From nobody Thu May 2 07:03:19 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55ADC1203A3 for ; Thu, 2 May 2019 07:03:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XSYN8-8dxDXj for ; Thu, 2 May 2019 07:03:07 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04on0600.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0e::600]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C8BA120387 for ; Thu, 2 May 2019 07:03:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GiUduhbuHUzlxkYLOIJuOaGAGdhAuu3Cmznoh0vsM2I=; b=ZoRzglC92BZZJ7VtLQsJni1cV8BMeqTUGaIY5RIvtG1xmNx54BqMXn/TnBW73NiZCpUdFF95DVz8a3M5RTZW0IvXOYWUko+myjjReD3t6VEvOVjVUD9AD3NkMUvGFGeJS1lUniJfb48Q9mU1simJbv0Ndb3sjZbRfjNf5LgN0EY= Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com (10.168.185.17) by HE1PR0701MB2636.eurprd07.prod.outlook.com (10.168.187.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.7; Thu, 2 May 2019 14:03:04 +0000 Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::2130:5ad6:fafb:c4c8]) by HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::2130:5ad6:fafb:c4c8%8]) with mapi id 15.20.1856.008; Thu, 2 May 2019 14:03:04 +0000 From: Francesca Palombini To: "ace@ietf.org" Thread-Topic: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile Thread-Index: AdT5MOoRmSih6TN6QsqUY7eFmxsJIAAbjGYAAdhaoAA= Date: Thu, 2 May 2019 14:03:04 +0000 Message-ID: <23E5C70D-4374-4970-8B56-391D19506B43@ericsson.com> References: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> <174d13cf-a48d-5e66-fbcb-0b05c1207790@ri.se> In-Reply-To: <174d13cf-a48d-5e66-fbcb-0b05c1207790@ri.se> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 796fe07e-ab99-4a69-0b8c-08d6cf06e587 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:HE1PR0701MB2636; x-ms-traffictypediagnostic: HE1PR0701MB2636: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0025434D2D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(366004)(346002)(136003)(396003)(199004)(189003)(186003)(1730700003)(14444005)(316002)(81156014)(446003)(81166006)(256004)(2616005)(26005)(11346002)(14454004)(6306002)(4744005)(486006)(6512007)(86362001)(478600001)(3846002)(6116002)(44832011)(8676002)(99286004)(25786009)(966005)(36756003)(71200400001)(71190400001)(6246003)(83716004)(5660300002)(2351001)(53936002)(6916009)(33656002)(7736002)(76176011)(6506007)(53546011)(2906002)(76116006)(82746002)(6436002)(476003)(66066001)(68736007)(229853002)(2501003)(66446008)(102836004)(5640700003)(66946007)(66556008)(64756008)(305945005)(73956011)(66476007)(6486002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2636; H:HE1PR0701MB2746.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ZujvbHShpdIbqzfr7yO6rPMjj6R1ZGA2LrlTeA4Gi5XvNswDn2IzARlxtUV9G+9bVWV3Ugj0B2FT+TKYLNeEgs7OFm5LvoiVBYcfaT1SEKmDnTJVJyFJ1nTKvHRWq5bf5w+s7+76QIXH0fVj8q9mC6FNyrG8rexQbmr2mi2LDZYO5+afu4x8rNfFBDlVNcB06XCvv2SGVY4EUHDpL+s8V+pU99pmtQttdzlCj6HUIfLPUb5L6I5UYgtqemw6pXsJaPC/FVvEJo0z3/cP7oOVzOG7CIK2J1M4K3soH6hDzrpyR1VRVNdgC+7ewhLHM59uG/wvQtbN+hgM3l7BE58nfdb4pyfXJ4ygORQjLxQ3oifWTZ6crPV4NblN2i5h8WRs+o26TiyE+IP9KYrn4GOY9qfspqaqteBOrjZ7O4N0v9o= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 796fe07e-ab99-4a69-0b8c-08d6cf06e587 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 May 2019 14:03:04.6229 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2636 Archived-At: Subject: Re: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 May 2019 14:03:18 -0000 KzENCg0KRnJhbmNlc2NhDQoNCu+7v09uIDIzLzA0LzIwMTksIDA4OjM4LCAiQWNlIG9uIGJlaGFs ZiBvZiBMdWR3aWcgU2VpdHoiIDxhY2UtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgbHVk d2lnLnNlaXR6QHJpLnNlPiB3cm90ZToNCg0KICAgIE9uIDIyLzA0LzIwMTkgMTk6MzIsIEppbSBT Y2hhYWQgd3JvdGU6DQogICAgPiBBdCB0aGUgbWVldGluZyBpbiBQcmFndWUgdGhlcmUgd2FzIHNv bWUgZGlzY3Vzc2lvbiBhYm91dCBhZG9wdGluZw0KICAgID4gaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvZHJhZnQtc2VuZ3VsLWFjZS1tcXR0LXRscy1wcm9maWxlLyBhcyBhDQogICAg PiB3b3JraW5nIGdyb3VwIGRvY3VtZW50LiAgVGhlIG92ZXJhbGwgc2Vuc2Ugb2YgdGhlIHJvb20g d2FzIHRoYXQgdGhpcyBzaG91bGQNCiAgICA+IGJlIGRvbmUuICBUaGlzIG1lc3NhZ2Ugc3RhcnRz IGEgMiB3ZWVrIGFkb3B0aW9uIGNhbGwgZm9yIHRoZSBkb2N1bWVudC4gIElmDQogICAgPiB5b3Ug aGF2ZSBzdHJvbmcgZmVlbGluZ3Mgb25lIHdheSBvciB0aGUgb3RoZXIgYWJvdXQgYWRvcHRpbmcg dGhpcyBkb2N1bWVudA0KICAgID4gcGxlYXNlIGxldCB1cyBrbm93LiAgUmVhc29ucyBmb3IgeW91 ciBwb3NpdGlvbiBhcmUgYXBwcmVjaWF0ZWQuDQogICAgPiANCiAgICA+IEFDRSBDaGFpcnMNCiAg ICA+IA0KICAgID4gSmltICYgRGFuaWVsDQogICAgPiANCiAgICANCiAgICBJIHN1cHBvcnQgYWRv cHRpb24gb2YgdGhpcyBkcmFmdC4NCiAgICANCiAgICBUaGUgcmVhc29uIGlzIHRoYXQgTVFUVCBp cyBhIHZlcnkgcG9wdWxhciBwcm90b2NvbCBpbiBzZW5zb3IgbmV0d29ya3MsIA0KICAgIGFuZCB0 aHVzIEFDRSB3b3VsZCBiZSB2ZXJ5IG11Y2ggbGVzcyByZWxldmFudCBpZiB3ZSBkaWRuJ3Qgd29y ayBvbiBhIA0KICAgIHNvbHV0aW9uIGZvciBNUVRUIGFzIHdlbGwuDQogICAgDQogICAgUmVnYXJk cywNCiAgICANCiAgICBMdWR3aWcNCiAgICANCiAgICANCiAgICANCiAgICAtLSANCiAgICBMdWR3 aWcgU2VpdHosIFBoRA0KICAgIFNlY3VyaXR5IExhYiwgUklTRQ0KICAgIFBob25lICs0NigwKTcw LTM0OSA5MiA1MQ0KICAgIA0KICAgIA0KDQo= From nobody Thu May 2 11:23:39 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7CB8120099 for ; Thu, 2 May 2019 11:23:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I6Fe5CQJClDN for ; Thu, 2 May 2019 11:23:35 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on061d.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1f::61d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA927120075 for ; Thu, 2 May 2019 11:23:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-ri-se; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G0tCT7SuKhiJfO2rhB5uZvxgK8OulFHsFrk/Z5CDxpI=; b=WIy4K/vYRsSuDF8U1RT92yLDWGKodMfxHiTSl7OpHis9A3qR1qqkYBmioY9NAco5mci3FIAwPDic9J5+ZJ9Rn2Pn5AdptaOaRW230jt4qtSKCTntQh3jeLHvfs+gtYJVVMKdG+5F5vJnR3GZAiRrpuOfzD7AY4yr1zqDx5RL8uo= Received: from DB6P189CA0033.EURP189.PROD.OUTLOOK.COM (2603:10a6:6:2e::46) by AM5P189MB0322.EURP189.PROD.OUTLOOK.COM (2603:10a6:206:20::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.10; Thu, 2 May 2019 18:23:32 +0000 Received: from VE1EUR02FT043.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::205) by DB6P189CA0033.outlook.office365.com (2603:10a6:6:2e::46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.11 via Frontend Transport; Thu, 2 May 2019 18:23:32 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT043.mail.protection.outlook.com (10.152.13.89) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.1856.11 via Frontend Transport; Thu, 2 May 2019 18:23:31 +0000 Received: from [10.8.2.14] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 2 May 2019 20:23:31 +0200 To: References: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> <174d13cf-a48d-5e66-fbcb-0b05c1207790@ri.se> <23E5C70D-4374-4970-8B56-391D19506B43@ericsson.com> From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: Date: Thu, 2 May 2019 20:23:23 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <23E5C70D-4374-4970-8B56-391D19506B43@ericsson.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="l51OeSSTq6KSJ5G3MIDXIFcrHVdrkLCh5" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-2.sp.se (10.100.0.162) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(376002)(136003)(39860400002)(396003)(346002)(2980300002)(189003)(199004)(8936002)(65956001)(66574012)(65806001)(2616005)(6246003)(21480400003)(44832011)(53936002)(229853002)(486006)(14444005)(5024004)(31686004)(74482002)(106002)(6916009)(16586007)(86362001)(16576012)(6306002)(31696002)(58126008)(81156014)(65826007)(81166006)(8676002)(316002)(76176011)(6116002)(3846002)(33964004)(22746008)(69596002)(22756006)(7736002)(70206006)(305945005)(386003)(5660300002)(70586007)(68736007)(71190400001)(446003)(235185007)(11346002)(126002)(476003)(336012)(84326002)(568964002)(186003)(64126003)(356004)(26005)(77096007)(478600001)(6666004)(966005)(36756003)(16526019)(40036005)(53546011)(2351001)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5P189MB0322; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 29bb598c-ca15-4ce5-1084-08d6cf2b4817 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4709054)(2017052603328)(7193020); SRVR:AM5P189MB0322; X-MS-TrafficTypeDiagnostic: AM5P189MB0322: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 0025434D2D X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: PwgMUmITWXXevEiuoYlBQdOa3inO5z13nxadhWls+kkT/XRXf89LGd/GWkg2vAgDapwIgsJank1DwbcZoEF3eaG35DIcCeRMp4/OxtvQQIgNvTCuv0JEsNCBX7WSQgOK2vKMW34CXsvHJT3Z7bnuiGUkT/wo3cbliJ4ER4ItHF9/h4VBejt50HuS3UhDfrDaAseeb07Sdl9lRUiBmrJKUCRhj6fxWIRu1pcQVnGuvidZ331+8JKhFTvl5eba2MK8xAmqz0DP1qHqKEqwmUl1vMEju+xf3x+a0dx1qOYTr08FyihFh2UaVPH4EqoNO/pEBxqw+tReQHJuzFDXdbNStAQQJs25s9H/arTkGRDJaltskfEd/FyYOkGzZGKMFXnDDVDwLR36SZiosG6rFw29Nlv7YjUMa/ESytBhq4ZJzE0= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2019 18:23:31.8567 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 29bb598c-ca15-4ce5-1084-08d6cf2b4817 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P189MB0322 Archived-At: Subject: Re: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 May 2019 18:23:39 -0000 --l51OeSSTq6KSJ5G3MIDXIFcrHVdrkLCh5 Content-Type: multipart/mixed; boundary="HMmdlwq0aEuwrPpLFtKxTm3N4wNwiXRsP"; protected-headers="v1" From: Marco Tiloca To: ace@ietf.org Message-ID: Subject: Re: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile References: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> <174d13cf-a48d-5e66-fbcb-0b05c1207790@ri.se> <23E5C70D-4374-4970-8B56-391D19506B43@ericsson.com> In-Reply-To: <23E5C70D-4374-4970-8B56-391D19506B43@ericsson.com> --HMmdlwq0aEuwrPpLFtKxTm3N4wNwiXRsP Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US +1 for adopting this document. Best, /Marco On 5/2/19 4:03 PM, Francesca Palombini wrote: > +1 > > Francesca > > =EF=BB=BFOn 23/04/2019, 08:38, "Ace on behalf of Ludwig Seitz" wrote: > > On 22/04/2019 19:32, Jim Schaad wrote: > > At the meeting in Prague there was some discussion about adopting= > > https://datatracker.ietf.org/doc/draft-sengul-ace-mqtt-tls-profil= e/ as a > > working group document. The overall sense of the room was that t= his should > > be done. This message starts a 2 week adoption call for the docu= ment. If > > you have strong feelings one way or the other about adopting this= document > > please let us know. Reasons for your position are appreciated. > >=20 > > ACE Chairs > >=20 > > Jim & Daniel > >=20 > =20 > I support adoption of this draft. > =20 > The reason is that MQTT is a very popular protocol in sensor networ= ks,=20 > and thus ACE would be very much less relevant if we didn't work on = a=20 > solution for MQTT as well. > =20 > Regards, > =20 > Ludwig > =20 > =20 > =20 > --=20 > Ludwig Seitz, PhD > Security Lab, RISE > Phone +46(0)70-349 92 51 > =20 > =20 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --HMmdlwq0aEuwrPpLFtKxTm3N4wNwiXRsP-- --l51OeSSTq6KSJ5G3MIDXIFcrHVdrkLCh5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAlzLNaIACgkQ7iZktA5Y 2kP4oAf/XzTgeuJ1nuzPFCv7/+BqyooQUcEpM6CmcRIZHPIL2ZR4tLTveeolIkp2 PDK1orpM3Lc4rXUXOi5H76X+HXD3mETcO0OopCmTaggljkSksTjiD9VR1wr/ZYCq YsMrIqTlJvj6WdtPYrjTplT06+5ywgrOzAuUkBDUW+h/N3UCgqLrqAEp1eTfXkIo b3KGKEAJ4Y7hqi4DFRqsVqn/XEW4pCN2TLypE6PgWmyu55tocteGxLbeT0fdhkDG UJGr/YlQeccWa3+U3qh20RiuXSX/5V5Kck28lK2QaXxJm4AKnf0EdhQKRC+i+YZq buuNd//d4PrDfdmAO9qejbeNcp8NQA== =Bd1B -----END PGP SIGNATURE----- --l51OeSSTq6KSJ5G3MIDXIFcrHVdrkLCh5-- From nobody Tue May 7 01:24:44 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4632612009E; Tue, 7 May 2019 01:24:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ZRK7gdiU8PX; Tue, 7 May 2019 01:24:34 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30082.outbound.protection.outlook.com [40.107.3.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDBEE12001E; Tue, 7 May 2019 01:24:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=teqtRPBWGMnP1rY0Zp55DUP9HsPiOnHRCii2Uel1098=; b=PUNQOvoRTUDL3SA/bVXeVEwM61lJHx5dBJijDU2sxTrsh/SBw3oqWJKU0jK+Tkn2S0t7LR9g6D7s88bpuleBuM+ovyGpbj56qKM+PhHbqFYbdYpZcLsAaFODBUvzDvsKamvQZNzGEpn8Z0Xe0TuGfP6inUeu8ClHIJkopyxI1mE= Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com (10.168.185.17) by HE1PR0701MB2249.eurprd07.prod.outlook.com (10.168.31.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.19; Tue, 7 May 2019 08:24:30 +0000 Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::2130:5ad6:fafb:c4c8]) by HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::2130:5ad6:fafb:c4c8%8]) with mapi id 15.20.1878.019; Tue, 7 May 2019 08:24:30 +0000 From: Francesca Palombini To: "cose@ietf.org" , "core@ietf.org WG" , "cbor@ietf.org" , "Ace@ietf.org" CC: Cose Chairs Wg , "core-chairs@ietf.org" , "cbor-chairs@ietf.org" , "ace-chairs@ietf.org" Thread-Topic: [Cbor] [Ace] Doodle poll for virtual interims Thread-Index: AQHVBK5K4v+s+vwmOEaJ9TA4LL9/TA== Date: Tue, 7 May 2019 08:24:30 +0000 Message-ID: <2101B222-960B-4378-9676-5A68BFE4315A@ericsson.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0b14bdf2-b34a-4b81-74e2-08d6d2c56da2 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:HE1PR0701MB2249; x-ms-traffictypediagnostic: HE1PR0701MB2249: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0030839EEE x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(376002)(366004)(136003)(396003)(199004)(189003)(53754006)(54896002)(66066001)(66574012)(236005)(99286004)(5660300002)(2201001)(14454004)(7736002)(256004)(14444005)(102836004)(478600001)(6486002)(6306002)(6512007)(6506007)(8936002)(790700001)(3846002)(6116002)(606006)(53546011)(6246003)(966005)(53936002)(86362001)(68736007)(2501003)(486006)(73956011)(66946007)(66476007)(66556008)(64756008)(66446008)(76116006)(2616005)(476003)(71190400001)(26005)(33656002)(316002)(8676002)(83716004)(81166006)(4326008)(186003)(81156014)(71200400001)(450100002)(54906003)(36756003)(2906002)(110136005)(25786009)(229853002)(44832011)(82746002)(6436002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2249; H:HE1PR0701MB2746.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: UaZAWx2boEcehQOdBjiGdfmIkO8cK96CGXgKkZqS1w911RLJMnED+4OUb08nDe59/tE+EiH3+wg7VJuc+BqrWkDg+C+vVx3jiX/HDLVYhrTenafrtYu5WY/cnrZNojXVHihkdPnINYaDp2IDDjOPXI8nn/Qd9XwBOqpzgzQW059RrsCTzCvO7d+y2l8NO+8kSSWp9DrpKckE3bFHadWWZdjfUr9VHkhXgkU+sUHgGveoKz6agbjQy2ODFa+0BBd3YxHz1RaahQmf6ksHhGmoweXXr0CMX+2sbCqB/F/8XSm0Hn0U6KmiUeNklN6uwhOjETUI4S6KiYemo9BgmpAqdbs4Njh27Fw3rcp8Kf6VnVejMF3s7A938KiPM8LLCczSMfa6jRCzW3+HwXa7YehFfaaGSplOak68kGkNNMeFA/w= Content-Type: multipart/alternative; boundary="_000_2101B222960B437896765A68BFE4315Aericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0b14bdf2-b34a-4b81-74e2-08d6d2c56da2 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2019 08:24:30.7155 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2249 Archived-At: Subject: Re: [Ace] [Cbor] Doodle poll for virtual interims X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 May 2019 08:24:37 -0000 --_000_2101B222960B437896765A68BFE4315Aericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgYWxsLA0KDQpUaGFuayB5b3UgdG8gdGhvc2UgcGFydGljaXBhdGluZyBpbiB0aGUgZG9vZGxl IHBvbGwsIGFuZCB0aGFua3MgdG8gbHB3YW4gV0cgZm9yIGFkanVzdGluZyB0aGVpciBpbnRlcmlt IHRpbWUgYXJvdW5kIG91ciBwcmVmZXJyZWQgdGltZSEgVGhlIHdpbm5pbmcgdGltZXNsb3QgaXMg dGhlIDE1OjAwIOKAkyAxNjozMCBVVEMuDQoNCkFzIGEgcmVzdWx0LCBDQk9SIFdHIHdpbGwgaGF2 ZSBjb25mZXJlbmNlIGNhbGxzIGV2ZXJ5IG90aGVyIFdlZG5lc2RheSBzdGFydGluZyBNYXkgMjJu ZCwgMTU6MDAgdG8gMTY6MDAgVVRDIDogaHR0cHM6Ly93d3cuZXBvY2hjb252ZXJ0ZXIuY29tL3Rp bWV6b25lcz9xPTE1NTg1MzcyMDAmdHo9RXVyb3BlJTJGQmVybGluDQoNClRoZSBTZWNyZXRhcmlh dCB3aWxsIGFubm91bmNlIHRoZSBjYWxscyBzb29uLCBidXQgaGVyZSBpcyBhIHN1bW1hcnk6DQoN CkRheTogZXZlcnkgb3RoZXIgV2VkbmVzZGF5IGJlZ2lubmluZyBvbiBNYXkgMjJuZA0KRGF0ZXM6 ICAyMiBNYXk7IDUsIDE5IEp1bmU7IDMsIDE3LCAzMSBKdWx5OyAxNCwgMjggQXVnOyAxMSwgMjUg U2VwdDsgOSwgMjMgT2N0OyA2IE5vdg0KVGltZTogMTU6MDAgdG8gMTY6MDAgVVRDIGZvciBhbGwg ZGF0ZXMgZXhjZXB0IDYgTm92OyA2IE5vdjogMTY6MDAg4oCTIDE3OjAwIFVUQw0KDQoqKiBOb3Rl IHRoYXQgbG9jYWwgdGltZSBpbiBOQSB3aWxsIGNoYW5nZSBmb3IgdGhlIDYgTm92IG1lZXRpbmcu IExvY2FsIHRpbWUgd2lsbCBub3QgY2hhbmdlIGluIEV1cm9wZS4gKioNCg0KV2Ugd2lsbCB1c2Ug dGhlIHdvcmtpbmcgZ3JvdXAgV2ViRXggZm9yIHRoZSBjYWxscy4gIFRoZSBJRVRGIFdlYkV4DQph Y2NvdW50IGRvZXMgbm90IGFsbG93IEludGVybmF0aW9uYWwgZGlhbGxpbmcgbm9yIFVTIHRvbGwg ZnJlZSAoIjgwMCINCm51bWJlcnMpLCBidXQgeW91IGNhbiB1c2UgdGhlIFdlYkV4IGFwcCB0byBj b25uZWN0IHlvdXIgZGV2aWNlIGF1ZGlvLA0KYW5kIHRoZXJlJ3MgYWxzbyB0aGUgb3B0aW9uIG9m IGNvbm5lY3Rpb24gZGlyZWN0bHkgZnJvbSB5b3VyIGJyb3dzZXINCmlmIHlvdXIgYnJvd3NlciBz dXBwb3J0cyBpdC4NCg0KV2ViRXggZGV0YWlscyB3aWxsIGJlIHNlbnQgdG8gdGhlIG1haWxpbmcg bGlzdCBiZWZvcmUgZWFjaCBjYWxsICh0aGUNCmRldGFpbHMgd2lsbCBiZSB0aGUgc2FtZSBmb3Ig YWxsIGNhbGxzLCBidXQgdGhlIG1lc3NhZ2VzIHdpbGwgc2VydmUgYXMNCnJlbWluZGVycykuDQoN Cg0KVGhhbmtzLA0KRnJhbmNlc2NhIChhcyBDQk9SIGNoYWlyKQ0KDQpGcm9tOiBDQk9SIDxjYm9y LWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBGcmFuY2VzY2EgUGFsb21iaW5pIDxmcmFu Y2VzY2EucGFsb21iaW5pQGVyaWNzc29uLmNvbT4NCkRhdGU6IE1vbmRheSwgMTUgQXByaWwgMjAx OSBhdCAxNzo0NA0KVG86IENvc2UgV2cgPGNvc2VAaWV0Zi5vcmc+LCAiY29yZUBpZXRmLm9yZyBX RyIgPGNvcmVAaWV0Zi5vcmc+LCAiY2JvckBpZXRmLm9yZyIgPGNib3JAaWV0Zi5vcmc+LCBBY2Ug V2cgPEFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbQ2Jvcl0gW0FjZV0gRG9vZGxlIHBvbGwg Zm9yIHZpcnR1YWwgaW50ZXJpbXMNCg0KSGksDQoNClBsZWFzZSBlbnRlciB5b3VyIGF2YWlsYWJp bGl0eSBieSB0aGlzIEZyaWRheSwgQXByaWwgMTl0aDogaHR0cHM6Ly9kb29kbGUuY29tL3BvbGwv dmU3cm55YXJlcmkya3Flcg0KDQpBcyBLbGF1cyBzYWlkLCB0aGUgdGltZSBzbG90cyBhcmUgdG8g Y2hvc2UgZm9yIHdlZWtseSBtZWV0aW5ncywgc28gZGlzcmVnYXJkIHRoZSBleGFjdCBkYXRlcyBp biB0aGUgZG9vZGxlIHBvbGwsIGJ1dCBvbmx5IGNvbnNpZGVyIHRoZSBkYXkgb2YgdGhlIHdlZWsu DQoNClRoZSBnb2FsIGlzIHRvIHJlc3RhcnQgdGhlIG1lZXRpbmdzIGJ5IHRoZSAybmQgd2VlayBv ZiBNYXksIGFuZCB3ZSBuZWVkIGEgY291cGxlIG9mIHdlZWtzIHRvIHNldCBpdCB1cCB3aXRoIHRo ZSBTZWNyZXRhcmlhdC4NCg0KQWxzbyBub3RlIHRoYXQgdGhlIHRpbWVzbG90cyBhcmUgOTAgbWlu dXRlcyBsb25nLCB0byBhbGxvdyBmb3IgbG9uZ2VyIGludGVyaW0gdGltZSBpZiBuZWVkZWQuDQoN Cg0KVGhhbmtzLA0KRnJhbmNlc2NhDQoNCk9uIDEzIEFwcmlsIDIwMTkgYXQgMTY6NDc6MDIgQ0VT VCwgS2xhdXMgSGFydGtlIDxoYXJ0a2VAcHJvamVjdGNvb2wuZGU+IHdyb3RlOg0KV2UgYXJlIGxv b2tpbmcgZm9yIGEgbmV3IHRpbWUgc2xvdCBmb3IgdGhlIENvUkUvQ0JPUi9DT1NFIHZpcnR1YWwN CmludGVyaW1zIHVudGlsIElFVEYgMTA1Lg0KDQpQcm9wb3NlZCBvcHRpb25zOg0KDQo3YW0gUERU IC8gMTBhbSBFRFQgLyA0cG0gQ0VTVCAvIDExcG0gSlNUDQo4YW0gUERUIC8gMTFhbSBFRFQgLyA1 cG0gQ0VTVCAvIDEybWlkbiBKU1QNCjlhbSBQRFQgLyAxMm5vb24gRURUIC8gNnBtIENFU1QgLyAx YW0gSlNUDQoxMGFtIFBEVCAvIDFwbSBFRFQgLyA3cG0gQ0VTVCAvIDJhbSBKU1QNCg0KVGhlIGlu dGVyaW1zIGFyZSBzY2hlZHVsZWQgdG8gYmUgd2Vla2x5LCBhbHRlcm5hdGluZyBiZXR3ZWVuIENv UkUgYW5kDQpDQk9SL0NPU0UgKGFuZCBhIGRhc2ggb2YgQUNFKS4NCg0KUGxlYXNlIHVzZSB0aGlz IGRvb2RsZSBwb2xsIHRvIGluZGljYXRlIHlvdXIgcHJlZmVyZW5jZToNCmh0dHBzOi8vZG9vZGxl LmNvbS9wb2xsL3ZlN3JueWFyZXJpMmtxZXINCg0KS2xhdXMNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBpZXRm Lm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg== --_000_2101B222960B437896765A68BFE4315Aericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <0DC4CFE33C912F4A81C22865BB8BA8D3@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4ubnVsbA0KCXttc28tc3R5bGUt bmFtZTpudWxsO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRv d3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5 Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVO LUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBhbGwsPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoYW5rIHlvdSB0byB0aG9zZSBwYXJ0aWNpcGF0aW5nIGluIHRoZSBkb29kbGUgcG9sbCwgYW5k IHRoYW5rcyB0byBscHdhbiBXRyBmb3IgYWRqdXN0aW5nIHRoZWlyIGludGVyaW0gdGltZSBhcm91 bmQgb3VyIHByZWZlcnJlZCB0aW1lISBUaGUgd2lubmluZyB0aW1lc2xvdCBpcyB0aGUgMTU6MDAg 4oCTIDE2OjMwIFVUQy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMgYSByZXN1bHQsIENCT1Ig V0cgd2lsbCBoYXZlIGNvbmZlcmVuY2UgY2FsbHMgZXZlcnkgb3RoZXIgV2VkbmVzZGF5IHN0YXJ0 aW5nIE1heSAyMm5kLCAxNTowMCB0byAxNjowMCBVVEMgOg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cu ZXBvY2hjb252ZXJ0ZXIuY29tL3RpbWV6b25lcz9xPTE1NTg1MzcyMDAmYW1wO3R6PUV1cm9wZSUy RkJlcmxpbiI+DQpodHRwczovL3d3dy5lcG9jaGNvbnZlcnRlci5jb20vdGltZXpvbmVzP3E9MTU1 ODUzNzIwMCZhbXA7dHo9RXVyb3BlJTJGQmVybGluPC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5UaGUgU2VjcmV0YXJpYXQgd2lsbCBhbm5vdW5jZSB0aGUgY2FsbHMgc29vbiwgYnV0IGhlcmUg aXMgYSBzdW1tYXJ5OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5EYXk6IGV2ZXJ5IG90aGVyIFdl ZG5lc2RheSBiZWdpbm5pbmcgb24gTWF5IDIybmQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkRhdGVzOiZuYnNwOyAyMiBNYXk7IDUsIDE5IEp1bmU7IDMsIDE3LCAzMSBKdWx5 OyAxNCwgMjggQXVnOyAxMSwgMjUgU2VwdDsgOSwgMjMgT2N0OyA2IE5vdjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGltZTogMTU6MDAgdG8gMTY6MDAgVVRDIGZvciBhbGwg ZGF0ZXMgZXhjZXB0IDYgTm92OyA2IE5vdjogMTY6MDAg4oCTIDE3OjAwIFVUQzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4qKiBOb3RlIHRoYXQgbG9jYWwgdGltZSBpbiBOQSB3aWxsIGNoYW5nZSBm b3IgdGhlIDYgTm92IG1lZXRpbmcuIExvY2FsIHRpbWUgd2lsbCBub3QgY2hhbmdlIGluIEV1cm9w ZS4gKio8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2Ugd2lsbCB1c2UgdGhlIHdvcmtpbmcgZ3Jv dXAgV2ViRXggZm9yIHRoZSBjYWxscy4mbmJzcDsgVGhlIElFVEYgV2ViRXg8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmFjY291bnQgZG9lcyBub3QgYWxsb3cgSW50ZXJuYXRp b25hbCBkaWFsbGluZyBub3IgVVMgdG9sbCBmcmVlICgmcXVvdDs4MDAmcXVvdDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPm51bWJlcnMpLCBidXQgeW91IGNhbiB1c2UgdGhl IFdlYkV4IGFwcCB0byBjb25uZWN0IHlvdXIgZGV2aWNlIGF1ZGlvLDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+YW5kIHRoZXJlJ3MgYWxzbyB0aGUgb3B0aW9uIG9mIGNvbm5l Y3Rpb24gZGlyZWN0bHkgZnJvbSB5b3VyIGJyb3dzZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPmlmIHlvdXIgYnJvd3NlciBzdXBwb3J0cyBpdC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+V2ViRXggZGV0YWlscyB3aWxsIGJlIHNlbnQgdG8gdGhlIG1haWxpbmcgbGlzdCBi ZWZvcmUgZWFjaCBjYWxsICh0aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PmRldGFpbHMgd2lsbCBiZSB0aGUgc2FtZSBmb3IgYWxsIGNhbGxzLCBidXQgdGhlIG1lc3NhZ2Vz IHdpbGwgc2VydmUgYXM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPnJlbWlu ZGVycykuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+RnJhbmNlc2NhIChhcyBDQk9SIGNoYWlyKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+Q0JPUiAmbHQ7Y2Jvci1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBi ZWhhbGYgb2YgRnJhbmNlc2NhIFBhbG9tYmluaSAmbHQ7ZnJhbmNlc2NhLnBhbG9tYmluaUBlcmlj c3Nvbi5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRheSwgMTUgQXByaWwgMjAxOSBhdCAx Nzo0NDxicj4NCjxiPlRvOiA8L2I+Q29zZSBXZyAmbHQ7Y29zZUBpZXRmLm9yZyZndDssICZxdW90 O2NvcmVAaWV0Zi5vcmcgV0cmcXVvdDsgJmx0O2NvcmVAaWV0Zi5vcmcmZ3Q7LCAmcXVvdDtjYm9y QGlldGYub3JnJnF1b3Q7ICZsdDtjYm9yQGlldGYub3JnJmd0OywgQWNlIFdnICZsdDtBY2VAaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbQ2Jvcl0gW0FjZV0gRG9vZGxlIHBv bGwgZm9yIHZpcnR1YWwgaW50ZXJpbXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpLCA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBsZWFzZSBlbnRlciB5b3VyIGF2YWlsYWJpbGl0eSBieSB0 aGlzIEZyaWRheSwgQXByaWwgMTl0aDombmJzcDtodHRwczovL2Rvb2RsZS5jb20vcG9sbC92ZTdy bnlhcmVyaTJrcWVyJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFzIEtsYXVzIHNhaWQsIHRoZSB0aW1lIHNsb3RzIGFyZSB0byBjaG9z ZSBmb3Igd2Vla2x5IG1lZXRpbmdzLCBzbyBkaXNyZWdhcmQgdGhlIGV4YWN0IGRhdGVzIGluIHRo ZSBkb29kbGUgcG9sbCwgYnV0IG9ubHkgY29uc2lkZXIgdGhlIGRheSBvZiB0aGUgd2Vlay48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGdv YWwgaXMgdG8gcmVzdGFydCB0aGUgbWVldGluZ3MgYnkgdGhlIDJuZCB3ZWVrIG9mIE1heSwgYW5k IHdlIG5lZWQgYSBjb3VwbGUgb2Ygd2Vla3MgdG8gc2V0IGl0IHVwIHdpdGggdGhlIFNlY3JldGFy aWF0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5BbHNvIG5vdGUgdGhhdCB0aGUgdGltZXNsb3RzIGFyZSA5MCBtaW51dGVzIGxvbmcsIHRvIGFs bG93IGZvciBsb25nZXIgaW50ZXJpbSB0aW1lIGlmIG5lZWRlZC48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQpUaGFua3MsIDxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZyYW5jZXNjYTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5PbiAxMyBBcHJpbCAyMDE5IGF0IDE2OjQ3OjAyIENFU1QsIEtsYXVzIEhh cnRrZSAmbHQ7aGFydGtlQHByb2plY3Rjb29sLmRlJmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk IHdpbmRvd3RleHQgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA4LjBwdDttYXJnaW4tbGVmdDow Y207bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBhcmUgbG9va2luZyBmb3IgYSBu ZXcgdGltZSBzbG90IGZvciB0aGUgQ29SRS9DQk9SL0NPU0UgdmlydHVhbDxicj4NCmludGVyaW1z IHVudGlsIElFVEYgMTA1Ljxicj4NCjxicj4NClByb3Bvc2VkIG9wdGlvbnM6PGJyPg0KPGJyPg0K N2FtIFBEVCAvIDEwYW0gRURUIC8gNHBtIENFU1QgLyAxMXBtIEpTVDxicj4NCjhhbSBQRFQgLyAx MWFtIEVEVCAvIDVwbSBDRVNUIC8gMTJtaWRuIEpTVDxicj4NCjlhbSBQRFQgLyAxMm5vb24gRURU IC8gNnBtIENFU1QgLyAxYW0gSlNUPGJyPg0KMTBhbSBQRFQgLyAxcG0gRURUIC8gN3BtIENFU1Qg LyAyYW0gSlNUPGJyPg0KPGJyPg0KVGhlIGludGVyaW1zIGFyZSBzY2hlZHVsZWQgdG8gYmUgd2Vl a2x5LCBhbHRlcm5hdGluZyBiZXR3ZWVuIENvUkUgYW5kPGJyPg0KQ0JPUi9DT1NFIChhbmQgYSBk YXNoIG9mIEFDRSkuPGJyPg0KPGJyPg0KUGxlYXNlIHVzZSB0aGlzIGRvb2RsZSBwb2xsIHRvIGlu ZGljYXRlIHlvdXIgcHJlZmVyZW5jZTo8YnI+DQo8YSBocmVmPSJodHRwczovL2Rvb2RsZS5jb20v cG9sbC92ZTdybnlhcmVyaTJrcWVyIiB0YXJnZXQ9Il9CTEFOSyI+aHR0cHM6Ly9kb29kbGUuY29t L3BvbGwvdmU3cm55YXJlcmkya3FlcjwvYT48YnI+DQo8YnI+DQpLbGF1czxicj4NCjxicj4NCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KQWNlIG1h aWxpbmcgbGlzdDxicj4NCkFjZUBpZXRmLm9yZzxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIiB0YXJnZXQ9Il9CTEFOSyI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_2101B222960B437896765A68BFE4315Aericssoncom_-- From nobody Tue May 7 05:41:47 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6DCB120122; Tue, 7 May 2019 05:41:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e4xgwDzpftIw; Tue, 7 May 2019 05:41:43 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00048.outbound.protection.outlook.com [40.107.0.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45092120119; Tue, 7 May 2019 05:41:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=j1M5pmOyrEu4BOtBNWm2SmJ+mCysnbaLJfTtieeT9fE=; b=csUyjYUvzt0w1oSE3X74hzUkgZJqr1xLG8BLsKu5iO1JafRyNcovOHVyaqX1a02405mRZcfLVvpmeF3GmVXdZtFWVMKacTD9T3MhRX9IG4J45kUvR4CQhqhU4Vz03eKaXwaJKauDZ3mRNN8LW1GonK2cifTvAVMa9Up62nXqqE4= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4824.eurprd08.prod.outlook.com (20.179.46.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.11; Tue, 7 May 2019 12:41:41 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1856.012; Tue, 7 May 2019 12:41:40 +0000 From: Hannes Tschofenig To: "ace@ietf.org" , "'core@ietf.org WG'" Thread-Topic: Joint IETF/IRTF - OMA SpecWorks Meeting Thread-Index: AdUE0KlI9KBqzI4iR+W4OYbK5l83jAAAVrjg Date: Tue, 7 May 2019 12:41:40 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.123.90] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2d8fa423-0806-4c2e-b97b-08d6d2e95aa7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4824; x-ms-traffictypediagnostic: DBBPR08MB4824: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0030839EEE x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(39860400002)(136003)(366004)(376002)(40434004)(53754006)(189003)(199004)(606006)(316002)(446003)(229853002)(478600001)(5660300002)(11346002)(5024004)(99286004)(72206003)(476003)(86362001)(450100002)(52536014)(33656002)(790700001)(6116002)(3846002)(74316002)(7736002)(14454004)(2501003)(6436002)(2940100002)(486006)(966005)(7696005)(68736007)(26005)(8936002)(256004)(66946007)(9686003)(73956011)(66556008)(76116006)(6306002)(236005)(2473003)(66066001)(102836004)(55016002)(66446008)(64756008)(81166006)(8676002)(54896002)(81156014)(66476007)(14444005)(110136005)(186003)(2906002)(71200400001)(6506007)(25786009)(66574012)(76176011)(53546011)(71190400001)(53936002); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4824; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Psho8VKSwdCuvKHDiPJpWGGXsTIA9D1X1LHICtIogcDd+eDxUUSNXmDwprNZU+2QYgAr51LmbYwwH9S8oY7AUHWRpxp26dOuaiorpLqLbzb5U8MvjXRYuFEl4e9XrhL/e25r/2hzGvC2sDaf/61dLy19qhgxfPM22pU9izmsHv6JQeJsX5k4mLew9v9uuAGZeCOANFMHdP8w/PS3pqGnZBhMKIkMj5FnPx32BOTa0OTMxzIb2fPFYlNTnbB+gwRuS8RY7bJqlg/Qw7TUnDwn0gX3mMEbM/DhkEPE5P+0ApscO4hM1vRPTwmvuaxe188OV2/7LtIL2ZwKILPzfBWgRX8KB7Cya7eXTnxdU8bp1j+Zy9F9lPcokqrQM5yHtWsjinJ2reBIRY3js5Su4bONjYxviwFgeXrH2Sjol++kKNk= Content-Type: multipart/alternative; boundary="_000_DBBPR08MB453933085BF7E8D5E02CDAF6FA310DBBPR08MB4539eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2d8fa423-0806-4c2e-b97b-08d6d2e95aa7 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 May 2019 12:41:40.8977 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4824 Archived-At: Subject: [Ace] FW: Joint IETF/IRTF - OMA SpecWorks Meeting X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 May 2019 12:41:46 -0000 --_000_DBBPR08MB453933085BF7E8D5E02CDAF6FA310DBBPR08MB4539eurp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FYI: I am forwarding the meeting announcement also to ACE and CORE because = there maybe interested parties in these groups as well. Everyone is welcome to join! From: T2TRG On Behalf Of Hannes Tschofenig Sent: Dienstag, 7. Mai 2019 14:39 To: T2TRG@irtf.org Cc: Ari Ker=E4nen Subject: [T2TRG] Joint IETF/IRTF - OMA SpecWorks Meeting Hi all, as Ari mentioned already we are planning to hold a joint meeting between OM= A SpecWorks (two groups, namely the device management & service enablement = working group and the IPSO working group) and interested participants of t= he IETF/IRTF. The meeting will take place Friday, July 19th - the Friday be= fore the IETF Hackathon/IETF 105 meeting starts. Ericsson is kindly hosting= this event in their Montreal office. The Ericsson office location is 8275 = Route Transcanadienne, Saint-Laurent, Quebec H4S-0B6: https://www.ericsson.= com/en/about-us/company-facts/ericsson-worldwide/canada For logistical reason please let us know whether you are interested to part= icipate in the joint IETF/IRTF-OMA meeting: https://doodle.com/poll/z6e8kzeke9r9bdyh The agenda will be very much like the one we put together for the joint IET= F/OMA conference call earlier this year where we talked about IETF drafts t= hat are utilized by LwM2M. A detailed agenda will be distributed in time f= or the meeting. Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_DBBPR08MB453933085BF7E8D5E02CDAF6FA310DBBPR08MB4539eurp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

FYI: I am forwarding the meeting announcement also t= o ACE and CORE because there maybe interested parties in these groups as we= ll.

Everyone is welcome to join!

 

From: T2TRG <t2trg-bounces@irtf.org> On Behalf Of Hannes Tschofenig
Sent: Dienstag, 7. Mai 2019 14:39
To: T2TRG@irtf.org
Cc: Ari Ker=E4nen <ari.keranen@ERICSSON.COM>
Subject: [T2TRG] Joint IETF/IRTF - OMA SpecWorks Meeting<= /span>

 

Hi all,

 

as Ari mentioned already we are= planning to hold a joint meeting between OMA SpecWorks (two groups, namely= the device management & service enablement working group  and the= IPSO working group) and interested participants of the IETF/IRTF. The meeting will take place Friday, July 19t= h – the Friday before the IETF Hackathon/IETF 105 meeting start= s. Ericsson is kindly hosting this event in their Montrea= l office. The Ericsson office location is 8275 Route Transcanadienne, Saint-La= urent, Quebec H4S-0B6: https://www.ericsson.com/en/about-us/company-facts/ericsson-worldwide/canad= a

 

For logistical reason please let us know whether you= are interested to participate in the joint IETF/IRTF-OMA meeting:

https://doodle.com/poll/z6e8kzeke9r9bdyh

 

The agenda will be very much like the one we put tog= ether for the joint IETF/OMA conference call earlier this year where we tal= ked about IETF drafts that are utilized by LwM2M.  A detailed agenda will be distributed in time for the meeting.

 

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any= attachments are confidential and may also be privileged. If you are not th= e intended recipient, please notify the sender immediately and do not discl= ose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Th= ank you.

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_DBBPR08MB453933085BF7E8D5E02CDAF6FA310DBBPR08MB4539eurp_-- From nobody Tue May 7 11:39:39 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ED6412029D; Tue, 7 May 2019 11:39:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WbIC4jgxq9vo; Tue, 7 May 2019 11:39:28 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06AC512029E; Tue, 7 May 2019 11:39:28 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 7 May 2019 11:38:17 -0700 From: Jim Schaad To: CC: References: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> In-Reply-To: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> Date: Tue, 7 May 2019 11:38:11 -0700 Message-ID: <010f01d50504$0794d4a0$16be7de0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQLviyWC5/ryToLzxwhb5wnb5sh9ZaQq8QKg Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 May 2019 18:39:37 -0000 This closes the adoption call for draft-sengul-ace-mqtt-tls-profile. Between the F2F meeting and the list there is significant desire to adopt the draft and nobody objected. Authors, please republish the draft as an ACE WG document. ACE Chairs Jim & Daniel > -----Original Message----- > From: Ace On Behalf Of Jim Schaad > Sent: Monday, April 22, 2019 10:32 AM > To: ace@ietf.org > Subject: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile > > At the meeting in Prague there was some discussion about adopting > https://datatracker.ietf.org/doc/draft-sengul-ace-mqtt-tls-profile/ as a > working group document. The overall sense of the room was that this should > be done. This message starts a 2 week adoption call for the document. If > you have strong feelings one way or the other about adopting this document > please let us know. Reasons for your position are appreciated. > > ACE Chairs > > Jim & Daniel > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace From nobody Tue May 7 12:31:19 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DCEC91201AA; Tue, 7 May 2019 12:31:17 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Jim Schaad via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 6.96.0 Auto-Submitted: auto-generated Precedence: bulk Cc: Jim Schaad , ietf@augustcellars.com, ace-chairs@ietf.org, iesg-secretary@ietf.org, ace@ietf.org Message-ID: <155725747790.32626.16590496667107912643.idtracker@ietfa.amsl.com> Date: Tue, 07 May 2019 12:31:17 -0700 Archived-At: Subject: [Ace] Publication has been requested for draft-ietf-ace-dtls-authorize-08 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 May 2019 19:31:18 -0000 Jim Schaad has requested publication of draft-ietf-ace-dtls-authorize-08 as Proposed Standard on behalf of the ACE working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-ace-dtls-authorize/ From nobody Tue May 7 14:38:31 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3781612019B; Tue, 7 May 2019 14:38:29 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Jim Schaad via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 6.96.0 Auto-Submitted: auto-generated Precedence: bulk Cc: Jim Schaad , ietf@augustcellars.com, ace-chairs@ietf.org, iesg-secretary@ietf.org, ace@ietf.org Message-ID: <155726510921.32661.13399893048800058165.idtracker@ietfa.amsl.com> Date: Tue, 07 May 2019 14:38:29 -0700 Archived-At: Subject: [Ace] Publication has been requested for draft-ietf-ace-coap-est-10 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 May 2019 21:38:29 -0000 Jim Schaad has requested publication of draft-ietf-ace-coap-est-10 as Proposed Standard on behalf of the ACE working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-ace-coap-est/ From nobody Wed May 8 05:20:29 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D9671200EC; Wed, 8 May 2019 05:20:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.96.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <155731802733.22628.9858945742639402237@ietfa.amsl.com> Date: Wed, 08 May 2019 05:20:27 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-00.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 May 2019 12:20:27 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : MQTT-TLS profile of ACE Authors : Cigdem Sengul Anthony Kirby Paul Fremantle Filename : draft-ietf-ace-mqtt-tls-profile-00.txt Pages : 22 Date : 2019-05-08 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) to enable authorization in an MQTT-based publish-subscribe messaging system. Proof-of- possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize publisher and subscriber clients. The protocol relies on TLS for confidentiality and server authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-00 https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed May 8 05:24:14 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BFF41200B2 for ; Wed, 8 May 2019 05:24:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.017 X-Spam-Level: X-Spam-Status: No, score=-1.017 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_FACE_BAD=0.981, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mVYPfyrMZJtp for ; Wed, 8 May 2019 05:24:10 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDA2E12004C for ; Wed, 8 May 2019 05:24:09 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id w20so660241qka.7 for ; Wed, 08 May 2019 05:24:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MBb9cFAkAl8SaWWqGn7Oi/ZptIAj9uK9RheiXt/B+Hs=; b=Goh82ilxGM1zhpMy8tk5EbXDFTPZQR/L+loX6ZeALBviuSs5VB1bPLUHv5jAaSBCBt 5bN11OPqCstd4+Rw5vsyYqRJ+f0+OyWQLjd71yPG76dO6oFPTXFYXH6C1HynDl/hlPzY NTdfBMmNrtJpH8TSKRJUB84e9oSi4hKoHT2AbWA/6Dm26NMuGBA36wFGe3PrpK9+BmA8 lzqTaCFgoFz0YP+ElLy01ku6F08Nk5vwgZ0iD1iDBqaB3yHhioP4kIJyjsn306MwoLS+ knG8IJUHr8xCKVOHVjuC1/PrKs2N525uFE1x7PDUv+8YYtDHxWINRU8PF5Lkr+SjLDrB aKUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MBb9cFAkAl8SaWWqGn7Oi/ZptIAj9uK9RheiXt/B+Hs=; b=HquW9/5zfd3qcY7t8txKGILxIbqOW3y77cEbpbmRt5nzoo0zfycgyUppOhXPV0QYxy gXMnlCLfGLNmsQd5nIcI7dS52DiEYFsjs3qJRxWZciAe4+wxJc0A2dimBPWqCRDb/3ZT C2eRKYKfkI+7mdM+3cgM+s90VXBgbMAcDBS9kjSi4UuQ9qmga08q7Q+87fxSO31vhGsd 9tQrTN4qWPAC+T8uunPv8yqBo4Qi63IuxgoKz/73AvezH0Cnej8zV7zekYbJ8p2y7SL9 hTuiV1a0GX1po6a8/fRDaR7pPEEuB5a4b1U3s7ptZd39QviRa4VhyX1N8FJh2GW7Li99 tDLQ== X-Gm-Message-State: APjAAAV5aU+IidOgEMbxvQUdGyrw+tO6nm83rRvF7aIJWrE/bMFGJ55H g1ik4xJFFcmOdtYPtEOgQUjwIWoGzG/4I/afNhl/J1rH4Je1hQ== X-Google-Smtp-Source: APXvYqwq9OBjCU47Yw6ExikyvvakDg6MKJV3UXjYDoRNxPSLdCYsno0wuG8S8SMTTuu0AYnEw0RJI6RAZGzx5kwLdmE= X-Received: by 2002:a37:bd45:: with SMTP id n66mr28105360qkf.54.1557318249005; Wed, 08 May 2019 05:24:09 -0700 (PDT) MIME-Version: 1.0 References: <00fc01d4f931$4dc225b0$e9467110$@augustcellars.com> <010f01d50504$0794d4a0$16be7de0$@augustcellars.com> In-Reply-To: <010f01d50504$0794d4a0$16be7de0$@augustcellars.com> From: Cigdem Sengul Date: Wed, 8 May 2019 13:23:58 +0100 Message-ID: To: Jim Schaad Cc: ace@ietf.org Content-Type: multipart/alternative; boundary="00000000000008c94505885f699e" Archived-At: Subject: Re: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 May 2019 12:24:13 -0000 --00000000000008c94505885f699e Content-Type: text/plain; charset="UTF-8" Thank you very much. We just republished the draft as draft-ietf-ace-mqtt-tls-profile-00 Thanks, --Cigdem Name: draft-ietf-ace-mqtt-tls-profile Revision: 00 Title: MQTT-TLS profile of ACE Document date: 2019-05-07 Group: ace Pages: 22 URL: https://www.ietf.org/internet-drafts/draft-ietf-ace-mqtt-tls-profile-00.txt Status: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ Htmlized: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile On Tue, May 7, 2019 at 7:40 PM Jim Schaad wrote: > This closes the adoption call for draft-sengul-ace-mqtt-tls-profile. > > Between the F2F meeting and the list there is significant desire to adopt > the draft and nobody objected. Authors, please republish the draft as an > ACE WG document. > > ACE Chairs > > Jim & Daniel > > > > -----Original Message----- > > From: Ace On Behalf Of Jim Schaad > > Sent: Monday, April 22, 2019 10:32 AM > > To: ace@ietf.org > > Subject: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile > > > > At the meeting in Prague there was some discussion about adopting > > https://datatracker.ietf.org/doc/draft-sengul-ace-mqtt-tls-profile/ as a > > working group document. The overall sense of the room was that this > should > > be done. This message starts a 2 week adoption call for the document. > If > > you have strong feelings one way or the other about adopting this > document > > please let us know. Reasons for your position are appreciated. > > > > ACE Chairs > > > > Jim & Daniel > > > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --00000000000008c94505885f699e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thank you very much. We just republished the draft as=C2= =A0draft-ietf= -ace-mqtt-tls-profile-00

Thanks,=C2=A0
--Cigdem


Name: draft-ietf-ace-mqtt= -tls-profile
Revision: 00
Title: MQTT-TLS profile of ACE
Document date: 2019-05-07
Group: ace
Pages: 22
URL:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0https://www.ietf.org/internet-drafts/draft-ietf= -ace-mqtt-tls-profile-00.txt
Status:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0https://d= atatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/
Htmlized:=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<= /span>https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-00
Htmlized:= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://datatracker.ietf.org/doc/html/draft-ietf-a= ce-mqtt-tls-profile




On= Tue, May 7, 2019 at 7:40 PM Jim Schaad <ietf@augustcellars.com> wrote:
This closes the adoption call for draft-se= ngul-ace-mqtt-tls-profile.

Between the F2F meeting and the list there is significant desire to adopt the draft and nobody objected.=C2=A0 Authors, please republish the draft as= an
ACE WG document.

