However, so far we have been unable to reproduce that there is (still) = a problem with S/MIME clients applying the currently standardized = S/MIME. >=20 > May I ask those who experienced such issues to let us know which = S/MIME clients were effected and how those (mis-)rendered the message? >=20 > Our intension is to research and better understand the extent of the = problem, to help the WG to make an informed decision on whether or not = we should change the MIME format for Header Protection in S/MIME. >=20 > In addition, we'd be also interested in the same information regarding = PGP/MIME. >=20 > Looking forward to your answers! >=20 > cheers > Bernie >=20 >=20 > -- >=20 > http://ucom.ch/ > Modern Telephony Solutions and Tech Consulting for Internet Technology >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Oct 29 10:57:16 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FCDE3A005C for ; Thu, 29 Oct 2020 10:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.346 X-Spam-Level: X-Spam-Status: No, score=-2.346 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.247, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpyNpPeFJn35 for ; Thu, 29 Oct 2020 10:57:14 -0700 (PDT) Received: from waldorf.isode.com (waldorf.isode.com [62.232.206.188]) by ietfa.amsl.com (Postfix) with ESMTP id E31793A003F for ; Thu, 29 Oct 2020 10:57:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1603994233; d=isode.com; s=june2016; i=@isode.com; bh=3xRYGeZS0mwoGmdKs95rcDGIojfTirG+AKewRGW8OpU=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=Oes8ET3jB1ObroVWHDWpJ35m86TxiOf+/NVfIP4sT0vDd0jz5yXXE9nfq2FONjos6C5mr1 Zn/1+S+7ieLwuK3uRb7mw+xNNCDF4Co5ZPzqlDYr26Dagr8I0RJNnYewq40HlLzkqZEosb XOYQOSKmEnOz9IoNmb+njil7s46pg8U=; Received: from [192.168.0.5] (97e7601a.skybroadband.com [151.231.96.26]) by waldorf.isode.com (submission channel) via TCP with ESMTPSA id ; Thu, 29 Oct 2020 17:57:12 +0000 To: Russ Housley , Bernie Hoeneisen Cc: IETF LAMPS WG References: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> From: Alexey Melnikov Message-ID: Date: Thu, 29 Oct 2020 17:57:08 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.12.1 In-Reply-To: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-GB Archived-At: Subject: Re: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 17:57:15 -0000 On 29/10/2020 17:48, Russ Housley wrote: > As part of the DKG experiment, I saw the rendering as a attached .eml file. At least Thunderbird does this. I need to check iOS mail and Outlook. > > Russ > > >> On Oct 29, 2020, at 1:23 PM, Bernie Hoeneisen wrote: >> >> Hi! >> >> One reason why we are working on Header Protection is that there have been reports that S/MIME Clients are not rendering Header Protected messages correctly. I was told that some clients e.g. display it as fowarded message and do not show the content at all or garbled. >> However, so far we have been unable to reproduce that there is (still) a problem with S/MIME clients applying the currently standardized S/MIME. >> >> May I ask those who experienced such issues to let us know which S/MIME clients were effected and how those (mis-)rendered the message? >> >> Our intension is to research and better understand the extent of the problem, to help the WG to make an informed decision on whether or not we should change the MIME format for Header Protection in S/MIME. >> >> In addition, we'd be also interested in the same information regarding PGP/MIME. >> >> Looking forward to your answers! >> >> cheers >> Bernie >> >> >> -- >> >> http://ucom.ch/ >> Modern Telephony Solutions and Tech Consulting for Internet Technology >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Oct 29 10:58:48 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2E943A0115 for ; Thu, 29 Oct 2020 10:58:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ItdB4Huq_cwH for ; Thu, 29 Oct 2020 10:58:45 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F6923A005C for ; Thu, 29 Oct 2020 10:58:45 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id CF844300BB1 for ; Thu, 29 Oct 2020 13:58:42 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id G3iG70DXfrf8 for ; Thu, 29 Oct 2020 13:58:41 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 3494C300A02; Thu, 29 Oct 2020 13:58:41 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Thu, 29 Oct 2020 13:58:42 -0400 Cc: Bernie Hoeneisen , IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> To: Alexey Melnikov X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 17:58:47 -0000 > On Oct 29, 2020, at 1:57 PM, Alexey Melnikov = wrote: >=20 > On 29/10/2020 17:48, Russ Housley wrote: >=20 >> As part of the DKG experiment, I saw the rendering as a attached .eml = file. > At least Thunderbird does this. I need to check iOS mail and Outlook. I was testing Mail.app and MailMate on Mac. Russ >>=20 >> Russ >>=20 >>=20 >>> On Oct 29, 2020, at 1:23 PM, Bernie Hoeneisen = wrote: >>>=20 >>> Hi! >>>=20 >>> One reason why we are working on Header Protection is that there = have been reports that S/MIME Clients are not rendering Header Protected = messages correctly. I was told