From nobody Tue Nov 1 11:10:40 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59A6C1296BA for ; Tue, 1 Nov 2016 11:10:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id em8xcN2z4kx1 for ; Tue, 1 Nov 2016 11:10:37 -0700 (PDT) Received: from mail-pf0-f176.google.com (mail-pf0-f176.google.com [209.85.192.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 253A91294DA for ; Tue, 1 Nov 2016 11:10:37 -0700 (PDT) Received: by mail-pf0-f176.google.com with SMTP id d2so24015408pfd.0 for ; Tue, 01 Nov 2016 11:10:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=UHQ+1qqTEGw+XD1yYXCMIVc475Q9xV8+6+MEkDxMgqg=; b=e2r4CW4rxcUjkf243uqGeZm6gou4d0X/pCFCxFos/LizQBphVxS+fsDzlVTznX5S42 wCn5E2CUm9UvRtpVjKxLdf2nX+QbALpEr6N3MAafOBywaok4TF8XZyBdGBKNSyK6XHcJ NJ0FSRNCLHmhnmgkZjs2nBL/WJ9E0QCEkXHJm3GiisAZwQgjk4NMaRY2Y8mcKFBf+oXq LTEMImneXK5lmet1fwyJhwYiIn7GUPCIB+aXRbGNYtUFbKBi63tC3cc4cY62D2RqGUr2 QmWraGl10My+2Pwgl4SW6f5J14npWGAVxEtPqYSYYX7TFJZRkDooALPNWHhXNFNr7JDo XT9Q== X-Gm-Message-State: ABUngveiXv9JnGycTmv9giUu9Su+ehRsJwu6AvU/y3w4/pmbdY7Ir+c++GYBTo4XDliw1ZwU X-Received: by 10.98.213.7 with SMTP id d7mr36348841pfg.3.1478023836172; Tue, 01 Nov 2016 11:10:36 -0700 (PDT) Received: from [192.168.1.101] (c-67-164-110-148.hsd1.ca.comcast.net. [67.164.110.148]) by smtp.gmail.com with ESMTPSA id xk6sm43770372pab.26.2016.11.01.11.10.35 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 01 Nov 2016 11:10:35 -0700 (PDT) To: ace@ietf.org References: From: Randy Presuhn Message-ID: <2af41a57-c8df-dac1-a008-6a05d6b2a9c2@alumni.stanford.edu> Date: Tue, 1 Nov 2016 11:10:36 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Ace] New Version Notification for draft-navas-ace-secure-time-synchronization-00.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Nov 2016 18:10:38 -0000 Hi - On 10/31/2016 11:45 PM, Ludwig Seitz wrote: > On 2016-11-01 01:41, Randy Presuhn wrote: >> Hi - >> >> >> On 10/31/2016 7:25 AM, Renzo Navas wrote: >> ... >>> The need for a secure source of time is getting clearer on ACE (either >>> that, or mechanisms to assure freshness of each transaction), and we >>> hope that with this protocol we are giving the first step to come up >>> with a constrained-resource friendly solution. >> ... >> >> Along the way to SNMPv3, we learned that a full-blown time >> protocol isn't actually necessary to provide authentication, >> timeliness, replay protection, etc. See RFC 3414 for details >> on how to get these properties cheaply, both from protocol >> overhead and processing perspectives. >> >> Randy >> > > Does your "etc" include expiration of access tokens? The standard access control model (VACM, RFC 3415) does not rely on "access tokens" - what is (and is not) allowed is determined the currently configured permissions on the system whose information is being accessed / modified / published, and the authenticated identity of the user/entity to which the information is being delivered or by which it is being modified. This may or may not meet your needs. The SNMP design was driven in part by a requirement for things to work correctly even when large portions of the internet infrastructure (such as NTP, PKI, DNS, etc.) were malfunctioning, broken, or under attack, and to work on systems with minimal (from the perspective of the late 1980s and extending into the 1990s) capabilities. Again, this might not be necessary here. It does seem, however, that what seems like a shortcut here or there can have large impacts on the ultimate complexity and technology footprint of a design... Randy From nobody Wed Nov 2 03:48:34 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A780C129564 for ; Wed, 2 Nov 2016 03:48:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9XAc-kgVpBnS for ; Wed, 2 Nov 2016 03:48:31 -0700 (PDT) Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5ED0F129AB8 for ; Wed, 2 Nov 2016 03:48:29 -0700 (PDT) Received: by mail-qk0-x236.google.com with SMTP id x190so11063410qkb.0 for ; Wed, 02 Nov 2016 03:48:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ziVgKt33CnEgHw8YC3S9vLPPDvEVEDaY979llc4aEG0=; b=T1qhRI/p6DXSF8stPVus7hMzgJzvjL9DVplNPA2fZ/txGRDgDIddH4D2YGDW15aqsV dj13IPhMAZcXS844fBWz2p0UzrWFPYsEyePPOS06sLU6b8MNYXbTNU0RjPw54Qjs38dP VlZqoOB83uhAb5bz8pKvOMolaGQvJ8O0YSs6L0q8CeWG4Q0FocUhl4nE+v/fIA9Ar01a 0BDVg81XscWJM9qcMnTR1/lMAbUTJ9swDCrFxTDqVyeFpqaSu5fB3onZXGkJp7wyLwad Pa2UEp9Sba62Moe87HtNZsC2UapPLWJLbyzRL8OT+JnSrMELejUPdYH6BKt/lkamssnS pifw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ziVgKt33CnEgHw8YC3S9vLPPDvEVEDaY979llc4aEG0=; b=LpukEvbHn7L+D3nw3/Vv3oBqW4yAv3NlmKNjvM5T56TXXNr+0rmicAC3p1GrEpnQxc 7run96xb/lxdVfZycIPKmYXr8NJFxYvCmASJJMWArqdr2zf3svWQlaMOCKwW2Ia7EcEs noh7M+c7sK/Tou6JjVCVzC0igDXGX99b77/QhUiHfAIe3VWULVb5HTB1lsRJH/8VAbUb L5Yx2PxtPGLk2m/0dI/6GgHdREMWtB3sTxj3taoK75WluJ2Zq6lXY6JRv+tscu4JjcNw G+ELHpI8ndbK5eaIpo3VQ67mI8czbW4QJnBCae1lD5b1c+ObJXLvutJbnoNJIb6tXX2K aykQ== X-Gm-Message-State: ABUngvfZY8TxB+3GjWNtd6zxLrrFBJQFpx55fzg5AHVxO/yrod3qOKCSdle47rR09Wo6ZQkKfrjpvyQOQmVqgQ== X-Received: by 10.55.160.136 with SMTP id j130mr2373495qke.108.1478083708425; Wed, 02 Nov 2016 03:48:28 -0700 (PDT) MIME-Version: 1.0 Received: by 10.55.122.7 with HTTP; Wed, 2 Nov 2016 03:48:08 -0700 (PDT) In-Reply-To: <2af41a57-c8df-dac1-a008-6a05d6b2a9c2@alumni.stanford.edu> References: <2af41a57-c8df-dac1-a008-6a05d6b2a9c2@alumni.stanford.edu> From: Renzo Navas Date: Wed, 2 Nov 2016 11:48:08 +0100 Message-ID: To: Randy Presuhn Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: ace Subject: Re: [Ace] New Version Notification for draft-navas-ace-secure-time-synchronization-00.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Nov 2016 10:48:32 -0000 Hi Randy! Thank you for the pointer, I was not aware of rfc3414. I am in favor of solutions that do not need a time protocol/synchronized time; I think we will need both at ACE. Freshness is what seems to provide the 'Timeliness Module' of rfc3414 (but then I think the module to work needs some sort of "Time Synchronization" sec 2.3. which I could not figure out in detail). In any case I will deep digger on the document. About the need for time: Internal ACE discussions (clock design team), that now I hope well be debated publicly, lead to some partial conclusions; and I think one of them is that a minimal time-sync will be needed in ACE. The protocol we are designing, consist on two messages (fundamentally: two object structures), that where designed to be easily attached/piggybacked with other messages of the ACE framework. I can no think about something more minimalistic, other than not using self containing structures, and using something more compact than CBOR/COSE. Also I think its good to separate the debate about the actual time sync procedure (nonce, what to authenticate, etc), and the second issue is how to encode and send those messages within the ACE framework. I think its an open discussion, so Its good that we are talking about Time in ACE. Eager to continue the time-discussion, but now I don' have more time :P Renzo PS: One thing that must be clarified on future versions of draft is that we will be too pretentious to call a "full-blown" time protocol our proposal, certainly time precision/accuracy is not one of the goals. On Tue, Nov 1, 2016 at 7:10 PM, Randy Presuhn wrote: > Hi - > > On 10/31/2016 11:45 PM, Ludwig Seitz wrote: >> >> On 2016-11-01 01:41, Randy Presuhn wrote: >>> >>> Hi - >>> >>> >>> On 10/31/2016 7:25 AM, Renzo Navas wrote: >>> ... >>>> >>>> The need for a secure source of time is getting clearer on ACE (either >>>> that, or mechanisms to assure freshness of each transaction), and we >>>> hope that with this protocol we are giving the first step to come up >>>> with a constrained-resource friendly solution. >>> >>> ... >>> >>> Along the way to SNMPv3, we learned that a full-blown time >>> protocol isn't actually necessary to provide authentication, >>> timeliness, replay protection, etc. See RFC 3414 for details >>> on how to get these properties cheaply, both from protocol >>> overhead and processing perspectives. >>> >>> Randy >>> >> >> Does your "etc" include expiration of access tokens? > > > The standard access control model (VACM, RFC 3415) does not > rely on "access tokens" - what is (and is not) allowed is > determined the currently configured permissions on the system > whose information is being accessed / modified / published, > and the authenticated identity of the user/entity to which the > information is being delivered or by which it is being modified. > > This may or may not meet your needs. The SNMP design was driven > in part by a requirement for things to work correctly even when > large portions of the internet infrastructure (such as NTP, > PKI, DNS, etc.) were malfunctioning, broken, or under attack, > and to work on systems with minimal (from the perspective > of the late 1980s and extending into the 1990s) capabilities. > Again, this might not be necessary here. It does seem, however, > that what seems like a shortcut here or there can have large > impacts on the ultimate complexity and technology footprint > of a design... > > > Randy > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace From nobody Sun Nov 6 05:52:30 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD5791298BC for ; Sun, 6 Nov 2016 05:52:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alibaba-inc.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cBMcu-gzZmKy for ; Sun, 6 Nov 2016 05:52:26 -0800 (PST) Received: from out0-134.mail.aliyun.com (out0-134.mail.aliyun.com [140.205.0.134]) by ietfa.amsl.com (Postfix) with ESMTP id 7B4B51298C5 for ; Sun, 6 Nov 2016 05:52:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alibaba-inc.com; s=default; t=1478440342; h=Date:Subject:From:To:Message-ID:Mime-version:Content-type; bh=gg27GhEK6wsFg3nWumwyQGJg38FMG4F8HzhJb81MSqw=; b=OYs3O/2dwc+RPvBe+zMPHV62M1Ve1IMeEsFhD62AmdPjeMrxnMcqOtRmhuzKD9gj90OTdrt7ZKU42PDCGjp8HX1emSLPicyfjAcB3ciKNFKVjBQ+2+/AnAeW8X/JTh+fuiNM2IKENRhJl6qbIrhj25+1ZWYcQNrBPUd0Qmirm/U= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R531e4; FP=0|-1|-1|-1|0|-1|-1|-1; HT=e02c03283; MF=kepeng.lkp@alibaba-inc.com; NM=1; PH=DS; RN=2; SR=0; TI=SMTPD_---.78azY9q_1478440330; Received: from 30.39.5.235(mailfrom:kepeng.lkp@alibaba-inc.com ip:42.120.73.202) by smtp.aliyun-inc.com(127.0.0.1); Sun, 06 Nov 2016 21:52:14 +0800 User-Agent: Microsoft-MacOutlook/14.6.8.160830 Date: Sun, 06 Nov 2016 21:52:13 +0800 From: "Kepeng Li" To: ace Message-ID: Thread-Topic: Agenda Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3561313938_1363558" Archived-At: Cc: Hannes Tschofenig Subject: [Ace] Agenda X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Nov 2016 13:52:29 -0000 > ´ËÓʼþʹÓà MIME ¸ñʽ¡£ÓÉÓÚÓʼþÔĶÁ³ÌÐò²»ÄÜʶ±ð ´Ë¸ñʽ£¬Òò´Ë£¬¿ÉÄÜÎÞ·¨Ê¶±ð¸ÃÓʼþµÄ·Ö²¿»ò²¿·ÖÄÚÈÝ¡£ --B_3561313938_1363558 Content-type: text/plain; charset="GB2312" Content-transfer-encoding: 7bit Hi all, Here is a first draft of the agenda for the upcoming meeting: https://datatracker.ietf.org/meeting/97/agenda/ace/ Feedback welcome. Kind Regards Kepeng & Hannes --B_3561313938_1363558 Content-type: text/html; charset="GB2312" Content-transfer-encoding: quoted-printable
Hi all,

Here is a first draft of the = agenda for the upcoming meeting:

F= eedback welcome.

=
Kind Regards
Kepeng & Hannes
--B_3561313938_1363558-- From nobody Mon Nov 7 23:38:51 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C984F12945D for ; Mon, 7 Nov 2016 23:38:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sics.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v2H0JDqaeC-v for ; Mon, 7 Nov 2016 23:38:47 -0800 (PST) Received: from mail-lf0-x229.google.com (mail-lf0-x229.google.com [IPv6:2a00:1450:4010:c07::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A40D1293E4 for ; Mon, 7 Nov 2016 23:38:47 -0800 (PST) Received: by mail-lf0-x229.google.com with SMTP id t196so132742561lff.3 for ; Mon, 07 Nov 2016 23:38:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sics.se; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=QArTSWhYGmHKQmXe3WwO+QlrMgBV4TYDrhWvmYB9fdo=; b=HRnMwt2gNUBLb1rFFuKY+KfOpf22W83puRBEEmgmfsVcuVApMhrrJflREZI3/fwHk4 bBjowQ4Re/+O3fbIscD15HJNwMqWgYasOeOz5XakrjnxxQ6bcO4/q3jArfd3CGM6TaiC Nr1/c+ZdbS8QSlpAtB1lAmnQLf8bMeV7jIUmDpWhKo/8yKq1r2lehZuH2LtI2DZHYEFJ G7ivOJqF+X6hDr1gShcGqC4l+2WHQGCihL2b8dXMiK5u/Ngue6ph8KIqQXdLyF0z40tj rwvqZk0kpkGHRBUYEmUmQLBSL2CGubW+oAzSfF0YCRTtBXxvDvKX8AjsW4Keoem/EDIf E1Zg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=QArTSWhYGmHKQmXe3WwO+QlrMgBV4TYDrhWvmYB9fdo=; b=fVu7AQIWkuBbVdBlhSmcL60/N9wGf0K0tfnxToNWCQPNRXdrBuI1CqWBRzKIIW75Nx fFt1zwO8IIIGhFBnRmcudLTfTcrFTLY/guQveOVZt6lSrO/dxBSZGvta1z4M3ixblAVz +EUY+yEoMdeBxg+5/fzQSFsmN8+qO2EzfDMeyYtnLreHhtOkdImZDTiBsrjzPLfSFdz4 Yp7gGAPAPdEF9nuuv2TdBzLgzhCzLa1V5pU2/HGistyDcZ3sxo4/GZSjKNIPKoC4v80C 9UHIk9sPILig/KVS2mQgsmLf2l671fS4p0ZB0kzU/bBJQRMy9MUrIbKHQbkAWdii4TXf fJQg== X-Gm-Message-State: ABUngvffxZSLRTl7YeKWf7jy8/9/O7/fLvpUfNfTNmXgLW8YfL+hB9nIbM3BIqdyUPmm3gIx X-Received: by 10.25.33.131 with SMTP id h125mr5020455lfh.49.1478590725374; Mon, 07 Nov 2016 23:38:45 -0800 (PST) Received: from [192.168.0.166] ([85.235.12.155]) by smtp.gmail.com with ESMTPSA id 141sm5720820ljf.27.2016.11.07.23.38.44 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 07 Nov 2016 23:38:44 -0800 (PST) To: ace@ietf.org References: From: Ludwig Seitz Message-ID: <02d03aa6-bd8c-ed2c-82b0-8b4bbbabd977@sics.se> Date: Tue, 8 Nov 2016 08:38:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000502040705030705060502" Archived-At: Subject: Re: [Ace] Agenda X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Nov 2016 07:38:50 -0000 This is a cryptographically signed message in MIME format. --------------ms000502040705030705060502 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable On 2016-11-06 14:52, Kepeng Li wrote: > Hi all, > > Here is a first draft of the agenda for the upcoming meeting: > https://datatracker.ietf.org/meeting/97/agenda/ace/ > > Feedback welcome. > > Kind Regards > Kepeng & Hannes Hello chairs, The current agenda lists me for presenting draft-ietf-ace-oauth-authz. Please note that I will not be able to attend IETF 97, I could arrange=20 for a remote presentation, but it would be much more convenient if my=20 co-author Hannes could present in person. /Ludwig --=20 Ludwig Seitz, PhD SICS Swedish ICT AB Ideon Science Park, Building Beta 2 Scheelev=E4gen 17, SE-223 70 Lund Phone +46(0)70-349 92 51 The RISE institutes SP, Swedish ICT and Innventia are merging in order=20 to create a unified institute sector and become a stronger innovation=20 partner for businesses and society. At the end of the year we will=20 change our name to RISE. Read more at www.ri.se/en/about-rise --------------ms000502040705030705060502 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CtQwggTqMIID0qADAgECAhAU4QcxMULaotNy8Yzm2pESMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMzE0MDkzNDMyWhcNMTcwMzE0MDkzNDMyWjA4MRcwFQYDVQQDDA5sdWR3 aWdAc2ljcy5zZTEdMBsGCSqGSIb3DQEJARYObHVkd2lnQHNpY3Muc2UwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9kgmm82Op78D9DXYNJrQW5bUdSxElnOC/CzAK/enHn+uF B/RLo8alI6Ukd35qsAtcje0I3e/RtbkRnkEuhKneH+aDRofy7YaWQO61CjIlcdndTx8FEmXK /swcafYX5PbyzQFGgApwtWFkVXcq3R87CDB3VbkHzTHIBmfwZ4hhDeEyuJoSuWEVWQppfTji /GpVLiDx6s+Zqm3qI5EkjvhQ+jX3tJxXqUf4w1BY6/sBLfvr7TOPGPoAmi6B2UOgyDSfX3c0 +jzlYFLNb6Eqc7uGvaQi7VN39kAJXz9f+qL/wokaNjboK3/JyTG/ikxsWymzO9E0/U9apn2Y z5SVUGSDAgMBAAGjggGxMIIBrTAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFN37NX1Db3Xp23cbQI1MpYPUMw84 MB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggr BgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUFBzAChi1odHRwOi8v YWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYDVR0fBDEwLzAtoCug KYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3JsMBkGA1UdEQQSMBCB Dmx1ZHdpZ0BzaWNzLnNlMCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBG BgNVHSAEPzA9MDsGCysGAQQBgbU3AQIEMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAQEAUy78MN+soYHwIz+6m9mMkzPF KfgIq7sLupWnis7K5U66U9zfKOVDReyfUvPmar7P7Tb9uNNrUlkk3lSISplqU30TMnVbtK5D I0mxdpa1hZxIAa8uWQnAh/oYJJYaMziKxpZgsUjel6/ZnD0z/QsuHo763I1boi2ghe4Knj0f qFO79ErRr9aJJBfQlFVwQ4gRoYtMz18/usC3eqGxFz8a/LCeRMWeZJagGJ/St1WW1HUBmMFd vRFweeUdCvDbzK+WjqbxhXyi7b0sH65lWIjINCBVQ0AvqOwm/aXEWcIQlAIJjr2kEC6c0VY6 V1aP16BAKooEgGGOTrmcDGeteXZRyjCCBeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEw DQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4x KzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMT IFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMw MTIxNjAxMDAwNVowdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAn BgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFy dENvbSBDbGFzcyAxIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AL192vfDon2D9luC/dtbX64eG3XAtRmvmCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGt TCRk9dEDBlmixEd8QiLkUfvHpJX/xKnmVkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdf a89VLnUztRr2cgmCfyO9Otrh7LJDPG+4D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx 7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PIdopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4D IM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuuN0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFg MA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0T AQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNv bS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEEWjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5z dGFydHNzbC5jb20wMAYIKwYBBQUHMAKGJGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRz L2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvv GqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0gBDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wB i4StDwECW5zhIycjBL008HACblIf26HY0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspB OB/y5uzSns1lZwh7sG96bYBZpcGzGxpFNjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvets D+bjyOngCIVeC/GmsmtbuLOzJ606tEc9uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyI NBfCBJb+e29bLafgu6JqjOUJ9eXXj20p6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA 0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOvZ3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf 1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOumZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/ tdfrBzez76xtDsK0KfUDHt1/q59BvDI7RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH 2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO/ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9 VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsNJQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp /2deoprGevfnxWB+vHNQiu85o6MxggPMMIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQG A1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhAU4QcxMULa otNy8Yzm2pESMA0GCWCGSAFlAwQCAQUAoIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcB MBwGCSqGSIb3DQEJBTEPFw0xNjExMDgwNzM4NDRaMC8GCSqGSIb3DQEJBDEiBCBwJ+pM284A woZ/xuIZCIrBLfq2IjKDbYVvx8B3kHJKszBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQB KjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkG A1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVu dCBDQQIQFOEHMTFC2qLTcvGM5tqREjCBnAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBD QQIQFOEHMTFC2qLTcvGM5tqREjANBgkqhkiG9w0BAQEFAASCAQBhttAayU3U4kitAk58cBVH lw6xcNxdQMUHCqP3yPkLNVbmbX1mzjgQVtPXgponSf4VhWEv9QTJCpJPUP8jTQde7THa9U17 5YDM2AsjMHb6u3FAlfI8MsyAFT//NupZEc0TPHS/WouZegnbBowNoox1OUbmi5pdLeHAOz+h A81nG8pg9w824nSJ7/KVM2Lwf00A0aUEJxfSr/dzSBjkSXWY/c598Aww/Dl8h1AFZi1nQNd6 XCm8lGF5DY/SQA9JFP6BO/XHqTcGaeQfabSvjtgJK3TZm6+307Y44MT+yepQZnk8FFvexZjn RfFgdwaer1I/tBkkrJFS9k2QH9StOnQAAAAAAAAA --------------ms000502040705030705060502-- From nobody Sat Nov 12 14:11:34 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 269171294B4 for ; Sat, 12 Nov 2016 14:11:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NROZG0IY7f1E for ; Sat, 12 Nov 2016 14:11:32 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D358A126CD8 for ; Sat, 12 Nov 2016 14:11:31 -0800 (PST) Received: from dooku.sandelman.ca (unknown [182.172.168.109]) by relay.sandelman.ca (Postfix) with ESMTPS id 603E31F906; Sat, 12 Nov 2016 22:11:30 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id F192F3285; Sat, 12 Nov 2016 17:11:27 -0500 (EST) From: Michael Richardson To: ace@ietf.org In-reply-to: References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> Comments: In-reply-to Michael StJohns message dated "Mon, 26 Sep 2016 11:41:52 -0400." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Sun, 13 Nov 2016 07:11:27 +0900 Message-ID: <6108.1478988687@dooku.sandelman.ca> Archived-At: Cc: Michael StJohns Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Nov 2016 22:11:33 -0000 --=-=-= Content-Type: text/plain see inline as well. In the summary, it was unclear if I was against the symmetric method or not. I will admit that I'm sitting on the fence here. I would prefer not to have a standardized symmetric method. My preference would be to start running code that shows the price/performance of asymmetric methods in a lighting context. It would have to be done by a sufficiently resourced group motivated to show positive results. Michael StJohns wrote: >> Without a hat on, you can add my support to Abhinav's proposal. >> Perfect is ideal, but you often can not make any progress if you >> accept nothing less. The security considerations section will have to >> be thorough. > Hi Kathleen et al - > To attain "rough consensus", RFC 7282 requires that "all issues be > addressed" even if not all issues are accommodated. So far the basic > issues of "this is unsafe as a mechanism for 'securing' a control > protocol" or even "how the heck do we keep this off the broader > internet" have not been addressed. > I once again suggest that the lighting folk go off and write something > that they implement as a group, and bring it back to the IETF as an > informational "here's how we did it" document, rather than adopting > this as a WG item. The ONLY thing that even argues for considering > symmetric key multicast (vice asymmetric key multicast) is the latency > claims for lighting. I haven't yet heard of another use case with the > particular combination of cheapness and latency of lighting which would > suggest this particular combination is useful elsewhere. I realize that this thread is months old: I haven't seen any newer conversation, so I'll continue anyway. I would concur with MSJ's view that having an informational draft might be a way to let this work go forward, but I suggest instead the right track might be experimental. I'm less sure that I agree with the subsequent view that we can't adopt this item until we have assurance; I'd say that asking for the issue to be addressed as part of the adoption process is reasonable, and objecting at WGLC if it has not been addressed is the right way. I will say I'm scared that garage door actuators and doors and security systems will be sold with "lighting" interfaces. This same thing happened in USB space: zillions of inappropriate USB devices were given HID designations because the windows drivers were easier to write/get-signed. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYJ5OPAAoJEJVM4Vb9/EKQfRcH/A6iNaZcjy+oWV6u+vDk62SW O7rLz1y5l378bV+ys9IojtM5FTSlbZQU5mrsSeLQbo7DZmpJdLr81uihi/tfgIcw Q/p0CRxE4+ms3EbGee9uiq2lVW5IXAqedqTsndlUb/sFfZqEsRqHRahaQ4OwQe+u JEkDPdUHPhLXvIZLMoOSWSkkgpjbcJhESHXGxIz+vxQ9rrOQhFCxXROVJuNhUXlP CF/Cy75UusxDgwKrV3xhdztTPFSLHbuyxspinSBAViSqSs/akE1vTvXZm4TowYGm m419pgKSkIWzxZtzs0WUkHDImcVdQkgkQFbMO6Me9w8pvozCPKJ3zLst9BMeJl0= =HPzQ -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Nov 12 17:36:07 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB2FC1296C3 for ; Sat, 12 Nov 2016 17:36:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 24JOC-1rlOjC for ; Sat, 12 Nov 2016 17:35:56 -0800 (PST) Received: from resqmta-ch2-10v.sys.comcast.net (resqmta-ch2-10v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8D1B1296BD for ; Sat, 12 Nov 2016 17:35:55 -0800 (PST) Received: from resomta-ch2-18v.sys.comcast.net ([69.252.207.114]) by resqmta-ch2-10v.sys.comcast.net with SMTP id 5ji5coALRRing5ji7czb1S; Sun, 13 Nov 2016 01:35:55 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1479000955; bh=bDYUTHtwYBr+IkC9wXH9uYLtsLxY4fcx9PejxCzE+UA=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=DGOiITufn023jIeLiHSdT2EnysHwqbW19L0XUx5AXlmSLnMkmt90Iyw3ZXn5zIJ6C L0IFN3dcVs8Wol8FJF8P7aZP8KJOAeY+Ql6n46RTAdzNx1j9XeMQh7plFiySDvJDeH cMI1BkZ7ajYyzDU9MTfPLR6IWTGDAMseX5qNuPZidxtPBzvYbxG1sPVTsQCDP3Eprr 81uWknqJ+TTNnqWEPM/9A/MVBxUA8+ngbVjPTVCOB/iLSOpXt1bYIozaHXX73iFfs7 DQaNiuvWuEu8/ULMkeqC9eO+VGbna6wtMazBIzOdC1+aE67Xl8EnX4xst7XkxEiAWP lmvB6e4w06sqA== Received: from [31.133.134.205] ([31.133.134.205]) by resomta-ch2-18v.sys.comcast.net with SMTP id 5jhucVdC5TAgy5jhxc0dIT; Sun, 13 Nov 2016 01:35:52 +0000 To: Michael Richardson , ace@ietf.org References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> From: Michael StJohns Message-ID: <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> Date: Sat, 12 Nov 2016 20:35:48 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <6108.1478988687@dooku.sandelman.ca> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfCZVa9jMdOmiN7Zc9m2p9JF4WOomjJSPOGeF4L0Nk02IA0yXxk1/WfgKv+r1jBXVBZeKeuYbCiIPu5OVXSvT1c85CpnxK4KvdWdqLnQhBqwYktwzKcni OhhQVtVi2udC7Gu0H7fvpdwLyUUGmuOcAxLy7FkujF2c5fbRsolEHusAn16/DSJn0mBf0VxrbyOW6mndX7LImSQXLs+7z1yot0c= Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Nov 2016 01:36:07 -0000 On 11/12/2016 5:11 PM, Michael Richardson wrote: > I realize that this thread is months old: I haven't seen any newer > conversation, so I'll continue anyway. > > I would concur with MSJ's view that having an informational draft might be a > way to let this work go forward, but I suggest instead the right track might > be experimental. I suggested Informational as the IETF has a long history of republishing things developed elsewhere as "Here's how we did it documents". Experimental documents generally describe ideas either where we know there is a way forward, but we're not sure which of several paths work, or ideas where the general utility may not be readily apparent. I could live with experimental/non-WG. > I'm less sure that I agree with the subsequent view that we can't adopt this > item until we have assurance; I'd say that asking for the issue to be > addressed as part of the adoption process is reasonable, and objecting at > WGLC if it has not been addressed is the right way. http://www.techworm.net/2016/11/researchers-use-drones-hijack-philips-hue-smart-lights.html describes how the use of multi-party symmetric key systems weakens even minimal security guarantees in a IOT system. In this article, its noted that the HUE lights have firmware that's signed/encrypted by a symmetric key (which - by definition then needs to be included in every device to decrypt/verify the firmware), and that the attackers were able to extract the key from a lightbulb with relative ease; craft their own firmware and cause the lightbulbs to load it in a chain reaction. There really isn't a lot of difference in the key extraction attack for the above vs extracting a symmetric key used for group communications. The only saving grace in group comms is that the group is smaller than unity. So I'd turn this around and ask for a offer of proof that we can find a way to do this safely *BEFORE* having the IETF invest time and resources in the work. I don't expect a fully fleshed out solution, but I haven't seen even a hint that anyone knows how to mitigate the risks. > > I will say I'm scared that garage door actuators and doors and security > systems will be sold with "lighting" interfaces. This same thing happened in > USB space: zillions of inappropriate USB devices were given HID designations > because the windows drivers were easier to write/get-signed. > At least most of those weren't cyber physical (except maybe the USB nerf turret and its ilk http://weburbanist.com/2009/11/18/truly-geeky-gadgets-15-usb-weapons-from-fail-to-fantastic/). Mike From nobody Sat Nov 12 23:43:03 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02A24129475 for ; Sat, 12 Nov 2016 23:43:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bz2rJHblGBWv for ; Sat, 12 Nov 2016 23:43:00 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAD701293DF for ; Sat, 12 Nov 2016 23:43:00 -0800 (PST) Received: from dooku.sandelman.ca (unknown [211.44.215.72]) by relay.sandelman.ca (Postfix) with ESMTPS id 152071F906; Sun, 13 Nov 2016 07:42:58 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id E32F5321D; Sun, 13 Nov 2016 02:42:54 -0500 (EST) From: Michael Richardson To: Michael StJohns In-reply-to: <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> Comments: In-reply-to Michael StJohns message dated "Sat, 12 Nov 2016 20:35:48 -0500." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Sun, 13 Nov 2016 16:42:54 +0900 Message-ID: <1490.1479022974@dooku.sandelman.ca> Archived-At: Cc: ace@ietf.org Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Nov 2016 07:43:02 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Michael StJohns wrote: >> I'm less sure that I agree with the subsequent view that we can't >> adopt this item until we have assurance; I'd say that asking for the >> issue to be addressed as part of the adoption process is reasonable, >> and objecting at WGLC if it has not been addressed is the right way. > http://www.techworm.net/2016/11/researchers-use-drones-hijack-philips= -hue-smart-lights.html > describes how the use of multi-party symmetric key systems weakens ev= en > minimal security guarantees in a IOT system. In this article, its > noted that the HUE lights have firmware that's signed/encrypted by a > symmetric key (which - by definition then needs to be included in eve= ry > device to decrypt/verify the firmware), and that the attackers were > able to extract the key from a lightbulb with relative ease; craft > their own firmware and cause the lightbulbs to load it in a chain > reaction. I had read all about this, and I wondered how they had gotten the bogus firmware accepted; I thought that this was the "bug", but I hadn't read (or= I had missed) that the firmware was symmetric signed. That's really really d= umb. > So I'd turn this around and ask for a offer of proof that we can find= a > way to do this safely *BEFORE* having the IETF invest time and > resources in the work. I don't expect a fully fleshed out solution, > but I haven't seen even a hint that anyone knows how to mitigate the > risks. I see your point. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYKBl+AAoJEJVM4Vb9/EKQe58IAKIZFrZvcRJemAKSDSTOnJpN /0ISLbI2R2Fxcv9ZtC4qS+jDHl0gC42XTU5PrVTNYKLnNq8/Sg6wddeXJwhU2/43 ebTXij8QtTOohAwP2tt3poA7+Lm3B6UNYwcneJxVJjIjpamMaCzMSAwkOC6L53WY y9qnIg1I+LTbuZk9AO/qEUPeR0hOJxebwH/ycgOcWYGkjhs1cTPdgQscq1PWj4F0 nFRynwUxMM2QMaTqBr5uBqMHc883fi4v1xF0hjOeHYXr8MFSNuKk71UukSfoBE9p GGqceAnZweqXP+C0bvTZogCZ4itpWnw3eEj1iO0Kf7hnqqLQQOs6lLyWdzKMOJI= =IMLu -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Nov 16 06:08:53 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13707127071; Wed, 16 Nov 2016 06:08:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alibaba-inc.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sXKFvvMtWn3O; Wed, 16 Nov 2016 06:08:45 -0800 (PST) Received: from out0-141.mail.aliyun.com (out0-141.mail.aliyun.com [140.205.0.141]) by ietfa.amsl.com (Postfix) with ESMTP id 6E386129460; Wed, 16 Nov 2016 06:08:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alibaba-inc.com; s=default; t=1479305319; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type; bh=m2G/3IwWlQmLCgET60+FF+1BAwMoi/CjmIpzQndBEQg=; b=YkPX0AUcIJzb9MdT6593hZ04qWlXTaOzcLgaCg4n/BtiB7baRZN27LH8XZj47TBql9S0bxBklfsIYvirItmsE82mU6unxrCQFQ1GZbqOUTd1abbBz+glRDv2XT/BLfwIhKuYyGWwKGENkHIA/pvvFLXP7TbOyUiawJ2MfFsGpDk= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R181e4; FP=0|-1|-1|-1|0|-1|-1|-1; HT=e01l10437; MF=kepeng.lkp@alibaba-inc.com; NM=1; PH=DW; RN=2; SR=0; TI=dingding_android.COREAPI8d01b449669343ed999247f47995225b; Received: from WS-web (kepeng.lkp@alibaba-inc.com[10.194.102.56]) by e02c03272.eu6 at Wed, 16 Nov 2016 22:08:28 +0800 Date: Wed, 16 Nov 2016 22:08:28 +0800 From: "Kepeng Li" To: "Ace" Cc: Message-ID: <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> X-Priority: 3 X-Mailer: Alimail-Mailagent revision 37 MIME-Version: 1.0 In-Reply-To: 1490.1479022974@dooku.sandelman.ca References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net>, 1490.1479022974@dooku.sandelman.ca Content-Type: multipart/alternative; boundary="----=ALIBOUNDARY_117874_494f3940_582c685c_313335" Archived-At: Subject: [Ace] =?utf-8?q?Summary_of_ACE_Group_Communication_Security_Discu?= =?utf-8?q?ssion?= X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Nov 2016 14:08:52 -0000 ------=ALIBOUNDARY_117874_494f3940_582c685c_313335 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SGVsbG8gYWxsLMKgIApXZSBoYWQgYSBsb25nIGRpc2N1c3Npb24gYWJvdXQgZ3JvdXAgY29tbXVu aWNhdGlvbiBzZWN1cml0eSB0b3BpYyBzaW5jZSB0aGUgcHJldmlvdXMgRjJGIG1lZXRpbmcuCkhh bm5lcyBhbmQgSSBoYXZlIHRyaWVkIHRvIG1ha2UgYSBzdW1tYXJ5IGFib3V0IHRoZSBkaXNjdXNz aW9uIGFzIGZvbGxvd3M6CsK3wqDCoMKgwqDCoMKgIFRoZSBzb2x1dGlvbiBuZWVkcyB0byBkZWZp bmUgYm90aCwgc3ltbWV0cmljIGFuZCBhbiBhc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbi4g CsK3wqDCoMKgwqDCoMKgIFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9uIHNlY3Rpb24gbmVlZHMg dG8gZXhwbGFpbiB1bmRlciB3aGF0IGNpcmN1bXN0YW5jZXMgd2hhdCBzb2x1dGlvbiBpcyBhcHBy b3ByaWF0ZS4gCklmIHRoaXMgaXMgbm90IGFjY3VyYXRlLCBwbGVhc2UgbGV0IHVzIGtub3cuCktp bmQgUmVnYXJkcwoKS2VwZW5nICYgSGFubmVzCkJUVzogaXQgaXMgYSBwaXR5IHRoYXQgSSBjYW4n dCBhdHRlbmQgdGhpcyBtZWV0aW5nIGR1ZSB0byBwZXJzb25hbCByZWFzb25zLCBhbmQgaG9wZSB5 b3UgYWxsIGhhdmUgYSBuaWNlIG1lZXRpbmcgaW4gU2VvdWwhCg== ------=ALIBOUNDARY_117874_494f3940_582c685c_313335 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: base64 PHA+SGVsbG8gYWxsLCZuYnNwOyA8L3A+CjxwPldlIGhhZCBhIGxvbmcgZGlzY3Vzc2lvbiBhYm91 dCBncm91cCBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHRvcGljIHNpbmNlIHRoZSBwcmV2aW91cyBG MkYgbWVldGluZy48L3A+CjxwPkhhbm5lcyBhbmQgSSBoYXZlIHRyaWVkIHRvIG1ha2UgYSBzdW1t YXJ5IGFib3V0IHRoZSBkaXNjdXNzaW9uIGFzIGZvbGxvd3M6PC9wPgo8cD4mIzE4MzsmIzE2MDsm IzE2MDsmIzE2MDsmIzE2MDsmIzE2MDsmIzE2MDsgVGhlIHNvbHV0aW9uIG5lZWRzIHRvIGRlZmlu ZSBib3RoLCBzeW1tZXRyaWMgYW5kIGFuIGFzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0aW9uLiA8 L3A+CjxwPiYjMTgzOyYjMTYwOyYjMTYwOyYjMTYwOyYjMTYwOyYjMTYwOyYjMTYwOyBUaGUgc2Vj dXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIgd2hhdCBj aXJjdW1zdGFuY2VzIHdoYXQgc29sdXRpb24gaXMgYXBwcm9wcmlhdGUuIDwvcD4KPHA+SWYgdGhp cyBpcyBub3QgYWNjdXJhdGUsIHBsZWFzZSBsZXQgdXMga25vdy48L3A+CjxwPktpbmQgUmVnYXJk czxicj4KS2VwZW5nICZhbXA7IEhhbm5lczwvcD4KPHA+QlRXOiBpdCBpcyBhIHBpdHkgdGhhdCBJ IGNhbid0IGF0dGVuZCB0aGlzIG1lZXRpbmcgZHVlIHRvIHBlcnNvbmFsIHJlYXNvbnMsIGFuZCBo b3BlIHlvdSBhbGwgaGF2ZSBhIG5pY2UgbWVldGluZyBpbiBTZW91bCE8L3A+Cg== ------=ALIBOUNDARY_117874_494f3940_582c685c_313335-- From nobody Wed Nov 16 06:29:59 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96B88129620; Wed, 16 Nov 2016 06:29:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alibaba-inc.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wrnEEnXDROcf; Wed, 16 Nov 2016 06:29:57 -0800 (PST) Received: from out0-129.mail.aliyun.com (out0-129.mail.aliyun.com [140.205.0.129]) by ietfa.amsl.com (Postfix) with ESMTP id 5AB551297C2; Wed, 16 Nov 2016 06:29:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alibaba-inc.com; s=default; t=1479306591; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type; bh=5DvjFO9V1rXO9lEG5FHEiUkHA0BX8RU2cGsLXYVpK2U=; b=hhSLSySI/fh1584v7BNbxf1drCxGgh7PC77OQFyb81tmwhU7gplZ5j0BdgVncQ2oFFSXRcEFPvSzd0qK9lyFA2YO+gzZMhhmZY98IR/CJXylgrDhLcG9D3GF1t9hRthHKLhxectbLOCRN7sQyM2Y/X1sbNPyUKEXQW9ww2DYUsQ= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R361e4; FP=0|-1|-1|-1|0|-1|-1|-1; HT=e02c03280; MF=kepeng.lkp@alibaba-inc.com; NM=1; PH=DW; RN=2; SR=0; TI=dingding_android.COREAPId6527998228e4b619f78adbb3281f186; Received: from WS-web (kepeng.lkp@alibaba-inc.com[10.194.100.154]) by e01l07395.eu6 at Wed, 16 Nov 2016 22:29:42 +0800 Date: Wed, 16 Nov 2016 22:29:42 +0800 From: "Kepeng Li" To: "Ace" Cc: Message-ID: X-Priority: 3 X-Mailer: Alimail-Mailagent revision 37 MIME-Version: 1.0 In-Reply-To: 7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net>, 1490.1479022974@dooku.sandelman.ca, 7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com Content-Type: multipart/alternative; boundary="----=ALIBOUNDARY_27833_57e08940_582c6d56_31463e" Archived-At: Subject: [Ace] =?utf-8?q?Slides_for_the_Seoul_F2F_meeting?= X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Nov 2016 14:29:58 -0000 ------=ALIBOUNDARY_27833_57e08940_582c6d56_31463e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SGVsbG8gYWxsLApXZSBhcmUgc3RpbGwgbWlzc2luZyBzb21lIHNsaWRlcyBmb3Igc29tZSBvZiB0 aGUgYWdlbmRhIGl0ZW1zLgpEb2N1bWVudCBhdXRob3JzIC8gcHJlc2VudGVycywgcGxlYXNlIHNl bmQgeW91ciBzbGlkZXMgdG8gdXMgKGNvLWNoYWlycyBhbmQgYWN0aW5nIGNoYWlycykgQVNBUC4K QlRXOiBkcmFmdCBhZ2VuZGEgaXMgYmVsb3cuCktpbmQgUmVnYXJkcwoKS2VwZW5nCkFDRSBXRyBN ZWV0aW5nCgpJRVRGIDk3IC0gU2VvdWwKClRodXJzZGF5LCAxNyBOb3YsIDIwMTYsIDE1OjIwIC0g MTc6NTAgCgpDaGFpcnM6IEtlcGVuZyBMaSwgSGFubmVzIFRzY2hvZmVuaWcKCkFjdGluZyBjaGFp cnM6IEJhcnJ5IExlaWJhLCBOYW5jeSBDYW0tV2luZ2V0CiogQWdlbmRhIEJhc2hpbmcgKENoYWly cywgNSBtaW4pCiogQWN0b3JzIChDYXJzdGVuIEJvcm1hbm4sIDUgbWluKQoKLSBodHRwOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtYWNlLWFjdG9ycy8KKiBDQk9SIFdlYiBU b2tlbiAoTWljaGFlbCBCLiBKb25lcywgNSBtaW5zKQoKLSBodHRwczovL2RhdGF0cmFja2VyLmll dGYub3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1jYm9yLXdlYi10b2tlbi8KKiBBdXRob3JpemF0aW9u IHVzaW5nIE9BdXRoIDIuMCAoTHVkd2lnIFNlaXR6LCBSZW1vdGUsIDMwIG1pbikKCi0gaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHovCiog U2VjdXJpdHkgZm9yIExvdy1MYXRlbmN5IEdyb3VwIENvbW11bmljYXRpb24gKFRCRCwgMzAgbWlu cykKCi0gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtc29tYXJhanUtYWNl LW11bHRpY2FzdC8KKiBFcGhlbWVyYWwgRGlmZmllLUhlbGxtYW4gT3ZlciBDT1NFIChKb2huIE1h dHRzc29uLCAyMCBtaW5zKQoKLSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFm dC1zZWxhbmRlci1hY2UtY29zZS1lY2RoZS8KKiBPU0NPQVAgcHJvZmlsZSBvZiBBQ0XCoCAoRnJh bmNlc2NhIFBhbG9tYmluaSwgMjAgbWluKQoKLSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2RvYy9kcmFmdC1zZWl0ei1hY2Utb3Njb2FwLXByb2ZpbGUvCiogRFRMUyBQcm9maWxlIGZvciBB Q0UgKENhcnN0ZW4gQm9ybWFubiwgMjAgbWlucykKCi0gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtZ2VyZGVzLWFjZS1kdGxzLWF1dGhvcml6ZS8KKiBMaWdodHdlaWdodCBB dXRoZW50aWNhdGVkIFRpbWUgKExBVGUpIFN5bmNocm9uaXphdGlvbiBQcm90b2NvbCAoUmVuem8g TmF2YXMsIFJlbW90ZSwgMTAgbWlucykKCi0gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvZHJhZnQtbmF2YXMtYWNlLXNlY3VyZS10aW1lLXN5bmNocm9uaXphdGlvbi8KKiBXcmFwLXVw IChDaGFpcnMsIDUgbWluKQoK ------=ALIBOUNDARY_27833_57e08940_582c6d56_31463e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: base64 PHA+SGVsbG8gYWxsLDwvcD4KPHA+V2UgYXJlIHN0aWxsIG1pc3Npbmcgc29tZSBzbGlkZXMgZm9y IHNvbWUgb2YgdGhlIGFnZW5kYSBpdGVtcy48L3A+CjxwPkRvY3VtZW50IGF1dGhvcnMgLyBwcmVz ZW50ZXJzLCBwbGVhc2Ugc2VuZCB5b3VyIHNsaWRlcyB0byB1cyAoY28tY2hhaXJzIGFuZCBhY3Rp bmcgY2hhaXJzKSBBU0FQLjwvcD4KPHA+QlRXOiBkcmFmdCBhZ2VuZGEgaXMgYmVsb3cuPC9wPgo8 cD5LaW5kIFJlZ2FyZHM8YnI+CktlcGVuZzwvcD4KPHA+QUNFIFdHIE1lZXRpbmc8YnI+CklFVEYg OTcgLSBTZW91bDxicj4KVGh1cnNkYXksIDE3IE5vdiwgMjAxNiwgMTU6MjAgLSAxNzo1MCA8YnI+ CkNoYWlyczogS2VwZW5nIExpLCBIYW5uZXMgVHNjaG9mZW5pZzxicj4KQWN0aW5nIGNoYWlyczog QmFycnkgTGVpYmEsIE5hbmN5IENhbS1XaW5nZXQ8L3A+CjxwPiogQWdlbmRhIEJhc2hpbmcgKENo YWlycywgNSBtaW4pPC9wPgo8cD4qIEFjdG9ycyAoQ2Fyc3RlbiBCb3JtYW5uLCA1IG1pbik8YnI+ Ci0gaHR0cDovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1hY3RvcnMv PC9wPgo8cD4qIENCT1IgV2ViIFRva2VuIChNaWNoYWVsIEIuIEpvbmVzLCA1IG1pbnMpPGJyPgot IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtYWNlLWNib3Itd2Vi LXRva2VuLzwvcD4KPHA+KiBBdXRob3JpemF0aW9uIHVzaW5nIE9BdXRoIDIuMCAoTHVkd2lnIFNl aXR6LCBSZW1vdGUsIDMwIG1pbik8YnI+Ci0gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHovPC9wPgo8cD4qIFNlY3VyaXR5IGZvciBMb3ct TGF0ZW5jeSBHcm91cCBDb21tdW5pY2F0aW9uIChUQkQsIDMwIG1pbnMpPGJyPgotIGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXNvbWFyYWp1LWFjZS1tdWx0aWNhc3QvPC9w Pgo8cD4qIEVwaGVtZXJhbCBEaWZmaWUtSGVsbG1hbiBPdmVyIENPU0UgKEpvaG4gTWF0dHNzb24s IDIwIG1pbnMpPGJyPgotIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXNl bGFuZGVyLWFjZS1jb3NlLWVjZGhlLzwvcD4KPHA+KiBPU0NPQVAgcHJvZmlsZSBvZiBBQ0UmIzE2 MDsgKEZyYW5jZXNjYSBQYWxvbWJpbmksIDIwIG1pbik8YnI+Ci0gaHR0cHM6Ly9kYXRhdHJhY2tl ci5pZXRmLm9yZy9kb2MvZHJhZnQtc2VpdHotYWNlLW9zY29hcC1wcm9maWxlLzwvcD4KPHA+KiBE VExTIFByb2ZpbGUgZm9yIEFDRSAoQ2Fyc3RlbiBCb3JtYW5uLCAyMCBtaW5zKTxicj4KLSBodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1nZXJkZXMtYWNlLWR0bHMtYXV0aG9y aXplLzwvcD4KPHA+KiBMaWdodHdlaWdodCBBdXRoZW50aWNhdGVkIFRpbWUgKExBVGUpIFN5bmNo cm9uaXphdGlvbiBQcm90b2NvbCAoUmVuem8gTmF2YXMsIFJlbW90ZSwgMTAgbWlucyk8YnI+Ci0g aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtbmF2YXMtYWNlLXNlY3VyZS10 aW1lLXN5bmNocm9uaXphdGlvbi88L3A+CjxwPiogV3JhcC11cCAoQ2hhaXJzLCA1IG1pbik8YnI+ PC9wPgo= ------=ALIBOUNDARY_27833_57e08940_582c6d56_31463e-- From nobody Wed Nov 16 21:50:13 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F93F12964F for ; Wed, 16 Nov 2016 21:50:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.196 X-Spam-Level: X-Spam-Status: No, score=-4.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7O35_GUjmrcc for ; Wed, 16 Nov 2016 21:50:06 -0800 (PST) Received: from resqmta-ch2-07v.sys.comcast.net (resqmta-ch2-07v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AEE31295DB for ; Wed, 16 Nov 2016 21:50:06 -0800 (PST) Received: from resomta-ch2-15v.sys.comcast.net ([69.252.207.111]) by resqmta-ch2-07v.sys.comcast.net with SMTP id 7FaHceyI4ff8q7FaHcf85a; Thu, 17 Nov 2016 05:50:05 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1479361805; bh=HqUzktnwyRNFQwJUpeizMexl8ntv4RVlN0pbYofE1lA=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=WfyfRNEoqWukNest935+cilB7NumKrO7PrQYhHw54IZ1qp8lRzjf9PmMi8orpVyMY NfLwtkOnFOZZJB40ox/FMzk/PBlDbx7fqznrLjYdEKLt5wBj6Nj5dwhDQ2klROa/lF 88ofP68tALMuxITZX66V33WXQSTJ+zq1ARf5o/u0ycPJa2uLyZOK8qA8p5eSjKw5+b kye4ajGeqzGRde63GKftFXrRyEXXios6PLQrDLT6WCM8Ye2ETRuVrvI+FJ4+a+CGqq e9sIZ1uGy9PUnRVIRfZ6ku1jWgCbPWjbHRDm4MpoLTtONEXLnibmsjVOyucz7Q0+yN XgFi/KRFeW67A== Received: from [IPv6:2001:67c:370:144:a89a:c353:cdd3:bb57] ([IPv6:2001:67c:370:144:a89a:c353:cdd3:bb57]) by resomta-ch2-15v.sys.comcast.net with SMTP id 7Fa3cXeHP0G8A7Fa9cG7t9; Thu, 17 Nov 2016 05:50:03 +0000 To: ace@ietf.org References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> From: Michael StJohns Message-ID: <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> Date: Thu, 17 Nov 2016 00:50:00 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> Content-Type: multipart/alternative; boundary="------------ACD31C6068427B0031E57060" X-CMAE-Envelope: MS4wfIDzl/X61oBxOpbteDQ1jlR5bCWjL25VdPb1OEp0yIZTiiUjV43SkqsW/x52ErG/gdImx0S1Tq2t7y65vsm2i+wjNbs+go81D2AJ6qeN0N+uItIGxVwE paddy5A7YG89DUfXZtcBTkDyDEqVwRj4eXdUD3vaNEGYo4zSOTHsRIcYME40cCuPlwKbwdeC9Mm7Ng== Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 05:50:08 -0000 This is a multi-part message in MIME format. --------------ACD31C6068427B0031E57060 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit On 11/16/2016 9:08 AM, Kepeng Li wrote: > > Hello all, > > We had a long discussion about group communication security topic > since the previous F2F meeting. > > Hannes and I have tried to make a summary about the discussion as follows: > > · The solution needs to define both, symmetric and an asymmetric > group key solution. > There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure. I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important". Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)? The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems. E.g. lightbulbs. Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea. > · The security consideration section needs to explain under what > circumstances what solution is appropriate. > Security consideration sections generally only address the threat *to* the system from security choices. In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices. An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet. Mike > If this is not accurate, please let us know. > > Kind Regards > Kepeng & Hannes > > BTW: it is a pity that I can't attend this meeting due to personal > reasons, and hope you all have a nice meeting in Seoul! > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --------------ACD31C6068427B0031E57060 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".


Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

·       The security consideration section needs to explain under what circumstances what solution is appropriate.


Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.

Mike


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--------------ACD31C6068427B0031E57060-- From nobody Wed Nov 16 23:28:46 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 669981295AF for ; Wed, 16 Nov 2016 23:28:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DiJhQm2e0-xI for ; Wed, 16 Nov 2016 23:28:44 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE312129467 for ; Wed, 16 Nov 2016 23:28:43 -0800 (PST) Received: from dooku.sandelman.ca (dhcp-8d96.meeting.ietf.org [31.133.141.150]) by relay.sandelman.ca (Postfix) with ESMTPS id 6971A1F8F0 for ; Thu, 17 Nov 2016 07:28:41 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 663B028A4; Thu, 17 Nov 2016 16:28:39 +0900 (KST) From: Michael Richardson To: ace@ietf.org In-reply-to: <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> Comments: In-reply-to Michael StJohns message dated "Thu, 17 Nov 2016 00:50:00 -0500." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Thu, 17 Nov 2016 16:28:39 +0900 Message-ID: <1956.1479367719@dooku.sandelman.ca> Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 07:28:45 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Michael StJohns wrote: > The multiparty (group) symmetric key solution is only wanted for a > single corner of the solution space - low latency, no cost > systems. E.g. lightbulbs. Given there is a worked example of the > insecurity of multiparty symmetric key systems (e.g. the attack on the > symmetric signing key of the HUE lights), I'm unclear why anyone at a= ll > would think that pursuing a known bad solution in the IETF is a good > idea. Also, there is the question about cost, so look at: https://www.ietf.org/proceedings/97/slides/slides-97-lwig-2-lightweight-c= rypto-00.pdf From=20this morning. 261ms for k163 on a specific device. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJYLVwnAAoJEJVM4Vb9/EKQWlQH/jk9TXhafVo8pmxQV43GSTXC yac4aYC3VtoaLr9rtSDMnb3zjg31lIOUrlnA1kdrDYZCKoQz9okiHUwr79TSMRk9 oYOMkAyqVCK8t7cBueWuYUpmQq/A0dmZUxAhXELEt1OZu7wuKjWNdmTTpGIgNHv1 ukdxoWJZSAB/JoEpckZIXII5e7C2dSrdvdbsjY3YoN9VTvKenAqMRbon2kIQBdx3 hdQ2Wt/H/b2XNymByu4cTIYPSvPUQuAonOyiud0Bb/pFEwKkymfGQmetXiWuRCgT J/yk4cVs2OMYey2hfL8D82NB1JdiGmGZpZ5+7EYQNAqNdN2rugIn79JyD50Ozvg= =UMvt -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Nov 17 06:26:48 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DE7512996A for ; Thu, 17 Nov 2016 06:26:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQp70-smB5VK for ; Thu, 17 Nov 2016 06:26:45 -0800 (PST) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D9AB1297ED for ; Thu, 17 Nov 2016 06:26:45 -0800 (PST) Received: by mail-it0-x233.google.com with SMTP id c20so280500910itb.0 for ; Thu, 17 Nov 2016 06:26:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=sDBWNg/98qKI05rIaujMuUlj1d3I9XE4R8OnLtRx9Cg=; b=ZJ4FUJbpqDvDTV6wuf8FDATZCK6lkaTT+YTZVHb30bg8mM1KsCJfvmrI/dnndXxOMz e+vzPmP3qTWkNYsz2hWEyYpKfNqFuPQPdP8LqRS9LCq+I5s8veNUsOSzadFBpFBztEM+ 9PlJTldwtf2HqFJzENyTGvwfAbuqyrubyJ2/SRMDtiv4yV0M/4JvASDGLRCdef2FanKd RbQYkFAQsqBDIOStkhXmryxE7GYvgbzY1f4Pi45KD+/OT7wu9d4NdeBy1dasAcr0pobF aERV8nQ/fGfTK1dDffMqMnAX9ddofrldcmzfWGKXYu6zyLZSUAxx8UZHYR7FxUJ2aD4t Fkmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=sDBWNg/98qKI05rIaujMuUlj1d3I9XE4R8OnLtRx9Cg=; b=JABXbi+dgGn+qO5R+3DsvtDJXjF09IogJZK8tJOS0PeAPIqCxZnJ7NahS4r/4tOp/f KyAECMfg/rh64TeMlSQGCZxP4RSGbdmxEjFDFiTI03jJLoBEMkS/KjMeEtyu/Lq7f3N3 03NpoME2A3wOV0ORrNoZcIGstxzaTtQuPv862E9uf0V5qwAypgj8RPck5dURbum0RwSd 2iYkf/5MelLkWX7pL68tXM3jieLtLm4LxrU8kvQ07tEk+OwgMXEZ0CVPtLZvbtFf2Ysl UOsp2McdCBV200IW2Xsve8RW60kJlrP87vGB/SiaknARxw2XU6LQ11z2nm/6CrBtgcar ijNw== X-Gm-Message-State: AKaTC01qt1u8gBfTtvz0OUJ4DJKzl6dSIiIEZ/ujWnGbiRH6/pQ8KMJEZI+1Q6diT3TsBA== X-Received: by 10.107.10.35 with SMTP id u35mr3071385ioi.124.1479392803929; Thu, 17 Nov 2016 06:26:43 -0800 (PST) Received: from [192.168.0.14] (CPE7cb21b2cb904-CM7cb21b2cb901.cpe.net.cable.rogers.com. [174.112.186.144]) by smtp.gmail.com with ESMTPSA id s13sm1307916ioi.24.2016.11.17.06.26.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Nov 2016 06:26:43 -0800 (PST) To: Michael StJohns , ace@ietf.org References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> From: Rene Struik Message-ID: Date: Thu, 17 Nov 2016 09:26:32 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> Content-Type: multipart/alternative; boundary="------------9059CEC1217759B97667B1B0" Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 14:26:47 -0000 This is a multi-part message in MIME format. --------------9059CEC1217759B97667B1B0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Dear colleagues: Just a reminder re perceived technical hurdles for using signatures: a) time latency of signing: One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies. Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 b): further speed-ups/tricks, etc: One can try and be smarter by clever implementations. Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI This seems to take the time latency argument away. The only other technical hurdles I can see are (i) signature size {is 64B too much?}; (ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}. As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152. So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}. On 11/17/2016 12:50 AM, Michael StJohns wrote: > On 11/16/2016 9:08 AM, Kepeng Li wrote: >> >> Hello all, >> >> We had a long discussion about group communication security topic >> since the previous F2F meeting. >> >> Hannes and I have tried to make a summary about the discussion as >> follows: >> >> · The solution needs to define both, symmetric and an >> asymmetric group key solution. >> > > There is no case (absent hardware mitigation) in which a symmetric > group key solution can be made secure/safe and no one has made an > offer of proof that they can make it secure. I've asked repeatedly > - no one has come forward with more than "oh we can lock the symmetric > key stuff in a corner and make sure it isn't used for anything important". > > > Given the recent attacks on the internet by IOT botnets, there is a > further consideration that should be undertaken - whether the > symmetric group key solution applied to 10s of 1000s of IOT devices is > an active threat to the rest of the internet (e.g. enabling DDOS, > cyber physical issues, etc)? > > The multiparty (group) symmetric key solution is only wanted for a > single corner of the solution space - low latency, no cost systems. > E.g. lightbulbs. Given there is a worked example of the insecurity of > multiparty symmetric key systems (e.g. the attack on the symmetric > signing key of the HUE lights), I'm unclear why anyone at all would > think that pursuing a known bad solution in the IETF is a good idea. > >> · The security consideration section needs to explain under >> what circumstances what solution is appropriate. >> > > Security consideration sections generally only address the threat *to* > the system from security choices. In this case, symmetric key group > comms reduces down to the same security analysis you would use with > shared default passwords across 1000s of devices. An IOT security > consideration section in the future probably needs to address the > threat *FROM* the IOT solution to the broader internet. > > Mike > > >> If this is not accurate, please let us know. >> >> Kind Regards >> Kepeng & Hannes >> >> BTW: it is a pity that I can't attend this meeting due to personal >> reasons, and hope you all have a nice meeting in Seoul! >> >> >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace > > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace -- email: rstruik.ext@gmail.com | Skype: rstruik cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 --------------9059CEC1217759B97667B1B0 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".


Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

·       The security consideration section needs to explain under what circumstances what solution is appropriate.


Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.

Mike


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace





_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace



-- 
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
--------------9059CEC1217759B97667B1B0-- From nobody Thu Nov 17 16:00:36 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C25DC129581 for ; Thu, 17 Nov 2016 16:00:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.998 X-Spam-Level: X-Spam-Status: No, score=-0.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDMQDg493i96 for ; Thu, 17 Nov 2016 16:00:32 -0800 (PST) Received: from mail-pg0-x22c.google.com (mail-pg0-x22c.google.com [IPv6:2607:f8b0:400e:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBECD129573 for ; Thu, 17 Nov 2016 16:00:32 -0800 (PST) Received: by mail-pg0-x22c.google.com with SMTP id p66so96350889pga.2 for ; Thu, 17 Nov 2016 16:00:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WaWI2wAnpfM2vIyaUyMxpUHsWvD+BLSXQQqmGwdEpzo=; b=kk7qOPxKM+CTa5xpk7RZK0C4MZNM/+9DfjboTGZvfRQV19SEhhjP6cUg9RaKO+DgWd yLE8eolLr1f+gJdW80fw8E7JJSgDxRHxZi6AY+CHi6n4+1pbDsUdnXgmdKG042hb9hb8 hc3gyJ8gK98rMX5sLhBD/LkchdPUn/sJd/rzR/5ZvpLUSJixl9MBcdLln5OL7ZYxuN5W sGF0fv0XUpgP5U1fshjW79tvk0GjOztLJCQoEA4fnOVvjFEnZyxRfzsuP4wQ1WLF9Iph QMHW5rxw6CoSTTKOuf+b4syWe+1awjtM/WpTWTj0GwJa/Sc9eMAxqTaw4AOzAwmclgXH y9OA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WaWI2wAnpfM2vIyaUyMxpUHsWvD+BLSXQQqmGwdEpzo=; b=CWegzdC/mstg5VC/go3VFBTyHfosCJOW+oWHAxfxNbUNgvtvH+tqrFQW83fYh5dAa1 nWeIWDZNZ+rEq8NsHs9n12y8n80i9BFEXxqRRt5BHNV3840B+FpnlTH8LHS9Jlbch/uJ swFFfuyEO/BMqUdiPiv1Ee2fQs59g67WwtFsQ9ED40ip3q90o7+BlTXCxBnAm9YYZTu0 28RnN9F5XvT2LEWeAEd/vVQRz4BiQZE94riWbpczi8A6Xjc0j0gbaORYZTKXPD+GudpW g48hVU/yGnef6WpcrujaKKwMs+DDZ1OkV90bfrfCkjMMgy+aT6d/5N6am5IQpsA1eKfD ElNw== X-Gm-Message-State: AKaTC00sbqXNkLhp9kxOOJZmbz9A3ymZvceJJAQpMD8nlSknDWDT7AtX5R0pZIZYR3eueQ== X-Received: by 10.99.213.21 with SMTP id c21mr899861pgg.137.1479427232243; Thu, 17 Nov 2016 16:00:32 -0800 (PST) Received: from ?IPv6:2001:67c:370:128:cc1d:5c3d:ed43:9572? ([2001:67c:370:128:cc1d:5c3d:ed43:9572]) by smtp.gmail.com with ESMTPSA id y200sm6011638pfb.16.2016.11.17.16.00.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Nov 2016 16:00:31 -0800 (PST) Content-Type: multipart/alternative; boundary=Apple-Mail-10A28545-F879-4086-947A-B4BD446BFFB1 Mime-Version: 1.0 (1.0) From: kathleen.moriarty.ietf@gmail.com X-Mailer: iPhone Mail (14B100) In-Reply-To: Date: Fri, 18 Nov 2016 09:00:25 +0900 Content-Transfer-Encoding: 7bit Message-Id: <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> To: Rene Struik Archived-At: Cc: Michael StJohns , ace@ietf.org Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 00:00:35 -0000 --Apple-Mail-10A28545-F879-4086-947A-B4BD446BFFB1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Is anyone willing to work on a draft to be ready in advance of the Chicago m= eeting so we have a concrete proposal for asymmetric keys? Thanks, Kathleen=20 Please excuse typos, sent from handheld device=20 > On Nov 17, 2016, at 11:26 PM, Rene Struik wrote: >=20 > Dear colleagues: >=20 > Just a reminder re perceived technical hurdles for using signatures: > a) time latency of signing: > One can pre-compute ephemeral signing keys, so as to reduce online key com= putation to a few finite field multiplies.=20 > Please see my email to the list of July 26, 2016: https://mailarchive.ietf= .org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 > b): further speed-ups/tricks, etc: > One can try and be smarter by clever implementations. > Please see my email to the list of July 21, 2016: https://mailarchive.ietf= .org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI >=20 > This seems to take the time latency argument away. The only other technica= l hurdles I can see are=20 > (i) signature size {is 64B too much?};=20 > (ii) cost of public key crypto implementations {quite some small, nifty de= signs out there (NaCl etc.}. >=20 > As to (i) - one should view signature sizes in perspective: as an example,= key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips)= has key sizes of 6.25 kB and up, according to Table 3 of the paper that mas= sages parameters to thwart new attacks on their scheme, see http://eprint.ia= cr.org/2016/152. >=20 > So, security arguments that favor asymmetric solutions aside, there also d= o not seem to be too many other objections that would hold in the world anno= 2016 {except for "sunk investment" arguments", but that is a corporate mind= set issue}. >=20 >> On 11/17/2016 12:50 AM, Michael StJohns wrote: >>> On 11/16/2016 9:08 AM, Kepeng Li wrote: >>> Hello all,=20 >>>=20 >>> We had a long discussion about group communication security topic since t= he previous F2F meeting. >>>=20 >>> Hannes and I have tried to make a summary about the discussion as follow= s: >>>=20 >>> =C2=B7 The solution needs to define both, symmetric and an asymmet= ric group key solution. >>>=20 >>=20 >> There is no case (absent hardware mitigation) in which a symmetric group k= ey solution can be made secure/safe and no one has made an offer of proof th= at they can make it secure. I've asked repeatedly - no one has come forwa= rd with more than "oh we can lock the symmetric key stuff in a corner and ma= ke sure it isn't used for anything important". >>=20 >>=20 >> Given the recent attacks on the internet by IOT botnets, there is a furth= er consideration that should be undertaken - whether the symmetric group key= solution applied to 10s of 1000s of IOT devices is an active threat to the r= est of the internet (e.g. enabling DDOS, cyber physical issues, etc)? >>=20 >> The multiparty (group) symmetric key solution is only wanted for a single= corner of the solution space - low latency, no cost systems. E.g. lightbul= bs. Given there is a worked example of the insecurity of multiparty symmetr= ic key systems (e.g. the attack on the symmetric signing key of the HUE ligh= ts), I'm unclear why anyone at all would think that pursuing a known bad sol= ution in the IETF is a good idea. >>=20 >>> =C2=B7 The security consideration section needs to explain under w= hat circumstances what solution is appropriate. >>>=20 >>=20 >> Security consideration sections generally only address the threat *to* th= e system from security choices. In this case, symmetric key group comms red= uces down to the same security analysis you would use with shared default pa= sswords across 1000s of devices. An IOT security consideration secti= on in the future probably needs to address the threat *FROM* the IOT s= olution to the broader internet. >>=20 >> Mike >>=20 >>=20 >>> If this is not accurate, please let us know. >>>=20 >>> Kind Regards >>> Kepeng & Hannes >>>=20 >>> BTW: it is a pity that I can't attend this meeting due to personal reaso= ns, and hope you all have a nice meeting in Seoul! >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> Ace mailing list >>> Ace@ietf.org >>> https://www.ietf.org/mailman/listinfo/ace >>=20 >>=20 >>=20 >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >=20 >=20 > --=20 > email: rstruik.ext@gmail.com | Skype: rstruik > cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --Apple-Mail-10A28545-F879-4086-947A-B4BD446BFFB1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Is anyone willing to work on a draft t= o be ready in advance of the Chicago meeting so we have a concrete proposal f= or asymmetric keys?

Thanks,
Kathleen&nb= sp;

Please excuse typos, sent from handheld device 
On Nov 17, 2016, at 11:26 PM, Rene Struik <rstruik.ext@gmail.com> wrote:

=20 =20 =20
Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arc= h/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arc= h/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

=C2=B7       The solution needs to d= efine both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've as= ked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".


Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example o= f the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

=C2=B7       The security considera= tion section needs to explain under what circumstances what solution is appropriate.


Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices. =   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.

Mike


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace=






_______________________________________________
Ace mailing list
Ace@ietf.=
org
https://www.ietf.org/mailman/listinfo/ace



--=20
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
=20
____________________= ___________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/lis= tinfo/ace
= --Apple-Mail-10A28545-F879-4086-947A-B4BD446BFFB1-- From nobody Thu Nov 17 19:56:16 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 820C81294B9 for ; Thu, 17 Nov 2016 19:56:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.517 X-Spam-Level: X-Spam-Status: No, score=-15.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dTBsFczZyB8c for ; Thu, 17 Nov 2016 19:56:13 -0800 (PST) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DB181293D6 for ; Thu, 17 Nov 2016 19:56:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=22110; q=dns/txt; s=iport; t=1479441373; x=1480650973; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=0U0fKjEmPuGoZcfsbKfY9nxCwZ0LvHJsxwthT5k91t0=; b=Z7pgSR+UJgpqz72mYYBsS7OS812Z8WUdtqBQxiiBe2fXyrFg1NEkIp4L ODqQtJ5fmVd0rclOGnR079WLAbQc7TfIe9rIFjwajPU45QiiodSi/0E/S j+zgkDN32dM6lvOY2Zu5QYIwIPDEQNIdbNQdvBLyB9hg4iIlIhgXag5M4 s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AlAQBney5Y/4YNJK1bAxkBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYJzRAEBAQEBH1iBAAeNOJcQh2+HW4UbggcdAQqFeQIagXo/FAE?= =?us-ascii?q?CAQEBAQEBAWIohGgBAQEEAQEBIApBCxACAQgRBAEBKAMCAgIfBgsUCQgCBAENB?= =?us-ascii?q?QgTiDcDFw6sKoIph0UNhAUBAQEBAQEBAQEBAQEBAQEBAQEBAQEchjyEWoJIgVM?= =?us-ascii?q?RATMKFRGCPYJdBYhGiluGbzUBhj+GYoNFgXdPhCeJQIdggUiEKoQKAQ8PN10uH?= =?us-ascii?q?YUhcgGGHIEhgQwBAQE?= X-IronPort-AV: E=Sophos;i="5.31,655,1473120000"; d="scan'208,217";a="172652233" Received: from alln-core-12.cisco.com ([173.36.13.134]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 18 Nov 2016 03:56:12 +0000 Received: from XCH-ALN-018.cisco.com (xch-aln-018.cisco.com [173.36.7.28]) by alln-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id uAI3uCsb022459 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 18 Nov 2016 03:56:12 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-018.cisco.com (173.36.7.28) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 17 Nov 2016 21:56:11 -0600 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Thu, 17 Nov 2016 21:56:11 -0600 From: "Tirumaleswar Reddy (tireddy)" To: "kathleen.moriarty.ietf@gmail.com" , Rene Struik Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion Thread-Index: AQHSF95O4Mh/TThK60uX2f7HbJa1j6CL8WcAgAAWPYCAADVxAIBRUHeOgAEE04D//9zDkA== Date: Fri, 18 Nov 2016 03:56:11 +0000 Message-ID: References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> In-Reply-To: <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.65.76.218] Content-Type: multipart/alternative; boundary="_000_dead56f965b94081bd187585d1272398XCHRCD017ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Michael StJohns , "ace@ietf.org" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 03:56:15 -0000 --_000_dead56f965b94081bd187585d1272398XCHRCD017ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 S2F0aGxlZW4sDQoNCkkgd2lsbCBwdXQgdXAgYSBwcm9wb3NhbCBiZWZvcmUgdGhlIENoaWNhZ28g bWVldGluZy4NCg0KLVRpcnUNCg0KRnJvbTogQWNlIFttYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5v cmddIE9uIEJlaGFsZiBPZiBrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbQ0KU2VudDog RnJpZGF5LCBOb3ZlbWJlciAxOCwgMjAxNiA1OjMwIEFNDQpUbzogUmVuZSBTdHJ1aWsgPHJzdHJ1 aWsuZXh0QGdtYWlsLmNvbT4NCkNjOiBNaWNoYWVsIFN0Sm9obnMgPG1zdGpvaG5zQGNvbWNhc3Qu bmV0PjsgYWNlQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW0FjZV0gU3VtbWFyeSBvZiBBQ0UgR3Jv dXAgQ29tbXVuaWNhdGlvbiBTZWN1cml0eSBEaXNjdXNzaW9uDQoNCklzIGFueW9uZSB3aWxsaW5n IHRvIHdvcmsgb24gYSBkcmFmdCB0byBiZSByZWFkeSBpbiBhZHZhbmNlIG9mIHRoZSBDaGljYWdv IG1lZXRpbmcgc28gd2UgaGF2ZSBhIGNvbmNyZXRlIHByb3Bvc2FsIGZvciBhc3ltbWV0cmljIGtl eXM/DQoNClRoYW5rcywNCkthdGhsZWVuDQoNClBsZWFzZSBleGN1c2UgdHlwb3MsIHNlbnQgZnJv bSBoYW5kaGVsZCBkZXZpY2UNCg0KT24gTm92IDE3LCAyMDE2LCBhdCAxMToyNiBQTSwgUmVuZSBT dHJ1aWsgPHJzdHJ1aWsuZXh0QGdtYWlsLmNvbTxtYWlsdG86cnN0cnVpay5leHRAZ21haWwuY29t Pj4gd3JvdGU6DQpEZWFyIGNvbGxlYWd1ZXM6DQoNCkp1c3QgYSByZW1pbmRlciByZSBwZXJjZWl2 ZWQgdGVjaG5pY2FsIGh1cmRsZXMgZm9yIHVzaW5nIHNpZ25hdHVyZXM6DQphKSB0aW1lIGxhdGVu Y3kgb2Ygc2lnbmluZzoNCk9uZSBjYW4gcHJlLWNvbXB1dGUgZXBoZW1lcmFsIHNpZ25pbmcga2V5 cywgc28gYXMgdG8gcmVkdWNlIG9ubGluZSBrZXkgY29tcHV0YXRpb24gdG8gYSBmZXcgZmluaXRl IGZpZWxkIG11bHRpcGxpZXMuDQpQbGVhc2Ugc2VlIG15IGVtYWlsIHRvIHRoZSBsaXN0IG9mIEp1 bHkgMjYsIDIwMTY6IGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWNlL2lF YjBYbkFJTUFCX1YzSThMak1GUVJqMUZlMA0KYik6IGZ1cnRoZXIgc3BlZWQtdXBzL3RyaWNrcywg ZXRjOg0KT25lIGNhbiB0cnkgYW5kIGJlIHNtYXJ0ZXIgYnkgY2xldmVyIGltcGxlbWVudGF0aW9u cy4NClBsZWFzZSBzZWUgbXkgZW1haWwgdG8gdGhlIGxpc3Qgb2YgSnVseSAyMSwgMjAxNjogaHR0 cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2UvaUk1OG1UX0REektJbUwxTFBf YlVRN1R6b29JDQoNClRoaXMgc2VlbXMgdG8gdGFrZSB0aGUgdGltZSBsYXRlbmN5IGFyZ3VtZW50 IGF3YXkuIFRoZSBvbmx5IG90aGVyIHRlY2huaWNhbCBodXJkbGVzIEkgY2FuIHNlZSBhcmUNCihp KSBzaWduYXR1cmUgc2l6ZSB7aXMgNjRCIHRvbyBtdWNoP307DQooaWkpIGNvc3Qgb2YgcHVibGlj IGtleSBjcnlwdG8gaW1wbGVtZW50YXRpb25zIHtxdWl0ZSBzb21lIHNtYWxsLCBuaWZ0eSBkZXNp Z25zIG91dCB0aGVyZSAoTmFDbCBldGMufS4NCg0KQXMgdG8gKGkpIC0gb25lIHNob3VsZCB2aWV3 IHNpZ25hdHVyZSBzaXplcyBpbiBwZXJzcGVjdGl2ZTogYXMgYW4gZXhhbXBsZSwga2V5IHNpemVz IGluIHRoZSBrZXkgcHJlLWRpc3RyaWJ1dGlvbiBzY2hlbWUgSElNTU8gKGFzIHByb21vdGVkIGJ5 IFBoaWxpcHMpIGhhcyBrZXkgc2l6ZXMgb2YgNi4yNSBrQiBhbmQgdXAsIGFjY29yZGluZyB0byBU YWJsZSAzIG9mIHRoZSBwYXBlciB0aGF0IG1hc3NhZ2VzIHBhcmFtZXRlcnMgdG8gdGh3YXJ0IG5l dyBhdHRhY2tzIG9uIHRoZWlyIHNjaGVtZSwgc2VlIGh0dHA6Ly9lcHJpbnQuaWFjci5vcmcvMjAx Ni8xNTIuDQoNClNvLCBzZWN1cml0eSBhcmd1bWVudHMgdGhhdCBmYXZvciBhc3ltbWV0cmljIHNv bHV0aW9ucyBhc2lkZSwgdGhlcmUgYWxzbyBkbyBub3Qgc2VlbSB0byBiZSB0b28gbWFueSBvdGhl ciBvYmplY3Rpb25zIHRoYXQgd291bGQgaG9sZCBpbiB0aGUgd29ybGQgYW5ubyAyMDE2IHtleGNl cHQgZm9yICJzdW5rIGludmVzdG1lbnQiIGFyZ3VtZW50cyIsIGJ1dCB0aGF0IGlzIGEgY29ycG9y YXRlIG1pbmRzZXQgaXNzdWV9Lg0KDQpPbiAxMS8xNy8yMDE2IDEyOjUwIEFNLCBNaWNoYWVsIFN0 Sm9obnMgd3JvdGU6DQpPbiAxMS8xNi8yMDE2IDk6MDggQU0sIEtlcGVuZyBMaSB3cm90ZToNCg0K SGVsbG8gYWxsLA0KDQpXZSBoYWQgYSBsb25nIGRpc2N1c3Npb24gYWJvdXQgZ3JvdXAgY29tbXVu aWNhdGlvbiBzZWN1cml0eSB0b3BpYyBzaW5jZSB0aGUgcHJldmlvdXMgRjJGIG1lZXRpbmcuDQoN Ckhhbm5lcyBhbmQgSSBoYXZlIHRyaWVkIHRvIG1ha2UgYSBzdW1tYXJ5IGFib3V0IHRoZSBkaXNj dXNzaW9uIGFzIGZvbGxvd3M6DQoNCsK3ICAgICAgIFRoZSBzb2x1dGlvbiBuZWVkcyB0byBkZWZp bmUgYm90aCwgc3ltbWV0cmljIGFuZCBhbiBhc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbi4N Cg0KVGhlcmUgaXMgbm8gY2FzZSAoYWJzZW50IGhhcmR3YXJlIG1pdGlnYXRpb24pIGluIHdoaWNo IGEgc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBjYW4gYmUgbWFkZSBzZWN1cmUvc2FmZSBh bmQgbm8gb25lIGhhcyBtYWRlIGFuIG9mZmVyIG9mIHByb29mIHRoYXQgdGhleSBjYW4gbWFrZSBp dCBzZWN1cmUuICAgIEkndmUgYXNrZWQgcmVwZWF0ZWRseSAtIG5vIG9uZSBoYXMgY29tZSBmb3J3 YXJkIHdpdGggbW9yZSB0aGFuICJvaCB3ZSBjYW4gbG9jayB0aGUgc3ltbWV0cmljIGtleSBzdHVm ZiBpbiBhIGNvcm5lciBhbmQgbWFrZSBzdXJlIGl0IGlzbid0IHVzZWQgZm9yIGFueXRoaW5nIGlt cG9ydGFudCIuDQoNCg0KR2l2ZW4gdGhlIHJlY2VudCBhdHRhY2tzIG9uIHRoZSBpbnRlcm5ldCBi eSBJT1QgYm90bmV0cywgdGhlcmUgaXMgYSBmdXJ0aGVyIGNvbnNpZGVyYXRpb24gdGhhdCBzaG91 bGQgYmUgdW5kZXJ0YWtlbiAtIHdoZXRoZXIgdGhlIHN5bW1ldHJpYyBncm91cCBrZXkgc29sdXRp b24gYXBwbGllZCB0byAxMHMgb2YgMTAwMHMgb2YgSU9UIGRldmljZXMgaXMgYW4gYWN0aXZlIHRo cmVhdCB0byB0aGUgcmVzdCBvZiB0aGUgaW50ZXJuZXQgKGUuZy4gZW5hYmxpbmcgRERPUywgY3li ZXIgcGh5c2ljYWwgaXNzdWVzLCBldGMpPw0KDQpUaGUgbXVsdGlwYXJ0eSAoZ3JvdXApIHN5bW1l dHJpYyBrZXkgc29sdXRpb24gaXMgb25seSB3YW50ZWQgZm9yIGEgc2luZ2xlIGNvcm5lciBvZiB0 aGUgc29sdXRpb24gc3BhY2UgLSBsb3cgbGF0ZW5jeSwgbm8gY29zdCBzeXN0ZW1zLiAgRS5nLiBs aWdodGJ1bGJzLiAgR2l2ZW4gdGhlcmUgaXMgYSB3b3JrZWQgZXhhbXBsZSBvZiB0aGUgaW5zZWN1 cml0eSBvZiBtdWx0aXBhcnR5IHN5bW1ldHJpYyBrZXkgc3lzdGVtcyAoZS5nLiB0aGUgYXR0YWNr IG9uIHRoZSBzeW1tZXRyaWMgc2lnbmluZyBrZXkgb2YgdGhlIEhVRSBsaWdodHMpLCBJJ20gdW5j bGVhciB3aHkgYW55b25lIGF0IGFsbCB3b3VsZCB0aGluayB0aGF0IHB1cnN1aW5nIGEga25vd24g YmFkIHNvbHV0aW9uIGluIHRoZSBJRVRGIGlzIGEgZ29vZCBpZGVhLg0KDQoNCg0KwrcgICAgICAg VGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbiBuZWVkcyB0byBleHBsYWluIHVuZGVy IHdoYXQgY2lyY3Vtc3RhbmNlcyB3aGF0IHNvbHV0aW9uIGlzIGFwcHJvcHJpYXRlLg0KDQpTZWN1 cml0eSBjb25zaWRlcmF0aW9uIHNlY3Rpb25zIGdlbmVyYWxseSBvbmx5IGFkZHJlc3MgdGhlIHRo cmVhdCAqdG8qIHRoZSBzeXN0ZW0gZnJvbSBzZWN1cml0eSBjaG9pY2VzLiAgSW4gdGhpcyBjYXNl LCBzeW1tZXRyaWMga2V5IGdyb3VwIGNvbW1zIHJlZHVjZXMgZG93biB0byB0aGUgc2FtZSBzZWN1 cml0eSBhbmFseXNpcyB5b3Ugd291bGQgdXNlIHdpdGggc2hhcmVkIGRlZmF1bHQgcGFzc3dvcmRz IGFjcm9zcyAxMDAwcyBvZiBkZXZpY2VzLiAgIEFuIElPVCBzZWN1cml0eSBjb25zaWRlcmF0aW9u IHNlY3Rpb24gaW4gdGhlIGZ1dHVyZSBwcm9iYWJseSBuZWVkcyB0byBhZGRyZXNzIHRoZSB0aHJl YXQgKkZST00qIHRoZSBJT1Qgc29sdXRpb24gdG8gdGhlIGJyb2FkZXIgaW50ZXJuZXQuDQoNCk1p a2UNCg0KDQoNCg0KSWYgdGhpcyBpcyBub3QgYWNjdXJhdGUsIHBsZWFzZSBsZXQgdXMga25vdy4N Cg0KS2luZCBSZWdhcmRzDQpLZXBlbmcgJiBIYW5uZXMNCg0KQlRXOiBpdCBpcyBhIHBpdHkgdGhh dCBJIGNhbid0IGF0dGVuZCB0aGlzIG1lZXRpbmcgZHVlIHRvIHBlcnNvbmFsIHJlYXNvbnMsIGFu ZCBob3BlIHlvdSBhbGwgaGF2ZSBhIG5pY2UgbWVldGluZyBpbiBTZW91bCENCg0KDQoNCg0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KQWNlIG1haWxp bmcgbGlzdA0KDQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg0KDQoNCg0KDQoNCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNCkFjZSBtYWlsaW5nIGxpc3QN Cg0KQWNlQGlldGYub3JnPG1haWx0bzpBY2VAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQoNCg0KDQoNCi0tDQoNCmVtYWlsOiByc3RydWlrLmV4 dEBnbWFpbC5jb208bWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbT4gfCBTa3lwZTogcnN0cnVp aw0KDQpjZWxsOiArMSAoNjQ3KSA4NjctNTY1OCB8IFVTOiArMSAoNDE1KSA2OTAtNzM2Mw0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkFjZSBtYWlsaW5n IGxpc3QNCkFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg== --_000_dead56f965b94081bd187585d1272398XCHRCD017ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnANCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIs c2VyaWY7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxl LW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0K CWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7 fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVm b3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5r OiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLmFwcGxlLWNvbnZl cnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEw LjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2lu OjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl ZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0t LT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4N CjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1s PjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5LYXRobGVlbiwNCjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB3aWxsIHB1dCB1cCBhIHByb3Bv c2FsIGJlZm9yZSB0aGUgQ2hpY2FnbyBtZWV0aW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+LVRpcnU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg Ymx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBBY2UgW21haWx0bzphY2UtYm91bmNl c0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBn bWFpbC5jb208YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBOb3ZlbWJlciAxOCwgMjAxNiA1OjMw IEFNPGJyPg0KPGI+VG86PC9iPiBSZW5lIFN0cnVpayAmbHQ7cnN0cnVpay5leHRAZ21haWwuY29t Jmd0Ozxicj4NCjxiPkNjOjwvYj4gTWljaGFlbCBTdEpvaG5zICZsdDttc3Rqb2huc0Bjb21jYXN0 Lm5ldCZndDs7IGFjZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0FjZV0gU3Vt bWFyeSBvZiBBQ0UgR3JvdXAgQ29tbXVuaWNhdGlvbiBTZWN1cml0eSBEaXNjdXNzaW9uPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklzIGFueW9u ZSB3aWxsaW5nIHRvIHdvcmsgb24gYSBkcmFmdCB0byBiZSByZWFkeSBpbiBhZHZhbmNlIG9mIHRo ZSBDaGljYWdvIG1lZXRpbmcgc28gd2UgaGF2ZSBhIGNvbmNyZXRlIHByb3Bvc2FsIGZvciBhc3lt bWV0cmljIGtleXM/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNp Z25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkthdGhsZWVuJm5ic3A7PGJyPg0KPGJyPg0KUGxl YXNlIGV4Y3VzZSB0eXBvcywgc2VudCBmcm9tIGhhbmRoZWxkIGRldmljZSZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBOb3YgMTcsIDIwMTYsIGF0IDExOjI2IFBNLCBSZW5l IFN0cnVpayAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbSI+cnN0cnVp ay5leHRAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5EZWFyIGNvbGxlYWd1ZXM6PGJyPg0K PGJyPg0KSnVzdCBhIHJlbWluZGVyIHJlIHBlcmNlaXZlZCB0ZWNobmljYWwgaHVyZGxlcyBmb3Ig dXNpbmcgc2lnbmF0dXJlczo8YnI+DQphKSB0aW1lIGxhdGVuY3kgb2Ygc2lnbmluZzo8YnI+DQpP bmUgY2FuIHByZS1jb21wdXRlIGVwaGVtZXJhbCBzaWduaW5nIGtleXMsIHNvIGFzIHRvIHJlZHVj ZSBvbmxpbmUga2V5IGNvbXB1dGF0aW9uIHRvIGEgZmV3IGZpbml0ZSBmaWVsZCBtdWx0aXBsaWVz Lg0KPGJyPg0KUGxlYXNlIHNlZSBteSBlbWFpbCB0byB0aGUgbGlzdCBvZiBKdWx5IDI2LCAyMDE2 OiA8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9pRWIw WG5BSU1BQl9WM0k4TGpNRlFSajFGZTAiPg0KaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9h cmNoL21zZy9hY2UvaUViMFhuQUlNQUJfVjNJOExqTUZRUmoxRmUwPC9hPjxicj4NCmIpOiBmdXJ0 aGVyIHNwZWVkLXVwcy90cmlja3MsIGV0Yzo8YnI+DQpPbmUgY2FuIHRyeSBhbmQgYmUgc21hcnRl ciBieSBjbGV2ZXIgaW1wbGVtZW50YXRpb25zLjxicj4NClBsZWFzZSBzZWUgbXkgZW1haWwgdG8g dGhlIGxpc3Qgb2YgSnVseSAyMSwgMjAxNjogPGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5p ZXRmLm9yZy9hcmNoL21zZy9hY2UvaUk1OG1UX0REektJbUwxTFBfYlVRN1R6b29JIj4NCmh0dHBz Oi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWNlL2lJNThtVF9ERHpLSW1MMUxQX2JV UTdUem9vSTwvYT48YnI+DQo8YnI+DQpUaGlzIHNlZW1zIHRvIHRha2UgdGhlIHRpbWUgbGF0ZW5j eSBhcmd1bWVudCBhd2F5LiBUaGUgb25seSBvdGhlciB0ZWNobmljYWwgaHVyZGxlcyBJIGNhbiBz ZWUgYXJlDQo8YnI+DQooaSkgc2lnbmF0dXJlIHNpemUge2lzIDY0QiB0b28gbXVjaD99OyA8YnI+ DQooaWkpIGNvc3Qgb2YgcHVibGljIGtleSBjcnlwdG8gaW1wbGVtZW50YXRpb25zIHtxdWl0ZSBz b21lIHNtYWxsLCBuaWZ0eSBkZXNpZ25zIG91dCB0aGVyZSAoTmFDbCBldGMufS48YnI+DQo8YnI+ DQpBcyB0byAoaSkgLSBvbmUgc2hvdWxkIHZpZXcgc2lnbmF0dXJlIHNpemVzIGluIHBlcnNwZWN0 aXZlOiBhcyBhbiBleGFtcGxlLCBrZXkgc2l6ZXMgaW4gdGhlIGtleSBwcmUtZGlzdHJpYnV0aW9u IHNjaGVtZSBISU1NTyAoYXMgcHJvbW90ZWQgYnkgUGhpbGlwcykgaGFzIGtleSBzaXplcyBvZiA2 LjI1IGtCIGFuZCB1cCwgYWNjb3JkaW5nIHRvIFRhYmxlIDMgb2YgdGhlIHBhcGVyIHRoYXQgbWFz c2FnZXMgcGFyYW1ldGVycyB0byB0aHdhcnQgbmV3DQogYXR0YWNrcyBvbiB0aGVpciBzY2hlbWUs IHNlZSA8YSBocmVmPSJodHRwOi8vZXByaW50LmlhY3Iub3JnLzIwMTYvMTUyIj5odHRwOi8vZXBy aW50LmlhY3Iub3JnLzIwMTYvMTUyPC9hPi48YnI+DQo8YnI+DQpTbywgc2VjdXJpdHkgYXJndW1l bnRzIHRoYXQgZmF2b3IgYXN5bW1ldHJpYyBzb2x1dGlvbnMgYXNpZGUsIHRoZXJlIGFsc28gZG8g bm90IHNlZW0gdG8gYmUgdG9vIG1hbnkgb3RoZXIgb2JqZWN0aW9ucyB0aGF0IHdvdWxkIGhvbGQg aW4gdGhlIHdvcmxkIGFubm8gMjAxNiB7ZXhjZXB0IGZvciAmcXVvdDtzdW5rIGludmVzdG1lbnQm cXVvdDsgYXJndW1lbnRzJnF1b3Q7LCBidXQgdGhhdCBpcyBhIGNvcnBvcmF0ZSBtaW5kc2V0IGlz c3VlfS48YnI+DQo8YnI+DQpPbiAxMS8xNy8yMDE2IDEyOjUwIEFNLCBNaWNoYWVsIFN0Sm9obnMg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIDExLzE2LzIwMTYgOTowOCBBTSwgS2VwZW5nIExpIHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxwPkhlbGxvIGFsbCwmbmJzcDsgPG86cD48L286cD48L3A+DQo8cD5XZSBo YWQgYSBsb25nIGRpc2N1c3Npb24gYWJvdXQgZ3JvdXAgY29tbXVuaWNhdGlvbiBzZWN1cml0eSB0 b3BpYyBzaW5jZSB0aGUgcHJldmlvdXMgRjJGIG1lZXRpbmcuPG86cD48L286cD48L3A+DQo8cD5I YW5uZXMgYW5kIEkgaGF2ZSB0cmllZCB0byBtYWtlIGEgc3VtbWFyeSBhYm91dCB0aGUgZGlzY3Vz c2lvbiBhcyBmb2xsb3dzOjxvOnA+PC9vOnA+PC9wPg0KPHA+wrcmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgVGhlIHNvbHV0aW9uIG5lZWRzIHRvIGRlZmluZSBib3RoLCBzeW1t ZXRyaWMgYW5kIGFuIGFzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0aW9uLg0KPG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpUaGVyZSBpcyBu byBjYXNlIChhYnNlbnQgaGFyZHdhcmUgbWl0aWdhdGlvbikgaW4gd2hpY2ggYSBzeW1tZXRyaWMg Z3JvdXAga2V5IHNvbHV0aW9uIGNhbiBiZSBtYWRlIHNlY3VyZS9zYWZlIGFuZCBubyBvbmUgaGFz IG1hZGUgYW4gb2ZmZXIgb2YgcHJvb2YgdGhhdCB0aGV5IGNhbiBtYWtlIGl0IHNlY3VyZS4mbmJz cDsmbmJzcDsmbmJzcDsgSSd2ZSBhc2tlZCByZXBlYXRlZGx5IC0gbm8gb25lIGhhcyBjb21lIGZv cndhcmQgd2l0aCBtb3JlIHRoYW4gJnF1b3Q7b2ggd2UgY2FuIGxvY2sNCiB0aGUgc3ltbWV0cmlj IGtleSBzdHVmZiBpbiBhIGNvcm5lciBhbmQgbWFrZSBzdXJlIGl0IGlzbid0IHVzZWQgZm9yIGFu eXRoaW5nIGltcG9ydGFudCZxdW90Oy48YnI+DQo8YnI+DQo8YnI+DQpHaXZlbiB0aGUgcmVjZW50 IGF0dGFja3Mgb24gdGhlIGludGVybmV0IGJ5IElPVCBib3RuZXRzLCB0aGVyZSBpcyBhIGZ1cnRo ZXIgY29uc2lkZXJhdGlvbiB0aGF0IHNob3VsZCBiZSB1bmRlcnRha2VuIC0gd2hldGhlciB0aGUg c3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBhcHBsaWVkIHRvIDEwcyBvZiAxMDAwcyBvZiBJ T1QgZGV2aWNlcyBpcyBhbiBhY3RpdmUgdGhyZWF0IHRvIHRoZSByZXN0IG9mIHRoZSBpbnRlcm5l dCAoZS5nLiBlbmFibGluZw0KIERET1MsIGN5YmVyIHBoeXNpY2FsIGlzc3VlcywgZXRjKT88YnI+ DQo8YnI+DQpUaGUgbXVsdGlwYXJ0eSAoZ3JvdXApIHN5bW1ldHJpYyBrZXkgc29sdXRpb24gaXMg b25seSB3YW50ZWQgZm9yIGEgc2luZ2xlIGNvcm5lciBvZiB0aGUgc29sdXRpb24gc3BhY2UgLSBs b3cgbGF0ZW5jeSwgbm8gY29zdCBzeXN0ZW1zLiZuYnNwOyBFLmcuIGxpZ2h0YnVsYnMuJm5ic3A7 IEdpdmVuIHRoZXJlIGlzIGEgd29ya2VkIGV4YW1wbGUgb2YgdGhlIGluc2VjdXJpdHkgb2YgbXVs dGlwYXJ0eSBzeW1tZXRyaWMga2V5IHN5c3RlbXMgKGUuZy4gdGhlIGF0dGFjaw0KIG9uIHRoZSBz eW1tZXRyaWMgc2lnbmluZyBrZXkgb2YgdGhlIEhVRSBsaWdodHMpLCBJJ20gdW5jbGVhciB3aHkg YW55b25lIGF0IGFsbCB3b3VsZCB0aGluayB0aGF0IHB1cnN1aW5nIGEga25vd24gYmFkIHNvbHV0 aW9uIGluIHRoZSBJRVRGIGlzIGEgZ29vZCBpZGVhLjxicj4NCjxicj4NCjxicj4NCjxvOnA+PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8cD7CtyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUaGUg c2VjdXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIgd2hh dCBjaXJjdW1zdGFuY2VzIHdoYXQgc29sdXRpb24gaXMgYXBwcm9wcmlhdGUuDQo8bzpwPjwvbzpw PjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NClNlY3VyaXR5 IGNvbnNpZGVyYXRpb24gc2VjdGlvbnMgZ2VuZXJhbGx5IG9ubHkgYWRkcmVzcyB0aGUgdGhyZWF0 ICp0byogdGhlIHN5c3RlbSBmcm9tIHNlY3VyaXR5IGNob2ljZXMuJm5ic3A7IEluIHRoaXMgY2Fz ZSwgc3ltbWV0cmljIGtleSBncm91cCBjb21tcyByZWR1Y2VzIGRvd24gdG8gdGhlIHNhbWUgc2Vj dXJpdHkgYW5hbHlzaXMgeW91IHdvdWxkIHVzZSB3aXRoIHNoYXJlZCBkZWZhdWx0IHBhc3N3b3Jk cyBhY3Jvc3MgMTAwMHMgb2YgZGV2aWNlcy4mbmJzcDsmbmJzcDsNCiBBbiBJT1Qgc2VjdXJpdHkg Y29uc2lkZXJhdGlvbiBzZWN0aW9uIGluIHRoZSBmdXR1cmUgcHJvYmFibHkgbmVlZHMgdG8gYWRk cmVzcyB0aGUgdGhyZWF0ICpGUk9NKiB0aGUgSU9UIHNvbHV0aW9uIHRvIHRoZSBicm9hZGVyIGlu dGVybmV0Ljxicj4NCjxicj4NCk1pa2U8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHA+SWYgdGhpcyBpcyBub3QgYWNjdXJhdGUsIHBsZWFzZSBsZXQgdXMga25vdy48 bzpwPjwvbzpwPjwvcD4NCjxwPktpbmQgUmVnYXJkczxicj4NCktlcGVuZyAmYW1wOyBIYW5uZXM8 bzpwPjwvbzpwPjwvcD4NCjxwPkJUVzogaXQgaXMgYSBwaXR5IHRoYXQgSSBjYW4ndCBhdHRlbmQg dGhpcyBtZWV0aW5nIGR1ZSB0byBwZXJzb25hbCByZWFzb25zLCBhbmQgaG9wZSB5b3UgYWxsIGhh dmUgYSBuaWNlIG1lZXRpbmcgaW4gU2VvdWwhPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmU+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJlPg0K PHByZT5BY2UgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFp bHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5odHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwvcHJl Pg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmU+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJlPg0K PHByZT5BY2UgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFp bHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5odHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwvcHJl Pg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwcmU+LS0gPG86cD48L286cD48L3ByZT4N CjxwcmU+ZW1haWw6IDxhIGhyZWY9Im1haWx0bzpyc3RydWlrLmV4dEBnbWFpbC5jb20iPnJzdHJ1 aWsuZXh0QGdtYWlsLmNvbTwvYT4gfCBTa3lwZTogcnN0cnVpazxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPmNlbGw6ICYjNDM7MSAoNjQ3KSA4NjctNTY1OCB8IFVTOiAmIzQzOzEgKDQxNSkgNjkwLTcz NjM8bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxicj4NCkFjZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWNlQGll dGYub3JnIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9hY2UiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_dead56f965b94081bd187585d1272398XCHRCD017ciscocom_-- From nobody Thu Nov 17 19:59:54 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F5661293D6 for ; Thu, 17 Nov 2016 19:59:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sPR2gejTWv9c for ; Thu, 17 Nov 2016 19:59:50 -0800 (PST) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 682A8129625 for ; Thu, 17 Nov 2016 19:59:50 -0800 (PST) Received: by mail-vk0-x235.google.com with SMTP id p9so159053130vkd.3 for ; Thu, 17 Nov 2016 19:59:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Q20FI8x75yZp6pT0YkXFlFMadC3JLVXrv+AMqQ1QPbs=; b=QZVAVeSHA1ZTl/6rTkkiT4stWA6PQ8hH4uFYzYwhPHGucNO8J3qnFhndFsm3pezBAK DoCGeCUvgiuBMtQ8N7X8RWWwBUGG5xtI99SQ2aUUZ+MoUCk+aXVgakoNyjmvAP0T1zIj i9e9vqYbrkVVj6gKJx9yzH3uJ0fxmsl/A5pvd4sk3z4vn0OzCKrIRmYvASThkGgOVU9y Jq37X7bR/32txKs1FiNFUI1ncGgZEfLjwEvvs8oaVNRHmHGtAoAzKAz55NhPFTd4RynB w/JYjblDhgkYkCdBTBbJLCFOeSqDkGU8DywEIPXYKNegGmCo7Aiyse4duekMux0EVTy6 p5tA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Q20FI8x75yZp6pT0YkXFlFMadC3JLVXrv+AMqQ1QPbs=; b=HLVeQ1Bc7FITJIgMcQwm9o2vDZ26L1j9L8aE8GgZq+DVPMhgpTf7fK9UfhlupGr9/I CVb/4WmsStSMHIP3mGhhKN0JNBOt0dnoxwK4pR6MpaYPz+/MA5tNtnr2Tqji6iKm5Az9 rhAiFuXy4Z7YNpPsaX1H9YNrq/1Lg8S1CnS+kV3LJhX9lcdthcm2UyurCh3sG1F/xLNv +DU8O8/GPclTyIYHcsgyf2uvyF4Rd5ur+9+g6gZDPqj0QTo2ip/qZQiamRXIF43LXvK3 4L2xvSOhWCbXP0ZeBqyfH7TK/cMsxUygI89+j3Et2PUMNHEZLT10K+c8G3JPGkMAJtoy LzDQ== X-Gm-Message-State: AKaTC01BW58rsb/sBoDqQpNitg2J+XQCGwcOxfQ3ApCMJNqgZD87RibrifRpM3ZBmgIWh9A06DWfp0VRa0wI/g== X-Received: by 10.31.200.4 with SMTP id y4mr4380559vkf.115.1479441589446; Thu, 17 Nov 2016 19:59:49 -0800 (PST) MIME-Version: 1.0 Received: by 10.176.82.143 with HTTP; Thu, 17 Nov 2016 19:59:48 -0800 (PST) In-Reply-To: References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> From: Kathleen Moriarty Date: Thu, 17 Nov 2016 22:59:48 -0500 Message-ID: To: "Tirumaleswar Reddy (tireddy)" Content-Type: multipart/alternative; boundary=001a114dd55867ad8805418b567b Archived-At: Cc: Michael StJohns , Rene Struik , "ace@ietf.org" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 03:59:53 -0000 --001a114dd55867ad8805418b567b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, Nov 17, 2016 at 10:56 PM, Tirumaleswar Reddy (tireddy) < tireddy@cisco.com> wrote: > Kathleen, > > > > I will put up a proposal before the Chicago meeting. > Thank you. > > > -Tiru > > > > *From:* Ace [mailto:ace-bounces@ietf.org] *On Behalf Of * > kathleen.moriarty.ietf@gmail.com > *Sent:* Friday, November 18, 2016 5:30 AM > *To:* Rene Struik > *Cc:* Michael StJohns ; ace@ietf.org > *Subject:* Re: [Ace] Summary of ACE Group Communication Security > Discussion > > > > Is anyone willing to work on a draft to be ready in advance of the Chicag= o > meeting so we have a concrete proposal for asymmetric keys? > > > > Thanks, > > Kathleen > > Please excuse typos, sent from handheld device > > > On Nov 17, 2016, at 11:26 PM, Rene Struik wrote: > > Dear colleagues: > > Just a reminder re perceived technical hurdles for using signatures: > a) time latency of signing: > One can pre-compute ephemeral signing keys, so as to reduce online key > computation to a few finite field multiplies. > Please see my email to the list of July 26, 2016: > https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 > b): further speed-ups/tricks, etc: > One can try and be smarter by clever implementations. > Please see my email to the list of July 21, 2016: > https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI > > This seems to take the time latency argument away. The only other > technical hurdles I can see are > (i) signature size {is 64B too much?}; > (ii) cost of public key crypto implementations {quite some small, nifty > designs out there (NaCl etc.}. > > As to (i) - one should view signature sizes in perspective: as an example= , > key sizes in the key pre-distribution scheme HIMMO (as promoted by Philip= s) > has key sizes of 6.25 kB and up, according to Table 3 of the paper that > massages parameters to thwart new attacks on their scheme, see > http://eprint.iacr.org/2016/152. > > So, security arguments that favor asymmetric solutions aside, there also > do not seem to be too many other objections that would hold in the world > anno 2016 {except for "sunk investment" arguments", but that is a corpora= te > mindset issue}. > > On 11/17/2016 12:50 AM, Michael StJohns wrote: > > On 11/16/2016 9:08 AM, Kepeng Li wrote: > > Hello all, > > We had a long discussion about group communication security topic since > the previous F2F meeting. > > Hannes and I have tried to make a summary about the discussion as follows= : > > =C2=B7 The solution needs to define both, symmetric and an asymmetr= ic > group key solution. > > > There is no case (absent hardware mitigation) in which a symmetric group > key solution can be made secure/safe and no one has made an offer of proo= f > that they can make it secure. I've asked repeatedly - no one has come > forward with more than "oh we can lock the symmetric key stuff in a corne= r > and make sure it isn't used for anything important". > > > Given the recent attacks on the internet by IOT botnets, there is a > further consideration that should be undertaken - whether the symmetric > group key solution applied to 10s of 1000s of IOT devices is an active > threat to the rest of the internet (e.g. enabling DDOS, cyber physical > issues, etc)? > > The multiparty (group) symmetric key solution is only wanted for a single > corner of the solution space - low latency, no cost systems. E.g. > lightbulbs. Given there is a worked example of the insecurity of > multiparty symmetric key systems (e.g. the attack on the symmetric signin= g > key of the HUE lights), I'm unclear why anyone at all would think that > pursuing a known bad solution in the IETF is a good idea. > > > =C2=B7 The security consideration section needs to explain under wh= at > circumstances what solution is appropriate. > > > Security consideration sections generally only address the threat *to* th= e > system from security choices. In this case, symmetric key group comms > reduces down to the same security analysis you would use with shared > default passwords across 1000s of devices. An IOT security consideratio= n > section in the future probably needs to address the threat *FROM* the IOT > solution to the broader internet. > > Mike > > > > If this is not accurate, please let us know. > > Kind Regards > Kepeng & Hannes > > BTW: it is a pity that I can't attend this meeting due to personal > reasons, and hope you all have a nice meeting in Seoul! > > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > > -- > > email: rstruik.ext@gmail.com | Skype: rstruik > > cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > --=20 Best regards, Kathleen --001a114dd55867ad8805418b567b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Nov 17, 2016 at 10:56 PM, Tirumaleswar Reddy (tireddy) <tiredd= y@cisco.com> wrote:

Kathleen,

=C2=A0

I will put up a proposal before the C= hicago meeting.


Than= k you.=C2=A0

=C2=A0

-Tiru

=C2=A0

From: Ace [mailto:ace-bounces@ietf.org] On Behalf Of kathleen.moriarty.ietf@gmail.com
Sent: Friday, November 18, 2016 5:30 AM
To: Rene Struik <rstruik.ext@gmail.com>
Cc: Michael StJohns <mstjohns@comcast.net>; ace@ietf.org
Subject: Re: [Ace] Summary of ACE Group Communication Security Discu= ssion

=C2=A0

Is anyone willing to work on a draft to be ready in = advance of the Chicago meeting so we have a concrete proposal for asymmetri= c keys?

=C2=A0

Thanks,

Kathleen=C2=A0

Please excuse typos, sent from handheld device=C2=A0


On Nov 17, 2016, at 11:26 PM, Rene Struik <rstruik.ext@gmail.com> wrote:

Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key comp= utation to a few finite field multiplies.
Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj= 1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7T= zooI

This seems to take the time latency argument away. The only other technical= hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty des= igns out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, = key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips)= has key sizes of 6.25 kB and up, according to Table 3 of the paper that ma= ssages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, there also do= not seem to be too many other objections that would hold in the world anno= 2016 {except for "sunk investment" arguments", but that is = a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:

On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all,=C2=A0

We had a long discussion about group communication security topic since = the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follow= s:

=C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The solution needs to define = both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group ke= y solution can be made secure/safe and no one has made an offer of proof th= at they can make it secure.=C2=A0=C2=A0=C2=A0 I've asked repeatedly - n= o one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for an= ything important".


Given the recent attacks on the internet by IOT botnets, there is a further= consideration that should be undertaken - whether the symmetric group key = solution applied to 10s of 1000s of IOT devices is an active threat to the = rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single c= orner of the solution space - low latency, no cost systems.=C2=A0 E.g. ligh= tbulbs.=C2=A0 Given there is a worked example of the insecurity of multipar= ty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyon= e at all would think that pursuing a known bad solution in the IETF is a go= od idea.


=C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The security consideration se= ction needs to explain under what circumstances what solution is appropriat= e.


Security consideration sections generally only address the threat *to* the = system from security choices.=C2=A0 In this case, symmetric key group comms= reduces down to the same security analysis you would use with shared defau= lt passwords across 1000s of devices.=C2=A0=C2=A0 An IOT security consideration section in the future probably needs to addr= ess the threat *FROM* the IOT solution to the broader internet.

Mike



If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal r= easons, and hope you all have a nice meeting in Seoul!