ACE Chairs

Jim & Daniel


> -----Original Message-----
> From: Ace <ace-bounces@ietf.org> On Behalf Of Jim Schaad
> Sent: Monday, April 22, 2019 10:32 AM
> To: ace@ietf.org=
> Subject: [Ace] Adoption call for draft-sengul-ace-mqtt-tls-profile
>
> At the meeting in Prague there was some discussion about adopting
> https://datatracker.ietf.org= /doc/draft-sengul-ace-mqtt-tls-profile/ as a
> working group document.=C2=A0 The overall sense of the room was that t= his
should
> be done.=C2=A0 This message starts a 2 week adoption call for the docu= ment.=C2=A0 If
> you have strong feelings one way or the other about adopting this docu= ment
> please let us know.=C2=A0 Reasons for your position are appreciated. >
> ACE Chairs
>
> Jim & Daniel
>
>
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--00000000000008c94505885f699e-- From nobody Thu May 9 07:42:45 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13B3A120122 for ; Thu, 9 May 2019 07:42:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vu69p7kdICyg for ; Thu, 9 May 2019 07:42:38 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30054.outbound.protection.outlook.com [40.107.3.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D198E1202BA for ; Thu, 9 May 2019 07:42:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mhtJWcl5C24Zo7Jeg6oQwK5L/pvkE6h5DhSKatTH3sw=; b=I9sQ/veha/+WYvIclFw6H9d9q2pvwg/q9nRSWUejY/8JSKXqploeHa5lpYxQ2miox+2P0vH6CqhDugiG4lPLtQWbQMSYN+vjz5lNwJLSUmStm6PlSy8Cab39nolobt88wDgiiZ/Vo3kcjbaIF0i6L/W7P3fLEORxVE6+Yny1g7s= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4807.eurprd08.prod.outlook.com (20.179.46.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.21; Thu, 9 May 2019 14:42:35 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1856.012; Thu, 9 May 2019 14:42:35 +0000 From: Hannes Tschofenig To: "ace@ietf.org" Thread-Topic: EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6A== Date: Thu, 9 May 2019 14:42:35 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.123.90] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7d18b723-242e-4a14-1a2c-08d6d48c935c x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4807; x-ms-traffictypediagnostic: DBBPR08MB4807: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 003245E729 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(39860400002)(366004)(396003)(376002)(189003)(199004)(53754006)(40434004)(186003)(71190400001)(476003)(71200400001)(4743002)(5640700003)(9686003)(6916009)(8936002)(55016002)(8676002)(486006)(316002)(68736007)(66066001)(6506007)(1730700003)(26005)(81166006)(81156014)(102836004)(25786009)(7696005)(66446008)(72206003)(52536014)(478600001)(64756008)(66556008)(2906002)(66946007)(66476007)(5660300002)(76116006)(73956011)(33656002)(7736002)(53936002)(305945005)(14454004)(3846002)(6116002)(86362001)(74316002)(99286004)(2501003)(256004)(5024004)(14444005)(2351001)(6436002); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4807; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: fD80YrCLcKRRu2fLTvp7DkjjhO4kAFjpJopbpQ0JeQZZtw1uZwLbfH1cvt08IKfJhujFE10QmeGNxr81BILQ2YSYq0R1BiOF35ebe6uxWqUjAhhKQQqXRQ8CVM8XKsnDegJQmxAkRcE+Pka8U8Zu01flL3jZ9pDvrgDqOlgBzot4gUHyHcHybpa/zSVGFH7wEgZR5ZjGd+Ox54Wtcy/1g0f1opAYfM3N4wevrAeb8twYQ4Vknce+PIibWS82MIOXp0YwQmt/yP18fypcPJOB0XkZ1+QukT9G77LAAe8oGLp9C6X2D38RR+4CXYV8vwIBGVr3r+dmSE8ElmSuE1lkOXicdD6T1kdhFkiuABNvBw0Xp5fgIW6qUJd72uKCc2rMY4YSi4tUCAiJfgmPaYeCkPsaZPYAq2d1b/JmUb+yfHM= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7d18b723-242e-4a14-1a2c-08d6d48c935c X-MS-Exchange-CrossTenant-originalarrivaltime: 09 May 2019 14:42:35.1059 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4807 Archived-At: Subject: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 May 2019 14:42:43 -0000 Hi all, I am still a bit unhappy about this paragraph: " Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. " If you get hardware that does not have a hardware-based RNG then you are in= trouble. The main security protocols we look into do not work without a so= urce of randomness. Hence, getting the certificate & private key from the s= erver will not get you too far. I believe we should encourage developers to pick the correct hardware for t= he task rather than making them believe we have come up with solutions that= allow them to get away without a hardware-based RNG. I also do not believe the statement that random number key generation is co= stly. Can you give me some number? The references to [PsQs] [RSAorig] are IMHO also not appropriate because th= ey are conveying a different message (at least that's my understanding from= reading them). The message is that you have to be careful with designing a= nd using a random number generator on embedded systems because the sources = of entropy may just not be there (like keyboards, harddisk drive, processin= g scheduling, etc.). Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Thu May 9 08:34:10 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0930120129 for ; Thu, 9 May 2019 08:34:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fKSHJ_wO46rA for ; Thu, 9 May 2019 08:34:06 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91A8412010C for ; Thu, 9 May 2019 08:34:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6576; q=dns/txt; s=iport; t=1557416045; x=1558625645; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=/EN2JxS7BV7QIzXfaOMsHU9JvByJmKCQD7Nrp9I0+qk=; b=Wf3bz8FUIL94HMNOL67aemejTmes45D3PAvrXN5rJLmTonOybDVBK7qM WmmIW112PO5/S3T/JLF0qHIBSnvNUeY6aClg5FHywAjEi5ywNg0HhUYdW Ta/7k/W6PVkz+htlKzn4dmbbpBlEY2vH6ttDfC+61q9WKSIP1z6k+CFdj Y=; X-Files: signature.asc : 195 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A4AADpR9Rc/xbLJq1kGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBVAMBAQELAYFhgWkBIBIohBGIe4wjkliGD4FnAgcBAQEJAwEBLwE?= =?us-ascii?q?BhEACgis3Bg4BAwEBBAEBAgEEbSiFSgEBAQMBI1YFCwsYKgICVwYTG4MHAYF?= =?us-ascii?q?7D603gS+FR4RfEIEyAYFOiheBf4ERJx+CTD6ECCaDIDKCJgSLS4dJlDEJggu?= =?us-ascii?q?CBoECj0wblVmeJIJ4AgQGBQIVgWUigVczGggbFWUBgkE+kBU9AzCQDAEB?= X-IronPort-AV: E=Sophos;i="5.60,450,1549929600"; d="asc'?scan'208,217";a="11924335" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 09 May 2019 15:34:00 +0000 Received: from ams3-vpn-dhcp4533.cisco.com (ams3-vpn-dhcp4533.cisco.com [10.61.81.180]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x49FY0A0023312 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 9 May 2019 15:34:00 GMT From: Eliot Lear Message-Id: <6F612702-C149-4DFB-B6C6-17BC14C8E605@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_0CFF9F0C-6AD0-424B-A894-36B2A9F47F90"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Date: Thu, 9 May 2019 17:33:59 +0200 In-Reply-To: Cc: "ace@ietf.org" To: Hannes Tschofenig References: X-Mailer: Apple Mail (2.3445.104.8) X-Outbound-SMTP-Client: 10.61.81.180, ams3-vpn-dhcp4533.cisco.com X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 May 2019 15:34:08 -0000 --Apple-Mail=_0CFF9F0C-6AD0-424B-A894-36B2A9F47F90 Content-Type: multipart/alternative; boundary="Apple-Mail=_4FBE4723-A533-4DF4-A1C3-04479E182495" --Apple-Mail=_4FBE4723-A533-4DF4-A1C3-04479E182495 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Hannes, > On 9 May 2019, at 16:42, Hannes Tschofenig = wrote: >=20 > Hi all, >=20 > I am still a bit unhappy about this paragraph: >=20 > " > Constrained devices sometimes do not have the necessary hardware to > generate statistically random numbers for private keys and DTLS > ephemeral keys. Past experience has also shown that low-resource > endpoints sometimes generate numbers which could allow someone to > decrypt the communication or guess the private key and impersonate = as > the device [PsQs] [RSAorig]. Additionally, random number key > generation is costly, thus energy draining. > =E2=80=9C >=20 > If you get hardware that does not have a hardware-based RNG then you = are in trouble. The main security protocols we look into do not work = without a source of randomness. Hence, getting the certificate & private = key from the server will not get you too far. >=20 > I believe we should encourage developers to pick the correct hardware = for the task rather than making them believe we have come up with = solutions that allow them to get away without a hardware-based RNG. >=20 > I also do not believe the statement that random number key generation = is costly. Can you give me some number? I think that statement in particular is troublesome. Even if we were to = believe it to be true today by some measure, is there any reason to = believe it will continue to be true? We need to be raising the bar. >=20 > The references to [PsQs] [RSAorig] are IMHO also not appropriate = because they are conveying a different message (at least that's my = understanding from reading them). The message is that you have to be = careful with designing and using a random number generator on embedded = systems because the sources of entropy may just not be there (like = keyboards, harddisk drive, processing scheduling, etc.). >=20 Yes. And maybe the emphasis of this paragraph should shift as well = along these lines. Eliot --Apple-Mail=_4FBE4723-A533-4DF4-A1C3-04479E182495 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Hannes,


On 9 May = 2019, at 16:42, Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:

Hi = all,

I am still a bit unhappy about this = paragraph:

"
=   Constrained devices sometimes do not have the necessary = hardware to
  generate statistically random = numbers for private keys and DTLS
  ephemeral = keys.  Past experience has also shown that low-resource
  endpoints sometimes generate numbers which could = allow someone to
  decrypt the communication or = guess the private key and impersonate as
  the = device [PsQs] [RSAorig].  Additionally, random number = key
  generation is costly, thus energy = draining.
=E2=80=9C



If you get hardware that does not have a hardware-based RNG = then you are in trouble. The main security protocols we look into do not = work without a source of randomness. Hence, getting the certificate = & private key from the server will not get you too far.



I believe we = should encourage developers to pick the correct hardware for the task = rather than making them believe we have come up with solutions that = allow them to get away without a hardware-based RNG.

I also do not believe the statement that random number key = generation is costly. Can you give me some number?

I think = that statement in particular is troublesome.  Even if we were to = believe it to be true today by some measure, is there any reason to = believe it will continue to be true?  We need to be raising the = bar.


The references to [PsQs] = [RSAorig] are IMHO also not appropriate because they are conveying a = different message (at least that's my understanding from reading them). = The message is that you have to be careful with designing and using a = random number generator on embedded systems because the sources of = entropy may just not be there (like keyboards, harddisk drive, = processing scheduling, etc.).



Yes.  And maybe the emphasis of this = paragraph should shift as well along these lines.

Eliot

= --Apple-Mail=_4FBE4723-A533-4DF4-A1C3-04479E182495-- --Apple-Mail=_0CFF9F0C-6AD0-424B-A894-36B2A9F47F90 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTgo4LlIIJ5lIBumWpugA9nE248uAUCXNRIZwAKCRBugA9nE248 uPqcAJ0cjkn9XMNO52FQKmSIr0E/n1z5vgCgqS41p0yAX3KBr/JZnfYvvdbA+yg= =XPzH -----END PGP SIGNATURE----- --Apple-Mail=_0CFF9F0C-6AD0-424B-A894-36B2A9F47F90-- From nobody Thu May 9 19:52:57 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54A74120091 for ; Thu, 9 May 2019 19:52:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=Tox2PEYC; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=X+myay8U Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JT4AIrhOx2Ww for ; Thu, 9 May 2019 19:52:54 -0700 (PDT) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCC1B120071 for ; Thu, 9 May 2019 19:52:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2353; q=dns/txt; s=iport; t=1557456773; x=1558666373; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=ytZ6p/W5jMOcAmP/79OCdpwy+/2eMctGFn2r8Sb73LQ=; b=Tox2PEYCGKH3/wkPiPxvbFE9Bw8iwPPjAKTel/PTGxKV9tt3kfp2uhyo GvAnE7az6TFUgeZI0s2tXMm6pUnQXtiFBMZaHQ1W+6nUBjqW5ht0Xfmjq EQEHO8H98yO2rgwhswfQ2N7crIqWYCAkY8ba2SogKFTbz/A3oY35l1upc s=; IronPort-PHdr: =?us-ascii?q?9a23=3Ab0DUVBSQet78YGJTWrphFMKHf9psv++ubAcI9p?= =?us-ascii?q?oqja5Pea2//pPkeVbS/uhpkESXBNfA8/wRje3QvuigQmEG7Zub+FE6OJ1XH1?= =?us-ascii?q?5g640NmhA4RsuMCEn1NvnvOjQ5FcFaXVls13q6KkNSXs35Yg6arw=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ATAAAR59Rc/5ldJa1kGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBUwMBAQEBCwGBPSQFJwNpVSAECyiHWAOOfUqCDZclgS4UgRA?= =?us-ascii?q?DVAkBAQEMAQEYCwoCAQGEQAKCCCM2Bw4BAwEBBAEBAgEEbRwMhUoBAQEEAQE?= =?us-ascii?q?QKAYBASwCCgsEAgEIEQQBAR4BECcLHQgBAQQBEggTB4MBgWoDHQEOoXwCgTW?= =?us-ascii?q?IX4IggnkBAQWFAxiCDwMGgTIBijCBHheBQD8ma0aCTD6CYQEBgSUJARIBCRi?= =?us-ascii?q?DOoImiwScRQkCggmONYQ6ghAthhmNA4wllHcCBAIEBQIOAQEFgVYELWZxcBU?= =?us-ascii?q?7gmyCD4EkAQKCSIUUhT9ygSmMHoJDAQE?= X-IronPort-AV: E=Sophos;i="5.60,452,1549929600"; d="scan'208";a="271382399" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 10 May 2019 02:52:52 +0000 Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x4A2qqbK025053 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 10 May 2019 02:52:52 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 9 May 2019 21:52:51 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 9 May 2019 22:52:50 -0400 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 9 May 2019 22:52:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Zo5RO4XC6J05AsP6p2AqIXpFXk5KRIbXAkBIRt7Wps8=; b=X+myay8UpogAmxvn78V4JZcOGZLJ6h97Me2ZE3GmZdSmaAREprfw1+tf2+mP/8G74C3vlVuqivZ+qfMQGkItLRUwx7pZFA0mbHP+zB6Os+5MbZ5BsqszhGbjWJGPfolCQG+iwww65QUWrES5WSveiQCOhGWiZ7zd8ZRpIIa2urU= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1503.namprd11.prod.outlook.com (10.172.54.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Fri, 10 May 2019 02:52:49 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1878.022; Fri, 10 May 2019 02:52:49 +0000 From: "Panos Kampanakis (pkampana)" To: Hannes Tschofenig , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQA Date: Fri, 10 May 2019 02:52:49 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1006::392] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fdeda7a2-91b2-4452-6016-08d6d4f29699 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1503; x-ms-traffictypediagnostic: MWHPR11MB1503: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0033AAD26D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(366004)(39860400002)(376002)(136003)(13464003)(53754006)(199004)(189003)(40434004)(33656002)(7696005)(316002)(110136005)(99286004)(305945005)(25786009)(7736002)(9686003)(6246003)(76176011)(53936002)(86362001)(74316002)(6306002)(46003)(102836004)(53546011)(6506007)(186003)(486006)(11346002)(476003)(446003)(2501003)(966005)(55016002)(68736007)(81166006)(81156014)(8936002)(14454004)(229853002)(478600001)(6436002)(2906002)(6116002)(8676002)(71190400001)(76116006)(73956011)(66946007)(66476007)(66556008)(64756008)(66446008)(5660300002)(71200400001)(52536014)(5024004)(14444005)(256004); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1503; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: JblJurLrfz4bCuBNe2uns0FOa6MsbXEVtNvbPyhGe3s1OQVFBVBaNt7lOQHOmVbEzZrpxLLIGAMeqBvTk+hMgDIlc5+soPt8D3OrVLzn3dL89A5hsELbkzQaAsPkEfXCLWCbETREAoYASmaOPqqXbU89h/Rg5013d4O8cNs1j5AT1PwYYD90M/bTiVRZLfPhCt2u0RutaqITumrMWijItRlhVr4QBQQAZL78buNtj/NP85VLdQOd9NVYsFZbIEy33JYo/6SYH0IFHLyKgxjoCOd7Zm0bpAxGveQm6I8SXAedLXHQ63a3Qr/C8gUh0gkYeGZU5Rf7QtUKTX69UAG7hgY1LS/wyahtw5L8g4GEVxa5eJmrNhnbjIbZxMs82BswS3PNt5yC41Cw2spfzPNG+cITHnzNXhwuylz7Ccyg9Is= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fdeda7a2-91b2-4452-6016-08d6d4f29699 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2019 02:52:49.1420 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1503 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.11, xch-aln-001.cisco.com X-Outbound-Node: rcdn-core-2.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 May 2019 02:52:56 -0000 Thanks Hannes. Before I try to address it, can you help me understand what you are proposi= ng. To amend this paragraph maybe? -----Original Message----- From: Ace On Behalf Of Hannes Tschofenig Sent: Thursday, May 09, 2019 10:43 AM To: ace@ietf.org Subject: [Ace] EST over CoAP: Randomness Hi all, I am still a bit unhappy about this paragraph: " Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. " If you get hardware that does not have a hardware-based RNG then you are in= trouble. The main security protocols we look into do not work without a so= urce of randomness. Hence, getting the certificate & private key from the s= erver will not get you too far. I believe we should encourage developers to pick the correct hardware for t= he task rather than making them believe we have come up with solutions that= allow them to get away without a hardware-based RNG. I also do not believe the statement that random number key generation is co= stly. Can you give me some number? The references to [PsQs] [RSAorig] are IMHO also not appropriate because th= ey are conveying a different message (at least that's my understanding from= reading them). The message is that you have to be careful with designing a= nd using a random number generator on embedded systems because the sources = of entropy may just not be there (like keyboards, harddisk drive, processin= g scheduling, etc.). Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Fri May 10 01:57:56 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 600471201B7 for ; Fri, 10 May 2019 01:57:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pfIoqUjpZdsU for ; Fri, 10 May 2019 01:57:41 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60040.outbound.protection.outlook.com [40.107.6.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E9351201CC for ; Fri, 10 May 2019 01:57:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ly5UvIaQPXiFJ8qBjqmZSeO6chcV2cM5g8roMwHcS7Q=; b=BuAjnZAOPS0rgdwm2yO08rGlDBhs8I1cj8m11Hmuw6eerbehmb58PdBwOp6yoU5STc3vmVuKQ3Ay6cWel0vx2AaMhfIqqpCIjNMtWUoA96OahXJs1H7TH5Hfbr0+FZab/MDv23B5/WJKWZ/4NqVGPNbrYkpbKS/c5eFyKpMXmbY= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4741.eurprd08.prod.outlook.com (10.255.79.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.11; Fri, 10 May 2019 08:57:38 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1878.022; Fri, 10 May 2019 08:57:38 +0000 From: Hannes Tschofenig To: "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYA= Date: Fri, 10 May 2019 08:57:38 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.123.90] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 98c83e2f-e1ea-4d69-30a8-08d6d5258dd2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4741; x-ms-traffictypediagnostic: DBBPR08MB4741: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0033AAD26D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(396003)(136003)(366004)(39860400002)(40434004)(13464003)(53754006)(199004)(189003)(476003)(6436002)(478600001)(86362001)(72206003)(110136005)(966005)(53936002)(186003)(68736007)(11346002)(6116002)(486006)(446003)(66066001)(3846002)(74316002)(14444005)(71200400001)(5024004)(256004)(5660300002)(305945005)(71190400001)(8936002)(8676002)(55016002)(81166006)(81156014)(6306002)(6246003)(2501003)(9686003)(14454004)(316002)(33656002)(26005)(7736002)(2906002)(66556008)(64756008)(66446008)(73956011)(66946007)(6506007)(53546011)(76116006)(102836004)(52536014)(76176011)(66476007)(229853002)(7696005)(99286004)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4741; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: kQqfM0sLx31zz02Ivm+RJpTmumj+BayfspBzkpAaRYgni9DzIigK2CWBJCazJwroJ7OdyhD7CkWcKoKyesbW3K5LZ2WVAOIfqe5LMTlP52H5AZS2wQGwYGjjqww0LCtST5iZhdoQB/V3jsjGNmxFXtfUEpA/SSeTsy620/h0V1EXYfReC9t0hLwaW1JEL1RhDUEpB7LDqFDT4FKNMUzFyW04ekgL67Ro8djz/O9n4yKGq7yB3hhBbOkFWAKYNTvmC8vd8zhzPLvbBwQQaSVN5oi//hhA1o65tbG/1DHjF4TpAuz6us/xjJrnWBKYnHKrpYqY+7bu1FMTX3qVtpV8BYWQ2KTPrR7Rzs+jEzraBupi1HmciRAvX4Q+kd6OGaI3rnpMUc673ioM8hoOB7MCiPrcGJuXG/5HM7fIVeeZ/BE= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 98c83e2f-e1ea-4d69-30a8-08d6d5258dd2 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2019 08:57:38.8652 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4741 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 May 2019 08:57:55 -0000 Hi Panos, I had argued earlier that this feature shouldn't be in the draft but it see= ms that I will not get there. Hence, I believe it would be better to first shorten the following paragrap= h to a single line: FROM: " 5.8. Server-side Key Generation Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. Even though the random numbers that constitute the identity/cert do not get generated often, an endpoint may not want to spend time and energy generating keypairs, and just ask for one from the server. In these scenarios, server-side key generation can be used. .... " TO: " 5.8. Server-side Key Generation In scenarios where it is desirable that the server obtains access to the = private key the server-side key generation should be used. .... " In the security consideration section I would add a new section somewhere t= hat talks about the random number generation. " Random Number Generation Modern security protocol require random numbers to be available during the protocol run, for example for nonces, ephemeral Diffie-Hellman key generation. When the private key is generated by the IoT device then the capability to generate random numbers is also needed. When server- side key generation is used then the IoT device still needs random numbe= rs for use in security protocols, such as DTLS. It is important to note that sources contributing to the randomness pool on laptops or desktop PCs are not available on many IoT devices, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, as pointed out in [PsQs]. Other sources have to be found or dedicated hardware has to be added. Selecting hardware for an IoT device that is capable of producing high-quality random numbers is therefore important. " Does this make sense? Ciao Hannes PS: Note that I omitted the reference to RSA because ECC is so much more po= pular in the IoT space that there is no point in dealing with RSA these day= s. -----Original Message----- From: Panos Kampanakis (pkampana) Sent: Freitag, 10. Mai 2019 04:53 To: Hannes Tschofenig ; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Thanks Hannes. Before I try to address it, can you help me understand what you are proposi= ng. To amend this paragraph maybe? -----Original Message----- From: Ace On Behalf Of Hannes Tschofenig Sent: Thursday, May 09, 2019 10:43 AM To: ace@ietf.org Subject: [Ace] EST over CoAP: Randomness Hi all, I am still a bit unhappy about this paragraph: " Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. " If you get hardware that does not have a hardware-based RNG then you are in= trouble. The main security protocols we look into do not work without a so= urce of randomness. Hence, getting the certificate & private key from the s= erver will not get you too far. I believe we should encourage developers to pick the correct hardware for t= he task rather than making them believe we have come up with solutions that= allow them to get away without a hardware-based RNG. I also do not believe the statement that random number key generation is co= stly. Can you give me some number? The references to [PsQs] [RSAorig] are IMHO also not appropriate because th= ey are conveying a different message (at least that's my understanding from= reading them). The message is that you have to be careful with designing a= nd using a random number generator on embedded systems because the sources = of entropy may just not be there (like keyboards, harddisk drive, processin= g scheduling, etc.). Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Fri May 10 13:05:52 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDDB712011E for ; Fri, 10 May 2019 13:05:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=KX7KMeBC; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=erI/XEo/ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6OPUAdWdhFfY for ; Fri, 10 May 2019 13:05:47 -0700 (PDT) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD678120268 for ; Fri, 10 May 2019 13:05:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=20583; q=dns/txt; s=iport; t=1557518746; x=1558728346; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=E4oPWLescDtiXPQGrU0Cj4wvX8uC3dGI35FRT6xmQUo=; b=KX7KMeBC0uSRw1mo0C0WGXy8n5Gj4D72CslRisB4Hs/ymmLPorx+pm81 8gYZ7n8rA88Dq6RsarLxQNoyhWgmGFJ+dPAaWnS5vqZTqEoT+m5n+h8Go zUVi8xCud+ZUIJHD17qtNrtQ5PBnOrok8eYRU3FiNZfjrOu+bBH/i1sau o=; IronPort-PHdr: =?us-ascii?q?9a23=3AUqEm+xEeuaxS/cTiI6a+qJ1GYnJ96bzpIg4Y7I?= =?us-ascii?q?YmgLtSc6Oluo7vJ1Hb+e4z1Q3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNV?= =?us-ascii?q?cejNkO2QkpAcqLE0r+eebpZikiFcJLfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B1AADI2NVc/5NdJa1bCRoBAQEBAQI?= =?us-ascii?q?BAQEBBwIBAQEBgVQCAQEBAQsBgQ4vJAUnA2lVIAQLKIRjgQ2BaAOOfoJXkli?= =?us-ascii?q?ETYFCgRADVAkBAQEMAQEYAQoKAgEBgwmBNwKCCyM3Bg4BAwEBBAEBAgEEbRw?= =?us-ascii?q?MhUoBAQEDAQEBEBsTAQEsAgoEBwQCAQgRBAEBLycLHQgBAQQBEggTB4MBgR1?= =?us-ascii?q?NAw4PAQ6iAAKBNYhfgiCCeQEBBYUAGIIPAwaBMgGKMIEeF4FAPyZrRoJMPoJ?= =?us-ascii?q?hAQGBJQkBCAoBCRgFBx8LgwSCJosGCIcfiA6MNGUJAoIJihWEJIQ7ghMuhh2?= =?us-ascii?q?NC4wxlQMCBAIEBQIOAQEFgWUiZnFwFTuCbIEXVCSBJAECgkiFFIU/coEpjQ2?= =?us-ascii?q?CQwEB?= X-IronPort-AV: E=Sophos;i="5.60,454,1549929600"; d="scan'208,217";a="273939932" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 10 May 2019 20:05:45 +0000 Received: from xch-rcd-011.cisco.com (xch-rcd-011.cisco.com [173.37.102.21]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id x4AK5jFx014180 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 10 May 2019 20:05:45 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-RCD-011.cisco.com (173.37.102.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 10 May 2019 15:05:44 -0500 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 10 May 2019 15:05:44 -0500 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 10 May 2019 15:05:44 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FR4uj5Dza3WN5xjhSk56NjF+NhIzoa0aff/Fn8ao0Ak=; b=erI/XEo/ebPYgxAGAPKKG5G/vmNj7yI1NLdEUmPgkCqcfU0VF5x2d10WCn/RrxvXdAdUOHDn5IxgMhz5YjUSfh5wvE7KhRUznv7ziB0o9rD+OuwiK3/kBS4qqB1QkOgl0AL+HiL5Kn+WfoVxPZCliRtBfbDhdl1xd5GlspMY3kY= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1742.namprd11.prod.outlook.com (10.175.52.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.21; Fri, 10 May 2019 20:05:42 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1878.022; Fri, 10 May 2019 20:05:42 +0000 From: "Panos Kampanakis (pkampana)" To: Hannes Tschofenig , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMA== Date: Fri, 10 May 2019 20:05:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1002::276] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b17d22f8-fe1d-4c72-2811-08d6d582e193 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1742; x-ms-traffictypediagnostic: MWHPR11MB1742: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0033AAD26D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(396003)(39860400002)(366004)(136003)(376002)(189003)(199004)(40434004)(53754006)(13464003)(55016002)(966005)(305945005)(229853002)(81166006)(7736002)(256004)(5024004)(14444005)(6436002)(8936002)(8676002)(316002)(478600001)(81156014)(14454004)(68736007)(74316002)(9686003)(6306002)(5660300002)(30864003)(110136005)(6116002)(11346002)(476003)(53936002)(446003)(25786009)(46003)(486006)(99286004)(52536014)(102836004)(76176011)(86362001)(7696005)(53546011)(6506007)(2906002)(71190400001)(71200400001)(76116006)(33656002)(6246003)(2501003)(73956011)(66946007)(66446008)(66556008)(66476007)(64756008)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1742; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: isX6jtDGOhci3pGyRTtT38M3tUeha5c1mAG8DGKFQOHtGxnn8asnj22JIIaEYbfRr0kxF/HrGE7+ZDKCTRMOLAUTP3Ucoc4T7TH+zFj20bVIIxKpyg6IZSOZl+pulzbRKeQtUfKWMWb6lCQfnZLPot/BS/j9+xmCd3gVnt/BW+rE8mJOUvB3y9/sb3oVh3lFEFMYDN41kh3DEtBnebaqIYwy0N/6ge/0EaUKMKn4EIFUURXmA9LVDl1CeXSEnbPSu/iOC63sncr4MPa8xCG0DYBojwA+WdL/NQLifebyyOELkwNrU51a33iOxWr7tMjGIG6EFa87BadBMpleoUVCnBsGCFIB2RCRVq38F8vevrln8K4ZL4AWm5kqjzS9A449Sl2IbRhj24hBHtv1taRdFfI2YzUxiJPY4vbyNhPzS9w= Content-Type: multipart/alternative; boundary="_000_MWHPR11MB18389FB713EB9DEDDC75BA99C90C0MWHPR11MB1838namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b17d22f8-fe1d-4c72-2811-08d6d582e193 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2019 20:05:42.4814 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1742 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.21, xch-rcd-011.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 May 2019 20:05:51 -0000 --_000_MWHPR11MB18389FB713EB9DEDDC75BA99C90C0MWHPR11MB1838namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Hannes, > Hence, I believe it would be better to first shorten the following paragr= aph to a single line: Note that this paragraph was added from feedback in the review process just= to motivate server-side keygen. Given that your proposed text below practi= cally moves the points made in this paragraph in the Sec considerations sec= tion, I am all for shortening the paragraph. I was thinking something close= to what you wrote, but just to keep a couple of phrases as motivation abou= t the feature without creating an inaccurate sense of security: ~~~~~~~~~~ 5.8. Server-side Key Generation In scenarios where it is desirable that the server obtains access to the = private key the server-side key generation should be used. Such scenarios could be when it is conside= red more secure to generate at the server a long-lived random private key that identifies th= e client or when the resources spent to generate a random private key at the client are consid= ered scarce. ~~~~~~~~~~ > In the security consideration section I would add a new section somewhere= that talks about the random number generation. I like your text. I will add it with minor changes in orange. ~~~~~~~~~~ Modern security protocols require random numbers to be available during the protocol run, for example for nonces, ephemeral EC Diffie-Hellman ke= y generation. This capability to generate random numbers is also needed when the constrained device generates the private key (that corresponds to the public key enrolled in the CSR). When server-side key generation = is used, the constrained device depends on the server to generate the private key randomly, but it still needs locally generated random number= s for use in security protocols, such as DTLS. It is important to note that sources contributing to the randomness pool used to generate random numbers on laptops or desktop PCs are not available on many constrained devices, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, as pointed out in [PsQs]. Other sources have to be used or dedicated hardware has to be added. Selecting hardware for an IoT device that is capable of producing high-quality random numbers is therefore important. ~~~~~~~~~~ I hope it makes sense. Panos -----Original Message----- From: Hannes Tschofenig Sent: Friday, May 10, 2019 4:58 AM To: Panos Kampanakis (pkampana) ; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Hi Panos, I had argued earlier that this feature shouldn't be in the draft but it see= ms that I will not get there. Hence, I believe it would be better to first shorten the following paragrap= h to a single line: FROM: " 5.8. Server-side Key Generation Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. Even though the random numbers that constitute the identity/cert do not get generated often, an endpoint may not want to spend time and energy generating keypairs, and just ask for one from the server. In these scenarios, server-side key generation can be used. .... " TO: " 5.8. Server-side Key Generation In scenarios where it is desirable that the server obtains access to the = private key the server-side key generation should be used. .... " In the security consideration section I would add a new section somewhere t= hat talks about the random number generation. " Random Number Generation Modern security protocol require random numbers to be available during the protocol run, for example for nonces, ephemeral Diffie-Hellman key generation. When the private key is generated by the IoT device then the capability to generate random numbers is also needed. When server- side key generation is used then the IoT device still needs random numbe= rs for use in security protocols, such as DTLS. It is important to note that sources contributing to the randomness pool on laptops or desktop PCs are not available on many IoT devices, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, as pointed out in [PsQs]. Other sources have to be found or dedicated hardware has to be added. Selecting hardware for an IoT device that is capable of producing high-quality random numbers is therefore important. " Does this make sense? Ciao Hannes PS: Note that I omitted the reference to RSA because ECC is so much more po= pular in the IoT space that there is no point in dealing with RSA these day= s. -----Original Message----- From: Panos Kampanakis (pkampana) Sent: Freitag, 10. Mai 2019 04:53 To: Hannes Tschofenig ; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Thanks Hannes. Before I try to address it, can you help me understand what you are proposi= ng. To amend this paragraph maybe? -----Original Message----- From: Ace On Behalf Of Hannes Tschofenig Sent: Thursday, May 09, 2019 10:43 AM To: ace@ietf.org Subject: [Ace] EST over CoAP: Randomness Hi all, I am still a bit unhappy about this paragraph: " Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. " If you get hardware that does not have a hardware-based RNG then you are in= trouble. The main security protocols we look into do not work without a so= urce of randomness. Hence, getting the certificate & private key from the s= erver will not get you too far. I believe we should encourage developers to pick the correct hardware for t= he task rather than making them believe we have come up with solutions that= allow them to get away without a hardware-based RNG. I also do not believe the statement that random number key generation is co= stly. Can you give me some number? The references to [PsQs] [RSAorig] are IMHO also not appropriate because th= ey are conveying a different message (at least that's my understanding from= reading them). The message is that you have to be careful with designing a= nd using a random number generator on embedded systems because the sources = of entropy may just not be there (like keyboards, harddisk drive, processin= g scheduling, etc.). Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_MWHPR11MB18389FB713EB9DEDDC75BA99C90C0MWHPR11MB1838namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Hi Hannes,
 
> Hence, I believe it would be better to first shorten the followin= g paragraph to a single line:
 
Note that this paragraph was added from feedback in the review process= just to motivate server-side keygen. Given that your proposed text below p= ractically moves the points made in this paragraph in the Sec consideration= s section, I am all for shortening the paragraph. I was thinking something close to what you wrote, but just t= o keep a couple of phrases as motivation about the feature without creating= an inaccurate sense of security:
~~~~~~~~~~
5.8.  Server-side Key Generation
 
  In scenarios where it is desirable that the server obtains acce= ss to the private key the server-side
  key generation should be used. Such scenarios could be when it = is considered more secure to
  generate at the server a long-lived random private key that ide= ntifies the client or when the
  resources spent to generate a random private key at the client = are considered scarce.
~~~~~~~~~~
 
> In the security consideration section I would add a new section s= omewhere that talks about the random number generation.
 
I like your text. I will add it  with minor changes in orange.
~~~~~~~~~~
   Modern security protocols require random numbers to be av= ailable during
   the protocol run, for example for nonces, ephemeral EC Di= ffie-Hellman key
   generation. This capability to generate random numbers is= also needed
   when the constrained device generates the private key (that corresp= onds
   to the public key enrolled in the= CSR). When server-side key generation is
   used, the constrained device depends on the server to gener= ate the
   private key randomly, but it still needs locally generated random numbers
   for use in security protocols, such as DTLS.
 
   It is important to note that sources contributing to the = randomness
   pool used to generate random numb= ers on laptops or desktop PCs
   are not available on many constra= ined devices, such as mouse
   movement, timing of keystrokes, air turbulence on the
   movement of hard drive heads, as pointed out in [PsQs].&n= bsp; Other
   sources have to be used or= dedicated hardware has to be added.
   Selecting hardware for an IoT device that is capable of p= roducing
   high-quality random numbers is therefore important.
~~~~~~~~~~
 
I hope it makes sense.
 
Panos
 
 
-----Original Message-----
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
Sent: Friday, May 10, 2019 4:58 AM
To: Panos Kampanakis (pkampana) <pkampana@cisco.com>; ace@ietf.o= rg
Subject: RE: [Ace] EST over CoAP: Randomness
 
Hi Panos,
 
I had argued earlier that this feature shouldn't be in the draft but i= t seems that I will not get there.
 
Hence, I believe it would be better to first shorten the following par= agraph to a single line:
 
FROM:
 
"
5.8.  Server-side Key Generation
 
   Constrained devices sometimes do not have the necessary h= ardware to
   generate statistically random numbers for private keys an= d DTLS
   ephemeral keys.  Past experience has also shown that= low-resource
   endpoints sometimes generate numbers which could allow so= meone to
   decrypt the communication or guess the private key and im= personate as
   the device [PsQs] [RSAorig].  Additionally, random n= umber key
   generation is costly, thus energy draining. Even though t= he random
   numbers that constitute the identity/cert do not get gene= rated often,
   an endpoint may not want to spend time and energy generat= ing
   keypairs, and just ask for one from the server.
 
   In these scenarios, server-side key generation can be use= d.
   ....
"
 
TO:
 
"
5.8.  Server-side Key Generation
 
  In scenarios where it is desirable that the server obtains acce= ss to the private key the server-side
  key generation should be used.
  ....
"
 
In the security consideration section I would add a new section somewh= ere that talks about the random number generation.
 
"
Random Number Generation
 
   Modern security protocol require random numbers to be ava= ilable during
   the protocol run, for example for nonces, ephemeral Diffi= e-Hellman key
   generation. When the private key is generated by the IoT = device then
   the capability to generate random numbers is also needed.= When server-
   side key generation is used then the IoT device still nee= ds random numbers
   for use in security protocols, such as DTLS.
 
   It is important to note that sources contributing to the = randomness
   pool on laptops or desktop PCs are not available on many = IoT devices,
   such as mouse movement, timing of keystrokes, air turbule= nce on the
   movement of hard drive heads, as pointed out in [PsQs].&n= bsp; Other
   sources have to be found or dedicated hardware has to be = added.
   Selecting hardware for an IoT device that is capable of p= roducing
   high-quality random numbers is therefore important.
"
 
Does this make sense?
 
Ciao
Hannes
 
PS: Note that I omitted the reference to RSA because ECC is so much mo= re popular in the IoT space that there is no point in dealing with RSA thes= e days.
 
 
 
 
-----Original Message-----
From: Panos Kampanakis (pkampana) <pkampana@cisco.com>
Sent: Freitag, 10. Mai 2019 04:53
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; ace@ietf.org<= /div>
Subject: RE: [Ace] EST over CoAP: Randomness
 
Thanks Hannes.
Before I try to address it, can you help me understand what you are pr= oposing. To amend this paragraph maybe?
 
-----Original Message-----
From: Ace <ace-bounces@ietf.org> On Behalf Of Hannes Tschofenig<= /div>
Sent: Thursday, May 09, 2019 10:43 AM
To: ace@ietf.org
Subject: [Ace] EST over CoAP: Randomness
 
Hi all,
 
I am still a bit unhappy about this paragraph:
 
"
   Constrained devices sometimes do not have the necessary h= ardware to
   generate statistically random numbers for private keys an= d DTLS
   ephemeral keys.  Past experience has also shown that= low-resource
   endpoints sometimes generate numbers which could allow so= meone to
   decrypt the communication or guess the private key and im= personate as
   the device [PsQs] [RSAorig].  Additionally, random n= umber key
   generation is costly, thus energy draining.
"
 
If you get hardware that does not have a hardware-based RNG then you a= re in trouble. The main security protocols we look into do not work without= a source of randomness. Hence, getting the certificate & private key f= rom the server will not get you too far.
 
I believe we should encourage developers to pick the correct hardware = for the task rather than making them believe we have come up with solutions= that allow them to get away without a hardware-based RNG.
 
I also do not believe the statement that random number key generation = is costly. Can you give me some number?
 
The references to [PsQs] [RSAorig] are IMHO also not appropriate becau= se they are conveying a different message (at least that's my understanding= from reading them). The message is that you have to be careful with design= ing and using a random number generator on embedded systems because the sources of entropy may just not be there (l= ike keyboards, harddisk drive, processing scheduling, etc.).
 
Ciao
Hannes
 
IMPORTANT NOTICE: The contents of this email and any attachments are c= onfidential and may also be privileged. If you are not the intended recipie= nt, please notify the sender immediately and do not disclose the contents t= o any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
 
_______________________________________________
Ace mailing list
Ace@ietf.org
IMPORTANT NOTICE: The contents of this email and any attachments are c= onfidential and may also be privileged. If you are not the intended recipie= nt, please notify the sender immediately and do not disclose the contents t= o any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
 