that some clients e.g. display it as = fowarded message and do not show the content at all or garbled. >>> However, so far we have been unable to reproduce that there is = (still) a problem with S/MIME clients applying the currently = standardized S/MIME. >>>=20 >>> May I ask those who experienced such issues to let us know which = S/MIME clients were effected and how those (mis-)rendered the message? >>>=20 >>> Our intension is to research and better understand the extent of the = problem, to help the WG to make an informed decision on whether or not = we should change the MIME format for Header Protection in S/MIME. >>>=20 >>> In addition, we'd be also interested in the same information = regarding PGP/MIME. >>>=20 >>> Looking forward to your answers! >>>=20 >>> cheers >>> Bernie >>>=20 >>>=20 >>> -- >>>=20 >>> http://ucom.ch/ >>> Modern Telephony Solutions and Tech Consulting for Internet = Technology >>>=20 >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Oct 29 12:09:18 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C56763A044E for ; Thu, 29 Oct 2020 12:09:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VhyamSMOFMFI for ; Thu, 29 Oct 2020 12:09:15 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [IPv6:2a01:4f8:c0c:15fc::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDD023A03F3 for ; Thu, 29 Oct 2020 12:09:14 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1kYDIN-000aLZ-V7; Thu, 29 Oct 2020 20:09:11 +0100 Date: Thu, 29 Oct 2020 20:09:11 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: Russ Housley cc: IETF LAMPS WG In-Reply-To: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> Message-ID: References: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> User-Agent: Alpine 2.22 (DEB 394 2020-01-19) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 19:09:17 -0000 Russ, On Thu, 29 Oct 2020, Russ Housley wrote: > As part of the DKG experiment, I saw the rendering as a attached .eml file. Just for clarification: Did this happen with some example(s) DKG documented in https://tools.ietf.org/id/draft-autocrypt-lamps-protected-headers-02.html and provided as read-only IMAP folder? Or did you try other examples? cheers, Bernie From nobody Thu Oct 29 12:27:15 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08F213A08A6 for ; Thu, 29 Oct 2020 12:27:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfr__Rde-nTM for ; Thu, 29 Oct 2020 12:27:13 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B8013A0879 for ; Thu, 29 Oct 2020 12:27:13 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 40BC8300B63 for ; Thu, 29 Oct 2020 15:27:11 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id mny76Of5y1Jw for ; Thu, 29 Oct 2020 15:27:09 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id D1CF8300A02; Thu, 29 Oct 2020 15:27:09 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: Date: Thu, 29 Oct 2020 15:27:11 -0400 Cc: IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: <45C37DC8-24C6-4CD5-861E-CCB8D8041BD4@vigilsec.com> References: <5FFE5424-F2E5-4DD1-A6E6-0EB315352DFB@vigilsec.com> To: Bernie Hoeneisen X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] Which S/MIME Clients have issues with current S/MIME Header Protection? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 19:27:15 -0000 Bernie: >> As part of the DKG experiment, I saw the rendering as a attached .eml = file. >=20 > Just for clarification: Did this happen with some example(s) DKG = documented in = https://tools.ietf.org/id/draft-autocrypt-lamps-protected-headers-02.html = and provided as read-only IMAP folder? Or did you try other examples? I did the testing with the messages in the draft. Russ From nobody Thu Oct 29 14:25:46 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D70213A0317 for ; Thu, 29 Oct 2020 14:25:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UbY61taTDzIA for ; Thu, 29 Oct 2020 14:25:43 -0700 (PDT) Received: from mail-il1-x12b.google.com (mail-il1-x12b.google.com [IPv6:2607:f8b0:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C4F63A0045 for ; Thu, 29 Oct 2020 14:25:43 -0700 (PDT) Received: by mail-il1-x12b.google.com with SMTP id g7so4556446ilr.12 for ; Thu, 29 Oct 2020 14:25:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4H3nriqpL09HK6nHfYTH2Dh0ufd4Cg0LgJpEv9UWc9A=; b=DuE2Ke0fl8maP0nhLC0zSHNKma3NC2dAato3U3rn9tiogzBQcrO3ZYonAoUu7qrM9D 9pcsae3AuBefpqNG72i6Dnc05zzWaoDosYCNW7B6GlSEswgCdJHf8MK/K56skfVBH6AG 8Zh5UVaW+h1qi1n+gjU0aW43mjSEUTYtQRUCQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4H3nriqpL09HK6nHfYTH2Dh0ufd4Cg0LgJpEv9UWc9A=; b=f3pa0BTnEytZIbWXa0oA7N5zefOfPthIiGeE4/xUmXPh3gKuwkkHjjFWV1SISazcKD SFPsCTi7idm20IhkFziW/Lxoov6eE3oR4652nTrC2fgrgNObWI3TGI4lOKgR2QMzs9zv n8LbQSSPSPGjo57czYP4v75pdwzqXxbglrls4lgv58KFese0zaphhzRHhuKe8jUgeZn4 gAidCvuIp22DVJQVc78H2yksdei/gyuL039IbGhtEnnVfs/dotUid67eFesRcA0jwucJ 3JnAlOBGPGZA/8jaTgyoMzq+P2/qrVLcVrwsTqt8zrw2nqIZA3eDQ9zJpsMa1Z5uPUT0 1i3g== X-Gm-Message-State: AOAM532oDFXbc2eiAuP0HXfl3FKoCTtc9tHXYeAyxwViNBO0ic/BKGXT F3tGhBvmGTrHRwsriapx/y+1P7WH2K+Aug== X-Google-Smtp-Source: ABdhPJxRQ7bQgJ+KFgozpkWRZ5BhqCHUgsNr2+5QCUkL4jkgCjKvY6lkjafPA25X37zYEnybOBPruA== X-Received: by 2002:a92:9944:: with SMTP id p65mr4672862ili.127.1604006742662; Thu, 29 Oct 2020 14:25:42 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id s85sm3915373ilk.41.2020.10.29.14.25.41 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 29 Oct 2020 14:25:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\)) From: Sean Turner In-Reply-To: Date: Thu, 29 Oct 2020 17:25:40 -0400 Cc: IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: <19C92E29-0A01-4850-84F8-2A836EAF48F6@sn3rd.com> References: To: Russ Housley X-Mailer: Apple Mail (2.3608.120.23.2.4) Archived-At: Subject: Re: [lamps] draft-housley-lamps-crmf-update-algs X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 21:25:45 -0000 I=E2=80=99m no cryptographer, but it seems like we=E2=80=99re moving = away from block encryption algorithms so maybe we should just adopt = AES-GMAC? The caveat here is that I suspect AES-CMAC is just fine as a = MAC algorithm (or somebody will correct me). But, I also feel like = nobody is actually not going to use HMAC-SHA256. Putting that all = together, I guess my order of preference is: 1. AES-GCM 2. drop the SHOULD 3. AES-CMAC spt > On Oct 25, 2020, at 13:22, Russ Housley wrote: >=20 > https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ >=20 > In order for the CMP algorithm document to drop SHA-1, this needs to = happen too. I think it is super straightforward. >=20 > The only real point to discuss in the SHOULD in the MAC algorithm = section. The choices are: > - Stick with AES-CMAC, > - Pick some other MAC (perhaps AES-GMAC), > - Drop the SHOULD altogether. >=20 > Once this question is resolved, I will ask Tim to make a call for = adoption. >=20 > Russ >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Oct 29 15:12:16 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A85063A08A9 for ; Thu, 29 Oct 2020 15:12:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ch5pogMgP4Kv for ; Thu, 29 Oct 2020 15:12:13 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0345E3A08C5 for ; Thu, 29 Oct 2020 15:12:13 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 473ED300BCF for ; Thu, 29 Oct 2020 18:12:10 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id oRNS5hHkSQ0b for ; Thu, 29 Oct 2020 18:12:08 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id AE3D1300B65; Thu, 29 Oct 2020 18:12:08 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) From: Russ Housley In-Reply-To: <19C92E29-0A01-4850-84F8-2A836EAF48F6@sn3rd.com> Date: Thu, 29 Oct 2020 18:12:10 -0400 Cc: IETF LAMPS WG Content-Transfer-Encoding: quoted-printable Message-Id: <7ABFE900-E53E-4E30-BECF-D633403F98BC@vigilsec.com> References: <19C92E29-0A01-4850-84F8-2A836EAF48F6@sn3rd.com> To: Sean Turner X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: Re: [lamps] draft-housley-lamps-crmf-update-algs X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Oct 2020 22:12:15 -0000 For 1, you meant AES-GMAC, right? > On Oct 29, 2020, at 5:25 PM, Sean Turner wrote: >=20 > I=E2=80=99m no cryptographer, but it seems like we=E2=80=99re moving = away from block encryption algorithms so maybe we should just adopt = AES-GMAC? The caveat here is that I suspect AES-CMAC is just fine as a = MAC algorithm (or somebody will correct me). But, I also feel like = nobody is actually not going to use HMAC-SHA256. Putting that all = together, I guess my order of preference is: >=20 > 1. AES-GCM > 2. drop the SHOULD > 3. AES-CMAC >=20 > spt >=20 >> On Oct 25, 2020, at 13:22, Russ Housley wrote: >>=20 >> = https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ >>=20 >> In order for the CMP algorithm document to drop SHA-1, this needs to = happen too. I think it is super straightforward. >>=20 >> The only real point to discuss in the SHOULD in the MAC algorithm = section. The choices are: >> - Stick with AES-CMAC, >> - Pick some other MAC (perhaps AES-GMAC), >> - Drop the SHOULD altogether. >>=20 >> Once this question is resolved, I will ask Tim to make a call for = adoption. >>=20 >> Russ >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Fri Oct 30 06:26:49 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A69AA3A0E8C for ; Fri, 30 Oct 2020 06:26:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WnGQzo9Np-B for ; Fri, 30 Oct 2020 06:26:46 -0700 (PDT) Received: from mail-qv1-xf2c.google.com (mail-qv1-xf2c.google.com [IPv6:2607:f8b0:4864:20::f2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D25D93A0E8E for ; Fri, 30 Oct 2020 06:26:45 -0700 (PDT) Received: by mail-qv1-xf2c.google.com with SMTP id s1so2696905qvm.13 for ; Fri, 30 Oct 2020 06:26:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=Y+gpewBB/7G3abwIA3uJ3Aj+d1fo0fJ0TWHRhfhZ1g4=; b=TnxjNoNy4SQH8VVLQ0ABo2qOtcTzJIUSq1piT8vzDa8jhP3+EMm7H2SAByAncdgUtU Vok+mXAudI4UsS0kEe40f1ygMJyk52Quk17UkE/6Man/SInRRRQm4cK7cNvS9Yop9ZoL XqrS5dRLRnRsmLgpVxLSPwHCl1HLP6d7/DrcA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=Y+gpewBB/7G3abwIA3uJ3Aj+d1fo0fJ0TWHRhfhZ1g4=; b=MDVJZXSXSkaGLKMbd7stG3/nCpgQOljC25I4stWuwhkTINZ0wv9DfZDhuSRCv4nZp7 Nio8uhEIlwytylPwb13qKlqQ/qM4K5A1YY1qUEps1m+tNVPt1lfHNbsGWd8HK0TlUS+8 