_______________________________________________

Ace mailing list


Ace@ietf.org<=
/u>


https://www.ietf.org/mailman/listinfo/ace

=C2=A0




_______________________________________________

Ace mailing list


Ace@ietf.org<=
/u>


https://www.ietf.org/mailman/listinfo/ace

=C2=A0

=C2=A0

-- 
email: rstr=
uik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

_______________________________________________=
Ace mailing list
Ace@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/ace




--
Best regards,
Kathleen
--001a114dd55867ad8805418b567b-- From nobody Fri Nov 18 00:00:29 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 934491294C1 for ; Fri, 18 Nov 2016 00:00:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ruxprjk3tkU4 for ; Fri, 18 Nov 2016 00:00:20 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E1FD1294AE for ; Fri, 18 Nov 2016 00:00:19 -0800 (PST) X-AuditID: c1b4fb3a-21fff70000005ff3-c4-582eb50f8007 Received: from ESESSHC009.ericsson.se (Unknown_Domain [153.88.183.45]) by (Symantec Mail Security) with SMTP id 11.67.24563.F05BE285; Fri, 18 Nov 2016 09:00:17 +0100 (CET) Received: from ESESSMB303.ericsson.se ([169.254.3.133]) by ESESSHC009.ericsson.se ([153.88.183.45]) with mapi id 14.03.0319.002; Fri, 18 Nov 2016 09:00:15 +0100 From: =?utf-8?B?R8O2cmFuIFNlbGFuZGVy?= To: Kathleen Moriarty , "ace@ietf.org" Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion Thread-Index: AQHSF95N3qNt2IV8ekmxtHQ0Ph4sSKCLfA8AgAAWPICAADVyAIBKWy+AgAA5GACABZowqIAA9ioAgACQUQCAAKBXgIAAQeCAgAABAgCAAFPvAA== Date: Fri, 18 Nov 2016 08:00:15 +0000 Message-ID: References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.9.160926 x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_D45466986D02Fgoranselanderericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrDIsWRmVeSWpSXmKPExsUyM2K7rq7gVr0Ig/4fihbfv/UwWzTszLfo OdTPbjFlXZbF6hvPWSxO7N7G6MDmMeX3RlaPyY/nMHrsnHWX3WPJkp9MHi1z9jAHsEZx2aSk 5mSWpRbp2yVwZRz/vZO9YPlMpopb3xcwNzB+mcjUxcjJISFgIvH3bxtrFyMXh5DAOkaJ9Yc3 s0A4Sxgl+hsaGEGq2ARcJB40PALrEBGIlNg0rZ8RpIhZYDOjxKZbT1hAEsICnhLb961mhyjy krh1ZxNbFyMHkF0nsepeIUiYRUBV4kLHW2aQMK+AhUTX5lKIXb2sEtNfbAVr5RQIlJiyexMr iM0oICbx/dQasL3MAuISt57Mh7paQGLJnvPMELaoxMvH/1hBZooK6EmsuR8GEVaSWLH9EiNI mFkgVqJzky1ImFdAUOLkzCcsExhFZyEZOguhahaSKoiwpsT6XfoQ1YoSU7ofskPYGhKtc+ZC 2dYSC3d9ZEJWs4CRYxWjaHFqcXFuupGRXmpRZnJxcX6eXl5qySZGYBwf3PLbagfjweeOhxgF OBiVeHgN/ulGCLEmlhVX5h5ilOBgVhLh3bROL0KINyWxsiq1KD++qDQntfgQozQHi5I4r9nK ++FCAumJJanZqakFqUUwWSYOTqkGRu9XNWbJdeeYZD3P/1g5uc9laYbj5W8zjf49Ei6Yx1Bi qGMXIF64pNwlVmBCR1zmFpvrT5fvqFT4JzONtecy4x3v1XXFkz+4nnuVrPz2zO+m08fln8VF HimvXnRZTkf/vLXlmxhR/dDJdbc/3dnns81nrXyP0NvnbLbSity9XVV/WJPFTx3Zo8RSnJFo qMVcVJwIAPeqLz3fAgAA Archived-At: Cc: Michael Richardson , Michael StJohns , Rene Struik , "Tirumaleswar Reddy \(tireddy\)" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 08:00:27 -0000 --_000_D45466986D02Fgoranselanderericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 S2F0aGxlZW4gYW5kIGFsbCwNCg0KSSBiZWxpZXZlIGFsbCBuZWNlc3NhcnkgZHJhZnRzIGZvciBh IHNvbHV0aW9uIGJhc2VkIG9uIGFzeW1tZXRyaWMga2V5cyBhcmUgYWxyZWFkeSBpbiBwbGFjZS4N Cg0KV2l0aCAiYSBzb2x1dGlvbiBiYXNlZCBvbiBhc3ltbWV0cmljIGtleXPigJ0gSSB1bmRlcnN0 YW5kIGEgc29sdXRpb24gd2hlcmUgZWFjaCBtZW1iZXIgb2YgdGhlIGdyb3VwIGNhbiBzaWduIG1l c3NhZ2VzIHdpdGggaXRzIHByaXZhdGUga2V5IGZvciBzb3VyY2UgYXV0aGVudGljYXRpb24gYnV0 IHdoZXJlIGNvbmZpZGVudGlhbGl0eSBpcyBwcm90ZWN0ZWQgd2l0aCBhIHN5bW1ldHJpYyBrZXkg c2hhcmVkIGJldHdlZW4gdGhlIG1lbWJlcnMgb2YgdGhlIGdyb3VwLg0KDQpbMV0gZGVzY3JpYmVz IGhvdyB0byBkaXN0cmlidXRlIGFuZCB1c2Ugc3ltbWV0cmljIGtleXMsIHVzaW5nIGEgS0RDIGZv ciBkaXN0cmlidXRpbmcgdGhlIHN5bW1ldHJpYyBrZXlzLCBhbmQgcmVmZXJlbmNlcyBPU0NPQVAg Zm9yIHNlY3VyaW5nIHRoZSBncm91cCBjb21tdW5pY2F0aW9uLiBbMl0gc2hvd3MgaG93IHRvIHNl Y3VyZSBncm91cCBjb21tdW5pY2F0aW9uIGZvciBDb0FQIGJhc2VkIG9uIGFzeW1tZXRyaWMga2V5 cyBhcyBkZXNjcmliZWQgYWJvdmUuIEFzIGZhciBhcyBJIHVuZGVyc3RhbmQsIHRoZSBvbmx5IHRo aW5nIG1pc3NpbmcgaXMgYSBtZWNoYW5pc20gZm9yIGRpc3RyaWJ1dGluZyB0aGUgcHVibGljIGtl eXMgb2YgdGhlIG1lbWJlcnMsIGJ1dCBpdCBzZWVtcyBuYXR1cmFsIHRvIGV4dGVuZCB0aGUgS0RD IHdpdGggdGhpcyBmdW5jdGlvbmFsaXR5Lg0KDQpbMV0gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL2RyYWZ0LXNvbWFyYWp1LWFjZS1tdWx0aWNhc3QtMDENClsyXSBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtdGlsb2NhLWNvcmUtbXVsdGljYXN0LW9zY29hcC0wMA0KDQoNCg0K SG93ZXZlciwgSSBkb27igJl0IGFncmVlIHdpdGggYWxsIGNvbmNsdXNpb25zIG9mIHRoZSBhc3lt bWV0cmljIGtleSBwcm9wb25lbnRzLg0KDQpJdCBpcyBub3QgbmV3cyB0aGF0IGFzeW1tZXRyaWMg a2V5IHRlY2huaXF1ZXMgYXJlIGZlYXNpYmxlIGZvciB1c2UgaW4gbWFueSBlbWJlZGRlZCBkZXZp Y2UgYXBwbGljYXRpb25zLCBidXQgaXQgaXMgZ29vZCB0aGF0IHRoZSBrbm93bGVkZ2UgaXMgYmVp bmcgc3ByZWFkLiBCdXQgZXhlY3V0aW9uIHRpbWVzIGFuZCBtZXNzYWdlIHNpemVzIG1heSBzdGls bCBiZSBwcm9oaWJpdGl2ZSBmb3Igc29tZSBhcHBsaWNhdGlvbnMuIFRvIGFkZHJlc3MgUmVuZeKA mXMgcXVlc3Rpb24gImlzIDY0QiB0b28gbXVjaD8iOiBBZGRpbmcgdGhlIGNvdW50ZXJzaWduYXR1 cmUgdG8gQ09TRSBtZXNzYWdlcyBzdWNoIGFzIHRob3NlIHVzZWQgaW4gbXVsdGljYXN0IE9TQ09B UCB3b3VsZCBpbmNyZWFzZSB0aGUgc2l6ZSBmcm9tIHRoZSBvcmRlciBvZiAyMCBieXRlcyB0byB0 aGUgb3JkZXIgb2YgODUtOTAgYnl0ZXMgd2hpY2ggaW4gdHVybiBtYXkgYWRkIHNpZ25pZmljYW50 IGxhdGVuY3kgZGVwZW5kaW5nIG9uIGxpbmsgbGF5ZXIgdGVjaG5vbG9neSB1c2VkLCBpbmRlcGVu ZGVudGx5IG9mIHByb2Nlc3NvciBjYXBhY2l0eS4NCg0KDQpXaXRob3V0IG5lZ2xlY3RpbmcgdGhl IGlzc3VlcyByYWlzZWQsIEkgZG8gdGhpbmsgdGhhdCB0aGVyZSBpcyBhIHJvbGUgZm9yIHN5bW1l dHJpYyBrZXkgYmFzZWQgZ3JvdXAgY29tbXVuaWNhdGlvbiBmb3IgdGhlIGNsYXNzIG9mIGFjdHVh dG9ycyBpbiBzY29wZSBvZiBbMV0uIEkgYWdyZWUgaXQgaXMgYW4gaXNzdWUgaWYgY29tcHJvbWlz aW5nIG9uZSBkZXZpY2UgYW5kIGV4dHJhY3Rpbmcgb25lIGtleSBsZXQncyB5b3UgdHVybiBvZmYg MTAwMCBsYW1wcyAobm90IHNheWluZyBpdCBoYXMgdG8sIGJ1dCBqdXN0IGFzIGFuIGV4YW1wbGUp LiBCdXQgdGhhdCBkb2Vzbid0IGF1dG9tYXRpY2FsbHkgdHVybiB0aGUgbGlnaHRidWxicyBpbnRv IGJvdHMuICBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgaW4gdGhpcyBjYXNlIHNob3VsZCBl LmcuIGluY2x1ZGUgdGhpbmdzIGxpa2UgcmVzdHJpY3RpbmcgY2FwYWJpbGl0aWVzIGFzc29jaWF0 ZWQgd2l0aCB0aGUgcG9zc2Vzc2lvbiBvZiBhIHNoYXJlZCBrZXkuDQoNCg0KSW5kZXBlbmRlbnQg b2YgdGhpcyBkaXNjdXNzaW9uLCBzeW1tZXRyaWMga2V5IHNvbHV0aW9ucyBmb3IgdGhlc2UgdXNl IGNhc2VzIHdpbGwgY29udGludWUgdG8gYmUgZGVwbG95ZWQuIEkgZmVhciB3ZSBtYXkgY3JlYXRl IGdyZWF0ZXIgZGFtYWdlIGJ5IG5vdCBhbmFseXNpbmcgYW5kIHByb3ZpZGluZyBndWlkYW5jZSB0 byB0aGVzZSB1c2UgY2FzZXMgd2hlbiBhcHBsaWVkIGluIGEgc3ltbWV0cmljIGtleSBzZXR0aW5n LCBhdCB0aGUgc2FtZSB0aW1lIGFzIHNwZWNpZnlpbmcgYW4gYXN5bW1ldHJpYyBrZXkgc29sdXRp b24uDQoNCg0KR8O2cmFuDQoNCg0KDQpGcm9tOiBBY2UgPGFjZS1ib3VuY2VzQGlldGYub3JnPG1h aWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBLYXRobGVlbiBNb3JpYXJ0 eSA8a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb208bWFpbHRvOmthdGhsZWVuLm1vcmlh cnR5LmlldGZAZ21haWwuY29tPj4NCkRhdGU6IEZyaWRheSAxOCBOb3ZlbWJlciAyMDE2IGF0IDA0 OjU5DQpUbzogIlRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkiIDx0aXJlZGR5QGNpc2NvLmNv bTxtYWlsdG86dGlyZWRkeUBjaXNjby5jb20+Pg0KQ2M6IE1pY2hhZWwgU3RKb2hucyA8bXN0am9o bnNAY29tY2FzdC5uZXQ8bWFpbHRvOm1zdGpvaG5zQGNvbWNhc3QubmV0Pj4sIFJlbmUgU3RydWlr IDxyc3RydWlrLmV4dEBnbWFpbC5jb208bWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbT4+LCAi YWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+IiA8YWNlQGlldGYub3JnPG1haWx0bzph Y2VAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtBY2VdIFN1bW1hcnkgb2YgQUNFIEdyb3VwIENv bW11bmljYXRpb24gU2VjdXJpdHkgRGlzY3Vzc2lvbg0KDQoNCg0KT24gVGh1LCBOb3YgMTcsIDIw MTYgYXQgMTA6NTYgUE0sIFRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkgPHRpcmVkZHlAY2lz Y28uY29tPG1haWx0bzp0aXJlZGR5QGNpc2NvLmNvbT4+IHdyb3RlOg0KS2F0aGxlZW4sDQoNCkkg d2lsbCBwdXQgdXAgYSBwcm9wb3NhbCBiZWZvcmUgdGhlIENoaWNhZ28gbWVldGluZy4NCg0KVGhh bmsgeW91Lg0KDQotVGlydQ0KDQpGcm9tOiBBY2UgW21haWx0bzphY2UtYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmc+XSBPbiBCZWhhbGYgT2Yga2F0aGxlZW4ubW9y aWFydHkuaWV0ZkBnbWFpbC5jb208bWFpbHRvOmthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwu Y29tPg0KU2VudDogRnJpZGF5LCBOb3ZlbWJlciAxOCwgMjAxNiA1OjMwIEFNDQpUbzogUmVuZSBT dHJ1aWsgPHJzdHJ1aWsuZXh0QGdtYWlsLmNvbTxtYWlsdG86cnN0cnVpay5leHRAZ21haWwuY29t Pj4NCkNjOiBNaWNoYWVsIFN0Sm9obnMgPG1zdGpvaG5zQGNvbWNhc3QubmV0PG1haWx0bzptc3Rq b2huc0Bjb21jYXN0Lm5ldD4+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1 YmplY3Q6IFJlOiBbQWNlXSBTdW1tYXJ5IG9mIEFDRSBHcm91cCBDb21tdW5pY2F0aW9uIFNlY3Vy aXR5IERpc2N1c3Npb24NCg0KSXMgYW55b25lIHdpbGxpbmcgdG8gd29yayBvbiBhIGRyYWZ0IHRv IGJlIHJlYWR5IGluIGFkdmFuY2Ugb2YgdGhlIENoaWNhZ28gbWVldGluZyBzbyB3ZSBoYXZlIGEg Y29uY3JldGUgcHJvcG9zYWwgZm9yIGFzeW1tZXRyaWMga2V5cz8NCg0KVGhhbmtzLA0KS2F0aGxl ZW4NCg0KUGxlYXNlIGV4Y3VzZSB0eXBvcywgc2VudCBmcm9tIGhhbmRoZWxkIGRldmljZQ0KDQpP biBOb3YgMTcsIDIwMTYsIGF0IDExOjI2IFBNLCBSZW5lIFN0cnVpayA8cnN0cnVpay5leHRAZ21h aWwuY29tPG1haWx0bzpyc3RydWlrLmV4dEBnbWFpbC5jb20+PiB3cm90ZToNCkRlYXIgY29sbGVh Z3VlczoNCg0KSnVzdCBhIHJlbWluZGVyIHJlIHBlcmNlaXZlZCB0ZWNobmljYWwgaHVyZGxlcyBm b3IgdXNpbmcgc2lnbmF0dXJlczoNCmEpIHRpbWUgbGF0ZW5jeSBvZiBzaWduaW5nOg0KT25lIGNh biBwcmUtY29tcHV0ZSBlcGhlbWVyYWwgc2lnbmluZyBrZXlzLCBzbyBhcyB0byByZWR1Y2Ugb25s aW5lIGtleSBjb21wdXRhdGlvbiB0byBhIGZldyBmaW5pdGUgZmllbGQgbXVsdGlwbGllcy4NClBs ZWFzZSBzZWUgbXkgZW1haWwgdG8gdGhlIGxpc3Qgb2YgSnVseSAyNiwgMjAxNjogaHR0cHM6Ly9t YWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2UvaUViMFhuQUlNQUJfVjNJOExqTUZRUmox RmUwDQpiKTogZnVydGhlciBzcGVlZC11cHMvdHJpY2tzLCBldGM6DQpPbmUgY2FuIHRyeSBhbmQg YmUgc21hcnRlciBieSBjbGV2ZXIgaW1wbGVtZW50YXRpb25zLg0KUGxlYXNlIHNlZSBteSBlbWFp bCB0byB0aGUgbGlzdCBvZiBKdWx5IDIxLCAyMDE2OiBodHRwczovL21haWxhcmNoaXZlLmlldGYu b3JnL2FyY2gvbXNnL2FjZS9pSTU4bVRfRER6S0ltTDFMUF9iVVE3VHpvb0kNCg0KVGhpcyBzZWVt cyB0byB0YWtlIHRoZSB0aW1lIGxhdGVuY3kgYXJndW1lbnQgYXdheS4gVGhlIG9ubHkgb3RoZXIg dGVjaG5pY2FsIGh1cmRsZXMgSSBjYW4gc2VlIGFyZQ0KKGkpIHNpZ25hdHVyZSBzaXplIHtpcyA2 NEIgdG9vIG11Y2g/fTsNCihpaSkgY29zdCBvZiBwdWJsaWMga2V5IGNyeXB0byBpbXBsZW1lbnRh dGlvbnMge3F1aXRlIHNvbWUgc21hbGwsIG5pZnR5IGRlc2lnbnMgb3V0IHRoZXJlIChOYUNsIGV0 Yy59Lg0KDQpBcyB0byAoaSkgLSBvbmUgc2hvdWxkIHZpZXcgc2lnbmF0dXJlIHNpemVzIGluIHBl cnNwZWN0aXZlOiBhcyBhbiBleGFtcGxlLCBrZXkgc2l6ZXMgaW4gdGhlIGtleSBwcmUtZGlzdHJp YnV0aW9uIHNjaGVtZSBISU1NTyAoYXMgcHJvbW90ZWQgYnkgUGhpbGlwcykgaGFzIGtleSBzaXpl cyBvZiA2LjI1IGtCIGFuZCB1cCwgYWNjb3JkaW5nIHRvIFRhYmxlIDMgb2YgdGhlIHBhcGVyIHRo YXQgbWFzc2FnZXMgcGFyYW1ldGVycyB0byB0aHdhcnQgbmV3IGF0dGFja3Mgb24gdGhlaXIgc2No ZW1lLCBzZWUgaHR0cDovL2VwcmludC5pYWNyLm9yZy8yMDE2LzE1Mi4NCg0KU28sIHNlY3VyaXR5 IGFyZ3VtZW50cyB0aGF0IGZhdm9yIGFzeW1tZXRyaWMgc29sdXRpb25zIGFzaWRlLCB0aGVyZSBh bHNvIGRvIG5vdCBzZWVtIHRvIGJlIHRvbyBtYW55IG90aGVyIG9iamVjdGlvbnMgdGhhdCB3b3Vs ZCBob2xkIGluIHRoZSB3b3JsZCBhbm5vIDIwMTYge2V4Y2VwdCBmb3IgInN1bmsgaW52ZXN0bWVu dCIgYXJndW1lbnRzIiwgYnV0IHRoYXQgaXMgYSBjb3Jwb3JhdGUgbWluZHNldCBpc3N1ZX0uDQoN Ck9uIDExLzE3LzIwMTYgMTI6NTAgQU0sIE1pY2hhZWwgU3RKb2hucyB3cm90ZToNCk9uIDExLzE2 LzIwMTYgOTowOCBBTSwgS2VwZW5nIExpIHdyb3RlOg0KDQpIZWxsbyBhbGwsDQoNCldlIGhhZCBh IGxvbmcgZGlzY3Vzc2lvbiBhYm91dCBncm91cCBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHRvcGlj IHNpbmNlIHRoZSBwcmV2aW91cyBGMkYgbWVldGluZy4NCg0KSGFubmVzIGFuZCBJIGhhdmUgdHJp ZWQgdG8gbWFrZSBhIHN1bW1hcnkgYWJvdXQgdGhlIGRpc2N1c3Npb24gYXMgZm9sbG93czoNCg0K wrcgICAgICAgVGhlIHNvbHV0aW9uIG5lZWRzIHRvIGRlZmluZSBib3RoLCBzeW1tZXRyaWMgYW5k IGFuIGFzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0aW9uLg0KDQpUaGVyZSBpcyBubyBjYXNlIChh YnNlbnQgaGFyZHdhcmUgbWl0aWdhdGlvbikgaW4gd2hpY2ggYSBzeW1tZXRyaWMgZ3JvdXAga2V5 IHNvbHV0aW9uIGNhbiBiZSBtYWRlIHNlY3VyZS9zYWZlIGFuZCBubyBvbmUgaGFzIG1hZGUgYW4g b2ZmZXIgb2YgcHJvb2YgdGhhdCB0aGV5IGNhbiBtYWtlIGl0IHNlY3VyZS4gICAgSSd2ZSBhc2tl ZCByZXBlYXRlZGx5IC0gbm8gb25lIGhhcyBjb21lIGZvcndhcmQgd2l0aCBtb3JlIHRoYW4gIm9o IHdlIGNhbiBsb2NrIHRoZSBzeW1tZXRyaWMga2V5IHN0dWZmIGluIGEgY29ybmVyIGFuZCBtYWtl IHN1cmUgaXQgaXNuJ3QgdXNlZCBmb3IgYW55dGhpbmcgaW1wb3J0YW50Ii4NCg0KDQpHaXZlbiB0 aGUgcmVjZW50IGF0dGFja3Mgb24gdGhlIGludGVybmV0IGJ5IElPVCBib3RuZXRzLCB0aGVyZSBp cyBhIGZ1cnRoZXIgY29uc2lkZXJhdGlvbiB0aGF0IHNob3VsZCBiZSB1bmRlcnRha2VuIC0gd2hl dGhlciB0aGUgc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBhcHBsaWVkIHRvIDEwcyBvZiAx MDAwcyBvZiBJT1QgZGV2aWNlcyBpcyBhbiBhY3RpdmUgdGhyZWF0IHRvIHRoZSByZXN0IG9mIHRo ZSBpbnRlcm5ldCAoZS5nLiBlbmFibGluZyBERE9TLCBjeWJlciBwaHlzaWNhbCBpc3N1ZXMsIGV0 Yyk/DQoNClRoZSBtdWx0aXBhcnR5IChncm91cCkgc3ltbWV0cmljIGtleSBzb2x1dGlvbiBpcyBv bmx5IHdhbnRlZCBmb3IgYSBzaW5nbGUgY29ybmVyIG9mIHRoZSBzb2x1dGlvbiBzcGFjZSAtIGxv dyBsYXRlbmN5LCBubyBjb3N0IHN5c3RlbXMuICBFLmcuIGxpZ2h0YnVsYnMuICBHaXZlbiB0aGVy ZSBpcyBhIHdvcmtlZCBleGFtcGxlIG9mIHRoZSBpbnNlY3VyaXR5IG9mIG11bHRpcGFydHkgc3lt bWV0cmljIGtleSBzeXN0ZW1zIChlLmcuIHRoZSBhdHRhY2sgb24gdGhlIHN5bW1ldHJpYyBzaWdu aW5nIGtleSBvZiB0aGUgSFVFIGxpZ2h0cyksIEknbSB1bmNsZWFyIHdoeSBhbnlvbmUgYXQgYWxs IHdvdWxkIHRoaW5rIHRoYXQgcHVyc3VpbmcgYSBrbm93biBiYWQgc29sdXRpb24gaW4gdGhlIElF VEYgaXMgYSBnb29kIGlkZWEuDQoNCg0KDQrCtyAgICAgICBUaGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbiBzZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIgd2hhdCBjaXJjdW1zdGFuY2VzIHdo YXQgc29sdXRpb24gaXMgYXBwcm9wcmlhdGUuDQoNClNlY3VyaXR5IGNvbnNpZGVyYXRpb24gc2Vj dGlvbnMgZ2VuZXJhbGx5IG9ubHkgYWRkcmVzcyB0aGUgdGhyZWF0ICp0byogdGhlIHN5c3RlbSBm cm9tIHNlY3VyaXR5IGNob2ljZXMuICBJbiB0aGlzIGNhc2UsIHN5bW1ldHJpYyBrZXkgZ3JvdXAg Y29tbXMgcmVkdWNlcyBkb3duIHRvIHRoZSBzYW1lIHNlY3VyaXR5IGFuYWx5c2lzIHlvdSB3b3Vs ZCB1c2Ugd2l0aCBzaGFyZWQgZGVmYXVsdCBwYXNzd29yZHMgYWNyb3NzIDEwMDBzIG9mIGRldmlj ZXMuICAgQW4gSU9UIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbiBpbiB0aGUgZnV0dXJl IHByb2JhYmx5IG5lZWRzIHRvIGFkZHJlc3MgdGhlIHRocmVhdCAqRlJPTSogdGhlIElPVCBzb2x1 dGlvbiB0byB0aGUgYnJvYWRlciBpbnRlcm5ldC4NCg0KTWlrZQ0KDQoNCg0KDQpJZiB0aGlzIGlz IG5vdCBhY2N1cmF0ZSwgcGxlYXNlIGxldCB1cyBrbm93Lg0KDQpLaW5kIFJlZ2FyZHMNCktlcGVu ZyAmIEhhbm5lcw0KDQpCVFc6IGl0IGlzIGEgcGl0eSB0aGF0IEkgY2FuJ3QgYXR0ZW5kIHRoaXMg bWVldGluZyBkdWUgdG8gcGVyc29uYWwgcmVhc29ucywgYW5kIGhvcGUgeW91IGFsbCBoYXZlIGEg bmljZSBtZWV0aW5nIGluIFNlb3VsIQ0KDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KDQpBY2UgbWFpbGluZyBsaXN0DQoNCkFjZUBpZXRmLm9y ZzxtYWlsdG86QWNlQGlldGYub3JnPg0KDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FjZQ0KDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCg0KQWNlIG1haWxpbmcgbGlzdA0KDQpBY2VAaWV0Zi5vcmc8bWFpbHRv OkFjZUBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9h Y2UNCg0KDQoNCg0KLS0NCg0KZW1haWw6IHJzdHJ1aWsuZXh0QGdtYWlsLmNvbTxtYWlsdG86cnN0 cnVpay5leHRAZ21haWwuY29tPiB8IFNreXBlOiByc3RydWlrDQoNCmNlbGw6ICsxICg2NDcpIDg2 Ny01NjU4IHwgVVM6ICsxICg0MTUpIDY5MC03MzYzDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGlldGYub3JnPG1h aWx0bzpBY2VAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2FjZQ0KDQoNCg0KLS0NCg0KQmVzdCByZWdhcmRzLA0KS2F0aGxlZW4NCg== --_000_D45466986D02Fgoranselanderericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJy ZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsgY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1zaXplOiAx NHB4OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyBmb250LXNpemU6IDE0cHg7Ij4NCkthdGhsZWVuIGFuZCBhbGwsPC9kaXY+DQo8ZGl2IHN0eWxl PSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsg Zm9udC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImNvbG9yOiByZ2Io MCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0 cHg7Ij4NCkkgYmVsaWV2ZSBhbGwgbmVjZXNzYXJ5IGRyYWZ0cyBmb3IgYSBzb2x1dGlvbiBiYXNl ZCBvbiBhc3ltbWV0cmljIGtleXMgYXJlIGFscmVhZHkgaW4gcGxhY2UuPC9kaXY+DQo8ZGl2IHN0 eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJp ZjsgZm9udC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImNvbG9yOiBy Z2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 IDE0cHg7Ij4NCldpdGggJnF1b3Q7YSBzb2x1dGlvbiBiYXNlZCBvbiBhc3ltbWV0cmljIGtleXPi gJ0gSSB1bmRlcnN0YW5kIGEgc29sdXRpb24gd2hlcmUgZWFjaCBtZW1iZXIgb2YgdGhlIGdyb3Vw IGNhbiBzaWduIG1lc3NhZ2VzIHdpdGggaXRzIHByaXZhdGUga2V5IGZvciBzb3VyY2UgYXV0aGVu dGljYXRpb24gYnV0IHdoZXJlIGNvbmZpZGVudGlhbGl0eSBpcyBwcm90ZWN0ZWQgd2l0aCBhIHN5 bW1ldHJpYyBrZXkgc2hhcmVkIGJldHdlZW4gdGhlIG1lbWJlcnMgb2YgdGhlDQogZ3JvdXAuPC9k aXY+DQo8ZGl2IHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyBmb250LXNpemU6IDE0cHg7Ij4NClsxXSBkZXNjcmliZXMgaG93IHRvIGRpc3RyaWJ1dGUgYW5k IHVzZSBzeW1tZXRyaWMga2V5cywgdXNpbmcgYSBLREMgZm9yIGRpc3RyaWJ1dGluZyB0aGUgc3lt bWV0cmljIGtleXMsIGFuZCByZWZlcmVuY2VzIE9TQ09BUCBmb3Igc2VjdXJpbmcgdGhlIGdyb3Vw IGNvbW11bmljYXRpb24uIFsyXSBzaG93cyBob3cgdG8gc2VjdXJlIGdyb3VwIGNvbW11bmljYXRp b24gZm9yIENvQVAgYmFzZWQgb24gYXN5bW1ldHJpYyBrZXlzIGFzIGRlc2NyaWJlZCBhYm92ZS4N CiBBcyBmYXIgYXMgSSB1bmRlcnN0YW5kLCB0aGUgb25seSB0aGluZyBtaXNzaW5nIGlzIGEgbWVj aGFuaXNtIGZvciBkaXN0cmlidXRpbmcgdGhlIHB1YmxpYyBrZXlzIG9mIHRoZSBtZW1iZXJzLCBi dXQgaXQgc2VlbXMgbmF0dXJhbCB0byBleHRlbmQgdGhlIEtEQyB3aXRoIHRoaXMgZnVuY3Rpb25h bGl0eS48L2Rpdj4NCjxkaXYgc3R5bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5 OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7Ij4NCjxicj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsiPg0KWzFdJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNvbWFyYWp1LWFjZS1tdWx0aWNhc3QtMDEiPmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1zb21hcmFqdS1hY2UtbXVsdGljYXN0LTAxPC9h PjwvZGl2Pg0KPGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IENh bGlicmksIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsiPg0KWzJdJm5ic3A7PGEgaHJlZj0i aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXRpbG9jYS1jb3JlLW11bHRpY2FzdC1v c2NvYXAtMDAiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC10aWxvY2EtY29yZS1t dWx0aWNhc3Qtb3Njb2FwLTAwPC9hPjwvZGl2Pg0KPGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAw LCAwKTsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsi Pg0KPGJyPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZh bWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJp LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7 IGZvbnQtc2l6ZTogMTRweDsiPg0KSG93ZXZlciwgSSBkb27igJl0IGFncmVlIHdpdGggYWxsIGNv bmNsdXNpb25zIG9mIHRoZSBhc3ltbWV0cmljIGtleSBwcm9wb25lbnRzLjwvZGl2Pg0KPGRpdiBz dHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2Vy aWY7IGZvbnQtc2l6ZTogMTRweDsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2Pkl0IGlzIG5vdCBuZXdz IHRoYXQmbmJzcDthc3ltbWV0cmljIGtleSB0ZWNobmlxdWVzIGFyZSBmZWFzaWJsZSBmb3IgdXNl IGluIG1hbnkgZW1iZWRkZWQgZGV2aWNlIGFwcGxpY2F0aW9ucywgYnV0IGl0IGlzIGdvb2QgdGhh dCB0aGUga25vd2xlZGdlIGlzIGJlaW5nIHNwcmVhZC4gQnV0IGV4ZWN1dGlvbiB0aW1lcyBhbmQg bWVzc2FnZSBzaXplcyBtYXkgc3RpbGwgYmUgcHJvaGliaXRpdmUgZm9yIHNvbWUgYXBwbGljYXRp b25zLiBUbyBhZGRyZXNzDQogUmVuZeKAmXMgcXVlc3Rpb24mbmJzcDs8c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsiPiZxdW90O2lz IDY0QiB0b28gbXVjaD8mcXVvdDs6Jm5ic3A7PC9zcGFuPjxmb250IGNvbG9yPSIjNDU0NTQ1IiBm YWNlPSJDYWxpYnJpIj5BZGRpbmcgdGhlIGNvdW50ZXJzaWduYXR1cmUgdG8gQ09TRSBtZXNzYWdl cyBzdWNoIGFzIHRob3NlIHVzZWQgaW4gbXVsdGljYXN0IE9TQ09BUCB3b3VsZCBpbmNyZWFzZSB0 aGUgc2l6ZSBmcm9tDQogdGhlIG9yZGVyIG9mIDIwIGJ5dGVzIHRvIHRoZSBvcmRlciBvZiA4NS05 MCBieXRlcyB3aGljaCBpbiB0dXJuIG1heSBhZGQgc2lnbmlmaWNhbnQgbGF0ZW5jeSBkZXBlbmRp bmcgb24gbGluayBsYXllciB0ZWNobm9sb2d5IHVzZWQsJm5ic3A7aW5kZXBlbmRlbnRseSBvZiBw cm9jZXNzb3ImbmJzcDtjYXBhY2l0eS48L2ZvbnQ+PC9kaXY+DQo8cCBzdHlsZT0iY29sb3I6IHJn Yig2OSwgNjksIDY5KTsgbWFyZ2luOiAwcHg7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG1pbi1oZWln aHQ6IDE0cHg7Ij4NCjxicj4NCjwvcD4NCjxkaXYgc3R5bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7 IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7Ij4NCjxw IHN0eWxlPSJmb250LWZhbWlseTogLXdlYmtpdC1zdGFuZGFyZDsgbWFyZ2luOiAwcHg7IGxpbmUt aGVpZ2h0OiBub3JtYWw7Ij48c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjogcmdiYSgyNTUs IDI1NSwgMjU1LCAwKTsiPldpdGhvdXQgbmVnbGVjdGluZyB0aGUgaXNzdWVzIHJhaXNlZCwgSSBk byB0aGluayB0aGF0IHRoZXJlIGlzIGEgcm9sZSBmb3Igc3ltbWV0cmljIGtleSBiYXNlZCBncm91 cCBjb21tdW5pY2F0aW9uIGZvciB0aGUgY2xhc3MNCiBvZiBhY3R1YXRvcnMgaW4gc2NvcGUgb2Yg WzFdLiBJIGFncmVlIGl0IGlzIGFuIGlzc3VlIGlmIGNvbXByb21pc2luZyBvbmUgZGV2aWNlIGFu ZCBleHRyYWN0aW5nIG9uZSBrZXkgbGV0J3MgeW91IHR1cm4gb2ZmIDEwMDAgbGFtcHMgKG5vdCBz YXlpbmcgaXQgaGFzIHRvLCBidXQganVzdCBhcyBhbiBleGFtcGxlKS4gQnV0IHRoYXQgZG9lc24n dCBhdXRvbWF0aWNhbGx5IHR1cm4gdGhlIGxpZ2h0YnVsYnMgaW50byBib3RzLiAmbmJzcDtUaGUg c2VjdXJpdHkNCiBjb25zaWRlcmF0aW9ucyBpbiB0aGlzIGNhc2Ugc2hvdWxkIGUuZy4gaW5jbHVk ZSB0aGluZ3MgbGlrZSByZXN0cmljdGluZyBjYXBhYmlsaXRpZXMgYXNzb2NpYXRlZCB3aXRoIHRo ZSBwb3NzZXNzaW9uIG9mIGEgc2hhcmVkIGtleS4mbmJzcDs8L3NwYW4+PC9wPg0KPHAgc3R5bGU9 ImZvbnQtZmFtaWx5OiAtd2Via2l0LXN0YW5kYXJkOyBtYXJnaW46IDBweDsgbGluZS1oZWlnaHQ6 IG5vcm1hbDsgbWluLWhlaWdodDogMjAuM3B4OyI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1j b2xvcjogcmdiYSgyNTUsIDI1NSwgMjU1LCAwKTsiPjxicj4NCjwvc3Bhbj48L3A+DQo8cCBzdHls ZT0iZm9udC1mYW1pbHk6IC13ZWJraXQtc3RhbmRhcmQ7IG1hcmdpbjogMHB4OyBsaW5lLWhlaWdo dDogbm9ybWFsOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6IHJnYmEoMjU1LCAyNTUs IDI1NSwgMCk7Ij5JbmRlcGVuZGVudCBvZiB0aGlzIGRpc2N1c3Npb24sIHN5bW1ldHJpYyBrZXkg c29sdXRpb25zIGZvciB0aGVzZSB1c2UgY2FzZXMgd2lsbCBjb250aW51ZSB0byBiZSBkZXBsb3ll ZC4gSSBmZWFyIHdlIG1heSBjcmVhdGUNCiBncmVhdGVyIGRhbWFnZSBieSBub3QgYW5hbHlzaW5n IGFuZCBwcm92aWRpbmcgZ3VpZGFuY2UgdG8gdGhlc2UgdXNlIGNhc2VzIHdoZW4gYXBwbGllZCBp biBhIHN5bW1ldHJpYyBrZXkgc2V0dGluZywgYXQgdGhlIHNhbWUgdGltZSBhcyBzcGVjaWZ5aW5n IGFuIGFzeW1tZXRyaWMga2V5IHNvbHV0aW9uLjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyBmb250LXNpemU6IDE0cHg7Ij4NCjxicj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJj b2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgZm9u dC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImNvbG9yOiByZ2IoMCwg MCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7 Ij4NCkfDtnJhbjwvZGl2Pg0KPGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1m YW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsiPg0KPGJyPg0KPC9k aXY+DQo8ZGl2IHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9ImNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlm OyBmb250LXNpemU6IDE0cHg7Ij4NCjxicj4NCjwvZGl2Pg0KPHNwYW4gaWQ9Ik9MS19TUkNfQk9E WV9TRUNUSU9OIiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IENhbGli cmksIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsiPg0KPGRpdiBzdHlsZT0iZm9udC1mYW1p bHk6Q2FsaWJyaTsgZm9udC1zaXplOjExcHQ7IHRleHQtYWxpZ246bGVmdDsgY29sb3I6YmxhY2s7 IEJPUkRFUi1CT1RUT006IG1lZGl1bSBub25lOyBCT1JERVItTEVGVDogbWVkaXVtIG5vbmU7IFBB RERJTkctQk9UVE9NOiAwaW47IFBBRERJTkctTEVGVDogMGluOyBQQURESU5HLVJJR0hUOiAwaW47 IEJPUkRFUi1UT1A6ICNiNWM0ZGYgMXB0IHNvbGlkOyBCT1JERVItUklHSFQ6IG1lZGl1bSBub25l OyBQQURESU5HLVRPUDogM3B0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXdlaWdodDpib2xkIj5Gcm9t OiA8L3NwYW4+QWNlICZsdDs8YSBocmVmPSJtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmciPmFj ZS1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVoYWxmIG9mIEthdGhsZWVuIE1vcmlhcnR5 ICZsdDs8YSBocmVmPSJtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20iPmth dGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8c3BhbiBzdHlsZT0i Zm9udC13ZWlnaHQ6Ym9sZCI+RGF0ZTogPC9zcGFuPkZyaWRheSAxOCBOb3ZlbWJlciAyMDE2IGF0 IDA0OjU5PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OmJvbGQiPlRvOiA8L3NwYW4+JnF1 b3Q7VGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRv OnRpcmVkZHlAY2lzY28uY29tIj50aXJlZGR5QGNpc2NvLmNvbTwvYT4mZ3Q7PGJyPg0KPHNwYW4g c3R5bGU9ImZvbnQtd2VpZ2h0OmJvbGQiPkNjOiA8L3NwYW4+TWljaGFlbCBTdEpvaG5zICZsdDs8 YSBocmVmPSJtYWlsdG86bXN0am9obnNAY29tY2FzdC5uZXQiPm1zdGpvaG5zQGNvbWNhc3QubmV0 PC9hPiZndDssIFJlbmUgU3RydWlrICZsdDs8YSBocmVmPSJtYWlsdG86cnN0cnVpay5leHRAZ21h aWwuY29tIj5yc3RydWlrLmV4dEBnbWFpbC5jb208L2E+Jmd0OywgJnF1b3Q7PGEgaHJlZj0ibWFp bHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPiZxdW90OyAmbHQ7PGEgaHJlZj0ibWFp bHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPiZndDs8YnI+DQo8c3BhbiBzdHlsZT0i Zm9udC13ZWlnaHQ6Ym9sZCI+U3ViamVjdDogPC9zcGFuPlJlOiBbQWNlXSBTdW1tYXJ5IG9mIEFD RSBHcm91cCBDb21tdW5pY2F0aW9uIFNlY3VyaXR5IERpc2N1c3Npb248YnI+DQo8L2Rpdj4NCjxk aXY+PGJyPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBpZD0iTUFDX09VVExPT0tfQVRUUklCVVRJT05f QkxPQ0tRVU9URSIgc3R5bGU9IkJPUkRFUi1MRUZUOiAjYjVjNGRmIDUgc29saWQ7IFBBRERJTkc6 MCAwIDAgNTsgTUFSR0lOOjAgMCAwIDU7Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBkaXI9Imx0ciI+ PGJyPg0KPGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj4NCjxkaXYgY2xhc3M9ImdtYWlsX3F1 b3RlIj5PbiBUaHUsIE5vdiAxNywgMjAxNiBhdCAxMDo1NiBQTSwgVGlydW1hbGVzd2FyIFJlZGR5 ICh0aXJlZGR5KQ0KPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86dGlyZWRkeUBj aXNjby5jb20iIHRhcmdldD0iX2JsYW5rIj50aXJlZGR5QGNpc2NvLmNvbTwvYT4mZ3Q7PC9zcGFu PiB3cm90ZTo8YnI+DQo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4 Ij4NCjxkaXYgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0ibV8tNDkwMDgwMjc5NjEzOTE3MjU4M1dvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFmNDk3ZCI+S2F0aGxlZW4sDQo8dT48L3U+ PHU+PC91Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFmNDk3ZCI+PHU+PC91PiZuYnNwOzx1PjwvdT48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPkkgd2lsbCBwdXQgdXAg YSBwcm9wb3NhbCBiZWZvcmUgdGhlIENoaWNhZ28gbWVldGluZy48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PlRoYW5rIHlv dS4mbmJzcDs8L2Rpdj4NCjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h cmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDox ZXgiPg0KPGRpdiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJtXy00OTAwODAyNzk2MTM5MTcyNTgzV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMWY0OTdkIj48dT48L3U+PHU+PC91Pjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFm NDk3ZCI+PHU+PC91PiZuYnNwOzx1PjwvdT48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPi1UaXJ1PHU+PC91Pjx1PjwvdT48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5 N2QiPjx1PjwvdT4mbmJzcDs8dT48L3U+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBw dCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjZTFl MWUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4g QWNlIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj48 YSBocmVmPSJtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20iIHRhcmdldD0i X2JsYW5rIj5rYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLjx3YnI+Y29tPC9hPjxicj4NCjxi PlNlbnQ6PC9iPiBGcmlkYXksIE5vdmVtYmVyIDE4LCAyMDE2IDU6MzAgQU08YnI+DQo8Yj5Ubzo8 L2I+IFJlbmUgU3RydWlrICZsdDs8YSBocmVmPSJtYWlsdG86cnN0cnVpay5leHRAZ21haWwuY29t IiB0YXJnZXQ9Il9ibGFuayI+cnN0cnVpay5leHRAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5D Yzo8L2I+IE1pY2hhZWwgU3RKb2hucyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zdGpvaG5zQGNvbWNh c3QubmV0IiB0YXJnZXQ9Il9ibGFuayI+bXN0am9obnNAY29tY2FzdC5uZXQ8L2E+Jmd0OzsNCjxh IGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8 L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQWNlXSBTdW1tYXJ5IG9mIEFDRSBHcm91cCBD b21tdW5pY2F0aW9uIFNlY3VyaXR5IERpc2N1c3Npb248dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgY2xhc3M9Img1Ij4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjx1PjwvdT4mbmJzcDs8dT48L3U+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPklzIGFueW9uZSB3aWxsaW5nIHRvIHdvcmsgb24gYSBkcmFmdCB0byBiZSByZWFkeSBpbiBh ZHZhbmNlIG9mIHRoZSBDaGljYWdvIG1lZXRpbmcgc28gd2UgaGF2ZSBhIGNvbmNyZXRlIHByb3Bv c2FsIGZvciBhc3ltbWV0cmljIGtleXM/PHU+PC91Pjx1PjwvdT48L3A+DQo8L2Rpdj4NCjxkaXYg aWQ9Im1fLTQ5MDA4MDI3OTYxMzkxNzI1ODNBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHU+PC91PiZuYnNwOzx1PjwvdT48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1f LTQ5MDA4MDI3OTYxMzkxNzI1ODNBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhhbmtzLDx1PjwvdT48dT48L3U+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy00OTAw ODAyNzk2MTM5MTcyNTgzQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkthdGhsZWVuJm5ic3A7PGJyPg0KPGJyPg0KUGxlYXNlIGV4Y3VzZSB0eXBvcywgc2VudCBmcm9t IGhhbmRoZWxkIGRldmljZSZuYnNwOzx1PjwvdT48dT48L3U+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpP biBOb3YgMTcsIDIwMTYsIGF0IDExOjI2IFBNLCBSZW5lIFN0cnVpayAmbHQ7PGEgaHJlZj0ibWFp bHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJzdHJ1aWsuZXh0QGdt YWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjx1PjwvdT48dT48L3U+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGVhciBjb2xsZWFndWVzOjxicj4NCjxicj4N Ckp1c3QgYSByZW1pbmRlciByZSBwZXJjZWl2ZWQgdGVjaG5pY2FsIGh1cmRsZXMgZm9yIHVzaW5n IHNpZ25hdHVyZXM6PGJyPg0KYSkgdGltZSBsYXRlbmN5IG9mIHNpZ25pbmc6PGJyPg0KT25lIGNh biBwcmUtY29tcHV0ZSBlcGhlbWVyYWwgc2lnbmluZyBrZXlzLCBzbyBhcyB0byByZWR1Y2Ugb25s aW5lIGtleSBjb21wdXRhdGlvbiB0byBhIGZldyBmaW5pdGUgZmllbGQgbXVsdGlwbGllcy4NCjxi cj4NClBsZWFzZSBzZWUgbXkgZW1haWwgdG8gdGhlIGxpc3Qgb2YgSnVseSAyNiwgMjAxNjogPGEg aHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2UvaUViMFhuQUlN QUJfVjNJOExqTUZRUmoxRmUwIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL21haWxhcmNoaXZl LmlldGYub3JnLzx3YnI+YXJjaC9tc2cvYWNlL2lFYjBYbkFJTUFCXzx3YnI+VjNJOExqTUZRUmox RmUwPC9hPjxicj4NCmIpOiBmdXJ0aGVyIHNwZWVkLXVwcy90cmlja3MsIGV0Yzo8YnI+DQpPbmUg Y2FuIHRyeSBhbmQgYmUgc21hcnRlciBieSBjbGV2ZXIgaW1wbGVtZW50YXRpb25zLjxicj4NClBs ZWFzZSBzZWUgbXkgZW1haWwgdG8gdGhlIGxpc3Qgb2YgSnVseSAyMSwgMjAxNjogPGEgaHJlZj0i aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2UvaUk1OG1UX0REektJbUwx TFBfYlVRN1R6b29JIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL21haWxhcmNoaXZlLmlldGYu b3JnLzx3YnI+YXJjaC9tc2cvYWNlL2lJNThtVF88d2JyPkREektJbUwxTFBfYlVRN1R6b29JPC9h Pjxicj4NCjxicj4NClRoaXMgc2VlbXMgdG8gdGFrZSB0aGUgdGltZSBsYXRlbmN5IGFyZ3VtZW50 IGF3YXkuIFRoZSBvbmx5IG90aGVyIHRlY2huaWNhbCBodXJkbGVzIEkgY2FuIHNlZSBhcmUNCjxi cj4NCihpKSBzaWduYXR1cmUgc2l6ZSB7aXMgNjRCIHRvbyBtdWNoP307IDxicj4NCihpaSkgY29z dCBvZiBwdWJsaWMga2V5IGNyeXB0byBpbXBsZW1lbnRhdGlvbnMge3F1aXRlIHNvbWUgc21hbGws IG5pZnR5IGRlc2lnbnMgb3V0IHRoZXJlIChOYUNsIGV0Yy59Ljxicj4NCjxicj4NCkFzIHRvIChp KSAtIG9uZSBzaG91bGQgdmlldyBzaWduYXR1cmUgc2l6ZXMgaW4gcGVyc3BlY3RpdmU6IGFzIGFu IGV4YW1wbGUsIGtleSBzaXplcyBpbiB0aGUga2V5IHByZS1kaXN0cmlidXRpb24gc2NoZW1lIEhJ TU1PIChhcyBwcm9tb3RlZCBieSBQaGlsaXBzKSBoYXMga2V5IHNpemVzIG9mIDYuMjUga0IgYW5k IHVwLCBhY2NvcmRpbmcgdG8gVGFibGUgMyBvZiB0aGUgcGFwZXIgdGhhdCBtYXNzYWdlcyBwYXJh bWV0ZXJzIHRvIHRod2FydCBuZXcNCiBhdHRhY2tzIG9uIHRoZWlyIHNjaGVtZSwgc2VlIDxhIGhy ZWY9Imh0dHA6Ly9lcHJpbnQuaWFjci5vcmcvMjAxNi8xNTIiIHRhcmdldD0iX2JsYW5rIj4NCmh0 dHA6Ly9lcHJpbnQuaWFjci5vcmcvMjAxNi88d2JyPjE1MjwvYT4uPGJyPg0KPGJyPg0KU28sIHNl Y3VyaXR5IGFyZ3VtZW50cyB0aGF0IGZhdm9yIGFzeW1tZXRyaWMgc29sdXRpb25zIGFzaWRlLCB0 aGVyZSBhbHNvIGRvIG5vdCBzZWVtIHRvIGJlIHRvbyBtYW55IG90aGVyIG9iamVjdGlvbnMgdGhh dCB3b3VsZCBob2xkIGluIHRoZSB3b3JsZCBhbm5vIDIwMTYge2V4Y2VwdCBmb3IgJnF1b3Q7c3Vu ayBpbnZlc3RtZW50JnF1b3Q7IGFyZ3VtZW50cyZxdW90OywgYnV0IHRoYXQgaXMgYSBjb3Jwb3Jh dGUgbWluZHNldCBpc3N1ZX0uPGJyPg0KPGJyPg0KT24gMTEvMTcvMjAxNiAxMjo1MCBBTSwgTWlj aGFlbCBTdEpvaG5zIHdyb3RlOjx1PjwvdT48dT48L3U+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxMS8xNi8yMDE2IDk6MDggQU0sIEtlcGVuZyBMaSB3cm90 ZTo8dT48L3U+PHU+PC91PjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cD5IZWxsbyBhbGwsJm5ic3A7IDx1Pjwv dT48dT48L3U+PC9wPg0KPHA+V2UgaGFkIGEgbG9uZyBkaXNjdXNzaW9uIGFib3V0IGdyb3VwIGNv bW11bmljYXRpb24gc2VjdXJpdHkgdG9waWMgc2luY2UgdGhlIHByZXZpb3VzIEYyRiBtZWV0aW5n Ljx1PjwvdT48dT48L3U+PC9wPg0KPHA+SGFubmVzIGFuZCBJIGhhdmUgdHJpZWQgdG8gbWFrZSBh IHN1bW1hcnkgYWJvdXQgdGhlIGRpc2N1c3Npb24gYXMgZm9sbG93czo8dT48L3U+PHU+PC91Pjwv cD4NCjxwPsK3Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoZSBzb2x1dGlv biBuZWVkcyB0byBkZWZpbmUgYm90aCwgc3ltbWV0cmljIGFuZCBhbiBhc3ltbWV0cmljIGdyb3Vw IGtleSBzb2x1dGlvbi4NCjx1PjwvdT48dT48L3U+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGJyPg0KVGhlcmUgaXMgbm8gY2FzZSAoYWJzZW50IGhhcmR3YXJlIG1p dGlnYXRpb24pIGluIHdoaWNoIGEgc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBjYW4gYmUg bWFkZSBzZWN1cmUvc2FmZSBhbmQgbm8gb25lIGhhcyBtYWRlIGFuIG9mZmVyIG9mIHByb29mIHRo YXQgdGhleSBjYW4gbWFrZSBpdCBzZWN1cmUuJm5ic3A7Jm5ic3A7Jm5ic3A7IEkndmUgYXNrZWQg cmVwZWF0ZWRseSAtIG5vIG9uZSBoYXMgY29tZSBmb3J3YXJkIHdpdGggbW9yZSB0aGFuICZxdW90 O29oIHdlIGNhbiBsb2NrDQogdGhlIHN5bW1ldHJpYyBrZXkgc3R1ZmYgaW4gYSBjb3JuZXIgYW5k IG1ha2Ugc3VyZSBpdCBpc24ndCB1c2VkIGZvciBhbnl0aGluZyBpbXBvcnRhbnQmcXVvdDsuPGJy Pg0KPGJyPg0KPGJyPg0KR2l2ZW4gdGhlIHJlY2VudCBhdHRhY2tzIG9uIHRoZSBpbnRlcm5ldCBi eSBJT1QgYm90bmV0cywgdGhlcmUgaXMgYSBmdXJ0aGVyIGNvbnNpZGVyYXRpb24gdGhhdCBzaG91 bGQgYmUgdW5kZXJ0YWtlbiAtIHdoZXRoZXIgdGhlIHN5bW1ldHJpYyBncm91cCBrZXkgc29sdXRp b24gYXBwbGllZCB0byAxMHMgb2YgMTAwMHMgb2YgSU9UIGRldmljZXMgaXMgYW4gYWN0aXZlIHRo cmVhdCB0byB0aGUgcmVzdCBvZiB0aGUgaW50ZXJuZXQgKGUuZy4gZW5hYmxpbmcNCiBERE9TLCBj eWJlciBwaHlzaWNhbCBpc3N1ZXMsIGV0Yyk/PGJyPg0KPGJyPg0KVGhlIG11bHRpcGFydHkgKGdy b3VwKSBzeW1tZXRyaWMga2V5IHNvbHV0aW9uIGlzIG9ubHkgd2FudGVkIGZvciBhIHNpbmdsZSBj b3JuZXIgb2YgdGhlIHNvbHV0aW9uIHNwYWNlIC0gbG93IGxhdGVuY3ksIG5vIGNvc3Qgc3lzdGVt cy4mbmJzcDsgRS5nLiBsaWdodGJ1bGJzLiZuYnNwOyBHaXZlbiB0aGVyZSBpcyBhIHdvcmtlZCBl eGFtcGxlIG9mIHRoZSBpbnNlY3VyaXR5IG9mIG11bHRpcGFydHkgc3ltbWV0cmljIGtleSBzeXN0 ZW1zIChlLmcuIHRoZSBhdHRhY2sNCiBvbiB0aGUgc3ltbWV0cmljIHNpZ25pbmcga2V5IG9mIHRo ZSBIVUUgbGlnaHRzKSwgSSdtIHVuY2xlYXIgd2h5IGFueW9uZSBhdCBhbGwgd291bGQgdGhpbmsg dGhhdCBwdXJzdWluZyBhIGtub3duIGJhZCBzb2x1dGlvbiBpbiB0aGUgSUVURiBpcyBhIGdvb2Qg aWRlYS48YnI+DQo8YnI+DQo8YnI+DQo8dT48L3U+PHU+PC91PjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHA+wrcmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24g c2VjdGlvbiBuZWVkcyB0byBleHBsYWluIHVuZGVyIHdoYXQgY2lyY3Vtc3RhbmNlcyB3aGF0IHNv bHV0aW9uIGlzIGFwcHJvcHJpYXRlLg0KPHU+PC91Pjx1PjwvdT48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpTZWN1cml0eSBjb25zaWRlcmF0aW9uIHNlY3Rp b25zIGdlbmVyYWxseSBvbmx5IGFkZHJlc3MgdGhlIHRocmVhdCAqdG8qIHRoZSBzeXN0ZW0gZnJv bSBzZWN1cml0eSBjaG9pY2VzLiZuYnNwOyBJbiB0aGlzIGNhc2UsIHN5bW1ldHJpYyBrZXkgZ3Jv dXAgY29tbXMgcmVkdWNlcyBkb3duIHRvIHRoZSBzYW1lIHNlY3VyaXR5IGFuYWx5c2lzIHlvdSB3 b3VsZCB1c2Ugd2l0aCBzaGFyZWQgZGVmYXVsdCBwYXNzd29yZHMgYWNyb3NzIDEwMDBzIG9mIGRl dmljZXMuJm5ic3A7Jm5ic3A7DQogQW4gSU9UIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gc2VjdGlv biBpbiB0aGUgZnV0dXJlIHByb2JhYmx5IG5lZWRzIHRvIGFkZHJlc3MgdGhlIHRocmVhdCAqRlJP TSogdGhlIElPVCBzb2x1dGlvbiB0byB0aGUgYnJvYWRlciBpbnRlcm5ldC48YnI+DQo8YnI+DQpN aWtlPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPHU+PC91Pjx1PjwvdT48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwPklmIHRo aXMgaXMgbm90IGFjY3VyYXRlLCBwbGVhc2UgbGV0IHVzIGtub3cuPHU+PC91Pjx1PjwvdT48L3A+ DQo8cD5LaW5kIFJlZ2FyZHM8YnI+DQpLZXBlbmcgJmFtcDsgSGFubmVzPHU+PC91Pjx1PjwvdT48 L3A+DQo8cD5CVFc6IGl0IGlzIGEgcGl0eSB0aGF0IEkgY2FuJ3QgYXR0ZW5kIHRoaXMgbWVldGlu ZyBkdWUgdG8gcGVyc29uYWwgcmVhc29ucywgYW5kIGhvcGUgeW91IGFsbCBoYXZlIGEgbmljZSBt ZWV0aW5nIGluIFNlb3VsITx1PjwvdT48dT48L3U+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGJyPg0KPGJyPg0KPGJyPg0KPHU+PC91Pjx1PjwvdT48L3A+DQo8cHJlPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fXzx3YnI+X19fX19fX19fX19fX19fX188dT48L3U+PHU+PC91PjwvcHJl Pg0KPHByZT5BY2UgbWFpbGluZyBsaXN0PHU+PC91Pjx1PjwvdT48L3ByZT4NCjxwcmU+PGEgaHJl Zj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRmLm9yZzwvYT48 dT48L3U+PHU+PC91PjwvcHJlPg0KPHByZT48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2FjZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vPHdicj5saXN0aW5mby9hY2U8L2E+PHU+PC91Pjx1PjwvdT48L3ByZT4NCjwvYmxv Y2txdW90ZT4NCjxwPjx1PjwvdT4mbmJzcDs8dT48L3U+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyPg0KPGJyPg0KPGJyPg0KPHU+PC91Pjx1PjwvdT48L3A+DQo8cHJlPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fXzx3YnI+X19fX19fX19fX19fX19fX188dT48L3U+PHU+PC91Pjwv cHJlPg0KPHByZT5BY2UgbWFpbGluZyBsaXN0PHU+PC91Pjx1PjwvdT48L3ByZT4NCjxwcmU+PGEg aHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRmLm9yZzwv YT48dT48L3U+PHU+PC91PjwvcHJlPg0KPHByZT48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2FjZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vPHdicj5saXN0aW5mby9hY2U8L2E+PHU+PC91Pjx1PjwvdT48L3ByZT4NCjwv YmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PjwvdT4mbmJzcDs8dT48L3U+PC9w Pg0KPHA+PHU+PC91PiZuYnNwOzx1PjwvdT48L3A+DQo8cHJlPi0tIDx1PjwvdT48dT48L3U+PC9w cmU+DQo8cHJlPmVtYWlsOiA8YSBocmVmPSJtYWlsdG86cnN0cnVpay5leHRAZ21haWwuY29tIiB0 YXJnZXQ9Il9ibGFuayI+cnN0cnVpay5leHRAZ21haWwuY29tPC9hPiB8IFNreXBlOiByc3RydWlr PHU+PC91Pjx1PjwvdT48L3ByZT4NCjxwcmU+Y2VsbDogJiM0MzsxICg2NDcpIDg2Ny01NjU4IHwg VVM6ICYjNDM7MSAoNDE1KSA2OTAtNzM2Mzx1PjwvdT48dT48L3U+PC9wcmU+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fXzx3YnI+X19fX19fX19fX19fX19fX188YnI+DQpBY2UgbWFpbGluZyBs aXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFj ZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2FjZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vPHdicj5saXN0aW5mby9hY2U8L2E+PHU+PC91Pjx1PjwvdT48L3A+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxkaXY+PGJyPg0KPC9kaXY+ DQotLSA8YnI+DQo8ZGl2IGNsYXNzPSJnbWFpbF9zaWduYXR1cmUiIGRhdGEtc21hcnRtYWlsPSJn bWFpbF9zaWduYXR1cmUiPg0KPGRpdiBkaXI9Imx0ciI+PGJyPg0KPGRpdj5CZXN0IHJlZ2FyZHMs PC9kaXY+DQo8ZGl2PkthdGhsZWVuPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L3NwYW4+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_D45466986D02Fgoranselanderericssoncom_-- From nobody Fri Nov 18 00:13:35 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8EB51294C1 for ; Fri, 18 Nov 2016 00:13:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=philips.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8a_nXEiBhQ8 for ; Fri, 18 Nov 2016 00:13:28 -0800 (PST) Received: from emea01-am1-obe.outbound.protection.outlook.com (mail-am1on0713.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe00::713]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E1EE129472 for ; Fri, 18 Nov 2016 00:13:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Philips.onmicrosoft.com; s=selector1-philips-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=GqVKpFrMEagKoy2G5TCaXWicSMqxttAtw1F0CdZa29Y=; b=bXclfnh3/bbi8e45Wutr9YR3+ZyL+yiJX0MsbSEbsZxWGZufT5ATciDr+SQGch0uoAUcf53nfe9jzwRXvcDKZMm/CLhXgqEpyNNODWcwXGFU4u4dSn29Y+XJy9E2jfgIocOcS2dy1IEP6JbUSY0I6TePMSZeoWA7DuZR9UfGMEo= Received: from HE1P122CA0001.EURP122.PROD.OUTLOOK.COM (129.75.100.143) by VI1P122MB0029.EURP122.PROD.OUTLOOK.COM (129.75.100.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.721.19; Fri, 18 Nov 2016 08:13:02 +0000 Received: from DB3FFO11FD014.protection.gbl (2a01:111:f400:7e04::120) by HE1P122CA0001.outlook.office365.com (2603:10a6:23:2::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.10 via Frontend Transport; Fri, 18 Nov 2016 08:13:02 +0000 Authentication-Results: spf=none (sender IP is 40.103.22.84) smtp.mailfrom=philips.com; ericsson.com; dkim=none (message not signed) header.d=none;ericsson.com; dmarc=none action=none header.from=philips.com; Received-SPF: None (protection.outlook.com: philips.com does not designate permitted sender hosts) Received: from 011-smtp-out.Philips.com (40.103.22.84) by DB3FFO11FD014.mail.protection.outlook.com (10.47.216.188) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.4 via Frontend Transport; Fri, 18 Nov 2016 08:13:01 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:; UpperCasedChecksum:; SizeAsReceived:5208; Count:54 Received: from VI1PR9003MB0237.MGDPHG.emi.philips.com (129.75.99.82) by VI1PR9003MB0237.MGDPHG.emi.philips.com (129.75.99.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.721.19; Fri, 18 Nov 2016 08:13:01 +0000 Received: from VI1PR9003MB0237.MGDPHG.emi.philips.com ([129.75.99.82]) by VI1PR9003MB0237.MGDPHG.emi.philips.com ([129.75.99.82]) with mapi id 15.01.0721.017; Fri, 18 Nov 2016 08:13:01 +0000 From: "Kumar, Sandeep" To: =?utf-8?B?R8O2cmFuIFNlbGFuZGVy?= , "Kathleen Moriarty" , "ace@ietf.org" Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion Thread-Index: AQHSF95QsC+5rVMRV0yRdDB1g0aTt6CLnZYAgEqWLFyAADkGAIAFiXENgAEG6ACAAJBRAIAAoFiAgABB34CAAAEDAIAAQy6AgAABm1A= Date: Fri, 18 Nov 2016 08:13:00 +0000 Message-ID: <7b1b0dd3488645c693e346b71cede1ea@VI1PR9003MB0237.MGDPHG.emi.philips.com> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [85.150.192.178] X-MS-Office365-Filtering-Correlation-Id: f1a495ae-6296-4054-dcc3-08d40f8ab753 Content-Type: multipart/alternative; boundary="_000_7b1b0dd3488645c693e346b71cede1eaVI1PR9003MB0237MGDPHGem_" MIME-Version: 1.0 X-OrganizationHeadersPreserved: VI1PR9003MB0237.MGDPHG.emi.philips.com X-IncomingHeaderCount: 54 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:40.103.22.84; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(428002)(53754006)(199003)(189002)(374574003)(53434003)(24454002)(55904004)(377454003)(85714005)(92566002)(2950100002)(69596002)(2906002)(551544002)(4326007)(14971765001)(356003)(8666005)(325944008)(2900100001)(626004)(5660300001)(8676002)(33646002)(54356999)(86362001)(50986999)(575784001)(7696004)(101416001)(76176999)(108616004)(106116001)(106466001)(105586002)(2501003)(93886004)(561944003)(66066001)(7846002)(81166006)(8936002)(7736002)(81156014)(512874002)(16297215004)(68736007)(7906003)(2420400007)(24736003)(102836003)(15650500001)(606004)(7110500001)(97736004)(84326002)(87936001)(189998001)(790700001)(3846002)(6116002)(5001770100001)(38730400001)(229853002)(7059030); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1P122MB0029; H:011-smtp-out.Philips.com; FPR:; SPF:None; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; DB3FFO11FD014; 1:0kcxo8l1QzX3QTdCDitqVCsL0iyZ2C+EPqCrEiGC3EIS/9S5m4fkFjgePHdbDYhdk8KewBxcVZZ0QvXQN10spBAW5VLrOUPReaDgYCBLNMRA6jT4S+ndjKRTn1OtbpcYU6srItDWu3NZELljLnBmi90CbcSKUXwobcubO7jBJpWHzp4ar5sr8tG+GZCfvWuohqN0vfSIS2tMjTnssCOBAJ7GO/TFlabq/nzzAS+2fMprIU0UaLYU05/oXeYMfHXCplFG1mwSsFNi1eSx8o3ytqD++zTZqEtNa0MMRgeIdXy2k5qDQAYUjeShshkWnZdeLm5NNq4cNBYXOz7hzsAQJz80Acg8FfUZ+OFYcCsbZpogNP8KoJKRwormu2YJVRccTFUfGSU9HkXvfG/rT4XWZb6mYK68Scv0l8btDbLafU5RBNyQgShV5VPQrc437JQKYrTRov3tt+UaUivgJ52O/2EWAaZ2ffcoFW23aHOOWmFv8wMtedVHCx4ZmDZgtPR2q0El39OJspjSwmmTzTppuA== X-CrossPremisesHeadersPromoted: DB3FFO11FD014.protection.gbl X-CrossPremisesHeadersFiltered: DB3FFO11FD014.protection.gbl X-Microsoft-Exchange-Diagnostics: 1; VI1P122MB0029; 2:/yONsIhUhDqykqW7zRI7EPZNEjx4/qw5k3PXF9BzkrSbQoZlYd9hLXPrzLzauZCSM+QRLpsjd5vmrmAXYUYByDc8O3VyowLl0pUAIG05dk/EUmmXefOFuir3W1Yl7jFmlO32hK2rqaoPjSixDwXX1elr3OJSmM+Tp0SefLy1koQ=; 3:ul3yNOIOBdV+u84LhvgYpfelx5jaqvd/VdKARoE4DHVss+h1QqLWAhTWk0EqHEZwycQqzl+BLQgeUKWthbRDiISmMJkvgYepGtVg19thX0wOfnEfiESCAQy9sig8UFRU6oG+8Yu06FBo++rPfoPY1Da4UqVZkctR7xye57OKE+NGKuSrogRlfy4XRJHLpoRYJsjm89RkaRAGO3nzGWxH4yL40ddZoJzlilW1Puyzx7+hwSrWj1sk6PEXnqAgzMbN6qmTnHLnKKtf9+Dz1Lqozw==; 25:OwhXAu7Yg7xghBSHUzc75UPc4YUPGtoVm3pAW9ExSCO/LlPowrRAT9SW0AE+yGPwjbtSNmzbXnBUHO0OtsSwsdEg3KStjcEaHBAzHk8+l+djfZV4A7b+xwOGWNfBFkoygCpMGuyh5C3xsyac0l2Q/mHcO7z510mQA7L4Jg8v8/WJjnt10XEhDUQq8iVVw7zXsfmWgPnKEEQlmcarxBiuBu7JbEj6s+FmVV8F3HK6gpSVY2vHIun3jB3xv/socmvwyy/YMJgyZzjpvmm97Yq6OE+vC1XLT8xaVAyb/BKd+3i+1KDVc0KxxB+u+me1K3abTlU+rznA9P0NVJN6rwWfnchjNcq1ZZ35uB4aIwPF04bqmuOQnyHvWuv33FXbDABFqoe2U/kZ7HNZhMK3qWRxFEgdVBNXPB/gYrmEHZcy63hMxWcKMT241B83vaBTxxiU57izlJpHnTF2pAJUgmojZw== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1P122MB0029; X-Microsoft-Exchange-Diagnostics: 1; VI1P122MB0029; 31:Mgy2uXuHNgAnfa2nqrMwNglhpgTcucrB78NBGwqLYAlD9cUTwysBlhN5bkI3Dfe1Df7ESVJh696OVDKW+OUw5RaPxi4uWzyyYL1N7ztH0M0ozRyolQdjxvi0t7o2hdzz/tlixE7uv3Z5mXB95X1wUTO02lm8cVjxZlha9Ferx8d/6YTXCqp/93YWSGYo/tQwP+dm+sHK3ewv4xBjQoqzXeN2w78ANE6Nm8Xtg3I+1G707VfbJbEeOBMDc9EIPSjeARENVB4792e8mh/DaEE6yg==; 20:theQu2+QTamPA9nY+9J/Y5C1be54XLlAqvzMtHdHcYzbFcK04dBo/s9MAqGmEvTfeAPYRHLzWOkuecZhz9G84IdZpniGLZpcGjBu/0X9ZPggmuafJ3UDMveqcIijHi9NetFBeY9adFSfDwBM4q22B1lqRW2RS4IpdP7ckg8tUAHhHzV2X6AX6R5wEYacpaOS50jLf6OMPrs6xWiN6hkJDgrx3eXH6sDNiEY6fQ5pV0jnCFVVPEduQ2yoTEyEzt3L0xh05lw1bwvfUjigY/uu1PGtGD/rxihywxOzXvUXZOV+Vjy7up0K2bzr3TxRUPW5RUkiNue29pVgmoNMttq+eL+rCqKC/krbqoGkh50FqfjJGhWDpLZME2gjG2Wd3Kph8BRiRYPJEcmnHWUTDc65amm/EHYJr9XiWlneo0sYuYuKSXP2Pzmf10zamqpXfR8mCZsmDOgnKsWqrkFT3lVuj6U+Y9LVZ7P4kVeQV2bwGhPRsRvo9Oyt0UFexBsEVvUr X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(68173958961439)(278428928389397)(209352067349851)(192374486261705)(95692535739014)(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040281)(6060326)(2401047)(13016025)(8121501046)(13018025)(5005006)(3002001)(10201501046)(6055026)(6061324)(6041223); SRVR:VI1P122MB0029; BCL:0; PCL:0; RULEID:; SRVR:VI1P122MB0029; X-Microsoft-Exchange-Diagnostics: 1; VI1P122MB0029; 4:CVU+cvbs6K+QaA21vhHtRw4igpAHDfNov62maBWjxvce2Xv6QpkM6/qArZJ0soFRe553M0KqDfJRsme0XmhQai4zT/4PY4crnQ7GN3aUTFIsjxAEbwPgEiCyHkfwEMWZPmM96Ycjy2f1Xlf733BCPm66FCI+4Yfuc1qJNGs8sllbQtcLSrOVCHiMHWj5TbrnoqlFwSfqKP1DAcKmDXkl+GAq2k3gkDWGBZgvFB0y6W8FwgcoWtzbkllOV8HpuAkSr8JKtz4rpD0KNG1/7DQCF5KYl0wnx0VFHoLGy3InupE33aTaebNV0e9Qdm43PMTD40TDVNID24OWVGPEOUhjeGJpQ1PJ7OMvQgZEmm0N3/N6rirj6GKO0PJ6UDgtGZEBMJd2ePSAQytvpknwQR1eovb5AGHQT5Ug7y4xQ79ktRcMtosr5xkURowekHnU4cLqV5svdOf7v62849Exwn5bhU8MOJh4QWI5pQ9Y1XZaipujUWaOqoutPhmpe4OZFZypNh5L1bVCejLSqo4k21Xl0riiR4OVlS24BfN3GKgjAkj8cj9lixC0GkYxiIez/j1yiPIG+2MgWgb1mxDkdootqugXGIWqogEgXpIDuMNWlLR17pGnZuxs4zpKnvKvVeQnONctIJ4/Jinu5uG2KncrYUSltrVIqTaiAySLHe/q+wGYNEOjRRS9w9JpAzResWAF/FSYGBQ3wZ6IXE9SOIMZ2g== X-Forefront-PRVS: 01304918F3 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; VI1P122MB0029; 23:wdwUwbhgN7vSTPhHFvr6ZJikf9Wfj+tKhQGiRsvIh?= =?us-ascii?Q?gZ2bwGsLJeeG+FDyU/osNnD9cUqEYMG0gAlK7WX42Y1R6FhsNKWPEhbZ6zRr?= =?us-ascii?Q?6ZoHX0D02fO4fPlIqsMvWc9Oc8RbPo9Y46cM6JpDkv/C1vLkQS08mESotMel?= =?us-ascii?Q?8Nkk/F46mac8+bZdh6YmivS+sUdH5bVwB/kZ6uLRRT8cPxH516gw8E7PwCfX?= =?us-ascii?Q?NtF3qbHd/xjlaMQr1zfx7fqlt5cS43vCfXs8Guhvicn4TuHY3iWgb/JWCGHG?= =?us-ascii?Q?vES0s1AZK4uBlZGuRsrZhe//VQdyGEuOjM+J1Ir2qOsSFcoopBGpdgipjlHp?= =?us-ascii?Q?mAmGbaiQ+Aa4GrVAMf4kfAtwUWhuCPsJrKA3e3rzTvGSdjUKP2muOMGoh0G6?= =?us-ascii?Q?8jEAwHwPCWkpAaSvZbQTc4UtcERox42K1f9FwWWYzb/bHBq993o0HP63jhMt?= =?us-ascii?Q?OXgXCQXPI8W4SK6mjHhexnlEdQfL70lbAMxfGB5fl0xn2nwjIEgvndyAoSWV?= =?us-ascii?Q?+WgJsFg+NzlEb/RSRlXYnOzu+Uw224PIerrg3GmduWEj8q2g19WtIVJxJpLo?= =?us-ascii?Q?l2Iiy1QtLGzGUfHO0lmj3mjMe+S15f7TFhvsHuxzaZR+iX0tHRUZGYG8NBZY?= =?us-ascii?Q?+COfg7Gf5AIC1qaUugR6cQUfIgaI7dbCsIqSFGkVHbkwo9r7XhtIQkp5YLgC?= =?us-ascii?Q?QXUpHMxtZWw57087TnJYXCL8QSAcVwVH34iaLiaWrzQYg9r/IgqdBRqJh/s7?= =?us-ascii?Q?CCZMJsYRRekSLEap5/95/CqIZL2NQ91QvimrIuthmPpvS5MOyXTaMlu8DPk8?= =?us-ascii?Q?HWxNpkdmUhYzQSDYvhJo6/XXooeJDToUEXkeCuM+l5sAwheYNAWWgy7iGBS7?= =?us-ascii?Q?InChcILvPNOrtbF/+lCBrO0RX9s300sEjNI/oI42R/BzjzXqR/M3M9dPpRhj?= =?us-ascii?Q?WiIrIuREzp/vvUoY4wg5FWndrZLjxzoUH+v6Be8V+u43siBz6kuaaB2rCn2I?= =?us-ascii?Q?i9dsgJlZe+CNX1iQM4z3s93ZNZBLoqT5Gdc7jqVWU/0H93DEIPQbPFv+Q7/P?= =?us-ascii?Q?MN2l8n6ST9+ndCMzpY8EEJGuJf6d2PEjkfYJ0wmb5WCo5SVBv+90xV7YZPSV?= =?us-ascii?Q?5ArW0UyIzbzAohgx3aN69av4vBaZgpPTYIcBxrdN/ziHu8ctGegQhr0k67eu?= =?us-ascii?Q?7EOo7way4JmfHpWDmUmi2ICyEOEwzb+L9t0X4fU4Iw0X7ir600SfIvvj96bc?= =?us-ascii?Q?eY5daHfjM2h+5pJBNMnTWY1goHSK1XtvR/h624dvtGhj5l7YBtoGY1On7Md+?= =?us-ascii?Q?8T+C6Nf3I+jrj4wPFOHw8tTZ1roXerm6kcNTYsqvyarsllntJuN9diQ5HOID?= =?us-ascii?Q?hSPaBu+swWnRbsAH31Nctkf7zPGMJiva5WL89N/p+IqJ90ZURV3FM+FFFyvl?= =?us-ascii?Q?Yk0m/M78vM27A4zI7DpQlZmjRJapsa9cfqU2WFo+3tglwZr5xmsdfrj9k3iB?= =?us-ascii?Q?2UmNRAlj1wSRtj8+Dnfv1xSvlAl6nG97OyDIYWvBg6nsOhYp04KTHn+fMplq?= =?us-ascii?Q?gXzlGp2y3oOOFxkbIezG3AXelBb16qVg3OGQ2kp3RXi9v+eJcTR4CYOiWl40?= =?us-ascii?Q?xPrCtldI9y8dHgPRvJnLvZtRf1cEtXo+g6vbF30yQI=3D?= X-Microsoft-Exchange-Diagnostics: 1; VI1P122MB0029; 6:Ex5vmNMThpPEeaMiP3Tqt7hJrxyL9wYp19iVcEMV4rSOoQvEmvSWtwxNKaG7I8EH9M4duShXu6mVvymNIS6tmz2QVGnUzM58RsFCzJ4dSSBktXHZuEgtBcvkeCmrGd6VfZcc79dSqAOnA5hDrhICJs8kvO0Ak7oAS01K66G4sgsSJJwESQ37cPCmww1mR0kha2Y8cKbu0c4zXX3kxxa/nS6DgifN8EJ3f3jUwALec+YyfNmhnr40R5Bsk8VxMSMdASSU/XAZRCzm3KEq0o5ISCCsBPIyruAkdlxhbNlfOm0arNGPwJjz9nUthrO8T31CTjjpimXXInrd30iFLfmvf4aF4p2bl3MysV8X5TTXl2jeUU30cCtIXaJ0/5Jhqi5w; 5:WamoR8/SSlTvZiSF0j3V7Q1hkPdRmusJd95y32UpqI1z9or/K5m91+BgPh7IovYYd6wVS5ntjXoTzG+QQA3npNBz9uw78x85KA/Rnh9bQkmHO5nJyDIR9/3kQeCeP01sOmI/8NO/W27GhNcxsiLsGg==; 24:WiQtCrqLp1WB9rGL6vg03EchDKkKDt36HLL8mJusK7h5Reoyd3FEoHQniLjKuZaJFOqm6Z6YrbRrdx078K2TY7ku3oOA3KXnlvPP+uq8Kfs= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; VI1P122MB0029; 7:t7eEUCo7iZZ0U8KMg7YLOiOWC5Jrw+mtqJ2ogFy15KZz3Meak7K2Mlj9W+Dd4r/qjkcWsUpx6rMqufKC5cxNJ1dkiDt9iVpf2IDaGy1XiPVuLve1plBgNBoCKZ6EkEZ1hCUZG5WwejQpqtr2HzgATiigTAHzCb3znabliN6xYQ7FSRBhgUBVwfEdSITXqBQT3XXOyNEnU5LMsN8wZYcZevkBenDO18ryq3FaxW0ekzvAqWEgBmgEWxBQISowwKn7wesAxCT2Pa8Xb9I2OcIY+A3SC6QHjx5A2bytcj/UYwR6lTJIGe4jq40qHH+W6854vExaNIVRCxfp/f3LN2MpZRnsjosHfSv2JGy8BXqs9mg= X-OriginatorOrg: philips.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Nov 2016 08:13:01.9216 (UTC) X-MS-Exchange-CrossTenant-Id: 1a407a2d-7675-4d17-8692-b3ac285306e4 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1a407a2d-7675-4d17-8692-b3ac285306e4; Ip=[40.103.22.84]; Helo=[011-smtp-out.Philips.