 --_000_MWHPR11MB18389FB713EB9DEDDC75BA99C90C0MWHPR11MB1838namp_-- From nobody Fri May 10 14:33:49 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A41E312012D for ; Fri, 10 May 2019 14:33:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JllrKWFwk69Y for ; Fri, 10 May 2019 14:33:43 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10107.outbound.protection.outlook.com [40.107.1.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E524212006B for ; Fri, 10 May 2019 14:33:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancy-nl; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fkYYPvZxR79q/xw+LMJbAE6REmENcU3Ofw/4QId9PeY=; b=FD1CJQgn0P6hJAh2pAx2Y7/BB0xa9eL+6m5cbfah/kPB4BbVtLI4DUwap68M8JBc54qh2gYwqd0u5ryMSxpQ+LBOn9XP6J5aZOQzsYGkMrZ26ba+eqcxd3L8GuelozVEQC85IBe03pD5ujo7jDtlRjFeYj2dztGRyO2QImyLxJs= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0325.EURP190.PROD.OUTLOOK.COM (10.175.241.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1856.15; Fri, 10 May 2019 21:33:38 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::15e1:e6d0:bb1f:e59a]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::15e1:e6d0:bb1f:e59a%4]) with mapi id 15.20.1856.012; Fri, 10 May 2019 21:33:38 +0000 From: Esko Dijk To: "Panos Kampanakis (pkampana)" , Hannes Tschofenig , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMAAPxWTg Date: Fri, 10 May 2019 21:33:38 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [2001:1c02:3101:4800:e5d0:7d21:e3d0:2932] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 05fba63d-32a0-4db8-beed-08d6d58f2a09 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6P190MB0325; x-ms-traffictypediagnostic: DB6P190MB0325: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0033AAD26D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(366004)(136003)(396003)(39830400003)(376002)(199004)(189003)(40434004)(53754006)(13464003)(7696005)(76176011)(33656002)(74482002)(2501003)(508600001)(68736007)(966005)(14454004)(110136005)(606006)(99286004)(2906002)(9686003)(316002)(44832011)(102836004)(53546011)(7736002)(52536014)(6436002)(55016002)(86362001)(6506007)(186003)(790700001)(6116002)(74316002)(71190400001)(66446008)(11346002)(46003)(71200400001)(66946007)(446003)(76116006)(486006)(66476007)(66556008)(64756008)(476003)(73956011)(5660300002)(25786009)(229853002)(53936002)(6246003)(236005)(6306002)(54896002)(81156014)(81166006)(8676002)(256004)(8936002)(5024004)(14444005); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0325; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: SrOvY71ezCajEDg9p1iaHTZiMe4HHDt5o6eQN6o9cb9uvWo0tn83izQyKdrLs6Cor42XYPHaA86ZA9r1daPsUg+ClSTfMgdgsB5AhM9LrLqoAheXpkn49iRmJyV2E2XtO4pVk4iXjZ8OYHbYYGerc5M/em90CpTSEIQ+Opq//Hr6D/g/LJ1oQDj0xBARK9p3Wzh2oPHnwws8cob1ZfvF6Ya/QpqcPeIbhs/1HJ5269YAPmw7iMoVWbGhupevregBesnQJQ1kqBp6uWI/Ob42vGdas9toe3P1/bxOrz9h+oCe6TWlvtHVM+aj3UPpt8xGhWVnQfShhnpTCA3CIfsBLLZi6X2qrgHXVsj5Vnvgd/+hIPTdul3m5aCE95/pbQTYB3B8xL/CmrSZj1/9dE4lioPImjZmGamXCMlug4+KjpY= Content-Type: multipart/alternative; boundary="_000_DB6P190MB0054CCBC63956CBDFF8E0F37FD0C0DB6P190MB0054EURP_" MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: 05fba63d-32a0-4db8-beed-08d6d58f2a09 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 May 2019 21:33:38.0674 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0325 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 May 2019 21:33:48 -0000 --_000_DB6P190MB0054CCBC63956CBDFF8E0F37FD0C0DB6P190MB0054EURP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUGFub3MsIEhhbm5lcywNCg0KQW5vdGhlciByZWFzb24gZm9yIHNlcnZlci1zaWRlIGtleWdl biBjYW4gYmUgdGhhdCBhbiBJVCBkZXBhcnRtZW50L21hbmFnZXIgd2FudHMgaXQgdGhhdCB3YXku IFRoZXJlIGNvdWxkIGJlIGEgcG9saWN5IHRoYXQgdGhlIGtleXBhaXJzIGZvciBhbGwgZG9tYWlu IGNlcnRpZmljYXRlcyBtdXN0IGJlIGNyZWF0ZWQgYnkgdGhlIHN5c3RlbXMgdW5kZXIgZGlyZWN0 IGNvbnRyb2wgb2YgdGhlIElUIGRlcGFydG1lbnQuIChFLmcuIHRvIGNvbXBseSB3aXRoIG90aGVy IHBvbGljaWVzIG9yIHRvIGJlIGFibGUgdG8gdHJ1c3QgdGhlIHJhbmRvbW5lc3MgbGV2ZWwuIE9y IGp1c3QgYmVjYXVzZSB0aGF0IHdhcyB0aGUgd2F5IGl0IGFsd2F5cyBoYXMgYmVlbiB3aGVuIFBD cyB3ZXJlIHByb3Zpc2lvbmVkIHdpdGggY2VydGlmaWNhdGVzLikgIFRoaXMgY291bGQgYmUgbGlz dGVkIGFzIGFuIGFkZGl0aW9uYWwgcmVhc29uLg0KDQpCZXN0IHJlZ2FyZHMNCkVza28NCg0KRnJv bTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIFBhbm9zIEthbXBhbmFr aXMgKHBrYW1wYW5hKQ0KU2VudDogRnJpZGF5LCBNYXkgMTAsIDIwMTkgMjI6MDYNClRvOiBIYW5u ZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT47IGFjZUBpZXRmLm9yZw0K U3ViamVjdDogUmU6IFtBY2VdIEVTVCBvdmVyIENvQVA6IFJhbmRvbW5lc3MNCg0KSGkgSGFubmVz LA0KDQo+IEhlbmNlLCBJIGJlbGlldmUgaXQgd291bGQgYmUgYmV0dGVyIHRvIGZpcnN0IHNob3J0 ZW4gdGhlIGZvbGxvd2luZyBwYXJhZ3JhcGggdG8gYSBzaW5nbGUgbGluZToNCg0KTm90ZSB0aGF0 IHRoaXMgcGFyYWdyYXBoIHdhcyBhZGRlZCBmcm9tIGZlZWRiYWNrIGluIHRoZSByZXZpZXcgcHJv Y2VzcyBqdXN0IHRvIG1vdGl2YXRlIHNlcnZlci1zaWRlIGtleWdlbi4gR2l2ZW4gdGhhdCB5b3Vy IHByb3Bvc2VkIHRleHQgYmVsb3cgcHJhY3RpY2FsbHkgbW92ZXMgdGhlIHBvaW50cyBtYWRlIGlu IHRoaXMgcGFyYWdyYXBoIGluIHRoZSBTZWMgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiwgSSBhbSBh bGwgZm9yIHNob3J0ZW5pbmcgdGhlIHBhcmFncmFwaC4gSSB3YXMgdGhpbmtpbmcgc29tZXRoaW5n IGNsb3NlIHRvIHdoYXQgeW91IHdyb3RlLCBidXQganVzdCB0byBrZWVwIGEgY291cGxlIG9mIHBo cmFzZXMgYXMgbW90aXZhdGlvbiBhYm91dCB0aGUgZmVhdHVyZSB3aXRob3V0IGNyZWF0aW5nIGFu IGluYWNjdXJhdGUgc2Vuc2Ugb2Ygc2VjdXJpdHk6DQp+fn5+fn5+fn5+DQo1LjguICBTZXJ2ZXIt c2lkZSBLZXkgR2VuZXJhdGlvbg0KDQogIEluIHNjZW5hcmlvcyB3aGVyZSBpdCBpcyBkZXNpcmFi bGUgdGhhdCB0aGUgc2VydmVyIG9idGFpbnMgYWNjZXNzIHRvIHRoZSBwcml2YXRlIGtleSB0aGUg c2VydmVyLXNpZGUNCiAga2V5IGdlbmVyYXRpb24gc2hvdWxkIGJlIHVzZWQuIFN1Y2ggc2NlbmFy aW9zIGNvdWxkIGJlIHdoZW4gaXQgaXMgY29uc2lkZXJlZCBtb3JlIHNlY3VyZSB0bw0KICBnZW5l cmF0ZSBhdCB0aGUgc2VydmVyIGEgbG9uZy1saXZlZCByYW5kb20gcHJpdmF0ZSBrZXkgdGhhdCBp ZGVudGlmaWVzIHRoZSBjbGllbnQgb3Igd2hlbiB0aGUNCiAgcmVzb3VyY2VzIHNwZW50IHRvIGdl bmVyYXRlIGEgcmFuZG9tIHByaXZhdGUga2V5IGF0IHRoZSBjbGllbnQgYXJlIGNvbnNpZGVyZWQg c2NhcmNlLg0Kfn5+fn5+fn5+fg0KDQo+IEluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9uIHNl Y3Rpb24gSSB3b3VsZCBhZGQgYSBuZXcgc2VjdGlvbiBzb21ld2hlcmUgdGhhdCB0YWxrcyBhYm91 dCB0aGUgcmFuZG9tIG51bWJlciBnZW5lcmF0aW9uLg0KDQpJIGxpa2UgeW91ciB0ZXh0LiBJIHdp bGwgYWRkIGl0ICB3aXRoIG1pbm9yIGNoYW5nZXMgaW4gb3JhbmdlLg0Kfn5+fn5+fn5+fg0KICAg TW9kZXJuIHNlY3VyaXR5IHByb3RvY29scyByZXF1aXJlIHJhbmRvbSBudW1iZXJzIHRvIGJlIGF2 YWlsYWJsZSBkdXJpbmcNCiAgIHRoZSBwcm90b2NvbCBydW4sIGZvciBleGFtcGxlIGZvciBub25j ZXMsIGVwaGVtZXJhbCBFQyBEaWZmaWUtSGVsbG1hbiBrZXkNCiAgIGdlbmVyYXRpb24uIFRoaXMg Y2FwYWJpbGl0eSB0byBnZW5lcmF0ZSByYW5kb20gbnVtYmVycyBpcyBhbHNvIG5lZWRlZA0KICAg d2hlbiB0aGUgY29uc3RyYWluZWQgZGV2aWNlIGdlbmVyYXRlcyB0aGUgcHJpdmF0ZSBrZXkgKHRo YXQgY29ycmVzcG9uZHMNCiAgIHRvIHRoZSBwdWJsaWMga2V5IGVucm9sbGVkIGluIHRoZSBDU1Ip LiBXaGVuIHNlcnZlci1zaWRlIGtleSBnZW5lcmF0aW9uIGlzDQogICB1c2VkLCB0aGUgY29uc3Ry YWluZWQgZGV2aWNlIGRlcGVuZHMgb24gdGhlIHNlcnZlciB0byBnZW5lcmF0ZSB0aGUNCiAgIHBy aXZhdGUga2V5IHJhbmRvbWx5LCBidXQgaXQgc3RpbGwgbmVlZHMgbG9jYWxseSBnZW5lcmF0ZWQg cmFuZG9tIG51bWJlcnMNCiAgIGZvciB1c2UgaW4gc2VjdXJpdHkgcHJvdG9jb2xzLCBzdWNoIGFz IERUTFMuDQoNCiAgIEl0IGlzIGltcG9ydGFudCB0byBub3RlIHRoYXQgc291cmNlcyBjb250cmli dXRpbmcgdG8gdGhlIHJhbmRvbW5lc3MNCiAgIHBvb2wgdXNlZCB0byBnZW5lcmF0ZSByYW5kb20g bnVtYmVycyBvbiBsYXB0b3BzIG9yIGRlc2t0b3AgUENzDQogICBhcmUgbm90IGF2YWlsYWJsZSBv biBtYW55IGNvbnN0cmFpbmVkIGRldmljZXMsIHN1Y2ggYXMgbW91c2UNCiAgIG1vdmVtZW50LCB0 aW1pbmcgb2Yga2V5c3Ryb2tlcywgYWlyIHR1cmJ1bGVuY2Ugb24gdGhlDQogICBtb3ZlbWVudCBv ZiBoYXJkIGRyaXZlIGhlYWRzLCBhcyBwb2ludGVkIG91dCBpbiBbUHNRc10uICBPdGhlcg0KICAg c291cmNlcyBoYXZlIHRvIGJlIHVzZWQgb3IgZGVkaWNhdGVkIGhhcmR3YXJlIGhhcyB0byBiZSBh ZGRlZC4NCiAgIFNlbGVjdGluZyBoYXJkd2FyZSBmb3IgYW4gSW9UIGRldmljZSB0aGF0IGlzIGNh cGFibGUgb2YgcHJvZHVjaW5nDQogICBoaWdoLXF1YWxpdHkgcmFuZG9tIG51bWJlcnMgaXMgdGhl cmVmb3JlIGltcG9ydGFudC4NCn5+fn5+fn5+fn4NCg0KSSBob3BlIGl0IG1ha2VzIHNlbnNlLg0K DQpQYW5vcw0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBIYW5uZXMgVHNj aG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVu aWdAYXJtLmNvbT4+DQpTZW50OiBGcmlkYXksIE1heSAxMCwgMjAxOSA0OjU4IEFNDQpUbzogUGFu b3MgS2FtcGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNjby5jb208bWFpbHRvOnBrYW1w YW5hQGNpc2NvLmNvbT4+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1Ympl Y3Q6IFJFOiBbQWNlXSBFU1Qgb3ZlciBDb0FQOiBSYW5kb21uZXNzDQoNCkhpIFBhbm9zLA0KDQpJ IGhhZCBhcmd1ZWQgZWFybGllciB0aGF0IHRoaXMgZmVhdHVyZSBzaG91bGRuJ3QgYmUgaW4gdGhl IGRyYWZ0IGJ1dCBpdCBzZWVtcyB0aGF0IEkgd2lsbCBub3QgZ2V0IHRoZXJlLg0KDQpIZW5jZSwg SSBiZWxpZXZlIGl0IHdvdWxkIGJlIGJldHRlciB0byBmaXJzdCBzaG9ydGVuIHRoZSBmb2xsb3dp bmcgcGFyYWdyYXBoIHRvIGEgc2luZ2xlIGxpbmU6DQoNCkZST006DQoNCiINCjUuOC4gIFNlcnZl ci1zaWRlIEtleSBHZW5lcmF0aW9uDQoNCiAgIENvbnN0cmFpbmVkIGRldmljZXMgc29tZXRpbWVz IGRvIG5vdCBoYXZlIHRoZSBuZWNlc3NhcnkgaGFyZHdhcmUgdG8NCiAgIGdlbmVyYXRlIHN0YXRp c3RpY2FsbHkgcmFuZG9tIG51bWJlcnMgZm9yIHByaXZhdGUga2V5cyBhbmQgRFRMUw0KICAgZXBo ZW1lcmFsIGtleXMuICBQYXN0IGV4cGVyaWVuY2UgaGFzIGFsc28gc2hvd24gdGhhdCBsb3ctcmVz b3VyY2UNCiAgIGVuZHBvaW50cyBzb21ldGltZXMgZ2VuZXJhdGUgbnVtYmVycyB3aGljaCBjb3Vs ZCBhbGxvdyBzb21lb25lIHRvDQogICBkZWNyeXB0IHRoZSBjb21tdW5pY2F0aW9uIG9yIGd1ZXNz IHRoZSBwcml2YXRlIGtleSBhbmQgaW1wZXJzb25hdGUgYXMNCiAgIHRoZSBkZXZpY2UgW1BzUXNd IFtSU0FvcmlnXS4gIEFkZGl0aW9uYWxseSwgcmFuZG9tIG51bWJlciBrZXkNCiAgIGdlbmVyYXRp b24gaXMgY29zdGx5LCB0aHVzIGVuZXJneSBkcmFpbmluZy4gRXZlbiB0aG91Z2ggdGhlIHJhbmRv bQ0KICAgbnVtYmVycyB0aGF0IGNvbnN0aXR1dGUgdGhlIGlkZW50aXR5L2NlcnQgZG8gbm90IGdl dCBnZW5lcmF0ZWQgb2Z0ZW4sDQogICBhbiBlbmRwb2ludCBtYXkgbm90IHdhbnQgdG8gc3BlbmQg dGltZSBhbmQgZW5lcmd5IGdlbmVyYXRpbmcNCiAgIGtleXBhaXJzLCBhbmQganVzdCBhc2sgZm9y IG9uZSBmcm9tIHRoZSBzZXJ2ZXIuDQoNCiAgIEluIHRoZXNlIHNjZW5hcmlvcywgc2VydmVyLXNp ZGUga2V5IGdlbmVyYXRpb24gY2FuIGJlIHVzZWQuDQogICAuLi4uDQoiDQoNClRPOg0KDQoiDQo1 LjguICBTZXJ2ZXItc2lkZSBLZXkgR2VuZXJhdGlvbg0KDQogIEluIHNjZW5hcmlvcyB3aGVyZSBp dCBpcyBkZXNpcmFibGUgdGhhdCB0aGUgc2VydmVyIG9idGFpbnMgYWNjZXNzIHRvIHRoZSBwcml2 YXRlIGtleSB0aGUgc2VydmVyLXNpZGUNCiAga2V5IGdlbmVyYXRpb24gc2hvdWxkIGJlIHVzZWQu DQogIC4uLi4NCiINCg0KSW4gdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbiBJIHdv dWxkIGFkZCBhIG5ldyBzZWN0aW9uIHNvbWV3aGVyZSB0aGF0IHRhbGtzIGFib3V0IHRoZSByYW5k b20gbnVtYmVyIGdlbmVyYXRpb24uDQoNCiINClJhbmRvbSBOdW1iZXIgR2VuZXJhdGlvbg0KDQog ICBNb2Rlcm4gc2VjdXJpdHkgcHJvdG9jb2wgcmVxdWlyZSByYW5kb20gbnVtYmVycyB0byBiZSBh dmFpbGFibGUgZHVyaW5nDQogICB0aGUgcHJvdG9jb2wgcnVuLCBmb3IgZXhhbXBsZSBmb3Igbm9u Y2VzLCBlcGhlbWVyYWwgRGlmZmllLUhlbGxtYW4ga2V5DQogICBnZW5lcmF0aW9uLiBXaGVuIHRo ZSBwcml2YXRlIGtleSBpcyBnZW5lcmF0ZWQgYnkgdGhlIElvVCBkZXZpY2UgdGhlbg0KICAgdGhl IGNhcGFiaWxpdHkgdG8gZ2VuZXJhdGUgcmFuZG9tIG51bWJlcnMgaXMgYWxzbyBuZWVkZWQuIFdo ZW4gc2VydmVyLQ0KICAgc2lkZSBrZXkgZ2VuZXJhdGlvbiBpcyB1c2VkIHRoZW4gdGhlIElvVCBk ZXZpY2Ugc3RpbGwgbmVlZHMgcmFuZG9tIG51bWJlcnMNCiAgIGZvciB1c2UgaW4gc2VjdXJpdHkg cHJvdG9jb2xzLCBzdWNoIGFzIERUTFMuDQoNCiAgIEl0IGlzIGltcG9ydGFudCB0byBub3RlIHRo YXQgc291cmNlcyBjb250cmlidXRpbmcgdG8gdGhlIHJhbmRvbW5lc3MNCiAgIHBvb2wgb24gbGFw dG9wcyBvciBkZXNrdG9wIFBDcyBhcmUgbm90IGF2YWlsYWJsZSBvbiBtYW55IElvVCBkZXZpY2Vz LA0KICAgc3VjaCBhcyBtb3VzZSBtb3ZlbWVudCwgdGltaW5nIG9mIGtleXN0cm9rZXMsIGFpciB0 dXJidWxlbmNlIG9uIHRoZQ0KICAgbW92ZW1lbnQgb2YgaGFyZCBkcml2ZSBoZWFkcywgYXMgcG9p bnRlZCBvdXQgaW4gW1BzUXNdLiAgT3RoZXINCiAgIHNvdXJjZXMgaGF2ZSB0byBiZSBmb3VuZCBv ciBkZWRpY2F0ZWQgaGFyZHdhcmUgaGFzIHRvIGJlIGFkZGVkLg0KICAgU2VsZWN0aW5nIGhhcmR3 YXJlIGZvciBhbiBJb1QgZGV2aWNlIHRoYXQgaXMgY2FwYWJsZSBvZiBwcm9kdWNpbmcNCiAgIGhp Z2gtcXVhbGl0eSByYW5kb20gbnVtYmVycyBpcyB0aGVyZWZvcmUgaW1wb3J0YW50Lg0KIg0KDQpE b2VzIHRoaXMgbWFrZSBzZW5zZT8NCg0KQ2lhbw0KSGFubmVzDQoNClBTOiBOb3RlIHRoYXQgSSBv bWl0dGVkIHRoZSByZWZlcmVuY2UgdG8gUlNBIGJlY2F1c2UgRUNDIGlzIHNvIG11Y2ggbW9yZSBw b3B1bGFyIGluIHRoZSBJb1Qgc3BhY2UgdGhhdCB0aGVyZSBpcyBubyBwb2ludCBpbiBkZWFsaW5n IHdpdGggUlNBIHRoZXNlIGRheXMuDQoNCg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBrYW1wYW5hQGNpc2NvLmNvbTxt YWlsdG86cGthbXBhbmFAY2lzY28uY29tPj4NClNlbnQ6IEZyZWl0YWcsIDEwLiBNYWkgMjAxOSAw NDo1Mw0KVG86IEhhbm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPG1h aWx0bzpIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPj47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNl QGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtBY2VdIEVTVCBvdmVyIENvQVA6IFJhbmRvbW5lc3MN Cg0KVGhhbmtzIEhhbm5lcy4NCkJlZm9yZSBJIHRyeSB0byBhZGRyZXNzIGl0LCBjYW4geW91IGhl bHAgbWUgdW5kZXJzdGFuZCB3aGF0IHlvdSBhcmUgcHJvcG9zaW5nLiBUbyBhbWVuZCB0aGlzIHBh cmFncmFwaCBtYXliZT8NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEFjZSA8 YWNlLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVo YWxmIE9mIEhhbm5lcyBUc2Nob2ZlbmlnDQpTZW50OiBUaHVyc2RheSwgTWF5IDA5LCAyMDE5IDEw OjQzIEFNDQpUbzogYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBb QWNlXSBFU1Qgb3ZlciBDb0FQOiBSYW5kb21uZXNzDQoNCkhpIGFsbCwNCg0KSSBhbSBzdGlsbCBh IGJpdCB1bmhhcHB5IGFib3V0IHRoaXMgcGFyYWdyYXBoOg0KDQoiDQogICBDb25zdHJhaW5lZCBk ZXZpY2VzIHNvbWV0aW1lcyBkbyBub3QgaGF2ZSB0aGUgbmVjZXNzYXJ5IGhhcmR3YXJlIHRvDQog ICBnZW5lcmF0ZSBzdGF0aXN0aWNhbGx5IHJhbmRvbSBudW1iZXJzIGZvciBwcml2YXRlIGtleXMg YW5kIERUTFMNCiAgIGVwaGVtZXJhbCBrZXlzLiAgUGFzdCBleHBlcmllbmNlIGhhcyBhbHNvIHNo b3duIHRoYXQgbG93LXJlc291cmNlDQogICBlbmRwb2ludHMgc29tZXRpbWVzIGdlbmVyYXRlIG51 bWJlcnMgd2hpY2ggY291bGQgYWxsb3cgc29tZW9uZSB0bw0KICAgZGVjcnlwdCB0aGUgY29tbXVu aWNhdGlvbiBvciBndWVzcyB0aGUgcHJpdmF0ZSBrZXkgYW5kIGltcGVyc29uYXRlIGFzDQogICB0 aGUgZGV2aWNlIFtQc1FzXSBbUlNBb3JpZ10uICBBZGRpdGlvbmFsbHksIHJhbmRvbSBudW1iZXIg a2V5DQogICBnZW5lcmF0aW9uIGlzIGNvc3RseSwgdGh1cyBlbmVyZ3kgZHJhaW5pbmcuDQoiDQoN CklmIHlvdSBnZXQgaGFyZHdhcmUgdGhhdCBkb2VzIG5vdCBoYXZlIGEgaGFyZHdhcmUtYmFzZWQg Uk5HIHRoZW4geW91IGFyZSBpbiB0cm91YmxlLiBUaGUgbWFpbiBzZWN1cml0eSBwcm90b2NvbHMg d2UgbG9vayBpbnRvIGRvIG5vdCB3b3JrIHdpdGhvdXQgYSBzb3VyY2Ugb2YgcmFuZG9tbmVzcy4g SGVuY2UsIGdldHRpbmcgdGhlIGNlcnRpZmljYXRlICYgcHJpdmF0ZSBrZXkgZnJvbSB0aGUgc2Vy dmVyIHdpbGwgbm90IGdldCB5b3UgdG9vIGZhci4NCg0KSSBiZWxpZXZlIHdlIHNob3VsZCBlbmNv dXJhZ2UgZGV2ZWxvcGVycyB0byBwaWNrIHRoZSBjb3JyZWN0IGhhcmR3YXJlIGZvciB0aGUgdGFz ayByYXRoZXIgdGhhbiBtYWtpbmcgdGhlbSBiZWxpZXZlIHdlIGhhdmUgY29tZSB1cCB3aXRoIHNv bHV0aW9ucyB0aGF0IGFsbG93IHRoZW0gdG8gZ2V0IGF3YXkgd2l0aG91dCBhIGhhcmR3YXJlLWJh c2VkIFJORy4NCg0KSSBhbHNvIGRvIG5vdCBiZWxpZXZlIHRoZSBzdGF0ZW1lbnQgdGhhdCByYW5k b20gbnVtYmVyIGtleSBnZW5lcmF0aW9uIGlzIGNvc3RseS4gQ2FuIHlvdSBnaXZlIG1lIHNvbWUg bnVtYmVyPw0KDQpUaGUgcmVmZXJlbmNlcyB0byBbUHNRc10gW1JTQW9yaWddIGFyZSBJTUhPIGFs c28gbm90IGFwcHJvcHJpYXRlIGJlY2F1c2UgdGhleSBhcmUgY29udmV5aW5nIGEgZGlmZmVyZW50 IG1lc3NhZ2UgKGF0IGxlYXN0IHRoYXQncyBteSB1bmRlcnN0YW5kaW5nIGZyb20gcmVhZGluZyB0 aGVtKS4gVGhlIG1lc3NhZ2UgaXMgdGhhdCB5b3UgaGF2ZSB0byBiZSBjYXJlZnVsIHdpdGggZGVz aWduaW5nIGFuZCB1c2luZyBhIHJhbmRvbSBudW1iZXIgZ2VuZXJhdG9yIG9uIGVtYmVkZGVkIHN5 c3RlbXMgYmVjYXVzZSB0aGUgc291cmNlcyBvZiBlbnRyb3B5IG1heSBqdXN0IG5vdCBiZSB0aGVy ZSAobGlrZSBrZXlib2FyZHMsIGhhcmRkaXNrIGRyaXZlLCBwcm9jZXNzaW5nIHNjaGVkdWxpbmcs IGV0Yy4pLg0KDQpDaWFvDQpIYW5uZXMNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRz IG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBt YXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBp ZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNj bG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVy cG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhh bmsgeW91Lg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGlldGYub3JnPG1haWx0bzpBY2VAaWV0Zi5vcmc+DQpo dHRwczovL3d3dy5pZXRmLi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U8aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U+DQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVu dHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5k IG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp cGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRp c2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBw dXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBU aGFuayB5b3UuDQoNCg== --_000_DB6P190MB0054CCBC63956CBDFF8E0F37FD0C0DB6P190MB0054EURP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZW1haWxxdW90ZSwgbGkuZW1haWxx dW90ZSwgZGl2LmVtYWlscXVvdGUNCgl7bXNvLXN0eWxlLW5hbWU6ZW1haWxxdW90ZTsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjEuMHB0Ow0KCWJvcmRlcjpub25lOw0KCXBhZGRp bmc6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVw bHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4 dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250 LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsN CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGkgUGFub3MsIEhhbm5lcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QW5vdGhlciByZWFzb24gZm9yIHNlcnZlci1zaWRlIGtleWdlbiBjYW4gYmUgdGhhdCBhbiBJVCBk ZXBhcnRtZW50L21hbmFnZXIgd2FudHMgaXQgdGhhdCB3YXkuIFRoZXJlIGNvdWxkIGJlIGEgcG9s aWN5IHRoYXQgdGhlIGtleXBhaXJzIGZvciBhbGwgZG9tYWluIGNlcnRpZmljYXRlcyBtdXN0IGJl IGNyZWF0ZWQgYnkgdGhlIHN5c3RlbXMgdW5kZXIgZGlyZWN0IGNvbnRyb2wgb2YgdGhlIElUIGRl cGFydG1lbnQuDQogKEUuZy4gdG8gY29tcGx5IHdpdGggb3RoZXIgcG9saWNpZXMgb3IgdG8gYmUg YWJsZSB0byB0cnVzdCB0aGUgcmFuZG9tbmVzcyBsZXZlbC4gT3IganVzdCBiZWNhdXNlIHRoYXQg d2FzIHRoZSB3YXkgaXQgYWx3YXlzIGhhcyBiZWVuIHdoZW4gUENzIHdlcmUgcHJvdmlzaW9uZWQg d2l0aCBjZXJ0aWZpY2F0ZXMuKSZuYnNwOyBUaGlzIGNvdWxkIGJlIGxpc3RlZCBhcyBhbiBhZGRp dGlvbmFsIHJlYXNvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVzdCByZWdhcmRzPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Fc2tvPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gQWNlICZs dDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NClBhbm9zIEth bXBhbmFraXMgKHBrYW1wYW5hKTxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE1heSAxMCwgMjAx OSAyMjowNjxicj4NCjxiPlRvOjwvYj4gSGFubmVzIFRzY2hvZmVuaWcgJmx0O0hhbm5lcy5Uc2No b2ZlbmlnQGFybS5jb20mZ3Q7OyBhY2VAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtBY2VdIEVTVCBvdmVyIENvQVA6IFJhbmRvbW5lc3M8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBIYW5uZXMsIDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IEhlbmNlLCBJIGJlbGlldmUgaXQg d291bGQgYmUgYmV0dGVyIHRvIGZpcnN0IHNob3J0ZW4gdGhlIGZvbGxvd2luZyBwYXJhZ3JhcGgg dG8gYSBzaW5nbGUgbGluZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Tm90ZSB0aGF0IHRoaXMgcGFyYWdyYXBoIHdhcyBhZGRlZCBmcm9tIGZl ZWRiYWNrIGluIHRoZSByZXZpZXcgcHJvY2VzcyBqdXN0IHRvIG1vdGl2YXRlIHNlcnZlci1zaWRl IGtleWdlbi4gR2l2ZW4gdGhhdCB5b3VyIHByb3Bvc2VkIHRleHQgYmVsb3cgcHJhY3RpY2FsbHkg bW92ZXMgdGhlIHBvaW50cyBtYWRlIGluIHRoaXMgcGFyYWdyYXBoIGluIHRoZSBTZWMgY29uc2lk ZXJhdGlvbnMgc2VjdGlvbiwgSSBhbQ0KIGFsbCBmb3Igc2hvcnRlbmluZyB0aGUgcGFyYWdyYXBo LiBJIHdhcyB0aGlua2luZyBzb21ldGhpbmcgY2xvc2UgdG8gd2hhdCB5b3Ugd3JvdGUsIGJ1dCBq dXN0IHRvIGtlZXAgYSBjb3VwbGUgb2YgcGhyYXNlcyBhcyBtb3RpdmF0aW9uIGFib3V0IHRoZSBm ZWF0dXJlIHdpdGhvdXQgY3JlYXRpbmcgYW4gaW5hY2N1cmF0ZSBzZW5zZSBvZiBzZWN1cml0eToN CjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+fn5+ fn5+fn5+fjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+NS44LiZuYnNwOyBTZXJ2ZXItc2lkZSBLZXkgR2VuZXJhdGlvbjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgSW4gc2NlbmFyaW9z IHdoZXJlIGl0IGlzIGRlc2lyYWJsZSB0aGF0IHRoZSBzZXJ2ZXIgb2J0YWlucyBhY2Nlc3MgdG8g dGhlIHByaXZhdGUga2V5IHRoZSBzZXJ2ZXItc2lkZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IGtleSBnZW5lcmF0aW9uIHNob3VsZCBi ZSB1c2VkLiBTdWNoIHNjZW5hcmlvcyBjb3VsZCBiZSB3aGVuIGl0IGlzIGNvbnNpZGVyZWQgbW9y ZSBzZWN1cmUgdG8NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7IGdlbmVyYXRlIGF0IHRoZSBzZXJ2ZXIgYSBsb25nLWxpdmVkIHJhbmRv bSBwcml2YXRlIGtleSB0aGF0IGlkZW50aWZpZXMgdGhlIGNsaWVudCBvciB3aGVuIHRoZQ0KPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg cmVzb3VyY2VzIHNwZW50IHRvIGdlbmVyYXRlIGEgcmFuZG9tIHByaXZhdGUga2V5IGF0IHRoZSBj bGllbnQgYXJlIGNvbnNpZGVyZWQgc2NhcmNlLg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5+fn5+fn5+fn5+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgSW4gdGhlIHNlY3VyaXR5IGNv bnNpZGVyYXRpb24gc2VjdGlvbiBJIHdvdWxkIGFkZCBhIG5ldyBzZWN0aW9uIHNvbWV3aGVyZSB0 aGF0IHRhbGtzIGFib3V0IHRoZSByYW5kb20gbnVtYmVyIGdlbmVyYXRpb24uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgbGlrZSB5b3VyIHRl eHQuIEkgd2lsbCBhZGQgaXQmbmJzcDsgd2l0aCBtaW5vciBjaGFuZ2VzIGluIG9yYW5nZS4NCjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+fn5+fn5+ fn5+fjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7Jm5ic3A7IE1vZGVybiBzZWN1cml0eSBwcm90b2NvbHMgcmVxdWlyZSByYW5kb20gbnVt YmVycyB0byBiZSBhdmFpbGFibGUgZHVyaW5nPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgdGhlIHByb3RvY29sIHJ1biwgZm9y IGV4YW1wbGUgZm9yIG5vbmNlcywgZXBoZW1lcmFsIEVDIERpZmZpZS1IZWxsbWFuIGtleTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5i c3A7IGdlbmVyYXRpb24uIFRoaXMgY2FwYWJpbGl0eSB0byBnZW5lcmF0ZSByYW5kb20gbnVtYmVy cyBpcyBhbHNvIG5lZWRlZA0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgd2hlbiA8c3BhbiBzdHlsZT0iY29sb3I6I0VEN0Qz MSI+dGhlIGNvbnN0cmFpbmVkIGRldmljZSBnZW5lcmF0ZXMgdGhlIHByaXZhdGUga2V5ICh0aGF0 IGNvcnJlc3BvbmRzDQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0VEN0QzMSI+Jm5ic3A7Jm5ic3A7 IHRvIHRoZSBwdWJsaWMga2V5IGVucm9sbGVkIGluIHRoZSBDU1IpPC9zcGFuPjxzcGFuIHN0eWxl PSJjb2xvcjpibGFjayI+LiBXaGVuIHNlcnZlci1zaWRlIGtleSBnZW5lcmF0aW9uIGlzDQo8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDsmbmJzcDsgdXNlZCwgPHNwYW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPnRoZSBjb25zdHJh aW5lZCBkZXZpY2UgZGVwZW5kcyBvbiB0aGUgc2VydmVyIHRvIGdlbmVyYXRlIHRoZQ0KPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPiZuYnNwOyZuYnNwOyBwcml2YXRlIGtleSByYW5kb21s eSw8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4gYnV0IGl0IHN0aWxsIG5lZWRzDQo8 L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPmxvY2FsbHkgZ2VuZXJhdGVkPC9zcGFu PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+IHJhbmRvbSBudW1iZXJzPC9zcGFuPjxzcGFuIHN0 eWxlPSJjb2xvcjojRUQ3RDMxIj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBmb3IgdXNlIGluIHNlY3VyaXR5 IHByb3RvY29scywgc3VjaCBhcyBEVExTLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgSXQgaXMgaW1wb3J0YW50IHRvIG5v dGUgdGhhdCBzb3VyY2VzIGNvbnRyaWJ1dGluZyB0byB0aGUgcmFuZG9tbmVzczxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IHBv b2wgPHNwYW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPnVzZWQgdG8gZ2VuZXJhdGUgcmFuZG9tIG51 bWJlcnM8L3NwYW4+IG9uIGxhcHRvcHMgb3IgZGVza3RvcCBQQ3MNCjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IGFyZSBub3Qg YXZhaWxhYmxlIG9uIG1hbnkgPHNwYW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPmNvbnN0cmFpbmVk PC9zcGFuPiBkZXZpY2VzLCBzdWNoIGFzIG1vdXNlDQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBtb3ZlbWVudCwgdGltaW5n IG9mIGtleXN0cm9rZXMsIGFpciB0dXJidWxlbmNlIG9uIHRoZTxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IG1vdmVtZW50IG9m IGhhcmQgZHJpdmUgaGVhZHMsIGFzIHBvaW50ZWQgb3V0IGluIFtQc1FzXS4mbmJzcDsgT3RoZXI8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyZuYnNwOyBzb3VyY2VzIGhhdmUgdG8gYmUgPHNwYW4gc3R5bGU9ImNvbG9yOiNFRDdEMzEiPnVz ZWQ8L3NwYW4+IG9yIGRlZGljYXRlZCBoYXJkd2FyZSBoYXMgdG8gYmUgYWRkZWQuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsg U2VsZWN0aW5nIGhhcmR3YXJlIGZvciBhbiBJb1QgZGV2aWNlIHRoYXQgaXMgY2FwYWJsZSBvZiBw cm9kdWNpbmc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyZuYnNwOyBoaWdoLXF1YWxpdHkgcmFuZG9tIG51bWJlcnMgaXMgdGhlcmVmb3Jl IGltcG9ydGFudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPn5+fn5+fn5+fn48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SSBob3BlIGl0IG1ha2VzIHNlbnNlLiA8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGFub3M8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+RnJvbTogSGFubmVzIFRzY2hvZmVuaWcgJmx0OzxhIGhyZWY9Im1haWx0bzpIYW5uZXMu VHNjaG9mZW5pZ0Bhcm0uY29tIj5IYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPC9hPiZndDsNCjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VudDog RnJpZGF5LCBNYXkgMTAsIDIwMTkgNDo1OCBBTTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VG86IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSAm bHQ7PGEgaHJlZj0ibWFpbHRvOnBrYW1wYW5hQGNpc2NvLmNvbSI+cGthbXBhbmFAY2lzY28uY29t PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdWJq ZWN0OiBSRTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzczxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBQYW5vcyw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBoYWQgYXJndWVk IGVhcmxpZXIgdGhhdCB0aGlzIGZlYXR1cmUgc2hvdWxkbid0IGJlIGluIHRoZSBkcmFmdCBidXQg aXQgc2VlbXMgdGhhdCBJIHdpbGwgbm90IGdldCB0aGVyZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVuY2UsIEkgYmVsaWV2ZSBpdCB3b3Vs ZCBiZSBiZXR0ZXIgdG8gZmlyc3Qgc2hvcnRlbiB0aGUgZm9sbG93aW5nIHBhcmFncmFwaCB0byBh IHNpbmdsZSBsaW5lOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5GUk9NOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjUuOC4mbmJzcDsgU2VydmVyLXNpZGUgS2V5IEdlbmVyYXRpb248bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 Jm5ic3A7IENvbnN0cmFpbmVkIGRldmljZXMgc29tZXRpbWVzIGRvIG5vdCBoYXZlIHRoZSBuZWNl c3NhcnkgaGFyZHdhcmUgdG88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBnZW5lcmF0ZSBzdGF0aXN0aWNhbGx5IHJhbmRvbSBu dW1iZXJzIGZvciBwcml2YXRlIGtleXMgYW5kIERUTFM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBlcGhlbWVyYWwga2V5cy4m bmJzcDsgUGFzdCBleHBlcmllbmNlIGhhcyBhbHNvIHNob3duIHRoYXQgbG93LXJlc291cmNlPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsm bmJzcDsgZW5kcG9pbnRzIHNvbWV0aW1lcyBnZW5lcmF0ZSBudW1iZXJzIHdoaWNoIGNvdWxkIGFs bG93IHNvbWVvbmUgdG88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBkZWNyeXB0IHRoZSBjb21tdW5pY2F0aW9uIG9yIGd1ZXNz IHRoZSBwcml2YXRlIGtleSBhbmQgaW1wZXJzb25hdGUgYXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyB0aGUgZGV2aWNlIFtQ c1FzXSBbUlNBb3JpZ10uJm5ic3A7IEFkZGl0aW9uYWxseSwgcmFuZG9tIG51bWJlciBrZXk8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZu YnNwOyBnZW5lcmF0aW9uIGlzIGNvc3RseSwgdGh1cyBlbmVyZ3kgZHJhaW5pbmcuIEV2ZW4gdGhv dWdoIHRoZSByYW5kb208bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBudW1iZXJzIHRoYXQgY29uc3RpdHV0ZSB0aGUgaWRlbnRp dHkvY2VydCBkbyBub3QgZ2V0IGdlbmVyYXRlZCBvZnRlbiw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBhbiBlbmRwb2ludCBt YXkgbm90IHdhbnQgdG8gc3BlbmQgdGltZSBhbmQgZW5lcmd5IGdlbmVyYXRpbmc8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBr ZXlwYWlycywgYW5kIGp1c3QgYXNrIGZvciBvbmUgZnJvbSB0aGUgc2VydmVyLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsg SW4gdGhlc2Ugc2NlbmFyaW9zLCBzZXJ2ZXItc2lkZSBrZXkgZ2VuZXJhdGlvbiBjYW4gYmUgdXNl ZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOyZuYnNwOyAuLi4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VE86PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+NS44LiZuYnNwOyBTZXJ2ZXItc2lkZSBLZXkgR2VuZXJhdGlvbjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgSW4gc2NlbmFyaW9zIHdoZXJlIGl0IGlzIGRlc2lyYWJsZSB0aGF0IHRoZSBzZXJ2ZXIgb2J0 YWlucyBhY2Nlc3MgdG8gdGhlIHByaXZhdGUga2V5IHRoZSBzZXJ2ZXItc2lkZTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IGtleSBnZW5l cmF0aW9uIHNob3VsZCBiZSB1c2VkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IC4uLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlv biBzZWN0aW9uIEkgd291bGQgYWRkIGEgbmV3IHNlY3Rpb24gc29tZXdoZXJlIHRoYXQgdGFsa3Mg YWJvdXQgdGhlIHJhbmRvbSBudW1iZXIgZ2VuZXJhdGlvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+JnF1b3Q7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SYW5kb20gTnVtYmVyIEdlbmVyYXRp b248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7Jm5ic3A7IE1vZGVybiBzZWN1cml0eSBwcm90b2NvbCByZXF1aXJlIHJhbmRvbSBudW1i ZXJzIHRvIGJlIGF2YWlsYWJsZSBkdXJpbmc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyB0aGUgcHJvdG9jb2wgcnVuLCBmb3Ig ZXhhbXBsZSBmb3Igbm9uY2VzLCBlcGhlbWVyYWwgRGlmZmllLUhlbGxtYW4ga2V5PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsg Z2VuZXJhdGlvbi4gV2hlbiB0aGUgcHJpdmF0ZSBrZXkgaXMgZ2VuZXJhdGVkIGJ5IHRoZSBJb1Qg ZGV2aWNlIHRoZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyZuYnNwOyB0aGUgY2FwYWJpbGl0eSB0byBnZW5lcmF0ZSByYW5kb20gbnVt YmVycyBpcyBhbHNvIG5lZWRlZC4gV2hlbiBzZXJ2ZXItPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgc2lkZSBrZXkgZ2VuZXJh dGlvbiBpcyB1c2VkIHRoZW4gdGhlIElvVCBkZXZpY2Ugc3RpbGwgbmVlZHMgcmFuZG9tIG51bWJl cnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOyZuYnNwOyBmb3IgdXNlIGluIHNlY3VyaXR5IHByb3RvY29scywgc3VjaCBhcyBEVExTLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsmbmJzcDsgSXQgaXMgaW1wb3J0YW50IHRvIG5vdGUgdGhhdCBzb3VyY2VzIGNvbnRyaWJ1dGlu ZyB0byB0aGUgcmFuZG9tbmVzczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IHBvb2wgb24gbGFwdG9wcyBvciBkZXNrdG9wIFBD cyBhcmUgbm90IGF2YWlsYWJsZSBvbiBtYW55IElvVCBkZXZpY2VzLDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IHN1Y2ggYXMg bW91c2UgbW92ZW1lbnQsIHRpbWluZyBvZiBrZXlzdHJva2VzLCBhaXIgdHVyYnVsZW5jZSBvbiB0 aGU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOyZuYnNwOyBtb3ZlbWVudCBvZiBoYXJkIGRyaXZlIGhlYWRzLCBhcyBwb2ludGVkIG91dCBp biBbUHNRc10uJm5ic3A7IE90aGVyPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgc291cmNlcyBoYXZlIHRvIGJlIGZvdW5kIG9y IGRlZGljYXRlZCBoYXJkd2FyZSBoYXMgdG8gYmUgYWRkZWQuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgU2VsZWN0aW5nIGhh cmR3YXJlIGZvciBhbiBJb1QgZGV2aWNlIHRoYXQgaXMgY2FwYWJsZSBvZiBwcm9kdWNpbmc8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZu YnNwOyBoaWdoLXF1YWxpdHkgcmFuZG9tIG51bWJlcnMgaXMgdGhlcmVmb3JlIGltcG9ydGFudC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90 OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5E b2VzIHRoaXMgbWFrZSBzZW5zZT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Q2lhbzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SGFubmVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBTOiBOb3RlIHRoYXQgSSBvbWl0dGVkIHRoZSByZWZlcmVu Y2UgdG8gUlNBIGJlY2F1c2UgRUNDIGlzIHNvIG11Y2ggbW9yZSBwb3B1bGFyIGluIHRoZSBJb1Qg c3BhY2UgdGhhdCB0aGVyZSBpcyBubyBwb2ludCBpbiBkZWFsaW5nIHdpdGggUlNBIHRoZXNlIGRh eXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Gcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2Ft cGFuYSkgJmx0OzxhIGhyZWY9Im1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20iPnBrYW1wYW5hQGNp c2NvLmNvbTwvYT4mZ3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5TZW50OiBGcmVpdGFnLCAxMC4gTWFpIDIwMTkgMDQ6NTM8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvOiBIYW5uZXMgVHNjaG9m ZW5pZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20iPkhhbm5l cy5Uc2Nob2ZlbmlnQGFybS5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5v cmciPmFjZUBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlN1YmplY3Q6IFJFOiBbQWNlXSBFU1Qgb3ZlciBDb0FQOiBSYW5kb21u ZXNzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoYW5rcyBIYW5uZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5CZWZvcmUgSSB0cnkgdG8gYWRkcmVzcyBpdCwgY2FuIHlvdSBoZWxwIG1lIHVu ZGVyc3RhbmQgd2hhdCB5b3UgYXJlIHByb3Bvc2luZy4gVG8gYW1lbmQgdGhpcyBwYXJhZ3JhcGgg bWF5YmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Gcm9tOiBBY2UgJmx0OzxhIGhyZWY9Im1haWx0bzph Y2UtYm91bmNlc0BpZXRmLm9yZyI+YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBPbiBCZWhh bGYgT2YgSGFubmVzIFRzY2hvZmVuaWc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlNlbnQ6IFRodXJzZGF5LCBNYXkgMDksIDIwMTkgMTA6NDMgQU08 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvOiA8 YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdWJqZWN0OiBbQWNlXSBF U1Qgb3ZlciBDb0FQOiBSYW5kb21uZXNzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIGFsbCw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhbSBzdGlsbCBhIGJpdCB1bmhhcHB5IGFib3V0 IHRoaXMgcGFyYWdyYXBoOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBDb25zdHJhaW5lZCBkZXZpY2VzIHNvbWV0aW1l cyBkbyBub3QgaGF2ZSB0aGUgbmVjZXNzYXJ5IGhhcmR3YXJlIHRvPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgZ2VuZXJhdGUg c3RhdGlzdGljYWxseSByYW5kb20gbnVtYmVycyBmb3IgcHJpdmF0ZSBrZXlzIGFuZCBEVExTPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsm bmJzcDsgZXBoZW1lcmFsIGtleXMuJm5ic3A7IFBhc3QgZXhwZXJpZW5jZSBoYXMgYWxzbyBzaG93 biB0aGF0IGxvdy1yZXNvdXJjZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IGVuZHBvaW50cyBzb21ldGltZXMgZ2VuZXJhdGUg bnVtYmVycyB3aGljaCBjb3VsZCBhbGxvdyBzb21lb25lIHRvPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgZGVjcnlwdCB0aGUg Y29tbXVuaWNhdGlvbiBvciBndWVzcyB0aGUgcHJpdmF0ZSBrZXkgYW5kIGltcGVyc29uYXRlIGFz PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsmbmJzcDsgdGhlIGRldmljZSBbUHNRc10gW1JTQW9yaWddLiZuYnNwOyBBZGRpdGlvbmFsbHks IHJhbmRvbSBudW1iZXIga2V5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgZ2VuZXJhdGlvbiBpcyBjb3N0bHksIHRodXMgZW5l cmd5IGRyYWluaW5nLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPklmIHlvdSBnZXQgaGFyZHdhcmUgdGhhdCBkb2VzIG5vdCBoYXZlIGEgaGFy ZHdhcmUtYmFzZWQgUk5HIHRoZW4geW91IGFyZSBpbiB0cm91YmxlLiBUaGUgbWFpbiBzZWN1cml0 eSBwcm90b2NvbHMgd2UgbG9vayBpbnRvIGRvIG5vdCB3b3JrIHdpdGhvdXQgYSBzb3VyY2Ugb2Yg cmFuZG9tbmVzcy4gSGVuY2UsIGdldHRpbmcgdGhlIGNlcnRpZmljYXRlICZhbXA7IHByaXZhdGUg a2V5IGZyb20gdGhlIHNlcnZlciB3aWxsDQogbm90IGdldCB5b3UgdG9vIGZhci48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBiZWxpZXZlIHdl IHNob3VsZCBlbmNvdXJhZ2UgZGV2ZWxvcGVycyB0byBwaWNrIHRoZSBjb3JyZWN0IGhhcmR3YXJl IGZvciB0aGUgdGFzayByYXRoZXIgdGhhbiBtYWtpbmcgdGhlbSBiZWxpZXZlIHdlIGhhdmUgY29t ZSB1cCB3aXRoIHNvbHV0aW9ucyB0aGF0IGFsbG93IHRoZW0gdG8gZ2V0IGF3YXkgd2l0aG91dCBh IGhhcmR3YXJlLWJhc2VkIFJORy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SSBhbHNvIGRvIG5vdCBiZWxpZXZlIHRoZSBzdGF0ZW1lbnQgdGhh dCByYW5kb20gbnVtYmVyIGtleSBnZW5lcmF0aW9uIGlzIGNvc3RseS4gQ2FuIHlvdSBnaXZlIG1l IHNvbWUgbnVtYmVyPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGUgcmVmZXJlbmNlcyB0byBbUHNRc10gW1JTQW9yaWddIGFyZSBJTUhPIGFs c28gbm90IGFwcHJvcHJpYXRlIGJlY2F1c2UgdGhleSBhcmUgY29udmV5aW5nIGEgZGlmZmVyZW50 IG1lc3NhZ2UgKGF0IGxlYXN0IHRoYXQncyBteSB1bmRlcnN0YW5kaW5nIGZyb20gcmVhZGluZyB0 aGVtKS4gVGhlIG1lc3NhZ2UgaXMgdGhhdCB5b3UgaGF2ZSB0byBiZSBjYXJlZnVsIHdpdGggZGVz aWduaW5nIGFuZCB1c2luZyBhDQogcmFuZG9tIG51bWJlciBnZW5lcmF0b3Igb24gZW1iZWRkZWQg c3lzdGVtcyBiZWNhdXNlIHRoZSBzb3VyY2VzIG9mIGVudHJvcHkgbWF5IGp1c3Qgbm90IGJlIHRo ZXJlIChsaWtlIGtleWJvYXJkcywgaGFyZGRpc2sgZHJpdmUsIHByb2Nlc3Npbmcgc2NoZWR1bGlu ZywgZXRjLikuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkNpYW88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkhhbm5lczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBh bmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZp bGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3Rp ZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50 cyB0byBhbnkgb3RoZXIgcGVyc29uLA0KIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3Jl IG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFjZSBtYWlsaW5nIGxpc3Q8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Im1h aWx0bzpBY2VAaWV0Zi5vcmciPkFjZUBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5odHRwczovL3d3dy5pZXRmLi5vcmcvbWFpbG1hbi9s aXN0aW5mby9hY2U8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBh bmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZp bGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3Rp ZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50 cyB0byBhbnkgb3RoZXIgcGVyc29uLA0KIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3Jl IG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DB6P190MB0054CCBC63956CBDFF8E0F37FD0C0DB6P190MB0054EURP_-- From nobody Tue May 14 09:41:41 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D293C120132 for ; Tue, 14 May 2019 09:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eDX7tRS_WJfL for ; Tue, 14 May 2019 09:41:34 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10058.outbound.protection.outlook.com [40.107.1.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69228120120 for ; Tue, 14 May 2019 09:41:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GaQi8DQ8BfBBwlreQgmt0a0zSzCYmTsy6zVfYCQFiOQ=; b=qk1S9tJ5MJmJ9SwMPUUsiRB4czkYmw1orkpWfHoto/daj/X7Z3oq2DDwWGpLMD2MAZU2yBFQQO8xlgTv+ugFm8XX2si0E1iwKu3ajChk1Iwnh0tI/vavCB2kUM7z4bfqNgBbsB282UP1s1VYKLVRO6/6d7maGG11pzLcbxLHq5g= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4774.eurprd08.prod.outlook.com (20.179.45.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Tue, 14 May 2019 16:41:28 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1878.024; Tue, 14 May 2019 16:41:28 +0000 From: Hannes Tschofenig To: "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMADO5pcw Date: Tue, 14 May 2019 16:41:28 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [96.64.251.237] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 89b70cba-f328-4cce-57ea-08d6d88b033d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4774; x-ms-traffictypediagnostic: DBBPR08MB4774: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0037FD6480 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(39860400002)(396003)(366004)(376002)(346002)(40434004)(189003)(199004)(53754006)(13464003)(236005)(6116002)(72206003)(54896002)(3846002)(790700001)(6306002)(110136005)(68736007)(25786009)(9686003)(14444005)(52536014)(5660300002)(256004)(5024004)(229853002)(86362001)(76116006)(66446008)(73956011)(2906002)(66556008)(66476007)(66946007)(316002)(33656002)(55016002)(64756008)(2501003)(6436002)(486006)(478600001)(6506007)(966005)(102836004)(53546011)(476003)(186003)(14454004)(74316002)(26005)(8936002)(606006)(53936002)(99286004)(81156014)(81166006)(8676002)(66066001)(71200400001)(11346002)(6246003)(76176011)(446003)(71190400001)(7696005)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4774; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: OTdfB837X/5RWdfnzcHO+Gc3zQyoNgzowh3qrEKAw4dYpUI/tl30Btjf5ccp/q0ANg68BhRSFRwqaJfuaWzUiZmNaQCnsClnZ4/f6bC9yh/b1CAWm2dQOexqaZR4BZOBlY0FO/Ka6RNrDNQmkq1GzFSuP65j8BPssUMpwfeA0awMlzLWGM1qtjnTgb0Ny2DaaaEiHxSwueNfXjHK/hazhLeCAeug29wLmk+mEp0P/GMbUf9Ru+jAzI9Wwjh5jj/RebnJ/xTfDuoqonIwyVUq3LJPZ3tMrQlaZw9eqnTZiP+WM/QlTB4cnxxPTo+Ssoek+fq3fhz0J33Qur4oN8YT8TnT1wRGMTFXP1BM5wQ6LgBU03HDOwMueUdxVQb27X2aH/IvvBda8xzUYbqFebdFLVpZ1AzghQdPqbFr25RAe6c= Content-Type: multipart/alternative; boundary="_000_DBBPR08MB45392B28B2B1DD0D56A9BB16FA080DBBPR08MB4539eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 89b70cba-f328-4cce-57ea-08d6d88b033d X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2019 16:41:28.5609 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4774 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 16:41:39 -0000 --_000_DBBPR08MB45392B28B2B1DD0D56A9BB16FA080DBBPR08MB4539eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Your text updates look good to me, Panos. Thanks. Hannes From: Panos Kampanakis (pkampana) Sent: Freitag, 10. Mai 2019 13:06 To: Hannes Tschofenig ; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Hi Hannes, > Hence, I believe it would be better to first shorten the following paragr= aph to a single line: Note that this paragraph was added from feedback in the review process just= to motivate server-side keygen. Given that your proposed text below practi= cally moves the points made in this paragraph in the Sec considerations sec= tion, I am all for shortening the paragraph. I was thinking something close= to what you wrote, but just to keep a couple of phrases as motivation abou= t the feature without creating an inaccurate sense of security: ~~~~~~~~~~ 5.8. Server-side Key Generation In scenarios where it is desirable that the server obtains access to the = private key the server-side key generation should be used. Such scenarios could be when it is conside= red more secure to generate at the server a long-lived random private key that identifies th= e client or when the resources spent to generate a random private key at the client are consid= ered scarce. ~~~~~~~~~~ > In the security consideration section I would add a new section somewhere= that talks about the random number generation. I like your text. I will add it with minor changes in orange. ~~~~~~~~~~ Modern security protocols require random numbers to be available during the protocol run, for example for nonces, ephemeral EC Diffie-Hellman ke= y generation. This capability to generate random numbers is also needed when the constrained device generates the private key (that corresponds to the public key enrolled in the CSR). When server-side key generation = is used, the constrained device depends on the server to generate the private key randomly, but it still needs locally generated random number= s for use in security protocols, such as DTLS. It is important to note that sources contributing to the randomness pool used to generate random numbers on laptops or desktop PCs are not available on many constrained devices, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, as pointed out in [PsQs]. Other sources have to be used or dedicated hardware has to be added. Selecting hardware for an IoT device that is capable of producing high-quality random numbers is therefore important. ~~~~~~~~~~ I hope it makes sense. Panos -----Original Message----- From: Hannes Tschofenig > Sent: Friday, May 10, 2019 4:58 AM To: Panos Kampanakis (pkampana) >; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Hi Panos, I had argued earlier that this feature shouldn't be in the draft but it see= ms that I will not get there. Hence, I believe it would be better to first shorten the following paragrap= h to a single line: FROM: " 5.8. Server-side Key Generation Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. Even though the random numbers that constitute the identity/cert do not get generated often, an endpoint may not want to spend time and energy generating keypairs, and just ask for one from the server. In these scenarios, server-side key generation can be used. .... " TO: " 5.8. Server-side Key Generation In scenarios where it is desirable that the server obtains access to the = private key the server-side key generation should be used. .... " In the security consideration section I would add a new section somewhere t= hat talks about the random number generation. " Random Number Generation Modern security protocol require random numbers to be available during the protocol run, for example for nonces, ephemeral Diffie-Hellman key generation. When the private key is generated by the IoT device then the capability to generate random numbers is also needed. When server- side key generation is used then the IoT device still needs random numbe= rs for use in security protocols, such as DTLS. It is important to note that sources contributing to the randomness pool on laptops or desktop PCs are not available on many IoT devices, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, as pointed out in [PsQs]. Other sources have to be found or dedicated hardware has to be added. Selecting hardware for an IoT device that is capable of producing high-quality random numbers is therefore important. " Does this make sense? Ciao Hannes PS: Note that I omitted the reference to RSA because ECC is so much more po= pular in the IoT space that there is no point in dealing with RSA these day= s. -----Original Message----- From: Panos Kampanakis (pkampana) > Sent: Freitag, 10. Mai 2019 04:53 To: Hannes Tschofenig >; ace@ietf.org Subject: RE: [Ace] EST over CoAP: Randomness Thanks Hannes. Before I try to address it, can you help me understand what you are proposi= ng. To amend this paragraph maybe? -----Original Message----- From: Ace > On Behalf Of = Hannes Tschofenig Sent: Thursday, May 09, 2019 10:43 AM To: ace@ietf.org Subject: [Ace] EST over CoAP: Randomness Hi all, I am still a bit unhappy about this paragraph: " Constrained devices sometimes do not have the necessary hardware to generate statistically random numbers for private keys and DTLS ephemeral keys. Past experience has also shown that low-resource endpoints sometimes generate numbers which could allow someone to decrypt the communication or guess the private key and impersonate as the device [PsQs] [RSAorig]. Additionally, random number key generation is costly, thus energy draining. " If you get hardware that does not have a hardware-based RNG then you are in= trouble. The main security protocols we look into do not work without a so= urce of randomness. Hence, getting the certificate & private key from the s= erver will not get you too far. I believe we should encourage developers to pick the correct hardware for t= he task rather than making them believe we have come up with solutions that= allow them to get away without a hardware-based RNG. I also do not believe the statement that random number key generation is co= stly. Can you give me some number? The references to [PsQs] [RSAorig] are IMHO also not appropriate because th= ey are conveying a different message (at least that's my understanding from= reading them). The message is that you have to be careful with designing a= nd using a random number generator on embedded systems because the sources = of entropy may just not be there (like keyboards, harddisk drive, processin= g scheduling, etc.). Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_DBBPR08MB45392B28B2B1DD0D56A9BB16FA080DBBPR08MB4539eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Your text updates look good to me, Panos.

 

Thanks.

Hannes

 

From: Panos Kampanakis (pkampana) <pkampana@cisco.com>
Sent: Freitag, 10. Mai 2019 13:06
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; ace@ietf.or= g
Subject: RE: [Ace] EST over CoAP: Randomness

 

Hi Hannes,

 

> Hence, I believe it would be better to first sh= orten the following paragraph to a single line:

 

Note that this paragraph was added from feedback in = the review process just to motivate server-side keygen. Given that your pro= posed text below practically moves the points made in this paragraph in the= Sec considerations section, I am all for shortening the paragraph. I was thinking something close to what y= ou wrote, but just to keep a couple of phrases as motivation about the feat= ure without creating an inaccurate sense of security:

~~~~~~~~~~

5.8.  Server-side Key Generation

 

  In scenarios where it is desirable that the s= erver obtains access to the private key the server-side

  key generation should be used. Such scenarios= could be when it is considered more secure to

  generate at the server a long-lived random pr= ivate key that identifies the client or when the

  resources spent to generate a random private = key at the client are considered scarce.

~~~~~~~~~~

 

> In the security consideration section I would a= dd a new section somewhere that talks about the random number generation.

 

I like your text. I will add it  with minor cha= nges in orange.

~~~~~~~~~~

   Modern security protocols require rando= m numbers to be available during

   the protocol run, for example for nonce= s, ephemeral EC Diffie-Hellman key

   generation. This capability to generate= random numbers is also needed

   when the = constrained device generates the private key (that corresponds

   to the pu= blic key enrolled in the CSR). When serv= er-side key generation is

   used, the= constrained device depends on the server to generate the

   private k= ey randomly, but it still needs locally generated random numbers

   for use in security protocols, such as = DTLS.

 

   It is important to note that sources co= ntributing to the randomness

   pool used= to generate random numbers on laptops or desktop PCs

   are not available on many constrained devices, such as mouse

   movement, timing of keystrokes, air tur= bulence on the

   movement of hard drive heads, as pointe= d out in [PsQs].  Other

   sources have to be used or dedicated hardware has to be added.

   Selecting hardware for an IoT device th= at is capable of producing

   high-quality random numbers is therefor= e important.

~~~~~~~~~~

 

I hope it makes sense.

 

Panos

 

 

-----Original Message-----

From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>

Sent: Friday, May 10, 2019 4:58 AM

To: Panos Kampanakis (pkampana) <pkampana@cisco.com>; ace@ietf.org

Subject: RE: [Ace] EST over CoAP: Randomness

 

Hi Panos,

 

I had argued earlier that this feature shouldn't be = in the draft but it seems that I will not get there.

 

Hence, I believe it would be better to first shorten= the following paragraph to a single line:

 

FROM:

 

"

5.8.  Server-side Key Generation

 

   Constrained devices sometimes do not ha= ve the necessary hardware to

   generate statistically random numbers f= or private keys and DTLS

   ephemeral keys.  Past experience h= as also shown that low-resource

   endpoints sometimes generate numbers wh= ich could allow someone to

   decrypt the communication or guess the = private key and impersonate as

   the device [PsQs] [RSAorig].  Addi= tionally, random number key

   generation is costly, thus energy drain= ing. Even though the random

   numbers that constitute the identity/ce= rt do not get generated often,

   an endpoint may not want to spend time = and energy generating

   keypairs, and just ask for one from the= server.

 

   In these scenarios, server-side key gen= eration can be used.

   ....

"

 

TO:

 

"

5.8.  Server-side Key Generation

 

  In scenarios where it is desirable that the s= erver obtains access to the private key the server-side

  key generation should be used.

  ....

"

 

In the security consideration section I would add a = new section somewhere that talks about the random number generation.

 

"

Random Number Generation

 

   Modern security protocol require random= numbers to be available during

   the protocol run, for example for nonce= s, ephemeral Diffie-Hellman key

   generation. When the private key is gen= erated by the IoT device then

   the capability to generate random numbe= rs is also needed. When server-

   side key generation is used then the Io= T device still needs random numbers

   for use in security protocols, such as = DTLS.

 

   It is important to note that sources co= ntributing to the randomness

   pool on laptops or desktop PCs are not = available on many IoT devices,

   such as mouse movement, timing of keyst= rokes, air turbulence on the

   movement of hard drive heads, as pointe= d out in [PsQs].  Other

   sources have to be found or dedicated h= ardware has to be added.

   Selecting hardware for an IoT device th= at is capable of producing

   high-quality random numbers is therefor= e important.

"

 

Does this make sense?

 

Ciao

Hannes

 

PS: Note that I omitted the reference to RSA because= ECC is so much more popular in the IoT space that there is no point in dea= ling with RSA these days.

 

 

 

 

-----Original Message-----

From: Panos Kampanakis (pkampana) <pkampana@cisco.com>

Sent: Freitag, 10. Mai 2019 04:53

To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; ace@ietf.org

Subject: RE: [Ace] EST over CoAP: Randomness

 

Thanks Hannes.

Before I try to address it, can you help me understa= nd what you are proposing. To amend this paragraph maybe?