W5bEhC32DDKZ9+NezP5SExrMNEdZWuw1hN3ECDFMHCu0qISuzabVM0tkGQ0N1cpeK7q2 YQnU1TiL+QhTSkJvnqKdz0klITV6489W/VXVjjbHBUaT015rmzqUUlWDnaJLFm3vBB81 svIumTfbWf/Ni52VK4sqzLIrAFm2PrZf6EdFFvQyi72nd6jyKMHp3Ea+F5WI33tCOuZd 5fxg== X-Gm-Message-State: AOAM533Fyi/rCV4KqGQNEhV3F2NFkmSn6Ca2E1TIpe+KXCeSRilTjvsy WnbgJFykrmRM4GQbSSc8LGzMrq6bHN/y0w== X-Google-Smtp-Source: ABdhPJwFmi61SbAANJjFbx8FgbZQ4n9JbqiSW2iWEVkWbVJt5spATkcau4a9zdDJSO1JZWbqO5LHhQ== X-Received: by 2002:ad4:5192:: with SMTP id b18mr9810879qvp.14.1604064404677; Fri, 30 Oct 2020 06:26:44 -0700 (PDT) Received: from [10.227.216.69] (mobile-166-170-32-50.mycingular.net. [166.170.32.50]) by smtp.gmail.com with ESMTPSA id 8sm2648546qkm.0.2020.10.30.06.26.43 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 30 Oct 2020 06:26:43 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Sean Turner Mime-Version: 1.0 (1.0) Date: Fri, 30 Oct 2020 09:26:32 -0400 Message-Id: <19F528F0-4388-4312-BD23-739FB7A972F8@sn3rd.com> References: <7ABFE900-E53E-4E30-BECF-D633403F98BC@vigilsec.com> Cc: IETF LAMPS WG In-Reply-To: <7ABFE900-E53E-4E30-BECF-D633403F98BC@vigilsec.com> To: Russ Housley X-Mailer: iPhone Mail (18A8395) Archived-At: Subject: Re: [lamps] draft-housley-lamps-crmf-update-algs X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Oct 2020 13:26:48 -0000 Yes AES-GMAC. sorry I was think gets used so that=E2=80=99s what I wrote. spt Sent from my iPhone > On Oct 29, 2020, at 18:12, Russ Housley wrote: >=20 > =EF=BB=BFFor 1, you meant AES-GMAC, right? >=20 >> On Oct 29, 2020, at 5:25 PM, Sean Turner wrote: >>=20 >> I=E2=80=99m no cryptographer, but it seems like we=E2=80=99re moving away= from block encryption algorithms so maybe we should just adopt AES-GMAC? Th= e caveat here is that I suspect AES-CMAC is just fine as a MAC algorithm (or= somebody will correct me). But, I also feel like nobody is actually not goi= ng to use HMAC-SHA256. Putting that all together, I guess my order of prefer= ence is: >>=20 >> 1. AES-GCM >> 2. drop the SHOULD >> 3. AES-CMAC >>=20 >> spt >>=20 >>>> On Oct 25, 2020, at 13:22, Russ Housley wrote: >>>=20 >>> https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ >>>=20 >>> In order for the CMP algorithm document to drop SHA-1, this needs to hap= pen too. I think it is super straightforward. >>>=20 >>> The only real point to discuss in the SHOULD in the MAC algorithm sectio= n. The choices are: >>> - Stick with AES-CMAC, >>> - Pick some other MAC (perhaps AES-GMAC), >>> - Drop the SHOULD altogether. >>>=20 >>> Once this question is resolved, I will ask Tim to make a call for adopti= on. >>>=20 >>> Russ >>>=20 >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 From nobody Fri Oct 30 06:59:08 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A03F3A0EC0 for ; Fri, 30 Oct 2020 06:59:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xV4-McEy20o5 for ; Fri, 30 Oct 2020 06:59:06 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50053.outbound.protection.outlook.com [40.107.5.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4BF93A0AD0 for ; Fri, 30 Oct 2020 06:59:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OLMJoE+jDwEuASNBygJpr/7VLS+DxpGzxwuhS42lLrAFFaY4+dwqAm1WM6qGYj4VE0s1G+sq/ouU0b2U8icA/7+tZpOqLpKKURAvF8d3cxZxonjZCOJjLaSVK+bqHN0U5KabydD82fRM21RdO9LsbrD5O7iI7KWIy5IbhqZPw3Vs8tfDMdPSn5d+3MoeuyE6mLNqYehOrjcbbQHApypm9M/tpn9KbgGPL2dfLDBMZ6lhEr2SWEp7/6M5Oxb7wFis0mku+YKUh6LLIvM8FqKq6H+FgFeQBCaaBlR2wu1/xlsJdMNMeKxmoidy57F6Cw5AnaFUSJJe1EDLUbRv4ENLIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sI/Ybnw/iliOD62TKRXKe5VOuTDobbdXmosH049fJQs=; b=UXf7II1jS7mMPcNUEkKxg85H1GRCrGLgMQaqUDFIepmUMO0sU7ls1ujmV4PP09I0uKyxhg0IKKw+5wIOi7k2iqyW5zShRUlVgmBxAssEV6i0Z7SniohkeJMlllPeNsMaVgztnUAny2nYiYdOxbdviAhbsJZRCnxa+g7og3SaYyrPyOGQiytw30r+k50Yz0/KkW06fsHCx0dF+yGb1ddBD7Hy9UCky0U18jXCQGUAUEuvjvCe281GOfSldu69hCaFlbC0ftEd15JMgSyc5i9K07V4eDLm72TJKjle5gkpLAce5jMWkP2kTuf+tzN8TIgTh+XqoEYjapFVMh9/sUsx4w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sI/Ybnw/iliOD62TKRXKe5VOuTDobbdXmosH049fJQs=; b=M0OuYsi8ZXwJWowdC2yxxnd9oRxZchu05DPHwKFoj05IhiMiF9lzC4V82CtSf4Gk63K5rtepXiP4q3st8/s+YWowg3/GAyjnPSBIuoRYvjpBIHvym1Wltkhs3eVfMevRQQ8MOoWFqMxXoZLM+ukbWyF/23pXZH9EsyYsBS0i3Js= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM4PR1001MB1233.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:200:97::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18; Fri, 30 Oct 2020 13:59:02 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::48d8:f723:944:efe6%6]) with mapi id 15.20.3499.027; Fri, 30 Oct 2020 13:59:02 +0000 From: "Brockhaus, Hendrik" To: "spasm@ietf.org" CC: "steffen.fries@siemens.com" Thread-Topic: [CMP Algorithms] Section 4.1.1 and 4.1.2 drop static-static (EC)DH key agreement algorithms for use in CMP Thread-Index: AdauxI59Oj9Kx+SGSTG4AKFVfwicTQ== Date: Fri, 30 Oct 2020 13:59:02 +0000 Message-ID: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-10-30T13:59:01Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=b512f06f-b868-4b99-a951-b5fed1ebb9dc; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=siemens.com; x-originating-ip: [165.225.200.146] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: a36e5f4f-dc0a-4cdc-058b-08d87cdbf510 x-ms-traffictypediagnostic: AM4PR1001MB1233: x-ld-processed: 38ae3bcd-9579-4fd4-adda-b42e1495d55a,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 668IzPYKpuBmd0r3/o0KKYWlWJkKmyFhfwe0BorbT9dfklliD7CaNZHFfMPzhqdbwDVMW53tUAof5ADv00csoCW+D35vSEtYQu1QCc3fd5c3iNJsvexO5i78v7DVdApKdVu+1AcstRCbAemVd1zlOkjxOgr4pIEAqaBmsVzvOlYsLHA6ewzNgtLV00VeubVDr3HwiWaknUGGA4qMDNRvbxWAZH3P/nJ+X0lyijKu+g6+tGOa0qaY1f5OKIEeVC7o2Ypi5cqzrd1M8vVaPkMVHjvEjsslaR18TOyokgq15piWPCVEoe5SQSmA8bhdT6fe x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(346002)(396003)(39860400002)(136003)(366004)(376002)(71200400001)(66946007)(55016002)(76116006)(558084003)(8936002)(26005)(478600001)(5660300002)(8676002)(33656002)(66556008)(64756008)(66446008)(66476007)(52536014)(55236004)(9686003)(6506007)(186003)(7696005)(6916009)(86362001)(316002)(4326008)(107886003)(2906002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: qAZfJF/fdYaixG8CQgiJVdHOMzBbKaqmhiytnhESh3efBkpv+XecRi9q3c8jjsjM9XouOv+zt3mCXI+sJtpTu4CWNMvMoTNuTh1u6slNO7IKR3KEvn6khRS0G8X1nTW5Df1Pj8gRPy66JjaWXnYZ+7vA8r5459HDBzvKtuJl6AseatOCkeS77vduUah+IetEGJGVBpRsBI1q8f0x6zJnvlkyD0OgoO1/aRLJ+byy/5UaXesRSzjG9L5UUhLLMqif/JZkk86iSOTV/Q+nQrpZnmZTgpBfwh5i4tZcOwrtMVqOAPfxGRJBt3B/P3duGrO6Q0cvyNGRP/KfU4fW8k4Y9V0Ne5e2hJGFrbByGhpCGQGOa2IZVYsZzijKLAFPDCvtdHoH7CKoierRcIeRKOHm1VNz+/WqicDlQ47bZWhTNMhTrxNQ75s1UxICBQW7jNRafRimyDAenFbi5s59ZgE2FpIcvOcLChnVhMc+9r04hQ5h5pNLup/y4voday1O6b6mYQKah6P/9UNIPdp9ORixLPWZouF43ljDC0hwdD3iQDtbpml93Z6ivqWncyhjXETJvd/X/HKymDydujXEtgG+Y/gsV+BAnnpNxdH70DZ3Cm9e0g7V0yfsZV15GvmQGNYS6IKNJ9i6IylC18/ZjUDi4g== Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a36e5f4f-dc0a-4cdc-058b-08d87cdbf510 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Oct 2020 13:59:02.3195 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: HIcpwI/3nsrVWxYOUPDfBQE+7DZdT0anzRzRrzeE/4kngOf75b+Jgins3os+KXP8eQSuwy2uMlllvhr1BDBGW8cQX9yXyN3rjzpks7y2FR4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR1001MB1233 Archived-At: Subject: [lamps] [CMP Algorithms] Section 4.1.1 and 4.1.2 drop static-static (EC)DH key agreement algorithms for use in CMP X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Oct 2020 13:59:07 -0000 I consider dropping the static-static (EC)DH key agreement algorithm OIDs i= n section 4.1.1 and 4.1.2 for use in CMP. Is there anyone having a use case for static-static (EC)DH key agreement, e= .g. in the context CMS EnvelopedData for secure transport of centrally gene= rated keys. Hendrik From nobody Fri Oct 30 09:28:52 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98AD93A0FF6 for ; Fri, 30 Oct 2020 09:28:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.081 X-Spam-Level: X-Spam-Status: No, score=-1.081 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DOTGOV_IMAGE=1, FROM_GOV_DKIM_AU=-0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GXyKhv0bhoYg for ; Fri, 30 Oct 2020 09:28:49 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl2gcc02on2135.outbound.protection.outlook.com [40.107.89.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE1853A0FEF for ; Fri, 30 Oct 2020 09:28:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UfVuS5bLKIrV0jUMrV+ROrBxEwJKp+lZCqxsvg3Mpv8jJlwcF5xJz1GUAD6ppfUV01jQxHSf9eDABDdw2vGFzLvpC4hb9uK33wbyI/Zkq3N4QpIWtHehm/pg9JeWKjxrlFW+nu0fgqlsmmBdMmVoaVVH7FN6twAUM3+Zh0QPkU/bPM+t/3Kf4fgeUIfzYPegDyBzW/M1NnelEv31gF+WfO5+Xby60mVotSTMBuP0QmSIUbLmSe5kdLZ1AVByCovR2z0p2QA6L+fOVC8HwHYjc4UkeA0FxVPQhDkuWxEAEea9KjlbLvY96B+IIuaxNQOEtm+krvDP/imQKsvoC2s0Vg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mxiIzk0ZxCDhxezX2P9vGM73kuHwv7EEHvHKm6mq6MY=; b=M8i5IWvBaXxx+lCodJvuDtyOcTsZRb5CWNPVytwYqGDj6hFgdL+jc0e88HXYeUyfSt7N+uzjN9zWxgiKpuMdaLyWRYheIbnyylJp/JvQpDWEZxSeMmEVHmtWMt4s1v/9uOAKeXdktWuEhoCL613JAJ2ihxxOklcXNe4A32cqLC3ivd4nw2QisyPt000bR5PCMUjOdJ+nqEYYGdIMLGknvHIhTj24/iIeULSMF0OdIuXiJqDPU8kUtS7RNJpNeHWO41eRgUJOJjFSqeBJDa/BKINpHi6RG/h4SXiaERCsPi/xFJfd/CDUXuXyB7YE7zIOxJMLL8KOtbk6CPgA0MeiZw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mxiIzk0ZxCDhxezX2P9vGM73kuHwv7EEHvHKm6mq6MY=; b=WN9RsA32nIiHCTGh/QhVGcyof+1VNf/X0aNz/CtLpQ6AdWmaKH7rYfVTqXqjbsWg+EaU8+pZwvzgV+M9TSFSlr4HEauVjXLSRWV6nT0/URyNsXmQYskm5Z/9ZrXHyEy2tWbXjBgb/3PLvUoFg/M5sf1wCmousMk8r7qmxfpW20Q= Received: from SJ0PR09MB6848.namprd09.prod.outlook.com (2603:10b6:a03:25b::12) by SJ0PR09MB6589.namprd09.prod.outlook.com (2603:10b6:a03:26e::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.19; Fri, 30 Oct 2020 16:28:46 +0000 Received: from SJ0PR09MB6848.namprd09.prod.outlook.com ([fe80::bd81:d465:9c2b:ef10]) by SJ0PR09MB6848.namprd09.prod.outlook.com ([fe80::bd81:d465:9c2b:ef10%5]) with mapi id 15.20.3499.027; Fri, 30 Oct 2020 16:28:46 +0000 From: "Dang, Quynh H. (Fed)" To: IETF LAMPS WG , "cfrg@irtf.org" Thread-Topic: Special Publication (SP) 800-208, Recommendation for Stateful Hash-Based Signature Schemes. Thread-Index: AQHWrtjCsu26nA0KL0mj9b8830Z9mg== Date: Fri, 30 Oct 2020 16:28:46 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nist.gov; x-originating-ip: [2610:20:6005:162::82] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 937f5612-9ca7-4d6c-773a-08d87cf0dfdb x-ms-traffictypediagnostic: SJ0PR09MB6589: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: akrV88OfE2xqeOo+pS3sqzaHIraM9pWmqm1feHOjPSUMPuFgj3NNN7HfwAhninLWpdQRQF56vqHWgz/kxjXwsUA8wKLIQbYCS7E+6fLVLw8cOgVfTKp4msyUitdcwSgwod14vidMOzrGIrRqEDFo6e5AnCE1vfDT4FBzE54FDY9u8ROyXmKJzCyH+kBcvoRG5W+vdbA5ELePRf0QVo5BmQP6dBv2ppTX53+64UxJ1BMXoOCPR76n2CKzGCkPSEACKdSPpalygpA9aOzKCNOBRCaJoQshkVQABqSuh+qaDjC0hXHT12wVK/Dv3SHofvjqJs4ipXkxyAYOSuc3AJqjBrDY+jyuf5LwF5VlqQ4KnREYST8QKmtzYIBVSGR262A0cdMMVMx106wZPTqHB/+lpHuTWpjnhWVrQieNKr/4hoqN8eQZDcv73gjUJ6AOqxTlMcIRUSCTJNnnmjLC+OCfjQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SJ0PR09MB6848.