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P122MB0029 X-MS-Exchange-CrossPremises-AuthAs: Internal X-MS-Exchange-CrossPremises-AuthMechanism: 04 X-MS-Exchange-CrossPremises-AuthSource: VI1PR9003MB0237.MGDPHG.emi.philips.com X-MS-Exchange-CrossPremises-SCL: 1 X-MS-Exchange-CrossPremises-messagesource: StoreDriver X-MS-Exchange-CrossPremises-BCC: X-MS-Exchange-CrossPremises-originalclientipaddress: 85.150.192.178 X-MS-Exchange-CrossPremises-disclaimer-hash: 7fd5309d68bb4378c576a4d2c2ad972d336f5eb0475879c2a0b14da1aac98972 X-MS-Exchange-CrossPremises-processed-by-journaling: Journal Agent X-MS-Exchange-CrossPremises-AVStamp-Service: 1.0 X-MS-Exchange-CrossPremises-Antispam-ScanContext: DIR:Originating; SFV:NSPM; SKIP:0; X-OrganizationHeadersPreserved: VI1P122MB0029.EURP122.PROD.OUTLOOK.COM Archived-At: Cc: Michael Richardson , Michael StJohns , Rene Struik , "Tirumaleswar Reddy \(tireddy\)" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 08:13:34 -0000 --_000_7b1b0dd3488645c693e346b71cede1eaVI1PR9003MB0237MGDPHGem_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgR8O2cmFuLCBLYXRobGVlbiBhbmQgYWxsDQoNCkV4dGVuZGluZyBvbiB0aGUgY29tbWVudCDi gJxidXQgaXQgc2VlbXMgbmF0dXJhbCB0byBleHRlbmQgdGhlIEtEQyB3aXRoIHRoaXMgZnVuY3Rp b25hbGl0eeKAnSwgdGhlIG5ldyB2ZXJzaW9uIG9mIHRoZSBkcmFmdC1zb21hcmFqdS1hY2UtbXVs dGljYXN0IFsxXSBzdWJtaXR0ZWQgYSB3ZWVrIGJhY2sgaW5jbHVkZXMgbm93IHRoZSBhc3ltbWV0 cmljIHZlcnNpb24gYXMgdGhlIHJlY29tbWVuZGVkIHZlcnNpb24gZm9yIG1vc3QgYXBwbGljYXRp b24gZXhjZXB0IHRoZSBsb3cgbGF0ZW5jeSBhcHBsaWNhdGlvbnMgKHRvIGJlIGFjaGlldmVkIGlu IGxvdyByZXNvdXJjZSBkZXZpY2UpLg0KQEthdGhsZWVuOiB3aGF0IHlvdSBoYXZlIGFza2VkIGlz IGFscmVhZHkgaW4gdGhlIG5ldyBkcmFmdCBhbmQgdGhlIGFzcGVjdHMgcmVnYXJkaW5nIE9TQ09B UCBpbiBbMl0gd2hpY2ggY2FuIGJlIGVhc2lseSBtZXJnZWQgaW50byBbMV0uIEFyZSB5b3UgYXNr aW5nIGZvciBzb21ldGhpbmcgZWxzZT8NCg0KU2FuZGVlcA0KDQoNCkZyb206IEFjZSBbbWFpbHRv OmFjZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgR8O2cmFuIFNlbGFuZGVyDQpTZW50 OiBGcmlkYXksIE5vdmVtYmVyIDE4LCAyMDE2IDk6MDAgQU0NClRvOiBLYXRobGVlbiBNb3JpYXJ0 eSA8a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+OyBhY2VAaWV0Zi5vcmcNCkNjOiBN aWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1hbi5jYT47IE1pY2hhZWwgU3RKb2hu cyA8bXN0am9obnNAY29tY2FzdC5uZXQ+OyBSZW5lIFN0cnVpayA8cnN0cnVpay5leHRAZ21haWwu Y29tPjsgVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+DQpT dWJqZWN0OiBSZTogW0FjZV0gU3VtbWFyeSBvZiBBQ0UgR3JvdXAgQ29tbXVuaWNhdGlvbiBTZWN1 cml0eSBEaXNjdXNzaW9uDQoNCkthdGhsZWVuIGFuZCBhbGwsDQoNCkkgYmVsaWV2ZSBhbGwgbmVj ZXNzYXJ5IGRyYWZ0cyBmb3IgYSBzb2x1dGlvbiBiYXNlZCBvbiBhc3ltbWV0cmljIGtleXMgYXJl IGFscmVhZHkgaW4gcGxhY2UuDQoNCldpdGggImEgc29sdXRpb24gYmFzZWQgb24gYXN5bW1ldHJp YyBrZXlz4oCdIEkgdW5kZXJzdGFuZCBhIHNvbHV0aW9uIHdoZXJlIGVhY2ggbWVtYmVyIG9mIHRo ZSBncm91cCBjYW4gc2lnbiBtZXNzYWdlcyB3aXRoIGl0cyBwcml2YXRlIGtleSBmb3Igc291cmNl IGF1dGhlbnRpY2F0aW9uIGJ1dCB3aGVyZSBjb25maWRlbnRpYWxpdHkgaXMgcHJvdGVjdGVkIHdp dGggYSBzeW1tZXRyaWMga2V5IHNoYXJlZCBiZXR3ZWVuIHRoZSBtZW1iZXJzIG9mIHRoZSBncm91 cC4NCg0KWzFdIGRlc2NyaWJlcyBob3cgdG8gZGlzdHJpYnV0ZSBhbmQgdXNlIHN5bW1ldHJpYyBr ZXlzLCB1c2luZyBhIEtEQyBmb3IgZGlzdHJpYnV0aW5nIHRoZSBzeW1tZXRyaWMga2V5cywgYW5k IHJlZmVyZW5jZXMgT1NDT0FQIGZvciBzZWN1cmluZyB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbi4g WzJdIHNob3dzIGhvdyB0byBzZWN1cmUgZ3JvdXAgY29tbXVuaWNhdGlvbiBmb3IgQ29BUCBiYXNl ZCBvbiBhc3ltbWV0cmljIGtleXMgYXMgZGVzY3JpYmVkIGFib3ZlLiBBcyBmYXIgYXMgSSB1bmRl cnN0YW5kLCB0aGUgb25seSB0aGluZyBtaXNzaW5nIGlzIGEgbWVjaGFuaXNtIGZvciBkaXN0cmli dXRpbmcgdGhlIHB1YmxpYyBrZXlzIG9mIHRoZSBtZW1iZXJzLCBidXQgaXQgc2VlbXMgbmF0dXJh bCB0byBleHRlbmQgdGhlIEtEQyB3aXRoIHRoaXMgZnVuY3Rpb25hbGl0eS4NCg0KWzFdIGh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1zb21hcmFqdS1hY2UtbXVsdGljYXN0LTAxDQpb Ml0gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXRpbG9jYS1jb3JlLW11bHRpY2Fz dC1vc2NvYXAtMDANCg0KDQoNCkhvd2V2ZXIsIEkgZG9u4oCZdCBhZ3JlZSB3aXRoIGFsbCBjb25j bHVzaW9ucyBvZiB0aGUgYXN5bW1ldHJpYyBrZXkgcHJvcG9uZW50cy4NCg0KSXQgaXMgbm90IG5l d3MgdGhhdCBhc3ltbWV0cmljIGtleSB0ZWNobmlxdWVzIGFyZSBmZWFzaWJsZSBmb3IgdXNlIGlu IG1hbnkgZW1iZWRkZWQgZGV2aWNlIGFwcGxpY2F0aW9ucywgYnV0IGl0IGlzIGdvb2QgdGhhdCB0 aGUga25vd2xlZGdlIGlzIGJlaW5nIHNwcmVhZC4gQnV0IGV4ZWN1dGlvbiB0aW1lcyBhbmQgbWVz c2FnZSBzaXplcyBtYXkgc3RpbGwgYmUgcHJvaGliaXRpdmUgZm9yIHNvbWUgYXBwbGljYXRpb25z LiBUbyBhZGRyZXNzIFJlbmXigJlzIHF1ZXN0aW9uICJpcyA2NEIgdG9vIG11Y2g/IjogQWRkaW5n IHRoZSBjb3VudGVyc2lnbmF0dXJlIHRvIENPU0UgbWVzc2FnZXMgc3VjaCBhcyB0aG9zZSB1c2Vk IGluIG11bHRpY2FzdCBPU0NPQVAgd291bGQgaW5jcmVhc2UgdGhlIHNpemUgZnJvbSB0aGUgb3Jk ZXIgb2YgMjAgYnl0ZXMgdG8gdGhlIG9yZGVyIG9mIDg1LTkwIGJ5dGVzIHdoaWNoIGluIHR1cm4g bWF5IGFkZCBzaWduaWZpY2FudCBsYXRlbmN5IGRlcGVuZGluZyBvbiBsaW5rIGxheWVyIHRlY2hu b2xvZ3kgdXNlZCwgaW5kZXBlbmRlbnRseSBvZiBwcm9jZXNzb3IgY2FwYWNpdHkuDQoNCg0KDQpX aXRob3V0IG5lZ2xlY3RpbmcgdGhlIGlzc3VlcyByYWlzZWQsIEkgZG8gdGhpbmsgdGhhdCB0aGVy ZSBpcyBhIHJvbGUgZm9yIHN5bW1ldHJpYyBrZXkgYmFzZWQgZ3JvdXAgY29tbXVuaWNhdGlvbiBm b3IgdGhlIGNsYXNzIG9mIGFjdHVhdG9ycyBpbiBzY29wZSBvZiBbMV0uIEkgYWdyZWUgaXQgaXMg YW4gaXNzdWUgaWYgY29tcHJvbWlzaW5nIG9uZSBkZXZpY2UgYW5kIGV4dHJhY3Rpbmcgb25lIGtl eSBsZXQncyB5b3UgdHVybiBvZmYgMTAwMCBsYW1wcyAobm90IHNheWluZyBpdCBoYXMgdG8sIGJ1 dCBqdXN0IGFzIGFuIGV4YW1wbGUpLiBCdXQgdGhhdCBkb2Vzbid0IGF1dG9tYXRpY2FsbHkgdHVy biB0aGUgbGlnaHRidWxicyBpbnRvIGJvdHMuICBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMg aW4gdGhpcyBjYXNlIHNob3VsZCBlLmcuIGluY2x1ZGUgdGhpbmdzIGxpa2UgcmVzdHJpY3Rpbmcg Y2FwYWJpbGl0aWVzIGFzc29jaWF0ZWQgd2l0aCB0aGUgcG9zc2Vzc2lvbiBvZiBhIHNoYXJlZCBr ZXkuDQoNCg0KDQpJbmRlcGVuZGVudCBvZiB0aGlzIGRpc2N1c3Npb24sIHN5bW1ldHJpYyBrZXkg c29sdXRpb25zIGZvciB0aGVzZSB1c2UgY2FzZXMgd2lsbCBjb250aW51ZSB0byBiZSBkZXBsb3ll ZC4gSSBmZWFyIHdlIG1heSBjcmVhdGUgZ3JlYXRlciBkYW1hZ2UgYnkgbm90IGFuYWx5c2luZyBh bmQgcHJvdmlkaW5nIGd1aWRhbmNlIHRvIHRoZXNlIHVzZSBjYXNlcyB3aGVuIGFwcGxpZWQgaW4g YSBzeW1tZXRyaWMga2V5IHNldHRpbmcsIGF0IHRoZSBzYW1lIHRpbWUgYXMgc3BlY2lmeWluZyBh biBhc3ltbWV0cmljIGtleSBzb2x1dGlvbi4NCg0KDQpHw7ZyYW4NCg0KDQoNCkZyb206IEFjZSA8 YWNlLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVo YWxmIG9mIEthdGhsZWVuIE1vcmlhcnR5IDxrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNv bTxtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+Pg0KRGF0ZTogRnJpZGF5 IDE4IE5vdmVtYmVyIDIwMTYgYXQgMDQ6NTkNClRvOiAiVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJl ZGR5KSIgPHRpcmVkZHlAY2lzY28uY29tPG1haWx0bzp0aXJlZGR5QGNpc2NvLmNvbT4+DQpDYzog TWljaGFlbCBTdEpvaG5zIDxtc3Rqb2huc0Bjb21jYXN0Lm5ldDxtYWlsdG86bXN0am9obnNAY29t Y2FzdC5uZXQ+PiwgUmVuZSBTdHJ1aWsgPHJzdHJ1aWsuZXh0QGdtYWlsLmNvbTxtYWlsdG86cnN0 cnVpay5leHRAZ21haWwuY29tPj4sICJhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4i IDxhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0FjZV0g U3VtbWFyeSBvZiBBQ0UgR3JvdXAgQ29tbXVuaWNhdGlvbiBTZWN1cml0eSBEaXNjdXNzaW9uDQoN Cg0KDQpPbiBUaHUsIE5vdiAxNywgMjAxNiBhdCAxMDo1NiBQTSwgVGlydW1hbGVzd2FyIFJlZGR5 ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb208bWFpbHRvOnRpcmVkZHlAY2lzY28uY29tPj4g d3JvdGU6DQpLYXRobGVlbiwNCg0KSSB3aWxsIHB1dCB1cCBhIHByb3Bvc2FsIGJlZm9yZSB0aGUg Q2hpY2FnbyBtZWV0aW5nLg0KDQpUaGFuayB5b3UuDQoNCi1UaXJ1DQoNCkZyb206IEFjZSBbbWFp bHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZz5dIE9u IEJlaGFsZiBPZiBrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbTxtYWlsdG86a2F0aGxl ZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+DQpTZW50OiBGcmlkYXksIE5vdmVtYmVyIDE4LCAy MDE2IDU6MzAgQU0NClRvOiBSZW5lIFN0cnVpayA8cnN0cnVpay5leHRAZ21haWwuY29tPG1haWx0 bzpyc3RydWlrLmV4dEBnbWFpbC5jb20+Pg0KQ2M6IE1pY2hhZWwgU3RKb2hucyA8bXN0am9obnNA Y29tY2FzdC5uZXQ8bWFpbHRvOm1zdGpvaG5zQGNvbWNhc3QubmV0Pj47IGFjZUBpZXRmLm9yZzxt YWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBY2VdIFN1bW1hcnkgb2YgQUNFIEdy b3VwIENvbW11bmljYXRpb24gU2VjdXJpdHkgRGlzY3Vzc2lvbg0KDQpJcyBhbnlvbmUgd2lsbGlu ZyB0byB3b3JrIG9uIGEgZHJhZnQgdG8gYmUgcmVhZHkgaW4gYWR2YW5jZSBvZiB0aGUgQ2hpY2Fn byBtZWV0aW5nIHNvIHdlIGhhdmUgYSBjb25jcmV0ZSBwcm9wb3NhbCBmb3IgYXN5bW1ldHJpYyBr ZXlzPw0KDQpUaGFua3MsDQpLYXRobGVlbg0KDQpQbGVhc2UgZXhjdXNlIHR5cG9zLCBzZW50IGZy b20gaGFuZGhlbGQgZGV2aWNlDQoNCk9uIE5vdiAxNywgMjAxNiwgYXQgMTE6MjYgUE0sIFJlbmUg U3RydWlrIDxyc3RydWlrLmV4dEBnbWFpbC5jb208bWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNv bT4+IHdyb3RlOg0KRGVhciBjb2xsZWFndWVzOg0KDQpKdXN0IGEgcmVtaW5kZXIgcmUgcGVyY2Vp dmVkIHRlY2huaWNhbCBodXJkbGVzIGZvciB1c2luZyBzaWduYXR1cmVzOg0KYSkgdGltZSBsYXRl bmN5IG9mIHNpZ25pbmc6DQpPbmUgY2FuIHByZS1jb21wdXRlIGVwaGVtZXJhbCBzaWduaW5nIGtl eXMsIHNvIGFzIHRvIHJlZHVjZSBvbmxpbmUga2V5IGNvbXB1dGF0aW9uIHRvIGEgZmV3IGZpbml0 ZSBmaWVsZCBtdWx0aXBsaWVzLg0KUGxlYXNlIHNlZSBteSBlbWFpbCB0byB0aGUgbGlzdCBvZiBK dWx5IDI2LCAyMDE2OiBodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9p RWIwWG5BSU1BQl9WM0k4TGpNRlFSajFGZTANCmIpOiBmdXJ0aGVyIHNwZWVkLXVwcy90cmlja3Ms IGV0YzoNCk9uZSBjYW4gdHJ5IGFuZCBiZSBzbWFydGVyIGJ5IGNsZXZlciBpbXBsZW1lbnRhdGlv bnMuDQpQbGVhc2Ugc2VlIG15IGVtYWlsIHRvIHRoZSBsaXN0IG9mIEp1bHkgMjEsIDIwMTY6IGh0 dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWNlL2lJNThtVF9ERHpLSW1MMUxQ X2JVUTdUem9vSQ0KDQpUaGlzIHNlZW1zIHRvIHRha2UgdGhlIHRpbWUgbGF0ZW5jeSBhcmd1bWVu dCBhd2F5LiBUaGUgb25seSBvdGhlciB0ZWNobmljYWwgaHVyZGxlcyBJIGNhbiBzZWUgYXJlDQoo aSkgc2lnbmF0dXJlIHNpemUge2lzIDY0QiB0b28gbXVjaD99Ow0KKGlpKSBjb3N0IG9mIHB1Ymxp YyBrZXkgY3J5cHRvIGltcGxlbWVudGF0aW9ucyB7cXVpdGUgc29tZSBzbWFsbCwgbmlmdHkgZGVz aWducyBvdXQgdGhlcmUgKE5hQ2wgZXRjLn0uDQoNCkFzIHRvIChpKSAtIG9uZSBzaG91bGQgdmll dyBzaWduYXR1cmUgc2l6ZXMgaW4gcGVyc3BlY3RpdmU6IGFzIGFuIGV4YW1wbGUsIGtleSBzaXpl cyBpbiB0aGUga2V5IHByZS1kaXN0cmlidXRpb24gc2NoZW1lIEhJTU1PIChhcyBwcm9tb3RlZCBi eSBQaGlsaXBzKSBoYXMga2V5IHNpemVzIG9mIDYuMjUga0IgYW5kIHVwLCBhY2NvcmRpbmcgdG8g VGFibGUgMyBvZiB0aGUgcGFwZXIgdGhhdCBtYXNzYWdlcyBwYXJhbWV0ZXJzIHRvIHRod2FydCBu ZXcgYXR0YWNrcyBvbiB0aGVpciBzY2hlbWUsIHNlZSBodHRwOi8vZXByaW50LmlhY3Iub3JnLzIw MTYvMTUyLg0KDQpTbywgc2VjdXJpdHkgYXJndW1lbnRzIHRoYXQgZmF2b3IgYXN5bW1ldHJpYyBz b2x1dGlvbnMgYXNpZGUsIHRoZXJlIGFsc28gZG8gbm90IHNlZW0gdG8gYmUgdG9vIG1hbnkgb3Ro ZXIgb2JqZWN0aW9ucyB0aGF0IHdvdWxkIGhvbGQgaW4gdGhlIHdvcmxkIGFubm8gMjAxNiB7ZXhj ZXB0IGZvciAic3VuayBpbnZlc3RtZW50IiBhcmd1bWVudHMiLCBidXQgdGhhdCBpcyBhIGNvcnBv cmF0ZSBtaW5kc2V0IGlzc3VlfS4NCg0KT24gMTEvMTcvMjAxNiAxMjo1MCBBTSwgTWljaGFlbCBT dEpvaG5zIHdyb3RlOg0KT24gMTEvMTYvMjAxNiA5OjA4IEFNLCBLZXBlbmcgTGkgd3JvdGU6DQoN CkhlbGxvIGFsbCwNCg0KV2UgaGFkIGEgbG9uZyBkaXNjdXNzaW9uIGFib3V0IGdyb3VwIGNvbW11 bmljYXRpb24gc2VjdXJpdHkgdG9waWMgc2luY2UgdGhlIHByZXZpb3VzIEYyRiBtZWV0aW5nLg0K DQpIYW5uZXMgYW5kIEkgaGF2ZSB0cmllZCB0byBtYWtlIGEgc3VtbWFyeSBhYm91dCB0aGUgZGlz Y3Vzc2lvbiBhcyBmb2xsb3dzOg0KDQrCtyAgICAgICBUaGUgc29sdXRpb24gbmVlZHMgdG8gZGVm aW5lIGJvdGgsIHN5bW1ldHJpYyBhbmQgYW4gYXN5bW1ldHJpYyBncm91cCBrZXkgc29sdXRpb24u DQoNClRoZXJlIGlzIG5vIGNhc2UgKGFic2VudCBoYXJkd2FyZSBtaXRpZ2F0aW9uKSBpbiB3aGlj aCBhIHN5bW1ldHJpYyBncm91cCBrZXkgc29sdXRpb24gY2FuIGJlIG1hZGUgc2VjdXJlL3NhZmUg YW5kIG5vIG9uZSBoYXMgbWFkZSBhbiBvZmZlciBvZiBwcm9vZiB0aGF0IHRoZXkgY2FuIG1ha2Ug aXQgc2VjdXJlLiAgICBJJ3ZlIGFza2VkIHJlcGVhdGVkbHkgLSBubyBvbmUgaGFzIGNvbWUgZm9y d2FyZCB3aXRoIG1vcmUgdGhhbiAib2ggd2UgY2FuIGxvY2sgdGhlIHN5bW1ldHJpYyBrZXkgc3R1 ZmYgaW4gYSBjb3JuZXIgYW5kIG1ha2Ugc3VyZSBpdCBpc24ndCB1c2VkIGZvciBhbnl0aGluZyBp bXBvcnRhbnQiLg0KDQoNCkdpdmVuIHRoZSByZWNlbnQgYXR0YWNrcyBvbiB0aGUgaW50ZXJuZXQg YnkgSU9UIGJvdG5ldHMsIHRoZXJlIGlzIGEgZnVydGhlciBjb25zaWRlcmF0aW9uIHRoYXQgc2hv dWxkIGJlIHVuZGVydGFrZW4gLSB3aGV0aGVyIHRoZSBzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0 aW9uIGFwcGxpZWQgdG8gMTBzIG9mIDEwMDBzIG9mIElPVCBkZXZpY2VzIGlzIGFuIGFjdGl2ZSB0 aHJlYXQgdG8gdGhlIHJlc3Qgb2YgdGhlIGludGVybmV0IChlLmcuIGVuYWJsaW5nIERET1MsIGN5 YmVyIHBoeXNpY2FsIGlzc3VlcywgZXRjKT8NCg0KVGhlIG11bHRpcGFydHkgKGdyb3VwKSBzeW1t ZXRyaWMga2V5IHNvbHV0aW9uIGlzIG9ubHkgd2FudGVkIGZvciBhIHNpbmdsZSBjb3JuZXIgb2Yg dGhlIHNvbHV0aW9uIHNwYWNlIC0gbG93IGxhdGVuY3ksIG5vIGNvc3Qgc3lzdGVtcy4gIEUuZy4g bGlnaHRidWxicy4gIEdpdmVuIHRoZXJlIGlzIGEgd29ya2VkIGV4YW1wbGUgb2YgdGhlIGluc2Vj dXJpdHkgb2YgbXVsdGlwYXJ0eSBzeW1tZXRyaWMga2V5IHN5c3RlbXMgKGUuZy4gdGhlIGF0dGFj ayBvbiB0aGUgc3ltbWV0cmljIHNpZ25pbmcga2V5IG9mIHRoZSBIVUUgbGlnaHRzKSwgSSdtIHVu Y2xlYXIgd2h5IGFueW9uZSBhdCBhbGwgd291bGQgdGhpbmsgdGhhdCBwdXJzdWluZyBhIGtub3du IGJhZCBzb2x1dGlvbiBpbiB0aGUgSUVURiBpcyBhIGdvb2QgaWRlYS4NCg0KDQrCtyAgICAgICBU aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIg d2hhdCBjaXJjdW1zdGFuY2VzIHdoYXQgc29sdXRpb24gaXMgYXBwcm9wcmlhdGUuDQoNClNlY3Vy aXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbnMgZ2VuZXJhbGx5IG9ubHkgYWRkcmVzcyB0aGUgdGhy ZWF0ICp0byogdGhlIHN5c3RlbSBmcm9tIHNlY3VyaXR5IGNob2ljZXMuICBJbiB0aGlzIGNhc2Us IHN5bW1ldHJpYyBrZXkgZ3JvdXAgY29tbXMgcmVkdWNlcyBkb3duIHRvIHRoZSBzYW1lIHNlY3Vy aXR5IGFuYWx5c2lzIHlvdSB3b3VsZCB1c2Ugd2l0aCBzaGFyZWQgZGVmYXVsdCBwYXNzd29yZHMg YWNyb3NzIDEwMDBzIG9mIGRldmljZXMuICAgQW4gSU9UIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24g c2VjdGlvbiBpbiB0aGUgZnV0dXJlIHByb2JhYmx5IG5lZWRzIHRvIGFkZHJlc3MgdGhlIHRocmVh dCAqRlJPTSogdGhlIElPVCBzb2x1dGlvbiB0byB0aGUgYnJvYWRlciBpbnRlcm5ldC4NCg0KTWlr ZQ0KDQoNCg0KSWYgdGhpcyBpcyBub3QgYWNjdXJhdGUsIHBsZWFzZSBsZXQgdXMga25vdy4NCg0K S2luZCBSZWdhcmRzDQpLZXBlbmcgJiBIYW5uZXMNCg0KQlRXOiBpdCBpcyBhIHBpdHkgdGhhdCBJ IGNhbid0IGF0dGVuZCB0aGlzIG1lZXRpbmcgZHVlIHRvIHBlcnNvbmFsIHJlYXNvbnMsIGFuZCBo b3BlIHlvdSBhbGwgaGF2ZSBhIG5pY2UgbWVldGluZyBpbiBTZW91bCENCg0KDQoNCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNCkFjZSBtYWlsaW5nIGxp c3QNCg0KQWNlQGlldGYub3JnPG1haWx0bzpBY2VAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KQWNlIG1haWxpbmcgbGlzdA0KDQpBY2VA aWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9hY2UNCg0KDQoNCg0KLS0NCg0KZW1haWw6IHJzdHJ1aWsuZXh0QGdtYWls LmNvbTxtYWlsdG86cnN0cnVpay5leHRAZ21haWwuY29tPiB8IFNreXBlOiByc3RydWlrDQoNCmNl bGw6ICsxICg2NDcpIDg2Ny01NjU4IHwgVVM6ICsxICg0MTUpIDY5MC03MzYzDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0K QWNlQGlldGYub3JnPG1haWx0bzpBY2VAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2FjZQ0KDQoNCg0KLS0NCg0KQmVzdCByZWdhcmRzLA0KS2F0aGxlZW4N Cg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRoZSBpbmZvcm1hdGlvbiBjb250 YWluZWQgaW4gdGhpcyBtZXNzYWdlIG1heSBiZSBjb25maWRlbnRpYWwgYW5kIGxlZ2FsbHkgcHJv dGVjdGVkIHVuZGVyIGFwcGxpY2FibGUgbGF3LiBUaGUgbWVzc2FnZSBpcyBpbnRlbmRlZCBzb2xl bHkgZm9yIHRoZSBhZGRyZXNzZWUocykuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp cGllbnQsIHlvdSBhcmUgaGVyZWJ5IG5vdGlmaWVkIHRoYXQgYW55IHVzZSwgZm9yd2FyZGluZywg ZGlzc2VtaW5hdGlvbiwgb3IgcmVwcm9kdWN0aW9uIG9mIHRoaXMgbWVzc2FnZSBpcyBzdHJpY3Rs eSBwcm9oaWJpdGVkIGFuZCBtYXkgYmUgdW5sYXdmdWwuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRl bmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFp bCBhbmQgZGVzdHJveSBhbGwgY29waWVzIG9mIHRoZSBvcmlnaW5hbCBtZXNzYWdlLg0K --_000_7b1b0dd3488645c693e346b71cede1eaVI1PR9003MB0237MGDPHGem_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5Oi13ZWJraXQtc3Rh bmRhcmQ7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAgMDt9DQovKiBTdHlsZSBEZWZpbml0 aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJn aW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZv bnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4t dG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1p bHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseToiQ291cmllciBOZXciO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0 eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNv bnNvbGFzO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJl cGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7 fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1z aXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJ bWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtl bmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJl ZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0 PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJs dWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBHw7ZyYW4sIEth dGhsZWVuIGFuZCBhbGw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PkV4dGVuZGluZyBvbiB0aGUgY29tbWVudCDigJw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5idXQgaXQgc2VlbXMgbmF0dXJhbCB0byBleHRlbmQgdGhlIEtEQyB3aXRoIHRoaXMN CiBmdW5jdGlvbmFsaXR54oCdLCA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjRFNzk7 bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzFGNEU3OTttc28tc3R5bGUtdGV4dGZpbGwt ZmlsbC1hbHBoYToxMDAuMCUiPnRoZSBuZXcgdmVyc2lvbiBvZiB0aGUgZHJhZnQtc29tYXJhanUt YWNlLW11bHRpY2FzdCBbMV0gc3VibWl0dGVkIGEgd2VlayBiYWNrIGluY2x1ZGVzDQogbm93IHRo ZSBhc3ltbWV0cmljIHZlcnNpb24gYXMgdGhlIHJlY29tbWVuZGVkIHZlcnNpb24gZm9yIG1vc3Qg YXBwbGljYXRpb24gZXhjZXB0IHRoZSBsb3cgbGF0ZW5jeSBhcHBsaWNhdGlvbnMgKHRvIGJlIGFj aGlldmVkIGluIGxvdyByZXNvdXJjZSBkZXZpY2UpLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjRFNzk7bXNvLXN0 eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzFGNEU3OTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1h bHBoYToxMDAuMCUiPkBLYXRobGVlbjogd2hhdCB5b3UgaGF2ZSBhc2tlZCBpcyBhbHJlYWR5IGlu IHRoZSBuZXcgZHJhZnQgYW5kIHRoZSBhc3BlY3RzIHJlZ2FyZGluZw0KIE9TQ09BUCBpbiBbMl0g d2hpY2ggY2FuIGJlIGVhc2lseSBtZXJnZWQgaW50byBbMV0uIEFyZSB5b3UgYXNraW5nIGZvciBz b21ldGhpbmcgZWxzZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNEU3OTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1j b2xvcjojMUY0RTc5O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEwMC4wJSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjRFNzk7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzFGNEU3OTtt c28tc3R5bGUtdGV4dGZpbGwtZmlsbC1hbHBoYToxMDAuMCUiPlNhbmRlZXA8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjRFNzk7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzFG NEU3OTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1hbHBoYToxMDAuMCUiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBBY2UgW21haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZ10N CjxiPk9uIEJlaGFsZiBPZiA8L2I+R8O2cmFuIFNlbGFuZGVyPGJyPg0KPGI+U2VudDo8L2I+IEZy aWRheSwgTm92ZW1iZXIgMTgsIDIwMTYgOTowMCBBTTxicj4NCjxiPlRvOjwvYj4gS2F0aGxlZW4g TW9yaWFydHkgJmx0O2thdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tJmd0OzsgYWNlQGll dGYub3JnPGJyPg0KPGI+Q2M6PC9iPiBNaWNoYWVsIFJpY2hhcmRzb24gJmx0O21jciYjNDM7aWV0 ZkBzYW5kZWxtYW4uY2EmZ3Q7OyBNaWNoYWVsIFN0Sm9obnMgJmx0O21zdGpvaG5zQGNvbWNhc3Qu bmV0Jmd0OzsgUmVuZSBTdHJ1aWsgJmx0O3JzdHJ1aWsuZXh0QGdtYWlsLmNvbSZndDs7IFRpcnVt YWxlc3dhciBSZWRkeSAodGlyZWRkeSkgJmx0O3RpcmVkZHlAY2lzY28uY29tJmd0Ozxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW0FjZV0gU3VtbWFyeSBvZiBBQ0UgR3JvdXAgQ29tbXVuaWNhdGlv biBTZWN1cml0eSBEaXNjdXNzaW9uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkth dGhsZWVuIGFuZCBhbGwsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkkgYmVsaWV2ZSBhbGwgbmVjZXNzYXJ5IGRyYWZ0 cyBmb3IgYSBzb2x1dGlvbiBiYXNlZCBvbiBhc3ltbWV0cmljIGtleXMgYXJlIGFscmVhZHkgaW4g cGxhY2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPldpdGggJnF1b3Q7YSBzb2x1dGlvbiBiYXNlZCBvbiBhc3ltbWV0 cmljIGtleXPigJ0gSSB1bmRlcnN0YW5kIGEgc29sdXRpb24gd2hlcmUgZWFjaCBtZW1iZXIgb2Yg dGhlIGdyb3VwIGNhbiBzaWduIG1lc3NhZ2VzIHdpdGggaXRzIHByaXZhdGUga2V5IGZvciBzb3Vy Y2UgYXV0aGVudGljYXRpb24NCiBidXQgd2hlcmUgY29uZmlkZW50aWFsaXR5IGlzIHByb3RlY3Rl ZCB3aXRoIGEgc3ltbWV0cmljIGtleSBzaGFyZWQgYmV0d2VlbiB0aGUgbWVtYmVycyBvZiB0aGUg Z3JvdXAuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPlsxXSBkZXNjcmliZXMgaG93IHRvIGRpc3RyaWJ1dGUgYW5kIHVz ZSBzeW1tZXRyaWMga2V5cywgdXNpbmcgYSBLREMgZm9yIGRpc3RyaWJ1dGluZyB0aGUgc3ltbWV0 cmljIGtleXMsIGFuZCByZWZlcmVuY2VzIE9TQ09BUCBmb3Igc2VjdXJpbmcgdGhlIGdyb3VwIGNv bW11bmljYXRpb24uDQogWzJdIHNob3dzIGhvdyB0byBzZWN1cmUgZ3JvdXAgY29tbXVuaWNhdGlv biBmb3IgQ29BUCBiYXNlZCBvbiBhc3ltbWV0cmljIGtleXMgYXMgZGVzY3JpYmVkIGFib3ZlLiBB cyBmYXIgYXMgSSB1bmRlcnN0YW5kLCB0aGUgb25seSB0aGluZyBtaXNzaW5nIGlzIGEgbWVjaGFu aXNtIGZvciBkaXN0cmlidXRpbmcgdGhlIHB1YmxpYyBrZXlzIG9mIHRoZSBtZW1iZXJzLA0KPGI+ YnV0IGl0IHNlZW1zIG5hdHVyYWwgdG8gZXh0ZW5kIHRoZSBLREMgd2l0aCB0aGlzIGZ1bmN0aW9u YWxpdHk8L2I+LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5bMV0mbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtc29tYXJhanUtYWNlLW11bHRpY2FzdC0wMSI+aHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNvbWFyYWp1LWFjZS1tdWx0aWNhc3QtMDE8L2E+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5bMl0mbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtdGlsb2NhLWNvcmUtbXVsdGljYXN0LW9zY29hcC0wMCI+aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXRpbG9jYS1jb3JlLW11bHRpY2FzdC1vc2Nv YXAtMDA8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu NXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5Ib3dldmVyLCBJIGRvbuKA mXQgYWdyZWUgd2l0aCBhbGwgY29uY2x1c2lvbnMgb2YgdGhlIGFzeW1tZXRyaWMga2V5IHByb3Bv bmVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPkl0IGlzIG5vdCBuZXdzIHRoYXQmbmJzcDthc3ltbWV0cmljIGtl eSB0ZWNobmlxdWVzIGFyZSBmZWFzaWJsZSBmb3IgdXNlIGluIG1hbnkgZW1iZWRkZWQgZGV2aWNl IGFwcGxpY2F0aW9ucywgYnV0IGl0IGlzIGdvb2QgdGhhdCB0aGUga25vd2xlZGdlIGlzIGJlaW5n IHNwcmVhZC4gQnV0DQogZXhlY3V0aW9uIHRpbWVzIGFuZCBtZXNzYWdlIHNpemVzIG1heSBzdGls bCBiZSBwcm9oaWJpdGl2ZSBmb3Igc29tZSBhcHBsaWNhdGlvbnMuIFRvIGFkZHJlc3MgUmVuZeKA mXMgcXVlc3Rpb24mbmJzcDsmcXVvdDtpcyA2NEIgdG9vIG11Y2g/JnF1b3Q7OiZuYnNwOzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzQ1NDU0NSI+QWRkaW5nIHRoZSBjb3VudGVyc2lnbmF0 dXJlIHRvIENPU0UgbWVzc2FnZXMNCiBzdWNoIGFzIHRob3NlIHVzZWQgaW4gbXVsdGljYXN0IE9T Q09BUCB3b3VsZCBpbmNyZWFzZSB0aGUgc2l6ZSBmcm9tIHRoZSBvcmRlciBvZiAyMCBieXRlcyB0 byB0aGUgb3JkZXIgb2YgODUtOTAgYnl0ZXMgd2hpY2ggaW4gdHVybiBtYXkgYWRkIHNpZ25pZmlj YW50IGxhdGVuY3kgZGVwZW5kaW5nIG9uIGxpbmsgbGF5ZXIgdGVjaG5vbG9neSB1c2VkLCZuYnNw O2luZGVwZW5kZW50bHkgb2YgcHJvY2Vzc29yJm5ic3A7Y2FwYWNpdHkuPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBz dHlsZT0ibWFyZ2luOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bWluLWhlaWdodDogMTRweCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiM0NTQ1NDUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXY+DQo8cCBzdHlsZT0ibWFyZ2luOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90Oy13ZWJraXQtc3Rh bmRhcmQmcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPldpdGhvdXQgbmVnbGVjdGluZyB0aGUgaXNz dWVzIHJhaXNlZCwgSSBkbyB0aGluayB0aGF0IHRoZXJlIGlzIGEgcm9sZSBmb3Igc3ltbWV0cmlj IGtleSBiYXNlZCBncm91cCBjb21tdW5pY2F0aW9uIGZvciB0aGUgY2xhc3Mgb2YgYWN0dWF0b3Jz DQogaW4gc2NvcGUgb2YgWzFdLiBJIGFncmVlIGl0IGlzIGFuIGlzc3VlIGlmIGNvbXByb21pc2lu ZyBvbmUgZGV2aWNlIGFuZCBleHRyYWN0aW5nIG9uZSBrZXkgbGV0J3MgeW91IHR1cm4gb2ZmIDEw MDAgbGFtcHMgKG5vdCBzYXlpbmcgaXQgaGFzIHRvLCBidXQganVzdCBhcyBhbiBleGFtcGxlKS4g QnV0IHRoYXQgZG9lc24ndCBhdXRvbWF0aWNhbGx5IHR1cm4gdGhlIGxpZ2h0YnVsYnMgaW50byBi b3RzLiAmbmJzcDtUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMNCiBpbiB0aGlzIGNhc2Ugc2hv dWxkIGUuZy4gaW5jbHVkZSB0aGluZ3MgbGlrZSByZXN0cmljdGluZyBjYXBhYmlsaXRpZXMgYXNz b2NpYXRlZCB3aXRoIHRoZSBwb3NzZXNzaW9uIG9mIGEgc2hhcmVkIGtleS4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBpbjttYXJnaW4tYm90dG9tOi4wMDAx cHQ7bWluLWhlaWdodDogMjAuM3B4Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250 LWZhbWlseTomcXVvdDstd2Via2l0LXN0YW5kYXJkJnF1b3Q7LHNlcmlmO2NvbG9yOmJsYWNrIj48 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBpbjtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQt ZmFtaWx5OiZxdW90Oy13ZWJraXQtc3RhbmRhcmQmcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPklu ZGVwZW5kZW50IG9mIHRoaXMgZGlzY3Vzc2lvbiwgc3ltbWV0cmljIGtleSBzb2x1dGlvbnMgZm9y IHRoZXNlIHVzZSBjYXNlcyB3aWxsIGNvbnRpbnVlIHRvIGJlIGRlcGxveWVkLiBJIGZlYXIgd2Ug bWF5IGNyZWF0ZSBncmVhdGVyDQogZGFtYWdlIGJ5IG5vdCBhbmFseXNpbmcgYW5kIHByb3ZpZGlu ZyBndWlkYW5jZSB0byB0aGVzZSB1c2UgY2FzZXMgd2hlbiBhcHBsaWVkIGluIGEgc3ltbWV0cmlj IGtleSBzZXR0aW5nLCBhdCB0aGUgc2FtZSB0aW1lIGFzIHNwZWNpZnlpbmcgYW4gYXN5bW1ldHJp YyBrZXkgc29sdXRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj5Hw7ZyYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj5BY2UgJmx0OzxhIGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZyI+ YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBiZWhhbGYgb2YgS2F0aGxlZW4gTW9yaWFy dHkgJmx0OzxhIGhyZWY9Im1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSI+ a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwv Yj5GcmlkYXkgMTggTm92ZW1iZXIgMjAxNiBhdCAwNDo1OTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7 VGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnRp cmVkZHlAY2lzY28uY29tIj50aXJlZGR5QGNpc2NvLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6IDwv Yj5NaWNoYWVsIFN0Sm9obnMgJmx0OzxhIGhyZWY9Im1haWx0bzptc3Rqb2huc0Bjb21jYXN0Lm5l dCI+bXN0am9obnNAY29tY2FzdC5uZXQ8L2E+Jmd0OywgUmVuZSBTdHJ1aWsgJmx0OzxhIGhyZWY9 Im1haWx0bzpyc3RydWlrLmV4dEBnbWFpbC5jb20iPnJzdHJ1aWsuZXh0QGdtYWlsLmNvbTwvYT4m Z3Q7LCAmcXVvdDs8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+ JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+ Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0FjZV0gU3VtbWFyeSBvZiBBQ0UgR3JvdXAg Q29tbXVuaWNhdGlvbiBTZWN1cml0eSBEaXNjdXNzaW9uPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQjVDNERGIDQuNXB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNC4wcHQ7bWFyZ2luLWxlZnQ6My43NXB0O21hcmdpbi1yaWdodDowaW4i IGlkPSJNQUNfT1VUTE9PS19BVFRSSUJVVElPTl9CTE9DS1FVT1RFIj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu NXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+T24gVGh1LCBOb3YgMTcsIDIwMTYgYXQgMTA6NTYgUE0sIFRpcnVtYWxlc3dhciBSZWRkeSAo dGlyZWRkeSkgJmx0OzxhIGhyZWY9Im1haWx0bzp0aXJlZGR5QGNpc2NvLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnRpcmVkZHlAY2lzY28uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+ PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+S2F0aGxlZW4sDQo8L3NwYW4+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHdpbGwgcHV0IHVwIGEg cHJvcG9zYWwgYmVmb3JlIHRoZSBDaGljYWdvIG1lZXRpbmcuPC9zcGFuPjxzcGFuIHN0eWxlPSJj b2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+VGhhbmsgeW91 LiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+LVRpcnU8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJs YWNrIj4gQWNlIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0KPGI+T24gQmVoYWxmIE9m IDwvYj48YSBocmVmPSJtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20iIHRh cmdldD0iX2JsYW5rIj5rYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbTwvYT48YnI+DQo8 Yj5TZW50OjwvYj4gRnJpZGF5LCBOb3ZlbWJlciAxOCwgMjAxNiA1OjMwIEFNPGJyPg0KPGI+VG86 PC9iPiBSZW5lIFN0cnVpayAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPnJzdHJ1aWsuZXh0QGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiBNaWNoYWVsIFN0Sm9obnMgJmx0OzxhIGhyZWY9Im1haWx0bzptc3Rqb2huc0Bjb21j YXN0Lm5ldCIgdGFyZ2V0PSJfYmxhbmsiPm1zdGpvaG5zQGNvbWNhc3QubmV0PC9hPiZndDs7DQo8 YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlQGlldGYub3Jn PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0FjZV0gU3VtbWFyeSBvZiBBQ0UgR3JvdXAg Q29tbXVuaWNhdGlvbiBTZWN1cml0eSBEaXNjdXNzaW9uPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+SXMgYW55b25lIHdpbGxpbmcgdG8gd29yayBvbiBh IGRyYWZ0IHRvIGJlIHJlYWR5IGluIGFkdmFuY2Ugb2YgdGhlIENoaWNhZ28gbWVldGluZyBzbyB3 ZSBoYXZlIGEgY29uY3JldGUgcHJvcG9zYWwgZm9yIGFzeW1tZXRyaWMga2V5cz88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTQ5MDA4MDI3OTYxMzkxNzI1ODNBcHBs ZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2siPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0i bV8tNDkwMDgwMjc5NjEzOTE3MjU4M0FwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+VGhhbmtzLDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNDkwMDgwMjc5NjEzOTE3MjU4M0FwcGxlTWFp bFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjayI+S2F0aGxlZW4mbmJzcDs8YnI+DQo8YnI+DQpQbGVhc2UgZXhjdXNlIHR5cG9zLCBzZW50 IGZyb20gaGFuZGhlbGQgZGV2aWNlJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxicj4N Ck9uIE5vdiAxNywgMjAxNiwgYXQgMTE6MjYgUE0sIFJlbmUgU3RydWlrICZsdDs8YSBocmVmPSJt YWlsdG86cnN0cnVpay5leHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cnN0cnVpay5leHRA Z21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPkRlYXIgY29sbGVhZ3Vlczo8YnI+DQo8YnI+DQpKdXN0IGEgcmVtaW5kZXIgcmUgcGVy Y2VpdmVkIHRlY2huaWNhbCBodXJkbGVzIGZvciB1c2luZyBzaWduYXR1cmVzOjxicj4NCmEpIHRp bWUgbGF0ZW5jeSBvZiBzaWduaW5nOjxicj4NCk9uZSBjYW4gcHJlLWNvbXB1dGUgZXBoZW1lcmFs IHNpZ25pbmcga2V5cywgc28gYXMgdG8gcmVkdWNlIG9ubGluZSBrZXkgY29tcHV0YXRpb24gdG8g YSBmZXcgZmluaXRlIGZpZWxkIG11bHRpcGxpZXMuDQo8YnI+DQpQbGVhc2Ugc2VlIG15IGVtYWls IHRvIHRoZSBsaXN0IG9mIEp1bHkgMjYsIDIwMTY6IDxhIGhyZWY9Imh0dHBzOi8vbWFpbGFyY2hp dmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWNlL2lFYjBYbkFJTUFCX1YzSThMak1GUVJqMUZlMCIgdGFy Z2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2Uv aUViMFhuQUlNQUJfVjNJOExqTUZRUmoxRmUwPC9hPjxicj4NCmIpOiBmdXJ0aGVyIHNwZWVkLXVw cy90cmlja3MsIGV0Yzo8YnI+DQpPbmUgY2FuIHRyeSBhbmQgYmUgc21hcnRlciBieSBjbGV2ZXIg aW1wbGVtZW50YXRpb25zLjxicj4NClBsZWFzZSBzZWUgbXkgZW1haWwgdG8gdGhlIGxpc3Qgb2Yg SnVseSAyMSwgMjAxNjogPGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNo L21zZy9hY2UvaUk1OG1UX0REektJbUwxTFBfYlVRN1R6b29JIiB0YXJnZXQ9Il9ibGFuayI+DQpo dHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9pSTU4bVRfRER6S0ltTDFM UF9iVVE3VHpvb0k8L2E+PGJyPg0KPGJyPg0KVGhpcyBzZWVtcyB0byB0YWtlIHRoZSB0aW1lIGxh dGVuY3kgYXJndW1lbnQgYXdheS4gVGhlIG9ubHkgb3RoZXIgdGVjaG5pY2FsIGh1cmRsZXMgSSBj YW4gc2VlIGFyZQ0KPGJyPg0KKGkpIHNpZ25hdHVyZSBzaXplIHtpcyA2NEIgdG9vIG11Y2g/fTsg PGJyPg0KKGlpKSBjb3N0IG9mIHB1YmxpYyBrZXkgY3J5cHRvIGltcGxlbWVudGF0aW9ucyB7cXVp dGUgc29tZSBzbWFsbCwgbmlmdHkgZGVzaWducyBvdXQgdGhlcmUgKE5hQ2wgZXRjLn0uPGJyPg0K PGJyPg0KQXMgdG8gKGkpIC0gb25lIHNob3VsZCB2aWV3IHNpZ25hdHVyZSBzaXplcyBpbiBwZXJz cGVjdGl2ZTogYXMgYW4gZXhhbXBsZSwga2V5IHNpemVzIGluIHRoZSBrZXkgcHJlLWRpc3RyaWJ1 dGlvbiBzY2hlbWUgSElNTU8gKGFzIHByb21vdGVkIGJ5IFBoaWxpcHMpIGhhcyBrZXkgc2l6ZXMg b2YgNi4yNSBrQiBhbmQgdXAsIGFjY29yZGluZyB0byBUYWJsZSAzIG9mIHRoZSBwYXBlciB0aGF0 IG1hc3NhZ2VzIHBhcmFtZXRlcnMgdG8gdGh3YXJ0IG5ldw0KIGF0dGFja3Mgb24gdGhlaXIgc2No ZW1lLCBzZWUgPGEgaHJlZj0iaHR0cDovL2VwcmludC5pYWNyLm9yZy8yMDE2LzE1MiIgdGFyZ2V0 PSJfYmxhbmsiPg0KaHR0cDovL2VwcmludC5pYWNyLm9yZy8yMDE2LzE1MjwvYT4uPGJyPg0KPGJy Pg0KU28sIHNlY3VyaXR5IGFyZ3VtZW50cyB0aGF0IGZhdm9yIGFzeW1tZXRyaWMgc29sdXRpb25z IGFzaWRlLCB0aGVyZSBhbHNvIGRvIG5vdCBzZWVtIHRvIGJlIHRvbyBtYW55IG90aGVyIG9iamVj dGlvbnMgdGhhdCB3b3VsZCBob2xkIGluIHRoZSB3b3JsZCBhbm5vIDIwMTYge2V4Y2VwdCBmb3Ig JnF1b3Q7c3VuayBpbnZlc3RtZW50JnF1b3Q7IGFyZ3VtZW50cyZxdW90OywgYnV0IHRoYXQgaXMg YSBjb3Jwb3JhdGUgbWluZHNldCBpc3N1ZX0uPGJyPg0KPGJyPg0KT24gMTEvMTcvMjAxNiAxMjo1 MCBBTSwgTWljaGFlbCBTdEpvaG5zIHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPk9uIDExLzE2LzIwMTYgOTowOCBBTSwgS2VwZW5nIExpIHdyb3RlOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8cD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkhlbGxv IGFsbCwmbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+V2UgaGFkIGEgbG9uZyBkaXNjdXNzaW9uIGFib3V0IGdyb3VwIGNvbW11bmlj YXRpb24gc2VjdXJpdHkgdG9waWMgc2luY2UgdGhlIHByZXZpb3VzIEYyRiBtZWV0aW5nLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+SGFubmVz IGFuZCBJIGhhdmUgdHJpZWQgdG8gbWFrZSBhIHN1bW1hcnkgYWJvdXQgdGhlIGRpc2N1c3Npb24g YXMgZm9sbG93czo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cD48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6YmxhY2siPsK3Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoZSBzb2x1 dGlvbiBuZWVkcyB0byBkZWZpbmUgYm90aCwgc3ltbWV0cmljIGFuZCBhbiBhc3ltbWV0cmljIGdy b3VwIGtleSBzb2x1dGlvbi4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJn aW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YnI+DQpUaGVyZSBp cyBubyBjYXNlIChhYnNlbnQgaGFyZHdhcmUgbWl0aWdhdGlvbikgaW4gd2hpY2ggYSBzeW1tZXRy aWMgZ3JvdXAga2V5IHNvbHV0aW9uIGNhbiBiZSBtYWRlIHNlY3VyZS9zYWZlIGFuZCBubyBvbmUg aGFzIG1hZGUgYW4gb2ZmZXIgb2YgcHJvb2YgdGhhdCB0aGV5IGNhbiBtYWtlIGl0IHNlY3VyZS4m bmJzcDsmbmJzcDsmbmJzcDsgSSd2ZSBhc2tlZCByZXBlYXRlZGx5IC0gbm8gb25lIGhhcyBjb21l IGZvcndhcmQgd2l0aCBtb3JlIHRoYW4gJnF1b3Q7b2ggd2UgY2FuIGxvY2sNCiB0aGUgc3ltbWV0 cmljIGtleSBzdHVmZiBpbiBhIGNvcm5lciBhbmQgbWFrZSBzdXJlIGl0IGlzbid0IHVzZWQgZm9y IGFueXRoaW5nIGltcG9ydGFudCZxdW90Oy48YnI+DQo8YnI+DQo8YnI+DQpHaXZlbiB0aGUgcmVj ZW50IGF0dGFja3Mgb24gdGhlIGludGVybmV0IGJ5IElPVCBib3RuZXRzLCB0aGVyZSBpcyBhIGZ1 cnRoZXIgY29uc2lkZXJhdGlvbiB0aGF0IHNob3VsZCBiZSB1bmRlcnRha2VuIC0gd2hldGhlciB0 aGUgc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBhcHBsaWVkIHRvIDEwcyBvZiAxMDAwcyBv ZiBJT1QgZGV2aWNlcyBpcyBhbiBhY3RpdmUgdGhyZWF0IHRvIHRoZSByZXN0IG9mIHRoZSBpbnRl cm5ldCAoZS5nLiBlbmFibGluZw0KIERET1MsIGN5YmVyIHBoeXNpY2FsIGlzc3VlcywgZXRjKT88 YnI+DQo8YnI+DQpUaGUgbXVsdGlwYXJ0eSAoZ3JvdXApIHN5bW1ldHJpYyBrZXkgc29sdXRpb24g aXMgb25seSB3YW50ZWQgZm9yIGEgc2luZ2xlIGNvcm5lciBvZiB0aGUgc29sdXRpb24gc3BhY2Ug LSBsb3cgbGF0ZW5jeSwgbm8gY29zdCBzeXN0ZW1zLiZuYnNwOyBFLmcuIGxpZ2h0YnVsYnMuJm5i c3A7IEdpdmVuIHRoZXJlIGlzIGEgd29ya2VkIGV4YW1wbGUgb2YgdGhlIGluc2VjdXJpdHkgb2Yg bXVsdGlwYXJ0eSBzeW1tZXRyaWMga2V5IHN5c3RlbXMgKGUuZy4gdGhlIGF0dGFjaw0KIG9uIHRo ZSBzeW1tZXRyaWMgc2lnbmluZyBrZXkgb2YgdGhlIEhVRSBsaWdodHMpLCBJJ20gdW5jbGVhciB3 aHkgYW55b25lIGF0IGFsbCB3b3VsZCB0aGluayB0aGF0IHB1cnN1aW5nIGEga25vd24gYmFkIHNv bHV0aW9uIGluIHRoZSBJRVRGIGlzIGEgZ29vZCBpZGVhLjxicj4NCjxicj4NCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPHA+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj7CtyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBz ZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIgd2hhdCBjaXJjdW1zdGFuY2VzIHdoYXQgc29s dXRpb24gaXMgYXBwcm9wcmlhdGUuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGJyPg0KU2Vj dXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9ucyBnZW5lcmFsbHkgb25seSBhZGRyZXNzIHRoZSB0 aHJlYXQgKnRvKiB0aGUgc3lzdGVtIGZyb20gc2VjdXJpdHkgY2hvaWNlcy4mbmJzcDsgSW4gdGhp cyBjYXNlLCBzeW1tZXRyaWMga2V5IGdyb3VwIGNvbW1zIHJlZHVjZXMgZG93biB0byB0aGUgc2Ft ZSBzZWN1cml0eSBhbmFseXNpcyB5b3Ugd291bGQgdXNlIHdpdGggc2hhcmVkIGRlZmF1bHQgcGFz c3dvcmRzIGFjcm9zcyAxMDAwcyBvZiBkZXZpY2VzLiZuYnNwOyZuYnNwOw0KIEFuIElPVCBzZWN1 cml0eSBjb25zaWRlcmF0aW9uIHNlY3Rpb24gaW4gdGhlIGZ1dHVyZSBwcm9iYWJseSBuZWVkcyB0 byBhZGRyZXNzIHRoZSB0aHJlYXQgKkZST00qIHRoZSBJT1Qgc29sdXRpb24gdG8gdGhlIGJyb2Fk ZXIgaW50ZXJuZXQuPGJyPg0KPGJyPg0KTWlrZTxicj4NCjxicj4NCjxicj4NCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPHA+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5JZiB0aGlzIGlz IG5vdCBhY2N1cmF0ZSwgcGxlYXNlIGxldCB1cyBrbm93LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+S2luZCBSZWdhcmRzPGJyPg0KS2VwZW5n ICZhbXA7IEhhbm5lczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+QlRXOiBpdCBpcyBhIHBpdHkgdGhhdCBJIGNhbid0IGF0dGVuZCB0aGlzIG1l ZXRpbmcgZHVlIHRvIHBlcnNvbmFsIHJlYXNvbnMsIGFuZCBob3BlIHlvdSBhbGwgaGF2ZSBhIG5p Y2UgbWVldGluZyBpbiBTZW91bCE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4w cHQiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QWNlIG1haWxpbmcgbGlzdDxvOnA+PC9vOnA+ PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1h aWx0bzpBY2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+PG86cD48 L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwv bzpwPjwvc3Bhbj48L3ByZT4NCjwvYmxvY2txdW90ZT4NCjxwPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkFjZSBtYWlsaW5nIGxpc3Q8bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86 QWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U8L2E+PG86cD48L286cD48 L3NwYW4+PC9wcmU+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHA+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+LS0gPG86cD48L286cD48L3NwYW4+PC9wcmU+ DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ZW1haWw6IDxhIGhyZWY9Im1haWx0bzpy c3RydWlrLmV4dEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5yc3RydWlrLmV4dEBnbWFpbC5j b208L2E+IHwgU2t5cGU6IHJzdHJ1aWs8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5jZWxsOiAmIzQzOzEgKDY0NykgODY3LTU2NTggfCBVUzog JiM0MzsxICg0MTUpIDY5MC03MzYzPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCkFjZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWNlQGlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+QWNlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIiB0YXJnZXQ9Il9ibGFuayI+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U8L2E+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4tLQ0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPkJlc3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkthdGhsZWVu PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJy Pg0KPGhyPg0KPGZvbnQgZmFjZT0iQXJpYWwiIGNvbG9yPSJHcmF5IiBzaXplPSIxIj5UaGUgaW5m b3JtYXRpb24gY29udGFpbmVkIGluIHRoaXMgbWVzc2FnZSBtYXkgYmUgY29uZmlkZW50aWFsIGFu ZCBsZWdhbGx5IHByb3RlY3RlZCB1bmRlciBhcHBsaWNhYmxlIGxhdy4gVGhlIG1lc3NhZ2UgaXMg aW50ZW5kZWQgc29sZWx5IGZvciB0aGUgYWRkcmVzc2VlKHMpLiBJZiB5b3UgYXJlIG5vdCB0aGUg aW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhlcmVieSBub3RpZmllZA0KIHRoYXQgYW55IHVz ZSwgZm9yd2FyZGluZywgZGlzc2VtaW5hdGlvbiwgb3IgcmVwcm9kdWN0aW9uIG9mIHRoaXMgbWVz c2FnZSBpcyBzdHJpY3RseSBwcm9oaWJpdGVkIGFuZCBtYXkgYmUgdW5sYXdmdWwuIElmIHlvdSBh cmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBjb250YWN0IHRoZSBzZW5kZXIg YnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVzdHJveSBhbGwgY29waWVzIG9mIHRoZSBvcmlnaW5hbCBt ZXNzYWdlLjxicj4NCjwvZm9udD4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_7b1b0dd3488645c693e346b71cede1eaVI1PR9003MB0237MGDPHGem_-- From nobody Fri Nov 18 00:22:05 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6727129575 for ; Fri, 18 Nov 2016 00:22:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sics.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1dUihpnq7jSi for ; Fri, 18 Nov 2016 00:22:01 -0800 (PST) Received: from mail-wm0-x22e.google.com (mail-wm0-x22e.google.com [IPv6:2a00:1450:400c:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E3241293EE for ; Fri, 18 Nov 2016 00:22:00 -0800 (PST) Received: by mail-wm0-x22e.google.com with SMTP id c184so3472747wmd.0 for ; Fri, 18 Nov 2016 00:22:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sics.se; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=gk/38qoald9J1WtMCJXUyP5yxVpn9KqsBeePa1In4mU=; b=MRtYP4RWzEMcjBQTQBCIkT3WHRvcI28mGjmpF72TDvbmU3D0FwVYLiG/s00a5EtocP wCJZKLW9+hHYA48rvgunJ6If3D87ZAdEz+iD1ovPyKWkDJDT1f+rE3PQyEWow39AQLZb WuIgKblhkC7sFuklywltgjyywHU5stGz/Bvj5mIxvPnzcvGdswwEiCNRTT2JLwCgdi8q QG7Zm3nu+1Mei4dQugAgR3zdv9lzDxShbqyD+31vpkO+B15lMK/G2p//F5v4Phywd/ra NuLtl8mIPCYj0Lj/pJDoMW/P1VDirnAAp+tGRSc1ZMQ3dCH3Ml4hJcZvzuRSGbeln2A6 9bRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=gk/38qoald9J1WtMCJXUyP5yxVpn9KqsBeePa1In4mU=; b=ZhHCkRNbwyZQLEGkZuL7yej5pUXlMGV8ET1hOHig4m3wcc3aWDP6xi+ca5sZOoNYkT sXPAEhd51EGx5DSJuSrP06SYXqxkfJW2hcARxyDYDyDSW3rVJAbTD3EZGgsaCidv01Kl N0BvxzvT62yObv4FYz0GIfsGAn3Bc4i3v3lQsJmjA/oDhu5C2Fxs9jraPv+imOMJduND +wB5ErXBv0BZBx04rsppjWZAvxm4t2QZoU1yiq/kTiQoe9ZFN63LinR2qBMNAfo4Mx4c 03jjfbt2Po9O/10VPbbGl467umwxqLUMQcKUG1CIkGRv1WW14xtijMTM6qeTOS/IpLI1 sxAQ== X-Gm-Message-State: AKaTC00ZodqSRGh3lFgjUcAOyxlsSXWG4BXkGmSQAcHsH5/jzIK2F03bXYEsJ4WMHTGYZDMv X-Received: by 10.46.9.129 with SMTP id 123mr3628500ljj.20.1479457318726; Fri, 18 Nov 2016 00:21:58 -0800 (PST) Received: from [10.0.1.4] (92-244-13-72.customers.ownit.se. [92.244.13.72]) by smtp.gmail.com with ESMTPSA id 33sm1883510lfy.44.2016.11.18.00.21.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 18 Nov 2016 00:21:57 -0800 (PST) From: Shahid Raza Message-Id: <18382B04-05CB-455A-A1F3-EDFE194821E6@sics.se> Content-Type: multipart/alternative; boundary="Apple-Mail=_1A1B7053-31A9-45E3-A438-520E3C567682" Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) Date: Fri, 18 Nov 2016 09:21:58 +0100 In-Reply-To: <7b1b0dd3488645c693e346b71cede1ea@VI1PR9003MB0237.MGDPHG.emi.philips.com> To: "Kumar, Sandeep" References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> <7b1b0dd3488645c693e346b71cede1ea@VI1PR9003MB0237.MGDPHG.emi.philips.com> X-Mailer: Apple Mail (2.3251) Archived-At: Cc: Michael Richardson , Rene Struik , "Tirumaleswar Reddy \(tireddy\)" , Kathleen Moriarty , Michael StJohns , "ace@ietf.org" , =?utf-8?Q?G=C3=B6ran_Selander?= Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 08:22:04 -0000 --Apple-Mail=_1A1B7053-31A9-45E3-A438-520E3C567682 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The question regarding distribution of asymmetric keys was raised in the = ACE working group before under the tread = https://www.ietf.org/mail-archive/web/ace/current/msg01825.html = , = where we mentioned that SICS and neXus are working on enrollment using = IoT protocols. We have already implementing this on the CA side and also = on Contiki side and tested with Class II IoT devices.=20 /Shahid > On 18 Nov 2016, at 09:13, Kumar, Sandeep = wrote: >=20 > Hi G=C3=B6ran, Kathleen and all > =20 > Extending on the comment =E2=80=9Cbut it seems natural to extend the = KDC with this functionality=E2=80=9D, the new version of the = draft-somaraju-ace-multicast [1] submitted a week back includes now the = asymmetric version as the recommended version for most application = except the low latency applications (to be achieved in low resource = device). > @Kathleen: what you have asked is already in the new draft and the = aspects regarding OSCOAP in [2] which can be easily merged into [1]. Are = you asking for something else? > =20 > Sandeep > =20 > =20 > From: Ace [mailto:ace-bounces@ietf.org ] = On Behalf Of G=C3=B6ran Selander > Sent: Friday, November 18, 2016 9:00 AM > To: Kathleen Moriarty >; ace@ietf.org = > Cc: Michael Richardson >; Michael StJohns >; Rene Struik >; Tirumaleswar Reddy (tireddy) = > > Subject: Re: [Ace] Summary of ACE Group Communication Security = Discussion > =20 > Kathleen and all, > =20 > I believe all necessary drafts for a solution based on asymmetric keys = are already in place. > =20 > With "a solution based on asymmetric keys=E2=80=9D I understand a = solution where each member of the group can sign messages with its = private key for source authentication but where confidentiality is = protected with a symmetric key shared between the members of the group. > =20 > [1] describes how to distribute and use symmetric keys, using a KDC = for distributing the symmetric keys, and references OSCOAP for securing = the group communication. [2] shows how to secure group communication for = CoAP based on asymmetric keys as described above. As far as I = understand, the only thing missing is a mechanism for distributing the = public keys of the members, but it seems natural to extend the KDC with = this functionality. > =20 > [1] https://tools.ietf.org/html/draft-somaraju-ace-multicast-01 = > [2] https://tools.ietf.org/html/draft-tiloca-core-multicast-oscoap-00 = > =20 > =20 > =20 > However, I don=E2=80=99t agree with all conclusions of the asymmetric = key proponents. > =20 > It is not news that asymmetric key techniques are feasible for use in = many embedded device applications, but it is good that the knowledge is = being spread. But execution times and message sizes may still be = prohibitive for some applications. To address Rene=E2=80=99s question = "is 64B too much?": Adding the countersignature to COSE messages such as = those used in multicast OSCOAP would increase the size from the order of = 20 bytes to the order of 85-90 bytes which in turn may add significant = latency depending on link layer technology used, independently of = processor capacity. > =20 > Without neglecting the issues raised, I do think that there is a role = for symmetric key based group communication for the class of actuators = in scope of [1]. I agree it is an issue if compromising one device and = extracting one key let's you turn off 1000 lamps (not saying it has to, = but just as an example). But that doesn't automatically turn the = lightbulbs into bots. The security considerations in this case should = e.g. include things like restricting capabilities associated with the = possession of a shared key.=20 >=20 >=20 > Independent of this discussion, symmetric key solutions for these use = cases will continue to be deployed. I fear we may create greater damage = by not analysing and providing guidance to these use cases when applied = in a symmetric key setting, at the same time as specifying an asymmetric = key solution. > =20 > =20 > G=C3=B6ran > =20 > =20 > =20 > From: Ace > on = behalf of Kathleen Moriarty > > Date: Friday 18 November 2016 at 04:59 > To: "Tirumaleswar Reddy (tireddy)" > > Cc: Michael StJohns >, Rene Struik >, "ace@ietf.org " = > > Subject: Re: [Ace] Summary of ACE Group Communication Security = Discussion > =20 > =20 > =20 > On Thu, Nov 17, 2016 at 10:56 PM, Tirumaleswar Reddy (tireddy) = > wrote: > Kathleen, > =20 > I will put up a proposal before the Chicago meeting. > =20 > Thank you.=20 > =20 > -Tiru > =20 > From: Ace [mailto:ace-bounces@ietf.org ] = On Behalf Of kathleen.moriarty.ietf@gmail.com = > Sent: Friday, November 18, 2016 5:30 AM > To: Rene Struik > > Cc: Michael StJohns >; ace@ietf.org > Subject: Re: [Ace] Summary of ACE Group Communication Security = Discussion > =20 > Is anyone willing to work on a draft to be ready in advance of the = Chicago meeting so we have a concrete proposal for asymmetric keys? > =20 > Thanks, > Kathleen=20 >=20 > Please excuse typos, sent from handheld device=20 >=20 > On Nov 17, 2016, at 11:26 PM, Rene Struik > wrote: >=20 > Dear colleagues: >=20 > Just a reminder re perceived technical hurdles for using signatures: > a) time latency of signing: > One can pre-compute ephemeral signing keys, so as to reduce online key = computation to a few finite field multiplies.=20 > Please see my email to the list of July 26, 2016: = https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 = > b): further speed-ups/tricks, etc: > One can try and be smarter by clever implementations. > Please see my email to the list of July 21, 2016: = https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI = >=20 > This seems to take the time latency argument away. The only other = technical hurdles I can see are=20 > (i) signature size {is 64B too much?};=20 > (ii) cost of public key crypto implementations {quite some small, = nifty designs out there (NaCl etc.}. >=20 > As to (i) - one should view signature sizes in perspective: as an = example, key sizes in the key pre-distribution scheme HIMMO (as promoted = by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the = paper that massages parameters to thwart new attacks on their scheme, = see http://eprint.iacr.org/2016/152 . >=20 > So, security arguments that favor asymmetric solutions aside, there = also do not seem to be too many other objections that would hold in the = world anno 2016 {except for "sunk investment" arguments", but that is a = corporate mindset issue}. >=20 > On 11/17/2016 12:50 AM, Michael StJohns wrote: > On 11/16/2016 9:08 AM, Kepeng Li wrote: > Hello all,=20 >=20 > We had a long discussion about group communication security topic = since the previous F2F meeting. >=20 > Hannes and I have tried to make a summary about the discussion as = follows: >=20 > =C2=B7 The solution needs to define both, symmetric and an = asymmetric group key solution. >=20 >=20 > There is no case (absent hardware mitigation) in which a symmetric = group key solution can be made secure/safe and no one has made an offer = of proof that they can make it secure. I've asked repeatedly - no one = has come forward with more than "oh we can lock the symmetric key stuff = in a corner and make sure it isn't used for anything important". >=20 >=20 > Given the recent attacks on the internet by IOT botnets, there is a = further consideration that should be undertaken - whether the symmetric = group key solution applied to 10s of 1000s of IOT devices is an active = threat to the rest of the internet (e.g. enabling DDOS, cyber physical = issues, etc)? >=20 > The multiparty (group) symmetric key solution is only wanted for a = single corner of the solution space - low latency, no cost systems. = E.g. lightbulbs. Given there is a worked example of the insecurity of = multiparty symmetric key systems (e.g. the attack on the symmetric = signing key of the HUE lights), I'm unclear why anyone at all would = think that pursuing a known bad solution in the IETF is a good idea. >=20 >=20 > =C2=B7 The security consideration section needs to explain under = what circumstances what solution is appropriate. >=20 >=20 > Security consideration sections generally only address the threat *to* = the system from security choices. In this case, symmetric key group = comms reduces down to the same security analysis you would use with = shared default passwords across 1000s of devices. An IOT security = consideration section in the future probably needs to address the threat = *FROM* the IOT solution to the broader internet. >=20 > Mike >=20 >=20 >=20 > If this is not accurate, please let us know. >=20 > Kind Regards > Kepeng & Hannes >=20 > BTW: it is a pity that I can't attend this meeting due to personal = reasons, and hope you all have a nice meeting in Seoul! >=20 >=20 >=20 >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace = > =20 >=20 >=20 >=20 >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace = > =20 > =20 >=20 > --=20 > email: rstruik.ext@gmail.com | Skype: = rstruik > cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace = >=20 >=20 > =20 > -- > =20 > Best regards, > Kathleen >=20 > The information contained in this message may be confidential and = legally protected under applicable law. The message is intended solely = for the addressee(s). If you are not the intended recipient, you are = hereby notified that any use, forwarding, dissemination, or reproduction = of this message is strictly prohibited and may be unlawful. If you are = not the intended recipient, please contact the sender by return e-mail = and destroy all copies of the original message. > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace = --Apple-Mail=_1A1B7053-31A9-45E3-A438-520E3C567682 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
The question regarding distribution of = asymmetric keys was raised in the ACE working group before under the = tread https://www.ietf.org/mail-archive/web/ace/current/msg01825.html=  , where we mentioned that SICS and neXus are working on = enrollment using IoT protocols. We have already implementing this on the = CA side and also on Contiki side and tested with Class II IoT = devices. 