 

-----Original Message-----

From: Ace <ace-bounces@ietf.org> On Behalf Of Hannes Tschofenig

Sent: Thursday, May 09, 2019 10:43 AM

Subject: [Ace] EST over CoAP: Randomness<= /p>

 

Hi all,

 

I am still a bit unhappy about this paragraph:<= /o:p>

 

"

   Constrained devices sometimes do not ha= ve the necessary hardware to

   generate statistically random numbers f= or private keys and DTLS

   ephemeral keys.  Past experience h= as also shown that low-resource

   endpoints sometimes generate numbers wh= ich could allow someone to

   decrypt the communication or guess the = private key and impersonate as

   the device [PsQs] [RSAorig].  Addi= tionally, random number key

   generation is costly, thus energy drain= ing.

"

 

If you get hardware that does not have a hardware-ba= sed RNG then you are in trouble. The main security protocols we look into d= o not work without a source of randomness. Hence, getting the certificate &= amp; private key from the server will not get you too far.

 

I believe we should encourage developers to pick the= correct hardware for the task rather than making them believe we have come= up with solutions that allow them to get away without a hardware-based RNG= .

 

I also do not believe the statement that random numb= er key generation is costly. Can you give me some number?

 

The references to [PsQs] [RSAorig] are IMHO also not= appropriate because they are conveying a different message (at least that'= s my understanding from reading them). The message is that you have to be c= areful with designing and using a random number generator on embedded systems because the sources of entropy= may just not be there (like keyboards, harddisk drive, processing scheduli= ng, etc.).

 

Ciao

Hannes

 

IMPORTANT NOTICE: The contents of this email and any= attachments are confidential and may also be privileged. If you are not th= e intended recipient, please notify the sender immediately and do not discl= ose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Th= ank you.

 

_______________________________________________=

Ace mailing list

IMPORTANT NOTICE: The contents of this email and any= attachments are confidential and may also be privileged. If you are not th= e intended recipient, please notify the sender immediately and do not discl= ose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Th= ank you.

 

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_DBBPR08MB45392B28B2B1DD0D56A9BB16FA080DBBPR08MB4539eurp_-- From nobody Tue May 14 09:46:51 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DAB0120172 for ; Tue, 14 May 2019 09:46:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TNuXSxj5vuhn for ; Tue, 14 May 2019 09:46:26 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0630.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 240EE12015B for ; Tue, 14 May 2019 09:46:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qNdzP78kz8ESB5NWGMQIcmSIYtBLZYrOcHQF6c5GlCk=; b=BpngFMkTc8s5KplRoL8DNR7lXKhMC63AZ95IArf+xGXf4oIE9hRwe1KupN/Usmp+QVjQaOvOxVxCVZA/xfDAoOsIEPOe16ay4LhFdnWzsykeolmiQdzkLAv2g5NxG9s9/0uDNu5n5uK2eRVB08G5Rwgv+UjRCK8nL2OU7kkopes= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4774.eurprd08.prod.outlook.com (20.179.45.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Tue, 14 May 2019 16:46:23 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1878.024; Tue, 14 May 2019 16:46:23 +0000 From: Hannes Tschofenig To: Esko Dijk , "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMAAPxWTgACLZPZA= Date: Tue, 14 May 2019 16:46:23 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [96.64.251.237] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1cd492b4-7594-4126-f5e6-08d6d88bb2d1 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4774; x-ms-traffictypediagnostic: DBBPR08MB4774: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0037FD6480 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(366004)(39860400002)(136003)(396003)(40434004)(199004)(189003)(26005)(14454004)(74316002)(6506007)(486006)(478600001)(476003)(186003)(102836004)(9326002)(6246003)(7696005)(71190400001)(7736002)(76176011)(446003)(11346002)(66066001)(8676002)(81166006)(81156014)(71200400001)(53936002)(8936002)(99286004)(110136005)(68736007)(9686003)(25786009)(5660300002)(5024004)(256004)(14444005)(52536014)(6116002)(790700001)(3846002)(6306002)(54896002)(72206003)(55016002)(33656002)(64756008)(6436002)(2501003)(229853002)(86362001)(66946007)(66476007)(66556008)(2906002)(73956011)(66446008)(316002)(76116006); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4774; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: GyzUZROrpcVLB0i/njamUcMyj5wW4uuheuZAJKbbJmz3m2/iVJzEt1F6CENhIPj5FLgK57YAZ9PqVX68wrXVHrvDlQRYqE1BxrlfyO2OJEJVtNofTxFyVxB/QeYinRfjpd6mH1H7pyosvpMb57MjqPRcTpqBvhhOwqvpMaY5TURFV8yqyjuHup2J6iRHvLDYl6sJvHBFq/y0pdKM+l7nJvUU8NmNeFKtgvf+agYqDDowD5oksWaiNN0LVoJq8t0kkwa2kxrTeWxBL6kXZltx7yFY7Yvsys3Uo/ZSaBbLCjenTAk3YB8B6RnWGwaeSR+XnVvn5tT3zQnLyUTqqudLR8Z4qyOwBu5EuBr5ICZ52/B5FOtHEzD30TJ8k4ZFnGT7CQQrPZPuQlMPKDFhZN4JgfaeGA7px0SgynhAL+Up5Cs= Content-Type: multipart/alternative; boundary="_000_DBBPR08MB45396D216551692BCE594780FA080DBBPR08MB4539eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1cd492b4-7594-4126-f5e6-08d6d88bb2d1 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2019 16:46:23.0791 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4774 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 16:46:41 -0000 --_000_DBBPR08MB45396D216551692BCE594780FA080DBBPR08MB4539eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRXNrbywNCg0KZ29vZCB0byBoZWFyIGZyb20geW91Lg0KDQoNCiAgKiAgIEFub3RoZXIgcmVh c29uIGZvciBzZXJ2ZXItc2lkZSBrZXlnZW4gY2FuIGJlIHRoYXQgYW4gSVQgZGVwYXJ0bWVudC9t YW5hZ2VyIHdhbnRzIGl0IHRoYXQgd2F5LiBUaGVyZSBjb3VsZCBiZSBhIHBvbGljeSB0aGF0IHRo ZSBrZXlwYWlycyBmb3IgYWxsIGRvbWFpbiBjZXJ0aWZpY2F0ZXMgbXVzdCBiZSBjcmVhdGVkIGJ5 IHRoZSBzeXN0ZW1zIHVuZGVyIGRpcmVjdCBjb250cm9sIG9mIHRoZSBJVCBkZXBhcnRtZW50LiAo RS5nLiB0byBjb21wbHkgd2l0aCBvdGhlciBwb2xpY2llcyBvciB0byBiZSBhYmxlIHRvIHRydXN0 IHRoZSByYW5kb21uZXNzIGxldmVsLiBPciBqdXN0IGJlY2F1c2UgdGhhdCB3YXMgdGhlIHdheSBp dCBhbHdheXMgaGFzIGJlZW4gd2hlbiBQQ3Mgd2VyZSBwcm92aXNpb25lZCB3aXRoIGNlcnRpZmlj YXRlcy4pICBUaGlzIGNvdWxkIGJlIGxpc3RlZCBhcyBhbiBhZGRpdGlvbmFsIHJlYXNvbi4NCg0K Rm9yIHJlYWRlcnMgaW50ZXJlc3RlZCBpbiBtYWtpbmcgaW5mb3JtZWQgZGVjaXNpb25zIEkgYmVs aWV2ZSBpdCBpcyB3b3J0aHdoaWxlIHRvIHBvaW50IG91dCB0aGF0IHRoZXkgbmVlZCByYW5kb20g bnVtYmVyIGdlbmVyYXRpb24gY2FwYWJpbGl0aWVzIG9uIElvVCBkZXZpY2VzIOKAkyBub3QganVz dCBmb3IgdGhlIHByaXZhdGUga2V5IGdlbmVyYXRpb24gaW4gY29udGV4dCBvZiB0aGUgRVNUIGV4 Y2hhbmdlLiBJIGZlYXIgdGhhdCBzb21lIHBlb3BsZSwgaW5jbHVkaW5nIElUIG1hbmFnZXJzLCBq dXN0IGdsYW5jZSBvdmVyIHRoZSBkZXRhaWxzIGFuZCBmb2N1cyBvbiBpc29sYXRlZCBhc3BlY3Rz LiBJIGFtIHN1cmUgeW91IGFncmVlIHdpdGggbWUgdGhhdCB0aGlzIHdvdWxkIGJlIGEgdG9vIHNp bXBsaXN0aWMgdmlldy4NCg0KQ2lhbw0KSGFubmVzDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBj b250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlh bCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVk IHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBu b3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3Ig YW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRp dW0uIFRoYW5rIHlvdS4NCg== --_000_DBBPR08MB45396D216551692BCE594780FA080DBBPR08MB4539eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFn cmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1h cmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJ bWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5lbWFpbHF1b3Rl LCBsaS5lbWFpbHF1b3RlLCBkaXYuZW1haWxxdW90ZQ0KCXttc28tc3R5bGUtbmFtZTplbWFpbHF1 b3RlOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MS4wcHQ7DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWls U3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIu MHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8q IExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjg1MDA5OTgxODsN Cgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTEwMTA2Njk5 MzIgLTE0NjQ3MjAxNDggMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEz NDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMDpsZXZlbDEN Cgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJ bXNvLWJpZGktZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjExMTM1OTM2MzE7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE5ODU3NDQzNTY7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjM2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxMDguMHB0Ow0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxNDQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDoxODAuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoy MTYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot MTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyNTIuMHB0Ow0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1i b3R0b206MGNtO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IaSBFc2tvLCA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Z29vZCB0byBoZWFyIGZy b20geW91LiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBjbSIgdHlwZT0iZGlzYyI+DQo8bGkg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY207bXNvLWxpc3Q6 bDAgbGV2ZWwxIGxmbzMiPjxzcGFuIGxhbmc9IkVOLVVTIj5Bbm90aGVyIHJlYXNvbiBmb3Igc2Vy dmVyLXNpZGUga2V5Z2VuIGNhbiBiZSB0aGF0IGFuIElUIGRlcGFydG1lbnQvbWFuYWdlciB3YW50 cyBpdCB0aGF0IHdheS4gVGhlcmUgY291bGQgYmUgYSBwb2xpY3kgdGhhdCB0aGUga2V5cGFpcnMg Zm9yIGFsbCBkb21haW4gY2VydGlmaWNhdGVzDQogbXVzdCBiZSBjcmVhdGVkIGJ5IHRoZSBzeXN0 ZW1zIHVuZGVyIGRpcmVjdCBjb250cm9sIG9mIHRoZSBJVCBkZXBhcnRtZW50LiAoRS5nLiB0byBj b21wbHkgd2l0aCBvdGhlciBwb2xpY2llcyBvciB0byBiZSBhYmxlIHRvIHRydXN0IHRoZSByYW5k b21uZXNzIGxldmVsLiBPciBqdXN0IGJlY2F1c2UgdGhhdCB3YXMgdGhlIHdheSBpdCBhbHdheXMg aGFzIGJlZW4gd2hlbiBQQ3Mgd2VyZSBwcm92aXNpb25lZCB3aXRoIGNlcnRpZmljYXRlcy4pJm5i c3A7IFRoaXMNCiBjb3VsZCBiZSBsaXN0ZWQgYXMgYW4gYWRkaXRpb25hbCByZWFzb24uPG86cD48 L286cD48L3NwYW4+PC9saT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIj5Gb3IgcmVhZGVycyBpbnRlcmVzdGVkIGluIG1ha2luZyBpbmZv cm1lZCBkZWNpc2lvbnMgSSBiZWxpZXZlIGl0IGlzIHdvcnRod2hpbGUgdG8gcG9pbnQgb3V0IHRo YXQgdGhleSBuZWVkIHJhbmRvbSBudW1iZXIgZ2VuZXJhdGlvbiBjYXBhYmlsaXRpZXMgb24gSW9U IGRldmljZXMg4oCTIG5vdCBqdXN0IGZvciB0aGUgcHJpdmF0ZSBrZXkgZ2VuZXJhdGlvbiBpbiBj b250ZXh0IG9mIHRoZQ0KIEVTVCBleGNoYW5nZS4gSSBmZWFyIHRoYXQgc29tZSBwZW9wbGUsIGlu Y2x1ZGluZyBJVCBtYW5hZ2VycywganVzdCBnbGFuY2Ugb3ZlciB0aGUgZGV0YWlscyBhbmQgZm9j dXMgb24gaXNvbGF0ZWQgYXNwZWN0cy4gSSBhbSBzdXJlIHlvdSBhZ3JlZSB3aXRoIG1lIHRoYXQg dGhpcyB3b3VsZCBiZSBhIHRvbyBzaW1wbGlzdGljIHZpZXcuICZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tVVMiPkNpYW88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+SGFubmVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMg b2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1h eSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGll bnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Ns b3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJw b3NlLA0KIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRo YW5rIHlvdS4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DBBPR08MB45396D216551692BCE594780FA080DBBPR08MB4539eurp_-- From nobody Tue May 14 11:56:40 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 346A81200B5 for ; Tue, 14 May 2019 11:56:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oGcQXfO4_VTw for ; Tue, 14 May 2019 11:56:36 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150124.outbound.protection.outlook.com [40.107.15.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B28E31200B1 for ; Tue, 14 May 2019 11:56:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancy-nl; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b+5WBznYcb/lo/4nPATIzBoJCe9mdH4Fj+bKsQCjV1o=; b=IhMuRyLb4SFpRQgoX8jQ6NKZdJdLtYoDIJ6qwPzMg8Ce2Rs8+G1vcviKG+ql67i2tmJMDzCv2LA0rFStDzaHiyMMWyPk3j6IWBU+mowC2bqsf0nJ4URcIVPi45npJrwSaRS3vMZa2b0p7/gwRZAAxxPw9fYerxCxbk4vUtSmSyE= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0565.EURP190.PROD.OUTLOOK.COM (10.175.242.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Tue, 14 May 2019 18:56:32 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20%8]) with mapi id 15.20.1878.024; Tue, 14 May 2019 18:56:32 +0000 From: Esko Dijk To: Hannes Tschofenig , "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMAAPxWTgACLZPZAAoLfO4A== Date: Tue, 14 May 2019 18:56:32 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [2001:1c02:3101:4800:4c05:986f:8d90:9390] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 91cb4556-b90f-475d-82c3-08d6d89de171 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6P190MB0565; x-ms-traffictypediagnostic: DB6P190MB0565: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0037FD6480 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(376002)(136003)(396003)(39830400003)(40434004)(189003)(199004)(74482002)(99286004)(25786009)(71190400001)(74316002)(14454004)(33656002)(71200400001)(14444005)(5024004)(6436002)(256004)(508600001)(229853002)(2501003)(9686003)(55016002)(66556008)(66476007)(64756008)(53936002)(46003)(73956011)(76116006)(7696005)(86362001)(110136005)(102836004)(476003)(53546011)(6506007)(2906002)(446003)(54896002)(6306002)(76176011)(606006)(236005)(486006)(5660300002)(44832011)(52536014)(9326002)(316002)(81156014)(8936002)(6116002)(7736002)(68736007)(186003)(66946007)(8676002)(66446008)(11346002)(81166006)(6246003)(790700001); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0565; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: KgZp+mB8tOAPC7l+hu4gOIsWKEq+QQarHj7ySZVfceDPpErlEz7THfXdOLd47Of7AXQ+MEWk/XaigYgSEuboprdL6P/jQ7YmkdD9pyqKooiIqpLWNswRc8o3TOAIidRHhyzzQr8jQ1oU1JhtLteKgW+ghr5OpjbViMmoyvErkyQQKDUZ9UxwmAw2JFwCrqlubmgHaIibkEZRUzP3+CMreRcGgRHh+ErW3TuBIE9Ok5uSK7khR7pbS5tLrBgWj/OFiEGnrjYYvvdkheQ9FXjM/lyQS81NZefS9YZNJEAq5K9fVF0Kb82UqO/Z8dFuzGpdcUXD3DhM9udYjqGnWuBB71UiHZTFvSse1+PSX697dLFyajkdWYOGrG6m5UgTj+UPjtTIKEKpmtVoi00HZtIWPBR+aH5hFdpYRIPcVa8ao9g= Content-Type: multipart/alternative; boundary="_000_DB6P190MB0054FE4F99040ACB0CEF267DFD080DB6P190MB0054EURP_" MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: 91cb4556-b90f-475d-82c3-08d6d89de171 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2019 18:56:32.2030 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0565 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 18:56:39 -0000 --_000_DB6P190MB0054FE4F99040ACB0CEF267DFD080DB6P190MB0054EURP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSGFubmVzLA0KDQpBZ3JlZS4gVGhlIGRyYWZ0IGlzIGFscmVhZHkgcmVmZXJlbmNpbmcgUkZD IDc5MjUsIHNvIGl0IGNvdWxkIGFkZGl0aW9uYWxseSByZWZlcmVuY2UgU2VjdGlvbiAxMiAoaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc5MjUjc2VjdGlvbi0xMikgd2hpY2ggZXhwbGFp bnMgdGhhdCByYW5kb21uZXNzIGlzIGFsc28gbmVlZGVkIGZvciBhbGwgRFRMUyBoYW5kc2hha2Vz LiBXaGF0IEkgbWVudGlvbiBhYm91dCDigJxiZWluZyBhYmxlIHRvIHRydXN0IHRoZSByYW5kb21u ZXNzIGxldmVs4oCdIGlzIHRoZW4gbWF5YmUgYSBtb3JlIHBzeWNob2xvZ2ljYWwgcmVxdWlyZW1l bnQgcmF0aGVyIHRoYW4gdGVjaG5pY2FsLiBBIHBvd2VyZnVsIHNlcnZlciB3aXRoIFJUQyBqdXN0 IHNvdW5kcyBtb3JlIGNhcGFibGUgdG8gZG8gcHJpdmF0ZSBrZXkgZ2VuZXJhdGlvbiB0aGFuIGFu IElvVCBkZXZpY2UsIHdoaWNoIGlzIHdoeSBzZXJ2ZXItc2lkZSBrZXlnZW4gbWF5IGJlIHByZWZl cnJlZCA7KQ0KDQpFc2tvDQoNCkZyb206IEhhbm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNjaG9m ZW5pZ0Bhcm0uY29tPg0KU2VudDogVHVlc2RheSwgTWF5IDE0LCAyMDE5IDE4OjQ2DQpUbzogRXNr byBEaWprIDxlc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmw+OyBQYW5vcyBLYW1wYW5ha2lzIChw a2FtcGFuYSkgPHBrYW1wYW5hQGNpc2NvLmNvbT47IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUkU6 IFtBY2VdIEVTVCBvdmVyIENvQVA6IFJhbmRvbW5lc3MNCg0KSGkgRXNrbywNCg0KZ29vZCB0byBo ZWFyIGZyb20geW91Lg0KDQoNCiAgKiAgIEFub3RoZXIgcmVhc29uIGZvciBzZXJ2ZXItc2lkZSBr ZXlnZW4gY2FuIGJlIHRoYXQgYW4gSVQgZGVwYXJ0bWVudC9tYW5hZ2VyIHdhbnRzIGl0IHRoYXQg d2F5LiBUaGVyZSBjb3VsZCBiZSBhIHBvbGljeSB0aGF0IHRoZSBrZXlwYWlycyBmb3IgYWxsIGRv bWFpbiBjZXJ0aWZpY2F0ZXMgbXVzdCBiZSBjcmVhdGVkIGJ5IHRoZSBzeXN0ZW1zIHVuZGVyIGRp cmVjdCBjb250cm9sIG9mIHRoZSBJVCBkZXBhcnRtZW50LiAoRS5nLiB0byBjb21wbHkgd2l0aCBv dGhlciBwb2xpY2llcyBvciB0byBiZSBhYmxlIHRvIHRydXN0IHRoZSByYW5kb21uZXNzIGxldmVs LiBPciBqdXN0IGJlY2F1c2UgdGhhdCB3YXMgdGhlIHdheSBpdCBhbHdheXMgaGFzIGJlZW4gd2hl biBQQ3Mgd2VyZSBwcm92aXNpb25lZCB3aXRoIGNlcnRpZmljYXRlcy4pICBUaGlzIGNvdWxkIGJl IGxpc3RlZCBhcyBhbiBhZGRpdGlvbmFsIHJlYXNvbi4NCg0KRm9yIHJlYWRlcnMgaW50ZXJlc3Rl ZCBpbiBtYWtpbmcgaW5mb3JtZWQgZGVjaXNpb25zIEkgYmVsaWV2ZSBpdCBpcyB3b3J0aHdoaWxl IHRvIHBvaW50IG91dCB0aGF0IHRoZXkgbmVlZCByYW5kb20gbnVtYmVyIGdlbmVyYXRpb24gY2Fw YWJpbGl0aWVzIG9uIElvVCBkZXZpY2VzIOKAkyBub3QganVzdCBmb3IgdGhlIHByaXZhdGUga2V5 IGdlbmVyYXRpb24gaW4gY29udGV4dCBvZiB0aGUgRVNUIGV4Y2hhbmdlLiBJIGZlYXIgdGhhdCBz b21lIHBlb3BsZSwgaW5jbHVkaW5nIElUIG1hbmFnZXJzLCBqdXN0IGdsYW5jZSBvdmVyIHRoZSBk ZXRhaWxzIGFuZCBmb2N1cyBvbiBpc29sYXRlZCBhc3BlY3RzLiBJIGFtIHN1cmUgeW91IGFncmVl IHdpdGggbWUgdGhhdCB0aGlzIHdvdWxkIGJlIGEgdG9vIHNpbXBsaXN0aWMgdmlldy4NCg0KQ2lh bw0KSGFubmVzDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWls IGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJp dmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5v dGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRl bnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3Jl IG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== --_000_DB6P190MB0054FE4F99040ACB0CEF267DFD080DB6P190MB0054EURP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFn cmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1h cmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJ bWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZW1haWxxdW90ZSwg bGkuZW1haWxxdW90ZSwgZGl2LmVtYWlscXVvdGUNCgl7bXNvLXN0eWxlLW5hbWU6ZW1haWxxdW90 ZTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjEuMHB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIyDQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAq Lw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NTI0MjUzNTAzOw0KCW1zby1saXN0LXRlbXBsYXRl LWlkczoyMTQ2MTgxNjM0O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDou NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw2 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6ODUwMDk5 ODE4Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTAx MDY2OTkzMiAtMTQ2NDcyMDE0OCAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1 NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0IGwxOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkRlbmdYaWFu Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBs MTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNw0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5l dyI7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRp Zl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0 Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0Pjwv eG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkhpIEhhbm5lcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QWdyZWUuIFRoZSBk cmFmdCBpcyBhbHJlYWR5IHJlZmVyZW5jaW5nIFJGQyA3OTI1LCBzbyBpdCBjb3VsZCBhZGRpdGlv bmFsbHkgcmVmZXJlbmNlIFNlY3Rpb24gMTIgKDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9yZmM3OTI1I3NlY3Rpb24tMTIiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9y ZmM3OTI1I3NlY3Rpb24tMTI8L2E+KSB3aGljaCBleHBsYWlucyB0aGF0IHJhbmRvbW5lc3MNCiBp cyBhbHNvIG5lZWRlZCBmb3IgYWxsIERUTFMgaGFuZHNoYWtlcy4gV2hhdCBJIG1lbnRpb24gYWJv dXQg4oCcYmVpbmcgYWJsZSB0byB0cnVzdCB0aGUgcmFuZG9tbmVzcyBsZXZlbOKAnSBpcyB0aGVu IG1heWJlIGEgbW9yZSBwc3ljaG9sb2dpY2FsIHJlcXVpcmVtZW50IHJhdGhlciB0aGFuIHRlY2hu aWNhbC4gQSBwb3dlcmZ1bCBzZXJ2ZXIgd2l0aCBSVEMganVzdCBzb3VuZHMgbW9yZSBjYXBhYmxl IHRvIGRvIHByaXZhdGUga2V5IGdlbmVyYXRpb24gdGhhbg0KIGFuIElvVCBkZXZpY2UsIHdoaWNo IGlzIHdoeSBzZXJ2ZXItc2lkZSBrZXlnZW4gbWF5IGJlIHByZWZlcnJlZCA7KTxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Fc2tvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gSGFubmVzIFRzY2hvZmVuaWcgJmx0O0hh bm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20mZ3Q7IDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBN YXkgMTQsIDIwMTkgMTg6NDY8YnI+DQo8Yj5Ubzo8L2I+IEVza28gRGlqayAmbHQ7ZXNrby5kaWpr QGlvdGNvbnN1bHRhbmN5Lm5sJmd0OzsgUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpICZsdDtw a2FtcGFuYUBjaXNjby5jb20mZ3Q7OyBhY2VAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UkU6IFtBY2VdIEVTVCBvdmVyIENvQVA6IFJhbmRvbW5lc3M8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5IaSBFc2tvLCA8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiPmdvb2QgdG8gaGVhciBmcm9tIHlvdS4gPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjx1bCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHR5cGU9ImRpc2MiPg0KPGxp IGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0 OmwxIGxldmVsMSBsZm8zIj5Bbm90aGVyIHJlYXNvbiBmb3Igc2VydmVyLXNpZGUga2V5Z2VuIGNh biBiZSB0aGF0IGFuIElUIGRlcGFydG1lbnQvbWFuYWdlciB3YW50cyBpdCB0aGF0IHdheS4gVGhl cmUgY291bGQgYmUgYSBwb2xpY3kgdGhhdCB0aGUga2V5cGFpcnMgZm9yIGFsbCBkb21haW4gY2Vy dGlmaWNhdGVzIG11c3QgYmUgY3JlYXRlZA0KIGJ5IHRoZSBzeXN0ZW1zIHVuZGVyIGRpcmVjdCBj b250cm9sIG9mIHRoZSBJVCBkZXBhcnRtZW50LiAoRS5nLiB0byBjb21wbHkgd2l0aCBvdGhlciBw b2xpY2llcyBvciB0byBiZSBhYmxlIHRvIHRydXN0IHRoZSByYW5kb21uZXNzIGxldmVsLiBPciBq dXN0IGJlY2F1c2UgdGhhdCB3YXMgdGhlIHdheSBpdCBhbHdheXMgaGFzIGJlZW4gd2hlbiBQQ3Mg d2VyZSBwcm92aXNpb25lZCB3aXRoIGNlcnRpZmljYXRlcy4pJm5ic3A7IFRoaXMgY291bGQgYmUg bGlzdGVkDQogYXMgYW4gYWRkaXRpb25hbCByZWFzb24uPG86cD48L286cD48L2xpPjwvdWw+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkZvciByZWFkZXJzIGludGVyZXN0ZWQgaW4gbWFraW5nIGluZm9ybWVkIGRlY2lzaW9u cyBJIGJlbGlldmUgaXQgaXMgd29ydGh3aGlsZSB0byBwb2ludCBvdXQgdGhhdCB0aGV5IG5lZWQg cmFuZG9tIG51bWJlciBnZW5lcmF0aW9uIGNhcGFiaWxpdGllcyBvbiBJb1QgZGV2aWNlcyDigJMg bm90IGp1c3QgZm9yIHRoZSBwcml2YXRlIGtleSBnZW5lcmF0aW9uIGluIGNvbnRleHQgb2YgdGhl IEVTVCBleGNoYW5nZS4gSQ0KIGZlYXIgdGhhdCBzb21lIHBlb3BsZSwgaW5jbHVkaW5nIElUIG1h bmFnZXJzLCBqdXN0IGdsYW5jZSBvdmVyIHRoZSBkZXRhaWxzIGFuZCBmb2N1cyBvbiBpc29sYXRl ZCBhc3BlY3RzLiBJIGFtIHN1cmUgeW91IGFncmVlIHdpdGggbWUgdGhhdCB0aGlzIHdvdWxkIGJl IGEgdG9vIHNpbXBsaXN0aWMgdmlldy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5DaWFvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IYW5uZXM8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+SU1QT1JUQU5U IE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBh cmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5v dCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRp YXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMNCiB0byBhbnkgb3RoZXIgcGVy c29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1h dGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DB6P190MB0054FE4F99040ACB0CEF267DFD080DB6P190MB0054EURP_-- From nobody Tue May 14 12:28:27 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDB271200DE for ; Tue, 14 May 2019 12:28:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oqlGROSqtSDr for ; Tue, 14 May 2019 12:28:23 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30065.outbound.protection.outlook.com [40.107.3.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 572491200C4 for ; Tue, 14 May 2019 12:28:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2xuOWgM5rewQmvFz0epD/gwVHJPD9+lviIRVbtbERH8=; b=gnQGBkx8986b9IaS6sA/wUMFFVywKpgoOKvYfxzINl+Cd/za1rwT920ZfeXuClVrxWnK9aSgizUjhwQGfl9bOfuaMdYmb/D9rpYG2NTqJnRLM+g6ES8vu+m36guxyaX+FllTNsI74ROaMU9YFZbbQARQ8GOKV+RE2oWkLgWW3T0= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4870.eurprd08.prod.outlook.com (20.179.46.213) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Tue, 14 May 2019 19:28:20 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::3803:e042:abea:cd93%5]) with mapi id 15.20.1878.024; Tue, 14 May 2019 19:28:20 +0000 From: Hannes Tschofenig To: Esko Dijk , "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMAAPxWTgACLZPZAAoLfO4AABXdqQ Date: Tue, 14 May 2019 19:28:20 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [217.140.103.75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 00997f65-41ec-4d32-74c0-08d6d8a252f5 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4870; x-ms-traffictypediagnostic: DBBPR08MB4870: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0037FD6480 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39860400002)(376002)(396003)(136003)(346002)(199004)(189003)(40434004)(2906002)(74316002)(478600001)(72206003)(9686003)(53936002)(54896002)(6306002)(55016002)(99286004)(102836004)(2501003)(6246003)(53546011)(7696005)(6506007)(7736002)(76176011)(446003)(33656002)(236005)(76116006)(73956011)(66946007)(66556008)(6436002)(64756008)(66446008)(66476007)(186003)(8936002)(26005)(316002)(229853002)(14454004)(486006)(5660300002)(66066001)(68736007)(256004)(14444005)(5024004)(606006)(25786009)(52536014)(71200400001)(71190400001)(8676002)(476003)(3846002)(86362001)(6116002)(790700001)(81166006)(81156014)(11346002)(110136005); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4870; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: QbxjEzEZxded4EQ1ycvSrdVUaD0xpmmyKET5ZBPHNp5l4qL2Y6/4AT8Wvmx8QXn9o9/4pDbOc6jM6rzlkZkQ8TskdfCR1ZZo6cX5kEan1kUtCk3SjkMKyKd6+qhZBWne0kjIBCSd6XUnPL9UKq4IikfHHhAmdZx/k8XB1/VxlhXBKylpHGaiDpEOY9AJPfjzEJs6tmCsVXw0hLmDSIsz7QlvMMuGW6WSszI1WDe+d59OdKOf2r1k4mdHeZDfgLNDFlsza58Yx/pwXhI3PxYJ+ufN+01ygpbRlDMksuCLfQ5IdfscrEYkN7QF0ksZEmPVDgb/yHK7NIbm1FF551N4n1tp2YSJzqxBFv+mGxOPiwGbzRKJn/tTWQifDj+G2DrxDEYNHqhZMcBysvZPFjKabwInRgjlA1pVZ2wfy2iFpkc= Content-Type: multipart/alternative; boundary="_000_DBBPR08MB45392D26EC53653EF833437FFA080DBBPR08MB4539eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 00997f65-41ec-4d32-74c0-08d6d8a252f5 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2019 19:28:20.6952 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4870 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 19:28:27 -0000 --_000_DBBPR08MB45392D26EC53653EF833437FFA080DBBPR08MB4539eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RXNrbywNCg0KeW91ciBsaW5lIG9mIHRob3VnaHQgbWFrZXMgc2Vuc2UgdG8gbWUuIEkgbGVhdmUg aXQgdG8gUGFub3MgdG8gZW5oYW5jZSB0aGUgdGV4dC4NCg0KQ2lhbw0KSGFubmVzDQoNCkZyb206 IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPg0KU2VudDogRGllbnN0YWcs IDE0LiBNYWkgMjAxOSAxMTo1Nw0KVG86IEhhbm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNjaG9m ZW5pZ0Bhcm0uY29tPjsgUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNj by5jb20+OyBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBbQWNlXSBFU1Qgb3ZlciBDb0FQOiBS YW5kb21uZXNzDQoNCkhpIEhhbm5lcywNCg0KQWdyZWUuIFRoZSBkcmFmdCBpcyBhbHJlYWR5IHJl ZmVyZW5jaW5nIFJGQyA3OTI1LCBzbyBpdCBjb3VsZCBhZGRpdGlvbmFsbHkgcmVmZXJlbmNlIFNl Y3Rpb24gMTIgKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3OTI1I3NlY3Rpb24tMTIp IHdoaWNoIGV4cGxhaW5zIHRoYXQgcmFuZG9tbmVzcyBpcyBhbHNvIG5lZWRlZCBmb3IgYWxsIERU TFMgaGFuZHNoYWtlcy4gV2hhdCBJIG1lbnRpb24gYWJvdXQg4oCcYmVpbmcgYWJsZSB0byB0cnVz dCB0aGUgcmFuZG9tbmVzcyBsZXZlbOKAnSBpcyB0aGVuIG1heWJlIGEgbW9yZSBwc3ljaG9sb2dp Y2FsIHJlcXVpcmVtZW50IHJhdGhlciB0aGFuIHRlY2huaWNhbC4gQSBwb3dlcmZ1bCBzZXJ2ZXIg d2l0aCBSVEMganVzdCBzb3VuZHMgbW9yZSBjYXBhYmxlIHRvIGRvIHByaXZhdGUga2V5IGdlbmVy YXRpb24gdGhhbiBhbiBJb1QgZGV2aWNlLCB3aGljaCBpcyB3aHkgc2VydmVyLXNpZGUga2V5Z2Vu IG1heSBiZSBwcmVmZXJyZWQgOykNCg0KRXNrbw0KDQpGcm9tOiBIYW5uZXMgVHNjaG9mZW5pZyA8 SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNv bT4+DQpTZW50OiBUdWVzZGF5LCBNYXkgMTQsIDIwMTkgMTg6NDYNClRvOiBFc2tvIERpamsgPGVz a28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubDxtYWlsdG86ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5 Lm5sPj47IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPG1h aWx0bzpwa2FtcGFuYUBjaXNjby5jb20+PjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSRTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzcw0KDQpIaSBF c2tvLA0KDQpnb29kIHRvIGhlYXIgZnJvbSB5b3UuDQoNCg0KICAqICAgQW5vdGhlciByZWFzb24g Zm9yIHNlcnZlci1zaWRlIGtleWdlbiBjYW4gYmUgdGhhdCBhbiBJVCBkZXBhcnRtZW50L21hbmFn ZXIgd2FudHMgaXQgdGhhdCB3YXkuIFRoZXJlIGNvdWxkIGJlIGEgcG9saWN5IHRoYXQgdGhlIGtl eXBhaXJzIGZvciBhbGwgZG9tYWluIGNlcnRpZmljYXRlcyBtdXN0IGJlIGNyZWF0ZWQgYnkgdGhl IHN5c3RlbXMgdW5kZXIgZGlyZWN0IGNvbnRyb2wgb2YgdGhlIElUIGRlcGFydG1lbnQuIChFLmcu IHRvIGNvbXBseSB3aXRoIG90aGVyIHBvbGljaWVzIG9yIHRvIGJlIGFibGUgdG8gdHJ1c3QgdGhl IHJhbmRvbW5lc3MgbGV2ZWwuIE9yIGp1c3QgYmVjYXVzZSB0aGF0IHdhcyB0aGUgd2F5IGl0IGFs d2F5cyBoYXMgYmVlbiB3aGVuIFBDcyB3ZXJlIHByb3Zpc2lvbmVkIHdpdGggY2VydGlmaWNhdGVz LikgIFRoaXMgY291bGQgYmUgbGlzdGVkIGFzIGFuIGFkZGl0aW9uYWwgcmVhc29uLg0KDQpGb3Ig cmVhZGVycyBpbnRlcmVzdGVkIGluIG1ha2luZyBpbmZvcm1lZCBkZWNpc2lvbnMgSSBiZWxpZXZl IGl0IGlzIHdvcnRod2hpbGUgdG8gcG9pbnQgb3V0IHRoYXQgdGhleSBuZWVkIHJhbmRvbSBudW1i ZXIgZ2VuZXJhdGlvbiBjYXBhYmlsaXRpZXMgb24gSW9UIGRldmljZXMg4oCTIG5vdCBqdXN0IGZv ciB0aGUgcHJpdmF0ZSBrZXkgZ2VuZXJhdGlvbiBpbiBjb250ZXh0IG9mIHRoZSBFU1QgZXhjaGFu Z2UuIEkgZmVhciB0aGF0IHNvbWUgcGVvcGxlLCBpbmNsdWRpbmcgSVQgbWFuYWdlcnMsIGp1c3Qg Z2xhbmNlIG92ZXIgdGhlIGRldGFpbHMgYW5kIGZvY3VzIG9uIGlzb2xhdGVkIGFzcGVjdHMuIEkg YW0gc3VyZSB5b3UgYWdyZWUgd2l0aCBtZSB0aGF0IHRoaXMgd291bGQgYmUgYSB0b28gc2ltcGxp c3RpYyB2aWV3Lg0KDQpDaWFvDQpIYW5uZXMNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRl bnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFu ZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVj aXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBk aXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkg cHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4g VGhhbmsgeW91Lg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwg YW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2 aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90 aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVu dHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUg b3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K --_000_DBBPR08MB45392D26EC53653EF833437FFA080DBBPR08MB4539eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFn cmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1h cmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJ bWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5lbWFpbHF1b3Rl LCBsaS5lbWFpbHF1b3RlLCBkaXYuZW1haWxxdW90ZQ0KCXttc28tc3R5bGUtbmFtZTplbWFpbHF1 b3RlOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MS4wcHQ7DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWls U3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyNA0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3 aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBw dCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICov DQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo4NTAwOTk4MTg7DQoJbXNvLWxpc3QtdHlwZTpoeWJy aWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMDEwNjY5OTMyIC0xNDY0NzIwMTQ4IDEzNDgw NzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEz NDgwNzU1NSAxMzQ4MDc1NTc7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1h dDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv g5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5 OkNhbGlicmk7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxl dmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxNzEyMzQzNjk0Ow0KCW1zby1saXN0LXRlbXBsYXRl LWlkczotMTEyNDQ0MzY1Mjt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MzYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot MTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo3Mi4wcHQ7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjE4MC4w cHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIxNi4wcHQ7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw3 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMyNC4wcHQ7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0Kb2wN Cgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9z dHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVk aXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJl ZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkVza28sIDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj55b3VyIGxpbmUgb2YgdGhvdWdodCBtYWtlcyBzZW5zZSB0byBt ZS4gSSBsZWF2ZSBpdCB0byBQYW5vcyB0byBlbmhhbmNlIHRoZSB0ZXh0Lg0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkNpYW88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhh bm5lczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj RTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gbGFuZz0iREUiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJERSI+ IEVza28gRGlqayAmbHQ7ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sJmd0Ow0KPGJyPg0KPGI+ U2VudDo8L2I+IERpZW5zdGFnLCAxNC4gPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj5NYWkgMjAx OSAxMTo1Nzxicj4NCjxiPlRvOjwvYj4gSGFubmVzIFRzY2hvZmVuaWcgJmx0O0hhbm5lcy5Uc2No b2ZlbmlnQGFybS5jb20mZ3Q7OyBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgJmx0O3BrYW1w YW5hQGNpc2NvLmNvbSZndDs7IGFjZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTog W0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5IaSBIYW5uZXMsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIj5BZ3JlZS4gVGhlIGRyYWZ0IGlzIGFscmVhZHkgcmVmZXJlbmNpbmcgUkZD IDc5MjUsIHNvIGl0IGNvdWxkIGFkZGl0aW9uYWxseSByZWZlcmVuY2UgU2VjdGlvbiAxMiAoPGEg aHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc5MjUjc2VjdGlvbi0xMiI+aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc5MjUjc2VjdGlvbi0xMjwvYT4pIHdoaWNoIGV4 cGxhaW5zDQogdGhhdCByYW5kb21uZXNzIGlzIGFsc28gbmVlZGVkIGZvciBhbGwgRFRMUyBoYW5k c2hha2VzLiBXaGF0IEkgbWVudGlvbiBhYm91dCDigJxiZWluZyBhYmxlIHRvIHRydXN0IHRoZSBy YW5kb21uZXNzIGxldmVs4oCdIGlzIHRoZW4gbWF5YmUgYSBtb3JlIHBzeWNob2xvZ2ljYWwgcmVx dWlyZW1lbnQgcmF0aGVyIHRoYW4gdGVjaG5pY2FsLiBBIHBvd2VyZnVsIHNlcnZlciB3aXRoIFJU QyBqdXN0IHNvdW5kcyBtb3JlIGNhcGFibGUgdG8gZG8gcHJpdmF0ZQ0KIGtleSBnZW5lcmF0aW9u IHRoYW4gYW4gSW9UIGRldmljZSwgd2hpY2ggaXMgd2h5IHNlcnZlci1zaWRlIGtleWdlbiBtYXkg YmUgcHJlZmVycmVkIDspPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5Fc2tvPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxz cGFuIGxhbmc9IkVOLVVTIj4gSGFubmVzIFRzY2hvZmVuaWcgJmx0OzxhIGhyZWY9Im1haWx0bzpI YW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tIj5IYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPC9hPiZn dDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBNYXkgMTQsIDIwMTkgMTg6NDY8YnI+DQo8 Yj5Ubzo8L2I+IEVza28gRGlqayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVza28uZGlqa0Bpb3Rjb25z dWx0YW5jeS5ubCI+ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPC9hPiZndDs7IFBhbm9zIEth bXBhbmFraXMgKHBrYW1wYW5hKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBrYW1wYW5hQGNpc2NvLmNv bSI+cGthbXBhbmFAY2lzY28uY29tPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86YWNlQGlldGYu b3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbQWNlXSBFU1Qg b3ZlciBDb0FQOiBSYW5kb21uZXNzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBFc2tvLCA8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Z29vZCB0byBoZWFyIGZyb20geW91LiA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJn aW4tdG9wOjBjbSIgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowY207bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPjxzcGFuIGxhbmc9 IkVOLVVTIj5Bbm90aGVyIHJlYXNvbiBmb3Igc2VydmVyLXNpZGUga2V5Z2VuIGNhbiBiZSB0aGF0 IGFuIElUIGRlcGFydG1lbnQvbWFuYWdlciB3YW50cyBpdCB0aGF0IHdheS4gVGhlcmUgY291bGQg YmUgYSBwb2xpY3kgdGhhdCB0aGUga2V5cGFpcnMgZm9yIGFsbCBkb21haW4gY2VydGlmaWNhdGVz DQogbXVzdCBiZSBjcmVhdGVkIGJ5IHRoZSBzeXN0ZW1zIHVuZGVyIGRpcmVjdCBjb250cm9sIG9m IHRoZSBJVCBkZXBhcnRtZW50LiAoRS5nLiB0byBjb21wbHkgd2l0aCBvdGhlciBwb2xpY2llcyBv ciB0byBiZSBhYmxlIHRvIHRydXN0IHRoZSByYW5kb21uZXNzIGxldmVsLiBPciBqdXN0IGJlY2F1 c2UgdGhhdCB3YXMgdGhlIHdheSBpdCBhbHdheXMgaGFzIGJlZW4gd2hlbiBQQ3Mgd2VyZSBwcm92 aXNpb25lZCB3aXRoIGNlcnRpZmljYXRlcy4pJm5ic3A7IFRoaXMNCiBjb3VsZCBiZSBsaXN0ZWQg YXMgYW4gYWRkaXRpb25hbCByZWFzb24uPG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gb3IgcmVh ZGVycyBpbnRlcmVzdGVkIGluIG1ha2luZyBpbmZvcm1lZCBkZWNpc2lvbnMgSSBiZWxpZXZlIGl0 IGlzIHdvcnRod2hpbGUgdG8gcG9pbnQgb3V0IHRoYXQgdGhleSBuZWVkIHJhbmRvbSBudW1iZXIg Z2VuZXJhdGlvbiBjYXBhYmlsaXRpZXMgb24gSW9UIGRldmljZXMg4oCTIG5vdCBqdXN0IGZvciB0 aGUgcHJpdmF0ZSBrZXkgZ2VuZXJhdGlvbiBpbiBjb250ZXh0IG9mIHRoZQ0KIEVTVCBleGNoYW5n ZS4gSSBmZWFyIHRoYXQgc29tZSBwZW9wbGUsIGluY2x1ZGluZyBJVCBtYW5hZ2VycywganVzdCBn bGFuY2Ugb3ZlciB0aGUgZGV0YWlscyBhbmQgZm9jdXMgb24gaXNvbGF0ZWQgYXNwZWN0cy4gSSBh bSBzdXJlIHlvdSBhZ3JlZSB3aXRoIG1lIHRoYXQgdGhpcyB3b3VsZCBiZSBhIHRvbyBzaW1wbGlz dGljIHZpZXcuICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkNpYW88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+SGFu bmVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwg YW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2 aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90 aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVu dHMgdG8gYW55IG90aGVyIHBlcnNvbiwNCiB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9y ZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRo aXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxz byBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBw bGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0 aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwN CiBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5 b3UuDQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DBBPR08MB45392D26EC53653EF833437FFA080DBBPR08MB4539eurp_-- From nobody Tue May 14 15:08:05 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E0D91201EE for ; Tue, 14 May 2019 15:08:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HsWaobMWpS95 for ; Tue, 14 May 2019 15:08:01 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A349A12003F for ; Tue, 14 May 2019 15:08:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=581; q=dns/txt; s=iport; t=1557871681; x=1559081281; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=hU+8/OcF8c4S1uEhz3YDbFdjAgrf53u8x9fU/1pg8KE=; b=lBCS/i9vVw8gZRLXWS1qwRAMmP17igd3t9PrFWxQ12yGf7nUjigqOSCI 9NMVzPEMNPi58J6EJ6/P5LurFGQk/lRzxvR+7j8PJn3+tO3Zt611fb+ax n11vUrhEVFnPPmJeccd0ocR6qTESQFH5zm1M7Q3SoEvtYB0+OWGrkjiX5 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D+AADeO9tc/5BdJa1kGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBZYFiL4E6M4Q5kxOBYAglmk4JAQEBDi8BAYRAAoIdIzgTAQMBAQQ?= =?us-ascii?q?BAQIBBG0ohUsBBSMPAQVRCxgCAiYCAlcGAQwIAQEXgweCC6ttgS+FR4MlgUa?= =?us-ascii?q?BCyiLTxeBQD+BOAyCXz6HToJYBKdZCYILiluHfQYbggSKKolAjDSNK4gHgWY?= =?us-ascii?q?hgVczGggbFYMokGwjA5EfAQE?= X-IronPort-AV: E=Sophos;i="5.60,470,1549929600"; d="scan'208";a="555086061" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 May 2019 22:07:49 +0000 Received: from [10.86.249.76] (bxb-vpn3-332.cisco.com [10.86.249.76]) by rcdn-core-8.cisco.com (8.15.2/8.15.2) with ESMTP id x4EM7mer013909; Tue, 14 May 2019 22:07:49 GMT To: Hannes Tschofenig , "ace@ietf.org" References: From: Paul Duffy Message-ID: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> Date: Tue, 14 May 2019 18:07:48 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Outbound-SMTP-Client: 10.86.249.76, bxb-vpn3-332.cisco.com X-Outbound-Node: rcdn-core-8.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 22:08:03 -0000 On 5/9/2019 10:42 AM, Hannes Tschofenig wrote: > I believe we should encourage developers to pick the correct hardware for the task rather than making them believe we have come up with solutions that allow them to get away without a hardware-based RNG. > > I also do not believe the statement that random number key generation is costly. Can you give me some number? Strong agreement.  The added cost for hw based RNG is ever decreasing.  Last time I checked it was on the order of 50 cents @ Q 10k?  It has likely fallen since.  Confirm with Atmel etc. Cheers From nobody Tue May 14 16:29:14 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CC5F12003E for ; Tue, 14 May 2019 16:29:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ju2FYsAWV6gi for ; Tue, 14 May 2019 16:29:07 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60049.outbound.protection.outlook.com [40.107.6.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4247612004E for ; Tue, 14 May 2019 16:29:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kpMSRSmmQJiqBFJya9aZj0+6XdlD9z8fg9IjdNwAAKo=; b=V/WAQwcJrza50i8qGZoh8a8EfiJLn0aB8m1QSqARGHGWCzfqvogATfmmGAZQ1HtMUcIjh/slKw+rSN+v2OIeo8Arojx8hUdR53PZ9TbVBORnmbBWFFKySXIKk90Kql3pJecobiqUiIfyJh6DeeHbkhqeUCYn1DDr2bLId5iVA0E= Received: from AM0PR08MB4532.eurprd08.prod.outlook.com (20.179.35.147) by AM0PR08MB3284.eurprd08.prod.outlook.com (52.134.93.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Tue, 14 May 2019 23:29:00 +0000 Received: from AM0PR08MB4532.eurprd08.prod.outlook.com ([fe80::35d0:ad07:4504:44a2]) by AM0PR08MB4532.eurprd08.prod.outlook.com ([fe80::35d0:ad07:4504:44a2%7]) with mapi id 15.20.1878.024; Tue, 14 May 2019 23:29:00 +0000 From: Hannes Tschofenig To: Paul Duffy , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AEMI0QAAAJINfA= Date: Tue, 14 May 2019 23:29:00 +0000 Message-ID: References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> In-Reply-To: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [217.140.103.75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 67505e92-6f9d-4cc6-21a1-08d6d8c3f1e1 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:AM0PR08MB3284; x-ms-traffictypediagnostic: AM0PR08MB3284: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0037FD6480 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(376002)(346002)(366004)(39860400002)(13464003)(40434004)(189003)(199004)(446003)(110136005)(316002)(74316002)(33656002)(71200400001)(71190400001)(66946007)(11346002)(7696005)(25786009)(68736007)(55016002)(76176011)(86362001)(99286004)(476003)(486006)(9686003)(6506007)(53546011)(305945005)(26005)(2501003)(229853002)(186003)(6436002)(66066001)(478600001)(14454004)(256004)(8936002)(52536014)(6246003)(53936002)(102836004)(5660300002)(72206003)(8676002)(81156014)(73956011)(66476007)(64756008)(81166006)(66556008)(66446008)(5024004)(76116006)(14444005)(6116002)(7736002)(2906002)(3846002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB3284; H:AM0PR08MB4532.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: khBQMhE3r24xKF75DLG53adyuGIiQJZPXWTZws8FSXURXyzQCP0DYRIgJekYCnApps6Aila98Dq9njVqPX+LIcO7xUlnGDgn0RNVO98ivsAkBKicc7zCdYS/wJPXAcOLg/0DAGDcQoJlz5nQTcP3JnwyfpmMVwMH0O8XXdE09mtZ6IQpNuOnpebQ/0cI5ayylk3BC3wWOu6p3OxNQC5uZDH5hGa8RPdDrZhd8d7IONNapMbwf98V7g1DV0bcjCxsB59xWH8f4TnDyrLziCup6YXIp9kemVsZqMAlYlgWxzuKenUDb5SFpaYytsZv/Sta2EZRYYc+Y7WyZhA7D+v9l+crlif5amhUd3uEhbeyZQTuGQDhxIw8gBtdMstkVeESbJDJ/RP+j8zGZ7XHE8rwdigUWTP/P1eoGcqGLTv2yJE= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 67505e92-6f9d-4cc6-21a1-08d6d8c3f1e1 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2019 23:29:00.7459 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3284 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 23:29:12 -0000 SGkgUGF1bCwNCg0KTXkgdW5kZXJzdGFuZGluZyBmcm9tIHJlYWRpbmcgdGhlIGRyYWZ0IHRleHQg d2FzIHRoYXQgdGhlICJjb3N0IiB3YXMgYWN0dWFsbHkgdGFsa2luZyBhYm91dCAiZW5lcmd5IGNv c3QiIHJhdGhlciB0aGFuICJtb25ldGFyeSBjb3N0Ii4NClRoZSBtb25ldGFyeSBjb3N0IG1heSBh bHNvIGJlIGludGVyZXN0aW5nLg0KDQpJdCBpcyBkaWZmaWN1bHQgdG8ganVkZ2UgdGhlIGV4dHJh IGNvc3Qgb2YgYSBSTkcgaW4gYW4gTUNVIGJlY2F1c2UNCihhKSB5b3UgcmFyZWx5IGZpbmQgYW4g TUNVIHdpdGggYW5kIHdpdGhvdXQgTUNVIChrZWVwaW5nIGFsbCBvdGhlciBmZWF0dXJlcyB0aGUg c2FtZSksDQooYikgZXZlbiBpZiB5b3UgZmluZCBvbmUgdGhlcmUgYXJlIG90aGVyIGZhY3RvcnMg dGhhdCBpbXBhY3QgdGhlIGNvc3QgKHN1Y2ggYXMgcG9wdWxhcml0eSBvZiBhIHBhcnRpY3VsYXIg TUNVKSwNCihjKSBSTkcgZmVhdHVyZXMgYXJlIG9mdGVuIHByb3ZpZGVkIHdpdGggb3RoZXIgZmVh dHVyZXMgKHN1Y2ggYXMgU0hBMjU2IGFuZCBBRVMgaW4gaGFyZHdhcmUpLCBhbmQNCihkKSBjb3N0 IGFuZCBwcmljZSBvZiBhbiBNQ1UgYXJlIGRpZmZlcmVudCBhc3BlY3RzLg0KDQpDaWFvDQpIYW5u ZXMNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFBhdWwgRHVmZnkgPHBhZHVm ZnlAY2lzY28uY29tPg0KU2VudDogRGllbnN0YWcsIDE0LiBNYWkgMjAxOSAxNTowOA0KVG86IEhh bm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPjsgYWNlQGlldGYub3Jn DQpTdWJqZWN0OiBSZTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzcw0KDQoNCk9uIDUv OS8yMDE5IDEwOjQyIEFNLCBIYW5uZXMgVHNjaG9mZW5pZyB3cm90ZToNCj4gSSBiZWxpZXZlIHdl IHNob3VsZCBlbmNvdXJhZ2UgZGV2ZWxvcGVycyB0byBwaWNrIHRoZSBjb3JyZWN0IGhhcmR3YXJl IGZvciB0aGUgdGFzayByYXRoZXIgdGhhbiBtYWtpbmcgdGhlbSBiZWxpZXZlIHdlIGhhdmUgY29t ZSB1cCB3aXRoIHNvbHV0aW9ucyB0aGF0IGFsbG93IHRoZW0gdG8gZ2V0IGF3YXkgd2l0aG91dCBh IGhhcmR3YXJlLWJhc2VkIFJORy4NCj4NCj4gSSBhbHNvIGRvIG5vdCBiZWxpZXZlIHRoZSBzdGF0 ZW1lbnQgdGhhdCByYW5kb20gbnVtYmVyIGtleSBnZW5lcmF0aW9uIGlzIGNvc3RseS4gQ2FuIHlv dSBnaXZlIG1lIHNvbWUgbnVtYmVyPw0KDQpTdHJvbmcgYWdyZWVtZW50LiAgVGhlIGFkZGVkIGNv c3QgZm9yIGh3IGJhc2VkIFJORyBpcyBldmVyIGRlY3JlYXNpbmcuIExhc3QgdGltZSBJIGNoZWNr ZWQgaXQgd2FzIG9uIHRoZSBvcmRlciBvZiA1MCBjZW50cyBAIFEgMTBrPyAgSXQgaGFzIGxpa2Vs eSBmYWxsZW4gc2luY2UuICBDb25maXJtIHdpdGggQXRtZWwgZXRjLg0KDQpDaGVlcnMNCg0KDQpJ TVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFj aG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlv dSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRl ciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3Ro ZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBp bmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= From nobody Wed May 15 07:10:52 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8235C1202BE for ; Wed, 15 May 2019 07:10:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GiNre6ekSEhU for ; Wed, 15 May 2019 07:10:44 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 798A31202D0 for ; Wed, 15 May 2019 07:10:44 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 080693826E for ; Wed, 15 May 2019 10:09:58 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id B1F58E3B; Wed, 15 May 2019 10:10:41 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id AFA36A2 for ; Wed, 15 May 2019 10:10:41 -0400 (EDT) From: Michael Richardson To: "ace\@ietf.org" In-Reply-To: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 May 2019 14:10:52 -0000 --=-=-= Content-Type: text/plain My understanding of the use case for server generated keys is for existing, deployed systems where the system can easily get a firmware update, but the hardware TPM itself is unable/unwilling to generate new keys, and can't be upgraded, but keys can be loaded. Systems like Hannes' company produces, where the TPM is really a TEE don't suffer from the upgrade problem, but there are many other systems out there based upon older designs. And, it's an optional part of the protocol; one I don't intend to support. I don't see why it should bother anyone. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlzcHeEACgkQgItw+93Q 3WVOPwf/QGESuV4gpoE/BrGwehonRd33ogp6RzpFY8WieypLyNip1dqRMnc8NMkj N2mhg2zb8qgZMdZMHC87kW1LyMFhO75x30oNPOjv3YWDPkLgzll/qWC21SVAS19S 3VXwNs5Ezg//3xndP5mQx0XyKoRmUxyUU/AcFdu18sdrRUv1hZILLSDGk/2i6mVu swoHhJ/Nlx1pF6mgP/1aJfgmsDAKjBQk/1+Y46MgsZK8Z/i1c38isQ3nDEFOkrP5 WC6/Y0vFKZz2ZwOZeP3aBWC3OXKl6YQqGGnNywpv0ONfgXefOfb13n6OkLVZod3g HFb/qaH80pYfGTGBNtE9qjf2a2C6FA== =PylP -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed May 15 07:28:48 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE87D12004B for ; Wed, 15 May 2019 07:28:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=itron.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BB_pgzAA8mEi for ; Wed, 15 May 2019 07:28:43 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-eopbgr790059.outbound.protection.outlook.com [40.107.79.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B27F8120019 for ; Wed, 15 May 2019 07:28:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itron.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/fbLW+xPURkZic4RQqCmQzZilyvf5kXgtdFzzuMpBg4=; b=cTT9lnTlKM+L7v0HVNvBIZRhAnN3kNNsF0L57o1fy7ujAB1F0ICb6ilor04438O0KzjKj1WWkcyKfPBpnMtZtEZdAZMZUXcL0biCAubh+aEsJ1URVpis4CIkjwnYZe1gqM11GA4tElOgashIQhaheVBr+sxP66y5LutdACdZZQs= Received: from SN6PR04MB5165.namprd04.prod.outlook.com (52.135.116.211) by SN6PR04MB4896.namprd04.prod.outlook.com (52.135.114.77) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Wed, 15 May 2019 14:28:40 +0000 Received: from SN6PR04MB5165.namprd04.prod.outlook.com ([fe80::7d72:f582:bf3b:302]) by SN6PR04MB5165.namprd04.prod.outlook.com ([fe80::7d72:f582:bf3b:302%4]) with mapi id 15.20.1900.010; Wed, 15 May 2019 14:28:40 +0000 From: "Damm, Benjamin" To: Hannes Tschofenig , Paul Duffy , "ace@ietf.org" Thread-Topic: [EXTERNAL] Re: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AEMI0QAAAJINfAAH7kBBA== Date: Wed, 15 May 2019 14:28:40 +0000 Message-ID: References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Benjamin.Damm@itron.com; x-originating-ip: [20.41.63.67] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a4f1576b-ae68-4bca-21af-08d6d941a084 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:SN6PR04MB4896; x-ms-traffictypediagnostic: SN6PR04MB4896: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0038DE95A2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(366004)(39860400002)(396003)(346002)(376002)(13464003)(40434004)(199004)(189003)(316002)(9686003)(55016002)(7736002)(6306002)(54896002)(2906002)(68736007)(6116002)(3846002)(7696005)(110136005)(76176011)(52536014)(33656002)(99286004)(74316002)(6436002)(102836004)(66066001)(6506007)(5660300002)(25786009)(53546011)(229853002)(186003)(91956017)(81166006)(81156014)(5024004)(8676002)(53936002)(64756008)(76116006)(66446008)(86362001)(66946007)(73956011)(26005)(66476007)(446003)(11346002)(486006)(476003)(71200400001)(8936002)(71190400001)(66556008)(14454004)(6246003)(2501003)(966005)(478600001)(72206003)(256004)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:SN6PR04MB4896; H:SN6PR04MB5165.namprd04.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: itron.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: pmgawGWn5raHi72AwTkvssm9jZQL70JeQ/verJy8sECrW1zieBgLPPGZleAg0qGpvwEcdtwDkNcVsoNDQz/wEH+SYu1ulglW5mj/B9LmBx1NyjAlM1CWSt+3aKlQ/cOJjK5NatWV1zSLF4N8c44jKIygYhUpgXo6yKBAuxsR5E4BVkwX8rjiraMT4kFAgY4uLCRa05thskTfM1hHVP3K0bCpZyRDyue6rO7v71FW8mQFOPkB22tQj5QQFBkwrBbIzS0O8E5UTWgYs3T9pBJZtJi3tFU6L0AsWY6QD0qCH3QaAJlnknjqgK1xQA8ox6EIqd1effqkL+z2Farky45bsSLoeoUOErpAduSwUkGI/tII6ibL7LaUJ84e8B8T7ll/j7dDZpptOHRWVSku3NyvA+W1c0WcQhWNyzG4Cm+TgpQ= Content-Type: multipart/alternative; boundary="_000_SN6PR04MB516505FF98223DDEFC4FC256F8090SN6PR04MB5165namp_" MIME-Version: 1.0 X-OriginatorOrg: itron.com X-MS-Exchange-CrossTenant-Network-Message-Id: a4f1576b-ae68-4bca-21af-08d6d941a084 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 May 2019 14:28:40.7590 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5818bd20-bf25-47b1-b996-d419d7e6e8ba X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR04MB4896 Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 May 2019 14:28:46 -0000 --_000_SN6PR04MB516505FF98223DDEFC4FC256F8090SN6PR04MB5165namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Low-throughput RNG should be a must for IoT. Certainly in our environment d= evices that are unable to generate keys would be unacceptable. Hopefully we= won=92t codify such an abomination in any protocol. -Ben Benjamin Damm Cell: +1-415-297-5474 Web: https://Itron.com ________________________________ From: Ace on behalf of Hannes Tschofenig Sent: Tuesday, May 14, 2019 4:29 PM To: Paul Duffy; ace@ietf.org Subject: [EXTERNAL] Re: [Ace] EST over CoAP: Randomness Hi Paul, My understanding from reading the draft text was that the "cost" was actual= ly talking about "energy cost" rather than "monetary cost". The monetary cost may also be interesting. It is difficult to judge the extra cost of a RNG in an MCU because (a) you rarely find an MCU with and without MCU (keeping all other features= the same), (b) even if you find one there are other factors that impact the cost (such= as popularity of a particular MCU), (c) RNG features are often provided with other features (such as SHA256 and= AES in hardware), and (d) cost and price of an MCU are different aspects. Ciao Hannes -----Original Message----- From: Paul Duffy Sent: Dienstag, 14. Mai 2019 15:08 To: Hannes Tschofenig ; ace@ietf.org Subject: Re: [Ace] EST over CoAP: Randomness On 5/9/2019 10:42 AM, Hannes Tschofenig wrote: > I believe we should encourage developers to pick the correct hardware for= the task rather than making them believe we have come up with solutions th= at allow them to get away without a hardware-based RNG. > > I also do not believe the statement that random number key generation is = costly. Can you give me some number? Strong agreement. The added cost for hw based RNG is ever decreasing. Last = time I checked it was on the order of 50 cents @ Q 10k? It has likely falle= n since. Confirm with Atmel etc. Cheers IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_ace&d=3DDwICAg&c=3DpqcuzKEN_84c78MOSc5_fw&r=3DGYGBKg0XeEBnyXmKSs4= zZ6DBOYB5tLwwWSrFtYahCvs&m=3DdH_774yB0_IzrwFvyY1Iio9qthZz-eV34lbAEv3Y3kY&s= =3DWChHRMoeN8IO06GYZPU1yk3uh76KEHoR7q9Hx7nhGcs&e=3D --_000_SN6PR04MB516505FF98223DDEFC4FC256F8090SN6PR04MB5165namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Low-throughput RNG should be a must for IoT.= Certainly in our environment devices that are unable to generate keys woul= d be unacceptable. Hopefully we won=92t codify such an abomination in any p= rotocol.
-Ben