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(376002)(136003)(39860400002)(346002)(83380400001)(71200400001)(966005)(478600001)(6506007)(186003)(166002)(110136005)(7696005)(316002)(91956017)(66476007)(76116006)(66446008)(66946007)(55016002)(83080400002)(33656002)(64756008)(8676002)(8936002)(66556008)(52536014)(19627405001)(2906002)(86362001)(5660300002)(9686003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: qNu+r5NdDIBbxBjk17lJpaiMPZRIQcU8m9MBUEmjIQtLIbZmxMXqc/1bgLvQK8vNTatXq7FssbBVar57IfVVLW7eCPPqW760t8+b2up1EaJL3UUMCNx2e5AGpeInIJa7Cqcw1FSXi5vSUQrnV7dNWcrgOfC46xuC1jHSL/WoPOT3Lue1OJic2plRZdQscO+WfwMTRO5qGB+JmKfqtT46/GT47vHcgc3a18eL2dzLJ8RcVuj2uvwtoO+ZHXwWD7nVB3W90k5nsw05HAr2Q9PnVBiVYDfSIBESjtVsb6StpOlJweP1koH/CWct+TGzs3+u2cf1rxhVL4+HbjywgKWDdTvE/uJomxESsFF0np74rcOr3p2tSCVGvKe3kZYA2BzCNBAd4cd6MUZbo2TPzdOfK5FsptnJy6AUEzPkJb/trhi3IdXoenfqWEW8inJ+5w9AGFotZXxA2iE2laOFbMMjSkoXTk9J/5+GSSyNwTBJ3PUvjebGpp42IbAyxX7dzHzflZcfNlZbC7RUzOEYRYSfduP8FQKY8pfFaOPP5FmjNjfBJM+VgN6xc5Gl9mWgGSSjCUSduai8piyAOB0FyF0qMPE9tDFFyRVcZ2gk7Ur1QfEbELXvWK69Or4QSYKmJoqzk1sUQFl2loz55L6WQ/HtY8Kglh8Oy23bMDn7XxFwiMA= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_SJ0PR09MB6848017DACB82782EEACFF11F3150SJ0PR09MB6848namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SJ0PR09MB6848.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 937f5612-9ca7-4d6c-773a-08d87cf0dfdb X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Oct 2020 16:28:46.1895 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +G2jVAiXcu5CHu4pLjqWZLlrKmJ5FlpuEz14hMem5loO0llVGC6Pc8r+cls3xeWZ X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR09MB6589 Archived-At: Subject: [lamps] Special Publication (SP) 800-208, Recommendation for Stateful Hash-Based Signature Schemes. X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Oct 2020 16:28:51 -0000 --_000_SJ0PR09MB6848017DACB82782EEACFF11F3150SJ0PR09MB6848namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi all, Today, we published Special Publication (SP) 800-208, Recommendation for St= ateful Hash-Based Signature Schemes on this page: https://csrc.nist.gov/pub= lications/detail/sp/800-208/final, along with our responses to the received= comments during the public comment period on the previous draft document. = This SP supplements FIPS 186 by approving the use of two stateful hash-bas= ed signature schemes: the eXtended Merkle Signature Scheme (XMSS) and the L= eighton-Micali Signature system (LMS) as specified in Requests for Comments= (RFC) 8391 and 8554, respectively. [https://csrc.nist.gov/CSRC/media/images/CSRC-logo-open-graph.png] NIST Special Publication (SP) 800-208, Recommendation for Stateful Hash-Bas= ed Signature Schemes This recommendation specifies two algorithms that can be used to generate a= digital signature, both of which are stateful hash-based signature schemes= : the Leighton-Micali Signature (LMS) system and the eXtended Merkle Signat= ure Scheme (XMSS), along with their multi-tree variants, the Hierarchical S= ignature System (HSS) and multi-tree XMSS (XMSSMT). csrc.nist.gov NIST SP 800-208 profiles LMS, XMSS, and their multi-tree variants. This pro= file approves the use of some but not all of the parameter sets defined in = RFCs 8391 and 8554. The approved parameter sets use either SHA-256 or SHAKE= 256 with 192- or 256-bit outputs. Regards, Quynh. --_000_SJ0PR09MB6848017DACB82782EEACFF11F3150SJ0PR09MB6848namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi all,&nbs= p;

Today, we publis= hed Special Publication (SP) 800-208, Recommendation for Stateful Hash-Base= d Signature Schemes on this page: https://csrc.nist.gov/publi= cations/detail/sp/800-208/final, along with our responses to the received comments during the public commen= t period on the previous draft document.  This SP supplements FIPS 186 by approving the use of two= stateful hash-based signature schemes: the eXtended Merkle Signature Scheme (XMSS) and the Leighton-Micali Signature = system (LMS) as specified in Requests for Comments (RFC) 8391 and 8554, res= pectively.
3D""
This recommendation specifies two algorithms that can be used to generate a= digital signature, both of which are stateful hash-based signature schemes= : the Leighton-Micali Signature (LMS) system and the eXtended Merkle Signat= ure Scheme (XMSS), along with their multi-tree variants, the Hierarchical Signature System (HSS) and multi-tre= e XMSS (XMSSMT).