/Shahid

On 18 Nov 2016, at 09:13, Kumar, Sandeep = <sandeep.kumar@philips.com> wrote:

Hi G=C3=B6ran, Kathleen and all
 
Extending on the = comment =E2=80=9Cbut it seems natural to extend the KDC = with this functionality=E2=80=9D, the new version of the = draft-somaraju-ace-multicast [1] submitted a week back includes now the = asymmetric version as the recommended version for most application = except the low latency applications (to be achieved in low resource = device).
@Kathleen: what you = have asked is already in the new draft and the aspects regarding OSCOAP = in [2] which can be easily merged into [1]. Are you asking for something = else?
 
Sandeep
 
 
From: Ace [mailto:ace-bounces@ietf.org] On Behalf = Of G=C3=B6ran = Selander
Sent: Friday, November 18, 2016 = 9:00 AM
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>; ace@ietf.org
Cc: Michael Richardson <mcr+ietf@sandelman.ca>; = Michael StJohns <mstjohns@comcast.net>; Rene Struik <rstruik.ext@gmail.com>; = Tirumaleswar Reddy (tireddy) <tireddy@cisco.com>
Subject: Re: [Ace] Summary of ACE = Group Communication Security Discussion
 
Kathleen and all,
 
I believe all necessary drafts for a solution based on = asymmetric keys are already in place.
 
With "a solution based on = asymmetric keys=E2=80=9D I understand a solution where each member of = the group can sign messages with its private key for source = authentication but where confidentiality is protected with a symmetric = key shared between the members of the group.
 
[1] describes how to = distribute and use symmetric keys, using a KDC for distributing the = symmetric keys, and references OSCOAP for securing the group = communication. [2] shows how to secure group communication for CoAP = based on asymmetric keys as described above. As far as I understand, the = only thing missing is a mechanism for distributing the public keys of = the members, but it seems natural to extend the KDC with this = functionality.
 
[1] https://tools.ietf.org/html/draft-somaraju-ace-multicast-01=
[2] https://tools.ietf.org/html/draft-tiloca-core-multicast-oscoap-= 00
 
 
 
However, I don=E2=80=99t = agree with all conclusions of the asymmetric key proponents.
 
It is not news = that asymmetric key techniques are feasible for use in many = embedded device applications, but it is good that the knowledge is being = spread. But execution times and message sizes may still be prohibitive = for some applications. To address Rene=E2=80=99s question "is 64B = too much?": Adding the = countersignature to COSE messages such as those used in multicast OSCOAP = would increase the size from the order of 20 bytes to the order of 85-90 = bytes which in turn may add significant latency depending on link layer = technology used, independently of = processor capacity.
 
Without neglecting the issues = raised, I do think that there is a role for symmetric key based group = communication for the class of actuators in scope of [1]. I agree it is = an issue if compromising one device and extracting one key let's you = turn off 1000 lamps (not saying it has to, but just as an example). But = that doesn't automatically turn the lightbulbs into bots.  The = security considerations in this case should e.g. include things like = restricting capabilities associated with the possession of a shared = key. 


Independent of this discussion, = symmetric key solutions for these use cases will continue to be = deployed. I fear we may create greater damage by not analysing and = providing guidance to these use cases when applied in a symmetric key = setting, at the same time as specifying an asymmetric key solution.
 
 
G=C3=B6ran
 
 
 
From: Ace <ace-bounces@ietf.org> on behalf of Kathleen Moriarty = <kathleen.moriarty.ietf@gmail.com>
Date: Friday 18 November 2016 = at 04:59
To: "Tirumaleswar Reddy = (tireddy)" <tireddy@cisco.com>
Cc: Michael StJohns <mstjohns@comcast.net>, = Rene Struik <rstruik.ext@gmail.com>, "ace@ietf.org" <ace@ietf.org>
Subject: Re: [Ace] Summary of = ACE Group Communication Security Discussion
 
 
 
On Thu, Nov 17, 2016 at 10:56 PM, = Tirumaleswar Reddy (tireddy) <tireddy@cisco.com> wrote:
Kathleen,
 
I will put up a = proposal before the Chicago meeting.
 
Thank you. 
 
-Tiru
 
From: Ace = [mailto:ace-bounces@ietf.org] On Behalf = Of kathleen.moriarty.ietf@gmail.com
Sent: Friday, November 18, 2016 = 5:30 AM
To: Rene Struik <rstruik.ext@gmail.com>
Cc: Michael StJohns <mstjohns@comcast.net>; ace@ietf.org
Subject: Re: [Ace] Summary of ACE = Group Communication Security Discussion
 
Is anyone willing to work on a draft to be ready in advance = of the Chicago meeting so we have a concrete proposal for asymmetric = keys?
 
Thanks,
Kathleen 

Please excuse = typos, sent from handheld device 


On Nov 17, = 2016, at 11:26 PM, Rene Struik <rstruik.ext@gmail.com> wrote:

Dear = colleagues:

Just a reminder re perceived = technical hurdles for using signatures:
a) time latency of = signing:
One can pre-compute ephemeral signing keys, so as = to reduce online key computation to a few finite field multiplies. 
Please see = my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQ= Rj1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ= 7TzooI

This seems to take the time = latency argument away. The only other technical hurdles I can see = are 
(i) = signature size {is 64B too much?}; 
(ii) cost of = public key crypto implementations {quite some small, nifty designs out = there (NaCl etc.}.

As to (i) - one should = view signature sizes in perspective: as an example, key sizes in the key = pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of = 6.25 kB and up, according to Table 3 of the paper that massages = parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, = there also do not seem to be too many other objections that would hold = in the world anno 2016 {except for "sunk investment" arguments", but = that is a corporate mindset issue}.

On = 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, = Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security = topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the = discussion as follows:

=C2=B7       The solution needs = to define both, symmetric and an asymmetric group key solution.


There is no = case (absent hardware mitigation) in which a symmetric group key = solution can be made secure/safe and no one has made an offer of proof = that they can make it secure.    I've asked repeatedly - = no one has come forward with more than "oh we can lock the symmetric key = stuff in a corner and make sure it isn't used for anything = important".


Given the recent = attacks on the internet by IOT botnets, there is a further consideration = that should be undertaken - whether the symmetric group key solution = applied to 10s of 1000s of IOT devices is an active threat to the rest = of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution = is only wanted for a single corner of the solution space - low latency, = no cost systems.  E.g. lightbulbs.  Given there is a worked = example of the insecurity of multiparty symmetric key systems (e.g. the = attack on the symmetric signing key of the HUE lights), I'm unclear why = anyone at all would think that pursuing a known bad solution in the IETF = is a good idea.

=C2=B7      = ; The security consideration section needs to explain under what = circumstances what solution is appropriate.


Security = consideration sections generally only address the threat *to* the system = from security choices.  In this case, symmetric key group comms = reduces down to the same security analysis you would use with shared = default passwords across 1000s of devices.   An IOT security = consideration section in the future probably needs to address the threat = *FROM* the IOT solution to the broader internet.

Mike


If this is not accurate, please let us = know.

Kind Regards
Kepeng & = Hannes

BTW: it is a pity that I can't attend = this meeting due to personal reasons, and hope you all have a nice = meeting in Seoul!



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

 



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
 

 

-- 
email: rstruik.ext@gmail.com =
| Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 =
(415) 690-7363
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
<= /div>


 
--
 
Best regards,
Kathleen

The information contained in this message may be confidential = and legally protected under applicable law. The message is intended = solely for the addressee(s). If you are not the intended recipient, you = are hereby notified that any use, forwarding, dissemination, or = reproduction of this message is strictly prohibited and may be unlawful. = If you are not the intended recipient, please contact the sender by = return e-mail and destroy all copies of the original message.
_______________________________________________
Ace mailing = list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

= --Apple-Mail=_1A1B7053-31A9-45E3-A438-520E3C567682-- From nobody Mon Nov 21 06:00:46 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BB70129A68 for ; Mon, 21 Nov 2016 06:00:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=philips.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GgT8lQzyjIT4 for ; Mon, 21 Nov 2016 06:00:42 -0800 (PST) Received: from emea01-db3-obe.outbound.protection.outlook.com (mail-db3on0739.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe04::739]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3731E129A67 for ; Mon, 21 Nov 2016 06:00:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Philips.onmicrosoft.com; s=selector1-philips-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Wt8aGj48uYWFi+C0R4R9ojWpOCpWz/ypkwKTwyPnSXg=; b=RTmJN9mXrehoCY/ajC78K68kW1Yi9CJId6OREU/oMVLJkClZCSMQlqjZCxwa92nSmvg19SAvdwdiCagn5LrCGOtF5+ujQS7/lNUB7Bkx1+yBwQnq53Ty5ltueMUtllIV8B2uV0EEdYTp3HQgfznDBfSpBaiTaCYV5E1R0V17DG0= Received: from HE1P122CA0001.EURP122.PROD.OUTLOOK.COM (129.75.100.143) by DB5P122MB0005.EURP122.PROD.OUTLOOK.COM (129.75.100.212) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.10; Mon, 21 Nov 2016 14:00:21 +0000 Received: from AM1FFO11OLC001.protection.gbl (2a01:111:f400:7e00::170) by HE1P122CA0001.outlook.office365.com (2603:10a6:23:2::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.10 via Frontend Transport; Mon, 21 Nov 2016 14:00:21 +0000 Authentication-Results: spf=none (sender IP is 40.103.22.84) smtp.mailfrom=philips.com; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=philips.com; Received-SPF: None (protection.outlook.com: philips.com does not designate permitted sender hosts) Received: from 011-smtp-out.Philips.com (40.103.22.84) by AM1FFO11OLC001.mail.protection.outlook.com (10.174.65.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.4 via Frontend Transport; Mon, 21 Nov 2016 14:00:21 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:; UpperCasedChecksum:; SizeAsReceived:4138; Count:52 Received: from VI1PR9003MB0237.MGDPHG.emi.philips.com (129.75.99.82) by VI1PR9003MB0238.MGDPHG.emi.philips.com (129.75.99.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.721.19; Mon, 21 Nov 2016 14:00:19 +0000 Received: from VI1PR9003MB0237.MGDPHG.emi.philips.com ([129.75.99.82]) by VI1PR9003MB0237.MGDPHG.emi.philips.com ([129.75.99.82]) with mapi id 15.01.0721.024; Mon, 21 Nov 2016 14:00:19 +0000 From: "Kumar, Sandeep" To: "ace@ietf.org" Thread-Topic: EST over CoAP in ACE wg Thread-Index: AdJD/4dN3nkys8JpRuSDXvz8bQBVcA== Date: Mon, 21 Nov 2016 14:00:19 +0000 Message-ID: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [194.171.252.108] X-MS-Office365-Filtering-Correlation-Id: e7b9398a-b3b5-4613-6483-08d41216bbdb Content-Type: multipart/alternative; boundary="_000_6525c5f0b6e040b683ccd9c43b1c5e2fVI1PR9003MB0237MGDPHGem_" MIME-Version: 1.0 X-OrganizationHeadersPreserved: VI1PR9003MB0238.MGDPHG.emi.philips.com X-IncomingHeaderCount: 52 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:40.103.22.84; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(7916002)(2980300002)(428002)(189002)(199003)(374574003)(85714005)(55904004)(68736007)(512954002)(101416001)(81156014)(81166006)(106466001)(92566002)(4326007)(2906002)(5640700001)(108616004)(33646002)(356003)(8676002)(2351001)(105586002)(790700001)(8936002)(6116002)(102836003)(2900100001)(7846002)(1730700003)(7736002)(7906003)(3846002)(86362001)(5660300001)(110136003)(7696004)(69596002)(626004)(260700001)(189998001)(97736004)(87936001)(66066001)(2501003)(54356999)(606004)(38730400001)(84326002)(6916009)(24736003)(50986999); DIR:OUT; SFP:1102; SCL:1; SRVR:DB5P122MB0005; H:011-smtp-out.Philips.com; FPR:; SPF:None; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; AM1FFO11OLC001; 1:AjqFw/NvJVV5QhFpdhvc6Spd0M5UU7drNaqcLL+rP9Qnnn4Bo0lnA/GH1TrDnso6eWaGZAQIMjDLYRyqSFrDa9c2J+mxYi/06O7G6CmyybHK7uKFWIENzS6Hy+OxAcdeLVv4KIp3j1TYkeU57h4wMclqly9lVTMbBnhNcecvDLnjUNgJIXqsBh5Ct/WrqYNrz4ERTn41+IQpQoGTenYAwnvgGTHXPS0vYYiaWFyBoZ7/jAd5NN8bROpmIbWtqHl/0yPz2MwZu7S7SryDYS53aiyCg9hvKdUxkfC0yzywzRuSG0lPLItAv43tPzlvyohBTsDvEA98jOrUqVgu8ZnQR7r3qZFPRirLnhebSgI23C9jvKLXZJJ/vMFURM79+Cu/F4zotQUSLWugDErEIcFk0skZfwxeBiX/mE8DXY9dLzNhvjgIQMP0qVlj1FVdjN4kYrgtXzDjIklvFcD5Ha9+JBerUC3POavnVcWd2vXfEZeHrU0YLu4+Z0RB5HoO6JSvxhE5o9fSXIeP6i7GeJpspw== X-CrossPremisesHeadersPromoted: AM1FFO11OLC001.protection.gbl X-CrossPremisesHeadersFiltered: AM1FFO11OLC001.protection.gbl X-Microsoft-Exchange-Diagnostics: 1; DB5P122MB0005; 2:ueX/fvTgps1cmTQlU1qw9oM0tT5F2vuFBgdhWzxbiiV4mc6CslwGjz/KNNMhp+CpqtcTgF+hgkYdghlHYFQHmfhhRrEoaHIUaI/hHD20hKoQE9iuSoGuFGO5ea7EIRf55sqRQjPTshu4DTyFc8zf19of76W8o+2S4hmGKi0wFow=; 3:UBCuLoh3QWPoFcH9Z1vf117baC7+3WNvNIuSjG03nlMjjV/PUdGiAH92QK3/E3UVHJLN8lQgViDKWJV5Y2ouISP26FomgXypgB7eoD3mzInW1ehF9Xavgse/6RlrO3Ukk4Gq0mrLUwD7jStnKsC2vbDI9HT38q2TIA1YL6aIRvfBzOme88d0LHMcGXr/PQ56M84rWIUca3ZZ1rMCVnLHI/UnwlBjcsLvf4A5l8sCh76FgwNpRIrO5TyplIjBy5CupO5tbR9ZwsbY6qCclXmz2g== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB5P122MB0005; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DB5P122MB0005; 25:/UNP+4M4JNU1zp3EqQZXj89hU4OyjnJxGmBVVWMHK?= =?us-ascii?Q?IMlrM78exAkZxLgjDnFHQfhpRMsYreqN/U8r/xTMImv0O9pSgcmlKua1XQYQ?= =?us-ascii?Q?1aMOMi7PG5BFGDSbybKZHRD1VMvRVBMNUA8yW02CpuRmnCOWN5+6fxa0xLgv?= =?us-ascii?Q?Hgzs4jOzWTopWn/gR4dkyN3UIdwfrEouizUVytqjnDjCiAzvUAYmaBLMrQXc?= =?us-ascii?Q?W0tvs1gLmi5mUwZR5t+1MjDhs9gHZwdCTX9m7kUFYyHLo7CW6IlsOg7Et1ir?= =?us-ascii?Q?pITNWgAOL6f08ybYx+dwUf1BzaR6XQv8wmT2Niv32HEFtyuX0Ny9pyBplVPj?= =?us-ascii?Q?vq3Dro4K7OWnA9qTg6j/DSuy+OmpyKgvUZrJhlGA84DWFOFK7xfHis0D10R9?= =?us-ascii?Q?DUAKdDoeKS9UfVjsbLhR7KAW/lORtFJCxSDL0o94ZV08DHYfSjMZAOPmrjG8?= =?us-ascii?Q?X+Gq/Q4K9292pCwrnXQRtkq+SSRusYE7A3rEVRwoJrDcyUUr/tbsEczIwBM6?= =?us-ascii?Q?AJ6BjEXmE8LlcvHeJchAdVK5tq+hSPoshuxL4viM+jYuUkth8TSg+BKgtrvs?= =?us-ascii?Q?s6gVMOYqI249BdSW2fooHgRITNfH8xIYCAJDyHf7Sk+Q1q62kjRGpnrVAiIr?= =?us-ascii?Q?nD6FWQr/UeT4U/mt42Lc0xBtqFE1A6495723tkZKc3IcfEHE4r7W4jVHPdTw?= =?us-ascii?Q?9EYb/EVG6c/gbmdRfloDgH/B+mVgFbF9pFg7dKQW9vVMYDGzWrPNnTFXrFaX?= =?us-ascii?Q?UQ2b8wT1Z3m7N72ruTEztJKl0/RKDHfAW0OGcOVbgdrNlPv+LfcFs1yn8cV9?= =?us-ascii?Q?dZJhULAh8+aEx6rGvHq6p186iiQ50/8HB8woy+JSBELBNwOQBBtEJ0+UXE50?= =?us-ascii?Q?0i1SeqsiA38sVxtIeNP5v2kB8j73SLLjG8FEUNHskWrQ/dNfJ90tZ+5vmKnH?= =?us-ascii?Q?JnNguxR6+EqHvgd9+gU5iWCvNcb/Hvbz9Hm0zd81tBU9cm472e+gSTPYLBU4?= =?us-ascii?Q?bnNybHhDOveyx+Zc0kI17d4aT5UhAIx8jwyTwlBM5sTIfz5AmJcjEqGvWAxx?= =?us-ascii?Q?LqYRisX8iWiMZtjDQwJOihH7Ew+RgIFVOXQLeRHCgSfCR72RkzUACrN/jbEw?= =?us-ascii?Q?YMGfZZPuN0=3D?= X-Microsoft-Exchange-Diagnostics: 1; DB5P122MB0005; 31:v912VhrYg7IPV+QwPTPslApMOWgiBJsUPfoSqyhwcVwGvR9CkyU7Z3M6oH4DghEAqYbjQFRVpsgEUIK4aLIyYuQYpMJZLePiOXS78RBhFXzSXxXB6J8ffl+1PLznCTNE9V5mTnfxuaZQrrcSDqhhmc6hoH8uNNQrc2vMfJbXUKOMEVB72+5+CRP/Hin9Rtlrw4sjhgPyfBwN1bx1TAkvoR2vyXpFD941rwaxII5cZh1XwlJV7jkypJiZWvNeawGUwXDM7MybIfBlOtGTTpiFKA==; 20:xOlVcVe+TOLLFHPv0C//YwPQ9zS+tzQT9RUs2c8mCFaW8y1Wz4rCOi9XzsCI/tl19ARty6vGkRcvEAg2HepvzwJN58TM4nUfUZLQrr0tKimL7R5PMqsrOlhDyH9gZ7xUTFgCFrgphKFc5/U0KBH43UQxE7PKB7SSUVZeh1cOXCC9zLmXA/stv/da6coCKXmcZ/4SQTTuxe6I9WwJA6OY9xWU1G/fjic8mZn5Kd+MKEyXruSla3SIb3Aj85F6faKcgpSpdM+pp6zVt6XYXBGSALh2Zi2R6pTuDQ339wIUhEa/wUxM+Xqjq3SWdgWYqU+9X9HATNpg65kOdrn0GXVJmtxC+veY4k21AjN6gG0z7amFJucdAe83ITUB8EhkGXRJrADzF2/8mW+92gN8wJLCzhjddtKck5ARKhIwOcNy9vzdaUNJf157kDfMAae2CA3RIDmahkrytVdS8Z4tIJF8aNx88LZsClB8lbCCPEw0lDCd07NB0TtvanUg9slAZ6+d X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(21748063052155); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040307)(6060326)(6045199)(2401047)(13018025)(8121501046)(5005006)(13016025)(10201501046)(3002001)(6055026)(6041248)(6061324); SRVR:DB5P122MB0005; BCL:0; PCL:0; RULEID:; SRVR:DB5P122MB0005; X-Microsoft-Exchange-Diagnostics: 1; DB5P122MB0005; 4:JXQiEUJfKl16MwlrC1HiCqZJhzun525X+/HAxyQnOoD14AeDS0taQOrhvy3eeGDORp28O5kD/sc3rPsULqx+Vqg1un3VwJRR457/8tctkS76pqIlVEpVTSthYWYkFH2cyo41iX/83WIbIq9i6jQSMqOvPdvEpqAaygzkCJBLr9z8MO1qPMAyQB/46Kmlu6u02EcYm9YWBlWfTZaxb+nBRRLtman0GNpmJHWs7u4YJ23oCWcxSof6SdQt3EdjHnaCg5K+l10IUYKuYENP6xmePjsb96lhwt85WQKA7uekPXhbbUKzWZZKOxttGqJIXqaudJPVMUnYXAIHapMkvaV/cJwb7B39rydMcb5arfnqsM2hRRplcn6lPmSRa0KFXtcBkoq+ceJl4xTUMmP41M/m69BrMsJGdzEOfX1IWeUxgEDb1ttoCUrFHgIPmX9JnChj3/4mV2Dd2qHAq0zH2VGgObYkGdZga5T/0Bx07jBCShyyKMV1lHExJW1FuXvOwh0JHiwmTiVWwIX6vQ1AkGEXVkYHNmPLWNx7A+5kT1C/EcWwwYa7yWzkU+zC/P+H5dyv X-Forefront-PRVS: 01334458E5 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DB5P122MB0005; 23:imyyS+Xkk42x5tkukVhdCvHric+LmjfLg6f0IqSq7?= =?us-ascii?Q?QCLb83Px0B6qcKUnTUFgxOGD5OXzcRs6cx9hwEBFqPHnXvtrc+nTRFOec46o?= =?us-ascii?Q?G07+jzVzeCLSklj+wFDaBJHyLRPDCOKyAjBTkqK0v7pgdegnV9miyfSWgQF9?= =?us-ascii?Q?CFel5lgXyu4M1A3u5+c2eftcwNSGVwkFWKXUlF8G2UQlPVcxuwDXLMB20GAF?= =?us-ascii?Q?rOZAtWqzn8W/FI8jNp9viOr6C9wlE8gGiGQc9gNGTdJDlmEelvQQ6hJg/oJD?= =?us-ascii?Q?gddYkEY0CMbguScmJWGyZjUN3ucL6F46S+ONOigwCxMtcffykv6zF57HO5qd?= =?us-ascii?Q?iJ0IIIWVIWQCD1kfu4ut0jlzYHGt4dpa3ASBk6xvHEJxULyEDKs6d8uYGzn7?= =?us-ascii?Q?Eoy7gL5FXWO8bFRoonY3NIzq4KKlFkCG2bX3DN0LgAk8WH+q87wx+mf5X+Nu?= =?us-ascii?Q?swf679fxCV4fw4wf1dHo53p0gGLbI6/He4HsPiQtQ235uVnm22y7pT3QLjFC?= =?us-ascii?Q?M2FbPMWEoLhPM8Ufyg4Sjd5I50hQL4uNGz99fPaps9OgW2q9DglYJMNCh+2z?= =?us-ascii?Q?rs2MT2Y1cL2jfO9t8bLLA/Wu3jssKsKkJYbMzTw3Dn6I9GqayIV6wSWypALR?= =?us-ascii?Q?sYzztX9MMeWqljNl67oOAtRg1zUxaEQFo4uGRbz08H+/RylZPoZrqkLyQg65?= =?us-ascii?Q?17gxbozM4WBR/B5TQTg9nUlYjN+onoyrtNHbKdz4+k7PLJ9rAIG9ffsao/m6?= =?us-ascii?Q?SGcIcmwp654RKDQYoEpPPRTid0fSFzm9nibsIYJdcu/pzZwyYxdEjQ6yu600?= =?us-ascii?Q?dDUHrYW4nPJ5m8230N+Nhc2KC+Rh3d0U7ZSb3XN229TuMUZsq6TL9jy38IgF?= =?us-ascii?Q?WyAszyD9+OjtFmHXl39PNuSTlFh7cecsXS0EJZpLzVvIsMjSJw+4Wr9QpSW7?= =?us-ascii?Q?x6oaBPfnTX/CP1mXEZ/QM/55gMMjNk45E2YtaTg/fpe2ympz2SXaAPOHAj1P?= =?us-ascii?Q?/FAx4kmHiLPOQK/k2TUM/0iK1Z43Pta2Eydhovcya5ZvRbCPyXLcjoUDrlBP?= =?us-ascii?Q?BOUZMbFHu+StKMqeIPkG490rqYMhj/UBuUNjzzEceAIxHORC0AfolwiU2fxh?= =?us-ascii?Q?iakbS2VCSW1a2qNf573aJ61SwBsYlYrjlKQEvvT/ONcRNuo8V6akPFVWb3S+?= =?us-ascii?Q?3dmcuvFp64P+Kd+F6UTGJc46y9nD45T+wVLC5qRlZ0fj/XBQ/qm5cQwR4SJZ?= =?us-ascii?Q?kmlx5tzmECUODuD7Zo46svQK3LAwIqkv4FQydL+?= X-Microsoft-Exchange-Diagnostics: 1; DB5P122MB0005; 6:fiANgmh36+2sE9i1g4/ZUNmyEuvri/4oc+tcmiZ0yaLqv9skVY9uxMtzJgfKZVEYOoUQB4ntNnPCdVSXM9rrb7BVkTxBHAWJrYaZp8DWhzFtQiftBkZ5kmvdOgwIbyis7LT+TgQCpikncJhft1ZFbE3bxkkKPUoYFO04bCZ5ASY10RwpHOoV8KADz6V/CHqsxa21oTlIsvpf7orXKaulKKA4JICgj7o4DNHY3ci409QGTgOdpEMWU1L+s+Enp4GTQlTK49VWrNy70tcxnb+foldh7ajGS/5UCxUsqHq6/yjHB3LMMEpsLgx/grUYBVbAWbBZ1poXVgZylF6ZOIBB8Q+yq5rMCYhorDJdjZvusZINO2FecgKFavWJ3p7SaiIW; 5:0lV7Apm5YeXXdUagkQtu0PmnJaXH0/GYjCk8EoEy1hJyoBbmWexR+9tB7NP2TVAj/UoTLNl4Hin79xDXAkZcUOLOUCo5MfY25kSRPEhmnsWgOsTEY2MHnMZF8JonefP9t08Q+pw/HkCBZ9gtE8w78A==; 24:mklq1OY2kUsSGvOz/HdFaP/ElxDyD5wG8ikFMNJZDuLYVC2gmiQXwiibsgRR1vYCLyIdecSXjQySz1n5pxBsCFSjI4ToXrXy5ITOnFhZES4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DB5P122MB0005; 7:00tAuOVsRQagjzDHLHxF+D4L9Fasq3b+ENHZxJI4lnYmtxTG9JxjTS6BpnkS4WiGENmrlYy4qTYXXoJPAk1YawU8/bsY2HXkEUXZdEx2wMB9UUVIgXZiy3aZ8jrH1ejaVwzN9dbFACyNo7R8BmXNofl8zK+gKvhup48onJlPi+C5u5t5O/vcDqpQQT7c2sSTNfEPDW6Y8CisLS3YQr20reEvvUtr8GCyYBfsKmnOkdyL+DMgcNx0P6VNtMc8NHUN2WRg59wh4qCF1oplBXOZWPxb1MB/RGuxmIJYozwr7fbsv//LlXk3gqOe4+peCfxPALApNT00QGfqdSHwBOzxFbje6+fjzkJ9ucyugbNagg0= X-OriginatorOrg: philips.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Nov 2016 14:00:21.5600 (UTC) X-MS-Exchange-CrossTenant-Id: 1a407a2d-7675-4d17-8692-b3ac285306e4 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1a407a2d-7675-4d17-8692-b3ac285306e4; Ip=[40.103.22.84]; Helo=[011-smtp-out.Philips.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5P122MB0005 X-MS-Exchange-CrossPremises-AuthAs: Internal X-MS-Exchange-CrossPremises-AuthMechanism: 04 X-MS-Exchange-CrossPremises-AuthSource: VI1PR9003MB0237.MGDPHG.emi.philips.com X-MS-Exchange-CrossPremises-SCL: 1 X-MS-Exchange-CrossPremises-messagesource: StoreDriver X-MS-Exchange-CrossPremises-BCC: X-MS-Exchange-CrossPremises-originalclientipaddress: 194.171.252.108 X-MS-Exchange-CrossPremises-disclaimer-hash: 7fd5309d68bb4378c576a4d2c2ad972d336f5eb0475879c2a0b14da1aac98972 X-MS-Exchange-CrossPremises-processed-by-journaling: Journal Agent X-MS-Exchange-CrossPremises-AVStamp-Service: 1.0 X-MS-Exchange-CrossPremises-Antispam-ScanContext: DIR:Originating; SFV:NSPM; SKIP:0; X-OrganizationHeadersPreserved: DB5P122MB0005.EURP122.PROD.OUTLOOK.COM Archived-At: Cc: Shahid Raza , "Panos Kampanakis \(pkampana\)" , "'consultancy@vanderstok.org'" Subject: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 14:00:45 -0000 --_000_6525c5f0b6e040b683ccd9c43b1c5e2fVI1PR9003MB0237MGDPHGem_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dear ACE members Peter van Stok gave a short overview during the ACE f2f meeting on the work= related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-co= ap-est-00). = In the meeting there was general interest among the audience for the work a= nd ACE as the preferred WG for this item. There are additional drafts and w= ork on the same topic like the draft-pritikin-coap-bootstrap-01 and the email from Shahi= d https://www.ietf.org/mail-archive/web/ace/current/msg02029.html The idea is to merge these into a single draft (already discussed among us)= . We would like to get feedback on the mailing list if indeed ACE would be a = right place to continue this work as was perceived during the f2f meeting. = Please respond if you support (or not) the activity going forward in ACE wg= . Kind Regards Sandeep ________________________________ The information contained in this message may be confidential and legally p= rotected under applicable law. The message is intended solely for the addre= ssee(s). If you are not the intended recipient, you are hereby notified tha= t any use, forwarding, dissemination, or reproduction of this message is st= rictly prohibited and may be unlawful. If you are not the intended recipien= t, please contact the sender by return e-mail and destroy all copies of the= original message. --_000_6525c5f0b6e040b683ccd9c43b1c5e2fVI1PR9003MB0237MGDPHGem_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Dear ACE members

 =

Peter van Stok gave a sh= ort overview during the ACE f2f meeting on the work related to EST (RFC 703= 0) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00). In the meeting there was general interest among the audience for the work = and ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the dr= aft-pritikin-coap-bootstrap-01 and the email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html

The idea is to merge the= se into a single draft (already discussed among us).

 =

We would like to get fee= dback on the mailing list if indeed ACE would be a right place to continue = this work as was perceived during the f2f meeting. Please respond if you su= pport (or not) the activity going forward in ACE wg.