Benjamin Damm
Cell: +1-415-297-5474
Web: https://Itron.com
 
From: Ace= <ace-bounces@ietf.org> on behalf of Hannes Tschofenig <hannes.tsc= hofenig@arm.com>
Sent: Tuesday, May 14, 2019 4:29 PM
To: Paul Duffy; ace@ietf.org
Subject: [EXTERNAL] Re: [Ace] EST over CoAP: Randomness
 
Hi Paul,

My understanding from reading the draft text was that the "cost" = was actually talking about "energy cost" rather than "moneta= ry cost".
The monetary cost may also be interesting.

It is difficult to judge the extra cost of a RNG in an MCU because
(a) you rarely find an MCU with and without MCU (keeping all other features= the same),
(b) even if you find one there are other factors that impact the cost (such= as popularity of a particular MCU),
(c) RNG features are often provided with other features (such as SHA256 and= AES in hardware), and
(d) cost and price of an MCU are different aspects.

Ciao
Hannes

-----Original Message-----
From: Paul Duffy <paduffy@cisco.com>
Sent: Dienstag, 14. Mai 2019 15:08
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; ace@ietf.org
Subject: Re: [Ace] EST over CoAP: Randomness


On 5/9/2019 10:42 AM, Hannes Tschofenig wrote:
> I believe we should encourage developers to pick the correct hardware = for the task rather than making them believe we have come up with solutions= that allow them to get away without a hardware-based RNG.
>
> I also do not believe the statement that random number key generation = is costly. Can you give me some number?

Strong agreement. The added cost for hw based RNG is ever decreasing. Last = time I checked it was on the order of 50 cents @ Q 10k? It has likely falle= n since. Confirm with Atmel etc.

Cheers


IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
Ace mailing list
Ace@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_ace&d=3DDwICAg&c=3DpqcuzKEN_84c78MOSc5_fw&r=3DGYGBKg0= XeEBnyXmKSs4zZ6DBOYB5tLwwWSrFtYahCvs&m=3DdH_774yB0_IzrwFvyY1Iio9qthZz-e= V34lbAEv3Y3kY&s=3DWChHRMoeN8IO06GYZPU1yk3uh76KEHoR7q9Hx7nhGcs&e=3D
--_000_SN6PR04MB516505FF98223DDEFC4FC256F8090SN6PR04MB5165namp_-- From nobody Wed May 15 07:30:24 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 577131200DB for ; Wed, 15 May 2019 07:30:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d-GYSo-yHsum for ; Wed, 15 May 2019 07:30:20 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C79112001E for ; Wed, 15 May 2019 07:30:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2127; q=dns/txt; s=iport; t=1557930620; x=1559140220; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=OJWQPJGzp4331BWJvr0JrkiNd4prWpFVrotpTUeOif8=; b=PB9EsEMw2pdC8oUGHKvniKLje0h0eLtXDq3qm78g87Q64ltvsGq33qZb wYT567SrY3wfKTDvjwCK1fjn2MiwAPnjDsqQ4u79YcMWL0YUTZl3PHdaU nVq6R1UipBsayVmNg9rGDNjUwrwM3cK5nWWVBEB6u9JxcR4VmD7fML0mv c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AKAADBIdxc/49dJa1kGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBUwMBAQEBCwGBYQUqgW0ohBGTBoFgCCWYUxSBZwkBAQEOLwE?= =?us-ascii?q?BhEACgisjNgcOAQMBAQQBAQIBBG0ohUoBAQEEIw8BBTgVBAsRBAEBAQICJgI?= =?us-ascii?q?CTwgGAQwGAgEBF4MHggusR4EvhUeDIIFGgQsoAYowgR4XgUA/JoESDIJfPoQ?= =?us-ascii?q?RARIBS4JeglgEiwWcVAmCC4pbg2KEGwYbghQuhh6DTolAjDSNK4gHgVYELWZ?= =?us-ascii?q?xMxoIGxWDJ4MzAQKNNyMzjiyCQwEB?= X-IronPort-AV: E=Sophos;i="5.60,472,1549929600"; d="scan'208";a="270863332" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 15 May 2019 14:30:19 +0000 Received: from [161.44.79.55] ([161.44.79.55]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTP id x4FEUIPh003961; Wed, 15 May 2019 14:30:19 GMT To: Hannes Tschofenig , "ace@ietf.org" References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> From: Paul Duffy Message-ID: Date: Wed, 15 May 2019 10:30:18 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Outbound-SMTP-Client: 161.44.79.55, [161.44.79.55] X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 May 2019 14:30:22 -0000 The point I'm making Hannes is that,  though not so long ago the "cost" for RNG was prohibitive for many constrained end-devices ... this is more often no longer the case and improving every month (despite whatever other security functions are packaged within the module). On 5/14/2019 7:29 PM, Hannes Tschofenig wrote: > Hi Paul, > > My understanding from reading the draft text was that the "cost" was actually talking about "energy cost" rather than "monetary cost". > The monetary cost may also be interesting. > > It is difficult to judge the extra cost of a RNG in an MCU because > (a) you rarely find an MCU with and without MCU (keeping all other features the same), > (b) even if you find one there are other factors that impact the cost (such as popularity of a particular MCU), > (c) RNG features are often provided with other features (such as SHA256 and AES in hardware), and > (d) cost and price of an MCU are different aspects. > > Ciao > Hannes > > -----Original Message----- > From: Paul Duffy > Sent: Dienstag, 14. Mai 2019 15:08 > To: Hannes Tschofenig ; ace@ietf.org > Subject: Re: [Ace] EST over CoAP: Randomness > > > On 5/9/2019 10:42 AM, Hannes Tschofenig wrote: >> I believe we should encourage developers to pick the correct hardware for the task rather than making them believe we have come up with solutions that allow them to get away without a hardware-based RNG. >> >> I also do not believe the statement that random number key generation is costly. Can you give me some number? > Strong agreement. The added cost for hw based RNG is ever decreasing. Last time I checked it was on the order of 50 cents @ Q 10k? It has likely fallen since. Confirm with Atmel etc. > > Cheers > > > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. From nobody Wed May 15 08:12:22 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DBDF120099 for ; Wed, 15 May 2019 08:12:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=LXkUbrJ3; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=bSJBuHhp Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VHQGCL3wbe6W for ; Wed, 15 May 2019 08:12:16 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01D551200FB for ; Wed, 15 May 2019 08:12:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11400; q=dns/txt; s=iport; t=1557933135; x=1559142735; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=/XN6gaz1dd+EdVPmfGSjA8rTyBOJLl95R8Cp1mlEcQw=; b=LXkUbrJ394IAJLI2RkCWJQa/eF0xXhEknu4GFn+QQ4xvKxEJtOLzrpVs QXgJ+CrkUup8el+w1HMQZbRLGC4VwJHOXOAkKS6YKSMoHrSTGQQ9GogiO 9ZGBGFiweG4oAiRP6ip7nLaBiC8W/nNSprRV68fhaFog7fMvXDZH5KSOh I=; IronPort-PHdr: =?us-ascii?q?9a23=3A5hJPjBYOHsQigsm8/1tGVlr/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gabRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavybCU/BM1EXXdu/mqwNg5eH8OtL1A=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AlAAA+K9xc/5JdJa1hAxsBAQEBAwE?= =?us-ascii?q?BAQcDAQEBgVIFAQEBCwGBDi8kBScDaVUgBAsoCodOA45ySoINkliETYEuFIE?= =?us-ascii?q?QA1QJAQEBDAEBIAkEAgEBhEACgisjNQgOAQMBAQQBAQIBBG0cDIVKAQEBBBI?= =?us-ascii?q?bEwEBLAIKCwQCAQgRBAEBAScHMhQJCAIEARIIEwQDgwGBHU0DHQEOoS8CgTW?= =?us-ascii?q?IX4IggnkBAQWEfhiCDwmBMwGFQoJvgX+BHheBQD8mgTGCTD6CYQQYgRQBEgE?= =?us-ascii?q?hBQcTCwEJAg+CdYImiwmHKpUqCQKCCYYhhDqDYoQ8ghQuN4VnjQ6LHIEYhli?= =?us-ascii?q?OMgIEAgQFAg4BAQWBUQI0ZnFwFTuCbAmCBoEkAQKCSIpTcgEBE4EUjQOBIgG?= =?us-ascii?q?BIAEB?= X-IronPort-AV: E=Sophos;i="5.60,472,1549929600"; d="scan'208,217";a="560112734" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 15 May 2019 15:12:11 +0000 Received: from XCH-ALN-006.cisco.com (xch-aln-006.cisco.com [173.36.7.16]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id x4FFCBnB015948 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 15 May 2019 15:12:11 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-ALN-006.cisco.com (173.36.7.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 15 May 2019 10:12:11 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 15 May 2019 10:12:10 -0500 Received: from NAM05-BY2-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 15 May 2019 10:12:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=inla9QtjG3psr+la7fQRvxDuvV9Imvp3CwBAEwic10k=; b=bSJBuHhpJuGFOq4mgGsPvkGI4bXaWo7VWVH35JojtV+IsIqD280obx6/hRvG3DxdWIv6iFoyS78PzH+Yk5Odhmx/g9HJ3BZi3jpNZpMHhnZuXTr2+zDOnr8qFmwNIpLz4+qUz+rQeqhbOQd2tJqx+sXMMy4LkAutKnLFoBbmYxk= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHSPR00MB242.namprd11.prod.outlook.com (10.169.207.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Wed, 15 May 2019 15:12:09 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1900.010; Wed, 15 May 2019 15:12:09 +0000 From: "Panos Kampanakis (pkampana)" To: "Damm, Benjamin" , "ace@ietf.org" Thread-Topic: [Ace] [EXTERNAL] Re: EST over CoAP: Randomness Thread-Index: AQHVCyqVf0ZF4bvDnUOipNZ8LdEfhaZsSa3Q Date: Wed, 15 May 2019 15:12:09 +0000 Message-ID: References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [173.38.117.90] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 72655b8d-cdd8-4846-feaa-08d6d947b34b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHSPR00MB242; x-ms-traffictypediagnostic: MWHSPR00MB242: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0038DE95A2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39860400002)(136003)(376002)(366004)(346002)(189003)(13464003)(40434004)(199004)(478600001)(8936002)(966005)(76116006)(6506007)(110136005)(66946007)(68736007)(186003)(5660300002)(53936002)(7736002)(486006)(790700001)(6116002)(102836004)(81166006)(14454004)(3846002)(8676002)(81156014)(53546011)(52536014)(6246003)(66476007)(73956011)(7696005)(64756008)(66556008)(66446008)(71200400001)(71190400001)(76176011)(99286004)(446003)(26005)(11346002)(6306002)(5024004)(9686003)(236005)(14444005)(25786009)(256004)(86362001)(2906002)(476003)(33656002)(66066001)(606006)(54896002)(55016002)(229853002)(6436002)(2501003)(74316002)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHSPR00MB242; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ZIIcRHHYberjIzISwb6YvPNQcppe9s+0idg0AAuyptkYH2JaYTvwBRZQPdLglo8vcOQ1h+qWMrS95bK0rYc0Db86KNqNct3fqA3QtTIWn2axeV8wPAE20tn6N5LgdfMMfdx7ZouFBwg1g4TxZa0e0Jylbcau553/bRYju5shu93Cy62pzc4bjWMttpfSAF6UACpXvgYWmdNOi5/A/Ba2I4GWWF5l8q8sPkM5Ja1UqIebpEs3p+8ezBCz/KFE2F59IEBkPfBokoAVW9eX4pbTaCl498cTaYabm3kdDODQkSge/MjHHsro21zYlol+3GGr5Z+TRA0RkhuG6XpkAodcUlv5Bph4kLUU/hnieakiitevLAhHn9oa34+WwyrFqNKG8cM7ZEvh03HHZbk/FLyeBWsHHtK6IFEBPSJLrPa3Se0= Content-Type: multipart/alternative; boundary="_000_MWHPR11MB1838D7AC91CD71DD65B46764C9090MWHPR11MB1838namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 72655b8d-cdd8-4846-feaa-08d6d947b34b X-MS-Exchange-CrossTenant-originalarrivaltime: 15 May 2019 15:12:09.2940 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHSPR00MB242 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.16, xch-aln-006.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 May 2019 15:12:20 -0000 --_000_MWHPR11MB1838D7AC91CD71DD65B46764C9090MWHPR11MB1838namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The draft is not recommending against RNGs in any way and hopefully there w= ill be no room for such misunderstandings in the updated text. Panos From: Ace On Behalf Of Damm, Benjamin Sent: Wednesday, May 15, 2019 10:29 AM To: Hannes Tschofenig ; Paul Duffy (paduffy) ; ace@ietf.org Subject: Re: [Ace] [EXTERNAL] Re: EST over CoAP: Randomness Low-throughput RNG should be a must for IoT. Certainly in our environment d= evices that are unable to generate keys would be unacceptable. Hopefully we= won't codify such an abomination in any protocol. -Ben Benjamin Damm Cell: +1-415-297-5474 Web: https://Itron.com ________________________________ From: Ace > on behalf of = Hannes Tschofenig > Sent: Tuesday, May 14, 2019 4:29 PM To: Paul Duffy; ace@ietf.org Subject: [EXTERNAL] Re: [Ace] EST over CoAP: Randomness Hi Paul, My understanding from reading the draft text was that the "cost" was actual= ly talking about "energy cost" rather than "monetary cost". The monetary cost may also be interesting. It is difficult to judge the extra cost of a RNG in an MCU because (a) you rarely find an MCU with and without MCU (keeping all other features= the same), (b) even if you find one there are other factors that impact the cost (such= as popularity of a particular MCU), (c) RNG features are often provided with other features (such as SHA256 and= AES in hardware), and (d) cost and price of an MCU are different aspects. Ciao Hannes -----Original Message----- From: Paul Duffy > Sent: Dienstag, 14. Mai 2019 15:08 To: Hannes Tschofenig >; ace@ietf.org Subject: Re: [Ace] EST over CoAP: Randomness On 5/9/2019 10:42 AM, Hannes Tschofenig wrote: > I believe we should encourage developers to pick the correct hardware for= the task rather than making them believe we have come up with solutions th= at allow them to get away without a hardware-based RNG. > > I also do not believe the statement that random number key generation is = costly. Can you give me some number? Strong agreement. The added cost for hw based RNG is ever decreasing. Last = time I checked it was on the order of 50 cents @ Q 10k? It has likely falle= n since. Confirm with Atmel etc. Cheers IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_ace&d=3DDwICAg&c=3DpqcuzKEN_84c78MOSc5_fw&r=3DGYGBKg0XeEBnyXmKSs4= zZ6DBOYB5tLwwWSrFtYahCvs&m=3DdH_774yB0_IzrwFvyY1Iio9qthZz-eV34lbAEv3Y3kY&s= =3DWChHRMoeN8IO06GYZPU1yk3uh76KEHoR7q9Hx7nhGcs&e=3D --_000_MWHPR11MB1838D7AC91CD71DD65B46764C9090MWHPR11MB1838namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The draft is not recom= mending against RNGs in any way and hopefully there will be no room for suc= h misunderstandings in the updated text.

Panos

 

 

From: Ace <ace-bounces@ietf.org> On = Behalf Of Damm, Benjamin
Sent: Wednesday, May 15, 2019 10:29 AM
To: Hannes Tschofenig <hannes.tschofenig@arm.com>; Paul Duffy = (paduffy) <paduffy@cisco.com>; ace@ietf.org
Subject: Re: [Ace] [EXTERNAL] Re: EST over CoAP: Randomness

 

Low-throughput RNG should be a must for IoT. Certain= ly in our environment devices that are unable to generate keys would be una= cceptable. Hopefully we won’t codify such an abomination in any proto= col.

-Ben

 

 

Benjamin Damm

Cell: +1-415-297-5474

 

From: Ace <ace= -bounces@ietf.org> on behalf of Hannes Tschofenig <hannes.tschofenig@arm.com>
Sent: Tuesday, May 14, 2019 4:29 PM
To: Paul Duffy; ace@ietf.org
Subject: [EXTERNAL] Re: [Ace] EST over CoAP: Randomness <= /span>

 =

Hi Paul,

My understanding from reading the draft text was that the "cost" = was actually talking about "energy cost" rather than "moneta= ry cost".
The monetary cost may also be interesting.

It is difficult to judge the extra cost of a RNG in an MCU because
(a) you rarely find an MCU with and without MCU (keeping all other features= the same),
(b) even if you find one there are other factors that impact the cost (such= as popularity of a particular MCU),
(c) RNG features are often provided with other features (such as SHA256 and= AES in hardware), and
(d) cost and price of an MCU are different aspects.

Ciao
Hannes

-----Original Message-----
From: Paul Duffy <paduffy@cisco.com= >
Sent: Dienstag, 14. Mai 2019 15:08
To: Hannes Tschofenig <Hann= es.Tschofenig@arm.com>; ace@ietf.org
Subject: Re: [Ace] EST over CoAP: Randomness


On 5/9/2019 10:42 AM, Hannes Tschofenig wrote:
> I believe we should encourage developers to pick the correct hardware = for the task rather than making them believe we have come up with solutions= that allow them to get away without a hardware-based RNG.
>
> I also do not believe the statement that random number key generation = is costly. Can you give me some number?

Strong agreement. The added cost for hw based RNG is ever decreasing. Last = time I checked it was on the order of 50 cents @ Q 10k? It has likely falle= n since. Confirm with Atmel etc.

Cheers


IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
Ace mailing list
Ace@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_ace&d=3DDwICAg&c=3DpqcuzKEN_84c78MOSc5_fw&r= =3DGYGBKg0XeEBnyXmKSs4zZ6DBOYB5tLwwWSrFtYahCvs&m=3DdH_774yB0_IzrwFvyY1I= io9qthZz-eV34lbAEv3Y3kY&s=3DWChHRMoeN8IO06GYZPU1yk3uh76KEHoR7q9Hx7nhGcs= &e=3D