csrc.nist.gov

List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Oct 2020 19:46:43 -0000 Sean: Are you aware of an OID being assigned for AES-GMAC? I just did a = Google search and did not find one. Russ > On Oct 29, 2020, at 5:25 PM, Sean Turner wrote: >=20 > I=E2=80=99m no cryptographer, but it seems like we=E2=80=99re moving = away from block encryption algorithms so maybe we should just adopt = AES-GMAC? The caveat here is that I suspect AES-CMAC is just fine as a = MAC algorithm (or somebody will correct me). But, I also feel like = nobody is actually not going to use HMAC-SHA256. Putting that all = together, I guess my order of preference is: >=20 > 1. AES-GCM > 2. drop the SHOULD > 3. AES-CMAC >=20 > spt >=20 >> On Oct 25, 2020, at 13:22, Russ Housley wrote: >>=20 >> = https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ >>=20 >> In order for the CMP algorithm document to drop SHA-1, this needs to = happen too. I think it is super straightforward. >>=20 >> The only real point to discuss in the SHOULD in the MAC algorithm = section. The choices are: >> - Stick with AES-CMAC, >> - Pick some other MAC (perhaps AES-GMAC), >> - Drop the SHOULD altogether. >>=20 >> Once this question is resolved, I will ask Tim to make a call for = adoption. >>=20 >> Russ >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 From nobody Sat Oct 31 12:55:55 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C7E33A0E68 for ; Sat, 31 Oct 2020 12:55:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wKuxkuqUa-jz for ; Sat, 31 Oct 2020 12:55:51 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2B2E3A0DD5 for ; Sat, 31 Oct 2020 12:55:51 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 1CC8E300BB7 for ; Sat, 31 Oct 2020 15:55:49 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 5pU4c1D_01Dm for ; Sat, 31 Oct 2020 15:55:47 -0400 (EDT) Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 8F205300AF1 for ; Sat, 31 Oct 2020 15:55:47 -0400 (EDT) From: Russ Housley Content-Type: multipart/alternative; boundary="Apple-Mail=_DE5E4542-1FE0-48CE-A003-A070CEF866C7" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\)) Message-Id: <9421579D-6043-45B0-91E2-49C775A9D5E4@vigilsec.com> References: <160417406530.21687.11113822312225272939@ietfa.amsl.com> To: IETF LAMPS WG Date: Sat, 31 Oct 2020 15:55:49 -0400 X-Mailer: Apple Mail (2.3445.104.17) Archived-At: Subject: [lamps] New Version Notification for draft-housley-lamps-crmf-update-algs-01.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Oct 2020 19:55:54 -0000 --Apple-Mail=_DE5E4542-1FE0-48CE-A003-A070CEF866C7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii This uses AES-GMAC fir the SHOULD MAC algorithm instead of AES-CMAC. Russ > From: internet-drafts@ietf.org > Subject: New Version Notification for = draft-housley-lamps-crmf-update-algs-01.txt > Date: October 31, 2020 at 3:54:25 PM EDT > To: "Russ Housley" >=20 >=20 > A new version of I-D, draft-housley-lamps-crmf-update-algs-01.txt > has been successfully submitted by Russ Housley and posted to the > IETF repository. >=20 > Name: draft-housley-lamps-crmf-update-algs > Revision: 01 > Title: Algorithm Requirements Update to the Internet = X.509 Public Key Infrastructure Certificate Request Message Format = (CRMF) > Document date: 2020-10-31 > Group: Individual Submission > Pages: 4 > URL: = https://www.ietf.org/archive/id/draft-housley-lamps-crmf-update-algs-01.tx= t > Status: = https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-update-algs/ > Htmlized: = https://datatracker.ietf.org/doc/html/draft-housley-lamps-crmf-update-algs= > Htmlized: = https://tools.ietf.org/html/draft-housley-lamps-crmf-update-algs-01 > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-lamps-crmf-update-algs-0= 1 >=20 > Abstract: > This document updates the cryptographic algorithm requirements for > the Password-Based Message Authentication Code in the Internet X.509 > Public Key Infrastructure Certificate Request Message Format (CRMF) > specified in RFC 4211. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 >=20 --Apple-Mail=_DE5E4542-1FE0-48CE-A003-A070CEF866C7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii This = uses AES-GMAC fir the SHOULD MAC algorithm instead of AES-CMAC.

Russ


From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-housley-lamps-crmf-update-algs-01.txt
Date: = October 31, 2020 at 3:54:25 PM = EDT
To: = "Russ Housley" <housley@vigilsec.com>


A new version = of I-D, draft-housley-lamps-crmf-update-algs-01.txt
has = been successfully submitted by Russ Housley and posted to the
IETF repository.

Name: = draft-housley-lamps-crmf-update-algs
Revision: 01
Title:= = Algorithm Requirements Update to the Internet X.509 Public Key = Infrastructure Certificate Request Message Format (CRMF)
Document date: 2020-10-31
Group:= = Individual Submission
Pages: 4
URL: =            https://www.ietf.org/archive/id/draft-housley-lamps-crmf-update= -algs-01.txt
Status: =         https://datatracker.ietf.org/doc/draft-housley-lamps-crmf-updat= e-algs/
Htmlized: =       https://datatracker.ietf.org/doc/html/draft-housley-lamps-crmf-= update-algs
Htmlized: =       https://tools.ietf.org/html/draft-housley-lamps-crmf-update-alg= s-01
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-lamps-crmf-up= date-algs-01

Abstract:
=   This document updates the cryptographic algorithm = requirements for
  the Password-Based Message = Authentication Code in the Internet X.509
=   Public Key Infrastructure Certificate Request Message Format = (CRMF)
  specified in RFC 4211.



Please note = that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