 =

Kind Regards<= /span>

Sandeep

 =

 


The information contained in= this message may be confidential and legally protected under applicable la= w. The message is intended solely for the addressee(s). If you are not the = intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message i= s strictly prohibited and may be unlawful. If you are not the intended reci= pient, please contact the sender by return e-mail and destroy all copies of= the original message.
 --_000_6525c5f0b6e040b683ccd9c43b1c5e2fVI1PR9003MB0237MGDPHGem_-- From nobody Mon Nov 21 06:51:19 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A742E129A85 for ; Mon, 21 Nov 2016 06:51:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zgrp.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fO-7Bg9TtcL2 for ; Mon, 21 Nov 2016 06:51:13 -0800 (PST) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01on0135.outbound.protection.outlook.com [104.47.0.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 461CE129A93 for ; Mon, 21 Nov 2016 06:51:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zgrp.onmicrosoft.com; s=selector1-tridonic-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=LzVbU97e3oZBrOc3GHVIFfe5sn37gtU4A/bsKrtqIEE=; b=fFEV14CUAW4Eq8vyC1JBRQYkCnUj/xpEkAaGX+pdnuh2q8smqMxkRHCT/Vb024zLnCGmQsaxnnmJtve4U56l36sbCs2WTfAuRmGlVVTPcOgUTIbWF3dfeRge4NDdROPl6XmPOklRH5BtSw6YVLleKJoANv5quw0EjNbWEvI2brs= Received: from DB6PR0601MB2198.eurprd06.prod.outlook.com (10.168.57.139) by DB6PR0601MB2198.eurprd06.prod.outlook.com (10.168.57.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.8; Mon, 21 Nov 2016 14:51:04 +0000 Received: from DB6PR0601MB2198.eurprd06.prod.outlook.com ([10.168.57.139]) by DB6PR0601MB2198.eurprd06.prod.outlook.com ([10.168.57.139]) with mapi id 15.01.0734.013; Mon, 21 Nov 2016 14:51:04 +0000 From: Somaraju Abhinav To: "Kumar, Sandeep" , "ace@ietf.org" Thread-Topic: EST over CoAP in ACE wg Thread-Index: AdJD/4dN3nkys8JpRuSDXvz8bQBVcAABxVYQ Date: Mon, 21 Nov 2016 14:51:04 +0000 Message-ID: References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=abhinav.somaraju@tridonic.com; x-originating-ip: [146.108.200.112] x-microsoft-exchange-diagnostics: 1; DB6PR0601MB2198; 7:wtIF58BsGtH4WmT01VHgbW0gH21ssInEvCnMvoiks1XRd1FdNn8RDpnvZDIzp2sGOmWweF3gwJkepBChtUlhTsoceWzE6Ff8XbTcAJW+BqZoKPft9Jp0w2VSu8FG8pI2aqkEROdwaauEZQWrKVXK7I260fbs8Ne5dWbPsokL/c8sAbPp9FZ8zbTfO9+FqRxm/VCye6cp3COJWMJbSKbrA0TfcasSj9j19/L/LpebkClHHLqzpyMYl7yqAqjDWJwjgLL3PlWyj/mOdG3Lzqh5ZH3bNVRts4xC4HVj/iz/iTfUcX3QQ1K3v10EiFw2RGfiI1mwPpClKAQNxTCkYad6o+grx9pp0AtoIaKvN+0UtoI= x-ms-office365-filtering-correlation-id: 8583fc83-f14c-4797-39c6-08d4121dd174 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:DB6PR0601MB2198; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(95692535739014)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040307)(6060326)(6045199)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(6041248)(6061324); SRVR:DB6PR0601MB2198; BCL:0; PCL:0; RULEID:; SRVR:DB6PR0601MB2198; x-forefront-prvs: 01334458E5 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(189002)(199003)(85714005)(374574003)(55904004)(81166006)(81156014)(8676002)(7846002)(76576001)(122556002)(3660700001)(3280700002)(2501003)(7736002)(74316002)(9326002)(97736004)(5890100001)(2950100002)(2900100001)(5660300001)(77096005)(7696004)(92566002)(86362001)(87936001)(54356999)(50986999)(76176999)(229853002)(68736007)(33656002)(38730400001)(105586002)(606004)(5001770100001)(106356001)(8936002)(4326007)(6506003)(66066001)(2906002)(101416001)(189998001)(9686002)(7906003)(3846002)(6116002)(790700001)(102836003); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6PR0601MB2198; H:DB6PR0601MB2198.eurprd06.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: tridonic.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DB6PR0601MB21988D440155BDB0D5E0552DFCB50DB6PR0601MB2198_" MIME-Version: 1.0 X-OriginatorOrg: tridonic.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Nov 2016 14:51:04.1817 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8b206608-a593-4ace-a4b6-ef1fc83c9169 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2198 Archived-At: Cc: Shahid Raza , "Panos Kampanakis \(pkampana\)" , "'consultancy@vanderstok.org'" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 14:51:15 -0000 --_000_DB6PR0601MB21988D440155BDB0D5E0552DFCB50DB6PR0601MB2198_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Sandeep, I think this is a good idea and will fully support the adoption of this in = ACE. Abhinav From: Ace [mailto:ace-bounces@ietf.org] On Behalf Of Kumar, Sandeep Sent: Montag, 21. November 2016 15:00 To: ace@ietf.org Cc: Shahid Raza ; Panos Kampanakis (pkampana) ; 'consultancy@vanderstok.org' Subject: [Ace] EST over CoAP in ACE wg Dear ACE members Peter van Stok gave a short overview during the ACE f2f meeting on the work= related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-co= ap-est-00). = In the meeting there was general interest among the audience for the work a= nd ACE as the preferred WG for this item. There are additional drafts and w= ork on the same topic like the draft-pritikin-coap-bootstrap-01 and the email from Shahi= d https://www.ietf.org/mail-archive/web/ace/current/msg02029.html The idea is to merge these into a single draft (already discussed among us)= . We would like to get feedback on the mailing list if indeed ACE would be a = right place to continue this work as was perceived during the f2f meeting. = Please respond if you support (or not) the activity going forward in ACE wg= . Kind Regards Sandeep ________________________________ The information contained in this message may be confidential and legally p= rotected under applicable law. The message is intended solely for the addre= ssee(s). If you are not the intended recipient, you are hereby notified tha= t any use, forwarding, dissemination, or reproduction of this message is st= rictly prohibited and may be unlawful. If you are not the intended recipien= t, please contact the sender by return e-mail and destroy all copies of the= original message. ________________________________________________________ The contents of th= is e-mail and any attachments are confidential to the intended recipient. T= hey may not be disclosed to or used by or copied in any way by anyone other= than the intended recipient. If this e-mail is received in error, please i= mmediately notify the sender and delete the e-mail and attached documents. = Please note that neither the sender nor the sender's company accept any res= ponsibility for viruses and it is your responsibility to scan or otherwise = check this e-mail and any attachments. --_000_DB6PR0601MB21988D440155BDB0D5E0552DFCB50DB6PR0601MB2198_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Sandeep,

I think this is a good= idea and will fully support the adoption of this in ACE.=

Abhinav

 

From: Ace [mailto:ace-bounces@ietf.org] On Behalf Of Kumar, Sandeep
Sent: Montag, 21. November 2016 15:00
To: ace@ietf.org
Cc: Shahid Raza <shahid@sics.se>; Panos Kampanakis (pkampana) = <pkampana@cisco.com>; 'consultancy@vanderstok.org' <consultancy@va= nderstok.org>
Subject: [Ace] EST over CoAP in ACE wg

 

Dear ACE = members

 

Peter van= Stok gave a short overview during the ACE f2f meeting on the work related = to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00<= /a>). In the meeting there was general interest among the audience for the work = and ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the dr= aft-pritikin-coap-bootstrap-01 and the email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html

The idea = is to merge these into a single draft (already discussed among us).

&nbs= p;

We would = like to get feedback on the mailing list if indeed ACE would be a right pla= ce to continue this work as was perceived during the f2f meeting. Please re= spond if you support (or not) the activity going forward in ACE wg.

 

Kind Rega= rds

Sandeep

 

 

 

The information contained in= this message may be confidential and legally protected under applicable la= w. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any us= e, forwarding, dissemination, or reproduction of this message is strictly p= rohibited and may be unlawful. If you are not the intended recipient, pleas= e contact the sender by return e-mail and destroy all copies of the original message.<= o:p>

________________________________________________________ The contents of th= is e-mail and any attachments are confidential to the intended recipient. T= hey may not be disclosed to or used by or copied in any way by anyone other= than the intended recipient. If this e-mail is received in error, please immediately notify the sender and= delete the e-mail and attached documents. Please note that neither the sen= der nor the sender's company accept any responsibility for viruses and it i= s your responsibility to scan or otherwise check this e-mail and any attachments. --_000_DB6PR0601MB21988D440155BDB0D5E0552DFCB50DB6PR0601MB2198_-- From nobody Mon Nov 21 07:21:05 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A0F5129AC9 for ; Mon, 21 Nov 2016 07:21:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.018 X-Spam-Level: X-Spam-Status: No, score=-16.018 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ap0tc4atLD4R for ; Mon, 21 Nov 2016 07:21:02 -0800 (PST) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFA151296B9 for ; Mon, 21 Nov 2016 07:21:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6587; q=dns/txt; s=iport; t=1479741662; x=1480951262; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to; bh=873pRJ6RYteeoFT+w0duRbXjV7O/3RL01rsF20+QpYg=; b=EhMcN2YB3Cb6tFXAThsdtcrM0ZN2B+ql2UrT3VO+rQGCMmf4z8nSEirq ymHEahwxSHGk3g6m05t+zVkDp5z4bDe7Zb5ifQSeSpvr/eqUfjl4PgFul SJdLY+XDzq3IwpH1a5C6WcXPSrpNueeC1Y9UBVEEU3vQ5XY/1X/E3yjuD w=; X-Files: signature.asc : 481 X-IronPort-AV: E=Sophos;i="5.31,675,1473120000"; d="asc'?scan'208,217";a="647259435" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Nov 2016 15:21:00 +0000 Received: from [10.61.226.111] ([10.61.226.111]) by aer-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uALFKxtx010401; Mon, 21 Nov 2016 15:20:59 GMT To: "Kumar, Sandeep" , "ace@ietf.org" References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> From: Eliot Lear Message-ID: <1ddbe07a-3300-6364-b882-56ec51d42cef@cisco.com> Date: Mon, 21 Nov 2016 16:20:59 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Htjnsm9cMueDcCpHwuN9wQbgGbiubWvgC" Archived-At: Cc: Shahid Raza , "Panos Kampanakis \(pkampana\)" , "'consultancy@vanderstok.org'" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 15:21:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Htjnsm9cMueDcCpHwuN9wQbgGbiubWvgC Content-Type: multipart/mixed; boundary="EGiaC33XOoW4QaWXpj8XpshEwgjJBSu33"; protected-headers="v1" From: Eliot Lear To: "Kumar, Sandeep" , "ace@ietf.org" Cc: Shahid Raza , "Panos Kampanakis (pkampana)" , "'consultancy@vanderstok.org'" Message-ID: <1ddbe07a-3300-6364-b882-56ec51d42cef@cisco.com> Subject: Re: [Ace] EST over CoAP in ACE wg References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> --EGiaC33XOoW4QaWXpj8XpshEwgjJBSu33 Content-Type: multipart/alternative; boundary="------------EC00587B2BB6622561143DD3" This is a multi-part message in MIME format. --------------EC00587B2BB6622561143DD3 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I think this is a good idea. Eliot On 11/21/16 3:00 PM, Kumar, Sandeep wrote: > Dear ACE members > > Peter van Stok gave a short overview during the ACE f2f meeting on the = work related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-c= ore-coap-est-00). In the meeting there was general interest among the audience for = the work and ACE as the preferred WG for this item. There are additional = drafts and work on the same topic like the draft-pritikin-coap-bootstrap-= 01 and the = email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02= 029.html > The idea is to merge these into a single draft (already discussed among= us). > > We would like to get feedback on the mailing list if indeed ACE would b= e a right place to continue this work as was perceived during the f2f mee= ting. Please respond if you support (or not) the activity going forward i= n ACE wg. > > Kind Regards > Sandeep > > > > ________________________________ > The information contained in this message may be confidential and legal= ly protected under applicable law. The message is intended solely for the= addressee(s). If you are not the intended recipient, you are hereby noti= fied that any use, forwarding, dissemination, or reproduction of this mes= sage is strictly prohibited and may be unlawful. If you are not the inten= ded recipient, please contact the sender by return e-mail and destroy all= copies of the original message. > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --------------EC00587B2BB6622561143DD3 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

I think this is a good idea.

Eliot


On 11/21/16 3:00 PM, Kumar, Sandeep wrote:
Dear ACE members

Peter van Stok gave a short overview during the ACE f2f meeting on the wo=
rk related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-cor=
e-coap-est-00<https://tools.ietf.org/=
html/draft-vanderstok-core-coap-est-00>). In the meeting there was=
 general interest among the audience for the work and ACE as the preferre=
d WG for this item. There are additional drafts and work on the same topi=
c like the draft-pritikin-coap-bootstrap-01<https://tools.ietf.org/html/draft-pritikin-coap-bootstrap-01> and the email from Shahid https://ww=
w.ietf.org/mail-archive/web/ace/current/msg02029.html
The idea is to merge these into a single draft (already discussed among u=
s).

We would like to get feedback on the mailing list if indeed ACE would be =
a right place to continue this work as was perceived during the f2f meeti=
ng. Please respond if you support (or not) the activity going forward in =
ACE wg.

Kind Regards
Sandeep



________________________________
The information contained in this message may be confidential and legally=
 protected under applicable law. The message is intended solely for the a=
ddressee(s). If you are not the intended recipient, you are hereby notifi=
ed that any use, forwarding, dissemination, or reproduction of this messa=
ge is strictly prohibited and may be unlawful. If you are not the intende=
d recipient, please contact the sender by return e-mail and destroy all c=
opies of the original message.




_______________________________________________
Ace mailing list
Ace@ie=
tf.org
https://www.ietf.org/mailman/listinfo/ace

--------------EC00587B2BB6622561143DD3-- --EGiaC33XOoW4QaWXpj8XpshEwgjJBSu33-- --Htjnsm9cMueDcCpHwuN9wQbgGbiubWvgC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQEcBAEBCAAGBQJYMxDbAAoJEIe2a0bZ0nozuJsH/igGkpnXyY6o8+wlT8ptk6xY +ycXMmA7cI4t20WgXAZk73zM7qOfbGH3L7LgUOaOZnUqxhQ5yJx6MgFQKL3JbisW lzt8IBLefh8LHNbSbq2/KmFCQy15ARY/bidREfK2zEVP4j+SlVRnIOm6tC5uMRef b2yG0FNOI3bMeLudYlJj+pOms5wxghVqxR01CXltuu9uMGkSey2NkprFRqqc5tRm oC7pDtAp2iRa70Cdey1axf7sGLPb4x21TDaEaLUT86h5/zYV7htl43Ee85MKmCQK 76T6hjidqWRpYsTAxaX1z8q36gGd1TG3xb8YJgTDW8ucWdfAaEaVEiZcjdGP/YI= =wZ3E -----END PGP SIGNATURE----- --Htjnsm9cMueDcCpHwuN9wQbgGbiubWvgC-- From nobody Mon Nov 21 07:33:25 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C8BB1294EA for ; Mon, 21 Nov 2016 07:33:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.017 X-Spam-Level: X-Spam-Status: No, score=-16.017 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JD7UsrSrvvOq for ; Mon, 21 Nov 2016 07:33:22 -0800 (PST) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4CFD129696 for ; Mon, 21 Nov 2016 07:33:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8044; q=dns/txt; s=iport; t=1479742401; x=1480952001; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=SE5wI/aDe+kWxq3OVhJLBJcF8No16mVYhj2tqlnka08=; b=TflnVLBdrKrTm7Bqqx2VC7XBXjVbK1Gi1kDq/zu0T+RDhwZY/Rb/G8C9 ws73woz0jwHIKgiT10uYWWI7QC82WyYdF2ZahqYp/bKJ1LSpVpFKDIMck TE4XY4TaMEDrwFvSvO8mem04sWKgnmpQSAeZ0th8RrKg4Llk+8WnNT+zx 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D3AQCLEzNY/5ldJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgnNFAQEBAQEfWIEAB404lxOPT4UfggUohXkCggA/FAECAQEBAQEBAWI?= =?us-ascii?q?ohGgBAQEELUELEAIBCBEEAQEoBzIUCQgBAQQBDQUIiGUOrHaLUwEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBARcFhjyEWoQbEAIBUYUrBZpNAYZBii6Bd4R3iUCNX4QKAR4?= =?us-ascii?q?3XjQehSNyAYdEgQwBAQE?= X-IronPort-AV: E=Sophos;i="5.31,675,1473120000"; d="scan'208,217";a="176066691" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Nov 2016 15:32:57 +0000 Received: from XCH-RCD-010.cisco.com (xch-rcd-010.cisco.com [173.37.102.20]) by rcdn-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id uALFWvX7011581 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 21 Nov 2016 15:32:57 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-RCD-010.cisco.com (173.37.102.20) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 21 Nov 2016 09:32:56 -0600 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1210.000; Mon, 21 Nov 2016 09:32:56 -0600 From: "Panos Kampanakis (pkampana)" To: "Kumar, Sandeep" , "ace@ietf.org" Thread-Topic: EST over CoAP in ACE wg Thread-Index: AdJD/4dN3nkys8JpRuSDXvz8bQBVcAABV4QA Date: Mon, 21 Nov 2016 15:32:56 +0000 Message-ID: <0c8020c5de2042738704a6c8fc3d9778@XCH-ALN-010.cisco.com> References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.150.32.85] Content-Type: multipart/alternative; boundary="_000_0c8020c5de2042738704a6c8fc3d9778XCHALN010ciscocom_" MIME-Version: 1.0 Archived-At: Cc: Shahid Raza , "'consultancy@vanderstok.org'" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 15:33:24 -0000 --_000_0c8020c5de2042738704a6c8fc3d9778XCHALN010ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable +1 on ACE taking up this work. From: Kumar, Sandeep [mailto:sandeep.kumar@philips.com] Sent: Monday, November 21, 2016 9:00 AM To: ace@ietf.org Cc: 'consultancy@vanderstok.org' ; Panos Kampan= akis (pkampana) ; Shahid Raza Subject: EST over CoAP in ACE wg Dear ACE members Peter van Stok gave a short overview during the ACE f2f meeting on the work= related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-co= ap-est-00). = In the meeting there was general interest among the audience for the work a= nd ACE as the preferred WG for this item. There are additional drafts and w= ork on the same topic like the draft-pritikin-coap-bootstrap-01 and the email from Shahi= d https://www.ietf.org/mail-archive/web/ace/current/msg02029.html The idea is to merge these into a single draft (already discussed among us)= . We would like to get feedback on the mailing list if indeed ACE would be a = right place to continue this work as was perceived during the f2f meeting. = Please respond if you support (or not) the activity going forward in ACE wg= . Kind Regards Sandeep ________________________________ The information contained in this message may be confidential and legally p= rotected under applicable law. The message is intended solely for the addre= ssee(s). If you are not the intended recipient, you are hereby notified tha= t any use, forwarding, dissemination, or reproduction of this message is st= rictly prohibited and may be unlawful. If you are not the intended recipien= t, please contact the sender by return e-mail and destroy all copies of the= original message. --_000_0c8020c5de2042738704a6c8fc3d9778XCHALN010ciscocom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

+= 1 on ACE taking up this work.

=  

From: Kumar, Sandeep [mailto:sandeep.kumar@ph= ilips.com]
Sent: Monday, November 21, 2016 9:00 AM
To: ace@ietf.org
Cc: 'consultancy@vanderstok.org' <consultancy@vanderstok.org>;= Panos Kampanakis (pkampana) <pkampana@cisco.com>; Shahid Raza <sh= ahid@sics.se>
Subject: EST over CoAP in ACE wg

 

Dear ACE members

 =

Peter van Stok gave a sh= ort overview during the ACE f2f meeting on the work related to EST (RFC 703= 0) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00). In the meeting there was general interest among the audience for the work = and ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the draft-pritikin-coap-bootstrap-01 and t= he email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html=

The idea is to merge the= se into a single draft (already discussed among us).

 =

We would like to get fee= dback on the mailing list if indeed ACE would be a right place to continue = this work as was perceived during the f2f meeting. Please respond if you su= pport (or not) the activity going forward in ACE wg.

 =

Kind Regards<= /span>

Sandeep

 =

 

 

The information contained in this message m= ay be confidential and legally protected under applicable law. The message = is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forw= arding, dissemination, or reproduction of this message is strictly prohibit= ed and may be unlawful. If you are not the intended recipient, please conta= ct the sender by return e-mail and destroy all copies of the original message.

--_000_0c8020c5de2042738704a6c8fc3d9778XCHALN010ciscocom_-- From nobody Mon Nov 21 08:31:00 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3253F1296AF for ; Mon, 21 Nov 2016 08:30:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=erdtman-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JGtaxnbKhG3Q for ; Mon, 21 Nov 2016 08:30:51 -0800 (PST) Received: from mail-wm0-x233.google.com (mail-wm0-x233.google.com [IPv6:2a00:1450:400c:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F82C12963E for ; Mon, 21 Nov 2016 08:30:51 -0800 (PST) Received: by mail-wm0-x233.google.com with SMTP id f82so154677633wmf.1 for ; Mon, 21 Nov 2016 08:30:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erdtman-se.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IULcAwVxHsnWDxIxEq5JepeEgMqfuoe9WemLn+TfQ0c=; b=xWpYeXKPTWI+CjmJBNmuCjzvCajSZTSYPxmWKPXhod128anstMHrvrHhTmETbtXHwa rGGGcuEObiq0t7bsBR0btBfVk+5CH3nVg0C51AV53wjp5ANgsWX8GDzaUAJgYHIuZwcR pe7j3Pr21EcdwnVyLo9p4a5DTKFs36H3jPAl83vFfG5pq4XGm7z5gU3R+eOE5sBnB/q0 Szj0V1z69P0V69PI6flsDZQsMtEMffPrLkthbqy7Rd3pCTEYrekNBYEw1v8O83X6NInz iQTsidzSV0GMzlAvF6OzRrOwhFtVUWc4AEjuODQfrZYWSGzIno4PXNfEM1J3Jy4zB2V9 Z4Aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=IULcAwVxHsnWDxIxEq5JepeEgMqfuoe9WemLn+TfQ0c=; b=Flk0ri9AYg3KJYdhdwd8HscSJsHmlRgoH+POGhK31SSpPqXA0WhCYpRuLdD156ySDb N2+WjeMh1IsVXnEFIfiL1eTrzgtNF5QQ6+BoriE96/F/Ifiew0SJThGtBd0IMum7GCxV 5MqXFuGGHE0uQfQYAXW0SvsbUY1NxFfamvDfDB3uYsD4A+2yrCvANeAoc4a+iP5Uoqhi NktyBpyLmN5JHGqzxqb4yx1ez1cEi9NNHOqb9TX0Qv7Cq2kb8TCeYAg7R/g7pQEbuCFF VA3GtLGJYWcskLr95TAFQlFfEfTbUVGx/Az8uwOwlvow00RZ08SVva7KZk7lZ4xsypyI sohg== X-Gm-Message-State: AKaTC02UqiUYvQYASckxoE7XY+MC+FVOghneNt/XUNVGuotwx5BYdKViHNEC3pJ9tR57wGrV91r19DsQOis4/Q== X-Received: by 10.28.178.10 with SMTP id b10mr16934860wmf.83.1479745849954; Mon, 21 Nov 2016 08:30:49 -0800 (PST) MIME-Version: 1.0 Received: by 10.194.117.103 with HTTP; Mon, 21 Nov 2016 08:30:49 -0800 (PST) In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> From: Samuel Erdtman Date: Mon, 21 Nov 2016 17:30:49 +0100 Message-ID: To: "Kumar, Sandeep" Content-Type: multipart/alternative; boundary=001a1144513cbead910541d22d2f Archived-At: Cc: Shahid Raza , "Panos Kampanakis \(pkampana\)" , "consultancy@vanderstok.org" , "ace@ietf.org" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 16:30:58 -0000 --001a1144513cbead910541d22d2f Content-Type: text/plain; charset=UTF-8 Hi All, To run EST over DTLS and CoAP to address more constrained devices is not new to me, this was part of conversations that neXus (my previous employer) and SICS had about one and a half year ago. I would support this work. I think certificates makes sense for ACE because of the connection to existing security infrastructure. At neXus we did SCEP and CMP enrollment but when moving to more constrained devices it would make sense to move to use EST over CoAP and DTLS. In addition to being quite simple compared to SCEP and CMP, EST also support server side generated keys which could be a benefit for constrained devices. Not because the devices could not generate the key but in some case keys needs to be generated in trusted and certified hardware (FIPS, CC etc.) to "know" that keys are of good quality. //Samuel On Mon, Nov 21, 2016 at 3:00 PM, Kumar, Sandeep wrote: > Dear ACE members > > > > Peter van Stok gave a short overview during the ACE f2f meeting on the > work related to EST (RFC 7030) over DTLS secured CoAP ( > draft-vanderstok-core-coap-est-00 > ). In the > meeting there was general interest among the audience for the work and ACE > as the preferred WG for this item. There are additional drafts and work on > the same topic like the draft-pritikin-coap-bootstrap-01 > and the > email from Shahid https://www.ietf.org/mail-archive/web/ace/current/ > msg02029.html > > The idea is to merge these into a single draft (already discussed among > us). > > > > We would like to get feedback on the mailing list if indeed ACE would be a > right place to continue this work as was perceived during the f2f meeting. > Please respond if you support (or not) the activity going forward in ACE wg. > > > > Kind Regards > > Sandeep > > > > > > ------------------------------ > The information contained in this message may be confidential and legally > protected under applicable law. The message is intended solely for the > addressee(s). If you are not the intended recipient, you are hereby > notified that any use, forwarding, dissemination, or reproduction of this > message is strictly prohibited and may be unlawful. If you are not the > intended recipient, please contact the sender by return e-mail and destroy > all copies of the original message. > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > --001a1144513cbead910541d22d2f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi All,

To run EST over DTLS and Co= AP to address more constrained devices is not new to me, this was part of c= onversations that neXus (my previous employer) and SICS had about one and a= half year ago.

I would support this work. I think certif= icates makes sense for ACE because of the connection to existing security i= nfrastructure.

At neXus we did SCEP and CMP enrollment bu= t when moving to more constrained devices it would make sense to move to us= e EST over CoAP and DTLS.
In addition to being quite simple compared to= SCEP and CMP, EST also support server side generated keys which could be a= benefit for constrained devices. Not because the devices could not generat= e the key but in some case keys needs to be generated in trusted and certif= ied hardware (FIPS, CC etc.) to "know" that keys are of good qual= ity.

//Samuel



=



On Mon, Nov 21, 2016 at 3:00 PM, Kumar, Sandeep &= lt;sandeep.k= umar@philips.com> wrote:

Dear ACE members<= u>

=C2=A0

Peter van Stok gave a sh= ort overview during the ACE f2f meeting on the work related to EST (RFC 703= 0) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00). In the meeting there was general interest among the audience for the work = and ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the draft-pritikin-coap-bootstrap-01 and the email fro= m Shahid https://www.ietf.org/mail-archive/web/ace/current/<= wbr>msg02029.html

The idea is to merge the= se into a single draft (already discussed among us).

=C2=A0

We would like to get fee= dback on the mailing list if indeed ACE would be a right place to continue = this work as was perceived during the f2f meeting. Please respond if you su= pport (or not) the activity going forward in ACE wg.

=C2=A0

Kind Regards

Sandeep

=C2=A0

=C2=A0


The information contained in= this message may be confidential and legally protected under applicable la= w. The message is intended solely for the addressee(s). If you are not the = intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message i= s strictly prohibited and may be unlawful. If you are not the intended reci= pient, please contact the sender by return e-mail and destroy all copies of= the original message.

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--001a1144513cbead910541d22d2f-- From nobody Mon Nov 21 11:07:16 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5170D129B70 for ; Mon, 21 Nov 2016 11:07:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sics.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gU8gAkzeRnTZ for ; Mon, 21 Nov 2016 11:07:11 -0800 (PST) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com [IPv6:2a00:1450:400c:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9C86129665 for ; Mon, 21 Nov 2016 11:07:10 -0800 (PST) Received: by mail-wm0-x22a.google.com with SMTP id g23so164649020wme.1 for ; Mon, 21 Nov 2016 11:07:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sics.se; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=YodnX6ZU9wQX84UbTM7qj1u6wf2/MTKlFSscGjglcZg=; b=ZSYVsvOqVyWJUCqeSk2phc4vzoI1tVJgELoF9gidepIcr+pTppl+TejXTqk9/8mlkT jg6hWIOWEzRTYf+rFjRUZDCoBlpGrHzTU+7tD41hOKwD1zsKMYek9Zw7CNiYg+Vq7uGz JieLt55TbhMp+lzcqZYoiqe56JK+YyxdLksQIOdRhBikA1VXW+pqa/A//MAm5/RQfu9B qwGlj2mHs6ddJS7dJ9kIyTCNM8b9u+NUx/K/txTrdUq2bDhWGVVpy74iZqZWFswbibg8 PKVf3V+Dlnd53SWL8LCcZa31Ez6RHvayV5eBhPnfoZUx5bKmq+L0U9V+zJNbJ+ydFVJi Yleg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=YodnX6ZU9wQX84UbTM7qj1u6wf2/MTKlFSscGjglcZg=; b=KwGhebnXG3TXiBkSCNkor4SXW3GPiUhBcN7ZrYlmKCAL26Jty8kKn3XnREDja7CeRu l7A7w6IHtOtIN0TpsIC9P1fUavCubVRKAcuMWfmgczTm0W68fVf4C5uTD2p0R3UX5dQU HmHYpN2ZIye4zHeuOl5a+qamklvtilFR05ZqOB7z++L7jTMR27MZGeZx5PVLVQaHzp9r ixrNYUB8IYWIVc5lX110DELEDX3FI/GUqZZIlnRDnhwrFsuhPHnRb/Vv15j+qSYCf4RO u/7mWatdick2pR59wD7cQYo6W2EupQLzC92eSom9Btl+2t/4gLS4YDwe/Yv8TIu4UBSr IThg== X-Gm-Message-State: AKaTC015ih6/KEfh5seyYZRo0Np+21rtomqdsdgUuv8mESCAmjsUMRwbZs0KUyZz8rG2r40h X-Received: by 10.25.32.195 with SMTP id g186mr3664727lfg.157.1479755229367; Mon, 21 Nov 2016 11:07:09 -0800 (PST) Received: from [10.0.1.5] ([92.244.13.72]) by smtp.gmail.com with ESMTPSA id u12sm5555290lja.4.2016.11.21.11.06.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 21 Nov 2016 11:06:57 -0800 (PST) From: Shahid Raza Message-Id: <2066854B-4AC9-4EDA-B03E-855EA5135545@sics.se> Content-Type: multipart/alternative; boundary="Apple-Mail=_71DDE6F6-7337-44FE-AACE-E68B242AD437" Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) Date: Mon, 21 Nov 2016 20:06:54 +0100 In-Reply-To: To: Samuel Erdtman References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> X-Mailer: Apple Mail (2.3251) Archived-At: Cc: "Panos Kampanakis \(pkampana\)" , "Kumar, Sandeep" , "consultancy@vanderstok.org" , "ace@ietf.org" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Nov 2016 19:07:14 -0000 --Apple-Mail=_71DDE6F6-7337-44FE-AACE-E68B242AD437 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, Thanks for the initiative Sandeep. I fully support this.=20 As Samuel mentioned, SICS has been working with neXus on this solution = for more than a year now. We would be glad to bring in our experience = and would be happy to share our Contiki side and the SICSthSense side = (sense.sics.se ) implementations.=20 Regards, Shahid > On 21 Nov 2016, at 17:30, Samuel Erdtman wrote: >=20 > Hi All, >=20 > To run EST over DTLS and CoAP to address more constrained devices is = not new to me, this was part of conversations that neXus (my previous = employer) and SICS had about one and a half year ago. >=20 > I would support this work. I think certificates makes sense for ACE = because of the connection to existing security infrastructure. >=20 > At neXus we did SCEP and CMP enrollment but when moving to more = constrained devices it would make sense to move to use EST over CoAP and = DTLS.=20 > In addition to being quite simple compared to SCEP and CMP, EST also = support server side generated keys which could be a benefit for = constrained devices. Not because the devices could not generate the key = but in some case keys needs to be generated in trusted and certified = hardware (FIPS, CC etc.) to "know" that keys are of good quality. >=20 > //Samuel >=20 >=20 >=20 >=20 >=20 >=20 > On Mon, Nov 21, 2016 at 3:00 PM, Kumar, Sandeep = > wrote: > Dear ACE members >=20 > =20 >=20 > Peter van Stok gave a short overview during the ACE f2f meeting on the = work related to EST (RFC 7030) over DTLS secured CoAP = (draft-vanderstok-core-coap-est-00 = ). In the = meeting there was general interest among the audience for the work and = ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the draft-pritikin-coap-bootstrap-01 = and the = email from Shahid = https://www.ietf.org/mail-archive/web/ace/current/msg02029.html = > The idea is to merge these into a single draft (already discussed = among us). >=20 > =20 >=20 > We would like to get feedback on the mailing list if indeed ACE would = be a right place to continue this work as was perceived during the f2f = meeting. Please respond if you support (or not) the activity going = forward in ACE wg. >=20 > =20 >=20 > Kind Regards >=20 > Sandeep >=20 > =20 >=20 > =20 >=20 >=20 > The information contained in this message may be confidential and = legally protected under applicable law. The message is intended solely = for the addressee(s). If you are not the intended recipient, you are = hereby notified that any use, forwarding, dissemination, or reproduction = of this message is strictly prohibited and may be unlawful. If you are = not the intended recipient, please contact the sender by return e-mail = and destroy all copies of the original message. >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace = >=20 >=20 --Apple-Mail=_71DDE6F6-7337-44FE-AACE-E68B242AD437 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi,

Thanks = for the initiative Sandeep. I fully support this. 
As Samuel mentioned, SICS has been working with neXus on this = solution for more than a year now. We would be glad to bring in our = experience and would be happy to share our Contiki side and the = SICSthSense side (sense.sics.se) implementations. 

Regards,
Shahid


On 21 Nov 2016, at 17:30, Samuel Erdtman = <samuel@erdtman.se> wrote:

Hi All,

To run EST over DTLS and CoAP to address more = constrained devices is not new to me, this was part of conversations = that neXus (my previous employer) and SICS had about one and a half year = ago.

I would support = this work. I think certificates makes sense for ACE because of the = connection to existing security infrastructure.

At neXus we did SCEP and CMP enrollment = but when moving to more constrained devices it would make sense to move = to use EST over CoAP and DTLS.
In addition to being quite = simple compared to SCEP and CMP, EST also support server side generated = keys which could be a benefit for constrained devices. Not because the = devices could not generate the key but in some case keys needs to be = generated in trusted and certified hardware (FIPS, CC etc.) to "know" = that keys are of good quality.

//Samuel




On Mon, Nov 21, 2016 at 3:00 PM, = Kumar, Sandeep <sandeep.kumar@philips.com> wrote:

Dear ACE members

 

Peter van Stok gave a short overview during the ACE f2f = meeting on the work related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-coap-est-00). In the meeting there was general interest among the audience for the = work and ACE as the preferred WG for this item. There are additional = drafts and work on the same topic like the draft-pritikin-coap-bootstrap-01 and the email from Shahid https://www.ietf.org/mail-archive/web/ace/current/msg02029.html

The idea is to merge these into a single draft = (already discussed among us).

 

We would like to get feedback on the mailing list if indeed = ACE would be a right place to continue this work as was perceived during = the f2f meeting. Please respond if you support (or not) the activity = going forward in ACE wg.

 

Kind Regards

Sandeep

 

 


The = information contained in this message may be confidential and legally = protected under applicable law. The message is intended solely for the = addressee(s). If you are not the intended recipient, you are hereby = notified that any use, forwarding, dissemination, or reproduction of this = message is strictly prohibited and may be unlawful. If you are not the = intended recipient, please contact the sender by return e-mail and = destroy all copies of the original message.

_______________________________________________
Ace mailing list
Ace@ietf.org
= https://www.ietf.org/mailman/listinfo/ace



= --Apple-Mail=_71DDE6F6-7337-44FE-AACE-E68B242AD437-- From nobody Tue Nov 22 10:45:59 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA45D129B16 for ; Tue, 22 Nov 2016 10:45:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.018 X-Spam-Level: X-Spam-Status: No, score=-16.018 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rdxy-XU6_4I7 for ; Tue, 22 Nov 2016 10:45:55 -0800 (PST) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAA39129B07 for ; Tue, 22 Nov 2016 10:45:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11314; q=dns/txt; s=iport; t=1479840353; x=1481049953; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=ESxyoTDHGNDTclfEj5aeWmY7WVRbwPHUKsnwsAXY1BE=; b=bA/d0Xc4tLtUMRBrAfLkiM0awVgk8++Hi7r7bscTlOYgdHHNH0PMRlgG FRpB7G7lMicq+6/eEpS9MY+Y4SlBceKvQuqa3tQfIGY2Q2Frm4Oxml11i zIgtPeXnVXiPTxiVD08iUCkL8P/+atM8d/HF1nkunKVb7ESeIaOvD3ey8 w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CnAQDckTRY/5hdJa1aAxoBAQEBAgEBA?= =?us-ascii?q?QEIAQEBAYJzRQEBAQEBH1iBAQeNOZcZj06FH4IGHQEKhXkCghk/FAECAQEBAQE?= =?us-ascii?q?BAWIohGkBAQQBAQFrCxACAQg/BycLFBEBAQQOBQmIZA6yL4tQAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBHIg7CIJVhBsQAgE8JoJqgjAFmk4BhkaKNoFxhHeJRI1mhAs?= =?us-ascii?q?BHjdeNB6FI3IBhn6BDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.31,682,1473120000"; d="scan'208,217";a="351822241" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Nov 2016 18:45:52 +0000 Received: from XCH-RTP-010.cisco.com (xch-rtp-010.cisco.com [64.101.220.150]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id uAMIjqBq032009 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 22 Nov 2016 18:45:52 GMT Received: from xch-rtp-001.cisco.com (64.101.220.141) by XCH-RTP-010.cisco.com (64.101.220.150) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 22 Nov 2016 13:45:51 -0500 Received: from xch-rtp-001.cisco.com ([64.101.220.141]) by XCH-RTP-001.cisco.com ([64.101.220.141]) with mapi id 15.00.1210.000; Tue, 22 Nov 2016 13:45:51 -0500 From: "Brian Weis (bew)" To: "Kumar, Sandeep" Thread-Topic: [Ace] EST over CoAP in ACE wg Thread-Index: AdJD/4dN3nkys8JpRuSDXvz8bQBVcABGwRAA Date: Tue, 22 Nov 2016 18:45:51 +0000 Message-ID: References: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> In-Reply-To: <6525c5f0b6e040b683ccd9c43b1c5e2f@VI1PR9003MB0237.MGDPHG.emi.philips.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.41.33.249] Content-Type: multipart/alternative; boundary="_000_A4D5E6D2249646978F756E1DD39B709Eciscocom_" MIME-Version: 1.0 Archived-At: Cc: Shahid Raza , "Panos Kampanakis \(pkampana\)" , "consultancy@vanderstok.org" , "ace@ietf.org" Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 18:45:58 -0000 --_000_A4D5E6D2249646978F756E1DD39B709Eciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I support this work and it being done in ACE. Thanks, Brian On Nov 21, 2016, at 6:00 AM, Kumar, Sandeep > wrote: Dear ACE members Peter van Stok gave a short overview during the ACE f2f meeting on the work= related to EST (RFC 7030) over DTLS secured CoAP (draft-vanderstok-core-co= ap-est-00). = In the meeting there was general interest among the audience for the work a= nd ACE as the preferred WG for this item. There are additional drafts and w= ork on the same topic like the draft-pritikin-coap-bootstrap-01 and the email from Shahi= dhttps://www.ietf.org/mail-archive/web/ace/current/msg02029.html The idea is to merge these into a single draft (already discussed among us)= . We would like to get feedback on the mailing list if indeed ACE would be a = right place to continue this work as was perceived during the f2f meeting. = Please respond if you support (or not) the activity going forward in ACE wg= . Kind Regards Sandeep ________________________________ The information contained in this message may be confidential and legally p= rotected under applicable law. The message is intended solely for the addre= ssee(s). If you are not the intended recipient, you are hereby notified tha= t any use, forwarding, dissemination, or reproduction of this message is st= rictly prohibited and may be unlawful. If you are not the intended recipien= t, please contact the sender by return e-mail and destroy all copies of the= original message. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace -- Brian Weis Security, CSG, Cisco Systems Telephone: +1 408 526 4796 Email: bew@cisco.com --_000_A4D5E6D2249646978F756E1DD39B709Eciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable I support this work and it being done in ACE.

Thanks,
Brian

On Nov 21, 2016, at 6:00 AM, Kumar, Sandeep <sandeep.kumar@philips.com&= gt; wrote:

Dear ACE members
 
Peter van Stok gave a short overview during the= ACE f2f meeting on the work related to EST (RFC 7030) over DTLS secured Co= AP (draft-vanderstok-core-coap-est-00). In the meeting there was general interest among the audience for the work = and ACE as the preferred WG for this item. There are additional drafts and = work on the same topic like the = draft-pritikin-coap-bootstrap-01 and the email from Shahidhttps://www.ietf.org/mail-archive/web/ace/current/ms= g02029.html
The idea is to merge these into a single draft = (already discussed among us).
 
We would like to get feedback on the mailing li= st if indeed ACE would be a right place to continue this work as was percei= ved during the f2f meeting. Please respond if you support (or not) the acti= vity going forward in ACE wg.
 
Kind Regards
Sandeep
 
 

The information contained in this message may be confidential and legally prot= ected under applicable law. The message is intended solely for the addresse= e(s). If you are not the intended recipient, you are hereby notified that a= ny use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful= . If you are not the intended recipient, please contact the sender by retur= n e-mail and destroy all copies of the original message.
_______= ________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman= /listinfo/ace

-- 
Brian Weis
Security, CSG, Cisco Systems
Telephone: +1 408 526 4796
Email: bew@cisco.com

--_000_A4D5E6D2249646978F756E1DD39B709Eciscocom_-- From nobody Wed Nov 23 10:22:01 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFA58129A57 for ; Wed, 23 Nov 2016 10:22:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.196 X-Spam-Level: X-Spam-Status: No, score=-3.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jJ0HsWAwZv1Q for ; Wed, 23 Nov 2016 10:21:58 -0800 (PST) Received: from resqmta-po-11v.sys.comcast.net (resqmta-po-11v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3222B1296B9 for ; Wed, 23 Nov 2016 10:21:58 -0800 (PST) Received: from resomta-po-11v.sys.comcast.net ([96.114.154.235]) by resqmta-po-11v.sys.comcast.net with SMTP id 9cAFchziSEp5X9cBBcJzOX; Wed, 23 Nov 2016 18:21:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1479925317; bh=5Gf0pP5U/xJzj+VBD+Wsc0zPO6ot4jjyh4IwH1dTZEY=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=CxpAotngrPsq4WudcC2S/JlAP3nSFv19UcYqzc0uy8FcckUGdibM0pTpmMRUbqSU/ Odt6wUQnfTYs1Rg012MxScPjK8YTMIl4qloodyDtXAdhyLJWmW1+MlHGo/NTfW9VZK qKu4i5WG094WTdkRO/LxyXHZizbE1ETHXJ8XJq0KPqoe9nEBrNrJAVl6Mn2V3Zkauu Xyi8Swu3rIO5fNQoqpVEI7AfOG0LNwWvTuT1FeIAIJNjbRGCIqwXtitmxv65cqH8iL y+iSFR4uYbxqKeXH1NCNwY2VpZs3/96CUJjIUOCQ6OXdhvZ2E5g/fb0V8eXH+HPEex B7SFSeYFGQiOA== Received: from [192.168.1.115] ([68.83.216.245]) by resomta-po-11v.sys.comcast.net with SMTP id 9cBAcuAKKSUI09cBBcPF2x; Wed, 23 Nov 2016 18:21:57 +0000 To: kathleen.moriarty.ietf@gmail.com, Rene Struik References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> From: Michael StJohns Message-ID: <13b43f16-4867-6580-8275-a2bd0ecbae05@comcast.net> Date: Wed, 23 Nov 2016 13:21:58 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 In-Reply-To: <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> Content-Type: multipart/alternative; boundary="------------673F2D2AC01C8D701E1DEA08" X-CMAE-Envelope: MS4wfHkxAW/6+xTOQOO5VwlA004x2I6ZeWA3YkirfTj710yIZMu2OEMixRUWYAo7jr7xSmplC0/w8VbWmiy3M/ijlsUv3MIX8KjnkA5vfATUyINwl5e9MLTz 8HzyCGCm8OH8WFD+odqEbRhrUIyeZiHRsuyw7Aupk+mE6+XIIDz5ZBuFkIZeS7mJ2qpfRcFqLe4pNNBFaV7PmVA+7WvOlR3PWiMc0qQ7J9CUK6coJf1dEJMZ /Cp9geNmeW9oBeCkEfZgJA== Archived-At: Cc: ace@ietf.org Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 18:22:01 -0000 This is a multi-part message in MIME format. --------------673F2D2AC01C8D701E1DEA08 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 11/17/2016 7:00 PM, kathleen.moriarty.ietf@gmail.com wrote: > Is anyone willing to work on a draft to be ready in advance of the > Chicago meeting so we have a concrete proposal for asymmetric keys? I'm just catching up on old mail after getting over a cold. Mostly, this could be as simple as a two to four paragraph draft: 1) Use CORE section 5 for message formats. (e.g. public key signed messages) using one of several defined specific set of algorithms (e.g. sha256withecdsa and p256 or something smaller) chosen by the application. 2) The authentication bare public key is a configuration item for the end devices and placement is beyond the scope of this draft. 3) Tracking of a message ID from (1) to prevent command replay attacks. 4) Minimum numbers of controllers (e.g. public keys and actuation events or message ids) that an end system has to track. (2) could be folded into a draft about configuring end devices. A more complex model would be: 1) Place a root certificate on all end systems via configuration (also out of scope) 2) Describe the certification path algorithm (e.g. profile RFC5280) 3) Describe how the cert path certificates are carried in CORE section 5 messages. 4) plus 3 & 4 above. 5) plus how to operate in the presence of clock time. Unlike symmetric key systems, there really doesn't need to be a key management/agreement/transport protocol per se. It's all about a) what constitutes a valid message, and b) what do you do with the valid message once you get it. An application specific draft would include message formats for things included in a CORE section 5 message (e.g. the specific values for turning on and off lightbulbs or setting their hues or intensity), but that's not really an ACE thing per se. Mike > > Thanks, > Kathleen > > Please excuse typos, sent from handheld device > > On Nov 17, 2016, at 11:26 PM, Rene Struik > wrote: > >> Dear colleagues: >> >> Just a reminder re perceived technical hurdles for using signatures: >> a) time latency of signing: >> One can pre-compute ephemeral signing keys, so as to reduce online >> key computation to a few finite field multiplies. >> Please see my email to the list of July 26, 2016: >> https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 >> b): further speed-ups/tricks, etc: >> One can try and be smarter by clever implementations. >> Please see my email to the list of July 21, 2016: >> https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI >> >> This seems to take the time latency argument away. The only other >> technical hurdles I can see are >> (i) signature size {is 64B too much?}; >> (ii) cost of public key crypto implementations {quite some small, >> nifty designs out there (NaCl etc.}. >> >> As to (i) - one should view signature sizes in perspective: as an >> example, key sizes in the key pre-distribution scheme HIMMO (as >> promoted by Philips) has key sizes of 6.25 kB and up, according to >> Table 3 of the paper that massages parameters to thwart new attacks >> on their scheme, see http://eprint.iacr.org/2016/152. >> >> So, security arguments that favor asymmetric solutions aside, there >> also do not seem to be too many other objections that would hold in >> the world anno 2016 {except for "sunk investment" arguments", but >> that is a corporate mindset issue}. >> >> On 11/17/2016 12:50 AM, Michael StJohns wrote: >>> On 11/16/2016 9:08 AM, Kepeng Li wrote: >>>> >>>> Hello all, >>>> >>>> We had a long discussion about group communication security topic >>>> since the previous F2F meeting. >>>> >>>> Hannes and I have tried to make a summary about the discussion as >>>> follows: >>>> >>>> · The solution needs to define both, symmetric and an >>>> asymmetric group key solution. >>>> >>> >>> There is no case (absent hardware mitigation) in which a symmetric >>> group key solution can be made secure/safe and no one has made an >>> offer of proof that they can make it secure. I've asked >>> repeatedly - no one has come forward with more than "oh we can lock >>> the symmetric key stuff in a corner and make sure it isn't used for >>> anything important". >>> >>> >>> Given the recent attacks on the internet by IOT botnets, there is a >>> further consideration that should be undertaken - whether the >>> symmetric group key solution applied to 10s of 1000s of IOT devices >>> is an active threat to the rest of the internet (e.g. enabling DDOS, >>> cyber physical issues, etc)? >>> >>> The multiparty (group) symmetric key solution is only wanted for a >>> single corner of the solution space - low latency, no cost systems. >>> E.g. lightbulbs. Given there is a worked example of the insecurity >>> of multiparty symmetric key systems (e.g. the attack on the >>> symmetric signing key of the HUE lights), I'm unclear why anyone at >>> all would think that pursuing a known bad solution in the IETF is a >>> good idea. >>> >>>> · The security consideration section needs to explain under >>>> what circumstances what solution is appropriate. >>>> >>> >>> Security consideration sections generally only address the threat >>> *to* the system from security choices. In this case, symmetric key >>> group comms reduces down to the same security analysis you would use >>> with shared default passwords across 1000s of devices. An IOT >>> security consideration section in the future probably needs to >>> address the threat *FROM* the IOT solution to the broader internet. >>> >>> Mike >>> >>> >>>> If this is not accurate, please let us know. >>>> >>>> Kind Regards >>>> Kepeng & Hannes >>>> >>>> BTW: it is a pity that I can't attend this meeting due to personal >>>> reasons, and hope you all have a nice meeting in Seoul! >>>> >>>> >>>> >>>> _______________________________________________ >>>> Ace mailing list >>>> Ace@ietf.org >>>> https://www.ietf.org/mailman/listinfo/ace >>> >>> >>> >>> >>> _______________________________________________ >>> Ace mailing list >>> Ace@ietf.org >>> https://www.ietf.org/mailman/listinfo/ace >> >> >> -- >> email:rstruik.ext@gmail.com | Skype: rstruik >> cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace --------------673F2D2AC01C8D701E1DEA08 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 11/17/2016 7:00 PM, kathleen.moriarty.ietf@gmail.com wrote:
Is anyone willing to work on a draft to be ready in advance of the Chicago meeting so we have a concrete proposal for asymmetric keys?

I'm just catching up on old mail after getting over a cold.

Mostly, this could be as simple as a two to four paragraph draft:

1) Use CORE section 5 for message formats. (e.g. public key signed messages) using one of several defined specific set of algorithms (e.g. sha256withecdsa and p256 or something smaller) chosen by the application.
2) The authentication bare public key is a configuration item for the end devices and placement is beyond the scope of this draft.
3) Tracking of a message ID from (1) to prevent command replay attacks.
4) Minimum numbers of controllers (e.g. public keys and actuation events or message ids) that an end system has to track.

(2) could be folded into a draft about configuring end devices.

A more complex model would be:
1) Place a root certificate on all end systems via configuration (also out of scope)
2) Describe the certification path algorithm (e.g. profile RFC5280)
3) Describe how the cert path certificates are carried in CORE section 5 messages.
4) plus 3 & 4 above.
5) plus how to operate in the presence of clock time.



Unlike symmetric key systems, there really doesn't need to be a key management/agreement/transport protocol per se.  It's all about a) what constitutes a valid message, and b) what do you do with the valid message once you get it.

An application specific draft would include message formats for things included in a CORE section 5 message (e.g. the specific values for turning on and off lightbulbs or setting their hues or intensity), but that's not really an ACE thing per se.

Mike



Thanks,
Kathleen 

Please excuse typos, sent from handheld device 

On Nov 17, 2016, at 11:26 PM, Rene Struik <rstruik.ext@gmail.com> wrote:

Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:
On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".


Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.

·       The security consideration section needs to explain under what circumstances what solution is appropriate.


Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.