--_000_MWHPR11MB1838D7AC91CD71DD65B46764C9090MWHPR11MB1838namp_-- From nobody Wed May 15 09:46:44 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2833120105 for ; Wed, 15 May 2019 09:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=Vo5mb9eR; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=vm/fsEEa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m2X6YrLnEEA8 for ; Wed, 15 May 2019 09:46:39 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31079120090 for ; Wed, 15 May 2019 09:46:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=30684; q=dns/txt; s=iport; t=1557938799; x=1559148399; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=igqotUYhp3T5r3ujLzQfU68uqIQF9BTt8QbpCwSDu2w=; b=Vo5mb9eRnPlypSmydaXsOVBZLXxlfO40hZYE8CYekLo6rhcTPsuv6U6h 3f+780mOb8dCszzpHwfz1+JnuD+vVtXd0lHhJkB+4s1SRopoF+PfXQJrc nEwDGaHbKMJ6Pktcl3UNZDcm5X/46mbLz7RYhoRtKexLZXigCeipvs8px Y=; IronPort-PHdr: =?us-ascii?q?9a23=3AQ/rZ/h9xSZ1uWP9uRHGN82YQeigqvan1NQcJ65?= =?us-ascii?q?0hzqhDabmn44+8ZR7E/fs4iljPUM2b8P9Ch+fM+4HYEW0bqdfk0jgZdYBUER?= =?us-ascii?q?oMiMEYhQslVdaGAEjjJfjjRyc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BPAQCKQdxc/51dJa1bCRwBAQEEAQE?= =?us-ascii?q?HBAEBgVQEAQELAYEOLyknA2lVIAQLKAqEB4NHA45ySoINlyWBQoEQA1QJAQE?= =?us-ascii?q?BDAEBIwoCAQGEQAIXghQjNwYOAQMBAQQBAQIBBG0cDIVKAQEBBBIRChMBAS4?= =?us-ascii?q?KDwIBCBEEAQEhBwMCAgIwFAkIAgQBEggagwGBHU0DHQEOoSwCgTWIX3GBL4J?= =?us-ascii?q?5AQEFgTYCg0sYgg8DBoEzAYowgR4XgUA/JmtGgkw+gmEBAQIBgSsBCAoBCRg?= =?us-ascii?q?MCRYJAoJSMoImiwkIAoJNhFOIEIw1ZQkCggmGIYN4hCSEPIIULoYejQ6MNIZ?= =?us-ascii?q?YjjICBAIEBQIOAQEFgWUiZnFwFYMngRd4gSQBAoJIhRSFP3KBKY0DgSIBgSA?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.60,473,1549929600"; d="scan'208,217";a="560146565" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 15 May 2019 16:46:37 +0000 Received: from XCH-ALN-016.cisco.com (xch-aln-016.cisco.com [173.36.7.26]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id x4FGkbP5014576 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 15 May 2019 16:46:37 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-ALN-016.cisco.com (173.36.7.26) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 15 May 2019 11:46:36 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 15 May 2019 11:46:35 -0500 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 15 May 2019 11:46:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=igqotUYhp3T5r3ujLzQfU68uqIQF9BTt8QbpCwSDu2w=; b=vm/fsEEado9gR6NdRW64H8lrW90BkCrYNfFcaN/bhFeC/nuYhl3JcuqUKmfaP6Q7URpCtNiimQSB5CYv7OBd16qQivqKMbGFp8PoMP7ecO+rLH1WUs69bxw1cB9YBWeixEbQmeNTnVqaFIM3KtYWjfE5sjKtwgWOuXWNSFaFosM= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1743.namprd11.prod.outlook.com (10.175.52.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Wed, 15 May 2019 16:46:34 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1900.010; Wed, 15 May 2019 16:46:34 +0000 From: "Panos Kampanakis (pkampana)" To: Hannes Tschofenig , Esko Dijk , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AAamrQAAAw3WYAACv9EMAAPxWTgACLZPZAAoLfO4AABXdqQACx6ioA= Date: Wed, 15 May 2019 16:46:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [173.38.117.90] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ce6f7015-9c6a-4915-97dc-08d6d954e3d2 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1743; x-ms-traffictypediagnostic: MWHPR11MB1743: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0038DE95A2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(39860400002)(136003)(396003)(366004)(15404003)(189003)(199004)(40434004)(76176011)(486006)(7696005)(236005)(316002)(25786009)(446003)(5024004)(14444005)(102836004)(476003)(33656002)(54896002)(8936002)(256004)(11346002)(7736002)(6306002)(66066001)(81156014)(81166006)(8676002)(71190400001)(110136005)(71200400001)(26005)(6506007)(53546011)(790700001)(186003)(76116006)(73956011)(478600001)(55016002)(53936002)(86362001)(14454004)(6436002)(229853002)(5660300002)(2501003)(2906002)(52536014)(99286004)(9686003)(6116002)(3846002)(68736007)(6246003)(606006)(66556008)(66446008)(64756008)(66476007)(74316002)(66946007); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1743; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: VvAS6pBka611eTDEGADmAe4CWcFEWk7T98pB1O0Qnmo717BP3Vtd1VXT291D0Si2pIEfXcDXM82sJnKB6/3dQBMQwOHMRmDkFsParui/+fBA+0WOSnBSXq/WL8GOR59dg2Ir5TU2Q4RWEPoNTeWDSi4I+Gr5Beezd2iXHY7fgbrIUdHuOxH06LSIkUOP7mfba/x+W471JoyVECJeLyU1XLpBBMFXYSeK6kJtEj5nKoqXtIRJd9EUsSc3DtwsJmGH/hDC+hzD0H3d8YzUfOy3vmMJoPwIl5XvnbjK/w3BZ8owr9YY7qja3g090izNZIBrvVykTktvoBh6VQ7rArRSbOBekKz3xYbJLX1v56IZSnQGLbzzCOfFbS/mtTXJRKXzWYEQLLvODqaZzRXGv3ucOtv2YJOcjH9djZi0qkQZn1I= Content-Type: multipart/alternative; boundary="_000_MWHPR11MB18381E4C7F7D6F95233B57D5C9090MWHPR11MB1838namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: ce6f7015-9c6a-4915-97dc-08d6d954e3d2 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 May 2019 16:46:34.0552 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1743 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.26, xch-aln-016.cisco.com X-Outbound-Node: rcdn-core-6.cisco.com Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 May 2019 16:46:43 -0000 --_000_MWHPR11MB18381E4C7F7D6F95233B57D5C9090MWHPR11MB1838namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWdyZWVkIEhhbm5lcyBhbmQgRXNrby4NCg0KRm9yIGNvbXBsZXRlbmVzcywgaGVyZSBpcyBob3cg dGhlIHVwZGF0ZWQgdGV4dCBsb29rcyBsaWtlLiBJdCBzaG91bGQgY292ZXIgd2hhdCB3ZSBkaXNj dXNzZWQgaW4gdGhpcyB0aHJlYWQuDQoNCn5+fn5+fn5+fg0KNS44LiBTZXJ2ZXItc2lkZSBLZXkg R2VuZXJhdGlvbg0KDQpJbiBzY2VuYXJpb3Mgd2hlcmUgaXQgaXMgZGVzaXJhYmxlIHRoYXQgdGhl IHNlcnZlciBnZW5lcmF0ZXMgdGhlIHByaXZhdGUga2V5LCBzZXJ2ZXItc2lkZSBrZXkgZ2VuZXJh dGlvbiBzaG91bGQgYmUgdXNlZC4gU3VjaCBzY2VuYXJpb3MgY291bGQgYmUgd2hlbiBpdCBpcyBj b25zaWRlcmVkIG1vcmUgc2VjdXJlIHRvIGdlbmVyYXRlIGF0IHRoZSBzZXJ2ZXIgdGhlIGxvbmct bGl2ZWQgcmFuZG9tIHByaXZhdGUga2V5IHRoYXQgaWRlbnRpZmllcyB0aGUgY2xpZW50LCBvciB3 aGVuIHRoZSByZXNvdXJjZXMgc3BlbnQgdG8gZ2VuZXJhdGUgYSByYW5kb20gcHJpdmF0ZSBrZXkg YXQgdGhlIGNsaWVudCBhcmUgY29uc2lkZXJlZCBzY2FyY2UsIG9yIHdoZW4gdGhlIHNlY3VyaXR5 IHBvbGljeSByZXF1aXJlcyB0aGF0IHRoZSBjZXJ0aWZpY2F0ZSBwdWJsaWMgYW5kIGNvcnJlc3Bv bmRpbmcgcHJpdmF0ZSBrZXkgYXJlIGNlbnRyYWxseSBnZW5lcmF0ZWQgYW5kIGNvbnRyb2xsZWQu IE9mIGNvdXJzZSwgdGhhdCBkb2VzIG5vdCBlbGltaW5hdGUgdGhlIG5lZWQgZm9yIHByb3BlciBy YW5kb20gbnVtYmVycyBmb3IgdmFyaW91cyBwcm90b2NvbHMgbGlrZSAoRClUTFMgKFNlY3Rpb24g MTAuMSkuDQpbIOKApiBdDQoNCjEwLjEuIEVTVCBzZXJ2ZXIgY29uc2lkZXJhdGlvbnMNClsg4oCm IF0NCk1vZGVybiBzZWN1cml0eSBwcm90b2NvbHMgcmVxdWlyZSByYW5kb20gbnVtYmVycyB0byBi ZSBhdmFpbGFibGUgZHVyaW5nIHRoZSBwcm90b2NvbCBydW4sIGZvciBleGFtcGxlIGZvciBub25j ZXMsIGVwaGVtZXJhbCBFQyBEaWZmaWUtSGVsbG1hbiBrZXkgZ2VuZXJhdGlvbi4gVGhpcyBjYXBh YmlsaXR5IHRvIGdlbmVyYXRlIHJhbmRvbSBudW1iZXJzIGlzIGFsc28gbmVlZGVkIHdoZW4gdGhl IGNvbnN0cmFpbmVkIGRldmljZSBnZW5lcmF0ZXMgdGhlIHByaXZhdGUga2V5ICh0aGF0IGNvcnJl c3BvbmRzIHRvIHRoZSBwdWJsaWMga2V5IGVucm9sbGVkIGluIHRoZSBDU1IpLiBXaGVuIHNlcnZl ci1zaWRlIGtleSBnZW5lcmF0aW9uIGlzIHVzZWQsIHRoZSBjb25zdHJhaW5lZCBkZXZpY2UgZGVw ZW5kcyBvbiB0aGUgc2VydmVyIHRvIGdlbmVyYXRlIHRoZSBwcml2YXRlIGtleSByYW5kb21seSwg YnV0IGl0IHN0aWxsIG5lZWRzIGxvY2FsbHkgZ2VuZXJhdGVkIHJhbmRvbSBudW1iZXJzIGZvciB1 c2UgaW4gc2VjdXJpdHkgcHJvdG9jb2xzLCBhcyBleHBsYWluZWQgaW4gU2VjdGlvbiAxMiBvZiBb UkZDNzkyNV0uIEFkZGl0aW9uYWxseSwgdGhlIHRyYW5zcG9ydCBvZiBrZXlzIGdlbmVyYXRlZCBh dCB0aGUgc2VydmVyIGlzIGluaGVyZW50bHkgcmlza3kuIEFuYWx5c2lzIFNIT1VMRCBiZSBkb25l IHRvIGVzdGFibGlzaCB3aGV0aGVyIHNlcnZlci1zaWRlIGtleSBnZW5lcmF0aW9uIGVuaGFuY2Vz IG9yIGRlY3JlYXNlcyB0aGUgcHJvYmFiaWxpdHkgb2YgaWRlbnRpdHkgc3RlYWxpbmcuDQoNCkl0 IGlzIGltcG9ydGFudCB0byBub3RlIHRoYXQgc291cmNlcyBjb250cmlidXRpbmcgdG8gdGhlIHJh bmRvbW5lc3MgcG9vbCB1c2VkIHRvIGdlbmVyYXRlIHJhbmRvbSBudW1iZXJzIG9uIGxhcHRvcHMg b3IgZGVza3RvcCBQQ3MgYXJlIG5vdCBhdmFpbGFibGUgb24gbWFueSBjb25zdHJhaW5lZCBkZXZp Y2VzLCBzdWNoIGFzIG1vdXNlIG1vdmVtZW50LCB0aW1pbmcgb2Yga2V5c3Ryb2tlcywgYWlyIHR1 cmJ1bGVuY2Ugb24gdGhlIG1vdmVtZW50IG9mIGhhcmQgZHJpdmUgaGVhZHMsIGFzIHBvaW50ZWQg b3V0IGluIFtQc1FzXS4gT3RoZXIgc291cmNlcyBoYXZlIHRvIGJlIHVzZWQgb3IgZGVkaWNhdGVk IGhhcmR3YXJlIGhhcyB0byBiZSBhZGRlZC4gU2VsZWN0aW5nIGhhcmR3YXJlIGZvciBhbiBJb1Qg ZGV2aWNlIHRoYXQgaXMgY2FwYWJsZSBvZiBwcm9kdWNpbmcgaGlnaC1xdWFsaXR5IHJhbmRvbSBu dW1iZXJzIGlzIHRoZXJlZm9yZSBpbXBvcnRhbnQuDQpbIOKApiBdDQp+fn5+fn5+fn4NCg0KSSBh bSBwbGFubmluZyB0byByZXVwbG9hZCBieSB0aGUgZW5kIG9mIHRoZSB3ZWVrLg0KDQpSZ3MsDQpQ YW5vcw0KDQoNCkZyb206IEhhbm5lcyBUc2Nob2ZlbmlnIDxIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0u Y29tPg0KU2VudDogVHVlc2RheSwgTWF5IDE0LCAyMDE5IDM6MjggUE0NClRvOiBFc2tvIERpamsg PGVza28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubD47IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5h KSA8cGthbXBhbmFAY2lzY28uY29tPjsgYWNlQGlldGYub3JnDQpTdWJqZWN0OiBSRTogW0FjZV0g RVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzcw0KDQpFc2tvLA0KDQp5b3VyIGxpbmUgb2YgdGhvdWdo dCBtYWtlcyBzZW5zZSB0byBtZS4gSSBsZWF2ZSBpdCB0byBQYW5vcyB0byBlbmhhbmNlIHRoZSB0 ZXh0Lg0KDQpDaWFvDQpIYW5uZXMNCg0KRnJvbTogRXNrbyBEaWprIDxlc2tvLmRpamtAaW90Y29u c3VsdGFuY3kubmw8bWFpbHRvOmVza28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubD4+DQpTZW50OiBE aWVuc3RhZywgMTQuIE1haSAyMDE5IDExOjU3DQpUbzogSGFubmVzIFRzY2hvZmVuaWcgPEhhbm5l cy5Uc2Nob2ZlbmlnQGFybS5jb208bWFpbHRvOkhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20+Pjsg UGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNjby5jb208bWFpbHRvOnBr YW1wYW5hQGNpc2NvLmNvbT4+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1 YmplY3Q6IFJFOiBbQWNlXSBFU1Qgb3ZlciBDb0FQOiBSYW5kb21uZXNzDQoNCkhpIEhhbm5lcywN Cg0KQWdyZWUuIFRoZSBkcmFmdCBpcyBhbHJlYWR5IHJlZmVyZW5jaW5nIFJGQyA3OTI1LCBzbyBp dCBjb3VsZCBhZGRpdGlvbmFsbHkgcmVmZXJlbmNlIFNlY3Rpb24gMTIgKGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM3OTI1I3NlY3Rpb24tMTIpIHdoaWNoIGV4cGxhaW5zIHRoYXQgcmFu ZG9tbmVzcyBpcyBhbHNvIG5lZWRlZCBmb3IgYWxsIERUTFMgaGFuZHNoYWtlcy4gV2hhdCBJIG1l bnRpb24gYWJvdXQg4oCcYmVpbmcgYWJsZSB0byB0cnVzdCB0aGUgcmFuZG9tbmVzcyBsZXZlbOKA nSBpcyB0aGVuIG1heWJlIGEgbW9yZSBwc3ljaG9sb2dpY2FsIHJlcXVpcmVtZW50IHJhdGhlciB0 aGFuIHRlY2huaWNhbC4gQSBwb3dlcmZ1bCBzZXJ2ZXIgd2l0aCBSVEMganVzdCBzb3VuZHMgbW9y ZSBjYXBhYmxlIHRvIGRvIHByaXZhdGUga2V5IGdlbmVyYXRpb24gdGhhbiBhbiBJb1QgZGV2aWNl LCB3aGljaCBpcyB3aHkgc2VydmVyLXNpZGUga2V5Z2VuIG1heSBiZSBwcmVmZXJyZWQgOykNCg0K RXNrbw0KDQpGcm9tOiBIYW5uZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNv bTxtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT4+DQpTZW50OiBUdWVzZGF5LCBNYXkg MTQsIDIwMTkgMTg6NDYNClRvOiBFc2tvIERpamsgPGVza28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5u bDxtYWlsdG86ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPj47IFBhbm9zIEthbXBhbmFraXMg KHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPG1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20+ PjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTogW0FjZV0g RVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzcw0KDQpIaSBFc2tvLA0KDQpnb29kIHRvIGhlYXIgZnJv bSB5b3UuDQoNCg0KICAqICAgQW5vdGhlciByZWFzb24gZm9yIHNlcnZlci1zaWRlIGtleWdlbiBj YW4gYmUgdGhhdCBhbiBJVCBkZXBhcnRtZW50L21hbmFnZXIgd2FudHMgaXQgdGhhdCB3YXkuIFRo ZXJlIGNvdWxkIGJlIGEgcG9saWN5IHRoYXQgdGhlIGtleXBhaXJzIGZvciBhbGwgZG9tYWluIGNl cnRpZmljYXRlcyBtdXN0IGJlIGNyZWF0ZWQgYnkgdGhlIHN5c3RlbXMgdW5kZXIgZGlyZWN0IGNv bnRyb2wgb2YgdGhlIElUIGRlcGFydG1lbnQuIChFLmcuIHRvIGNvbXBseSB3aXRoIG90aGVyIHBv bGljaWVzIG9yIHRvIGJlIGFibGUgdG8gdHJ1c3QgdGhlIHJhbmRvbW5lc3MgbGV2ZWwuIE9yIGp1 c3QgYmVjYXVzZSB0aGF0IHdhcyB0aGUgd2F5IGl0IGFsd2F5cyBoYXMgYmVlbiB3aGVuIFBDcyB3 ZXJlIHByb3Zpc2lvbmVkIHdpdGggY2VydGlmaWNhdGVzLikgIFRoaXMgY291bGQgYmUgbGlzdGVk IGFzIGFuIGFkZGl0aW9uYWwgcmVhc29uLg0KDQpGb3IgcmVhZGVycyBpbnRlcmVzdGVkIGluIG1h a2luZyBpbmZvcm1lZCBkZWNpc2lvbnMgSSBiZWxpZXZlIGl0IGlzIHdvcnRod2hpbGUgdG8gcG9p bnQgb3V0IHRoYXQgdGhleSBuZWVkIHJhbmRvbSBudW1iZXIgZ2VuZXJhdGlvbiBjYXBhYmlsaXRp ZXMgb24gSW9UIGRldmljZXMg4oCTIG5vdCBqdXN0IGZvciB0aGUgcHJpdmF0ZSBrZXkgZ2VuZXJh dGlvbiBpbiBjb250ZXh0IG9mIHRoZSBFU1QgZXhjaGFuZ2UuIEkgZmVhciB0aGF0IHNvbWUgcGVv cGxlLCBpbmNsdWRpbmcgSVQgbWFuYWdlcnMsIGp1c3QgZ2xhbmNlIG92ZXIgdGhlIGRldGFpbHMg YW5kIGZvY3VzIG9uIGlzb2xhdGVkIGFzcGVjdHMuIEkgYW0gc3VyZSB5b3UgYWdyZWUgd2l0aCBt ZSB0aGF0IHRoaXMgd291bGQgYmUgYSB0b28gc2ltcGxpc3RpYyB2aWV3Lg0KDQpDaWFvDQpIYW5u ZXMNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFu eSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2Vk LiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRo ZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8g YW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29w eSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KSU1QT1JUQU5UIE5P VElDRTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUg Y29uZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0 aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRl bHkgYW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwg dXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24g aW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K --_000_MWHPR11MB18381E4C7F7D6F95233B57D5C9090MWHPR11MB1838namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFn cmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1h cmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJ bWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZW1haWxxdW90ZSwg bGkuZW1haWxxdW90ZSwgZGl2LmVtYWlscXVvdGUNCgl7bXNvLXN0eWxlLW5hbWU6ZW1haWxxdW90 ZTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjEuMHB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIyDQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9y OndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4 dDt9DQpzcGFuLkVtYWlsU3R5bGUyNQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEOw0KCWZv bnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246 bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0 IGwwDQoJe21zby1saXN0LWlkOjM5ODkzODU5MzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTUz MTQ4NzM2ODt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjg1MDA5OTgxODsNCglt c28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTEwMTA2Njk5MzIg LTE0NjQ3MjAxNDggMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgw NzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7 bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpEZW5nWGlhbjsNCgltc28t YmlkaS1mb250LWZhbWlseTpDYWxpYnJpO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwz DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBs aXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206 MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+QWdyZWVkIEhhbm5lcyBhbmQgRXNrby4gPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5Gb3IgY29tcGxldGVuZXNzLCBoZXJl IGlzIGhvdyB0aGUgdXBkYXRlZCB0ZXh0IGxvb2tzIGxpa2UuIEl0IHNob3VsZCBjb3ZlciB3aGF0 IHdlIGRpc2N1c3NlZCBpbiB0aGlzIHRocmVhZC4gJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMUY0OTdEIj5+fn5+fn5+fn48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48aT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+NS44LiBTZXJ2ZXIt c2lkZSBLZXkgR2VuZXJhdGlvbjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48aT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9pPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxpPjxzcGFuIHN0eWxlPSJj b2xvcjojMUY0OTdEIj5JbiBzY2VuYXJpb3Mgd2hlcmUgaXQgaXMgZGVzaXJhYmxlIHRoYXQgdGhl IHNlcnZlciBnZW5lcmF0ZXMgdGhlIHByaXZhdGUga2V5LCBzZXJ2ZXItc2lkZSBrZXkgZ2VuZXJh dGlvbiBzaG91bGQgYmUgdXNlZC4gU3VjaCBzY2VuYXJpb3MgY291bGQgYmUgd2hlbiBpdCBpcyBj b25zaWRlcmVkIG1vcmUgc2VjdXJlIHRvIGdlbmVyYXRlIGF0IHRoZSBzZXJ2ZXINCiB0aGUgbG9u Zy1saXZlZCByYW5kb20gcHJpdmF0ZSBrZXkgdGhhdCBpZGVudGlmaWVzIHRoZSBjbGllbnQsIG9y IHdoZW4gdGhlIHJlc291cmNlcyBzcGVudCB0byBnZW5lcmF0ZSBhIHJhbmRvbSBwcml2YXRlIGtl eSBhdCB0aGUgY2xpZW50IGFyZSBjb25zaWRlcmVkIHNjYXJjZSwgb3Igd2hlbiB0aGUgc2VjdXJp dHkgcG9saWN5IHJlcXVpcmVzIHRoYXQgdGhlIGNlcnRpZmljYXRlIHB1YmxpYyBhbmQgY29ycmVz cG9uZGluZyBwcml2YXRlIGtleSBhcmUNCiBjZW50cmFsbHkgZ2VuZXJhdGVkIGFuZCBjb250cm9s bGVkLiBPZiBjb3Vyc2UsIHRoYXQgZG9lcyBub3QgZWxpbWluYXRlIHRoZSBuZWVkIGZvciBwcm9w ZXIgcmFuZG9tIG51bWJlcnMgZm9yIHZhcmlvdXMgcHJvdG9jb2xzIGxpa2UgKEQpVExTIChTZWN0 aW9uIDEwLjEpLjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48aT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+WyDigKYgXSA8bzpwPjwvbzpwPjwvc3Bh bj48L2k+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxp PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4xMC4xLiBFU1Qgc2VydmVyIGNvbnNpZGVyYXRp b25zPG86cD48L286cD48L3NwYW4+PC9pPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxpPjxz cGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5bIOKApiBdIDxvOnA+PC9vOnA+PC9zcGFuPjwvaT48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48aT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ TW9kZXJuIHNlY3VyaXR5IHByb3RvY29scyByZXF1aXJlIHJhbmRvbSBudW1iZXJzIHRvIGJlIGF2 YWlsYWJsZSBkdXJpbmcgdGhlIHByb3RvY29sIHJ1biwgZm9yIGV4YW1wbGUgZm9yIG5vbmNlcywg ZXBoZW1lcmFsIEVDIERpZmZpZS1IZWxsbWFuIGtleSBnZW5lcmF0aW9uLiBUaGlzIGNhcGFiaWxp dHkgdG8gZ2VuZXJhdGUgcmFuZG9tIG51bWJlcnMgaXMgYWxzbw0KIG5lZWRlZCB3aGVuIHRoZSBj b25zdHJhaW5lZCBkZXZpY2UgZ2VuZXJhdGVzIHRoZSBwcml2YXRlIGtleSAodGhhdCBjb3JyZXNw b25kcyB0byB0aGUgcHVibGljIGtleSBlbnJvbGxlZCBpbiB0aGUgQ1NSKS4gV2hlbiBzZXJ2ZXIt c2lkZSBrZXkgZ2VuZXJhdGlvbiBpcyB1c2VkLCB0aGUgY29uc3RyYWluZWQgZGV2aWNlIGRlcGVu ZHMgb24gdGhlIHNlcnZlciB0byBnZW5lcmF0ZSB0aGUgcHJpdmF0ZSBrZXkgcmFuZG9tbHksIGJ1 dCBpdCBzdGlsbA0KIG5lZWRzIGxvY2FsbHkgZ2VuZXJhdGVkIHJhbmRvbSBudW1iZXJzIGZvciB1 c2UgaW4gc2VjdXJpdHkgcHJvdG9jb2xzLCBhcyBleHBsYWluZWQgaW4gU2VjdGlvbiAxMiBvZiBb UkZDNzkyNV0uIEFkZGl0aW9uYWxseSwgdGhlIHRyYW5zcG9ydCBvZiBrZXlzIGdlbmVyYXRlZCBh dCB0aGUgc2VydmVyIGlzIGluaGVyZW50bHkgcmlza3kuIEFuYWx5c2lzIFNIT1VMRCBiZSBkb25l IHRvIGVzdGFibGlzaCB3aGV0aGVyIHNlcnZlci1zaWRlIGtleSBnZW5lcmF0aW9uDQogZW5oYW5j ZXMgb3IgZGVjcmVhc2VzIHRoZSBwcm9iYWJpbGl0eSBvZiBpZGVudGl0eSBzdGVhbGluZy48bzpw PjwvbzpwPjwvc3Bhbj48L2k+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGk+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48aT48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SXQgaXMgaW1w b3J0YW50IHRvIG5vdGUgdGhhdCBzb3VyY2VzIGNvbnRyaWJ1dGluZyB0byB0aGUgcmFuZG9tbmVz cyBwb29sIHVzZWQgdG8gZ2VuZXJhdGUgcmFuZG9tIG51bWJlcnMgb24gbGFwdG9wcyBvciBkZXNr dG9wIFBDcyBhcmUgbm90IGF2YWlsYWJsZSBvbiBtYW55IGNvbnN0cmFpbmVkIGRldmljZXMsIHN1 Y2ggYXMgbW91c2UgbW92ZW1lbnQsIHRpbWluZw0KIG9mIGtleXN0cm9rZXMsIGFpciB0dXJidWxl bmNlIG9uIHRoZSBtb3ZlbWVudCBvZiBoYXJkIGRyaXZlIGhlYWRzLCBhcyBwb2ludGVkIG91dCBp biBbUHNRc10uIE90aGVyIHNvdXJjZXMgaGF2ZSB0byBiZSB1c2VkIG9yIGRlZGljYXRlZCBoYXJk d2FyZSBoYXMgdG8gYmUgYWRkZWQuIFNlbGVjdGluZyBoYXJkd2FyZSBmb3IgYW4gSW9UIGRldmlj ZSB0aGF0IGlzIGNhcGFibGUgb2YgcHJvZHVjaW5nIGhpZ2gtcXVhbGl0eSByYW5kb20gbnVtYmVy cw0KIGlzIHRoZXJlZm9yZSBpbXBvcnRhbnQuPG86cD48L286cD48L3NwYW4+PC9pPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxpPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5bIOKApiBd IDxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+fn5+fn5+fn5+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMUY0OTdEIj5JIGFtIHBsYW5uaW5nIHRvIHJldXBsb2FkIGJ5IHRoZSBlbmQgb2YgdGhlIHdl ZWsuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlJncyw8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+UGFub3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gSGFubmVzIFRzY2hvZmVuaWcgJmx0O0hh bm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20mZ3Q7IDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBN YXkgMTQsIDIwMTkgMzoyOCBQTTxicj4NCjxiPlRvOjwvYj4gRXNrbyBEaWprICZsdDtlc2tvLmRp amtAaW90Y29uc3VsdGFuY3kubmwmZ3Q7OyBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgJmx0 O3BrYW1wYW5hQGNpc2NvLmNvbSZndDs7IGFjZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9i PiBSRTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzczxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkVza28sIDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiI+eW91ciBsaW5lIG9mIHRob3VnaHQgbWFrZXMgc2Vuc2UgdG8gbWUuIEkgbGVhdmUg aXQgdG8gUGFub3MgdG8gZW5oYW5jZSB0aGUgdGV4dC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Q2lh bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIj5IYW5uZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IGxhbmc9IkRFIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iREUiPiBFc2tvIERpamsgJmx0 OzxhIGhyZWY9Im1haWx0bzplc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmwiPmVza28uZGlqa0Bp b3Rjb25zdWx0YW5jeS5ubDwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRGllbnN0YWcsIDE0 LiA8L3NwYW4+TWFpIDIwMTkgMTE6NTc8YnI+DQo8Yj5Ubzo8L2I+IEhhbm5lcyBUc2Nob2Zlbmln ICZsdDs8YSBocmVmPSJtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbSI+SGFubmVzLlRz Y2hvZmVuaWdAYXJtLmNvbTwvYT4mZ3Q7OyBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgJmx0 OzxhIGhyZWY9Im1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20iPnBrYW1wYW5hQGNpc2NvLmNvbTwv YT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxi cj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzczxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IaSBIYW5uZXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlLiBUaGUgZHJh ZnQgaXMgYWxyZWFkeSByZWZlcmVuY2luZyBSRkMgNzkyNSwgc28gaXQgY291bGQgYWRkaXRpb25h bGx5IHJlZmVyZW5jZSBTZWN0aW9uIDEyICg8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNzkyNSNzZWN0aW9uLTEyIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZj NzkyNSNzZWN0aW9uLTEyPC9hPikgd2hpY2ggZXhwbGFpbnMgdGhhdCByYW5kb21uZXNzDQogaXMg YWxzbyBuZWVkZWQgZm9yIGFsbCBEVExTIGhhbmRzaGFrZXMuIFdoYXQgSSBtZW50aW9uIGFib3V0 IOKAnGJlaW5nIGFibGUgdG8gdHJ1c3QgdGhlIHJhbmRvbW5lc3MgbGV2ZWzigJ0gaXMgdGhlbiBt YXliZSBhIG1vcmUgcHN5Y2hvbG9naWNhbCByZXF1aXJlbWVudCByYXRoZXIgdGhhbiB0ZWNobmlj YWwuIEEgcG93ZXJmdWwgc2VydmVyIHdpdGggUlRDIGp1c3Qgc291bmRzIG1vcmUgY2FwYWJsZSB0 byBkbyBwcml2YXRlIGtleSBnZW5lcmF0aW9uIHRoYW4NCiBhbiBJb1QgZGV2aWNlLCB3aGljaCBp cyB3aHkgc2VydmVyLXNpZGUga2V5Z2VuIG1heSBiZSBwcmVmZXJyZWQgOyk8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+RXNrbzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IEhhbm5lcyBUc2Nob2ZlbmlnICZsdDs8YSBo cmVmPSJtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbSI+SGFubmVzLlRzY2hvZmVuaWdA YXJtLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2RheSwgTWF5IDE0LCAyMDE5 IDE4OjQ2PGJyPg0KPGI+VG86PC9iPiBFc2tvIERpamsgJmx0OzxhIGhyZWY9Im1haWx0bzplc2tv LmRpamtAaW90Y29uc3VsdGFuY3kubmwiPmVza28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubDwvYT4m Z3Q7OyBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgJmx0OzxhIGhyZWY9Im1haWx0bzpwa2Ft cGFuYUBjaXNjby5jb20iPnBrYW1wYW5hQGNpc2NvLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFp bHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBS RTogW0FjZV0gRVNUIG92ZXIgQ29BUDogUmFuZG9tbmVzczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkhpIEVza28sIDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiI+Z29vZCB0byBoZWFyIGZyb20geW91LiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgdHlwZT0iZGlzYyI+DQo8bGkg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6 bDEgbGV2ZWwxIGxmbzMiPkFub3RoZXIgcmVhc29uIGZvciBzZXJ2ZXItc2lkZSBrZXlnZW4gY2Fu IGJlIHRoYXQgYW4gSVQgZGVwYXJ0bWVudC9tYW5hZ2VyIHdhbnRzIGl0IHRoYXQgd2F5LiBUaGVy ZSBjb3VsZCBiZSBhIHBvbGljeSB0aGF0IHRoZSBrZXlwYWlycyBmb3IgYWxsIGRvbWFpbiBjZXJ0 aWZpY2F0ZXMgbXVzdCBiZSBjcmVhdGVkDQogYnkgdGhlIHN5c3RlbXMgdW5kZXIgZGlyZWN0IGNv bnRyb2wgb2YgdGhlIElUIGRlcGFydG1lbnQuIChFLmcuIHRvIGNvbXBseSB3aXRoIG90aGVyIHBv bGljaWVzIG9yIHRvIGJlIGFibGUgdG8gdHJ1c3QgdGhlIHJhbmRvbW5lc3MgbGV2ZWwuIE9yIGp1 c3QgYmVjYXVzZSB0aGF0IHdhcyB0aGUgd2F5IGl0IGFsd2F5cyBoYXMgYmVlbiB3aGVuIFBDcyB3 ZXJlIHByb3Zpc2lvbmVkIHdpdGggY2VydGlmaWNhdGVzLikmbmJzcDsgVGhpcyBjb3VsZCBiZSBs aXN0ZWQNCiBhcyBhbiBhZGRpdGlvbmFsIHJlYXNvbi48bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Rm9yIHJlYWRlcnMgaW50ZXJlc3RlZCBpbiBtYWtpbmcgaW5mb3JtZWQgZGVjaXNpb25z IEkgYmVsaWV2ZSBpdCBpcyB3b3J0aHdoaWxlIHRvIHBvaW50IG91dCB0aGF0IHRoZXkgbmVlZCBy YW5kb20gbnVtYmVyIGdlbmVyYXRpb24gY2FwYWJpbGl0aWVzIG9uIElvVCBkZXZpY2VzIOKAkyBu b3QganVzdCBmb3IgdGhlIHByaXZhdGUga2V5IGdlbmVyYXRpb24gaW4gY29udGV4dCBvZiB0aGUg RVNUIGV4Y2hhbmdlLiBJDQogZmVhciB0aGF0IHNvbWUgcGVvcGxlLCBpbmNsdWRpbmcgSVQgbWFu YWdlcnMsIGp1c3QgZ2xhbmNlIG92ZXIgdGhlIGRldGFpbHMgYW5kIGZvY3VzIG9uIGlzb2xhdGVk IGFzcGVjdHMuIEkgYW0gc3VyZSB5b3UgYWdyZWUgd2l0aCBtZSB0aGF0IHRoaXMgd291bGQgYmUg YSB0b28gc2ltcGxpc3RpYyB2aWV3LiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkNpYW88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhhbm5lczxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5JTVBPUlRBTlQg Tk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFy ZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90 IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlh dGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cw0KIHRvIGFueSBvdGhlciBwZXJz b24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0 aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5JTVBPUlRBTlQgTk9USUNFOiBU aGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRl bnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRl bmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQg ZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cw0KIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBp dCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFu eSBtZWRpdW0uIFRoYW5rIHlvdS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_MWHPR11MB18381E4C7F7D6F95233B57D5C9090MWHPR11MB1838namp_-- From nobody Thu May 16 02:28:06 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72F9E120192; Thu, 16 May 2019 02:28:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OBI3nfsDgNtP; Thu, 16 May 2019 02:28:01 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150118.outbound.protection.outlook.com [40.107.15.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 778C31200F6; Thu, 16 May 2019 02:28:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancy-nl; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xeoPd8nvi/UyuTTMymfeQXw+3ieYI9CDn7lvdymr1fM=; b=B7/YNEytummWQIDolChz2058eJhBPXSbxgww6hKmuaIuoxdlAGgw87cjnj3qXsm1vwvGCmKHShlkG44qMmXaGBI+UVh/rgXxvPH01Uey6HJ0UEdO6KAxlJkes5jhBQGaovDzvGbLw4N9odAqnmh2PXC5sErNK/nLcVP8BWozglk= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0438.EURP190.PROD.OUTLOOK.COM (10.175.241.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1878.22; Thu, 16 May 2019 09:27:57 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20%8]) with mapi id 15.20.1878.024; Thu, 16 May 2019 09:27:57 +0000 From: Esko Dijk To: "ace@ietf.org" , "draft-ietf-ace-coap-est@ietf.org" Thread-Topic: Use of /crt vs /crts in draft-ietf-ace-coap-est Thread-Index: AdULyUVDHrMZ/hgzRrmoVKEKwnTIhg== Date: Thu, 16 May 2019 09:27:57 +0000 Message-ID: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [2001:1c02:3101:4800:116c:4c63:f4fa:b1bf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4161f1f3-9c6a-4dea-4036-08d6d9e0c830 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6P190MB0438; x-ms-traffictypediagnostic: DB6P190MB0438: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-forefront-prvs: 0039C6E5C5 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(376002)(346002)(39830400003)(396003)(136003)(189003)(199004)(2501003)(44832011)(8676002)(86362001)(7696005)(74482002)(74316002)(7736002)(71190400001)(71200400001)(53936002)(99286004)(52536014)(256004)(6436002)(186003)(316002)(102836004)(5660300002)(486006)(476003)(6506007)(33656002)(14454004)(413944005)(46003)(8936002)(66476007)(66446008)(64756008)(66556008)(76116006)(66946007)(73956011)(55016002)(25786009)(508600001)(236005)(54896002)(6306002)(9686003)(81166006)(81156014)(2906002)(110136005)(450100002)(790700001)(68736007)(558084003)(6116002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0438; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: kqTi2hB1/uBAaLQR+5WuyGYVLvcei0tx+9K/8+J/8c9WB//RpUqJYG1WQYZ9JgDWAq3yMvb59ZUacAA/+KpobMixYt2YpN182EH23d39V+HsDBRJqMYBkxJxOAZVPZAOp620W+lnBZZk13e5+eO08ljhd05sh9XAPoVU7Qd/l45MTO9+DwhCH4pAY5+YfpuV03kMVAnZELEXOfosLT8Z7NYr2IHXKESpcTJSmSMaX5pyb65YYJBmIdcKNT56LgC8R/6yqaz4aJqFYctK8wCV8ZtoaZckpMKZli9MEWFdymKEq8tIHBSGs7jojT3hbvLAP95qTlcoqKB8oqFuhmiXzAkwpubyMhcASdBFX53sbYQvh7/NEPjkosfLSx+Cd0+x8XRJKyb+X5bE+zbI0ZEBgWU56ZyCxtd84vwQPO+BNak= Content-Type: multipart/alternative; boundary="_000_DB6P190MB00545053A023C1E9632E5D28FD0A0DB6P190MB0054EURP_" MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: 4161f1f3-9c6a-4dea-4036-08d6d9e0c830 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 May 2019 09:27:57.1268 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0438 Archived-At: Subject: [Ace] Use of /crt vs /crts in draft-ietf-ace-coap-est X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 09:28:04 -0000 --_000_DB6P190MB00545053A023C1E9632E5D28FD0A0DB6P190MB0054EURP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RGVhciBhdXRob3JzLA0KDQpJbiB0aGUgZHJhZnQgYm90aCB0aGUgcGF0aHMgL2NydCBhbmQgL2Ny dHMgYXJlIHVzZWQg4oCTIHRoaXMgYXBwZWFycyB0byBiZSBpbmNvcnJlY3QuIFNob3VsZCBpdCAv Y3J0cyAgYWx3YXlzID8NCg0KQmVzdCByZWdhcmRzDQpFc2tvDQoNCkVza28gRGlqayBJb1QgQ29u c3VsdGFuY3kgfCAgRW1haWwvU2t5cGU6IGVza28uZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubDxtYWls dG86ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPg0KDQo= --_000_DB6P190MB00545053A023C1E9632E5D28FD0A0DB6P190MB0054EURP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46 MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVk ZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0t PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0K PG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+ PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIg dmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkRlYXIgYXV0aG9ycyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhlIGRy YWZ0IGJvdGggdGhlIHBhdGhzIC9jcnQgYW5kIC9jcnRzIGFyZSB1c2VkIOKAkyB0aGlzIGFwcGVh cnMgdG8gYmUgaW5jb3JyZWN0LiBTaG91bGQgaXQgL2NydHMgJm5ic3A7YWx3YXlzID88bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+QmVzdCByZWdhcmRzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5Fc2tvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+RXNrbyBEaWprIElvVCBDb25zdWx0YW5jeTwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4gfCZuYnNwOyBF bWFpbC9Ta3lwZToNCjxhIGhyZWY9Im1haWx0bzplc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2M0MxIj5lc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmw8 L3NwYW4+PC9hPiZuYnNwOyZuYnNwOyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJlbi1OTCI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DB6P190MB00545053A023C1E9632E5D28FD0A0DB6P190MB0054EURP_-- From nobody Thu May 16 07:32:44 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FBDC120026 for ; Thu, 16 May 2019 07:32:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=EU31VqIz; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=EpQ7k6UI Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x1UeeAJlIGNK for ; Thu, 16 May 2019 07:32:41 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3191E120098 for ; Thu, 16 May 2019 07:32:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6234; q=dns/txt; s=iport; t=1558017161; x=1559226761; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=vUNRKGNBsSxWsRmOZXZDSAah4hf+XDc0UNTbhWcMTuo=; b=EU31VqIzz5ZUZ/csEk1YGpMiCTuTjvQgCqjgUJ/U67j5PVkJHlOl35X3 +WhKmfAbOhFEpaFaR8F+9MO2dCEJBmWVHXS4XOY78HRQjl3vMQZ9+Fw5Q NdhANLkelHr2lOTL3ohC9P3UGzbZAw1reeYaurKQ8gjUKGfcwx6fDEkCw s=; IronPort-PHdr: =?us-ascii?q?9a23=3AH7p6CxbgCZCx10OECfpWk53/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gabRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavybCU/BM1EXXdu/mqwNg5eH8OtL1A=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BIAACTc91c/4YNJK1kHAEBAQQBAQc?= =?us-ascii?q?EAQGBUQcBAQsBgQ4vUANpVSAECygKhAeDRwOEUooiSoINkliETYEuFIEQA1Q?= =?us-ascii?q?JAQEBDAEBLQIBAYRAAheCFyM0CQ4BAwEBBAEBAgEEbRwMhUoBAQEEEhEKEwE?= =?us-ascii?q?BOA8CAQgRBAEBKAMCAgIwFAkIAQEEARIIGoMBgR1NAx0BoEsCgTWIX3GBL4J?= =?us-ascii?q?5AQEFhQAYgg8JgTMBi04XgUA/gVeCTD6EDAUBEgEhNIJUMoImjWCEU5UqCQK?= =?us-ascii?q?CCZJ5lW6MNJUKAgQCBAUCDgEBBYFPOGZxcBWDJ4IPg2+KU3KBKY0DgSIBgSA?= =?us-ascii?q?BAQ?= X-IronPort-AV: E=Sophos;i="5.60,477,1549929600"; d="scan'208,217";a="271458905" Received: from alln-core-12.cisco.com ([173.36.13.134]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 16 May 2019 14:32:39 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by alln-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id x4GEWdRN010147 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 16 May 2019 14:32:39 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 16 May 2019 09:32:38 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 16 May 2019 09:32:38 -0500 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 16 May 2019 10:32:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vUNRKGNBsSxWsRmOZXZDSAah4hf+XDc0UNTbhWcMTuo=; b=EpQ7k6UIjupcZYCTb2Fv20uXl/+5m5wrBmCJqjHSAFRdoOsYPKskIzUzTtBncbN759/bPxttizi10cOmEHtpRkj7KhuS5PePdaaC4JFzWk+mVFWg9OCawlqIT3f1cW0JWStf2c6i4S2exYgrZjwz4Zyy7kwauyjhlNxgOZ5czYg= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1919.namprd11.prod.outlook.com (10.175.54.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Thu, 16 May 2019 14:32:36 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1900.010; Thu, 16 May 2019 14:32:36 +0000 From: "Panos Kampanakis (pkampana)" To: Esko Dijk , "ace@ietf.org" Thread-Topic: Use of /crt vs /crts in draft-ietf-ace-coap-est Thread-Index: AdULyUVDHrMZ/hgzRrmoVKEKwnTIhgAKn7aQ Date: Thu, 16 May 2019 14:32:36 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [173.38.117.94] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 10f5ec26-2718-412b-a927-08d6da0b577b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1919; x-ms-traffictypediagnostic: MWHPR11MB1919: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-forefront-prvs: 0039C6E5C5 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(136003)(376002)(396003)(39860400002)(199004)(189003)(229853002)(71190400001)(4744005)(2906002)(11346002)(64756008)(52536014)(3846002)(6116002)(790700001)(6436002)(186003)(486006)(53546011)(99286004)(6506007)(66476007)(55016002)(446003)(71200400001)(86362001)(5660300002)(102836004)(476003)(66556008)(66446008)(26005)(66946007)(73956011)(76116006)(76176011)(25786009)(7696005)(110136005)(14454004)(6246003)(478600001)(66066001)(256004)(2501003)(316002)(74316002)(8676002)(53936002)(9686003)(6306002)(54896002)(236005)(8936002)(81166006)(81156014)(68736007)(33656002)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1919; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Tnn+Djoux6nvmQMNEglizHLi2gF2YEEsiMHW9J7DjFG4VD1+EH3DMjaix3YjT50Zip2/xLxPbL68kU+8Gcj6Jvr4plCIT8MzjED7i659LdjeU/MG9mqIwkUllUcsVMiXCkWaNZCVehWhnxNhcfpqIfGEs0SXtGZlv/5tjN/HdVIdUyFzMLXsUqjeN9tiLcLTX3plWznQZoDRIYcjX1odbWc6VeKLGJdeyWaIuia3uXtGT9faBV16plDPD9ehhp9dz+UmTPWE+ES7UqeNPykqLw5NqIVmknEmhIV8HqhcF2RFeBygnesthLNnjFNfIJB9DB027EJf+ceDdADHd11pK2kDMOS5UaEpCSkR1LDj+ho3YNyY2WylAnECBXsS3AUfKYdtXqH7kZkfz88IXLbE886KvVwrbM3ZsGZPiNn/Fmo= Content-Type: multipart/alternative; boundary="_000_MWHPR11MB18386C234C68BED90B08385FC90A0MWHPR11MB1838namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 10f5ec26-2718-412b-a927-08d6da0b577b X-MS-Exchange-CrossTenant-originalarrivaltime: 16 May 2019 14:32:36.5260 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1919 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: alln-core-12.cisco.com Archived-At: Subject: Re: [Ace] Use of /crt vs /crts in draft-ietf-ace-coap-est X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 May 2019 14:32:43 -0000 --_000_MWHPR11MB18386C234C68BED90B08385FC90A0MWHPR11MB1838namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 R29vZCBjYXRjaCBFc2tvLiBUaGFua3MuDQpXZSBoYWQgdGhyZWUgbGVmdG92ZXIg4oCcL2NydOKA nSB0aGF0IHNob3VsZCBoYXZlIGJlZW4g4oCcL2NydHPigJ0uIFdpbGwgYmUgZml4ZWQgaW4gdGhl IGl0ZXJhdGlvbiB0byBiZSBzdWJtaXR0ZWQgdG9tb3Jyb3cuDQoNCg0KRnJvbTogQWNlIDxhY2Ut Ym91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEVza28gRGlqaw0KU2VudDogVGh1cnNkYXks IE1heSAxNiwgMjAxOSA1OjI4IEFNDQpUbzogYWNlQGlldGYub3JnOyBkcmFmdC1pZXRmLWFjZS1j b2FwLWVzdEBpZXRmLm9yZw0KU3ViamVjdDogW0FjZV0gVXNlIG9mIC9jcnQgdnMgL2NydHMgaW4g ZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QNCg0KRGVhciBhdXRob3JzLA0KDQpJbiB0aGUgZHJhZnQg Ym90aCB0aGUgcGF0aHMgL2NydCBhbmQgL2NydHMgYXJlIHVzZWQg4oCTIHRoaXMgYXBwZWFycyB0 byBiZSBpbmNvcnJlY3QuIFNob3VsZCBpdCAvY3J0cyAgYWx3YXlzID8NCg0KQmVzdCByZWdhcmRz DQpFc2tvDQoNCkVza28gRGlqayBJb1QgQ29uc3VsdGFuY3kgfCAgRW1haWwvU2t5cGU6IGVza28u ZGlqa0Bpb3Rjb25zdWx0YW5jeS5ubDxtYWlsdG86ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5s Pg0KDQo= --_000_MWHPR11MB18386C234C68BED90B08385FC90A0MWHPR11MB1838namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMxRjQ5N0Q7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9y bWFsOw0KCXRleHQtZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVk aXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJl ZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+R29vZCBjYXRjaCBFc2tvLiBUaGFua3MuIDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj5XZSBoYWQgdGhyZWUgbGVmdG92ZXIg4oCcL2NydOKAnSB0aGF0IHNob3VsZCBoYXZlIGJl ZW4g4oCcL2NydHPigJ0uIFdpbGwgYmUgZml4ZWQgaW4gdGhlIGl0ZXJhdGlvbiB0byBiZSBzdWJt aXR0ZWQgdG9tb3Jyb3cuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gQWNlICZsdDthY2UtYm91bmNl c0BpZXRmLm9yZyZndDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NCkVza28gRGlqazxicj4NCjxiPlNl bnQ6PC9iPiBUaHVyc2RheSwgTWF5IDE2LCAyMDE5IDU6MjggQU08YnI+DQo8Yj5Ubzo8L2I+IGFj ZUBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3RAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJq ZWN0OjwvYj4gW0FjZV0gVXNlIG9mIC9jcnQgdnMgL2NydHMgaW4gZHJhZnQtaWV0Zi1hY2UtY29h cC1lc3Q8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRlYXIgYXV0aG9y cyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhlIGRyYWZ0IGJvdGggdGhlIHBhdGhzIC9j cnQgYW5kIC9jcnRzIGFyZSB1c2VkIOKAkyB0aGlzIGFwcGVhcnMgdG8gYmUgaW5jb3JyZWN0LiBT aG91bGQgaXQgL2NydHMgJm5ic3A7YWx3YXlzID88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVz dCByZWdhcmRzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Fc2tvPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1HQiI+RXNrbyBEaWprIElvVCBDb25zdWx0YW5jeTwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4gfCZuYnNwOyBFbWFpbC9Ta3lwZToNCjxhIGhyZWY9 Im1haWx0bzplc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmwiPmVza28uZGlqa0Bpb3Rjb25zdWx0 YW5jeS5ubDwvYT4mbmJzcDsmbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_MWHPR11MB18386C234C68BED90B08385FC90A0MWHPR11MB1838namp_-- From nobody Fri May 17 08:30:49 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7750612008C; Fri, 17 May 2019 08:30:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.96.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <155810704144.26327.4695280572619758639@ietfa.amsl.com> Date: Fri, 17 May 2019 08:30:41 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 May 2019 15:30:42 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : EST over secure CoAP (EST-coaps) Authors : Peter van der Stok Panos Kampanakis Michael C. Richardson Shahid Raza Filename : draft-ietf-ace-coap-est-11.txt Pages : 48 Date : 2019-05-17 Abstract: Enrollment over Secure Transport (EST) is used as a certificate provisioning protocol over HTTPS. Low-resource devices often use the lightweight Constrained Application Protocol (CoAP) for message exchanges. This document defines how to transport EST payloads over secure CoAP (EST-coaps), which allows constrained devices to use existing EST functionality for provisioning certificates. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-coap-est/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-coap-est-11 https://datatracker.ietf.org/doc/html/draft-ietf-ace-coap-est-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-coap-est-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri May 17 08:36:16 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C021D120135 for ; Fri, 17 May 2019 08:36:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=Qagvc9/d; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=NfclOKfO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i8t-c82pEM_4 for ; Fri, 17 May 2019 08:36:10 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1D08120364 for ; Fri, 17 May 2019 08:35:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2447; q=dns/txt; s=iport; t=1558107358; x=1559316958; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=X3QF97QHzselvj/mVMjQl3eOQ7BTTUnHNd/A473ucl0=; b=Qagvc9/dPBefWk2CrFqQ1nxTXjNXq2jqPSDz5pRJ6l76pj4oXfX/PnYh KI7pbXIJxp+TAgtbQLvv2wqF1ySajMCm4BhSBc1Q1XKAB2cTbm0FEYMXF MtymOwUCZNvXkrAXzU78prmxIKZogkfr3GbiXjZSO2/jCow19uFsZbXKr Y=; IronPort-PHdr: =?us-ascii?q?9a23=3ADK3kABO+YMZlxBMZp7wl6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEu6w/l0fHCIPc7f8My/HbtaztQyQh2d6AqzhDFf4ETB?= =?us-ascii?q?oZkYMTlg0kDtSCDBjjL/fvdyU8FexJVURu+DewNk0GUMs=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BKAABe1N5c/4oNJK1kHAEBAQQBAQc?= =?us-ascii?q?EAQGBUQcBAQsBgT1QA2lVIAQLKIdZA4RSiiRKgg2XJ4EugSQDVAkBAQEMAQE?= =?us-ascii?q?YCwoCAQGEQAKCNCM0CQ4BAwEBBAEBAgEEbRwBC4VKAQEBBAEBECgGAQEsDAs?= =?us-ascii?q?EAgEIEQQBAR8QJwsdCAIEEwgagwGBagMdAQ6fIgKBNYhfgiCCeQEBBYE2Ag5?= =?us-ascii?q?BgnwYgg8JgTQBi1AXgUA/gRFGgkw+gmEBAQIBARaBMRiDOoImqBoJAoILhi6?= =?us-ascii?q?MaIIdZ4VujSaMUYElhUSOTgIEAgQFAg4BAQWBTziBV3AVGiGCbAmCBoNvhRS?= =?us-ascii?q?FP3IBgSiOWQEB?= X-IronPort-AV: E=Sophos;i="5.60,480,1549929600"; d="scan'208";a="272834985" Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 17 May 2019 15:35:57 +0000 Received: from XCH-RCD-006.cisco.com (xch-rcd-006.cisco.com [173.37.102.16]) by alln-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id x4HFZvs7004912 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 17 May 2019 15:35:57 GMT Received: from xhs-rcd-003.cisco.com (173.37.227.248) by XCH-RCD-006.cisco.com (173.37.102.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 17 May 2019 10:35:56 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 17 May 2019 10:35:56 -0500 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 17 May 2019 11:35:56 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gaYXv+lzYKiey1RuiCXw5DdVrxN97ud8KJWtE0Lg9xw=; b=NfclOKfOkYKY+gVpfIMeRgCj75TvbR87Tx4pMiZ6EUcevzhxUaxyHxVunP7xJ+A1+NAiRDv6x1RfHmvp0djqFAS7zUfa+yoOd3WmiVQw+2faeXNyExK1aZwNNeMJhez9fNSRcjusdZZeh43LjSN7ei/jUmzYoqOzEMsWYAQbEZY= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.17; Fri, 17 May 2019 15:35:55 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1900.010; Fri, 17 May 2019 15:35:55 +0000 From: "Panos Kampanakis (pkampana)" To: "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt Thread-Index: AQHVDMWddQFmHhPwYk+M2tBX23+L/6ZvciLA Date: Fri, 17 May 2019 15:35:55 +0000 Message-ID: References: <155810704144.26327.4695280572619758639@ietfa.amsl.com> In-Reply-To: <155810704144.26327.4695280572619758639@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1007::233] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2bd70e74-ba8d-4688-3960-08d6dadd59f8 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1791; x-ms-traffictypediagnostic: MWHPR11MB1791: x-ms-exchange-purlcount: 6 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0040126723 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(376002)(39860400002)(346002)(136003)(396003)(53754006)(189003)(199004)(13464003)(14454004)(478600001)(476003)(966005)(6916009)(2906002)(99286004)(7696005)(229853002)(6436002)(5640700003)(55016002)(76176011)(8936002)(6506007)(1730700003)(81166006)(81156014)(8676002)(102836004)(53546011)(186003)(446003)(6116002)(256004)(14444005)(486006)(11346002)(46003)(52536014)(66946007)(76116006)(73956011)(66476007)(66556008)(64756008)(66446008)(86362001)(6246003)(25786009)(33656002)(53936002)(2501003)(2351001)(7736002)(71200400001)(71190400001)(316002)(66574012)(5660300002)(74316002)(305945005)(6306002)(68736007)(9686003); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1791; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: WYfEDosMvYTNf0z0D05Ccmoc2k4HIroAEkC6MfLeJIqJXM4bmBao5DLYpQxfIh/miwwN3ZLRaRqcvWNWRQFUBbud+hKsCR7qtxrqt8RaBBKTXb7zCkgKfdTpzBaSz9aSvKnOXPbVtfv6DcitgRWHuD27TzHT4djxOXZZ5+c3aMI7g0LWMb0oiJGDxZQMrRKchEeTRAjDd566uEhROadBqydsSokmnUV/q5fYcmzswDvBFdIy5T04qnZl97PJ0VhIThouG3x2Ixnkc4rGttk+21W6HSktOnMXfvmlcntyDzJR+uH8Mi6l/K2+6KlfZ2ZCD3OH3CUpqd/mFg4LsQGF4S5yUp+ZwOpAEXcqWavKLpyire4i+95BCX/k/KEYWkphTMGkzAL8MunBxkYBdd7y2n4f5AD+PlEiBISML4XFKCo= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2bd70e74-ba8d-4688-3960-08d6dadd59f8 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 May 2019 15:35:55.1170 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1791 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.16, xch-rcd-006.cisco.com X-Outbound-Node: alln-core-5.cisco.com Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 May 2019 15:36:14 -0000 Hi all,=20 This latest update addresses feedback while in WGLC"=20 - the comments by Hannes and Esko related to RNG and server-side key gen. I= t aims to prevent misunderstandings that random numbers are not needed any = more if server-side key gen is used.=20 - the nits with "/crt" instead of "/crts" pointed out by Esko.=20 The diff is here https://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-coap-= est-11.txt=20 Thanks, Panos -----Original Message----- From: Ace On Behalf Of internet-drafts@ietf.org Sent: Friday, May 17, 2019 11:31 AM To: i-d-announce@ietf.org Cc: ace@ietf.org Subject: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Authentication and Authorization for Const= rained Environments WG of the IETF. Title : EST over secure CoAP (EST-coaps) Authors : Peter van der Stok Panos Kampanakis Michael C. Richardson Shahid Raza Filename : draft-ietf-ace-coap-est-11.txt Pages : 48 Date : 2019-05-17 Abstract: Enrollment over Secure Transport (EST) is used as a certificate provisioning protocol over HTTPS. Low-resource devices often use the lightweight Constrained Application Protocol (CoAP) for message exchanges. This document defines how to transport EST payloads over secure CoAP (EST-coaps), which allows constrained devices to use existing EST functionality for provisioning certificates. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-coap-est/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-coap-est-11 https://datatracker.ietf.org/doc/html/draft-ietf-ace-coap-est-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-coap-est-11 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Sat May 18 22:41:19 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D8971200F1; Sat, 18 May 2019 22:41:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CRS5HN38pvJr; Sat, 18 May 2019 22:41:17 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B03B71200E9; Sat, 18 May 2019 22:41:13 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 18 May 2019 22:41:07 -0700 From: Jim Schaad To: CC: Date: Sat, 18 May 2019 22:41:04 -0700 Message-ID: <001901d50e05$74847200$5d8d5600$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdUN/nFAwwwghp0WRR+des3k7n3V6A== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] draft-ietf-ace-mqtt-tls-profile connections X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 May 2019 05:41:18 -0000 I am having a problem understanding the flow of authentication. This may just be a problem with my preconceptions, but in that case it still needs to get clarified in the document. * So as a client I get a token from the AS. For the first run, assume that it has a RPK in it. * I now connect to the server using TLS. Question #1 - Am I doing client authentication at this point in TLS? This is what is happening for all of the current profiles, but it is not clear that this is happening for this profile. The answer appears to be both yes and no. * The connect message holds the token and an authentication value. The sentence starting "The client MAY apply ..." in the next to last paragraph is totally confusing. Do I get a choice to create a value or not? Do I get a choice as to which method I use (which would seem to be dictated by the token type and not by client choice). * I am flummoxed by the statement that there is sufficient randomness in the payload when authenticating. I presume that all that is being used for the authentication input is the CONNECT message. Given that the exact same input would be used for two different logons, I do not understand how this could be the case. Impersonation would seem to be an issue in the event that the connect message is ever captured (including by the server). I would strongly suggest that there is a requirement to include a value from a tls-exporter to tie the authentication to a specific session. * Appendix B says that the broker will accept MQTT PUBLISH messages, does it have to do a connect before doing the publish or not? If the connect is required then what is used for authentication? Jim From nobody Sun May 19 11:16:44 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B58641200F3 for ; Sun, 19 May 2019 11:16:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bb7kC_dvyvfm for ; Sun, 19 May 2019 11:16:41 -0700 (PDT) Received: from resqmta-ch2-07v.sys.comcast.net (resqmta-ch2-07v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F669120072 for ; Sun, 19 May 2019 11:16:41 -0700 (PDT) Received: from resomta-ch2-03v.sys.comcast.net ([69.252.207.99]) by resqmta-ch2-07v.sys.comcast.net with ESMTP id SQC2hKnhjKkkfSQMShjPoy; Sun, 19 May 2019 18:16:40 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=20190202a; t=1558289800; bh=BgEPX7qObRSbP3fEAaScewQj5bGFelInQqlWJMw9R7I=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=Mgvhu5NmJqxepEUavn1TnxLqwrLcypMM7KY6uEAPWnuR1SWkgnGW+zC+TYddkJUhh uLU/tXGnCmWurD8iaP+siGVwqcj5657q0+BSHpQyKbCHe+RJXpX6/MDQvpJexwl2qN ue5rnLUIt8BNoVqmwS4/dOszykkM7cURd1A4E0Nu5rOKQhqJLa42q6o/Va72Ne3Ixo AvKXSwHChP67c/ZtaFx93CnrTB7T3QrHq+GlVGVEK4C2fD+iHYZoN6E/SirAMJp6So GZVeibRCnXIgGDM1t96AbRh5cInRtd1NGcJG9Ik3UnqKT2chyczt3aksU/sIcDbyRO jp54FhKxg72wg== Received: from [IPv6:2601:152:4400:437c:9da0:a575:986d:50be] ([IPv6:2601:152:4400:437c:9da0:a575:986d:50be]) by resomta-ch2-03v.sys.comcast.net with ESMTPSA id SQMRhdQuSxMewSQMRhpqXW; Sun, 19 May 2019 18:16:40 +0000 X-Xfinity-VMeta: sc=0;st=legit To: ace@ietf.org References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> From: Michael StJohns Message-ID: Date: Sun, 19 May 2019 14:16:38 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 May 2019 18:16:43 -0000 On 5/14/2019 7:29 PM, Hannes Tschofenig wrote: > Hi Paul, > > My understanding from reading the draft text was that the "cost" was actually talking about "energy cost" rather than "monetary cost". > The monetary cost may also be interesting. > > It is difficult to judge the extra cost of a RNG in an MCU because > (a) you rarely find an MCU with and without MCU (keeping all other features the same), "with and without RNG"? > (b) even if you find one there are other factors that impact the cost (such as popularity of a particular MCU), > (c) RNG features are often provided with other features (such as SHA256 and AES in hardware), and Um... you usually need one or the other of these to do a good implementation of a DRBG and hardware versions tend to be less "costly" energy wise than software ones. > (d) cost and price of an MCU are different aspects. That have no bearing on the protocol design past a certain set of minimums.   I'm beginning to think its time for "minimum requirements for internet hosts - 2020 edition" RFCs.  We seem to be back in the same set of arguments  that ANYTHING should be able to be an internet device albiet with even lower thresholds than we were a few years ago.  ACE is pushing those boundaries, but we seem to be chasing "cost -> 0" > > Ciao > Hannes All good points, but ignoring the fact that needs drive the protocols which drive the MCU development.  NOT MCUs limit the protocols which limit the needs. In other words, if the community (through protocol definitions) doesn't require the RNG, then the MCU developers won't include it. With respect to RNG energy costs - the argument that they are too expensive energy wise is pretty bogus.  RNGs generally have two parts - a TRNG or entropy source, and a DRBG seeded from the entropy source.  The energy costs for the DRBG are microscopic. The energy costs for a TRNG are related more to the time needed to initially fill the entropy pool (e.g. getting the noisy diodes making noise, getting the ring oscillators ringing etc) than to keeping it running to get a few thousand bits.  Doing this say once a year to seed the DRBG isn't going to kill the lifetime of a battery device. From nobody Sun May 19 23:31:34 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2236C120134; Sun, 19 May 2019 23:31:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cIdHJEdGCs5i; Sun, 19 May 2019 23:31:30 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10122.outbound.protection.outlook.com [40.107.1.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5082120041; Sun, 19 May 2019 23:31:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancynl-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Bg4xAMWbTc7q0HoeoGDXyEIsxiRWOHqHlg0hFuqCZF0=; b=zAREjpboMY0aTi0hW7Hl8mwkmZxNZp0DyAbUwC7syaMgWBWuvNOvzFCpdMp62wGZZB1XhO2NTuO1PAAPls524Psk/w3MLNzoxZqmLvjKcXtvQE/ktWVJXdmoZB0KXw6zs7ChesrvszCC6VomYuw8yASoH7L3WTwnh0kwQz3eYTw= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0149.EURP190.PROD.OUTLOOK.COM (10.172.228.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.18; Mon, 20 May 2019 06:31:25 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20%8]) with mapi id 15.20.1900.020; Mon, 20 May 2019 06:31:25 +0000 From: Esko Dijk To: "Panos Kampanakis (pkampana)" , "ace@ietf.org" CC: "draft-ietf-ace-coap-est@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt Thread-Index: AQHVDMWjkc1/UB/X3EaGxntG4OXylKZvcuOAgAQcGnA= Date: Mon, 20 May 2019 06:31:25 +0000 Message-ID: References: <155810704144.26327.4695280572619758639@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [81.82.250.44] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3e656467-ec67-4952-37fe-08d6dcecc883 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6P190MB0149; x-ms-traffictypediagnostic: DB6P190MB0149: x-ms-exchange-purlcount: 6 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 004395A01C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(366004)(39830400003)(396003)(136003)(53754006)(13464003)(189003)(199004)(14454004)(74482002)(74316002)(446003)(11346002)(6246003)(26005)(186003)(2906002)(53936002)(25786009)(86362001)(8676002)(81156014)(81166006)(8936002)(7736002)(229853002)(476003)(305945005)(486006)(4326008)(44832011)(55236004)(508600001)(52536014)(76176011)(71200400001)(71190400001)(6116002)(6506007)(6436002)(3846002)(53546011)(102836004)(2501003)(7696005)(110136005)(316002)(66556008)(64756008)(256004)(14444005)(6306002)(966005)(33656002)(99286004)(66574012)(5660300002)(66476007)(9686003)(66446008)(55016002)(76116006)(66066001)(68736007)(73956011)(66946007); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0149; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: JN6D+cF/QNZtgeWx+G1VrEiJotx3dXTBRRyBAYOpHgQHD4i025ShYkRqu0Cf6sMDAqNpxyzGfG37G8y4dT6RZcEJVtzVMNfsQswIGir2nQYBOcbT4D0QfXUBYt/ExD0qczb58/V4VALXCOVTPITLlPgRdVov5LnCHMgb9F1fCxJFwr4em6a8lbCx6WGIZjaOLwOZzHZyghz/BiKbyX5IQMJqDs5IIbkDeYT1pJW+ABzUoVtjWC6YFCIUMjAN7h18mg/EKmED9nRZzksfbJBf/Ag7jgfkdqXMs9A0GX4tyDtzyMj3s5MqJaQKH/QXE45Ds94jMggDF26fvWZvSrT2yFjVir+Uv26Swokh7ark+1SH2uhKaH2JEvNIJrN2riD9wb/zml3Xc1VM1LWH9F0jrl1LvG46cznG0ULXarVzatQ= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: 3e656467-ec67-4952-37fe-08d6dcecc883 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2019 06:31:25.2658 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0149 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 May 2019 06:31:33 -0000 VGhhbmtzLA0KDQpBIGZldyBjb21tZW50cyBJIGhhZCBzdGlsbCBvbiB0aGUgZGlzY292ZXJ5IHNl Y3Rpb24gLSBzb3JyeSB0byBiZSBsYXRlIHBvc3QtV0dMQyB3aXRoIHRoaXM6DQoNCi0gcGFnZSAx MCBib3R0b20gbWVudGlvbnMgIm1hbmFnZW1lbnQgZGF0YSIgLSBzaG91bGQgc2F5ICJtYW5hZ2Vt ZW50IHJlc291cmNlcyIsIG9yICJFU1QgcmVzb3VyY2VzIiBwZXJoYXBzPw0KLSBwYWdlIDEwIGJv dHRvbTogIiBVcG9uIHN1Y2Nlc3MsIHRoZSByZXR1cm4gcGF5bG9hZCB3aWxsIGNvbnRhaW4gdGhl IHJvb3QgcmVzb3VyY2Ugb2YgdGhlIEVTVCByZXNvdXJjZXMuIiAtIHRoaXMgaXMgbm90IHRydWUs IHNpbmNlIG9ubHkgdGhlIGluZGl2aWR1YWwgc3VwcG9ydGVkIHJlc291cmNlcyBhcmUgcmV0dXJu ZWQuIFRoZSByb290IChlLmcuICIvZXN0IiBpbiB0aGUgZXhhbXBsZXMpIGNhbiBiZSBkZWR1Y2Vk IGZyb20gdGhlIHJlc3BvbnNlIGJ1dCBpdCBpcyBuZXZlciByZXR1cm5lZCBhcyBvbmUgbGluayBm b3JtYXQgZW50cnkuDQotIHBhZ2UgMTEgdG9wOiB0aGUgZXhhbXBsZSBpcyBvbmx5IGNvcnJlY3Qg Zm9yIGEgc2VjdXJlIChjb2FwczovLykgZGlzY292ZXJ5IEdFVCByZXF1ZXN0LCBJIHRoaW5rIHRo aXMgY291bGQgYmUgbWVudGlvbmVkIGluIHRleHQgb3IgaW5kaWNhdGVkIGluIHRoZSByZXF1ZXN0 IGxpbmUuDQotIHBhZ2UgMTEgYm90dG9tIHJlcXVpcmVtZW50OiAiIFRoZSBjbGllbnQgU0hPVUxE IHVzZSByZXNvdXJjZSBkaXNjb3Zlcnkgd2hlbiBoZSBpcyB1bmF3YXJlIG9mIHRoZSBhdmFpbGFi bGUgIEVTVC1jb2FwcyByZXNvdXJjZXMuIiAtIHdoZW4gYW4gRVNUIHNlcnZlciBpcyBrbm93biwg dGhpcyByZXF1aXJlbWVudCBkb2VzIG5vdCByZWFsbHkgYXBwbHkgc2luY2UgdGhlIHNlcnZlciBh bHdheXMgc3VwcG9ydHMgLndlbGwta25vd24gRVNUIHJlc291cmNlcy4gIFNvIEkgcmVhZCBpdCBh cyBkb2luZyBhbiBSRCBkaXNjb3Zlcnkgb3IgbXVsdGljYXN0IENvQVAgZGlzY292ZXJ5IGlmIHRo ZSBjbGllbnQgZG9lc24ndCBrbm93biB0aGUgRVNUIHNlcnZlciBhZGRyZXNzLiAgSG9wZSB0aGlz IGlzIGNsZWFyIGVub3VnaCBpbiB0aGUgdGV4dCBhbmQgaW50ZW5kZWQ/DQotIHBhZ2UgMTEgYm90 dG9tOiAiaGUgc3VwcG9ydHMiIC0+ICJpdCBzdXBwb3J0cyINCi0gcGFnZSAxMSBib3R0b206ICIg SXQgaXMgdXAgdG8gdGhlIGltcGxlbWVudGF0aW9uIHRvIGNob29zZSBpdHMgcmVzb3VyY2UgcGF0 aHPigJ0gLT4gc2VlbXMgbm90IHJlYWxseSB0aGUgY2FzZSwgYmVjYXVzZSB0aGUgcm9vdCByZXNv dXJjZSBzdHJ1Y3R1cmUgaXMgZm9yY2VkIGJ5IHRoZSBzcGVjaWZpY2F0aW9uLiBJdCBjb3VsZCBo YXZlIGJlZW4gZGVzaWduZWQgYXMgZnJlZSBjaG9pY2UgKGJlY2F1c2UgaXQgY2FuIGJlIGRpc2Nv dmVyZWQgYW55d2F5KSBidXQgaXQgaXMgbm90Lg0KDQpCZXN0IHJlZ2FyZHMNCkVza28NCg0KLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEFjZSA8YWNlLWJvdW5jZXNAaWV0Zi5vcmc+ IE9uIEJlaGFsZiBPZiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkNClNlbnQ6IEZyaWRheSwg TWF5IDE3LCAyMDE5IDE3OjM2DQpUbzogYWNlQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW0FjZV0g SS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEudHh0DQoNCkhpIGFsbCwgDQoN ClRoaXMgbGF0ZXN0IHVwZGF0ZSBhZGRyZXNzZXMgZmVlZGJhY2sgd2hpbGUgaW4gV0dMQyIgDQot IHRoZSBjb21tZW50cyBieSBIYW5uZXMgYW5kIEVza28gcmVsYXRlZCB0byBSTkcgYW5kIHNlcnZl ci1zaWRlIGtleSBnZW4uIEl0IGFpbXMgdG8gcHJldmVudCBtaXN1bmRlcnN0YW5kaW5ncyB0aGF0 IHJhbmRvbSBudW1iZXJzIGFyZSBub3QgbmVlZGVkIGFueSBtb3JlIGlmIHNlcnZlci1zaWRlIGtl eSBnZW4gaXMgdXNlZC4gDQotIHRoZSBuaXRzIHdpdGggIi9jcnQiIGluc3RlYWQgb2YgIi9jcnRz IiBwb2ludGVkIG91dCBieSBFc2tvLiANCg0KVGhlIGRpZmYgaXMgaGVyZSBodHRwczovL3Rvb2xz LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQgDQoN ClRoYW5rcywNClBhbm9zDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBBY2Ug PGFjZS1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgaW50ZXJuZXQtZHJhZnRzQGlldGYu b3JnDQpTZW50OiBGcmlkYXksIE1heSAxNywgMjAxOSAxMTozMSBBTQ0KVG86IGktZC1hbm5vdW5j ZUBpZXRmLm9yZw0KQ2M6IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogW0FjZV0gSS1EIEFjdGlvbjog ZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEudHh0DQoNCg0KQSBOZXcgSW50ZXJuZXQtRHJhZnQg aXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVz Lg0KVGhpcyBkcmFmdCBpcyBhIHdvcmsgaXRlbSBvZiB0aGUgQXV0aGVudGljYXRpb24gYW5kIEF1 dGhvcml6YXRpb24gZm9yIENvbnN0cmFpbmVkIEVudmlyb25tZW50cyBXRyBvZiB0aGUgSUVURi4N Cg0KICAgICAgICBUaXRsZSAgICAgICAgICAgOiBFU1Qgb3ZlciBzZWN1cmUgQ29BUCAoRVNULWNv YXBzKQ0KICAgICAgICBBdXRob3JzICAgICAgICAgOiBQZXRlciB2YW4gZGVyIFN0b2sNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgUGFub3MgS2FtcGFuYWtpcw0KICAgICAgICAgICAgICAgICAg ICAgICAgICBNaWNoYWVsIEMuIFJpY2hhcmRzb24NCiAgICAgICAgICAgICAgICAgICAgICAgICAg U2hhaGlkIFJhemENCglGaWxlbmFtZSAgICAgICAgOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0x MS50eHQNCglQYWdlcyAgICAgICAgICAgOiA0OA0KCURhdGUgICAgICAgICAgICA6IDIwMTktMDUt MTcNCg0KQWJzdHJhY3Q6DQogICBFbnJvbGxtZW50IG92ZXIgU2VjdXJlIFRyYW5zcG9ydCAoRVNU KSBpcyB1c2VkIGFzIGEgY2VydGlmaWNhdGUNCiAgIHByb3Zpc2lvbmluZyBwcm90b2NvbCBvdmVy IEhUVFBTLiAgTG93LXJlc291cmNlIGRldmljZXMgb2Z0ZW4gdXNlIHRoZQ0KICAgbGlnaHR3ZWln aHQgQ29uc3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9jb2wgKENvQVApIGZvciBtZXNzYWdlDQog ICBleGNoYW5nZXMuICBUaGlzIGRvY3VtZW50IGRlZmluZXMgaG93IHRvIHRyYW5zcG9ydCBFU1Qg cGF5bG9hZHMgb3Zlcg0KICAgc2VjdXJlIENvQVAgKEVTVC1jb2FwcyksIHdoaWNoIGFsbG93cyBj b25zdHJhaW5lZCBkZXZpY2VzIHRvIHVzZQ0KICAgZXhpc3RpbmcgRVNUIGZ1bmN0aW9uYWxpdHkg Zm9yIHByb3Zpc2lvbmluZyBjZXJ0aWZpY2F0ZXMuDQoNCg0KVGhlIElFVEYgZGF0YXRyYWNrZXIg c3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC8NCg0KVGhlcmUgYXJlIGFsc28gaHRtbGl6 ZWQgdmVyc2lvbnMgYXZhaWxhYmxlIGF0Og0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExDQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2Rv Yy9odG1sL2RyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExDQoNCkEgZGlmZiBmcm9tIHRoZSBwcmV2 aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBhdDoNCmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2Rp ZmY/dXJsMj1kcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMQ0KDQoNClBsZWFzZSBub3RlIHRoYXQg aXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Np b24gdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0 b29scy5pZXRmLm9yZy4NCg0KSW50ZXJuZXQtRHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBieSBh bm9ueW1vdXMgRlRQIGF0Og0KZnRwOi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkFjZSBtYWls aW5nIGxpc3QNCkFjZUBpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9hY2UNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9hY2UNCg== From nobody Mon May 20 08:31:47 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 592FB1200E5 for ; Mon, 20 May 2019 08:31:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=CHBZM5Sj; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=RWFUQLSe Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ekN9AedoZlw4 for ; Mon, 20 May 2019 08:31:44 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0E9A12008F for ; Mon, 20 May 2019 08:31:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8360; q=dns/txt; s=iport; t=1558366304; x=1559575904; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=XnpbhTDEHw89RFPL/nhYIwagxGx0O4Q6La9gdQW/Jw8=; b=CHBZM5SjPjxj28ICbYwixQ+Pm1RJc0ZABVpNUq8NS8LIrBDg5QNNNYfL 1y4JdLWjdOMOmSpV8WRq7SgJIymDAys6WUMPefHzGTHRm7jbIuZHbgAtF gq8Y6Q5uDsSzkr9/hu3B/SvUXIWlzKd3L1UFShpSBiwKq4IFSW2rvg9l1 w=; IronPort-PHdr: =?us-ascii?q?9a23=3APTTc2xRPc5bgIKwCeIrhqG8cWtpsv++ubAcI9p?= =?us-ascii?q?oqja5Pea2//pPkeVbS/uhpkESXBNfA8/wRje3QvuigQmEG7Zub+FE6OJ1XH1?= =?us-ascii?q?5g640NmhA4RsuMCEn1NvnvOjQ5FcFaXVls13q6KkNSXs35Yg6arw=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BIAAAIyOJc/5ldJa1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBUQcBAQsBgT1QA2lVIAQLKIQTg0cDhFKKJYJXlyeBLoEkA1QJAQEBDAE?= =?us-ascii?q?BGA8GAgEBhEACF4IlIzQJDgEDAQEEAQECAQRtHAyFSgEBAQMBAQEQEQQNDAE?= =?us-ascii?q?BLAwEBwQCAQgRBAEBAwImAgICJQsVCAgCBAESCBqDAYFqAw4PAQ6bLQKBNYh?= =?us-ascii?q?fcXwzgnkBAQWBMwEDAg5BgncYgg8JgQwoAYtQF4FAP4ERRoJMPoJhAQECAQE?= =?us-ascii?q?WgTEYFYJzMoImjXaaJgkCgg2GLoxpgh1nhW6DeokzjFKBJYVIjk4CBAIEBQI?= =?us-ascii?q?OAQEFgU84gVdwFRohgmwJggaDb4UUhT9yAQmBH44OAQE?= X-IronPort-AV: E=Sophos;i="5.60,491,1549929600"; d="scan'208";a="275885313" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 20 May 2019 15:31:20 +0000 Received: from XCH-RCD-010.cisco.com (xch-rcd-010.cisco.com [173.37.102.20]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x4KFVIwh006066 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 20 May 2019 15:31:18 GMT Received: from xhs-rcd-003.cisco.com (173.37.227.248) by XCH-RCD-010.cisco.com (173.37.102.20) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 May 2019 10:31:17 -0500 Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 May 2019 10:31:17 -0500 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 20 May 2019 11:31:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XnpbhTDEHw89RFPL/nhYIwagxGx0O4Q6La9gdQW/Jw8=; b=RWFUQLSerGo4wjEqHzQjPoPJA8VHdwHdXXhpzRyAnBsrApcXcDHSyJ1GBtOd82fr0oUZ8+rg8Crl+pekbT385AFlCRbh+YXbRnX8B6QqWia2/IhAO5iElqsrYCDJ8wfoLUkEZY/bGxkGUE6dmVon6lL0WQnmTLoDDe1rNy8r0QQ= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1549.namprd11.prod.outlook.com (10.172.54.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Mon, 20 May 2019 15:31:15 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1900.020; Mon, 20 May 2019 15:31:15 +0000 From: "Panos Kampanakis (pkampana)" To: Esko Dijk , "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt Thread-Index: AQHVDMWddQFmHhPwYk+M2tBX23+L/6ZvciLAgAQfnoCAAI3gkA== Date: Mon, 20 May 2019 15:31:15 +0000 Message-ID: References: <155810704144.26327.4695280572619758639@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1003::189] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ac9875bb-7131-4c8e-0e34-08d6dd383299 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:MWHPR11MB1549; x-ms-traffictypediagnostic: MWHPR11MB1549: x-ms-exchange-purlcount: 7 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 004395A01C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(346002)(39860400002)(376002)(366004)(13464003)(199004)(189003)(53754006)(68736007)(2501003)(476003)(11346002)(446003)(46003)(229853002)(6506007)(53546011)(186003)(102836004)(316002)(66574012)(110136005)(76176011)(99286004)(33656002)(7696005)(486006)(2906002)(81166006)(25786009)(8936002)(53936002)(6246003)(71200400001)(71190400001)(5660300002)(73956011)(66946007)(66556008)(64756008)(66446008)(66476007)(76116006)(14454004)(478600001)(305945005)(14444005)(52536014)(6436002)(74316002)(8676002)(81156014)(966005)(6306002)(55016002)(6116002)(86362001)(9686003)(7736002)(256004); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1549; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8fm/AxUJYkd4vhbBnIjhOwW0yZyQgrQuTdIvFRVTFlmaC8x14Ur6fxsfIyifDL2BD5sQktxY7VpVw6qzvUz86dkfP1Zjyyp49HXGVCyMzyDBuBj/aeft2CvC/EPbOd4r7oYYm5xm1EZCAyrqbq7UpluqcglXAVH/vjJruGHcjSwJo+Hxtx4hGeBPofyUbBZpUrcwclqvGaT4cajnPcsSPGwj8YuLTfcC0L71arI/bgq/4Z7fVVMQtgxXY6Em5n3ATh1pQld0hzxq2370LODtqitvnLH8LiWWvhEUqwop5NLCyghnPbyYFIyWX3/toqlj1Zqv4X8a1B8GzIiu4nSlWKsX2qjCD4tckOrKkpzbKFCx9jKq6Hmri+xYf6QVAjp3yzNe8NK2qQCOZgirPa4ltPpqJ0htwO6Yb2Sl+QKTr0U= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: ac9875bb-7131-4c8e-0e34-08d6dd383299 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2019 15:31:15.4510 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1549 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.20, xch-rcd-010.cisco.com X-Outbound-Node: rcdn-core-2.cisco.com Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 May 2019 15:31:46 -0000 VGhhbmtzIEVza28uIA0KDQpBZGRyZXNzZWQgaW4gaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFy MjAxNS9FU1QtY29hcHMvYmxvYi84NGNlMGMxZDVlNzY4ZDQwZTk3MTg0MjE0YmFlNDA0ZGEyMWJk MDUwL2RyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LnhtbCBUd28gY29tbWVudHM6IA0KDQo+IHBhZ2Ug MTEgYm90dG9tIHJlcXVpcmVtZW50OiAiIFRoZSBjbGllbnQgU0hPVUxEIHVzZSByZXNvdXJjZSBk aXNjb3Zlcnkgd2hlbiBoZSBpcyB1bmF3YXJlIG9mIHRoZSBhdmFpbGFibGUgIEVTVC1jb2FwcyBy ZXNvdXJjZXMuIiAtIHdoZW4gYW4gRVNUIHNlcnZlciBpcyBrbm93biwgdGhpcyByZXF1aXJlbWVu dCBkb2VzIG5vdCByZWFsbHkgYXBwbHkgc2luY2UgdGhlIHNlcnZlciBhbHdheXMgc3VwcG9ydHMg LndlbGwta25vd24gRVNUIHJlc291cmNlcy4gIFNvIEkgcmVhZCBpdCBhcyBkb2luZyBhbiBSRCBk aXNjb3Zlcnkgb3IgbXVsdGljYXN0IENvQVAgZGlzY292ZXJ5IGlmIHRoZSBjbGllbnQgZG9lc24n dCBrbm93biB0aGUgRVNUIHNlcnZlciBhZGRyZXNzLiAgSG9wZSB0aGlzIGlzIGNsZWFyIGVub3Vn aCBpbiB0aGUgdGV4dCBhbmQgaW50ZW5kZWQ/DQoNClRoZXJlIGFyZSBvcHRpb25hbCByZXNvdXJj ZXMgbGlrZSAvYXR0LCAvc2tnIGFuZCAvc2tjIHRoYXQgdGhlIHNlcnZlciBkb2VzIG5vdCBoYXZl IHRvIHN1cHBvcnQsIHNvIHRoYXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcg dG8uIA0KDQo+IHBhZ2UgMTEgYm90dG9tOiAiIEl0IGlzIHVwIHRvIHRoZSBpbXBsZW1lbnRhdGlv biB0byBjaG9vc2UgaXRzIHJlc291cmNlIHBhdGhz4oCdIC0+IHNlZW1zIG5vdCByZWFsbHkgdGhl IGNhc2UsIGJlY2F1c2UgdGhlIHJvb3QgcmVzb3VyY2Ugc3RydWN0dXJlIGlzIGZvcmNlZCBieSB0 aGUgc3BlY2lmaWNhdGlvbi4gSXQgY291bGQgaGF2ZSBiZWVuIGRlc2lnbmVkIGFzIGZyZWUgY2hv aWNlIChiZWNhdXNlIGl0IGNhbiBiZSBkaXNjb3ZlcmVkIGFueXdheSkgYnV0IGl0IGlzIG5vdC4N Cg0KVGhlIHRleHQgc2F5cyB0aGF0IHRoZSBzZXJ2ZXIgTVVTVCBzdXBwb3J0IHRoZSBkZWZhdWx0 IC8ud2VsbC1rbm93bi9lc3Qgcm9vdCByZXNvdXJjZSBhbmQgaXQgU0hPVUxEIHN1cHBvcnQgcmVz b3VyY2UgZGlzY292ZXJ5IGZvciBub24tZGVmYXVsdCBVUklzIChsaWtlIC9lc3Qgb3IgL2VzdC9B cmJpdHJhcnlMYWJlbCkgb3IgcG9ydHMuIEluIHRoZSBsYXR0ZXIgY2FzZSBpdCBpcyB1cCB0byB0 aGUgc2VydmVyIHRvIGRlY2lkZSB0aGUgcGF0aHMgaGUgbWFrZXMgaXRzIHJlc291cmNlcyBhdmFp bGFibGUgYXQuIFRoYXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcgdG8uIEJ1 dCB5b3UgYXJlIHJpZ2h0OyBJIHJlYWxpemVkIHRoYXQgdGhpcyBzZW50ZW5jZSBpcyByZWR1bmRh bnQgc28gSSBvbmx5IGtlcHQgIlRocm91Z2hvdXQgdGhpcyBkb2N1bWVudCB0aGUgZXhhbXBsZSBy b290IHJlc291cmNlIG9mIC9lc3QgaXMgdXNlZC4iDQoNCldpbGwgcmV1cGxvYWQgdGhlIG5leHQg aXRlcmF0aW9uIGluIGEgZmV3IGRheXMuIA0KDQpSZ3MsDQpQYW5vcw0KDQoNCi0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBFc2tvIERpamsgPGVza28uZGlqa0Bpb3Rjb25zdWx0YW5j eS5ubD4gDQpTZW50OiBNb25kYXksIE1heSAyMCwgMjAxOSAyOjMxIEFNDQpUbzogUGFub3MgS2Ft cGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNjby5jb20+OyBhY2VAaWV0Zi5vcmcNCkNj OiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdEBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtBY2VdIEkt RCBBY3Rpb246IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dA0KDQpUaGFua3MsDQoNCkEg ZmV3IGNvbW1lbnRzIEkgaGFkIHN0aWxsIG9uIHRoZSBkaXNjb3Zlcnkgc2VjdGlvbiAtIHNvcnJ5 IHRvIGJlIGxhdGUgcG9zdC1XR0xDIHdpdGggdGhpczoNCg0KLSBwYWdlIDEwIGJvdHRvbSBtZW50 aW9ucyAibWFuYWdlbWVudCBkYXRhIiAtIHNob3VsZCBzYXkgIm1hbmFnZW1lbnQgcmVzb3VyY2Vz Iiwgb3IgIkVTVCByZXNvdXJjZXMiIHBlcmhhcHM/DQotIHBhZ2UgMTAgYm90dG9tOiAiIFVwb24g c3VjY2VzcywgdGhlIHJldHVybiBwYXlsb2FkIHdpbGwgY29udGFpbiB0aGUgcm9vdCByZXNvdXJj ZSBvZiB0aGUgRVNUIHJlc291cmNlcy4iIC0gdGhpcyBpcyBub3QgdHJ1ZSwgc2luY2Ugb25seSB0 aGUgaW5kaXZpZHVhbCBzdXBwb3J0ZWQgcmVzb3VyY2VzIGFyZSByZXR1cm5lZC4gVGhlIHJvb3Qg KGUuZy4gIi9lc3QiIGluIHRoZSBleGFtcGxlcykgY2FuIGJlIGRlZHVjZWQgZnJvbSB0aGUgcmVz cG9uc2UgYnV0IGl0IGlzIG5ldmVyIHJldHVybmVkIGFzIG9uZSBsaW5rIGZvcm1hdCBlbnRyeS4N Ci0gcGFnZSAxMSB0b3A6IHRoZSBleGFtcGxlIGlzIG9ubHkgY29ycmVjdCBmb3IgYSBzZWN1cmUg KGNvYXBzOi8vKSBkaXNjb3ZlcnkgR0VUIHJlcXVlc3QsIEkgdGhpbmsgdGhpcyBjb3VsZCBiZSBt ZW50aW9uZWQgaW4gdGV4dCBvciBpbmRpY2F0ZWQgaW4gdGhlIHJlcXVlc3QgbGluZS4NCi0gcGFn ZSAxMSBib3R0b20gcmVxdWlyZW1lbnQ6ICIgVGhlIGNsaWVudCBTSE9VTEQgdXNlIHJlc291cmNl IGRpc2NvdmVyeSB3aGVuIGhlIGlzIHVuYXdhcmUgb2YgdGhlIGF2YWlsYWJsZSAgRVNULWNvYXBz IHJlc291cmNlcy4iIC0gd2hlbiBhbiBFU1Qgc2VydmVyIGlzIGtub3duLCB0aGlzIHJlcXVpcmVt ZW50IGRvZXMgbm90IHJlYWxseSBhcHBseSBzaW5jZSB0aGUgc2VydmVyIGFsd2F5cyBzdXBwb3J0 cyAud2VsbC1rbm93biBFU1QgcmVzb3VyY2VzLiAgU28gSSByZWFkIGl0IGFzIGRvaW5nIGFuIFJE IGRpc2NvdmVyeSBvciBtdWx0aWNhc3QgQ29BUCBkaXNjb3ZlcnkgaWYgdGhlIGNsaWVudCBkb2Vz bid0IGtub3duIHRoZSBFU1Qgc2VydmVyIGFkZHJlc3MuICBIb3BlIHRoaXMgaXMgY2xlYXIgZW5v dWdoIGluIHRoZSB0ZXh0IGFuZCBpbnRlbmRlZD8NCi0gcGFnZSAxMSBib3R0b206ICJoZSBzdXBw b3J0cyIgLT4gIml0IHN1cHBvcnRzIg0KLSBwYWdlIDExIGJvdHRvbTogIiBJdCBpcyB1cCB0byB0 aGUgaW1wbGVtZW50YXRpb24gdG8gY2hvb3NlIGl0cyByZXNvdXJjZSBwYXRoc+KAnSAtPiBzZWVt cyBub3QgcmVhbGx5IHRoZSBjYXNlLCBiZWNhdXNlIHRoZSByb290IHJlc291cmNlIHN0cnVjdHVy ZSBpcyBmb3JjZWQgYnkgdGhlIHNwZWNpZmljYXRpb24uIEl0IGNvdWxkIGhhdmUgYmVlbiBkZXNp Z25lZCBhcyBmcmVlIGNob2ljZSAoYmVjYXVzZSBpdCBjYW4gYmUgZGlzY292ZXJlZCBhbnl3YXkp IGJ1dCBpdCBpcyBub3QuDQoNCkJlc3QgcmVnYXJkcw0KRXNrbw0KDQotLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9m IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKQ0KU2VudDogRnJpZGF5LCBNYXkgMTcsIDIwMTkg MTc6MzYNClRvOiBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQWNlXSBJLUQgQWN0aW9uOiBk cmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0KSGkgYWxsLCANCg0KVGhpcyBsYXRlc3Qg dXBkYXRlIGFkZHJlc3NlcyBmZWVkYmFjayB3aGlsZSBpbiBXR0xDIiANCi0gdGhlIGNvbW1lbnRz IGJ5IEhhbm5lcyBhbmQgRXNrbyByZWxhdGVkIHRvIFJORyBhbmQgc2VydmVyLXNpZGUga2V5IGdl bi4gSXQgYWltcyB0byBwcmV2ZW50IG1pc3VuZGVyc3RhbmRpbmdzIHRoYXQgcmFuZG9tIG51bWJl cnMgYXJlIG5vdCBuZWVkZWQgYW55IG1vcmUgaWYgc2VydmVyLXNpZGUga2V5IGdlbiBpcyB1c2Vk LiANCi0gdGhlIG5pdHMgd2l0aCAiL2NydCIgaW5zdGVhZCBvZiAiL2NydHMiIHBvaW50ZWQgb3V0 IGJ5IEVza28uIA0KDQpUaGUgZGlmZiBpcyBoZXJlIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZj ZGlmZj91cmwyPWRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dCANCg0KVGhhbmtzLA0KUGFu b3MNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEFjZSA8YWNlLWJvdW5jZXNA aWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmcNClNlbnQ6IEZy aWRheSwgTWF5IDE3LCAyMDE5IDExOjMxIEFNDQpUbzogaS1kLWFubm91bmNlQGlldGYub3JnDQpD YzogYWNlQGlldGYub3JnDQpTdWJqZWN0OiBbQWNlXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFj ZS1jb2FwLWVzdC0xMS50eHQNCg0KDQpBIE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBhdmFpbGFibGUg ZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGlyZWN0b3JpZXMuDQpUaGlzIGRyYWZ0 IGlzIGEgd29yayBpdGVtIG9mIHRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlvbiBm b3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIFdHIG9mIHRoZSBJRVRGLg0KDQogICAgICAgIFRp dGxlICAgICAgICAgICA6IEVTVCBvdmVyIHNlY3VyZSBDb0FQIChFU1QtY29hcHMpDQogICAgICAg IEF1dGhvcnMgICAgICAgICA6IFBldGVyIHZhbiBkZXIgU3Rvaw0KICAgICAgICAgICAgICAgICAg ICAgICAgICBQYW5vcyBLYW1wYW5ha2lzDQogICAgICAgICAgICAgICAgICAgICAgICAgIE1pY2hh ZWwgQy4gUmljaGFyZHNvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICBTaGFoaWQgUmF6YQ0K CUZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dA0KCVBhZ2Vz ICAgICAgICAgICA6IDQ4DQoJRGF0ZSAgICAgICAgICAgIDogMjAxOS0wNS0xNw0KDQpBYnN0cmFj dDoNCiAgIEVucm9sbG1lbnQgb3ZlciBTZWN1cmUgVHJhbnNwb3J0IChFU1QpIGlzIHVzZWQgYXMg YSBjZXJ0aWZpY2F0ZQ0KICAgcHJvdmlzaW9uaW5nIHByb3RvY29sIG92ZXIgSFRUUFMuICBMb3ct cmVzb3VyY2UgZGV2aWNlcyBvZnRlbiB1c2UgdGhlDQogICBsaWdodHdlaWdodCBDb25zdHJhaW5l ZCBBcHBsaWNhdGlvbiBQcm90b2NvbCAoQ29BUCkgZm9yIG1lc3NhZ2UNCiAgIGV4Y2hhbmdlcy4g IFRoaXMgZG9jdW1lbnQgZGVmaW5lcyBob3cgdG8gdHJhbnNwb3J0IEVTVCBwYXlsb2FkcyBvdmVy DQogICBzZWN1cmUgQ29BUCAoRVNULWNvYXBzKSwgd2hpY2ggYWxsb3dzIGNvbnN0cmFpbmVkIGRl dmljZXMgdG8gdXNlDQogICBleGlzdGluZyBFU1QgZnVuY3Rpb25hbGl0eSBmb3IgcHJvdmlzaW9u aW5nIGNlcnRpZmljYXRlcy4NCg0KDQpUaGUgSUVURiBkYXRhdHJhY2tlciBzdGF0dXMgcGFnZSBm b3IgdGhpcyBkcmFmdCBpczoNCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0 LWlldGYtYWNlLWNvYXAtZXN0Lw0KDQpUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBh dmFpbGFibGUgYXQ6DQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Ut Y29hcC1lc3QtMTENCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQt aWV0Zi1hY2UtY29hcC1lc3QtMTENCg0KQSBkaWZmIGZyb20gdGhlIHByZXZpb3VzIHZlcnNpb24g aXMgYXZhaWxhYmxlIGF0Og0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0 LWlldGYtYWNlLWNvYXAtZXN0LTExDQoNCg0KUGxlYXNlIG5vdGUgdGhhdCBpdCBtYXkgdGFrZSBh IGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lvbiB1bnRpbCB0aGUg aHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3Jn Lg0KDQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAg YXQ6DQpmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLw0KDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNl QGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZQ0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxp bmcgbGlzdA0KQWNlQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2FjZQ0K From nobody Tue May 21 13:35:20 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A44AC1200D6; Tue, 21 May 2019 13:35:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hoSq3fv6-jPW; Tue, 21 May 2019 13:35:15 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E858120044; Tue, 21 May 2019 13:35:15 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id t1so22131121qtc.12; Tue, 21 May 2019 13:35:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sf7YDAye5wutsxGwAod+S0Tua9SYitSZeRKF3kb0JeM=; b=Y5fgiMg/QLgodXgkHXEVQTJb1mvDoQKKDld6l0rWio2tbqfI5bIR4UkU2gs6z4gwhI ukO+jQHUQeRpjhBq4VGm30+jx5N2W+y32sOpnJd4ZqH/AyMekJNLG4FRbE+CHCXpppta VMKw/02Mj1hI6+eLln7vJCULiVCcJQSvcQOM90Q9ne6FRtmyYt987RELlEn7BdQuA4gT nB0/T+I3gIYs0OWUd5d9okF1127VI57KfnKFWU4pQPiKlxwYDkubLjeZNE8pbtUDirOS 2uSdjjRLGmlWDwRnJdQ4l+nBWnK8h3lvb7kzUr/40F3O+XoOs4Q08VvjCuRrlguhIkjX S7PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sf7YDAye5wutsxGwAod+S0Tua9SYitSZeRKF3kb0JeM=; b=KKhHKT8oFLGzieelrovJIGYZ0yNWeEiJASdcg/L6B+iYWolGy0eH7B9Fih6Gw7h0MN e+EuNxeDWQaZlHjCXy02z68g4GoOv7dh/0pPBC0+0hE19IWxBR6yWAmekx6461lQmgj9 dGzTrTVigT91p84bwvSWXIjZzsJUadEMpTHIn9BMnxrXacb0N8nl4AP4J6cqNc9wF9TJ xo8yR+4Nwd5K8kd/Xt0/A9eJoSvo3LZWxvsimam93eIUa41r+OYS7cYVcssu+JroRgnK lpe5XhGh9MPgoJ2hxHRdYcB6ACRTws8CsoamfdGbOl+rgaqBHL63tkLntEC4P4l/g0Ix MLCw== X-Gm-Message-State: APjAAAUTPZfcIxI8izkkP2TZ8vt3rR/J3m2+4T/WkaXQnNTwJyxFCMdT bo8vZ02xa0a+SuAyvJcJPyYhGmU/hIavyL7HjfE= X-Google-Smtp-Source: APXvYqwTUhMz41h8pxNLQG1UFdgFt+Lu5WNwh6hAU+GQ+yVVPJAC58vYZD7cDFTODxlp4ql90aae/xxvTtxCmbD/SR4= X-Received: by 2002:a0c:af5c:: with SMTP id j28mr61022707qvc.226.1558470914563; Tue, 21 May 2019 13:35:14 -0700 (PDT) MIME-Version: 1.0 References: <001901d50e05$74847200$5d8d5600$@augustcellars.com> In-Reply-To: <001901d50e05$74847200$5d8d5600$@augustcellars.com> From: Cigdem Sengul Date: Tue, 21 May 2019 21:35:03 +0100 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, ace@ietf.org Content-Type: multipart/alternative; boundary="00000000000041626205896bc967" Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile connections X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 May 2019 20:35:19 -0000 --00000000000041626205896bc967 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thank you for your comments. I see that we tried to cover too many options in the draft, and things got mixed up. I tried to clarify inline. * So as a client I get a token from the AS. For the first run, assume that > it has a RPK in it. > * I now connect to the server using TLS. > Question #1 - Am I doing client authentication at this point in > TLS? > This is what is happening for all of the current profiles, but it is not > clear that this is happening for this profile. The answer appears to be > both yes and no. > > The basic method we were thinking: 1. We have not assumed client-side certificates for authenticating clients during TLS handshake. RS uses a server-side certificate. 2. After the TLS session is set-up, the client passes token and authentication data inside the CONNECT message. 3. RS does proof-of-possession for a key owned by the client - so, RS authenticates the token. 4. From MQTT point of view, the clean session flag in the CONNECT indicates, there is no session state. The CONNECT payload includes a Cli= ent id, this should be sufficiently random (not explained clearly in the current draft) and unique across clients. 5. From ACE point of view, we assumed the client has registered with the AS, has established keys; the RS has registered with the AS, has established keys. So, using PoP, the RS checks that the client has authenticated with AS and was able to acquire a token. In addition to this, we state other options in the draft as well: the client and the RS can use the keys in the token to set-up the TLS session (then the token is not in CONNECT message, and may need to be pushed via =E2=80=9Cauthzinfo=E2=80=9D) I checked how client authentication is done in other profiles. I see that draft-ietf-ace-coap-est has =E2=80=9Cauthentication of the client MUST be w= ith a client certificate=E2=80=9D. In draft-ietf-ace-oscore-profile/ C-RS authen= tication is done implicitly by the possession of a common OSCORE security context. The latter is closer to what we were trying to achieve. > * The connect message holds the token and an authentication value. The > sentence starting "The client MAY apply ..." in the next to last paragrap= h > is totally confusing. Do I get a choice to create a value or not? Do I > get > a choice as to which method I use (which would seem to be dictated by the > token type and not by client choice). > That is a mistake - the MAY should have been removed (in an earlier version of the draft, it stated that =E2=80=9CMAY apply it to entire or part of the= CONNECT message=E2=80=9D). Indeed the choice of symmetric/asymmetric would depend on the token type. > > * I am flummoxed by the statement that there is sufficient randomness in > the > payload when authenticating. I presume that all that is being used for t= he > authentication input is the CONNECT message. Given that the exact same > input would be used for two different logons, I do not understand how thi= s > could be the case. Impersonation would seem to be an issue in the event > that the connect message is ever captured (including by the server). I > would strongly suggest that there is a requirement to include a value fro= m > a > tls-exporter to tie the authentication to a specific session. > It is because we assumed that client ids (23B) in the CONNECT payload would provide randomness. We do not keep session state (clean session flag is set across different connects) and hence, there is no incentive for client ids to be consistent across network sessions. But, you are right, a client may still repeat client ids across different CONNECTs or it may not select sufficiently random ids, and an attacker may be able to push the same token if it was able to capture it. Will remove the MAY part and add your suggestion to the draft. > > * Appendix B says that the broker will accept MQTT PUBLISH messages, doe= s > it have to do a connect before doing the publish or not? If the connect = is > required then what is used for authentication? > > This is the part where we have tried to incorporate autzinfo - taking our cue from the core draft, we have not assumed that it can be protected - so no, authentication. Not very comfortable about this - so, open to suggestions for fixes. Before publishing or subscribing anything, clients still need to CONNECT. If they publish to authzinfo - the payload contains a token (as usual encrypted for RS by the AS). So, I guess, an attacker may try to push a token that it captured. But to use it, it will need to disconnect, connect with TLS, and do PoP. We definitely need to put more clarifications and fix the randomness issue in the next iteration. Please let me know if I have missed or misunderstood something. --Cigdem > > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --00000000000041626205896bc967 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thank you for your comments.=C2=A0=C2=A0I=C2=A0see that we tried to cover too man= y options in the draft, and things got mixed up.=C2=A0I tried to clarify inline.=C2=A0