= --Apple-Mail=_DE5E4542-1FE0-48CE-A003-A070CEF866C7-- From nobody Sat Oct 31 14:16:11 2020 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98AFD3A0ECB; Sat, 31 Oct 2020 14:16:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.306 X-Spam-Level: X-Spam-Status: No, score=-1.306 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b=dCgO3IRE; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b=qGN+pbRe Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PDVBx1BbY902; Sat, 31 Oct 2020 14:16:07 -0700 (PDT) Received: from che.mayfirst.org (unknown [162.247.75.117]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27D5C3A0EC7; Sat, 31 Oct 2020 14:16:06 -0700 (PDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1604178965; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=NkSmLbJMqGI/9W95A8/5pLdXxk7Ytv9zP6PfBLmphMQ=; b=dCgO3IREE42xVDxIY0Jo3SOy8AvjbQjlJAhgVqkdLQ/ptXHnoUgvvX62S5/gMB4Dy71Vx jTBm5i54idUSq8gDQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1604178965; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=NkSmLbJMqGI/9W95A8/5pLdXxk7Ytv9zP6PfBLmphMQ=; b=qGN+pbReqnJJXTdfzOZmiHs4g9lDl+nfwjBxYMGnpoK+nagrybiLNlO7SneEnrJmWYq8u +VK7MZ8QYji+tbJXVulEsj6n28AJ5WDES73VYwhmKmqty6KFn5PWkfeNPzlo1CrkPEobuwi ysnokhbfYh0wMAk3pziRfN9IxIWg5XpDWvvQMZrzrZcJjFaAylJT9uxEP2HgvyJajv9CW19 VzMgoYgZ9MfD6NP85K/6amCKMe3ZyuE1p9ibc21iSMVB/Ye6HaOcTnOhFWl3QHBJXtUns2b xw+O8RZdM3Asrr+cs6lTEgm5CRPkXrNoW6Hf6iIn7GDaxE5nkwq0NsmRz0+w== Received: from fifthhorseman.net (unknown [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id C9B28F9A5; Sat, 31 Oct 2020 17:16:05 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id AF56E206AD; Sat, 31 Oct 2020 16:19:57 -0400 (EDT) From: Daniel Kahn Gillmor To: spasm@ietf.org, openpgp@ietf.org In-Reply-To: <160416804489.2019.4098533865860400253@ietfa.amsl.com> References: <160416804489.2019.4098533865860400253@ietfa.amsl.com> Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEXEK/AhYJKwYBBAHaRw8BAQdAr/gSROcn+6m8ijTN0DV9AahoHGafy52RRkhCZVwxhEe0K0Rh bmllbCBLYWhuIEdpbGxtb3IgPGRrZ0BmaWZ0aGhvcnNlbWFuLm5ldD6ImQQTFggAQQIbAQULCQgH AgYVCgkICwIEFgIDAQIeAQIXgAIZARYhBMS8Lds4zOlkhevpwvIGkReQOOXGBQJd5Hw3BQkFpJWB AAoJEPIGkReQOOXGDYEA/j0ERjPxDleKMZ2LDcWc/3o5cLFwAVzBKQHppu0Be5IWAP0aeTnyEqlp RTE7M8zugwkhYeUYfYu0BjecDUMnYz6iDLgzBF3kewUWCSsGAQQB2kcPAQEHQK1IuW0GZmcrs2mx CYMl8IHse0tMF8cP7eBNXevrlx2ZiPUEGBYIACYCGwIWIQTEvC3bOMzpZIXr6cLyBpEXkDjlxgUC XeR7TwUJAiGl/gCBdiAEGRYIAB0WIQQsv6x2UaqQJzY+dXHEDyVUMvKBDwUCXeR7BQAKCRDEDyVU MvKBD7KmAQCHs+7588C4jto6fMje0Nu97zzoppjJM7lrGF2rVnbHvwD+MgmGUbHzPSUrTWnZBQDi /QM595bxNrBA4N1CiXhs2AMJEPIGkReQOOXGpp0BAM7YeBnt/UNvxJAGm4DidSfHU7RDMWe6Tgux HrH21cDkAQC9leNFXJsQ7F2ZniRPHa8CkictcQEKPL8VCWpfe8LbArg4BF3ke5wSCisGAQQBl1UB BQEBB0Cf+EiAXtntQMf51xpqb6uZ5O0eCLAZtkg0SXHjA1JlEwMBCAeIfgQYFggAJhYhBMS8Lds4 zOlkhevpwvIGkReQOOXGBQJd5HucAhsMBQkCIaVkAAoJEPIGkReQOOXGdYcBANYnW7VyL2CncKH1 iO4Zr0IwfdIv6rai1PUHL98pVi3cAP9tMh85CKGDa0Xi/fptQH41meollLW5tLb/bEWMuUNuBQ== Date: Sat, 31 Oct 2020 16:19:56 -0400 Message-ID: <87wnz6jggj.fsf@fifthhorseman.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Archived-At: Subject: Re: [lamps] New Version Notification for draft-dkg-lamps-e2e-mail-guidance-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Oct 2020 21:16:10 -0000 --=-=-= Content-Type: text/plain Hi LAMPS and OpenPGP folks-- In the hopes of providing a useful space for discussion of effective implementation of end-to-end crypto for e-mail clients, i've just published the draft identified below. > https://datatracker.ietf.org/doc/draft-dkg-lamps-e2e-mail-guidance/ > https://www.ietf.org/archive/id/draft-dkg-lamps-e2e-mail-guidance-00.html > > Abstract: > End-to-end cryptographic protections for e-mail messages can provide > useful security. However, the standards for providing cryptographic > protection are extremely flexible. That flexibility can trap users > and cause surprising failures. This document offers guidance for > mail user agent implementers that need to compose or interpret e-mail > messages with end-to-end cryptographic protection. It provides a > useful set of vocabulary as well as suggestions to avoid common > failures. This is implementation guidance -- it covers some protocol structures but doesn't introduce any novel protocol elements. Rather, it gives pointers that explain common problems, subtleties and nuances that a MUA implementer might not understand about encrypted mail. You might think of it as a response to some of the problems that came up a few years ago in "EFAIL" (https://efail.de). The draft formalizes a few useful notions. In particular it documents "Cryptographic Envelope" and "Cryptographic Payload" as concepts that hopefully winnow down the space of infinite MIME recursion into usable, sensible structures for e-mail. I've pulled these definitions out of draft-autocrypt-lamps-protected-headers because they apply whether headers are protected or not. (I'll get to the protected headers in a separate conversation) I'm hoping to discuss this draft on the LAMPS mailing list (spasm@ietf.org) because of the coverage there of S/MIME and cryptographic e-mail more generally. But the principles are identical for PGP/MIME, so the draft covers PGP/MIME as well. Both standards exist and are in use, so cryptographic MUAs need to realistically grapple with that situation. I hope that developers who care about only one camp can see the moral equivalence of the two schemes and try to share tips that apply generally to cryptographic MUAs. If you're an implementer of a cryptographic MUA (or want to be), i hope you'll read the draft, offer commentary and share your insights. I welcome interested co-authors as well. The draft is written in pretty simple markdown, and for minor edits i welcome merge requests and bug reports at: https://gitlab.com/dkg/e2e-mail-guidance Any MRs or bug reports on gitlab for more substantive changes are welcome as well, but i encourage bigger conversations to target the LAMPS mailing list, and i'll use the issue/MR tracker on gitlab to track the mailing list discussion. If there's room in the upcoming LAMPS meeting at IETF 109 to discuss this, i'd be happy to lead a discussion for 5-10 minutes, but discussion on the mailing list is more important. Regards, --dkg On Sat 2020-10-31 11:14:04 -0700, internet-drafts@ietf.org wrote: > A new version of I-D, draft-dkg-lamps-e2e-mail-guidance-00.txt > has been successfully submitted by Daniel Kahn Gillmor and posted to the > IETF repository. > > Name: draft-dkg-lamps-e2e-mail-guidance > Revision: 00 > Title: Guidance on End-to-End E-mail Security > Document date: 2020-10-31 > Group: Individual Submission > Pages: 19 > URL: https://www.ietf.org/archive/id/draft-dkg-lamps-e2e-mail-guidance-00.txt > Status: https://datatracker.ietf.org/doc/draft-dkg-lamps-e2e-mail-guidance/ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQQsv6x2UaqQJzY+dXHEDyVUMvKBDwUCX53G7QAKCRDEDyVUMvKB D0x8APwJ1d7fIvZgtqjtQxtmInyWlgc0bf+lZIKYpA7j6C45WgEA1HDyB1dF3e+y Z/aq3QV9a+J2lyIXdHR2R/bGAqpuDgk= =KJ7R -----END PGP SIGNATURE----- --=-=-=--