Mike


If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace





_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace



-- 
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--------------673F2D2AC01C8D701E1DEA08-- From nobody Thu Nov 24 06:10:11 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A838312960D for ; Thu, 24 Nov 2016 06:10:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.098 X-Spam-Level: X-Spam-Status: No, score=-4.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LPFFZnXNN9xC for ; Thu, 24 Nov 2016 06:10:08 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0C1F1293F2 for ; Thu, 24 Nov 2016 06:10:07 -0800 (PST) Received: from [172.16.254.118] ([80.92.114.246]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MEnjW-1byK823J4E-00Fzpj; Thu, 24 Nov 2016 15:09:44 +0100 To: Michael StJohns , ace@ietf.org References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> Date: Thu, 24 Nov 2016 15:09:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="RFXqaTdSAkWV6BTQEUsE4AU2LgwAAJX4T" X-Provags-ID: V03:K0:UmVdcAaJhuegtsjZErWuI26zvYoksMoyKazXoM/ejC5aBqvMRXa ScB/syEY+pAXrFY1QDVuKZjpki4wyp+CScq5/I+7Gplt15G8TVF7m97KZqNxKJT4beBRTpV jLZn69IOi/I+O2aeeesLnQALoXBpN/gYIzt4NeE38YOF4ODhJiaHwvzN4wyn5QK8smk1EfC pLiaVM+Kixi2IIdZIwlhg== X-UI-Out-Filterresults: notjunk:1;V01:K0:5kT+NL60Snw=:T0xd4I2a4czNcM4Oh1Tm5g Ai9AsvNQoI3pfegi3VKzrmfFzXi6whERxapoMyrm6xKUhKh60tXSFWWWOEpbnUd/xr17sS1kV 4YSXDOZaZ+2e5yu7x+Ff5C2VToyFhHgwjtmP81ygEeuXGM0DNQCnihGIgFjSqWnyF8FL45BH3 34t9sIXOudNKinsEPDj6ffu5lx+0BVL0kHIZe6dO5vn02ZG0i7eXcDngNjDodO6UzLq+p2puL SkjspsIgrtCGRe1PZza0L/OVaWSQUBumzXpkI31/IYFZDVvfv1urA5pe6n7wGrjiiHpCMyq3/ Kpum/Mw5OSblKdjMzfOxC+s4Sr2llEPdW4LalS9EhyUtybIJLHBlaV1Ymm4dwF55gMFcxMsBT Y2YhWfSFyNarCkfBLWAyPjPjpXjNcUeKGP1qIcbxxZ+FNHaj/zmd+WgTDFyGfPZ9CX4I5fH1F GFF7cX42T0LUElv4KMKqkqyyq0KXr8bxtdBrRAITy9mSiOIROH6lCHtdE8/96UNAGxXifkDLQ uk3N93poTu6GiL/C/c9BGhoXvov+zm1p/KhbwDcALpf/t8Xv8bzAGrStsjK70qVoEdAX9/FPx ABO3bE4sbjv0vTvdvX8JPXBGCYmqYxMJv5jmWLrwD2NG6LhrEbGdENzlAMdCB/JB7uNsMtnk6 krp+AHQpgSBe+gZHX+B6qW6X7mzNcsctkvFd4mowBgw0ic+oZy0OW7SVVmCBwMQc3BsIazQcQ CA9C1czj/y6RORIVQEVzWjippjNWJbI8eCW2T+xw4BDJI26iwD2DyhUrukJHraB8oqa0ed+oS NgnGA9E Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2016 14:10:09 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --RFXqaTdSAkWV6BTQEUsE4AU2LgwAAJX4T Content-Type: multipart/mixed; boundary="k0b8LgPWH7k71Ql8TAKKfh4Lmws8MHuU4"; protected-headers="v1" From: Hannes Tschofenig To: Michael StJohns , ace@ietf.org Message-ID: <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> In-Reply-To: <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> --k0b8LgPWH7k71Ql8TAKKfh4Lmws8MHuU4 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Mike On 11/17/2016 06:50 AM, Michael StJohns wrote: >=20 > There is no case (absent hardware mitigation) in which a symmetric grou= p > key solution can be made secure/safe and no one has made an offer of > proof that they can make it secure. I've asked repeatedly - no one > has come forward with more than "oh we can lock the symmetric key stuff= > in a corner and make sure it isn't used for anything important". Security is not a black and white thing. What has been clear is that any solution that was proposed for symmetric keys did not meet your expectation. >=20 >=20 > Given the recent attacks on the internet by IOT botnets, there is a > further consideration that should be undertaken - whether the symmetric= > group key solution applied to 10s of 1000s of IOT devices is an active > threat to the rest of the internet (e.g. enabling DDOS, cyber physical > issues, etc)? The recent attack was made possible because all devices were provisioned with the same password, which was publically known. What we are proposing here is a key distribution protocol where * each device is provisioned with unique keys (symmetric or asymmetric keys), * uses those keys to authenticated to the trusted third party (the KDC), and * then gets provisioned with temporary shared secrets for used with group communication (whereby non-persistent symmetric keys are used for different groups, keys change over time and where there is an authorization step before you can join a group). >=20 > The multiparty (group) symmetric key solution is only wanted for a > single corner of the solution space - low latency, no cost systems.=20 > E.g. lightbulbs. Given there is a worked example of the insecurity of > multiparty symmetric key systems (e.g. the attack on the symmetric > signing key of the HUE lights), I'm unclear why anyone at all would > think that pursuing a known bad solution in the IETF is a good idea. While the lighting sector is only one part of the IoT industry I think it is OK to standardize a solution for one industry that consists of different vendors. The hack against the HUE lightbulbs you are referring to was also different. The issue there was that the entire product series was using the same shared secret provisioned during manufacturing. What we are doing, however, is to utilize a key distribution protocol to dynamically create shared secrets. So, each device has unique keys to authenticate to the KDC and then gets group keys dynamically provisioned. Note that the security difference here is huge. I know that you are aware of the differences between the attacks and what we do in the ACE working group. Hence I am a bit disappointed that you are trying to make others in the group, who are less knowledgeable in security, believe that these attacks are actually related. Ciao Hannes --k0b8LgPWH7k71Ql8TAKKfh4Lmws8MHuU4-- --RFXqaTdSAkWV6BTQEUsE4AU2LgwAAJX4T Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYNvSmAAoJEGhJURNOOiAt2sQH/3lUYQjva6rhvEMBP/Y+tQzF eUKBAkixiIkdZfpkGgSEGeTgUoGaqJya/Xrv4j3ilFQbxBIKdWjOzMWWPLKHzIjH 0aaATXZTdZ+cCsURm2oiZ9y6CpIixW2ySAydnVB0CapriZMJwGabo+RGLp/pcvS5 rscculmHr1iT5dY2OuWVwlwWuzYWeZrVGWm2Xhu6o59ukbaAYygbgYzP8ywuq7D8 erAn4AHAAgyUgLWeWXcVSomrbCAx/oSBF4eymJt9ud0O/jWTO2/NIBxRd+NZsfOt rwLQDAw40I0wQe/vYTdJ8kjRQABSll6PJxVh43Jz/V7ghBCfRAZrJ0REOU0g/54= =0otZ -----END PGP SIGNATURE----- --RFXqaTdSAkWV6BTQEUsE4AU2LgwAAJX4T-- From nobody Thu Nov 24 06:22:50 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 127001293F2 for ; Thu, 24 Nov 2016 06:22:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K9Fpida4YT9P for ; Thu, 24 Nov 2016 06:22:47 -0800 (PST) Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 352231294DC for ; Thu, 24 Nov 2016 06:22:47 -0800 (PST) X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de Received: from submithost.informatik.uni-bremen.de (submithost.informatik.uni-bremen.de [134.102.201.11]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id uAOEMZwF029157; Thu, 24 Nov 2016 15:22:35 +0100 (CET) Received: from [192.168.217.102] (p5DC7E34C.dip0.t-ipconnect.de [93.199.227.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 3tPhHb355rz8Jn1; Thu, 24 Nov 2016 15:22:35 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) From: Carsten Bormann In-Reply-To: <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> Date: Thu, 24 Nov 2016 15:22:34 +0100 X-Mao-Original-Outgoing-Id: 501690154.672028-7c2413a0a4ca43a93941476d80ebb018 Content-Transfer-Encoding: quoted-printable Message-Id: <4277A904-9FD9-414F-A50E-164207CF83DA@tzi.org> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> To: Hannes Tschofenig X-Mailer: Apple Mail (2.3251) Archived-At: Cc: Michael StJohns , ace@ietf.org Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2016 14:22:49 -0000 On 24 Nov 2016, at 15:09, Hannes Tschofenig = wrote: >=20 > Security is not a black and white thing. +1 The discussion is very tiring. If we can have only military-level security in the IoT, then the real = world IoT will simply happen without benefitting from the Internet. I = still don=E2=80=99t wear a bullet-proof vest when giving my lectures, = and we need appropriate, usable security. Gr=C3=BC=C3=9Fe, Carsten From nobody Thu Nov 24 10:17:33 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D5F5129509 for ; Thu, 24 Nov 2016 10:17:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=technologynexus.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UKgPGuK-BaPg for ; Thu, 24 Nov 2016 10:17:29 -0800 (PST) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00112.outbound.protection.outlook.com [40.107.0.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD864129893 for ; Thu, 24 Nov 2016 10:17:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=technologynexus.onmicrosoft.com; s=selector1-nexusgroup-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=5jdx5Ix4z7nBu2Bnxn1C1BLckhixX5CJqhnWAoS4N8c=; b=bW+oDw8XwDSJRTveQqjmeb8ajw662n+YPfat2AmpiN7nHDJq+zmTulXIIKb65L6BfRL0/W78AmIjwwMvY+5lTvYoVBVBAxCtMxyv8RX8l38ka67OhLvBonon8q6FLFFAuFiX8OgC2WM/uFbmAMvLS0tuPgPxQ5XGG340/tsLdgM= Received: from VI1PR0201MB1886.eurprd02.prod.outlook.com (10.167.206.152) by VI1PR0201MB1886.eurprd02.prod.outlook.com (10.167.206.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.8; Thu, 24 Nov 2016 18:17:26 +0000 Received: from VI1PR0201MB1886.eurprd02.prod.outlook.com ([10.167.206.152]) by VI1PR0201MB1886.eurprd02.prod.outlook.com ([10.167.206.152]) with mapi id 15.01.0734.014; Thu, 24 Nov 2016 18:17:26 +0000 From: Martin Furuhed Nexus To: "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP in ACE wg Thread-Index: AQHSRn8C/WaJf3aGvk2tAA9Zggej7g== Date: Thu, 24 Nov 2016 18:17:25 +0000 Message-ID: Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=martin.furuhed@nexusgroup.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [83.241.229.132] x-microsoft-exchange-diagnostics: 1; VI1PR0201MB1886; 7:/0majNSL+yyoc0t4+PZHEcvA4A2rfhkqqApJDrA5Pp2/Y2jxGUcZA7NPdh5FOswjnEHMhGREczmVMAU3qt7h4r6Plx42sgVM2l4+EI+ZwuEinAdzqRsxAPUQClMw0zLIUnRGQ08dRiBdKfkiFPQgjnj79VVu3Q+6C+kRP7Y8ZWUJMA8r3DtNnq5UdcbH6EOX6C3Q2q/58Z2UhroASWtemtdPwxTbvLO5izqb3mcEZk6r6190ocyV/N2E4EgtrhbIVF1mi2oNTrjbUCB1DFbrmEUETYAohx+i2P5TZeUArm7ALrLgxg9p7zAwAtKKpOWrusQ6CqhZB+iMKC7Q9vd05BCWllMWKMScxfMZgP4SPvI= x-ms-office365-filtering-correlation-id: 1f4446bd-3c34-45bc-32ea-08d4149624cb x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:VI1PR0201MB1886; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6045199)(6060326)(6040361)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6061324)(6041248)(20161123562025)(20161123564025)(20161123555025)(2016111802025)(20161123558021)(20161123560025)(6043046); SRVR:VI1PR0201MB1886; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0201MB1886; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(199003)(189002)(53754006)(3280700002)(39380400001)(39410400001)(5640700001)(2351001)(77096005)(122556002)(101416001)(3660700001)(6116002)(33656002)(2906002)(8676002)(86362001)(54356999)(92566002)(2900100001)(450100001)(50986999)(106356001)(83716003)(5660300001)(82746002)(102836003)(105586002)(3846002)(106116001)(189998001)(6512003)(6916009)(6506003)(97736004)(8936002)(38730400001)(110136003)(81166006)(229853002)(36756003)(2501003)(68736007)(7846002)(1730700003)(81156014)(7736002)(66066001)(39390400001)(107886002)(39400400001)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR0201MB1886; H:VI1PR0201MB1886.eurprd02.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: nexusgroup.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CA8F9730844F47C7B0B57FB0EB93691Dnexusgroupcom_" MIME-Version: 1.0 X-OriginatorOrg: nexusgroup.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Nov 2016 18:17:25.8026 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 89f9cd6f-fab5-4f61-a85e-b1b24768f7f6 X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0201MB1886 Archived-At: Subject: Re: [Ace] EST over CoAP in ACE wg X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2016 18:17:32 -0000 --_000_CA8F9730844F47C7B0B57FB0EB93691Dnexusgroupcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQWxsLA0KDQpNeSBmaXJzdCBwb3N0IGFmdGVyIGpvaW5pbmcgdGhlIGxpc3QuDQoNCkFzIG1l bnRpb25lZCBieSBTaGFoaWQgYW5kIFNhbXVlbCwgTmV4dXMgR3JvdXAgYW5kIFNJQ1MgYmVnYW4g YSBqb2ludCBwcm9qZWN0IG92ZXIgYSB5ZWFyIGFnbyBmb3IgZW5hYmxpbmcgY29uc3RyYWluZWQg ZGV2aWNlcyBlbnJvbGwgZm9yIGNlcnRpZmljYXRlcyB1c2luZyBFU1Qgb3ZlciBDb0FQLg0KQSBz dGFuZGFyZCBFU1Qgc2VydmVyIGFkZC1vbiB3aWxsIHNvb24gYmUgcGFydCBvZiB0aGUgTmV4dXMg Q2VydGlmaWNhdGUgTWFuYWdlciBDQSBzb2Z0d2FyZS4gQWRkaXRpb25hbCBFU1QgQ29BUCBzZXJ2 ZXIgd29yayBpcyBub3cgZG9uZSBpbiBwYXJhbGxlbCB3aXRoIHRoZSB3b3JrIG9uIHRoZSBTSUNT IEVTVCBDb0FQIGNsaWVudC4gT3VyIGN1cnJlbnQgaW1wbGVtZW50YXRpb24gc2hhcmVzIG1hbnkg c2ltaWxhcml0aWVzIHRvIHRoZSBkcmFmdCwgYW5kIHRoZSBvYmplY3RpdmUgaXMgdG8gdXBkYXRl IGFuZCBhbGlnbiBvdXIgaW1wbGVtZW50YXRpb24gdG8gdGhlIGRyYWZ0IGdvaW5nIGZvcndhcmQu IFdlIHdvdWxkIGJlIGhhcHB5IHRvIGNvbnRyaWJ1dGUgZXhwZXJpZW5jZSB0b2dldGhlciB3aXRo IFNJQ1MgYmFzZWQgb24gb3VyIG9uZ29pbmcgd29yay4NCg0KS2luZCByZWdhcmRzLA0KTWFydGlu IEZ1cnVoZWQNClByb2R1Y3QgTWFuYWdlcg0KTmV4dXMgR3JvdXAsIFN3ZWRlbg0KDQo= --_000_CA8F9730844F47C7B0B57FB0EB93691Dnexusgroupcom_ Content-Type: text/html; charset="utf-8" Content-ID: <9C0608A9DBEE28448E392C8718346F00@eurprd02.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iUnVicmlrIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iTnlja2Vsb3JkIiBjb250 ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAx NSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAq Lw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToy IDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNt Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OkNhbGlicmk7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KYTpsaW5rLCBzcGFu Lk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxp bmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3 aW5kb3d0ZXh0O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6 dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjU5NS4wcHQgODQyLjBwdDsNCgltYXJnaW46NzAuODVwdCA3 MC44NXB0IDcwLjg1cHQgNzAuODVwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNl Y3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFu Zz0iU1YiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPkhpIEFsbCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TXkgZmlyc3QgcG9zdCBhZnRl ciBqb2luaW5nIHRoZSBsaXN0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BcyBtZW50aW9uZWQgYnkgU2hhaGlkIGFu ZCBTYW11ZWwsIE5leHVzIEdyb3VwIGFuZCBTSUNTIGJlZ2FuIGEgam9pbnQgcHJvamVjdCBvdmVy IGEgeWVhciBhZ28gZm9yIGVuYWJsaW5nIGNvbnN0cmFpbmVkIGRldmljZXMgZW5yb2xsIGZvciBj ZXJ0aWZpY2F0ZXMgdXNpbmcgRVNUIG92ZXIgQ29BUC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPkEgc3RhbmRhcmQgRVNUIHNlcnZlciBhZGQtb24gd2lsbCBzb29uIGJlIHBhcnQgb2Yg dGhlIE5leHVzIENlcnRpZmljYXRlIE1hbmFnZXIgQ0Egc29mdHdhcmUuIEFkZGl0aW9uYWwgRVNU IENvQVAgc2VydmVyIHdvcmsgaXMgbm93IGRvbmUgaW4gcGFyYWxsZWwgd2l0aCB0aGUgd29yayBv biB0aGUgU0lDUyBFU1QgQ29BUCBjbGllbnQuDQogT3VyIGN1cnJlbnQgaW1wbGVtZW50YXRpb24g c2hhcmVzIG1hbnkgc2ltaWxhcml0aWVzIHRvIHRoZSBkcmFmdCwgYW5kIHRoZSBvYmplY3RpdmUg aXMgdG8gdXBkYXRlIGFuZCBhbGlnbiBvdXIgaW1wbGVtZW50YXRpb24gdG8gdGhlIGRyYWZ0IGdv aW5nIGZvcndhcmQuIFdlIHdvdWxkIGJlIGhhcHB5IHRvIGNvbnRyaWJ1dGUgZXhwZXJpZW5jZSB0 b2dldGhlciB3aXRoIFNJQ1MgYmFzZWQgb24gb3VyIG9uZ29pbmcgd29yay48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ S2luZCByZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TWFydGluIEZ1cnVo ZWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlByb2R1Y3QgTWFuYWdlcjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+TmV4dXMgR3JvdXAsIFN3ZWRlbjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CA8F9730844F47C7B0B57FB0EB93691Dnexusgroupcom_-- From nobody Thu Nov 24 12:59:45 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54EFD129D11 for ; Thu, 24 Nov 2016 12:59:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.196 X-Spam-Level: X-Spam-Status: No, score=-4.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LwYkUvZ_-HJX for ; Thu, 24 Nov 2016 12:59:42 -0800 (PST) Received: from resqmta-ch2-09v.sys.comcast.net (resqmta-ch2-09v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13096129B5F for ; Thu, 24 Nov 2016 12:59:41 -0800 (PST) Received: from resomta-ch2-11v.sys.comcast.net ([69.252.207.107]) by resqmta-ch2-09v.sys.comcast.net with SMTP id A179cUQW61XXBA17McUDba; Thu, 24 Nov 2016 20:59:40 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1480021180; bh=tyw0ETgTnPRP4l5Qpqbne6PDxhv7CPFAwt6SWpa3X7A=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=OfjWSZWZOdKFCCyY+3CcfUNKgjBdRh4upU4oGLXAl8LTmKp/FR5DEHNzrXdvl7HFX 1FWDMUMutb+rv3xLWLJwOOFj8+mqaK9oe2k+H/21Y/6FFGfh3q9KZCUD6vyQQ7Ne7I mFI9w5U9SPvXku/k+ypelZFibCbgFs6jdo7h5QBqI2sPDdZyhlA7BxYfXa4V1oCAZa 58wLlyV0SiFt0To7a+BVgbWbUo9p51VgMKbcq4CBzuRmedwIJa+pJYABRnft6pPyVT RHxCBeltnD+sAItfuDlNR8C9cBJW65dOVk9npb/ixVGodX42LCVCTvmXMGlVYjgVkV 276APofQChL9w== Received: from [192.168.1.113] ([68.83.216.245]) by resomta-ch2-11v.sys.comcast.net with SMTP id A17LctZz6p8yfA17LcFHec; Thu, 24 Nov 2016 20:59:40 +0000 To: ace@ietf.org References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> From: Michael StJohns Message-ID: <2c74a51f-ea9c-5f42-e1a5-2b219c596699@comcast.net> Date: Thu, 24 Nov 2016 15:59:42 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 In-Reply-To: <2ef1d615-bf44-9be4-3f56-17a7510e7b06@gmx.net> Content-Type: multipart/alternative; boundary="------------ABA4E3A3CE1D162ACC1876E8" X-CMAE-Envelope: MS4wfHklsjTxHCle8LQ+QaBhYtJxngsp8xJngoJldtwEGsjhznQE0p9MQMCtHS+b3hZAJs8AVrHyBCUddbXq6PbdMq9RWPmzr0qBbscMN37oDHqMU45XPE5M We40JcieuefSqmJ0TMEfM3khaScFv4sEho6DE6Z7zYgLTwnFwk45zx2S Archived-At: Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2016 20:59:44 -0000 This is a multi-part message in MIME format. --------------ABA4E3A3CE1D162ACC1876E8 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Comments inline. Also see particularly, the comments underlined and in bold. On 11/24/2016 9:09 AM, Hannes Tschofenig wrote: > Hi Mike > > On 11/17/2016 06:50 AM, Michael StJohns wrote: >> There is no case (absent hardware mitigation) in which a symmetric group >> key solution can be made secure/safe and no one has made an offer of >> proof that they can make it secure. I've asked repeatedly - no one >> has come forward with more than "oh we can lock the symmetric key stuff >> in a corner and make sure it isn't used for anything important". > Security is not a black and white thing. What has been clear is that any > solution that was proposed for symmetric keys did not meet your > expectation. This is a fairly null-value and disingenuous statement, _*but it helped me realize that you (plural) haven't actually stated any security requirements for a group control system protocol*_. What you have stated are constraints (low cost, low latency) that you believe inform the choice of security solutions - but these are NOT security requirements. Unfortunately, without stating your actual security requirements, its difficult for you to realize that the solution intersection of your constraints with any reasonable security requirements is probably the empty set. The analysis of whether a particular solution meets or exceeds the requirements for the system *is* actually a pretty black and white thing - it involves physics, math, cryptography and probability and an analysis of threats vs strengths. So let me put forth what I believe is a reasonable minimum security requirement for this group control system: "Compromise of a single device shall not result in an attacker having more privileges that nominally are assigned to that device." or less nuanced: "Compromise of a single device shall not result in the compromise of the entire system." Now you can put forth your minimum security requirements and we can decide as a group if those minimums are acceptable, and then figure out if your proposed solutions meet the requirements in any meaningful manner. > >> >> Given the recent attacks on the internet by IOT botnets, there is a >> further consideration that should be undertaken - whether the symmetric >> group key solution applied to 10s of 1000s of IOT devices is an active >> threat to the rest of the internet (e.g. enabling DDOS, cyber physical >> issues, etc)? > The recent attack was made possible because all devices were provisioned > with the same password, which was publically known. Seriously? If you'd had 10,000 devices with the same password, but that the password wasn't known to anyone at manufacture, the result wouldn't have been any different. The attacker would have grabbed one of the devices, and extracted the password and controlled 10K devices. Alternately, buy 10k devices, set an identical new password on each of them and deploy. Same result. > > What we are proposing here is a key distribution protocol where > * each device is provisioned with unique keys (symmetric or asymmetric > keys), > * uses those keys to authenticated to the trusted third party (the KDC), > and > * then gets provisioned with temporary shared secrets for used with > group communication (whereby non-persistent symmetric keys are used for > different groups, keys change over time and where there is an > authorization step before you can join a group). Again, 1) compromise a device, 2) have it pass on any symmetric key it is given to an attacker. 3) Attacker controls the system. Lather, rinse, repeat. It *DOES NOT MATTER* how the symmetric keys get to the device,_*it only matters that more than two devices at time T share the same symmetric key and the attacker can get to one of those devices.*__* *_ > > >> The multiparty (group) symmetric key solution is only wanted for a >> single corner of the solution space - low latency, no cost systems. >> E.g. lightbulbs. Given there is a worked example of the insecurity of >> multiparty symmetric key systems (e.g. the attack on the symmetric >> signing key of the HUE lights), I'm unclear why anyone at all would >> think that pursuing a known bad solution in the IETF is a good idea. > While the lighting sector is only one part of the IoT industry I think > it is OK to standardize a solution for one industry that consists of > different vendors. > > The hack against the HUE lightbulbs you are referring to was also > different. The issue there was that the entire product series was using > the same shared secret provisioned during manufacturing. They were using the same shared symmetric firmware signing/encrypting key. Which allowed an attacker to create "valid" firmware and use a zigbee stack flaw to cause it to be loaded. Again - a symmetric key shared between more than two entities led to a fatal flaw in the system. > What we are > doing, however, is to utilize a key distribution protocol to dynamically > create shared secrets. So, each device has unique keys to authenticate > to the KDC and then gets group keys dynamically provisioned. Note that > the security difference here is huge. No, it's actually not and no reasonable cryptographic protocol designer would say otherwise. > > I know that you are aware of the differences between the attacks and > what we do in the ACE working group. Hence I am a bit disappointed that > you are trying to make others in the group, who are less knowledgeable > in security, believe that these attacks are actually related. And I'm a bit disappointed that you're trying to claim that the attacks are not. I'm also a bit disappointed about the personal attack - but that's irrelevant to the discussion. The only difference between the HUE attack and attacking a multi-party symmetric key system is where and how you get the group key (or signing key). In general, in both, attack a single device and you can extract the multi-party shared secret. In terms of threat analysis they are exactly the same order of attack: Compromise one device, compromise the system that the device belongs to. In the HUE attack all the HUE devices belonged to the same firmware system. In an attack on group symmetric key multicast, all the devices belong to the same multicast group. The details for the attacks may differ. The actual impacts to a successful attacks may differ (re-writing firmware vs turning on and off things), but the security analysis are exactly the same. Mike > > Ciao > Hannes > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --------------ABA4E3A3CE1D162ACC1876E8 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
Comments inline. Also see particularly, the comments underlined and in bold.

On 11/24/2016 9:09 AM, Hannes Tschofenig wrote:
Hi Mike

On 11/17/2016 06:50 AM, Michael StJohns wrote:

There is no case (absent hardware mitigation) in which a symmetric group
key solution can be made secure/safe and no one has made an offer of
proof that they can make it secure.    I've asked repeatedly - no one
has come forward with more than "oh we can lock the symmetric key stuff
in a corner and make sure it isn't used for anything important".

Security is not a black and white thing. What has been clear is that any
solution that was proposed for symmetric keys did not meet your
expectation.

This is a fairly null-value and disingenuous statement, but it helped me realize that you (plural) haven't actually stated any security requirements for a group  control system protocol.  What you have stated are constraints (low cost, low latency) that you believe inform the choice of security solutions - but these are NOT security requirements.   Unfortunately, without stating your actual security requirements, its difficult for you to realize that the solution intersection of your constraints with any reasonable security requirements is probably the empty set.

The analysis of whether a particular solution meets or exceeds the requirements for the system *is* actually a pretty black and white thing - it involves physics, math, cryptography and probability and an analysis of threats vs strengths.

So let me put forth what I believe is a reasonable minimum security requirement for this group control system:

"Compromise of a single device shall not result in an attacker having more privileges that nominally are assigned to that device."  or less nuanced: "Compromise of a single device shall not result in the compromise of the entire system."

Now you can put forth your minimum security requirements and we can decide as a group if those minimums are acceptable, and then figure out if your proposed solutions meet the requirements in any meaningful manner.








Given the recent attacks on the internet by IOT botnets, there is a
further consideration that should be undertaken - whether the symmetric
group key solution applied to 10s of 1000s of IOT devices is an active
threat to the rest of the internet (e.g. enabling DDOS, cyber physical
issues, etc)?

The recent attack was made possible because all devices were provisioned
with the same password, which was publically known.

Seriously?   If you'd had 10,000 devices with the same password, but that the password wasn't known to anyone at manufacture, the result wouldn't have been any different.  The attacker would have grabbed one of the devices, and extracted the password and controlled 10K devices.    Alternately, buy 10k devices, set an identical new password on each of them and deploy.  Same result.


What we are proposing here is a key distribution protocol where
* each device is provisioned with unique keys (symmetric or asymmetric
keys),
* uses those keys to authenticated to the trusted third party (the KDC),
and
* then gets provisioned with temporary shared secrets for used with
group communication (whereby non-persistent symmetric keys are used for
different groups, keys change over time and where there is an
authorization step before you can join a group).

Again, 1) compromise a device, 2) have it pass on any symmetric key it is given to an attacker. 3) Attacker controls the system.  Lather, rinse, repeat.  It *DOES NOT MATTER* how the symmetric keys get to the device, it only matters that more than two devices at time T share the same symmetric key and the attacker can get to one of those devices.




The multiparty (group) symmetric key solution is only wanted for a
single corner of the solution space - low latency, no cost systems. 
E.g. lightbulbs.  Given there is a worked example of the insecurity of
multiparty symmetric key systems (e.g. the attack on the symmetric
signing key of the HUE lights), I'm unclear why anyone at all would
think that pursuing a known bad solution in the IETF is a good idea.

While the lighting sector is only one part of the IoT industry I think
it is OK to standardize a solution for one industry that consists of
different vendors.

The hack against the HUE lightbulbs you are referring to was also
different. The issue there was that the entire product series was using
the same shared secret provisioned during manufacturing.
They were using the same shared symmetric firmware signing/encrypting key.  Which allowed an attacker to create "valid" firmware and use a zigbee stack flaw to cause it to be loaded.

Again - a symmetric key shared between more than two entities led to a fatal flaw in the system.

What we are
doing, however, is to utilize a key distribution protocol to dynamically
create shared secrets. So, each device has unique keys to authenticate
to the KDC and then gets group keys dynamically provisioned. Note that
the security difference here is huge.

No, it's actually not and no reasonable cryptographic protocol designer would say otherwise.


I know that you are aware of the differences between the attacks and
what we do in the ACE working group. Hence I am a bit disappointed that
you are trying to make others in the group, who are less knowledgeable
in security, believe that these attacks are actually related.

And I'm a bit disappointed that you're trying to claim that the attacks are not. I'm also a bit disappointed about the personal attack - but that's irrelevant to the discussion. The only difference between the HUE attack and attacking a multi-party symmetric key system is where and how you get the group key (or signing key).    In general, in both, attack a single device and you can extract the multi-party shared secret.

In terms of threat analysis they are exactly the same order of attack:  Compromise one device, compromise the system that the device belongs to.  In the HUE attack all the HUE devices belonged to the same firmware system.  In an attack on group symmetric key multicast, all the devices belong to the same  multicast group.

The details for the attacks may differ.  The actual impacts to a successful attacks may differ (re-writing firmware vs turning on and off things), but the security analysis are exactly the same.

Mike



Ciao
Hannes




_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--------------ABA4E3A3CE1D162ACC1876E8-- From nobody Fri Nov 25 07:57:16 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B61A129702 for ; Fri, 25 Nov 2016 07:57:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.096 X-Spam-Level: X-Spam-Status: No, score=-1.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793, T_KAM_HTML_FONT_INVALID=0.01] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R8TGWwPnD7qy for ; Fri, 25 Nov 2016 07:57:11 -0800 (PST) Received: from smtp-in1.interdigital.com (unknown [68.168.94.174]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 590A9129951 for ; Fri, 25 Nov 2016 07:52:30 -0800 (PST) X-ASG-Debug-ID: 1480089147-06daaa59a058d40001-Yzt3Th Received: from NALENITE.InterDigital.com (nalenite.interdigital.com [10.2.64.253]) by smtp-in1.interdigital.com with ESMTP id Gl3qsHJaV5B5OCV9 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 25 Nov 2016 10:52:27 -0500 (EST) X-Barracuda-Envelope-From: Akbar.Rahman@InterDigital.com Received: from NABESITE.InterDigital.com ([fe80::4d8a:a889:67c2:f009]) by NALENITE.InterDigital.com ([::1]) with mapi id 14.03.0319.002; Fri, 25 Nov 2016 10:52:27 -0500 From: "Rahman, Akbar" To: Michael StJohns Thread-Topic: [Ace] Summary of ACE Group Communication Security Discussion X-ASG-Orig-Subj: RE: [Ace] Summary of ACE Group Communication Security Discussion Thread-Index: AQHSF95PoSzskKrErky7EMGDViWDUqCL4KQAgAAWPICAADVyAIBKWy+AgAA5GQCABTWaYIABWr8AgACQUQCAAKBXgIAJD24AgAKkLKA= Date: Fri, 25 Nov 2016 15:52:26 +0000 Message-ID: <36F5869FE31AB24485E5E3222C288E1F6DCA095E@NABESITE.InterDigital.com> References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> <13b43f16-4867-6580-8275-a2bd0ecbae05@comcast.net> In-Reply-To: <13b43f16-4867-6580-8275-a2bd0ecbae05@comcast.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.3.2.26] x-exclaimer-md-config: bb79a19d-f711-475c-a0f9-4d93b71c94dd Content-Type: multipart/alternative; boundary="_000_36F5869FE31AB24485E5E3222C288E1F6DCA095ENABESITEInterDi_" MIME-Version: 1.0 X-Barracuda-Connect: nalenite.interdigital.com[10.2.64.253] X-Barracuda-Start-Time: 1480089147 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA X-Barracuda-URL: https://10.1.245.3:443/cgi-mod/mark.cgi X-Barracuda-Scan-Msg-Size: 21728 X-Virus-Scanned: by bsmtpd at interdigital.com X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_SC0_MISMATCH_TO, BSF_SC5_SA210e, HTML_MESSAGE X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.34725 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 BSF_SC0_MISMATCH_TO Envelope rcpt doesn't match header 0.00 HTML_MESSAGE BODY: HTML included in message 0.00 BSF_SC5_SA210e Custom Rule SA210e Archived-At: Cc: "kathleen.moriarty.ietf@gmail.com" , Rene Struik , "ace@ietf.org" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Nov 2016 15:57:15 -0000 --_000_36F5869FE31AB24485E5E3222C288E1F6DCA095ENABESITEInterDi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWlrZSwNCg0KDQpUaGFua3MgZm9yIHBvaW50aW5nIG91dCBhbGwgdGhlIGlzc3VlcyB3aXRo IGEgc3ltbWV0cmljIGtleSBhcHByb2FjaCB0byBncm91cCBjb21tdW5pY2F0aW9uLiAgSG93ZXZl ciwgY2FuIHlvdSBhbHNvIGdpdmUgYW55IHRob3VnaHRzIG9uIHRoZSBzcGVjaWZpYyB2dWxuZXJh YmlsaXR5IHRvIHRoZSBDQSBhbmQgY2VydGlmaWNhdGVzIGluIHRoZSBhc3ltbWV0cmljIGtleSBh cHByb2FjaCBmb3IgSW9UPyAgQWZ0ZXIgYWxsLCB0aGVyZSBoYXMgYmVlbiBzb21lIHdlbGwta25v d24gYXR0YWNrcyBvbiBQS0kgaW5mcmFzdHJ1Y3R1cmUgaW4gdGhlIGxhc3QgZmV3IHllYXJzIHN1 Y2ggYXM6DQoNCmh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL0RpZ2lOb3RhciNJc3N1YW5j ZV9vZl9mcmF1ZHVsZW50X2NlcnRpZmljYXRlcw0KDQoNCkRvIHlvdSB0aGluayBpdCB3aWxsIGJl IGJldHRlciBvciB3b3JzZSBpZiBJb1QgaW5mcmFzdHJ1Y3R1cmUgc3RhcnQgdXNpbmcgY2VydGlm aWNhdGVzIG9uIGEgbWFzc2l2ZSBzY2FsZT8gIE9yIGlzIGl0IG91dHNpZGUgdGhlIHNjb3BlIG9m IElFVEYgc3RhbmRhcmRzIGFuZCBtb3JlIG9mIGEgZGVwbG95bWVudCBhbmQgb3BlcmF0aW9uYWwg aXNzdWU/DQoNCg0KL0FrYmFyDQoNCg0KRnJvbTogQWNlIFttYWlsdG86YWNlLWJvdW5jZXNAaWV0 Zi5vcmddIE9uIEJlaGFsZiBPZiBNaWNoYWVsIFN0Sm9obnMNClNlbnQ6IFdlZG5lc2RheSwgTm92 ZW1iZXIgMjMsIDIwMTYgMToyMiBQTQ0KVG86IGthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwu Y29tOyBSZW5lIFN0cnVpayA8cnN0cnVpay5leHRAZ21haWwuY29tPg0KQ2M6IGFjZUBpZXRmLm9y Zw0KU3ViamVjdDogUmU6IFtBY2VdIFN1bW1hcnkgb2YgQUNFIEdyb3VwIENvbW11bmljYXRpb24g U2VjdXJpdHkgRGlzY3Vzc2lvbg0KDQpPbiAxMS8xNy8yMDE2IDc6MDAgUE0sIGthdGhsZWVuLm1v cmlhcnR5LmlldGZAZ21haWwuY29tPG1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWls LmNvbT4gd3JvdGU6DQpJcyBhbnlvbmUgd2lsbGluZyB0byB3b3JrIG9uIGEgZHJhZnQgdG8gYmUg cmVhZHkgaW4gYWR2YW5jZSBvZiB0aGUgQ2hpY2FnbyBtZWV0aW5nIHNvIHdlIGhhdmUgYSBjb25j cmV0ZSBwcm9wb3NhbCBmb3IgYXN5bW1ldHJpYyBrZXlzPw0KDQpJJ20ganVzdCBjYXRjaGluZyB1 cCBvbiBvbGQgbWFpbCBhZnRlciBnZXR0aW5nIG92ZXIgYSBjb2xkLg0KDQpNb3N0bHksIHRoaXMg Y291bGQgYmUgYXMgc2ltcGxlIGFzIGEgdHdvIHRvIGZvdXIgcGFyYWdyYXBoIGRyYWZ0Og0KDQox KSBVc2UgQ09SRSBzZWN0aW9uIDUgZm9yIG1lc3NhZ2UgZm9ybWF0cy4gKGUuZy4gcHVibGljIGtl eSBzaWduZWQgbWVzc2FnZXMpIHVzaW5nIG9uZSBvZiBzZXZlcmFsIGRlZmluZWQgc3BlY2lmaWMg c2V0IG9mIGFsZ29yaXRobXMgKGUuZy4gc2hhMjU2d2l0aGVjZHNhIGFuZCBwMjU2IG9yIHNvbWV0 aGluZyBzbWFsbGVyKSBjaG9zZW4gYnkgdGhlIGFwcGxpY2F0aW9uLg0KMikgVGhlIGF1dGhlbnRp Y2F0aW9uIGJhcmUgcHVibGljIGtleSBpcyBhIGNvbmZpZ3VyYXRpb24gaXRlbSBmb3IgdGhlIGVu ZCBkZXZpY2VzIGFuZCBwbGFjZW1lbnQgaXMgYmV5b25kIHRoZSBzY29wZSBvZiB0aGlzIGRyYWZ0 Lg0KMykgVHJhY2tpbmcgb2YgYSBtZXNzYWdlIElEIGZyb20gKDEpIHRvIHByZXZlbnQgY29tbWFu ZCByZXBsYXkgYXR0YWNrcy4NCjQpIE1pbmltdW0gbnVtYmVycyBvZiBjb250cm9sbGVycyAoZS5n LiBwdWJsaWMga2V5cyBhbmQgYWN0dWF0aW9uIGV2ZW50cyBvciBtZXNzYWdlIGlkcykgdGhhdCBh biBlbmQgc3lzdGVtIGhhcyB0byB0cmFjay4NCg0KKDIpIGNvdWxkIGJlIGZvbGRlZCBpbnRvIGEg ZHJhZnQgYWJvdXQgY29uZmlndXJpbmcgZW5kIGRldmljZXMuDQoNCkEgbW9yZSBjb21wbGV4IG1v ZGVsIHdvdWxkIGJlOg0KMSkgUGxhY2UgYSByb290IGNlcnRpZmljYXRlIG9uIGFsbCBlbmQgc3lz dGVtcyB2aWEgY29uZmlndXJhdGlvbiAoYWxzbyBvdXQgb2Ygc2NvcGUpDQoyKSBEZXNjcmliZSB0 aGUgY2VydGlmaWNhdGlvbiBwYXRoIGFsZ29yaXRobSAoZS5nLiBwcm9maWxlIFJGQzUyODApDQoz KSBEZXNjcmliZSBob3cgdGhlIGNlcnQgcGF0aCBjZXJ0aWZpY2F0ZXMgYXJlIGNhcnJpZWQgaW4g Q09SRSBzZWN0aW9uIDUgbWVzc2FnZXMuDQo0KSBwbHVzIDMgJiA0IGFib3ZlLg0KNSkgcGx1cyBo b3cgdG8gb3BlcmF0ZSBpbiB0aGUgcHJlc2VuY2Ugb2YgY2xvY2sgdGltZS4NCg0KDQoNClVubGlr ZSBzeW1tZXRyaWMga2V5IHN5c3RlbXMsIHRoZXJlIHJlYWxseSBkb2Vzbid0IG5lZWQgdG8gYmUg YSBrZXkgbWFuYWdlbWVudC9hZ3JlZW1lbnQvdHJhbnNwb3J0IHByb3RvY29sIHBlciBzZS4gIEl0 J3MgYWxsIGFib3V0IGEpIHdoYXQgY29uc3RpdHV0ZXMgYSB2YWxpZCBtZXNzYWdlLCBhbmQgYikg d2hhdCBkbyB5b3UgZG8gd2l0aCB0aGUgdmFsaWQgbWVzc2FnZSBvbmNlIHlvdSBnZXQgaXQuDQoN CkFuIGFwcGxpY2F0aW9uIHNwZWNpZmljIGRyYWZ0IHdvdWxkIGluY2x1ZGUgbWVzc2FnZSBmb3Jt YXRzIGZvciB0aGluZ3MgaW5jbHVkZWQgaW4gYSBDT1JFIHNlY3Rpb24gNSBtZXNzYWdlIChlLmcu IHRoZSBzcGVjaWZpYyB2YWx1ZXMgZm9yIHR1cm5pbmcgb24gYW5kIG9mZiBsaWdodGJ1bGJzIG9y IHNldHRpbmcgdGhlaXIgaHVlcyBvciBpbnRlbnNpdHkpLCBidXQgdGhhdCdzIG5vdCByZWFsbHkg YW4gQUNFIHRoaW5nIHBlciBzZS4NCg0KTWlrZQ0KDQoNCg0KDQpUaGFua3MsDQpLYXRobGVlbg0K DQpQbGVhc2UgZXhjdXNlIHR5cG9zLCBzZW50IGZyb20gaGFuZGhlbGQgZGV2aWNlDQoNCk9uIE5v diAxNywgMjAxNiwgYXQgMTE6MjYgUE0sIFJlbmUgU3RydWlrIDxyc3RydWlrLmV4dEBnbWFpbC5j b208bWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbT4+IHdyb3RlOg0KRGVhciBjb2xsZWFndWVz Og0KDQpKdXN0IGEgcmVtaW5kZXIgcmUgcGVyY2VpdmVkIHRlY2huaWNhbCBodXJkbGVzIGZvciB1 c2luZyBzaWduYXR1cmVzOg0KYSkgdGltZSBsYXRlbmN5IG9mIHNpZ25pbmc6DQpPbmUgY2FuIHBy ZS1jb21wdXRlIGVwaGVtZXJhbCBzaWduaW5nIGtleXMsIHNvIGFzIHRvIHJlZHVjZSBvbmxpbmUg a2V5IGNvbXB1dGF0aW9uIHRvIGEgZmV3IGZpbml0ZSBmaWVsZCBtdWx0aXBsaWVzLg0KUGxlYXNl IHNlZSBteSBlbWFpbCB0byB0aGUgbGlzdCBvZiBKdWx5IDI2LCAyMDE2OiBodHRwczovL21haWxh cmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9pRWIwWG5BSU1BQl9WM0k4TGpNRlFSajFGZTAN CmIpOiBmdXJ0aGVyIHNwZWVkLXVwcy90cmlja3MsIGV0YzoNCk9uZSBjYW4gdHJ5IGFuZCBiZSBz bWFydGVyIGJ5IGNsZXZlciBpbXBsZW1lbnRhdGlvbnMuDQpQbGVhc2Ugc2VlIG15IGVtYWlsIHRv IHRoZSBsaXN0IG9mIEp1bHkgMjEsIDIwMTY6IGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcv YXJjaC9tc2cvYWNlL2lJNThtVF9ERHpLSW1MMUxQX2JVUTdUem9vSQ0KDQpUaGlzIHNlZW1zIHRv IHRha2UgdGhlIHRpbWUgbGF0ZW5jeSBhcmd1bWVudCBhd2F5LiBUaGUgb25seSBvdGhlciB0ZWNo bmljYWwgaHVyZGxlcyBJIGNhbiBzZWUgYXJlDQooaSkgc2lnbmF0dXJlIHNpemUge2lzIDY0QiB0 b28gbXVjaD99Ow0KKGlpKSBjb3N0IG9mIHB1YmxpYyBrZXkgY3J5cHRvIGltcGxlbWVudGF0aW9u cyB7cXVpdGUgc29tZSBzbWFsbCwgbmlmdHkgZGVzaWducyBvdXQgdGhlcmUgKE5hQ2wgZXRjLn0u DQoNCkFzIHRvIChpKSAtIG9uZSBzaG91bGQgdmlldyBzaWduYXR1cmUgc2l6ZXMgaW4gcGVyc3Bl Y3RpdmU6IGFzIGFuIGV4YW1wbGUsIGtleSBzaXplcyBpbiB0aGUga2V5IHByZS1kaXN0cmlidXRp b24gc2NoZW1lIEhJTU1PIChhcyBwcm9tb3RlZCBieSBQaGlsaXBzKSBoYXMga2V5IHNpemVzIG9m IDYuMjUga0IgYW5kIHVwLCBhY2NvcmRpbmcgdG8gVGFibGUgMyBvZiB0aGUgcGFwZXIgdGhhdCBt YXNzYWdlcyBwYXJhbWV0ZXJzIHRvIHRod2FydCBuZXcgYXR0YWNrcyBvbiB0aGVpciBzY2hlbWUs IHNlZSBodHRwOi8vZXByaW50LmlhY3Iub3JnLzIwMTYvMTUyLg0KDQpTbywgc2VjdXJpdHkgYXJn dW1lbnRzIHRoYXQgZmF2b3IgYXN5bW1ldHJpYyBzb2x1dGlvbnMgYXNpZGUsIHRoZXJlIGFsc28g ZG8gbm90IHNlZW0gdG8gYmUgdG9vIG1hbnkgb3RoZXIgb2JqZWN0aW9ucyB0aGF0IHdvdWxkIGhv bGQgaW4gdGhlIHdvcmxkIGFubm8gMjAxNiB7ZXhjZXB0IGZvciAic3VuayBpbnZlc3RtZW50IiBh cmd1bWVudHMiLCBidXQgdGhhdCBpcyBhIGNvcnBvcmF0ZSBtaW5kc2V0IGlzc3VlfS4NCg0KT24g MTEvMTcvMjAxNiAxMjo1MCBBTSwgTWljaGFlbCBTdEpvaG5zIHdyb3RlOg0KT24gMTEvMTYvMjAx NiA5OjA4IEFNLCBLZXBlbmcgTGkgd3JvdGU6DQoNCkhlbGxvIGFsbCwNCg0KV2UgaGFkIGEgbG9u ZyBkaXNjdXNzaW9uIGFib3V0IGdyb3VwIGNvbW11bmljYXRpb24gc2VjdXJpdHkgdG9waWMgc2lu Y2UgdGhlIHByZXZpb3VzIEYyRiBtZWV0aW5nLg0KDQpIYW5uZXMgYW5kIEkgaGF2ZSB0cmllZCB0 byBtYWtlIGEgc3VtbWFyeSBhYm91dCB0aGUgZGlzY3Vzc2lvbiBhcyBmb2xsb3dzOg0KDQrCtyAg ICAgICBUaGUgc29sdXRpb24gbmVlZHMgdG8gZGVmaW5lIGJvdGgsIHN5bW1ldHJpYyBhbmQgYW4g YXN5bW1ldHJpYyBncm91cCBrZXkgc29sdXRpb24uDQoNClRoZXJlIGlzIG5vIGNhc2UgKGFic2Vu dCBoYXJkd2FyZSBtaXRpZ2F0aW9uKSBpbiB3aGljaCBhIHN5bW1ldHJpYyBncm91cCBrZXkgc29s dXRpb24gY2FuIGJlIG1hZGUgc2VjdXJlL3NhZmUgYW5kIG5vIG9uZSBoYXMgbWFkZSBhbiBvZmZl ciBvZiBwcm9vZiB0aGF0IHRoZXkgY2FuIG1ha2UgaXQgc2VjdXJlLiAgICBJJ3ZlIGFza2VkIHJl cGVhdGVkbHkgLSBubyBvbmUgaGFzIGNvbWUgZm9yd2FyZCB3aXRoIG1vcmUgdGhhbiAib2ggd2Ug Y2FuIGxvY2sgdGhlIHN5bW1ldHJpYyBrZXkgc3R1ZmYgaW4gYSBjb3JuZXIgYW5kIG1ha2Ugc3Vy ZSBpdCBpc24ndCB1c2VkIGZvciBhbnl0aGluZyBpbXBvcnRhbnQiLg0KDQoNCkdpdmVuIHRoZSBy ZWNlbnQgYXR0YWNrcyBvbiB0aGUgaW50ZXJuZXQgYnkgSU9UIGJvdG5ldHMsIHRoZXJlIGlzIGEg ZnVydGhlciBjb25zaWRlcmF0aW9uIHRoYXQgc2hvdWxkIGJlIHVuZGVydGFrZW4gLSB3aGV0aGVy IHRoZSBzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0aW9uIGFwcGxpZWQgdG8gMTBzIG9mIDEwMDBz IG9mIElPVCBkZXZpY2VzIGlzIGFuIGFjdGl2ZSB0aHJlYXQgdG8gdGhlIHJlc3Qgb2YgdGhlIGlu dGVybmV0IChlLmcuIGVuYWJsaW5nIERET1MsIGN5YmVyIHBoeXNpY2FsIGlzc3VlcywgZXRjKT8N Cg0KVGhlIG11bHRpcGFydHkgKGdyb3VwKSBzeW1tZXRyaWMga2V5IHNvbHV0aW9uIGlzIG9ubHkg d2FudGVkIGZvciBhIHNpbmdsZSBjb3JuZXIgb2YgdGhlIHNvbHV0aW9uIHNwYWNlIC0gbG93IGxh dGVuY3ksIG5vIGNvc3Qgc3lzdGVtcy4gIEUuZy4gbGlnaHRidWxicy4gIEdpdmVuIHRoZXJlIGlz IGEgd29ya2VkIGV4YW1wbGUgb2YgdGhlIGluc2VjdXJpdHkgb2YgbXVsdGlwYXJ0eSBzeW1tZXRy aWMga2V5IHN5c3RlbXMgKGUuZy4gdGhlIGF0dGFjayBvbiB0aGUgc3ltbWV0cmljIHNpZ25pbmcg a2V5IG9mIHRoZSBIVUUgbGlnaHRzKSwgSSdtIHVuY2xlYXIgd2h5IGFueW9uZSBhdCBhbGwgd291 bGQgdGhpbmsgdGhhdCBwdXJzdWluZyBhIGtub3duIGJhZCBzb2x1dGlvbiBpbiB0aGUgSUVURiBp cyBhIGdvb2QgaWRlYS4NCg0KDQoNCsK3ICAgICAgIFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9u IHNlY3Rpb24gbmVlZHMgdG8gZXhwbGFpbiB1bmRlciB3aGF0IGNpcmN1bXN0YW5jZXMgd2hhdCBz b2x1dGlvbiBpcyBhcHByb3ByaWF0ZS4NCg0KU2VjdXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9u cyBnZW5lcmFsbHkgb25seSBhZGRyZXNzIHRoZSB0aHJlYXQgKnRvKiB0aGUgc3lzdGVtIGZyb20g c2VjdXJpdHkgY2hvaWNlcy4gIEluIHRoaXMgY2FzZSwgc3ltbWV0cmljIGtleSBncm91cCBjb21t cyByZWR1Y2VzIGRvd24gdG8gdGhlIHNhbWUgc2VjdXJpdHkgYW5hbHlzaXMgeW91IHdvdWxkIHVz ZSB3aXRoIHNoYXJlZCBkZWZhdWx0IHBhc3N3b3JkcyBhY3Jvc3MgMTAwMHMgb2YgZGV2aWNlcy4g ICBBbiBJT1Qgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIGluIHRoZSBmdXR1cmUgcHJv YmFibHkgbmVlZHMgdG8gYWRkcmVzcyB0aGUgdGhyZWF0ICpGUk9NKiB0aGUgSU9UIHNvbHV0aW9u IHRvIHRoZSBicm9hZGVyIGludGVybmV0Lg0KDQpNaWtlDQoNCg0KDQoNCklmIHRoaXMgaXMgbm90 IGFjY3VyYXRlLCBwbGVhc2UgbGV0IHVzIGtub3cuDQoNCktpbmQgUmVnYXJkcw0KS2VwZW5nICYg SGFubmVzDQoNCkJUVzogaXQgaXMgYSBwaXR5IHRoYXQgSSBjYW4ndCBhdHRlbmQgdGhpcyBtZWV0 aW5nIGR1ZSB0byBwZXJzb25hbCByZWFzb25zLCBhbmQgaG9wZSB5b3UgYWxsIGhhdmUgYSBuaWNl IG1lZXRpbmcgaW4gU2VvdWwhDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQoNCkFjZSBtYWlsaW5nIGxpc3QNCg0KQWNlQGlldGYub3JnPG1h aWx0bzpBY2VAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vYWNlDQoNCg0KDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KDQpBY2UgbWFpbGluZyBsaXN0DQoNCkFjZUBpZXRmLm9yZzxtYWlsdG86QWNl QGlldGYub3JnPg0KDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZQ0K DQoNCg0KDQotLQ0KDQplbWFpbDogcnN0cnVpay5leHRAZ21haWwuY29tPG1haWx0bzpyc3RydWlr LmV4dEBnbWFpbC5jb20+IHwgU2t5cGU6IHJzdHJ1aWsNCg0KY2VsbDogKzEgKDY0NykgODY3LTU2 NTggfCBVUzogKzEgKDQxNSkgNjkwLTczNjMNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpBY2UgbWFpbGluZyBsaXN0DQpBY2VAaWV0Zi5vcmc8bWFpbHRv OkFjZUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl DQoNCg0K --_000_36F5869FE31AB24485E5E3222C288E1F6DCA095ENABESITEInterDi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcHJlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0K c3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hw RGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0 O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4w aW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBNaWtl LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPlRoYW5rcyBmb3IgcG9pbnRpbmcgb3V0IGFsbCB0aGUgaXNzdWVzIHdpdGgg YSBzeW1tZXRyaWMga2V5IGFwcHJvYWNoIHRvIGdyb3VwIGNvbW11bmljYXRpb24uJm5ic3A7IEhv d2V2ZXIsIGNhbiB5b3UgYWxzbyBnaXZlIGFueSB0aG91Z2h0cyBvbiB0aGUgc3BlY2lmaWMgdnVs bmVyYWJpbGl0eQ0KIHRvIHRoZSBDQSBhbmQgY2VydGlmaWNhdGVzIGluIHRoZSBhc3ltbWV0cmlj IGtleSBhcHByb2FjaCBmb3IgSW9UPyZuYnNwOyBBZnRlciBhbGwsIHRoZXJlIGhhcyBiZWVuIHNv bWUgd2VsbC1rbm93biBhdHRhY2tzIG9uIFBLSSBpbmZyYXN0cnVjdHVyZSBpbiB0aGUgbGFzdCBm ZXcgeWVhcnMgc3VjaCBhczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxhIGhyZWY9Imh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL0RpZ2lOb3RhciNJc3N1 YW5jZV9vZl9mcmF1ZHVsZW50X2NlcnRpZmljYXRlcyI+aHR0cHM6Ly9lbi53aWtpcGVkaWEub3Jn L3dpa2kvRGlnaU5vdGFyI0lzc3VhbmNlX29mX2ZyYXVkdWxlbnRfY2VydGlmaWNhdGVzPC9hPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPkRvIHlvdSB0aGluayBpdCB3aWxsIGJlIGJldHRlciBvciB3b3JzZSBpZiBJb1Qg aW5mcmFzdHJ1Y3R1cmUgc3RhcnQgdXNpbmcgY2VydGlmaWNhdGVzIG9uIGEgbWFzc2l2ZSBzY2Fs ZT8gJm5ic3A7T3IgaXMgaXQgb3V0c2lkZSB0aGUgc2NvcGUgb2YgSUVURiBzdGFuZGFyZHMgYW5k IG1vcmUNCiBvZiBhIGRlcGxveW1lbnQgYW5kIG9wZXJhdGlvbmFsIGlzc3VlPzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi Pi9Ba2JhcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0 Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPiBBY2Ug W21haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+TWljaGFl bCBTdEpvaG5zPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgTm92ZW1iZXIgMjMsIDIwMTYg MToyMiBQTTxicj4NCjxiPlRvOjwvYj4ga2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb207 IFJlbmUgU3RydWlrICZsdDtyc3RydWlrLmV4dEBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9i PiBhY2VAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBY2VdIFN1bW1hcnkgb2Yg QUNFIEdyb3VwIENvbW11bmljYXRpb24gU2VjdXJpdHkgRGlzY3Vzc2lvbjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxMS8xNy8yMDE2IDc6 MDAgUE0sIDxhIGhyZWY9Im1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSI+ DQprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbTwvYT4gd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklzIGFueW9uZSB3aWxs aW5nIHRvIHdvcmsgb24gYSBkcmFmdCB0byBiZSByZWFkeSBpbiBhZHZhbmNlIG9mIHRoZSBDaGlj YWdvIG1lZXRpbmcgc28gd2UgaGF2ZSBhIGNvbmNyZXRlIHByb3Bvc2FsIGZvciBhc3ltbWV0cmlj IGtleXM/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCkknbSBqdXN0IGNhdGNoaW5nIHVwIG9uIG9sZCBtYWlsIGFmdGVyIGdl dHRpbmcgb3ZlciBhIGNvbGQuPGJyPg0KPGJyPg0KTW9zdGx5LCB0aGlzIGNvdWxkIGJlIGFzIHNp bXBsZSBhcyBhIHR3byB0byBmb3VyIHBhcmFncmFwaCBkcmFmdDo8YnI+DQo8YnI+DQoxKSBVc2Ug Q09SRSBzZWN0aW9uIDUgZm9yIG1lc3NhZ2UgZm9ybWF0cy4gKGUuZy4gcHVibGljIGtleSBzaWdu ZWQgbWVzc2FnZXMpIHVzaW5nIG9uZSBvZiBzZXZlcmFsIGRlZmluZWQgc3BlY2lmaWMgc2V0IG9m IGFsZ29yaXRobXMgKGUuZy4gc2hhMjU2d2l0aGVjZHNhIGFuZCBwMjU2IG9yIHNvbWV0aGluZyBz bWFsbGVyKSBjaG9zZW4gYnkgdGhlIGFwcGxpY2F0aW9uLjxicj4NCjIpIFRoZSBhdXRoZW50aWNh dGlvbiBiYXJlIHB1YmxpYyBrZXkgaXMgYSBjb25maWd1cmF0aW9uIGl0ZW0gZm9yIHRoZSBlbmQg ZGV2aWNlcyBhbmQgcGxhY2VtZW50IGlzIGJleW9uZCB0aGUgc2NvcGUgb2YgdGhpcyBkcmFmdC48 YnI+DQozKSBUcmFja2luZyBvZiBhIG1lc3NhZ2UgSUQgZnJvbSAoMSkgdG8gcHJldmVudCBjb21t YW5kIHJlcGxheSBhdHRhY2tzLjxicj4NCjQpIE1pbmltdW0gbnVtYmVycyBvZiBjb250cm9sbGVy cyAoZS5nLiBwdWJsaWMga2V5cyBhbmQgYWN0dWF0aW9uIGV2ZW50cyBvciBtZXNzYWdlIGlkcykg dGhhdCBhbiBlbmQgc3lzdGVtIGhhcyB0byB0cmFjay48YnI+DQo8YnI+DQooMikgY291bGQgYmUg Zm9sZGVkIGludG8gYSBkcmFmdCBhYm91dCBjb25maWd1cmluZyBlbmQgZGV2aWNlcy48YnI+DQo8 YnI+DQpBIG1vcmUgY29tcGxleCBtb2RlbCB3b3VsZCBiZTo8YnI+DQoxKSBQbGFjZSBhIHJvb3Qg Y2VydGlmaWNhdGUgb24gYWxsIGVuZCBzeXN0ZW1zIHZpYSBjb25maWd1cmF0aW9uIChhbHNvIG91 dCBvZiBzY29wZSk8YnI+DQoyKSBEZXNjcmliZSB0aGUgY2VydGlmaWNhdGlvbiBwYXRoIGFsZ29y aXRobSAoZS5nLiBwcm9maWxlIFJGQzUyODApPGJyPg0KMykgRGVzY3JpYmUgaG93IHRoZSBjZXJ0 IHBhdGggY2VydGlmaWNhdGVzIGFyZSBjYXJyaWVkIGluIENPUkUgc2VjdGlvbiA1IG1lc3NhZ2Vz Ljxicj4NCjQpIHBsdXMgMyAmYW1wOyA0IGFib3ZlLjxicj4NCjUpIHBsdXMgaG93IHRvIG9wZXJh dGUgaW4gdGhlIHByZXNlbmNlIG9mIGNsb2NrIHRpbWUuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0K VW5saWtlIHN5bW1ldHJpYyBrZXkgc3lzdGVtcywgdGhlcmUgcmVhbGx5IGRvZXNuJ3QgbmVlZCB0 byBiZSBhIGtleSBtYW5hZ2VtZW50L2FncmVlbWVudC90cmFuc3BvcnQgcHJvdG9jb2wgcGVyIHNl LiZuYnNwOyBJdCdzIGFsbCBhYm91dCBhKSB3aGF0IGNvbnN0aXR1dGVzIGEgdmFsaWQgbWVzc2Fn ZSwgYW5kIGIpIHdoYXQgZG8geW91IGRvIHdpdGggdGhlIHZhbGlkIG1lc3NhZ2Ugb25jZSB5b3Ug Z2V0IGl0Ljxicj4NCjxicj4NCkFuIGFwcGxpY2F0aW9uIHNwZWNpZmljIGRyYWZ0IHdvdWxkIGlu Y2x1ZGUgbWVzc2FnZSBmb3JtYXRzIGZvciB0aGluZ3MgaW5jbHVkZWQgaW4gYSBDT1JFIHNlY3Rp b24gNSBtZXNzYWdlIChlLmcuIHRoZSBzcGVjaWZpYyB2YWx1ZXMgZm9yIHR1cm5pbmcgb24gYW5k IG9mZiBsaWdodGJ1bGJzIG9yIHNldHRpbmcgdGhlaXIgaHVlcyBvciBpbnRlbnNpdHkpLCBidXQg dGhhdCdzIG5vdCByZWFsbHkgYW4gQUNFIHRoaW5nIHBlciBzZS48YnI+DQo8YnI+DQpNaWtlPGJy Pg0KPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXYgaWQ9IkFwcGxlTWFp bFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2ln bmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkthdGhsZWVuJm5ic3A7PGJyPg0KPGJyPg0K UGxlYXNlIGV4Y3VzZSB0eXBvcywgc2VudCBmcm9tIGhhbmRoZWxkIGRldmljZSZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBOb3YgMTcsIDIwMTYsIGF0IDExOjI2IFBNLCBS ZW5lIFN0cnVpayAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJzdHJ1aWsuZXh0QGdtYWlsLmNvbSI+cnN0 cnVpay5leHRAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5EZWFyIGNvbGxlYWd1ZXM6PGJy Pg0KPGJyPg0KSnVzdCBhIHJlbWluZGVyIHJlIHBlcmNlaXZlZCB0ZWNobmljYWwgaHVyZGxlcyBm b3IgdXNpbmcgc2lnbmF0dXJlczo8YnI+DQphKSB0aW1lIGxhdGVuY3kgb2Ygc2lnbmluZzo8YnI+ DQpPbmUgY2FuIHByZS1jb21wdXRlIGVwaGVtZXJhbCBzaWduaW5nIGtleXMsIHNvIGFzIHRvIHJl ZHVjZSBvbmxpbmUga2V5IGNvbXB1dGF0aW9uIHRvIGEgZmV3IGZpbml0ZSBmaWVsZCBtdWx0aXBs aWVzLg0KPGJyPg0KUGxlYXNlIHNlZSBteSBlbWFpbCB0byB0aGUgbGlzdCBvZiBKdWx5IDI2LCAy MDE2OiA8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9p RWIwWG5BSU1BQl9WM0k4TGpNRlFSajFGZTAiPg0KaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9y Zy9hcmNoL21zZy9hY2UvaUViMFhuQUlNQUJfVjNJOExqTUZRUmoxRmUwPC9hPjxicj4NCmIpOiBm dXJ0aGVyIHNwZWVkLXVwcy90cmlja3MsIGV0Yzo8YnI+DQpPbmUgY2FuIHRyeSBhbmQgYmUgc21h cnRlciBieSBjbGV2ZXIgaW1wbGVtZW50YXRpb25zLjxicj4NClBsZWFzZSBzZWUgbXkgZW1haWwg dG8gdGhlIGxpc3Qgb2YgSnVseSAyMSwgMjAxNjogPGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2 ZS5pZXRmLm9yZy9hcmNoL21zZy9hY2UvaUk1OG1UX0REektJbUwxTFBfYlVRN1R6b29JIj4NCmh0 dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWNlL2lJNThtVF9ERHpLSW1MMUxQ X2JVUTdUem9vSTwvYT48YnI+DQo8YnI+DQpUaGlzIHNlZW1zIHRvIHRha2UgdGhlIHRpbWUgbGF0 ZW5jeSBhcmd1bWVudCBhd2F5LiBUaGUgb25seSBvdGhlciB0ZWNobmljYWwgaHVyZGxlcyBJIGNh biBzZWUgYXJlDQo8YnI+DQooaSkgc2lnbmF0dXJlIHNpemUge2lzIDY0QiB0b28gbXVjaD99OyA8 YnI+DQooaWkpIGNvc3Qgb2YgcHVibGljIGtleSBjcnlwdG8gaW1wbGVtZW50YXRpb25zIHtxdWl0 ZSBzb21lIHNtYWxsLCBuaWZ0eSBkZXNpZ25zIG91dCB0aGVyZSAoTmFDbCBldGMufS48YnI+DQo8 YnI+DQpBcyB0byAoaSkgLSBvbmUgc2hvdWxkIHZpZXcgc2lnbmF0dXJlIHNpemVzIGluIHBlcnNw ZWN0aXZlOiBhcyBhbiBleGFtcGxlLCBrZXkgc2l6ZXMgaW4gdGhlIGtleSBwcmUtZGlzdHJpYnV0 aW9uIHNjaGVtZSBISU1NTyAoYXMgcHJvbW90ZWQgYnkgUGhpbGlwcykgaGFzIGtleSBzaXplcyBv ZiA2LjI1IGtCIGFuZCB1cCwgYWNjb3JkaW5nIHRvIFRhYmxlIDMgb2YgdGhlIHBhcGVyIHRoYXQg bWFzc2FnZXMgcGFyYW1ldGVycyB0byB0aHdhcnQgbmV3DQogYXR0YWNrcyBvbiB0aGVpciBzY2hl bWUsIHNlZSA8YSBocmVmPSJodHRwOi8vZXByaW50LmlhY3Iub3JnLzIwMTYvMTUyIj5odHRwOi8v ZXByaW50LmlhY3Iub3JnLzIwMTYvMTUyPC9hPi48YnI+DQo8YnI+DQpTbywgc2VjdXJpdHkgYXJn dW1lbnRzIHRoYXQgZmF2b3IgYXN5bW1ldHJpYyBzb2x1dGlvbnMgYXNpZGUsIHRoZXJlIGFsc28g ZG8gbm90IHNlZW0gdG8gYmUgdG9vIG1hbnkgb3RoZXIgb2JqZWN0aW9ucyB0aGF0IHdvdWxkIGhv bGQgaW4gdGhlIHdvcmxkIGFubm8gMjAxNiB7ZXhjZXB0IGZvciAmcXVvdDtzdW5rIGludmVzdG1l bnQmcXVvdDsgYXJndW1lbnRzJnF1b3Q7LCBidXQgdGhhdCBpcyBhIGNvcnBvcmF0ZSBtaW5kc2V0 IGlzc3VlfS48YnI+DQo8YnI+DQpPbiAxMS8xNy8yMDE2IDEyOjUwIEFNLCBNaWNoYWVsIFN0Sm9o bnMgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIDExLzE2LzIwMTYgOTowOCBBTSwgS2VwZW5nIExpIHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjxwPkhlbGxvIGFsbCwmbmJzcDsgPG86cD48L286cD48L3A+DQo8cD5X ZSBoYWQgYSBsb25nIGRpc2N1c3Npb24gYWJvdXQgZ3JvdXAgY29tbXVuaWNhdGlvbiBzZWN1cml0 eSB0b3BpYyBzaW5jZSB0aGUgcHJldmlvdXMgRjJGIG1lZXRpbmcuPG86cD48L286cD48L3A+DQo8 cD5IYW5uZXMgYW5kIEkgaGF2ZSB0cmllZCB0byBtYWtlIGEgc3VtbWFyeSBhYm91dCB0aGUgZGlz Y3Vzc2lvbiBhcyBmb2xsb3dzOjxvOnA+PC9vOnA+PC9wPg0KPHA+wrcmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhlIHNvbHV0aW9uIG5lZWRzIHRvIGRlZmluZSBib3RoLCBz eW1tZXRyaWMgYW5kIGFuIGFzeW1tZXRyaWMgZ3JvdXAga2V5IHNvbHV0aW9uLg0KPG86cD48L286 cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpUaGVyZSBp cyBubyBjYXNlIChhYnNlbnQgaGFyZHdhcmUgbWl0aWdhdGlvbikgaW4gd2hpY2ggYSBzeW1tZXRy aWMgZ3JvdXAga2V5IHNvbHV0aW9uIGNhbiBiZSBtYWRlIHNlY3VyZS9zYWZlIGFuZCBubyBvbmUg aGFzIG1hZGUgYW4gb2ZmZXIgb2YgcHJvb2YgdGhhdCB0aGV5IGNhbiBtYWtlIGl0IHNlY3VyZS4m bmJzcDsmbmJzcDsmbmJzcDsgSSd2ZSBhc2tlZCByZXBlYXRlZGx5IC0gbm8gb25lIGhhcyBjb21l IGZvcndhcmQgd2l0aCBtb3JlIHRoYW4gJnF1b3Q7b2ggd2UgY2FuIGxvY2sNCiB0aGUgc3ltbWV0 cmljIGtleSBzdHVmZiBpbiBhIGNvcm5lciBhbmQgbWFrZSBzdXJlIGl0IGlzbid0IHVzZWQgZm9y IGFueXRoaW5nIGltcG9ydGFudCZxdW90Oy48YnI+DQo8YnI+DQo8YnI+DQpHaXZlbiB0aGUgcmVj ZW50IGF0dGFja3Mgb24gdGhlIGludGVybmV0IGJ5IElPVCBib3RuZXRzLCB0aGVyZSBpcyBhIGZ1 cnRoZXIgY29uc2lkZXJhdGlvbiB0aGF0IHNob3VsZCBiZSB1bmRlcnRha2VuIC0gd2hldGhlciB0 aGUgc3ltbWV0cmljIGdyb3VwIGtleSBzb2x1dGlvbiBhcHBsaWVkIHRvIDEwcyBvZiAxMDAwcyBv ZiBJT1QgZGV2aWNlcyBpcyBhbiBhY3RpdmUgdGhyZWF0IHRvIHRoZSByZXN0IG9mIHRoZSBpbnRl cm5ldCAoZS5nLiBlbmFibGluZw0KIERET1MsIGN5YmVyIHBoeXNpY2FsIGlzc3VlcywgZXRjKT88 YnI+DQo8YnI+DQpUaGUgbXVsdGlwYXJ0eSAoZ3JvdXApIHN5bW1ldHJpYyBrZXkgc29sdXRpb24g aXMgb25seSB3YW50ZWQgZm9yIGEgc2luZ2xlIGNvcm5lciBvZiB0aGUgc29sdXRpb24gc3BhY2Ug LSBsb3cgbGF0ZW5jeSwgbm8gY29zdCBzeXN0ZW1zLiZuYnNwOyBFLmcuIGxpZ2h0YnVsYnMuJm5i c3A7IEdpdmVuIHRoZXJlIGlzIGEgd29ya2VkIGV4YW1wbGUgb2YgdGhlIGluc2VjdXJpdHkgb2Yg bXVsdGlwYXJ0eSBzeW1tZXRyaWMga2V5IHN5c3RlbXMgKGUuZy4gdGhlIGF0dGFjaw0KIG9uIHRo ZSBzeW1tZXRyaWMgc2lnbmluZyBrZXkgb2YgdGhlIEhVRSBsaWdodHMpLCBJJ20gdW5jbGVhciB3 aHkgYW55b25lIGF0IGFsbCB3b3VsZCB0aGluayB0aGF0IHB1cnN1aW5nIGEga25vd24gYmFkIHNv bHV0aW9uIGluIHRoZSBJRVRGIGlzIGEgZ29vZCBpZGVhLjxicj4NCjxicj4NCjxicj4NCjxvOnA+ PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJv dHRvbTo1LjBwdCI+DQo8cD7CtyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBU aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIG5lZWRzIHRvIGV4cGxhaW4gdW5kZXIg d2hhdCBjaXJjdW1zdGFuY2VzIHdoYXQgc29sdXRpb24gaXMgYXBwcm9wcmlhdGUuDQo8bzpwPjwv bzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NClNlY3Vy aXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbnMgZ2VuZXJhbGx5IG9ubHkgYWRkcmVzcyB0aGUgdGhy ZWF0ICp0byogdGhlIHN5c3RlbSBmcm9tIHNlY3VyaXR5IGNob2ljZXMuJm5ic3A7IEluIHRoaXMg Y2FzZSwgc3ltbWV0cmljIGtleSBncm91cCBjb21tcyByZWR1Y2VzIGRvd24gdG8gdGhlIHNhbWUg c2VjdXJpdHkgYW5hbHlzaXMgeW91IHdvdWxkIHVzZSB3aXRoIHNoYXJlZCBkZWZhdWx0IHBhc3N3 b3JkcyBhY3Jvc3MgMTAwMHMgb2YgZGV2aWNlcy4mbmJzcDsmbmJzcDsNCiBBbiBJT1Qgc2VjdXJp dHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uIGluIHRoZSBmdXR1cmUgcHJvYmFibHkgbmVlZHMgdG8g YWRkcmVzcyB0aGUgdGhyZWF0ICpGUk9NKiB0aGUgSU9UIHNvbHV0aW9uIHRvIHRoZSBicm9hZGVy IGludGVybmV0Ljxicj4NCjxicj4NCk1pa2U8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwv bzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPHA+SWYgdGhpcyBpcyBub3QgYWNjdXJhdGUsIHBsZWFzZSBsZXQgdXMga25v dy48bzpwPjwvbzpwPjwvcD4NCjxwPktpbmQgUmVnYXJkczxicj4NCktlcGVuZyAmYW1wOyBIYW5u ZXM8bzpwPjwvbzpwPjwvcD4NCjxwPkJUVzogaXQgaXMgYSBwaXR5IHRoYXQgSSBjYW4ndCBhdHRl bmQgdGhpcyBtZWV0aW5nIGR1ZSB0byBwZXJzb25hbCByZWFzb25zLCBhbmQgaG9wZSB5b3UgYWxs IGhhdmUgYSBuaWNlIG1lZXRpbmcgaW4gU2VvdWwhPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmU+X19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT5BY2UgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0i bWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwv cHJlPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmU+X19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT5BY2UgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0i bWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwv cHJlPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwcmU+LS0gPG86cD48L286cD48L3By ZT4NCjxwcmU+ZW1haWw6IDxhIGhyZWY9Im1haWx0bzpyc3RydWlrLmV4dEBnbWFpbC5jb20iPnJz dHJ1aWsuZXh0QGdtYWlsLmNvbTwvYT4gfCBTa3lwZTogcnN0cnVpazxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPmNlbGw6ICYjNDM7MSAoNjQ3KSA4NjctNTY1OCB8IFVTOiAmIzQzOzEgKDQxNSkgNjkw LTczNjM8bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzxicj4NCkFjZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWNl QGlldGYub3JnIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_36F5869FE31AB24485E5E3222C288E1F6DCA095ENABESITEInterDi_-- From nobody Fri Nov 25 09:49:20 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27C5112967C for ; Fri, 25 Nov 2016 09:49:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.186 X-Spam-Level: X-Spam-Status: No, score=-3.186 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D4XAnpFIXkY9 for ; Fri, 25 Nov 2016 09:49:16 -0800 (PST) Received: from resqmta-ch2-06v.sys.comcast.net (resqmta-ch2-06v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A51C5129461 for ; Fri, 25 Nov 2016 09:49:16 -0800 (PST) Received: from resomta-ch2-15v.sys.comcast.net ([69.252.207.111]) by resqmta-ch2-06v.sys.comcast.net with SMTP id AKcbcpKTM5TWoAKcecu13y; Fri, 25 Nov 2016 17:49:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1480096156; bh=yzte/cNsC2LMgpbFKhEXiglZ9rBCJTEQNKXL4O6mG9s=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=NH7eZBtNc5f9Xu7MxcmAb3LgQc2xt/8J5+K+5+RXYJoTBO1id/NP+V34lf6fp5Anf EEo7luAZtTrf4T/r10JbEOkIaoRrUsdSw1dks8sfZG3VNE2vNx16X6N679F0SC8qgw qbEBC4x+WD1yz+qKVziJ0svqe80NymHVCPx7h68fM5u7nIRD0QtW0Lt/BAmYYMMO2T fo4Cc5kDhajWwGjaHcGUxkOOZcREwB+cZeEvV/J8z9Fkk1pwFee2o+vQq43/3/ofmr uEYzk216F63Sgzf2Ew9x69iq0AnMmhnAunirqOfM9myLu0pBMG41Ydbo5dp+WaDTT8 XQRkEKfS18pwA== Received: from [192.168.1.115] ([68.83.216.245]) by resomta-ch2-15v.sys.comcast.net with SMTP id AKagcimvwr9q8AKahcSeao; Fri, 25 Nov 2016 17:47:15 +0000 To: "Rahman, Akbar" References: <1cc7f243-e7f7-6ec5-7140-88c74853dc34@gmx.net> <04FDEBEF-68CF-4DC6-B760-4DFB1B87D22C@gmail.com> <6108.1478988687@dooku.sandelman.ca> <187ea38f-3271-ee91-7053-3e5ecedeafea@comcast.net> <7f461eca-b294-4a4f-b8e1-ec2fe70effaf.kepeng.lkp@alibaba-inc.com> <3ccde008-1e19-718d-37bb-ed7653c60ec9@comcast.net> <0C27644B-6033-4781-86D5-2FD66872CEFC@gmail.com> <13b43f16-4867-6580-8275-a2bd0ecbae05@comcast.net> <36F5869FE31AB24485E5E3222C288E1F6DCA095E@NABESITE.InterDigital.com> From: Michael StJohns Message-ID: <20e471c2-3b48-ae05-9643-fb19afd580d4@comcast.net> Date: Fri, 25 Nov 2016 12:47:19 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 In-Reply-To: <36F5869FE31AB24485E5E3222C288E1F6DCA095E@NABESITE.InterDigital.com> Content-Type: multipart/alternative; boundary="------------8EFEEF47E92DE991622D6CE8" X-CMAE-Envelope: MS4wfFh9x9WFjXWJW1eUdJxiq4OSpBM5szZ2Iieu6H3aN77xPMHNDAXVM3wIhFUzQ3ZH4Qq+bg9ifKlTWGZcXq0/7DqqPqvglhXCpo3XoNLN/PQm8GiY1zqw nfyXqn6wA/22urmockngukTZgAzB7elbyfqginqY0jN2Ns8igDGUZ4D4Ogz4bMLucbxAJn8f01r4hL4GkF61HcVLPZch3GG0ita2ptK0wZnNB5TjbHAVXfzV 7OAcX0K2BQZpL6kIFJfdVU7Jel/leBDdgiiYCdVaWvTbpgogaeb8qFWsNx9cGAvd Archived-At: Cc: "kathleen.moriarty.ietf@gmail.com" , Rene Struik , "ace@ietf.org" Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Nov 2016 17:49:19 -0000 This is a multi-part message in MIME format. --------------8EFEEF47E92DE991622D6CE8 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Akbar - This comes under the heading of a rat hole question for this discussion - sorry. Basically, the use of public key systems vs whether to use public key systems with certificates are separate questions. In a typical relatively closed group control system using public keys, you would generate key pairs on the controllers (switches) and provide the bare public keys to the actuators to validate control messages. Since the public keys have no life outside of the local domain/group, there's really no reason to deal with CAs, certificates et al. Some designs *may* want to include digital certificates for chaining and management of credentials, but again typically, these are closed systems that do not/will not/should not depend on public PKI for their security guarantees. And in fact, the form of the digital certificate in these types of systems may bear little resemblance to an X.509 certificate (e.g. a signed public key blob with a fixed length, fixed fields, fixed offset format). In general, you use public PKI stuff when you want your credentials to have somewhat of a global reach. So - public PKI certificate question + IOT ==> rat hole for this discussion. Mike On 11/25/2016 10:52 AM, Rahman, Akbar wrote: > > Hi Mike, > > Thanks for pointing out all the issues with a symmetric key approach > to group communication. However, can you also give any thoughts on > the specific vulnerability to the CA and certificates in the > asymmetric key approach for IoT? After all, there has been some > well-known attacks on PKI infrastructure in the last few years such as: > > https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates > > Do you think it will be better or worse if IoT infrastructure start > using certificates on a massive scale? Or is it outside the scope of > IETF standards and more of a deployment and operational issue? > > /Akbar > > > > > > > This e-mail is intended only for the use of the individual or entity > to which it is addressed, and may contain information that is > privileged, confidential and/or otherwise protected from disclosure to > anyone other than its intended recipient. Unintended transmission > shall not constitute waiver of any privilege or confidentiality > obligation. If you received this communication in error, please do not > review, copy or distribute it, notify me immediately by email, and > delete the original message and any attachments. Unless expressly > stated in this e-mail, nothing in this message or any attachment > should be construed as a digital or electronic signature. > > > *From:*Ace [mailto:ace-bounces@ietf.org] *On Behalf Of *Michael StJohns > *Sent:* Wednesday, November 23, 2016 1:22 PM > *To:* kathleen.moriarty.ietf@gmail.com; Rene Struik > > *Cc:* ace@ietf.org > *Subject:* Re: [Ace] Summary of ACE Group Communication Security > Discussion > > On 11/17/2016 7:00 PM, kathleen.moriarty.ietf@gmail.com > wrote: > > Is anyone willing to work on a draft to be ready in advance of the > Chicago meeting so we have a concrete proposal for asymmetric keys? > > > I'm just catching up on old mail after getting over a cold. > > Mostly, this could be as simple as a two to four paragraph draft: > > 1) Use CORE section 5 for message formats. (e.g. public key signed > messages) using one of several defined specific set of algorithms > (e.g. sha256withecdsa and p256 or something smaller) chosen by the > application. > 2) The authentication bare public key is a configuration item for the > end devices and placement is beyond the scope of this draft. > 3) Tracking of a message ID from (1) to prevent command replay attacks. > 4) Minimum numbers of controllers (e.g. public keys and actuation > events or message ids) that an end system has to track. > > (2) could be folded into a draft about configuring end devices. > > A more complex model would be: > 1) Place a root certificate on all end systems via configuration (also > out of scope) > 2) Describe the certification path algorithm (e.g. profile RFC5280) > 3) Describe how the cert path certificates are carried in CORE section > 5 messages. > 4) plus 3 & 4 above. > 5) plus how to operate in the presence of clock time. > > > > Unlike symmetric key systems, there really doesn't need to be a key > management/agreement/transport protocol per se. It's all about a) > what constitutes a valid message, and b) what do you do with the valid > message once you get it. > > An application specific draft would include message formats for things > included in a CORE section 5 message (e.g. the specific values for > turning on and off lightbulbs or setting their hues or intensity), but > that's not really an ACE thing per se. > > Mike > > > > Thanks, > > Kathleen > > Please excuse typos, sent from handheld device > > > On Nov 17, 2016, at 11:26 PM, Rene Struik > wrote: > > Dear colleagues: > > Just a reminder re perceived technical hurdles for using > signatures: > a) time latency of signing: > One can pre-compute ephemeral signing keys, so as to reduce > online key computation to a few finite field multiplies. > Please see my email to the list of July 26, 2016: > https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0 > b): further speed-ups/tricks, etc: > One can try and be smarter by clever implementations. > Please see my email to the list of July 21, 2016: > https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI > > This seems to take the time latency argument away. The only > other technical hurdles I can see are > (i) signature size {is 64B too much?}; > (ii) cost of public key crypto implementations {quite some > small, nifty designs out there (NaCl etc.}. > > As to (i) - one should view signature sizes in perspective: as > an example, key sizes in the key pre-distribution scheme HIMMO > (as promoted by Philips) has key sizes of 6.25 kB and up, > according to Table 3 of the paper that massages parameters to > thwart new attacks on their scheme, see > http://eprint.iacr.org/2016/152. > > So, security arguments that favor asymmetric solutions aside, > there also do not seem to be too many other objections that > would hold in the world anno 2016 {except for "sunk > investment" arguments", but that is a corporate mindset issue}. > > On 11/17/2016 12:50 AM, Michael StJohns wrote: > > On 11/16/2016 9:08 AM, Kepeng Li wrote: > > Hello all, > > We had a long discussion about group communication > security topic since the previous F2F meeting. > > Hannes and I have tried to make a summary about the > discussion as follows: > > · The solution needs to define both, symmetric > and an asymmetric group key solution. > > > There is no case (absent hardware mitigation) in which a > symmetric group key solution can be made secure/safe and > no one has made an offer of proof that they can make it > secure. I've asked repeatedly - no one has come forward > with more than "oh we can lock the symmetric key stuff in > a corner and make sure it isn't used for anything important". > > > Given the recent attacks on the internet by IOT botnets, > there is a further consideration that should be undertaken > - whether the symmetric group key solution applied to 10s > of 1000s of IOT devices is an active threat to the rest of > the internet (e.g. enabling DDOS, cyber physical issues, etc)? > > The multiparty (group) symmetric key solution is only > wanted for a single corner of the solution space - low > latency, no cost systems. E.g. lightbulbs. Given there > is a worked example of the insecurity of multiparty > symmetric key systems (e.g. the attack on the symmetric > signing key of the HUE lights), I'm unclear why anyone at > all would think that pursuing a known bad solution in the > IETF is a good idea. > > > · The security consideration section needs to > explain under what circumstances what solution is > appropriate. > > > Security consideration sections generally only address the > threat *to* the system from security choices. In this > case, symmetric key group comms reduces down to the same > security analysis you would use with shared default > passwords across 1000s of devices. An IOT security > consideration section in the future probably needs to > address the threat *FROM* the IOT solution to the broader > internet. > > Mike > > > > If this is not accurate, please let us know. > > Kind Regards > Kepeng & Hannes > > BTW: it is a pity that I can't attend this meeting due > to personal reasons, and hope you all have a nice > meeting in Seoul! > > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > -- > > email:rstruik.ext@gmail.com | Skype: rstruik > > cell: +1 (647) 867-5658 | US: +1 (415) 690-7363 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --------------8EFEEF47E92DE991622D6CE8 Content-Type: multipart/related; boundary="------------1DFDB6432BAEC8BDB5A350C2" --------------1DFDB6432BAEC8BDB5A350C2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
Hi Akbar -