* So as a client I get a token from the AS.=C2=A0 For the first run, = assume that
it has a RPK in it.
* I now connect to the server using TLS.=C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Question #1 - Am I doing client authentication = at this point in TLS?
This is what is happening for all of the current profiles, but it is not clear that this is happening for this profile.=C2=A0 The answer appears to = be
both yes and no.

=C2=A0

The basic method we were think= ing: =C2=A0


  1. We have not assumed client-s= ide certificates for authenticating clients during TLS handshake. RS uses a= server-side certificate. =C2= =A0
  2. After the TLS session is set= -up, the client passes token and authentication data inside the CONNECT mes= sage.=C2=A0
  3. RS does proof-of-possession = for a key owned by the client - so, RS authenticates the token.=C2=A0
  4. From MQTT point of view, the= clean session flag in the CONNECT indicates, there is no session state. Th= e CONNECT payload includes a Client id, this should be sufficiently random = (not explained clearly in the current draft) and unique across clients.=C2=A0
  5. From ACE point of view, we a= ssumed the client has registered with the AS, has established keys; the RS = has registered with the AS, has established keys. So, using PoP, the RS che= cks that the client has authenticated with AS and was able to acquire a tok= en.=C2=A0


In addition to this,=C2=A0 we state other options in t= he draft as well: the client and the RS can use the keys in the token to se= t-up the TLS session (then the token is not in CONNECT message, and may nee= d to be pushed via =E2=80=9Cauthzinfo=E2=80=9D)


I checked how client authentic= ation is done in other profiles. I see that draft-ietf-ace-coap-est has =E2= =80=9Cauthentication of the client MUST be with a client certificate=E2=80= =9D.=C2=A0 In draft-ietf= -ace-oscore-profile/ C-RS authentication is done implicitly by the possessi= on of a common OSCORE security context. The latter is closer to what we wer= e trying to achieve.=C2=A0

=C2=A0
* The connect message holds the token and an authentication value.=C2=A0 Th= e
sentence starting "The client MAY apply ..." in the next to last = paragraph
is totally confusing.=C2=A0 Do I get a choice to create a value or not?=C2= =A0 Do I get
a choice as to which method I use (which would seem to be dictated by the token type and not by client choice).

That is a mistake - the MAY sh= ould have been removed (in an earlier version of the draft, it stated that = =E2=80=9CMAY apply it to entire or part of the CONNECT message=E2=80=9D).=C2=A0

= Indeed the choice of symmetric/asymmetric would depend on the token type.=C2=A0
=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
* I am flummoxed by the statement that there is sufficient randomness in th= e
payload when authenticating.=C2=A0 I presume that all that is being used fo= r the
authentication input is the CONNECT message.=C2=A0 Given that the exact sam= e
input would be used for two different logons, I do not understand how this<= br> could be the case.=C2=A0 Impersonation would seem to be an issue in the eve= nt
that the connect message is ever captured (including by the server).=C2=A0 = I
would strongly suggest that there is a requirement to include a value from = a
tls-exporter to tie the authentication to a specific session.

It is because we assumed that = client ids (23B) in the CONNECT payload would provide randomness. We do not= keep session state (clean session flag is set across different connects) a= nd hence, there is no incentive for client ids to be consistent across netw= ork sessions. But, you are right, a client may still repeat client ids acro= ss different CONNECTs or it may not select sufficiently random ids, and an = attacker may be able to push the same token if it was able to capture it.=C2=A0

= Will remove the MAY part and add your suggestion to the draft.=C2=A0
=C2=A0

*=C2=A0 Appendix B says that the broker will accept MQTT PUBLISH messages, = does
it have to do a connect before doing the publish or not?=C2=A0 If the conne= ct is
required then what is used for authentication?


This is the part where we have= tried to incorporate autzinfo - taking our cue from the core draft, we hav= e not assumed that it can be protected - so no, authentication. Not very co= mfortable about this - so, open to suggestions for fixes. =C2=A0


Before publishing or subscribi= ng anything, clients still need to CONNECT. If they publish to authzinfo - = the payload contains a token (as usual encrypted for RS by the AS). So, I g= uess, an attacker may try to push a token that it captured.=C2=A0 But to use it, it will need to di= sconnect, connect with TLS, and do PoP.=C2=A0


We definitely need to put more= clarifications and fix the randomness issue in the next iteration.=C2=A0