This comes under the heading of a rat hole question for this discussion - sorry.

Basically, the use of public key systems vs whether to use public key systems with certificates are separate questions.  In a typical relatively closed group control system using public keys, you would generate key pairs on the controllers (switches) and provide the bare public keys to the actuators to validate control messages.  Since the public keys have no life outside of the local domain/group, there's really no reason to deal with CAs, certificates et al.

Some designs *may* want to include digital certificates for chaining and management of credentials, but again typically, these are closed systems that do not/will not/should not depend on  public PKI for their security guarantees.   And in fact, the form of the digital certificate in these types of systems may bear little resemblance to an X.509 certificate (e.g. a signed public key blob with a fixed length, fixed fields, fixed offset format).

In general, you use public PKI stuff when you want your credentials to have somewhat of a global reach.

So - public PKI certificate question + IOT ==>  rat hole for this discussion.

Mike


On 11/25/2016 10:52 AM, Rahman, Akbar wrote:

Hi Mike,

 

 

Thanks for pointing out all the issues with a symmetric key approach to group communication.  However, can you also give any thoughts on the specific vulnerability to the CA and certificates in the asymmetric key approach for IoT?  After all, there has been some well-known attacks on PKI infrastructure in the last few years such as:

 

https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates

 

 

Do you think it will be better or worse if IoT infrastructure start using certificates on a massive scale?  Or is it outside the scope of IETF standards and more of a deployment and operational issue?

 

 

/Akbar

 

 






This e-mail is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and/or otherwise protected from disclosure to anyone other than its intended recipient. Unintended transmission shall not constitute waiver of any privilege or confidentiality obligation. If you received this communication in error, please do not review, copy or distribute it, notify me immediately by email, and delete the original message and any attachments. Unless expressly stated in this e-mail, nothing in this message or any attachment should be construed as a digital or electronic signature.

From: Ace [mailto:ace-bounces@ietf.org] On Behalf Of Michael StJohns
Sent: Wednesday, November 23, 2016 1:22 PM
To: kathleen.moriarty.ietf@gmail.com; Rene Struik <rstruik.ext@gmail.com>
Cc: ace@ietf.org
Subject: Re: [Ace] Summary of ACE Group Communication Security Discussion

 

On 11/17/2016 7:00 PM, kathleen.moriarty.ietf@gmail.com wrote:

Is anyone willing to work on a draft to be ready in advance of the Chicago meeting so we have a concrete proposal for asymmetric keys?


I'm just catching up on old mail after getting over a cold.

Mostly, this could be as simple as a two to four paragraph draft:

1) Use CORE section 5 for message formats. (e.g. public key signed messages) using one of several defined specific set of algorithms (e.g. sha256withecdsa and p256 or something smaller) chosen by the application.
2) The authentication bare public key is a configuration item for the end devices and placement is beyond the scope of this draft.
3) Tracking of a message ID from (1) to prevent command replay attacks.
4) Minimum numbers of controllers (e.g. public keys and actuation events or message ids) that an end system has to track.

(2) could be folded into a draft about configuring end devices.

A more complex model would be:
1) Place a root certificate on all end systems via configuration (also out of scope)
2) Describe the certification path algorithm (e.g. profile RFC5280)
3) Describe how the cert path certificates are carried in CORE section 5 messages.
4) plus 3 & 4 above.
5) plus how to operate in the presence of clock time.



Unlike symmetric key systems, there really doesn't need to be a key management/agreement/transport protocol per se.  It's all about a) what constitutes a valid message, and b) what do you do with the valid message once you get it.

An application specific draft would include message formats for things included in a CORE section 5 message (e.g. the specific values for turning on and off lightbulbs or setting their hues or intensity), but that's not really an ACE thing per se.

Mike



 

Thanks,

Kathleen 

Please excuse typos, sent from handheld device 


On Nov 17, 2016, at 11:26 PM, Rene Struik <rstruik.ext@gmail.com> wrote:

Dear colleagues:

Just a reminder re perceived technical hurdles for using signatures:
a) time latency of signing:
One can pre-compute ephemeral signing keys, so as to reduce online key computation to a few finite field multiplies.
Please see my email to the list of July 26, 2016: https://mailarchive.ietf.org/arch/msg/ace/iEb0XnAIMAB_V3I8LjMFQRj1Fe0
b): further speed-ups/tricks, etc:
One can try and be smarter by clever implementations.
Please see my email to the list of July 21, 2016: https://mailarchive.ietf.org/arch/msg/ace/iI58mT_DDzKImL1LP_bUQ7TzooI

This seems to take the time latency argument away. The only other technical hurdles I can see are
(i) signature size {is 64B too much?};
(ii) cost of public key crypto implementations {quite some small, nifty designs out there (NaCl etc.}.

As to (i) - one should view signature sizes in perspective: as an example, key sizes in the key pre-distribution scheme HIMMO (as promoted by Philips) has key sizes of 6.25 kB and up, according to Table 3 of the paper that massages parameters to thwart new attacks on their scheme, see http://eprint.iacr.org/2016/152.

So, security arguments that favor asymmetric solutions aside, there also do not seem to be too many other objections that would hold in the world anno 2016 {except for "sunk investment" arguments", but that is a corporate mindset issue}.

On 11/17/2016 12:50 AM, Michael StJohns wrote:

On 11/16/2016 9:08 AM, Kepeng Li wrote:

Hello all, 

We had a long discussion about group communication security topic since the previous F2F meeting.

Hannes and I have tried to make a summary about the discussion as follows:

·       The solution needs to define both, symmetric and an asymmetric group key solution.


There is no case (absent hardware mitigation) in which a symmetric group key solution can be made secure/safe and no one has made an offer of proof that they can make it secure.    I've asked repeatedly - no one has come forward with more than "oh we can lock the symmetric key stuff in a corner and make sure it isn't used for anything important".


Given the recent attacks on the internet by IOT botnets, there is a further consideration that should be undertaken - whether the symmetric group key solution applied to 10s of 1000s of IOT devices is an active threat to the rest of the internet (e.g. enabling DDOS, cyber physical issues, etc)?

The multiparty (group) symmetric key solution is only wanted for a single corner of the solution space - low latency, no cost systems.  E.g. lightbulbs.  Given there is a worked example of the insecurity of multiparty symmetric key systems (e.g. the attack on the symmetric signing key of the HUE lights), I'm unclear why anyone at all would think that pursuing a known bad solution in the IETF is a good idea.


·       The security consideration section needs to explain under what circumstances what solution is appropriate.


Security consideration sections generally only address the threat *to* the system from security choices.  In this case, symmetric key group comms reduces down to the same security analysis you would use with shared default passwords across 1000s of devices.   An IOT security consideration section in the future probably needs to address the threat *FROM* the IOT solution to the broader internet.

Mike



If this is not accurate, please let us know.

Kind Regards
Kepeng & Hannes

BTW: it is a pity that I can't attend this meeting due to personal reasons, and hope you all have a nice meeting in Seoul!




_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

 




_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

 

 

-- 
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

 


--------------1DFDB6432BAEC8BDB5A350C2 Content-Type: image/png Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAPAAAAAtCAYAAACQ9eZjAAAAGXRFWHRTb2Z0d2FyZQBBZG9i ZSBJbWFnZVJlYWR5ccllPAAAAyhpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tl dCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1l dGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUu Ni1jMDY3IDc5LjE1Nzc0NywgMjAxNS8wMy8zMC0yMzo0MDo0MiAgICAgICAgIj4gPHJkZjpS REYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgt bnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8v bnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNv bS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEu MC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9w IENDIDIwMTUgKE1hY2ludG9zaCkiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6RDM3MDE5 MDcwNDA3MTFFNjg5MkRBREQwRTJEMzlBQzYiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6 RDM3MDE5MDgwNDA3MTFFNjg5MkRBREQwRTJEMzlBQzYiPiA8eG1wTU06RGVyaXZlZEZyb20g c3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDpEMzcwMTkwNTA0MDcxMUU2ODkyREFERDBFMkQz OUFDNiIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDpEMzcwMTkwNjA0MDcxMUU2ODkyREFE RDBFMkQzOUFDNiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0 YT4gPD94cGFja2V0IGVuZD0iciI/PvW3jtcAAAutSURBVHhe7Zx3rDxVFcd/dEGkCRHpKEbs KBGMoqBEsYtKB/khxoBYwCgKUsQSiiWgIBKMQkRDFGuiJlgCmhB7on+YYCIKomIXFLvw/Hwn 507O3D1Tdt/ue5n3u9/kk7f3nHPP7tuZMzP3zp1dt7S0VCgURkpoLBQK4yA0FgqFcRAaC4XC OAiNhUJhHITGQqEwDkJjoVAYB6GxUCiMg9BYKBTGQWgsFArjIDQWCoVxEBo9u91wx/3wTXj4 uqJVEd/91vBh+BssDUDb7A74MpwJe1iqohErqs/Q6GHjp53iZ7Cl5SpaQfG93+i2wyyooD8H j7GURSNUVJ+h0eN2ArHechWtkPjOn5Jtg+XwPzgPNrH0RSNSVJ+h0eM2vrjCchWtkPjOT3Lf /7/hRDi8g5fAUXAOfA3+C34bCp2NN7e3KBqJovoMjZ5sw19ruRrCvjecAsfAZmYeJOI1vnsl nAH1OJvX+8Ahc2JTS1uJtj7nZcvkYEunfNvBuc7XxTvhWNjZuneKOF/At5t5sOizK3wQdPb1 2/LzsJGFNYRd/8+BsIWZphL99oSng777A2Ancw0S8Y+Fh1mzEm3tJ/l2nZXW7x7fTqD//cFm mkr0e8asffsU1Wdo9PBh/EafKGB9WLjXxXwKwh0jF3Ebww+tnzjcXPJd4OzL5QGWVnlfk/lm 5Q2WUjm/lPmGcB98FvaxNKHwL6uAk+irnfLXLpc429wNYddOLv/v4FAzd4q4/eEj8Fvw75H4 ObwPOv9fiZgvWB8dZLYym4o6zzkrx1ZvlAn7u+E/FqO/55trsKyvrpRON9PcFNVnaPTYB0pE BbxfFiPONHeniNNO5fv5Aj4o883KtyxlJdrfyPyzcoilVM6/ZL5p0MzysyzVhPDNpYAl+u8O v3L5/gUTdxewpQIWf4XWMwq+neEGix2CrgSuhK0txYTwpQIWl5ttE8gPQLOgwty1eiMnbK9w MZ5jLGSQsr4HmXkuiuozNHqyDzS0gHV26T1yE+N3FFEXsET74sw/Lb+EfS1dJdo3O/8s/BMu s3SVaN/t/CoKtSPabgP9CR5i6RrCPrcClsjxZPCX09eYqxa2fLu0nbGUS2dpHzuUW2F3S9UQ dl/Ad5lZ9meCDig+zzRoPuBkS1cL2+agfSXqo7svjSFYl7K+l5p5LorqMzR6sg80tIDFH2BP CwuFv7OAJWxPAI2vNUZOnA2+n+5Te//pcARMHOWx+QK+2czLEnlUnCnnBWYOhf9BoImm71h8 4kILaQj7XAtYIo/GxCmnLve2N1cl2vl2OclctbBpu9/jYhK/h4/DW+HV8DbQpJkfZiV0r3ri wIXNF/DdZq5EW2PU48Fvb6FCS33+bDbPybCXpWkI+6mQ+gp9J759qoX2KusXzhnNqqg+Q6On 7wNhaytg8X2ox5+58PUWcCTiNMni+zXOiF0idlULOIk4HfV/7Prdaq6GsC+igDXJpHvDKe9x 5qpEu7OAaWtCSWNaH6Ni1vxCOLuNXX3Oh7w4vg6NORParQXcJuL8dh38PRG7Jdzp+uoS+zDw Vyk6Ow+atXd9xCgL+CdZ+2MWOiF8G2wBS8Re5PrdZ+aGsM+9gCVy/cDlbdwepN1XwP5zC51J B63UI+6p4L8v0bhEp72SBayzc+onrjL7tZn9tKpDj7I+oyxg3YP8XmY7xcIbwr6hF/DbXb/7 zdwQ9kUVsJZmprw3mrkS7dYC5rXOpH4srzF/Y56hT8TrFuFHQdvi0/Akc1WivSIFTJzOvne5 fjr7VstO+avP6O+hK653JaKLF6MsYC0m0H1hPzOrL+ZA61IL22oXsMahe02DpWkI+yyX0BuB nxG/zVwNYV9UAfvbdN81cyXaXQWsA7T3XWSuuYmcK1XAWiee+ogrzVWJ9lWZ/wxztSqLH2cB m/1FmV23ABoTFrRXu4CnxtI0hH2qAibmUaAzj88d/g/YF1XAWlCS8t5i5kq0uwpYi1G8b+4P uZBz4QVMjK4k/uj66O7CQ81difYeoJNPitFZuPX2l+RixXgLWOK1btx7n2aL6yl5Xo+tgO+1 NA1hnyhg/m4K7wG9X+JHoNl5n1P8A8InhrAvqoA1U5zyftHMlWh3FbAWVyT7PWbuFHG6HNX/ kfNy2MXCamFbiQI+y8WLtgPoh7K4s8wVKosdfQFvBt92PlF/UbweWwFXiwpyYY8KWGuWfd82 dIRvXSyATzt6ip1nAftZ5EvMXIl2VwH7VWe/MXOniHuh65Oj//+NFlqJ9kILGL/2Hz/Emzj7 Jslu/hSrs3bXIpQUJ8ZdwBJtXYbovpyPqW5b8He1C/h20FiwD002aewXPsWDPSrg9ztbGxqD T8wNeOGfewGTJ1/ldpi5KtHuKmB/5taCnSETO9tA32q1J1q44hddwNqmKVZcbPYjQe+dk181 nVslCpTFjb+AJWz5ePjv8HhY7QJe2Cw0f18Heq/ELyDFiJuqzj0ibhEFrHuvKad2zsYDKLS7 CvjNme8Ic3WKuGeDVpz5vp7XW6hiVTTJPtcCxqd9x28vLTDZ0Xx6yCTZu1D/7aqEmbK4tVHA EvZ8PKxLuJdmtjVTwLmwa81wvtD/teZuFTFzLWByaHWU/wwTnxdbVwE/OvNpXD/o+WLiNHF0 KGgl2uXg87zMwhS3yALO72FXZ1+J11tBvkCljbbt7GPWVAFH42G/Akas2QKW8B0MfoWPViUd YO5Q+OdWwPRX4fhZVX3/25i7FrbWApZo35T5p1rzS7zuv/7U9dd3Uj8wweuFFDD2HcEv6dR2 y5eRapXaZ0BXC/J7NGRIfbXyrDpzezm/WDsFLOGLxsOeNV3AEv63uFihVUw7mHtC+JZdwPTT wVPPK/sdsPWBE+x9BaxfCfFLMYUWZlSP/nWJGD1++lXrk7je3JVoL6qAL3ExonNb5SL+XVn/ +uydlPnXVgFL+PPxsGdDKGAt4PA7qPgKtD1c7wv4TjMPEvHbgh4E8We7ROsCfXydBSxhy3dm ofukeojhkRZWibYunZ8GunzNx8Fa1dVYIEN77gWMLZ9N1jYLx7FtUrz1Sznq8XOS84llFzA5 toDqc0b1GRo9dPaXHMsuYImYfDw8uK9EnJ7o8f1mLWCNSbXmdShaflg/B5yEbXABS8RoR/BP z4jzzN0Qdj154+P07G302TyK0djUn3ETuoQ+0dKHwq/1yr5PVMA6EPnlmDl6Hz2ZFD2xlFDM 8y1lLWy6hE0xQwvYT8xFBZwvQDnHXFOJfvkMdmP4QDu/MhmK7oicYGkq0dZ20I8M6Imuo6L6 nDDk0NF/mfMq4Gg8LF5sIb0iVv9w6jdrAc+Cxmv7WbpKtKcqYIk4PSbpzwjhJS02LeH04+bl oKKub9e0iZgdwI+VJwo4Cd+bIH/CaAjafuED79j1w3spbmgB+9t2jQKmrZ8V8t+1Zt47V1S1 Sf2gdQUXr/0vzMzC8yyVcunWpQr4Cjg6qs8JQw4d94V0FO0rYB19HmGuThEXjYcH9ZWIPRrS 0W6aAr7G+iyHxtGbti/g483cK2L1W2A+rx6Of6C5a2HzO/Qs6OGSE2BjS9krYvWjeKl/awFL +LXS6pMQ/YBezm2gNcit94/xbQ/pCmVoAe8C6cGEvID9mmYdKI8010yivx/WiHr/4/VzwB/8 pqVeFcfr9aAhkB7TXB/V54QhxxJpA2nav/4dqCRsmllVIWnDdG7oXNZX0/Z6omXqSxr6aKym gnyVmXpF7G5wC0Rf3hC0prv+QTuJtg5Esl8Ig34PLIl4FYr66xcqXmDmCeF7Luh/1fiwj+tB ZyTtAHtbiqlFX81XfAJaf/LHiziduXWg+ADoIX6N7bXmW5fap8H+FtorYpXrHXCdmXpFrM60 74WrzVSJtm5XXgf6HJ0LZ4aKPLqvreGKvp/GVSdt/ZDf1RBtmz7qS3Jea8JP2/A4eFxYn5Gx UCiMg9BYKBTGQWgsFArjIDQWCoVxEBoLhcI4CI2FQmEchMZCoTAOQmOhUBgDS+v+D2vnVhiS dnwbAAAAAElFTkSuQmCC --------------1DFDB6432BAEC8BDB5A350C2 Content-Type: image/png Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAV4AAABGCAYAAACE2fxYAAAAGXRFWHRTb2Z0d2FyZQBBZG9i ZSBJbWFnZVJlYWR5ccllPAAAA3hpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tl dCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1l dGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUu Ni1jMTExIDc5LjE1ODMyNSwgMjAxNS8wOS8xMC0wMToxMDoyMCAgICAgICAgIj4gPHJkZjpS REYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgt bnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6 Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRv YmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9u cy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRp ZDoyYzBmYTYyNi04ZjJiLTRlZGUtYmU2Yy01ZmExYWJhOTMxOWMiIHhtcE1NOkRvY3VtZW50 SUQ9InhtcC5kaWQ6RDhDM0YyRkE4N0YwMTFFNkFBMzM5NDUxNUJDNzM3QjYiIHhtcE1NOklu c3RhbmNlSUQ9InhtcC5paWQ6RDhDM0YyRjk4N0YwMTFFNkFBMzM5NDUxNUJDNzM3QjYiIHht cDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENDIDIwMTUgKE1hY2ludG9zaCkiPiA8 eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo5M2MxOTdiNi1i MjFiLTRkYTQtYmIwMy05ZGRhMTgwM2RlOGEiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6 MmMwZmE2MjYtOGYyYi00ZWRlLWJlNmMtNWZhMWFiYTkzMTljIi8+IDwvcmRmOkRlc2NyaXB0 aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+o9UV+AAA EfBJREFUeF7tnWmsXVUVx8EpcYhDYvygHzRq4sRUagsVqRWqoEXAoQEqSkHFCQ2KYoQAjoAj iIiiggTRDwTRmChGYwVHVERAVECKEBW1tO91oMNrX992/Tf7f1x33XXOve/13Z53L2snv7yz 17DPtPf/7rvvufftkVIKgiAIdiOuMQiCIBgcrjEIgiAYHK4xCIIgGByuMQiCIBgcrjEIgiAY HK4xCIIgGByuMQiCIBgcrjEYXZ539X0JWHsQBLsP1xiMLiG8QdA+rjEYXUJ4g6B9XGMwuoTw BkH7uMZgdAnhDYL2cY3B6BLCGwTt4xqD0SWENwjaxzUGo0sIbxC0j2sMRpcQ3iBoH9fosc8L 9ko1/HCPmiK+c02s5lklrCpie7pwtbC+xNQxKdwqHFNSO4rYv1fi+oFtnVDSO4rYLyxx5HvF 1VHEfq+JW1lcfRWJt/vpC3ufehHCGwTt4xo9vEGveHrRj6qIbU/h3yrG0iG8Un+M8Bfl75ej ShNVEdt0hFfjtRXC24C0NQosF3BdxpTt6mKDD/X5pX5TqU+XDwm7kj8odvW8Bo13byq8PjkM uEYPb9ArTir6URWx7WtiLFZ4TzD+frmlNFEVsc1UeG8oTVRFbCG8guRwgI4ZO8HAhZ9CNUzM pvBSYJHv2XeHwD1bOF/A/gj2i2OwsSG8LeAaPbxBr7im6EdVxHa6ibFY4cUSg/ZDyE4WVhou F3QceEZpJhepW+G9RlhieIXwfUHHbSpNVEVsbQnvzYI99y68e9WEdNY8EK29F5IzysLrMazC S6GqA/t/isD4uS68jei+OEy4Rg8Z5FoUwCa1jTXZRxUNyUXqq5R/h9omVnj/avznFFdHEfsT TRx4VXHnInUrvBcWV0cR+woTJ1eks4itLeF192OLd6+akM6aB6C190JyQngfqs9l4eUxgp+U On3Y/2qBPpsTwrsbcY0eRhTABaa+uGgBYh8nTCjfZ9Q2scK7zfjdD7tQxLfOxL6zuHKRer/C u9zETRZXVcQWwitIzkyFFwMebxPzfgUMeh1DQfLEAEJBG6BwaEHRUCzRJm1sXwsh3orr9jlL 1OIzE+G1b+8B3yLzOJB/ssBrgmOw1wwz0ksF3YY+pzpwDRGvr6UG58391p2Xdz+YCzuOF8dX 9YeyzfuPv6gjnscD9PXXuWhLx+G89YzcuzcA7XddI9Uv0QbvIfNP1n23TVyjhxEFgLfrun5e 0QLELjO+xaYOrPBa/9HF1VXEZ0Xu1OLKRer9Cu9pJu6m4qqK2EJ4BcnhYOmFFhE9oCwQH8Zh 0ADWOfgB21ta6nYAahijRYPHwEEOG9uHUKLuDe5BCS/qXgyPDX+xDxsDIDR6fxa2jWP1/IBi xba882I7EDfa7DXT4skXRIK6tQEv1ztXijtivXujX0Asl5b+Wtf3ltu+3Qau0cOIAniUMK7q 1Ydcsn2RsmN2+khVJ5Xwyra3fHBYcXcV8d1mYj9SXLlI3QrvP4XrDb8VtgqM2SkcWZqoitja Et4tAtr0uK2kufeqCXZAa++F5HCw9IJCRRHCIKINUNAwcDi4aKMY60FLgeDAx1+25cFcDE7A dgDb56CEUKM+W8ILeJzI9+y6Te5X2xinRRbnQYHSYqjR58rr6mGPzzsv3jt9rXldEa/zgBZU CiLas/cXbdhc3AststwP981rpI+P1yLnlv7J3GeXenW8pY57n0V5LuAaPWSwH63BoJe/3xa0 WOQPueTvncp2ZbHpOKCF96nGB5YUd1cR3y0m9tziykXqVnh7gfYWlfSOIva2hLeJ9SXNvVdN lM4om76/DnTgktvvUgPremZLOCgYixjUITbcD7YRh4Gsc+qEhyCP+6XI8C8GKgUK7THHG9yD El6bz+tEoambqRHvehKKHl9QPHh97OxTH5e9Rl5M1R+UDfC68XwA34kwti4X6HuFur03EGnU QRZZD/FhH8hBO+d7MW3iGj1ksD9Lg0Evf48VtCC8VYBf25aXWG0Dc0l4AZ4ieG5poipiC+EV JKcaLMZOKCAzEV6AQQg428Jg5SC0g7EJvdyAY+DgRh3buk3mzCXhZb0OfdwWnCNi6q4TBBXX ADG9zovnj+vpzYDrxNMTXhtblwt4nXgO9t70JbykxOP4kY828wy5bVyjhx38GPTy98mCfmLh WgGPgLGOD9ieWGJpI1p4n2R8YDaXGrzHyQ4VrhB03Fx6jrfpcbIVJc29V01Ix8ud1tp7ITnV YDF2QsHggOZghcjSBjgwMej4FtPa7UwLNvxtEh0N8plDAeSAph1tM94ObsDj6SVQFisc1m7z ed14brxuPG6A64T24KPNgy863L8+R7TPFzx9bHXnxbbsOw+i742287rxfLxY1kEWQwF2XGse I/O9e8NrhlwuLaBN5OY1XPmLmGqmi20ht0tbm7hGDxnsWhSy8KLI9ipl3yhg/ZT1H5ewrnyh El4Ux787PlxbZOLAk4s7F6m3Jbzufmzx7lUTpfPJpu+vQ3KqwWPshINBiyxtHjoOcIABLTBs A4NWC3UTHGR6P8il6KJNHe8N7pkKL5dNCOP7FV4cJ20WLZh12P1btNCBpvPSxwEB1r6qPygb mI7wok6h1cCmxRg2fXx65m7BcaL9Ov/ICO+p1qc4pYR15QtWeNt4nOyFJg68qLhzkXoIryA5 1WAxdsJBSqEiEEE9CDDw0ZaOIYzTfgpWP6JDOFvDANZ2tAG7FgUwm8ILuB9AwepXeIl+8fD8 TUCYuJZLsB+vjabz0iKOa6p9VX9QNjBd4cWx6uuFfP3C4N0bgDzui23Zx8n0Nejwt41r9DCi oIX3OdaneGYJ68oXrPC28QWKA0wceH5x5yL1EN4GpK1g9ICo4S+F176A7Sp1oj1tvD45DLhG DyMKlfCiSP3P1i/cWty5OH4rvPYrw/cI7xDs+qb3leGOH+mRej9rvEsFr62nlWZykfpMhReP 1HU8CWJYVlJzkbrdDx538/I68O5VE9JZQ3iDXnAWTqYz2+6HEF7P6CGDXIuCFd7zrV/4eHHn 4vit8M6FH8lZXZqoithmKry9qJ5MQJG63U9f2PvUC+msIbxBE/atv15vny1CeD2jhx3wRS9y kfpB1i8sLO5cHL8V3pn+LGTXh3Bim6nwer+yFsLbgB4EQbC78frkMOAaPWSQ44dwKope5CL1 Rwj6SxO3C3sWdy7KRzqEF0VszxDwSBqejrDxGnzLDMsbbyypHUXs0xFetIUfQj+xpHcUsYfw NqAHQRDsbrw+OQy4Ro9eRUQAP3yO53o7HsdioU/xiOJyi/gfbeLJE0pIbZGYx5ucOvIzxk1F Yh5rch5fXB1F7PjQT8f14kklNRep2/30hXevmpDOGsIbjAxenxwGXKNHlLlZvHvVhHTWEN5g ZPD65DDgGj2izM3i3asmpLMOWnj5wQnQz2MGwazj9clhwDV6RJmbxbtXTUhnnbHwSp59KB3g IXaILQfDsAovPmHX50W8LxYA+8UQbHtPAOBZWP14FrZhs3HBDPD66TDgGj3W7LP/9Q8nbtx7 3m/nvWCvX+zT/XOScwrvXjUhnTULgLX3QnIgot7XOwnFZBiFF8epz0XjfWOq6TrAxy8g4PlX LwaE+M4CXl8dBlyjh4hRejjxm73nuU8RzDXsfeqFdNY88K29F5Kjv8XEHybhDBg2iuwwCi+E EsdbN7slOB+KLmL116Oxjedf8Q6ANs6Ktcjya66IpS2YIbafDguu0cMTp13lgQUHpnWHH5HW Hf36tPbQw9yYtqgT3sUvOTiddMKJ6ZCDl7h+8Lojj84x2H7ziuPz9oJ587viFuw3P/uOW35s OmjhorxdxyuWHNqVD+x96oV01iyK1t4LyaHw/sTYLVp48f1+/TbbfgPKe7tuY+hHu3qZA8IF m44FyNdtIsfGWHjMWjQ9OIPVLzS94OyX8LcHQnhnAd0XhwnX6GGFaeL6G9L22/7UYQPbf39T mtqyJa1dfEiHffNXvpp2/vs/IraLstBO/PrGlCYn09SmTWnnf/+b0vbtaef4+rT5sm+kNfsv fCjny/jB+O4ytXFj2nLVt6u2d9xxZ45l3bLxrHNK5v/L1MREmrz33rT5a5elNfMP6MqpE95T T3lvzj/rjDNdP1j101U5BtsXXfCFvH3Vld/sirvi8m9k3yc/9oksrk3l0+d9qisfSHHvVx3S WbMgWXsvJEfP9iBQ+QdH5K9FC68WQMJZItrz/ECLL2P0t6k0+sdbOJu09JrJ8kd17PHYNVse g31x6BecO1+I7I/OBDPA9tNhwTV6WGEae+3ylHbuTBtOfX9lGz/pbVl0J1evfkhAix0iDDsE cM28BWny/vvTxM9/mda+8lVVDOzr3/WeNPXg5vTgxZdkG8R0x9/uTg8c9LKKtS9fmjaeebYc UsoCjrh+hVe3s+6wZWnD+z6Qdo6Npc1XXNmVM1vCu99e+6Rbb7k1TU1NpZXHv7mKwUx4p1y/ X/3il2nfF+5dCe/nPv3ZdPjSV3ZxwP4LqlyNFPd+1SGdNYuKtfeD5EEsIUYUJgAh0W+ltfBS uPS6qBYz2ghFSc8GKYbwcYaL9iiCjKV4oq5no4xrWlNlroc+Fh6vXmLQ50vszFm3j/PneQS7 iNdPhwHX6GGFCWy99rtpx913pzX7vTjXt9/8xyy4EGM9693yzW+lHXf9LcdlwZYydsyKjrYI 2tz+h5vzNsQUs9Kx5cdVjL9pZRZmlLWHvTrH9Su8nm/z1y9Pk/f8vcs+W8ILjjh8Wdq6dWu6 77770sJ5L85ge8OGDWnpkkNyTK8ZL/xsTyPFvV91SGfNAmDtM0HagYhQLDkL1EKkBZCCTVFi 3QNtMo/Ca2eIFDP4UecyQB29lhxw3FpQIdR23/Zcmaf3A6zwcg15pjPloAavXw4DrtHDChNY u/TwNLVtIm0846y0/p2n/F9s950vYnhH2nLlVVkcEbP+3e/JOVjTRUG8bQ9sE9GakFkgtiGm aceOPEMGmGGjbP/jLWnDh8+scnZFeLd+R148/vyXLvtsCi/AcgIKlhwAyoc+cHrlp/B+6YsX p+WvfUMXB85f2NEekeLerzqks2ZxsPZ+kLyu/9AqNgogZoOo9yu8nD1qMfI+5OpXeJuEHFgx tHizUAotBZniznO1IK6ffQWzhO2Pw4Jr9LDCRLBGOvmPf6Ydt9/esbyQZ70iuNtW/Sxt/93v O3ImfnNjXu/d9Ilz09hxb3poJvvWt+eZsbwnTxtOOz3HQUwhqswbe8MxeT+Tq+/Jyxq0Iwb7 gcBaHjh4Sf6L0uH76MfT1muuzevMG8/+SNUW6SW84+Pj6f5//auDu+68K8d4wovlBCwrYMkB /OiH13X4Kbxeu+DsM8/qiCdS3PtVh3TWLETW3gvJoejgrXf+z63Fzg+8piu8FFTvE39PeGGj OHpLDRQ91OFnPvarlws8eGz6RYAfJgK2h/PhCwaOR8+Q4ePxh/DuJnQfHSZco4cVJoL1UnxQ BnHt+EBNZr3brvtR/rBt7Ng3duYsODA9+PkLswBjKQGz2SyeP7gujb/l5CoOAomlB52L5YpN 530qtws/bHl5Quoe6444Ks+urR1CjQ/oxle+pbP9Qp3wHrXsNenLF1/icuHnL8gxp5/2wVy3 uVhWYOziRS/t8GEdlz6P449d0RFP7H3qhXTWLCbW3gvJgShRBD0oWv0KrzdD1aLGPO6TPoue CVP4LMjVYmypywN2iQLn13QdgBZwwBct5Gl7sIt4fXUYcI0enjiNMnXCO9ew96kX0lmzOFh7 P0gehBSCqYUHIln34VqT8AIteJiVcvnAE160a+M5A9ZA5LRII0cfRx04B7TJPLRhBZR41wHA 5gl8CO+A8PrpMOAaPTxxGmVCePtDD4IBoYXX8wcPY7w+OQy4xmB0kc4awhuMDF6fHAZcYzC6 SGcN4Q1GBq9PDgOuMRhdpLPOqvAGQTB9XGMwuoTwBkH7uMZgdAnhDYL2cY3B6BLCGwTt4xqD 0SWENwjaxzUGo0sIbxC0j2sMRpcQ3iBoH9cYjC4hvEHQPq4xGF1CeIOgfVxjMLqE8AZB+7jG IAiCYHC4xiAIgmBwuMYgCIJgcLjGIAiCYHC4xiAIgmBwuMYgCIJgcLjGIAiCYHC4xiAIgmBQ pD3+B5c6KFEBXzslAAAAAElFTkSuQmCC --------------1DFDB6432BAEC8BDB5A350C2-- --------------8EFEEF47E92DE991622D6CE8-- From nobody Mon Nov 28 15:54:08 2016 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EB0512A144; Mon, 28 Nov 2016 15:54:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.398 X-Spam-Level: X-Spam-Status: No, score=-3.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cSHKz6TVyFP3; Mon, 28 Nov 2016 15:54:05 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A792612A133; Mon, 28 Nov 2016 15:54:04 -0800 (PST) Received: from hebrews (24.21.96.37) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 28 Nov 2016 16:11:36 -0800 From: Jim Schaad To: Date: Mon, 28 Nov 2016 15:53:55 -0800 Message-ID: <067a01d249d2$af67c920$0e375b60$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdJJMkg4vjO2KzKmRbmwFxCh+j2Dog== Content-Language: en-us X-Originating-IP: [24.21.96.37] Archived-At: Cc: ace@ietf.org Subject: [Ace] Comments on draft-selander-ace-cose-ecdhe-04 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Nov 2016 23:54:07 -0000 Here is a large number of comments on the draft. Some are technical and some are just editorial. I have gone through this list, in part, with Francesca once. Significant portions of the document are not reviewed either because they seemed to be similar to others or I just did not worry about them. * Use SIGMA-I for both the asym and sym version of the protocol. This is going to make the two versions more alike which makes implementation easier as well as protecting the id values which are sent in the symmetric key variant. The key id may or may not leak any useful information, but long term ids sent in the message definitely does. * The use of the words 'unique' and 'uniquely' are highly problematical and need to be justified at any location where they are being used. The problem is going to be that 1) if the identifier is really short (and thus reduces the transmission size) then collisions are going to be likely and 2) the entity that can check for a collision is not usually going to be the one that issues the identity and thus there is no way for enforcement of the requirement of uniqueness. The only possible place where I can think that uniqueness is going to be an issue is for the shared key identifiers. * Consider case where rather than sending an encrypted CWT access token rather than a shared secret identifier. (Maybe also for the asymmetric key identifier? I have not thought this case through.) * The current protocol description assumes that the signature algorithm is going to be the same for both entities. There is no reason to assume this always going to be true. The negotiation should be a set of algorithms that the party understands rather than attempting to agree on a single common one. This means that Sig_Arr would be sent both directions and would be a list of acceptable algorithms. * I am not sure that the following is a good idea or not, do you want to save message bytes for the case of only a default algorithm is listed, in which case the array of algorithms could be omitted. * Section 4.1.1 - Reverse the order of the fields SIG_arr and MAC_arr in alg_arr so that the same indexes can be used for both the symmetric and asymmetric cases. * Section 4.1.1 & 5.1.1 - Problem in that the same message names are used but the contents are not the same. Merge the definitions together so that there is only one. * Section 4.1.2 - I would like to see if we can get rid of the nonce-array element. -- In message #2 asym - these can be moved to the PartyU_nonce and PartyV_nonce fields in the recipient structure. -- In message #3 asym - This would be both identification and replay detection. Putting PartyV_nonce in the kid would work for identification, I am not sure what replay detection you are looking for but combining the nonce and the authentication tag might be a better detection than the pair of nonce values. * Section 4.2.1 - You should be using ECDH-SS rather than -ES for the algorithm. This is really using short lived static keys rather than ephemeral keys from the perspective of the COSE messaging structure. The key is being used in more than one message and thus COSE does not view this as a pure ephemeral. * Section 4.2.1 - The tag "E_V" should be "static key" (-2) * Section 4.2.3 - in pay1_3_rpk, ID_V should be ID_U. Same issue for C_V in pay1_3_cert * Section 4.2.3 - combine pay1_3_rpk and pay1_3_cert into a single structure with an alternative option "ID_U: bstr / C_U:bstr" in the last line as the only difference is where the content comes from and not the structure of the array. * Section 4.3 - Change the way that PartyUInfo and PartyVInfo are filled out as follows: - PartyUInfo SHALL contain: nonce shall be equal to N_U when deriving keys K_U* and N_V when deriving keys K_V* - PartyVInfo SHALL contain: nonce shall be equal to N_V when deriving keys K_U* and N_V when deriving keys K_U* * Section 4.3 - for SuppPubInfo, I do not think that you need to do the hash of the field rather than just using the raw field for the 'other'. With the above change, the strings "PartyU" and "PartyV" are not needed. * If this is going to be used, then Appendix B should be part of the main document. * Appendix B - Is there only a single address that this would be posted to? Why not post to uri-path: "resource-name/edhoc/" * Appendix B - how do I combine this with an authentication tag. * Appendix B - how do I combine this with an OSCON rather than an OSCOAP message? * Appendix B - how does the OSCOAP post know which location to link to if there are multiple possible outstanding edhoc destinations or sessions? Editorial: Section 1 - You need to be consistent about the term 'pre-shared key' vs 'pre-shared secret'. In many times a 'key' is going to be considered to be of a specific length and potentially attached to an algorithm while a 'secret' can be a variable length item and is probably what you are thinking about. Section 1 - s/either pre-shared keys, raw public keys, or X.509 certificates/either a pre-shared secret, a raw public key or an X.509 certificate/ - use singular on these as only one of these is used for a single set of messages. Section 2 - The working appears to say that the overview is coming in three different sections (2, 4.3 and 5.3). The overview should be in one place. I don't know if this is a document organization or merely a sentence punctuation problem. Section 2 - In the paragraph starting /ECHOC is build on/ You should say that "We defined two varieties of ECDHOC one using Async key s for authentication and one using symmetric secrets for authentication" Section 2 - s/MAC:ed/MACed/ Section 2 - para /ECDHOC is build on/ It is not clear which document 'Section 5' is referring to sentence re-write is called for Section 2 - The paragraph starting /EDHOC used with symmetric keys/ looks like it should be divided in two parts one before Figure 1 and one before Figure 2 in the current text. Otherwise it is not clear what these apply too. If the change to SIGMA-I is done then this may be less of an issue. Section 2 - You are stating that you have a symmetric key case, but the pictures do not reflect this as they are all using Sig(V: as a function. This change should also discuss how using MAC(Ka: affects the security levels of the document. Needs to talk about the fact that this is a lesser authentication and depends on the fact that Ka is going to be shared between only two parties and reflection is a potential problem. Not sure how I would exploit this attack right now. Section 5.1.1 - Swap the order of KID and ALG_U - while these are maps, making them the same order helps for doing comparisions Section 5.1.1 - Place the shared secret in as the salt for the KDF done by the ECDH-SS algorithm rather than having the kid_psk in the unprotected header field. Still may need to do an id of it some place but move up to the recipient field to do so. Section 5.1.1 - Is there a reason to make the MAC algorithm for the innermost and outermost MACs be the same esp if the PSK already specifies a MAC alg to use. Section 5.1.2 - Swap order of KID and ID_V in pay1_2_psk to match the asym case. Section 5.1.2 - why specify ALG_V for the psk but not for the asym payload? Section 5.1.2 - what is the value of doing the authentication on the psk identifier? This is not a security based item and you should have failed long before now if you did not get the correct key. Section 5.1.3 - in pay1_3_psk - s/ID_V/ID_U/ Section 5.2 - See comment on swapping the nonce values from above Section 5.2 - Do I have access to the ID_V field at the correct time? Does adding this add any value and if not why include it. It is not part of the asym key derivations. Section 2 - last sentence is redundant. Section 3 - Move all MTI statements to a single section where it is clear that all required algorithms are given one or more MTIs. You might need to specify more than one if you want to have fail over on an algorithm breakage. Section 3- The definition on how to form keys is targeted at one key type. I would make this more general so that it can apply to multiple key types. Example text might be: COSE keys used as ephemeral keys should contain only the minimal elements for interoperability. This means that labels such as 'alg' are not present. When multiple values of a field can be used, the shorter version SHOULD be used. Thus, for 'EC2' keys, the value of 'y' SHOULD be a Boolean rather than a binary string. Section 4 - sentence s/Subsequent traffic .../ You should be clear what subsequent traffic you are talking about here. Is this traffic in the EDHOC protocol or in the protocols that are going to use the established keys? Section 4 - I would like to suggest the following reorg for the document Section X - Message #X - overview of what the message is going to accomplish - where it maps in the SIGMA-I protocol Section X.1 - Message structure - The CDDL description for the message Section X.2 - Message creation - Section X.2.1 - For Async - Section X.2.2 - For sync - use these two sections iff the differences are large Section X.3 - Message Processing Party->Message #X Section X.4 - Message Processing Message #X --> Party Again .3 and .4 can have subsections if the differences are large I would put the two key derivations (Section 5) steps as Section 5.1 and 5.2 (in protocol and post protocol) Section 4.1.1 - I would add a note just to be explicit - that Message 1 does not have any security applied to it and note that the fields will be validated later. Section 4.3.4 - s/COSE_MAC0 is computed/COSE_CMAC0 is re-constructed/ Section 4.3.4 - /verify that the nonce has not/ which nonce is being referred to in this item Section 5 - What is the purpose of having the ID_U and ID_V fields for symmetric keys. This makes sense for asym because it is used to identify which public keys are being used. That is not done for the sym case. What type of info should go here? Section 5 - Need to talk about how to go from shared secret to K_VMP someplace. I am not sure that the OSCOAP key derivation technique is always correct esp of these PSK is a key rather than a secret. Section 7 - The last paragraph appears to me to be a vacuous statement. I don't know what steps to take to deal with this issue. Future Items: * Chaining the shared secret based on a successful running of the EDHOC algorithm. * Discussions of a server using the same ephemeral key for multiple runs of the protocol. Affects the PFS property, but this may be acceptable if the window is small (i.e. a couple of hours). * Rules on replay of messages seems to be needed. These rules may need to be modified by the difference between a reliable and an un-reliable transport.