Please let me know if I have m= issed or misunderstood something.=C2=A0


=C2=A0--Cigdem




_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--00000000000041626205896bc967-- From nobody Tue May 21 15:30:46 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F2C01200FF; Tue, 21 May 2019 15:30:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.891 X-Spam-Level: X-Spam-Status: No, score=-1.891 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VdRerAgXhL5T; Tue, 21 May 2019 15:30:41 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80118.outbound.protection.outlook.com [40.107.8.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEA3012004C; Tue, 21 May 2019 15:30:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancynl-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aHqwTKJWtZLNSpsKDjxak71iugKQ5lXMQyzdDGWuUyI=; b=eA0W14g1BLCl6b7TGKDSu8nmgT8+8AibignefZ6rndVP27Ci9/goF6pEVCcenbSi/IL190ZLDR/ujsfbkPBqez/w1F7Zf7D8CZA0wbvYd228Hq75WwrFcKbAVBNV5SDnBGd6q7wD6Kbz+TMUHDWUP2NIDM0tug2Gn1B4kk1aEJo= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0085.EURP190.PROD.OUTLOOK.COM (10.172.229.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1900.16; Tue, 21 May 2019 22:30:36 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20%8]) with mapi id 15.20.1900.020; Tue, 21 May 2019 22:30:36 +0000 From: Esko Dijk To: "Panos Kampanakis (pkampana)" , "ace@ietf.org" CC: "draft-ietf-ace-coap-est@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt Thread-Index: AQHVDMWjkc1/UB/X3EaGxntG4OXylKZvcuOAgAQcGnCAAJmXgIAB7o2g Date: Tue, 21 May 2019 22:30:36 +0000 Message-ID: References: <155810704144.26327.4695280572619758639@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [81.82.250.44] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d98a8b41-9f71-49f3-605a-08d6de3bf1ee x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7027125)(7023125)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:DB6P190MB0085; x-ms-traffictypediagnostic: DB6P190MB0085: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0044C17179 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(13464003)(189003)(199004)(14454004)(5660300002)(76116006)(110136005)(99286004)(55236004)(966005)(3846002)(256004)(305945005)(229853002)(14444005)(76176011)(66556008)(64756008)(6506007)(53546011)(73956011)(74316002)(33656002)(66946007)(66476007)(66446008)(7736002)(66066001)(52536014)(102836004)(7696005)(446003)(4326008)(2501003)(8676002)(6436002)(186003)(11346002)(53936002)(81166006)(508600001)(55016002)(476003)(68736007)(74482002)(8936002)(2906002)(71190400001)(81156014)(71200400001)(26005)(6246003)(6116002)(9686003)(86362001)(25786009)(6306002)(44832011)(486006); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0085; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: tZerxQDyzpZtlVX02M1k5eHl/HQnX2/XMEWZLHclXFrBtwizAOHmqYsQYbMQSnvgt512ZJJLRJRQ8TWILNjlqrE5sspYtjMBSHp49Z1c7mgX07R19Ngnv3bI8ac34NO/zvat72+v/+j9PkvIJI3pMxfSK5aBxNgu5jQ9GnyMSNZVDPf2OSxJHtXxsqASIH/BHmEOQXq0U2kvfwCQ2IPiMBESf09LYdzbG9Z4hgr3HqW2AgVES5EpKsXgeOm0xKbjvKvqe20Yy/RW+3NaXqEhpQpcgWys30n7zjAvXrk6qRwvG2TrwS5g6RsZih7tZAvvq+1GtqYY8HyaxdgZj6zYdyYO/td4YvhK6ZcdlMIdfUHFdlRn3xvxrDJs19WJR5qaEjzJyYr+DGLVtRytZoydEsNJ9S/Rh4PPT8JsH0eYd/A= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: d98a8b41-9f71-49f3-605a-08d6de3bf1ee X-MS-Exchange-CrossTenant-originalarrivaltime: 21 May 2019 22:30:36.1881 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0085 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 May 2019 22:30:44 -0000 SGVsbG8gUGFub3MsDQoNCkZvciB0aGUgZHJhZnQgdGV4dCBJIGhhdmUgYSBjb3VwbGUgb2YgbW9y ZSByZXZpZXcgcmVtYXJrczoNCg0KKiBwYWdlIDggZmlyc3QgYnVsbGV0OiBhIHByZXZpb3VzbHkg aXNzdWVzIGNsaWVudCBjZXJ0aWZpY2F0ZSBjb3VsZCBhbHNvIGV4cGlyZSwgaW4gc29tZSBjYXNl cyBldmVuIHdpdGhvdXQgdGhlIGNsaWVudCBrbm93aW5nLiBJZiB0aGUgY2xpZW50IHRoZW4gcGVy Zm9ybXMgc2ltcGxlIHJlLWVucm9sbG1lbnQgLS0gdXNpbmcgaXRzIHByZXZpb3VzIG9wZXJhdGlv bmFsIGNlcnQgYXMgYXV0aGVudGljYXRpb24sIHdoYXQgd291bGQgaGFwcGVuPyAgSSB3b3VsZCBl eHBlY3QgdGhlIHNlcnZlciBNQVkgYWxzbyB3YW50IHRvIHVzZSB0aGlzIGNlcnRpZmljYXRlIHRv IGF1dGhlbnRpY2F0ZSB0aGUgY2xpZW50LiBCZWNhdXNlIHRoZSBwdXJwb3NlIG9mIHRoZSBjbGll bnQgY29ubmVjdGluZyBhZ2FpbiB0byB0aGUgRVNUIHNlcnZlciBpcyB0byBkbyBzaW1wbGUgcmUt ZW5yb2xsbWVudCwgdG8gZ2V0IGEgbmV3IGNlcnRpZmljYXRlLiAgIFN1cHBvc2UgYSBjYXNlIHdo ZXJlIHRoZSBoYW5kc2hha2UgdG8gdGhlIEVTVCBzZXJ2ZXIgZmFpbHMgYmVjYXVzZSB0aGUgRVNU IHNlcnZlciByZWplY3RzIHRoZSBleHBpcmVkIG9wZXJhdGlvbmFsIGNlcnQ6ICB3aGF0IHdvdWxk IHRoZSBjbGllbnQgZG8gbm93PyBJdCBjb3VsZCBiZSBhIGNlcnRpZmljYXRlX2V4cGlyZWQgbWVz c2FnZS4gIFJGQyA3MDMwIHByb3ZpZGVzIG5vIGd1aWRhbmNlIGluIHRoaXMgbWF0dGVyOyB3b3Vs ZCBFU1QtY29hcHMgbmVlZCB0byBkZWZpbmUgdGhpcz8gRS5nLiBjbGllbnQgU0hPVUxEIHJldHJ5 IHVzaW5nIHRoZSBidWxsZXQgIzIgY2VydGlmaWNhdGUgKGUuZy4gSURldklEKT8NCg0KKiBwYWdl IDggbWlkZGxlOiAiQ29BUCBhbmQgRFRMUyBjYW4gcHJvdmlkZSBwcm9vZi1vZi1pZGVudGl0eSBm b3IgRVNULWNvYXBzIGNsaWVudHMgYW5kIHNlcnZlcnMgd2l0aCBzaW1wbGUgUEtJIG1lc3NhZ2Vz IGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDMuMSBvZiBbUkZDNTI3Ml0gIg0KTG9va2luZyB1cCB0 aGlzIHNlY3Rpb24gaXQgc2F5czogIlRoZSBTaW1wbGUgUEtJIFJlcXVlc3QgTVVTVCBOT1QgYmUg dXNlZCBpZiBhIHByb29mLW9mLWlkZW50aXR5IG5lZWRzIHRvIGJlIGluY2x1ZGVkLiIgICBUaGlz IHNlZW1zIHRvIHNheSB0aGUgb3Bwb3NpdGUgb2YgdGhlIGFib3ZlIHRleHQ/ICBUaGlzIHJlcXVp cmVzIGF0IGxlYXN0IHNvbWUgbW9yZSBleHBsYW5hdGlvbi4NCg0KKiBwYWdlIDggbWlkZGxlOiAi TW9yZW92ZXIsIGNoYW5uZWwtYmluZGluZyBpbmZvcm1hdGlvbiBmb3IgbGlua2luZyBwcm9vZi1v Zi1pZGVudGl0eSB3aXRoIGNvbm5lY3Rpb24tYmFzZWQgcHJvb2Ytb2YtcG9zc2Vzc2lvbiBpcyBP UFRJT05BTCBmb3IgRVNULWNvYXBzIiAgLT4gaXMgaXQgT1BUSU9OQUwgZm9yIGNsaWVudCwgc2Vy dmVyLCBvciBib3RoPyBJIHdvdWxkIGFzc3VtZSBpdCBpcyBPUFRJT05BTCBmb3IgYm90aC4gSWYg dGhlIChsaWdodC13ZWlnaHQpIGNsaWVudCBkb2VzIG5vdCBpbXBsZW1lbnQgaXQgYW5kIGlmIHRo ZSBzZXJ2ZXIgZG9lcyBtYW5kYXRlIGl0LCB0aGUgY2xpZW50IGNhbiBub3QgY29ubmVjdCB0byB0 aGF0IHNlcnZlciBpZiBpdHMgcG9saWN5IGlzIHNldCB0byAibGlua2luZyBQT1AvaWRlbnRpdHkg cmVxdWlyZWQiLg0KDQoqIHBhZ2UgMTQgdG9wIGJ1bGxldDogIlRoZSBDb0FQIE9wdGlvbnMgdXNl ZCBhcmUgLi4uLiAiIA0KICAtPiB0aGUgaXRlbSBCbG9jayBjb3VsZCBiZSBleHBhbmRlZCB0byAi QmxvY2sxLCBCbG9jazIiIHRvIGNhcHR1cmUgdGhlIGFjdHVhbCBPcHRpb24gbmFtZXMuDQogIC0+ IExvY2F0aW9uLVBhdGggaXMgbmV2ZXIgdXNlZCBpbiBhbnkgb2YgdGhlIENvQVAgaW50ZXJhY3Rp b25zIGRlZmluZWQ7IHNob3VsZCBiZSByZW1vdmVkLg0KDQoqIFBhZ2UgMTQgZmlyc3QgNS41IHBh cmFncmFwaDogIlNpbWlsYXJseSwgMi4wMSwgMi4wMiBvciAyLjA0IE1VU1QgYmUgdXNlZCBpbiBy ZXNwb25zZSB0byBFU1QgUE9TVCByZXF1ZXN0cyINCiAgLT4gMi4wMSBDcmVhdGVkIGlzIGxpa2Ug SFRUUCAyMDEsIHdoaWNoIGlzIG5vdCB1c2VkIGluIEVTVCAtIHNvIGNhbiBiZSByZW1vdmVkIGhl cmUuDQogIC0+IDIuMDIgRGVsZXRlZCBoYXMgbm8gSFRUUCBlcXVpdmFsZW50LCBzbyBpcyBub3Qg dXNlZCBpbiBFU1QuIEl0IHNob3VsZCBiZSByZW1vdmVkIGhlcmUuDQogIC0+IHRoYXQgbGVhdmVz IG9ubHkgMi4wNCByZXNwb25zZXMuIEhvd2V2ZXIgdGhlIHRleHQgc2hvdWxkIHNheSB0aGlzIGlz IGZvciBzdWNjZXNzZnVsIChIVFRQIDIwMCBvciAyMDIgaW4gRVNUKSByZXNwb25zZXMgLCBzbyBz dWdnZXN0aW9uIGlzIHRvIGNoYW5nZSBhYm92ZSBzZW50ZW5jZSB0bzogIlNpbWlsYXJseSwgMi4w NCBNVVNUIGJlIHVzZWQgaW4gYSByZXNwb25zZSB0byBhIHN1Y2Nlc3NmdWwgRVNUIFBPU1QgcmVx dWVzdCINCg0KKiBwYWdlIDE0IGJvdHRvbTogIkVTVCBtYWtlcyB1c2Ugb2YgSFRUUCAyMDQgYW5k IDQwNCByZXNwb25zZXMgd2hlbiBhIHJlc291cmNlIGlzIG5vdCAgYXZhaWxhYmxlIGZvciB0aGUg Y2xpZW50LiAgVGhlIGVxdWl2YWxlbnQgQ29BUCBjb2RlcyB0byB1c2UgaW4gYW4gRVNULWNvYXBz IHJlc3BvbnNlcyBhcmUgMi4wNCBhbmQgNC4wNC4gICINCiAgLT4gQ29BUCAyLjA0IGNhbiBvbmx5 IGJlIHVzZWQgaW4gcmVzcG9uc2VzIHRvIFBPU1Qgb3IgUFVUIHJlcXVlc3RzLCBub3QgZm9yIEdF VCByZXNwb25zZXMuDQogIC0+IHNvIGluIENvQVAgdGhlIHNlcnZlciBjb3VsZCBlaXRoZXIgcmV0 dXJuIDIuMDUgd2l0aCBlbXB0eSBwYXlsb2FkIChlcXVpdmFsZW50IHRvIEhUVFAgMjA0KSwgb3Ig cmV0dXJuIDQuMDQgKGVxdWl2YWxlbnQgdG8gSFRUUCA0MDQpDQoNCiogcGFnZSAxNSBib3R0b206 ICJUaGUgRVNULWNvYXBzIGNsaWVudCBhbmQgc2VydmVyIE1VU1Qgc3VwcG9ydCBCbG9jazIuICBC bG9jazEgTVVTVCBiZSBzdXBwb3J0ZWQgZm9yIEVTVC1jb2FwcyBlbnJvbGxtZW50IHJlcXVlc3Rz IHRoYXQgZXhjZWVkIHRoZSBQYXRoIE1UVS4iDQogIC0+IGNvdWxkIGJlIGNsYXJpZmllZCBiZXR0 ZXIsIEkgZXhwZWN0IGEgRVNULWNvYXBzIHNlcnZlciBNVVNUIHN1cHBvcnQgQmxvY2sxIGJlY2F1 c2UgdGhhdCBzZXJ2ZXIgZG9lc24ndCBrbm93IGluIGFkdmFuY2UgaG93IGJpZyB0aGUgY2xpZW50 J3MgcmVxdWVzdCBwYXlsb2FkIGlzIGdvaW5nIHRvIGJlIGFuZCB3aGV0aGVyIHRoYXQgY2xpZW50 IHdpbGwgdXNlIEJsb2NrMS4NCiAgLT4gZS5nLiAiVGhlIEVTVC1jb2FwcyBjbGllbnQgYW5kIHNl cnZlciBNVVNUIHN1cHBvcnQgQmxvY2syLiAgVGhlIEVTVC1jb2FwcyBzZXJ2ZXIgTVVTVCBzdXBw b3J0IEJsb2NrMS4gVGhlIEVTVC1jb2FwcyBjbGllbnQgTVVTVCBzdXBwb3J0IEJsb2NrMSBpZiBp dCBzZW5kcyBFU1QtY29hcHMgcmVxdWVzdHMgd2l0aCBhbiBJUCBwYWNrZXQgc2l6ZSB0aGF0IGV4 Y2VlZHMgdGhlIFBhdGggTVRVLiINCg0KKiBwYWdlIDE2IGV4YW1wbGU6IHRoZSBwYXlsb2FkcyBh cmUgbm90IGluZGljYXRpbmcgdGhhdCBlYWNoICJ7Q1NSIHJlcX0iIHBheWxvYWQgaXMgZGlmZmVy ZW50LiBJLmUuLCBhIGRpZmZlcmVudCBibG9jay4gSXQgd291bGQgYmUgbW9yZSBjbGVhciBpZiB0 aGF0IGlzIHNob3duIGUuZy4gIntDU1IgMX0iLCAie0NTUiAyfSIsIC4uLiB1cCB0byAie0NTUiBO MSsxfSIuIFRoZSAicmVxIiBzdHJpbmcgaXMgbm90IG5lZWRlZCBzaW5jZSB0aGUgUiBpbiBDU1Ig YWxyZWFkeSBzdGFuZHMgZm9yIHJlcXVlc3QuDQoNCiogcGFnZSAxNyBleGFtcGxlOiBzZWUgYWJv dmUgcGF5bG9hZHMgcmVtYXJrOyBhbmQgdGhlIGZvbGxvd2luZzoNCiAgLS0+IHdoYXQgSSBmaW5k IHN0cmFuZ2UgaGVyZSBpcyB0aGF0IGEgYmxvY2t3aXNlIFBPU1QgcmVxdWVzdCBlbmRzIHdpdGgg YSA1LjAzIHJlc3BvbnNlLCBhbmQgdGhlbiB0aGUgc2FtZSByZXF1ZXN0IGFmdGVyIHRoYXQgZ2l2 ZXMgYSAyLjAxIHJlc3BvbnNlLiBJbiBDb0FQIEFGQUlLLCBvbmUgcmVxdWVzdCBjYW4gbmV2ZXIg Z2l2ZSAyIHJlc3BvbnNlcyBpbiBzZXF1ZW5jZS4NCiAgLS0+IG9uY2UgYSByZXNwb25zZSBpcyBk ZWxpdmVyZWQgYmFjayB0byB0aGUgY2xpZW50IHBpZ2d5YmFja2VkIG9uIGFuIEFDSywgdGhlIHNl cnZlciBjbG9zZXMgdGhlIHRyYW5zYWN0aW9uIG5vcm1hbGx5IGFuZCBubyBmdXJ0aGVyIHN0YXRl IGZvciB0aGUgdHJhbnNhY3Rpb24gaXMga2VwdC4NCiAgLS0+IG5vcm1hbGx5IGlmIGEgc2VydmVy IHNlbmRzIDUuMDMgd2l0aCBNYXgtQWdlIHRoZSBjbGllbnQgbmVlZHMgdG8gc2VuZCBhIG5ldyBy ZXF1ZXN0IGkuZS4gcmV0cnkgd2l0aCBhIG5ldyByZXF1ZXN0IGFmdGVyIHRoaXMgd2FpdGluZyB0 aW1lLiAgIFRoYXQgaW1wbGllcyB0aGUgY2xpZW50IHdvdWxkIG5lZWQgdG8gcmVzZW5kIHRoZSBl bnRpcmUgcmVxdWVzdDogYWxsIGJsb2NrcyBvZiBpdCENCiAgLS0+IEkgZG8gcmVhbGl6ZSB0aGF0 IHJlc2VuZGluZyBhbGwgYmxvY2tzIGlzIHZlcnkgaW5lZmZpY2llbnQgOyBidXQgYXQgdGhlIHNh bWUgdGltZSB0aGUgZXhhbXBsZSBhbHNvIHNlZW1zIGluY29tcGF0aWJsZSB3aXRoIENvQVAgc3Bl Y3MuDQogIC0tPiBhbm90aGVyIHF1ZXN0aW9uIGlzIHdoeSBkb2VzIHRoZSBzZXJ2ZXIgdXNlIEJs b2NrMiBvcHRpb24gaW4gdGhlIDUuMDMgcmVzcG9uc2UgdGhhdCBoYXMgbm8gcGF5bG9hZC4gSW4g UkZDIDc5NTkgU2VjdGlvbiAyLjEsICJ0aGUgQmxvY2syIE9wdGlvbiBwZXJ0YWlucyB0byB0aGUg cmVzcG9uc2UgcGF5bG9hZCIgYW5kICJwYXlsb2FkLWJlYXJpbmcgcmVzcG9uc2VzIi4gU28gaXQg c2hvdWxkIGJlIGp1c3QgbGVmdCBvdXQgaW4gdGhlIHJlc3BvbnNlIHdpdGhvdXQgcGF5bG9hZCBJ IHRoaW5rLg0KICAtLT4gSSB1bmRlcnN0YW5kIHRoaXMgc2VxdWVuY2Ugb2YgbWVzc2FnZXMgd2Fz IHRlc3RlZCB1c2luZyBpbnRlcm9wcy9jb2RlOyB3YXMgYSBzcGVjaWZpYyBDb0FQIGxpYnJhcnkg dXNlZCB0aGF0IGV4aGliaXRzIHRoaXMgYmVoYXZpb3I/IEkgd291bGQgYmUgaW50ZXJlc3RlZCB0 byB1bmRlcnN0YW5kIGJldHRlciB3aHkgdGhpcyB3b3Jrcy4NCg0KSG9wZSB0aGVzZSBjb21tZW50 cyBjYW4gc3RpbGwgYmUgdXNlZCBmb3IgaW1wcm92ZW1lbnQgb2YgdGhlIHNwZWMuIEkgd2lsbCBz ZW5kIGZ1cnRoZXIgcmV2aWV3IGNvbW1lbnRzIGluIGEgbmV4dCBlbWFpbDogc3RpbGwgbmVlZCB0 byB3cml0ZSB0aGVzZSBkb3duLg0KDQpCZXN0IHJlZ2FyZHMNCkVza28NCg0KDQoNCi0tLS0tT3Jp Z2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBr YW1wYW5hQGNpc2NvLmNvbT4gDQpTZW50OiBNb25kYXksIE1heSAyMCwgMjAxOSAxNzozMQ0KVG86 IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPjsgYWNlQGlldGYub3JnDQpT dWJqZWN0OiBSRTogW0FjZV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEu dHh0DQoNClRoYW5rcyBFc2tvLiANCg0KQWRkcmVzc2VkIGluIGh0dHBzOi8vZ2l0aHViLmNvbS9T YW5LdW1hcjIwMTUvRVNULWNvYXBzL2Jsb2IvODRjZTBjMWQ1ZTc2OGQ0MGU5NzE4NDIxNGJhZTQw NGRhMjFiZDA1MC9kcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC54bWwgVHdvIGNvbW1lbnRzOiANCg0K PiBwYWdlIDExIGJvdHRvbSByZXF1aXJlbWVudDogIiBUaGUgY2xpZW50IFNIT1VMRCB1c2UgcmVz b3VyY2UgZGlzY292ZXJ5IHdoZW4gaGUgaXMgdW5hd2FyZSBvZiB0aGUgYXZhaWxhYmxlICBFU1Qt Y29hcHMgcmVzb3VyY2VzLiIgLSB3aGVuIGFuIEVTVCBzZXJ2ZXIgaXMga25vd24sIHRoaXMgcmVx dWlyZW1lbnQgZG9lcyBub3QgcmVhbGx5IGFwcGx5IHNpbmNlIHRoZSBzZXJ2ZXIgYWx3YXlzIHN1 cHBvcnRzIC53ZWxsLWtub3duIEVTVCByZXNvdXJjZXMuICBTbyBJIHJlYWQgaXQgYXMgZG9pbmcg YW4gUkQgZGlzY292ZXJ5IG9yIG11bHRpY2FzdCBDb0FQIGRpc2NvdmVyeSBpZiB0aGUgY2xpZW50 IGRvZXNuJ3Qga25vd24gdGhlIEVTVCBzZXJ2ZXIgYWRkcmVzcy4gIEhvcGUgdGhpcyBpcyBjbGVh ciBlbm91Z2ggaW4gdGhlIHRleHQgYW5kIGludGVuZGVkPw0KDQpUaGVyZSBhcmUgb3B0aW9uYWwg cmVzb3VyY2VzIGxpa2UgL2F0dCwgL3NrZyBhbmQgL3NrYyB0aGF0IHRoZSBzZXJ2ZXIgZG9lcyBu b3QgaGF2ZSB0byBzdXBwb3J0LCBzbyB0aGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVm ZXJyaW5nIHRvLiANCg0KPiBwYWdlIDExIGJvdHRvbTogIiBJdCBpcyB1cCB0byB0aGUgaW1wbGVt ZW50YXRpb24gdG8gY2hvb3NlIGl0cyByZXNvdXJjZSBwYXRoc+KAnSAtPiBzZWVtcyBub3QgcmVh bGx5IHRoZSBjYXNlLCBiZWNhdXNlIHRoZSByb290IHJlc291cmNlIHN0cnVjdHVyZSBpcyBmb3Jj ZWQgYnkgdGhlIHNwZWNpZmljYXRpb24uIEl0IGNvdWxkIGhhdmUgYmVlbiBkZXNpZ25lZCBhcyBm cmVlIGNob2ljZSAoYmVjYXVzZSBpdCBjYW4gYmUgZGlzY292ZXJlZCBhbnl3YXkpIGJ1dCBpdCBp cyBub3QuDQoNClRoZSB0ZXh0IHNheXMgdGhhdCB0aGUgc2VydmVyIE1VU1Qgc3VwcG9ydCB0aGUg ZGVmYXVsdCAvLndlbGwta25vd24vZXN0IHJvb3QgcmVzb3VyY2UgYW5kIGl0IFNIT1VMRCBzdXBw b3J0IHJlc291cmNlIGRpc2NvdmVyeSBmb3Igbm9uLWRlZmF1bHQgVVJJcyAobGlrZSAvZXN0IG9y IC9lc3QvQXJiaXRyYXJ5TGFiZWwpIG9yIHBvcnRzLiBJbiB0aGUgbGF0dGVyIGNhc2UgaXQgaXMg dXAgdG8gdGhlIHNlcnZlciB0byBkZWNpZGUgdGhlIHBhdGhzIGhlIG1ha2VzIGl0cyByZXNvdXJj ZXMgYXZhaWxhYmxlIGF0LiBUaGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVmZXJyaW5n IHRvLiBCdXQgeW91IGFyZSByaWdodDsgSSByZWFsaXplZCB0aGF0IHRoaXMgc2VudGVuY2UgaXMg cmVkdW5kYW50IHNvIEkgb25seSBrZXB0ICJUaHJvdWdob3V0IHRoaXMgZG9jdW1lbnQgdGhlIGV4 YW1wbGUgcm9vdCByZXNvdXJjZSBvZiAvZXN0IGlzIHVzZWQuIg0KDQpXaWxsIHJldXBsb2FkIHRo ZSBuZXh0IGl0ZXJhdGlvbiBpbiBhIGZldyBkYXlzLiANCg0KUmdzLA0KUGFub3MNCg0KDQo= From nobody Wed May 22 14:58:42 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7F5A12008C; Wed, 22 May 2019 14:58:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EFfrkIadmGRT; Wed, 22 May 2019 14:58:39 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 24CFD12004A; Wed, 22 May 2019 14:58:39 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 22 May 2019 14:58:32 -0700 From: Jim Schaad To: CC: Date: Wed, 22 May 2019 14:58:28 -0700 Message-ID: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdUQzMqhylusiqU3Ql2wSCD6gJTtgw== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 May 2019 21:58:42 -0000 Thanks for the updates from my last message. This has helped quite a bit. 1. A discussion of the use of raw public keys rather than certificates for the server may be in order. This can refer to the same RPK issues from the current DTLS document. It may also be that this just uses normal certificate processing and that should be noted as well, but some discussion of deciding if the subject name/alt name matches the token returned from the AS. For the connect message there are a couple of issues that need to be thought about. 2. What items are required to be in the connect message. The response to my last message suggested that a client identifier is required to be present but that is not documented. 3. It is not completely clear what portions of the CONNECT message are being covered by the signature/MAC value. As an example, is the password field omitted entirely or is it set to a zero length password. In addition to this, from the couple of implementations that I have looked at the entire packet is not passed out of the base server code for authentication purposes. This might need to be taken into account in terms of what is used for the body and how it is constructed. (As a side note, the implementations that I have looked at so far also think that the password is a text string rather than a binary value which is going to be a short term issue as well.) 4. I must admit that I am disappointed that there is no challenge response mechanism in the MQTT specifications. I don't know that anything can be done at this point about it but there are some security issues that need to be highlighted because of this in the security considerations section. Only the v3 seems to have this problem. Also doing the channel binding would deal with this problem as well. Might just need some general discussions around the channel binding text. 5. Is there an intention to provide a "standard" format for the scope field or just to leave it as ad hoc? 6. It might be reasonable in section 2.1.3 to note that even if a result is cached, that cached check should be limited for a specific amount of time to recheck if the token is still active. More of an issue in terms of how long to cache for introspection. 7. In section 2.1.4 - I would presume that the last paragraph should be extended to say that the token is stored only for the length of the connection. That is the token always needs to be supplied every time a connect message is sent. Jim From nobody Wed May 22 23:29:13 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 362CD12012A for ; Wed, 22 May 2019 23:29:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSWhqRiM0Y8f for ; Wed, 22 May 2019 23:29:09 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30046.outbound.protection.outlook.com [40.107.3.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77A171200D6 for ; Wed, 22 May 2019 23:29:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector2-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oVCcx30akh19EcYM7B/Nuf0pY4jl22S16HBGeS7v8Nw=; b=Skga9rcvWtyAsEg0B+jP3pHvxGaLqsXL8e9LxRJ9cOKV0HpW0K1UDzAU996DMXdPecVRjlKJlcKqTSI7+72u6/McDjgeF0UzZdyEE7PruvQcaWIAzsohf/aZJxOfmulrprFVdjaX5Bh5fWSIc4K+mhqVsf+mYFhnIYQhkh8qnfQ= Received: from DB6P18901CA0011.EURP189.PROD.OUTLOOK.COM (2603:10a6:4:16::21) by AM5P189MB0323.EURP189.PROD.OUTLOOK.COM (2603:10a6:206:20::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.16; Thu, 23 May 2019 06:29:05 +0000 Received: from HE1EUR02FT018.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::203) by DB6P18901CA0011.outlook.office365.com (2603:10a6:4:16::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1922.15 via Frontend Transport; Thu, 23 May 2019 06:29:05 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT018.mail.protection.outlook.com (10.152.10.248) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.1922.16 via Frontend Transport; Thu, 23 May 2019 06:29:04 +0000 Received: from [10.112.134.122] (10.100.0.158) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 23 May 2019 08:29:04 +0200 To: References: <001901d50e05$74847200$5d8d5600$@augustcellars.com> From: Ludwig Seitz Message-ID: <1438cd8c-0322-a83b-4635-cbf8ea85102a@ri.se> Date: Thu, 23 May 2019 08:28:51 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090003060209060703080207" X-Originating-IP: [10.100.0.158] X-ClientProxiedBy: sp-mail-2.sp.se (10.100.0.162) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(376002)(136003)(346002)(396003)(39850400004)(2980300002)(189003)(199004)(76176011)(53936002)(53546011)(386003)(33964004)(478600001)(6246003)(31686004)(16526019)(106002)(26005)(77096007)(486006)(336012)(126002)(476003)(2616005)(11346002)(446003)(6116002)(3846002)(186003)(44832011)(71190400001)(22756006)(568964002)(6666004)(40036005)(74482002)(235185007)(356004)(84326002)(68736007)(22746008)(65806001)(65956001)(5660300002)(69596002)(70586007)(2351001)(70206006)(64126003)(65826007)(305945005)(7736002)(2906002)(58126008)(16576012)(16586007)(81166006)(8676002)(36756003)(14444005)(5024004)(6916009)(229853002)(86362001)(316002)(31696002)(81156014)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5P189MB0323; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9bfb5326-7329-4144-db3d-08d6df47f3e2 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4709054)(2017052603328)(7193020); SRVR:AM5P189MB0323; X-MS-TrafficTypeDiagnostic: AM5P189MB0323: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 00462943DE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: HTVBV/4Bm4dY/CdPy/06I0Z1D6eyred/uNW1IJ7SrfR+B5uVJ+rv8zhNbO1L1ApTZRbjyJD/C80BbbXBzUqjuVDjNxH5Zu4va6pZ6nquhwgHBHIpD+IFLYyh+DWkrmJ9fieNE/nDv4uCSJxl48gf+rN+ahXtLNP8Vw6P7G/C/QU2R/hkAAfCbLHhSmpBwXlnpgeAfnbPXHQ5cDLhQ+N2t4PBxWAwZo93X1ve8Qw6ro3h2TlfvWzRdzAgvKI+48ngoJhw2zarclm5PS1Uklv1/y8SiltoFzdLZq9cIWX2yuueIzJpzDkyTO34P2xsIkpWf/RlQ4sUfsGP8tzt93AyG2Ceth5kHagdzwHIm74vw5RxbADTHx3ZzKJ4MKhAG/tR+V18YZZzCqM4zyZAolgRCYG22zxMMtaMsK3OrAU+C94= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2019 06:29:04.6176 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 9bfb5326-7329-4144-db3d-08d6df47f3e2 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P189MB0323 Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile connections X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 May 2019 06:29:12 -0000 --------------ms090003060209060703080207 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 21/05/2019 22:35, Cigdem Sengul wrote: > Thank you for your comments. =C2=A0I see that we tried to cover too man= y=20 > options in the draft, and things got mixed up.I tried to clarify inline= =2E >=20 > * So as a client I get a token from the AS.=C2=A0 For the first run= , > assume that > it has a RPK in it. > * I now connect to the server using TLS. > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Question #1 - Am I doing client authen= tication at this > point in TLS? > This is what is happening for all of the current profiles, but it i= s not > clear that this is happening for this profile.=C2=A0 The answer app= ears to be > both yes and no. >=20 > The basic method we were thinking: >=20 >=20 > 1. We have not assumed client-side certificates for authenticating > clients during TLS handshake. RS uses a server-side certificate. One quick question: If I understand it correctly there is a variant of=20 MQTT using UDP (MQTT-SN). Since TLS and TCP are not exactly=20 "constrained-friendly", would it make sense to look at that as well to=20 define a "MQTT-SN-over-DTLS-based" profile? /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms090003060209060703080207 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MDUyMzA2 Mjg1MVowLwYJKoZIhvcNAQkEMSIEIIazdSagD8MaUg1J26l9Ws19eM9ChZhVi1kDKm52WuuQ MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAd5rP8niEPDw6NQQ6Qw0QPGcUOEcawX3eze86pw47L3E/ DNm2P2EKDmXc9VxHzEpRESoBEZjJCjJnsJY2MaMW9JACPOvWQIePMP+UR9j+9FceE/lZDMuI aBGGkuPrRFfaPyPgbGZZFaYBS0aHx3FcaqriuY9n9Y3paBbwBlTfq0kWamc5Iz4AMR0eH6y4 2Yz18vziBqhPbV8qeQN7XiijX5Y2nXPuwhmJBRcDcirAlLJsKJUU6XKLCdGxqJGvC8vgajgO H4/McNS7MB/Tq3Jjsr+P3kq3WLGvq3NY5pYWE4np+pgZKPEarksOMMZu6aNAqW7WhMgKzb1z vOyPbeZTNAAAAAAAAA== --------------ms090003060209060703080207-- From nobody Wed May 22 23:39:52 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0639F1200F7 for ; Wed, 22 May 2019 23:39:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TmtI-hCrJojM for ; Wed, 22 May 2019 23:39:47 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80043.outbound.protection.outlook.com [40.107.8.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F19E1200D6 for ; Wed, 22 May 2019 23:39:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector2-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k5mEkkEGaxNx8vqXboukrTdqTzo+AsI6RNc/wOhf6Ms=; b=OBBNCZ5jMPYReOhI9hR3HqbM20e3G30l4Bk1COVNBlxXjYjnqX1+JLYPv36CvRL7T5J1pEZPKpC1oBa/vyLHbFcqvRehUKOmYkm9j/iXXNjqptpunnU5qiLC7H69FVCcbGHQHl2Nnxe7g9hh54eMxLqDzasYMiPImYMhrRo9NWY= Received: from HE1P189CA0002.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:53::15) by DB6P189MB0469.EURP189.PROD.OUTLOOK.COM (2603:10a6:6:3d::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.18; Thu, 23 May 2019 06:39:44 +0000 Received: from HE1EUR02FT033.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::209) by HE1P189CA0002.outlook.office365.com (2603:10a6:7:53::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1922.16 via Frontend Transport; Thu, 23 May 2019 06:39:43 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT033.mail.protection.outlook.com (10.152.10.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.1922.16 via Frontend Transport; Thu, 23 May 2019 06:39:43 +0000 Received: from [10.112.134.122] (10.100.0.158) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 23 May 2019 08:39:42 +0200 To: References: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> From: Ludwig Seitz Message-ID: <6a333a08-1c05-1de3-9a9c-eef3866f730b@ri.se> Date: Thu, 23 May 2019 08:39:42 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000703020706080107060802" X-Originating-IP: [10.100.0.158] X-ClientProxiedBy: sp-mail-2.sp.se (10.100.0.162) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(396003)(39850400004)(376002)(136003)(346002)(2980300002)(199004)(189003)(386003)(76176011)(33964004)(58126008)(53546011)(7736002)(40036005)(22756006)(336012)(74482002)(235185007)(106002)(53936002)(22746008)(2351001)(305945005)(5000100001)(44832011)(446003)(476003)(65806001)(31686004)(11346002)(478600001)(126002)(65956001)(486006)(14444005)(5024004)(5660300002)(2616005)(966005)(568964002)(316002)(16576012)(6116002)(3846002)(229853002)(2906002)(6916009)(16586007)(31696002)(36756003)(64126003)(69596002)(71190400001)(65826007)(68736007)(356004)(86362001)(8936002)(26005)(16526019)(6306002)(84326002)(8676002)(77096007)(70206006)(6246003)(186003)(70586007)(81156014)(81166006); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6P189MB0469; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c8a4433d-9808-4730-a3df-08d6df497080 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4709054)(2017052603328)(7193020); SRVR:DB6P189MB0469; X-MS-TrafficTypeDiagnostic: DB6P189MB0469: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-Forefront-PRVS: 00462943DE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: MJnx9OETFjVFTDgZg5dzBPvnfCrMgZJ8I6SgZpTrezinJdJEYlDZ7+xgYZOgRPtdDq8XydUZG404nP5R7qcv2l+hnT1k0xbpEQ0IcwqGYLJegLS2tkFs6F/HCzq3XVu3JxV2iNNPV4VUxYg5II20F2jInw5C0j/MrbIlR4KaolJ/vW2vA3rDifzKCxEND2cI6wR70NdLgaiKlJJk6okkf+Z2WSTLem+w+ofeB/ct/KkZbz+3bWo5Gvo12+ax45xe0ZYQ2ub8mHfFuU4uDXe56DKwTDeK2MyyvzHAv8A7WsmzMI95YBlolqzHio8cVi2WkXdew0bTqn31LEf/b+SHHgn+ON7BWnm9mhOoFxUBLVuh4QgG58EV3E/yelIyDedydmGDUZCnqYNqm7qiij81WELwzFs+dr7ixfccUvtD4DY= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2019 06:39:43.1848 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c8a4433d-9808-4730-a3df-08d6df497080 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P189MB0469 Archived-At: Subject: Re: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 May 2019 06:39:50 -0000 --------------ms000703020706080107060802 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 22/05/2019 23:58, Jim Schaad wrote: >=20 > 5. Is there an intention to provide a "standard" format for the scope = field > or just to leave it as ad hoc? I would be very much in favor of this, or at least provide guidelines to = avoid adding to this: https://www.brandur.org/oauth-scope /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms000703020706080107060802 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MDUyMzA2 Mzk0MlowLwYJKoZIhvcNAQkEMSIEILFD7dytN6DkBQIBDPUEy5mW7ja/a15QOk8XPJZhKrmj MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAOluHLvWF8N2eRf+3Sv5BztT5GXQYervZreNqXQD5V8F7 IfSoQrFVMgb2rLzkKE/+sn2kU9xKpwhFGNkfrE3DEVYTLBaYGkE3wNqxoqaGKhvCRPZ4ihDU tZoQAhm0aGyc8jhlV434691DUt/BgZwq5IYRWy27xnJGQRxC/BKHVM4O1pMu/cjzjnvj64qV wxHOrvz4uxGscByFNO3vKv1Jzt32vmgyJ+yE8C1DcLt+JwYkBWa/qkf+67snVacklntoampJ 384jIeeRSwCrOfzvS2JHPw6naBoDtuhnWGg6/QujL/nSqugJ3ZRl7ZKfOBJAu1A3H+94odqI aEzbpF7YzgAAAAAAAA== --------------ms000703020706080107060802-- From nobody Thu May 23 01:34:00 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BA6412016B for ; Thu, 23 May 2019 01:33:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oBo4cjUvwmfB for ; Thu, 23 May 2019 01:33:56 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98EF012008A for ; Thu, 23 May 2019 01:33:56 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id m32so5776603qtf.0 for ; Thu, 23 May 2019 01:33:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FJRq71JJK5xSfydswQpswBXYAQvCFoUp1mczBEuMDfs=; b=Uc9060ocSqkDEd/Cl5yMjhSTlPku5ThcFT3I3UTpQ0YD+bnH65GmPP/ElLGf4ME5Z7 g7JEY9S6LBzQpIDfJO4aNHooG8UfHPxoRM236Ar72rVFLqNHmaN8fzU1qNt0NKnsQDoj 4kK7ihX9W+02AIVcPUP7Y5Jw6dPT026Y5EpJuHQ/d7BCGPjy3VQa/1OcTNhRmzZ/5crJ 0Tj0+ht9P9BCBuhSP+cBu8z+9XouoIJvP+ryzmS8Eb2lH9Uk2vOtHYK1+qmASlwwKDAo J+6p95Jfpvt1PpsjFLyZO4M6E8/osEn/T0gcScnxuM1rwrhpJVgQNjS/bGJzkFRMHlsR UW1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FJRq71JJK5xSfydswQpswBXYAQvCFoUp1mczBEuMDfs=; b=CiPO26m59RdlU7gaUSRrb9fqqH5yRaxItjrKnl9SGm89YgbeVrFCZ1T7PztWMk0HZS nM0sEYWlYnzy20j7Vc7KD+zuEqF0T8Byg0KxVtTY3LE/Gtt+6VhjH+0A03/w5rZMSmoi ihyngRq7UyosNyIgGje3vave0TpPVDSJLfkA0l3UqkyPaf8NdfKnaE3Gt8AtIabJvZDw XvuibzyqqkyRooN597WJAtXc8zl5DOivBftaI7tae+MTiIrkn6yXTEiiSiUA+7F/gqvt wBPXB07IE2ER3Eeao5czbDiWjEg/R6tjVW55a+6641pOyMeLVAJ8dFJPzGYLgmA3eiGS yn/g== X-Gm-Message-State: APjAAAVPkLrHteGqpH3c0WG4+Wp4IyhHyGDcdk8xpz8H62dBFpeUZVB3 bRSSzJgEFYD6jzyhsDxqb3+9qEiO5zwpZn4Yk1A= X-Google-Smtp-Source: APXvYqxA/nySvy3MQgtHl4+pb0izw59r0ohm0qqfb2H+EVJ8zMHdpi5PSurdkdHETNODKiT0/Uh6Y2q1S8G/bT9xp7c= X-Received: by 2002:a0c:f350:: with SMTP id e16mr76442899qvm.72.1558600435771; Thu, 23 May 2019 01:33:55 -0700 (PDT) MIME-Version: 1.0 References: <001901d50e05$74847200$5d8d5600$@augustcellars.com> <1438cd8c-0322-a83b-4635-cbf8ea85102a@ri.se> In-Reply-To: <1438cd8c-0322-a83b-4635-cbf8ea85102a@ri.se> From: Cigdem Sengul Date: Thu, 23 May 2019 09:33:44 +0100 Message-ID: To: Ludwig Seitz Cc: ace@ietf.org Content-Type: multipart/alternative; boundary="000000000000522bfe058989f125" Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile connections X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 May 2019 08:33:59 -0000 --000000000000522bfe058989f125 Content-Type: text/plain; charset="UTF-8" Hello Ludwig, This was MQTT-SN-over-DTLS was on our agenda when first we started out. However, at that time there was not much take-up of MQTT-SN in practice (not sure that changed). If there is sufficient interest in the group, would make sense to do that as well, and theoretically, it would be a more natural fit to ACE. Thanks, --Cigdem On Thu, May 23, 2019 at 7:29 AM Ludwig Seitz wrote: > On 21/05/2019 22:35, Cigdem Sengul wrote: > > Thank you for your comments. I see that we tried to cover too many > > options in the draft, and things got mixed up.I tried to clarify inline. > > > > * So as a client I get a token from the AS. For the first run, > > assume that > > it has a RPK in it. > > * I now connect to the server using TLS. > > Question #1 - Am I doing client authentication at this > > point in TLS? > > This is what is happening for all of the current profiles, but it is > not > > clear that this is happening for this profile. The answer appears > to be > > both yes and no. > > > > The basic method we were thinking: > > > > > > 1. We have not assumed client-side certificates for authenticating > > clients during TLS handshake. RS uses a server-side certificate. > > > > One quick question: If I understand it correctly there is a variant of > MQTT using UDP (MQTT-SN). Since TLS and TCP are not exactly > "constrained-friendly", would it make sense to look at that as well to > define a "MQTT-SN-over-DTLS-based" profile? > > /Ludwig > > > -- > Ludwig Seitz, PhD > Security Lab, RISE > Phone +46(0)70-349 92 51 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000522bfe058989f125 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Ludwig,=C2=A0

This was MQTT-SN-ov= er-DTLS was on our agenda when first we started out.=C2=A0
Howeve= r, at that time there was not much take-up of MQTT-SN=C2=A0 in practice (no= t sure that changed). If there is sufficient interest in the group, would m= ake sense to do that as well, and theoretically, it would be a more natural= fit to ACE.=C2=A0
Thanks,
--Cigdem=C2=A0
On Thu, = May 23, 2019 at 7:29 AM Ludwig Seitz <ludwig.seitz@ri.se> wrote:
On 21/05/2019 22:35, Cigdem Sengul wrote:
> Thank you for your comments.=C2=A0 I see that we tried to cover too ma= ny
> options in the draft, and things got mixed up.I tried to clarify inlin= e.
>
>=C2=A0 =C2=A0 =C2=A0* So as a client I get a token from the AS.=C2=A0 F= or the first run,
>=C2=A0 =C2=A0 =C2=A0assume that
>=C2=A0 =C2=A0 =C2=A0it has a RPK in it.
>=C2=A0 =C2=A0 =C2=A0* I now connect to the server using TLS.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Question #1 - Am I doi= ng client authentication at this
>=C2=A0 =C2=A0 =C2=A0point in TLS?
>=C2=A0 =C2=A0 =C2=A0This is what is happening for all of the current pr= ofiles, but it is not
>=C2=A0 =C2=A0 =C2=A0clear that this is happening for this profile.=C2= =A0 The answer appears to be
>=C2=A0 =C2=A0 =C2=A0both yes and no.
>
> The basic method we were thinking:
>
>
>=C2=A0 1. We have not assumed client-side certificates for authenticati= ng
>=C2=A0 =C2=A0 =C2=A0clients during TLS handshake. RS uses a server-side= certificate.



One quick question: If I understand it correctly there is a variant of
MQTT using UDP (MQTT-SN). Since TLS and TCP are not exactly
"constrained-friendly", would it make sense to look at that as we= ll to
define a "MQTT-SN-over-DTLS-based" profile?

/Ludwig


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--000000000000522bfe058989f125-- From nobody Thu May 23 04:20:57 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCF0C1200C7; Thu, 23 May 2019 04:20:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b2PZePyOT_1y; Thu, 23 May 2019 04:20:52 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E487120019; Thu, 23 May 2019 04:20:52 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id t1so6180989qtc.12; Thu, 23 May 2019 04:20:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=geK7DfoAj9IPFDHqca07qRAv6f7QZuy6GQLiTaNktvQ=; b=lUqm72IdVBLeJ8DG4ylhYJg0ie3WI+c8jNCaCj7YXUsTaGvQVseRSawY6HWz+Io8YQ 74YJAUFUgr+Ed5hsAKAtX6arDlHJPxEHQ9ceXJPPq8Rdvqp8q2SjJ21DXx+Jb0MgknB3 DnJvolPtIzlhR3L2NlyNuqcbPan5mMoKgT6QrJcm87F5PKyhtjm1eRFoAyu3yvFIx8ua Knc3ORoxBzw5t/osI6iM1MFuSSPsEuWu+UuB0fxJRd3h9W8GyoGYviULir4C6bTlMyFW hLp+MfXkapJ9Qdpg4wqf3HUf8LB0JwMOI13m/UBtCk5lymQvZnMNTsdtJeYvvdAiNWai oUFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=geK7DfoAj9IPFDHqca07qRAv6f7QZuy6GQLiTaNktvQ=; b=nB2231nzDCB/IHUCxmeiKHgFzkqNo5BEKQhUtaiGU52b0KZPuCUebV+WmVEpl67JMo KtzKdKXRo0d5zaZelQEM5uWWIAoNrrfrhji7hBRXMl5HIjsjA7mMtsGw7DE48E1Hqc5R Knc2HJeAoyCqePqYu1hI6GtFLkCkJdAIWFSQ1X1gHjLtnMzLZ60q6e+DOracOgbyF1mO YH+5d6f1Qs1dMj+YESMTbvxuVOqTCYmyMKTrrCBU6rySfqJEq0QF0qG/O2aVDfoQ238Z doLPuup3g0kZgptYOjVDJqXchMG5mL7X9UP8FT9sFSU5jxaf61UssfmCqBFm/UfiuR0t EpiA== X-Gm-Message-State: APjAAAU0QGk63fZm29RNl32v1zpxUt4WAiKKYdUtJIuxMyiaYxENs+lt uJzqWqPKhXNdXg1qRbOSTFz3Qn39a0m2Pkb+fZG7ehaZvNw= X-Google-Smtp-Source: APXvYqyZ3TDGEET7kBaPN8Lcv8QnHwNaS50eA5hBM4SWJkh9qzRGXOFVDbRLD0t7+ziKRpBKs1QxuQ/eb8IuVKFV7sA= X-Received: by 2002:ac8:2f98:: with SMTP id l24mr45762559qta.78.1558610451216; Thu, 23 May 2019 04:20:51 -0700 (PDT) MIME-Version: 1.0 References: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> In-Reply-To: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> From: Cigdem Sengul Date: Thu, 23 May 2019 12:20:40 +0100 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, ace@ietf.org Content-Type: multipart/alternative; boundary="00000000000049bcdb05898c46ca" Archived-At: Subject: Re: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 May 2019 11:20:55 -0000 --00000000000049bcdb05898c46ca Content-Type: text/plain; charset="UTF-8" Thank you, Jim, for the comments. I have created issues corresponding to each one in the GitHub repository. We will start working on them, and specifically clarify the issues 1-3 around the CONNECT message. For 4, MQTT v5 can support a challenge-response; not possible with v3 indeed. Will expand the security considerations section on that. 5. We described a convention in the draft with SHOULD. Do we turn that into a MUST? 6. We thought that the AS would dictate the token expiration time. It can also be done that RS times out tokens even if they have not expired. But, security-performance trade-off should be considered. Token caching is important even if the token does not need introspection. The only time the MQTT client can push a token is with the CONNECT message (all subsequent publish/subscribe messages rely on this). In MQTT v5, a client can push a new token via reauthentication during an ongoing session (enabled by MQTT v5). If RS times out the token, this means a disconnection in MQTT v3. We mention this in Security considerations as "it is expected that AS follows a reasonable expiration strategy for access tokens" -->There may be workarounds designed especially MQTT v5 which has better support for request-response style communication. But need to think about it. 7. That is correct. Will add the clarification. Thanks, --Cigdem On Wed, May 22, 2019 at 10:58 PM Jim Schaad wrote: > Thanks for the updates from my last message. This has helped quite a bit. > > 1. A discussion of the use of raw public keys rather than certificates for > the server may be in order. This can refer to the same RPK issues from the > current DTLS document. It may also be that this just uses normal > certificate processing and that should be noted as well, but some > discussion > of deciding if the subject name/alt name matches the token returned from > the > AS. > > For the connect message there are a couple of issues that need to be > thought > about. > > 2. What items are required to be in the connect message. The response to > my last message suggested that a client identifier is required to be > present > but that is not documented. > > 3. It is not completely clear what portions of the CONNECT message are > being covered by the signature/MAC value. As an example, is the password > field omitted entirely or is it set to a zero length password. In addition > to this, from the couple of implementations that I have looked at the > entire > packet is not passed out of the base server code for authentication > purposes. This might need to be taken into account in terms of what is > used > for the body and how it is constructed. (As a side note, the > implementations that I have looked at so far also think that the password > is > a text string rather than a binary value which is going to be a short term > issue as well.) > > 4. I must admit that I am disappointed that there is no challenge response > mechanism in the MQTT specifications. I don't know that anything can be > done at this point about it but there are some security issues that need to > be highlighted because of this in the security considerations section. > Only > the v3 seems to have this problem. Also doing the channel binding would > deal with this problem as well. Might just need some general discussions > around the channel binding text. > > 5. Is there an intention to provide a "standard" format for the scope > field > or just to leave it as ad hoc? > > 6. It might be reasonable in section 2.1.3 to note that even if a result > is > cached, that cached check should be limited for a specific amount of time > to > recheck if the token is still active. More of an issue in terms of how > long > to cache for introspection. > > 7. In section 2.1.4 - I would presume that the last paragraph should be > extended to say that the token is stored only for the length of the > connection. That is the token always needs to be supplied every time a > connect message is sent. > > Jim > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --00000000000049bcdb05898c46ca Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thank you, Jim, for the comments.=C2=A0
I have created= issues corresponding to each one in the GitHub repository.=C2=A0

We will start working on them, and specifically clarify the= issues 1-3 around the CONNECT message.=C2=A0

For = 4, MQTT v5 can support a challenge-response; not possible with v3 indeed. W= ill expand the security considerations section on that.=C2=A0
5.=C2=A0 We described a convention in the draft with SHOULD. Do= we turn that into a MUST?=C2=A0

6. We thought tha= t the AS would dictate the token expiration time. It can also be done that = RS times out tokens even if they have not expired. But, security-performanc= e trade-off should be considered.=C2=A0
Token caching is importan= t even if the token does not need introspection. The only time the MQTT cli= ent can push a token is with the CONNECT message (all subsequent publish/su= bscribe messages rely on this). In MQTT v5, a client can push a new token v= ia reauthentication during an ongoing session (enabled by MQTT v5). If RS t= imes out the token, this means a disconnection in MQTT v3. We mention this= =C2=A0 in Security considerations as "it is expected that AS foll= ows a reasonable expiration strategy for access tokens"
<= div>
-->There may be workarounds designed especially MQTT = v5 which has better support for request-response style communication. But n= eed to think about it.=C2=A0

7. That is correct. W= ill add the clarification.=C2=A0

Thanks,
--Cigdem=C2=A0



On Wed, M= ay 22, 2019 at 10:58 PM Jim Schaad <ietf@augustcellars.com> wrote:
Thanks for the updates from my last message.=C2= =A0 This has helped quite a bit.

1.=C2=A0 A discussion of the use of raw public keys rather than certificate= s for
the server may be in order.=C2=A0 This can refer to the same RPK issues fro= m the
current DTLS document.=C2=A0 It may also be that this just uses normal
certificate processing and that should be noted as well, but some discussio= n
of deciding if the subject name/alt name matches the token returned from th= e
AS.

For the connect message there are a couple of issues that need to be though= t
about.

2.=C2=A0 What items are required to be in the connect message.=C2=A0 The re= sponse to
my last message suggested that a client identifier is required to be presen= t
but that is not documented.

3.=C2=A0 It is not completely clear what portions of the CONNECT message ar= e
being covered by the signature/MAC value.=C2=A0 As an example, is the passw= ord
field omitted entirely or is it set to a zero length password.=C2=A0 In add= ition
to this, from the couple of implementations that I have looked at the entir= e
packet is not passed out of the base server code for authentication
purposes.=C2=A0 This might need to be taken into account in terms of what i= s used
for the body and how it is constructed.=C2=A0 (As a side note, the
implementations that I have looked at so far also think that the password i= s
a text string rather than a binary value which is going to be a short term<= br> issue as well.)

4.=C2=A0 I must admit that I am disappointed that there is no challenge res= ponse
mechanism in the MQTT specifications.=C2=A0 I don't know that anything = can be
done at this point about it but there are some security issues that need to=
be highlighted because of this in the security considerations section.=C2= =A0 Only
the v3 seems to have this problem.=C2=A0 Also doing the channel binding wou= ld
deal with this problem as well.=C2=A0 Might just need some general discussi= ons
around the channel binding text.

5.=C2=A0 Is there an intention to provide a "standard" format for= the scope field
or just to leave it as ad hoc?

6.=C2=A0 It might be reasonable in section 2.1.3 to note that even if a res= ult is
cached, that cached check should be limited for a specific amount of time t= o
recheck if the token is still active.=C2=A0 More of an issue in terms of ho= w long
to cache for introspection.

7.=C2=A0 In section 2.1.4 - I would presume that the last paragraph should = be
extended to say that the token is stored only for the length of the
connection.=C2=A0 That is the token always needs to be supplied every time = a
connect message is sent.

Jim


_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--00000000000049bcdb05898c46ca-- From nobody Thu May 23 10:41:05 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABF1A120099; Thu, 23 May 2019 10:41:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yEku-y3cnIvq; Thu, 23 May 2019 10:40:58 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95200120043; Thu, 23 May 2019 10:40:57 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 23 May 2019 10:40:50 -0700 From: Jim Schaad To: 'Cigdem Sengul' CC: , References: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> In-Reply-To: Date: Thu, 23 May 2019 10:40:48 -0700 Message-ID: <001001d5118e$aa155290$fe3ff7b0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0011_01D51153.FDB7B310" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQEyqE6F6zu5BBD6EjCl0MEK4rN6KgGJqo9Qp7F8IcA= X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 May 2019 17:41:03 -0000 ------=_NextPart_000_0011_01D51153.FDB7B310 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Cigdem Sengul =20 Sent: Thursday, May 23, 2019 4:21 AM To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org; ace@ietf.org Subject: Re: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile =20 Thank you, Jim, for the comments.=20 I have created issues corresponding to each one in the GitHub = repository.=20 =20 We will start working on them, and specifically clarify the issues 1-3 = around the CONNECT message.=20 =20 For 4, MQTT v5 can support a challenge-response; not possible with v3 = indeed. Will expand the security considerations section on that.=20 =20 5. We described a convention in the draft with SHOULD. Do we turn that = into a MUST?=20 =20 [JLS] I missed this somehow. What is there is fine. =20 6. We thought that the AS would dictate the token expiration time. It = can also be done that RS times out tokens even if they have not expired. = But, security-performance trade-off should be considered.=20 Token caching is important even if the token does not need = introspection. The only time the MQTT client can push a token is with = the CONNECT message (all subsequent publish/subscribe messages rely on = this). In MQTT v5, a client can push a new token via reauthentication = during an ongoing session (enabled by MQTT v5). If RS times out the = token, this means a disconnection in MQTT v3. We mention this in = Security considerations as "it is expected that AS follows a reasonable = expiration strategy for access tokens"=20 =20 -->There may be workarounds designed especially MQTT v5 which has better = support for request-response style communication. But need to think = about it.=20 =20 [JLS] For introspection, but not for a published token, the token could = be =E2=80=9Crevoked=E2=80=9D by the RS. In this case a new = introspection check would lead to that information. There may be ways = to deal with this in the introspection dialog and not need to be called = up here. The question would be does the exi field mean =E2=80=93 = recheck the token or discard the token. =20 =20 Jim =20 =20 7. That is correct. Will add the clarification.=20 =20 Thanks, --Cigdem=20 =20 =20 =20 =20 On Wed, May 22, 2019 at 10:58 PM Jim Schaad > wrote: Thanks for the updates from my last message. This has helped quite a = bit. 1. A discussion of the use of raw public keys rather than certificates = for the server may be in order. This can refer to the same RPK issues from = the current DTLS document. It may also be that this just uses normal certificate processing and that should be noted as well, but some = discussion of deciding if the subject name/alt name matches the token returned from = the AS. For the connect message there are a couple of issues that need to be = thought about. 2. What items are required to be in the connect message. The response = to my last message suggested that a client identifier is required to be = present but that is not documented. 3. It is not completely clear what portions of the CONNECT message are being covered by the signature/MAC value. As an example, is the = password field omitted entirely or is it set to a zero length password. In = addition to this, from the couple of implementations that I have looked at the = entire packet is not passed out of the base server code for authentication purposes. This might need to be taken into account in terms of what is = used for the body and how it is constructed. (As a side note, the implementations that I have looked at so far also think that the = password is a text string rather than a binary value which is going to be a short = term issue as well.) 4. I must admit that I am disappointed that there is no challenge = response mechanism in the MQTT specifications. I don't know that anything can be done at this point about it but there are some security issues that need = to be highlighted because of this in the security considerations section. = Only the v3 seems to have this problem. Also doing the channel binding would deal with this problem as well. Might just need some general = discussions around the channel binding text. 5. Is there an intention to provide a "standard" format for the scope = field or just to leave it as ad hoc? 6. It might be reasonable in section 2.1.3 to note that even if a = result is cached, that cached check should be limited for a specific amount of = time to recheck if the token is still active. More of an issue in terms of how = long to cache for introspection. 7. In section 2.1.4 - I would presume that the last paragraph should be extended to say that the token is stored only for the length of the connection. That is the token always needs to be supplied every time a connect message is sent. Jim _______________________________________________ Ace mailing list Ace@ietf.org =20 https://www.ietf.org/mailman/listinfo/ace ------=_NextPart_000_0011_01D51153.FDB7B310 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From: = Cigdem Sengul <cigdem.sengul@gmail.com>
Sent: Thursday, = May 23, 2019 4:21 AM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: = draft-ietf-ace-mqtt-tls-profile@ietf.org; = ace@ietf.org
Subject: Re: [Ace] Comments on = draft-ietf-ace-mqtt-tls-profile

 

Thank = you, Jim, for the comments. 

I have created issues corresponding to each one in the = GitHub repository. 

 

We will start working on them, and specifically = clarify the issues 1-3 around the CONNECT = message. 

 

For 4, MQTT v5 can support a challenge-response; not = possible with v3 indeed. Will expand the security considerations section = on that. 

 

5.  We described a convention in the draft with = SHOULD. Do we turn that into a MUST? 

 

[JLS] I missed this somehow.=C2=A0 What is there = is fine.

 

6. We thought that the AS would dictate the token = expiration time. It can also be done that RS times out tokens even if = they have not expired. But, security-performance trade-off should be = considered. 

Token = caching is important even if the token does not need introspection. The = only time the MQTT client can push a token is with the CONNECT message = (all subsequent publish/subscribe messages rely on this). In MQTT v5, a = client can push a new token via reauthentication during an ongoing = session (enabled by MQTT v5). If RS times out the token, this means a = disconnection in MQTT v3. We mention this  in Security = considerations as "it is = expected that AS follows a reasonable expiration strategy for access = tokens"

 

-->There may be workarounds designed especially = MQTT v5 which has better support for request-response style = communication. But need to think about = it. 

 

[JLS] For introspection, but not for a published = token, the token could be =E2=80=9Crevoked=E2=80=9D by the RS.=C2=A0 In = this case a new introspection check would lead to that = information.=C2=A0 There may be ways to deal with this in the = introspection dialog and not need to be called up here.=C2=A0 The = question would be does the exi field mean =E2=80=93 recheck the token or = discard the token.=C2=A0

 

Jim

 

 

7. That is correct. Will add the = clarification. 

 

Thanks,

--Cigdem 

 

 

 

 

On = Wed, May 22, 2019 at 10:58 PM Jim Schaad <ietf@augustcellars.com> = wrote:

Thanks = for the updates from my last message.  This has helped quite a = bit.

1.  A discussion of the use of raw public keys rather = than certificates for
the server may be in order.  This can = refer to the same RPK issues from the
current DTLS document.  It = may also be that this just uses normal
certificate processing and = that should be noted as well, but some discussion
of deciding if the = subject name/alt name matches the token returned from = the
AS.

For the connect message there are a couple of issues = that need to be thought
about.

2.  What items are = required to be in the connect message.  The response to
my last = message suggested that a client identifier is required to be = present
but that is not documented.

3.  It is not = completely clear what portions of the CONNECT message are
being = covered by the signature/MAC value.  As an example, is the = password
field omitted entirely or is it set to a zero length = password.  In addition
to this, from the couple of = implementations that I have looked at the entire
packet is not passed = out of the base server code for authentication
purposes.  This = might need to be taken into account in terms of what is used
for the = body and how it is constructed.  (As a side note, = the
implementations that I have looked at so far also think that the = password is
a text string rather than a binary value which is going = to be a short term
issue as well.)

4.  I must admit that = I am disappointed that there is no challenge response
mechanism in = the MQTT specifications.  I don't know that anything can be
done = at this point about it but there are some security issues that need = to
be highlighted because of this in the security considerations = section.  Only
the v3 seems to have this problem.  Also = doing the channel binding would
deal with this problem as well.  = Might just need some general discussions
around the channel binding = text.

5.  Is there an intention to provide a = "standard" format for the scope field
or just to leave it = as ad hoc?

6.  It might be reasonable in section 2.1.3 to = note that even if a result is
cached, that cached check should be = limited for a specific amount of time to
recheck if the token is = still active.  More of an issue in terms of how long
to cache = for introspection.

7.  In section 2.1.4 - I would presume = that the last paragraph should be
extended to say that the token is = stored only for the length of the
connection.  That is the token = always needs to be supplied every time a
connect message is = sent.

Jim


_____________________________________________= __
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

------=_NextPart_000_0011_01D51153.FDB7B310-- From nobody Fri May 24 01:57:09 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E83A212013B; Fri, 24 May 2019 01:57:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R0F-x7mILfq8; Fri, 24 May 2019 01:57:04 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F5F31200EF; Fri, 24 May 2019 01:57:04 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id q197so6318522qke.7; Fri, 24 May 2019 01:57:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NoQZ/fvm2o0oo0ap7H/QKxjl1+XbJSiMeQV61XIdXC8=; b=Uy2B7TefENpamijaLsiVgv/gR545ztDo8oDqfuh7ILAgRvXPd0KWj1uAXPTbjUjls3 gBp8efr0Qb8YpakC4FDt9icj9wjuINJv1UT2cqfaTJYog+P9NHkspr/S8nG6pRIhUs6u 4ZRnT1gZrvJLC3mmIQbsM1qFQv0dulYolltQCkgc3264bXpOYtqicJRa6eqYH2agssaH 1BtAl6XEH2LXEsCw9vi7Jr0NK+/UQ9q+npF3f+FrB4oxtrOZARxgkvVM8qDb4EmS8D8H pTFQHZQ6G2ebOgmMIVi7bAJZ05uo6QPTAAgdV3fsWhLvlgIzdrcqL2ol1BE23wG/9lIO gmbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NoQZ/fvm2o0oo0ap7H/QKxjl1+XbJSiMeQV61XIdXC8=; b=eRbT41jYz2kHQMBgPW7SUXRaiYcdPMxMwDFFtfWOMQ1E5EJ++KpEbw/8AVvZ5SDCbD VDUyZ7t8AwSCPVCv5M0Iq/7Y+JW+NXnvqnfn2LiObh2oF57LWGH5jUe83R3R9qrsrt00 oIPnAla5wqxqR7suS/qPqd/L2h38GnJwU3wi3qVgVzBPxTFLfJd6rj57gIHAkGN5i7Io UmsF8q0izmYm6q87Ih6G8S4/PTlsAIOjuHMIND8WWmtuYTrhQmDQmluUujOkiEe2z9yK XFhxpLMCFgMU3bQ66KWmRkJ6Zkd1YTU16bpeUfRbQi3uICOFNg37GdUTwl5el9nEe6R3 TbYw== X-Gm-Message-State: APjAAAUap8vJtDCJpZcPE3nKIDilEiCi8v4b5Bd3tVjG0ADY6uChUDb0 OyqTU/6exGHw+cEvxJ3dEtWwQOBcCo/xDdsiYtU= X-Google-Smtp-Source: APXvYqyc7CtV1N+5hobnCPYyTHBXEKigzej1zfa62xry2UuSmZ2XD5KC6p5RTTfffwU3D+8OWb+EyxFp+bJQdc5Yvdg= X-Received: by 2002:ac8:1c39:: with SMTP id a54mr87043590qtk.344.1558688223790; Fri, 24 May 2019 01:57:03 -0700 (PDT) MIME-Version: 1.0 References: <009c01d510e9$7eada030$7c08e090$@augustcellars.com> <001001d5118e$aa155290$fe3ff7b0$@augustcellars.com> In-Reply-To: <001001d5118e$aa155290$fe3ff7b0$@augustcellars.com> From: Cigdem Sengul Date: Fri, 24 May 2019 09:56:52 +0100 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, ace@ietf.org Content-Type: multipart/alternative; boundary="000000000000e5099b05899e6133" Archived-At: Subject: Re: [Ace] Comments on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 08:57:07 -0000 --000000000000e5099b05899e6133 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, Thanks, Jim, this was helpful, and it also triggered that I go back and read the introspection section of the core draft again. > > > [JLS] For introspection, but not for a published token, the token could b= e > =E2=80=9Crevoked=E2=80=9D by the RS. In this case a new introspection ch= eck would lead to > that information. There may be ways to deal with this in the introspecti= on > dialog and not need to be called up here. The question would be does the > exi field mean =E2=80=93 recheck the token or discard the token. > Understood. We definitely need to clarify here what we do with exi field if it exists, and if it doesn't exist. The MAY language we used in the draft is not appropriate if exi does not exist. We considered the expiration time in the introspection response as a revocation signal and hence RS discards the token. (The basic flow was: RS receives a token, introspects it, caches the result and then when it expires, it revokes the token - which may next lead to different steps depending on the version of the MQTT.) But if introspection is done to handle the case of dynamic authorisation decisions, and exi would signal a recheck indeed. Will clarify. Thanks, --Cigdem > > > Jim > > > > > > 7. That is correct. Will add the clarification. > > > > Thanks, > > --Cigdem > > > > > > > > > > On Wed, May 22, 2019 at 10:58 PM Jim Schaad > wrote: > > Thanks for the updates from my last message. This has helped quite a bit= . > > 1. A discussion of the use of raw public keys rather than certificates f= or > the server may be in order. This can refer to the same RPK issues from t= he > current DTLS document. It may also be that this just uses normal > certificate processing and that should be noted as well, but some > discussion > of deciding if the subject name/alt name matches the token returned from > the > AS. > > For the connect message there are a couple of issues that need to be > thought > about. > > 2. What items are required to be in the connect message. The response t= o > my last message suggested that a client identifier is required to be > present > but that is not documented. > > 3. It is not completely clear what portions of the CONNECT message are > being covered by the signature/MAC value. As an example, is the password > field omitted entirely or is it set to a zero length password. In additi= on > to this, from the couple of implementations that I have looked at the > entire > packet is not passed out of the base server code for authentication > purposes. This might need to be taken into account in terms of what is > used > for the body and how it is constructed. (As a side note, the > implementations that I have looked at so far also think that the password > is > a text string rather than a binary value which is going to be a short ter= m > issue as well.) > > 4. I must admit that I am disappointed that there is no challenge respon= se > mechanism in the MQTT specifications. I don't know that anything can be > done at this point about it but there are some security issues that need = to > be highlighted because of this in the security considerations section. > Only > the v3 seems to have this problem. Also doing the channel binding would > deal with this problem as well. Might just need some general discussions > around the channel binding text. > > 5. Is there an intention to provide a "standard" format for the scope > field > or just to leave it as ad hoc? > > 6. It might be reasonable in section 2.1.3 to note that even if a result > is > cached, that cached check should be limited for a specific amount of time > to > recheck if the token is still active. More of an issue in terms of how > long > to cache for introspection. > > 7. In section 2.1.4 - I would presume that the last paragraph should be > extended to say that the token is stored only for the length of the > connection. That is the token always needs to be supplied every time a > connect message is sent. > > Jim > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > --000000000000e5099b05899e6133 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,=C2=A0

Thanks, Jim, th= is was helpful, and it also triggered that I go back and read the introspec= tion section of the core draft again.=C2=A0


=C2=A0

[JLS] For introspection, but not for a published token= , the token could be =E2=80=9Crevoked=E2=80=9D by the RS.=C2=A0 In this cas= e a new introspection check would lead to that information.=C2=A0 There may= be ways to deal with this in the introspection dialog and not need to be c= alled up here.=C2=A0 The question would be does the exi field mean =E2=80= =93 recheck the token or discard the token.=C2=A0


Understood. We definitely n= eed to clarify here what we do with exi field if it exists, and if it doesn= 't exist. The MAY language we used in the draft is not appropriate if e= xi does not exist.=C2=A0
We considered the expiration time in the= introspection response as a revocation signal and hence RS discards the to= ken.=C2=A0 (The basic flow was: RS receives a token, introspects it, caches= the result and then when it expires, it revokes the token - which may next= lead to different steps depending on the version of the MQTT.)
B= ut if introspection is done to handle the case of dynamic authorisation dec= isions, and exi would signal a recheck indeed.=C2=A0=C2=A0
Will clarify.=C2=A0
<= div>
Thanks,
--Cigdem=C2=A0

=C2=A0

=C2=A0

=

Jim

=C2=A0

=C2=A0

7. That is correct. Will add the clarifi= cation.=C2=A0

=C2= =A0

Thanks,

--Cigdem=C2=A0

=

=C2=A0

=C2=A0

=C2= =A0

=C2=A0

On Wed, May 22, 2019 at 10:58 PM Jim Schaad = <ietf@august= cellars.com> wrote:

Thanks for the updates from my last message.=C2=A0 Thi= s has helped quite a bit.

1.=C2=A0 A discussion of the use of raw pu= blic keys rather than certificates for
the server may be in order.=C2=A0= This can refer to the same RPK issues from the
current DTLS document.= =C2=A0 It may also be that this just uses normal
certificate processing = and that should be noted as well, but some discussion
of deciding if the= subject name/alt name matches the token returned from the
AS.

Fo= r the connect message there are a couple of issues that need to be thought<= br>about.

2.=C2=A0 What items are required to be in the connect mess= age.=C2=A0 The response to
my last message suggested that a client ident= ifier is required to be present
but that is not documented.

3.=C2= =A0 It is not completely clear what portions of the CONNECT message are
= being covered by the signature/MAC value.=C2=A0 As an example, is the passw= ord
field omitted entirely or is it set to a zero length password.=C2=A0= In addition
to this, from the couple of implementations that I have loo= ked at the entire
packet is not passed out of the base server code for a= uthentication
purposes.=C2=A0 This might need to be taken into account i= n terms of what is used
for the body and how it is constructed.=C2=A0 (A= s a side note, the
implementations that I have looked at so far also thi= nk that the password is
a text string rather than a binary value which i= s going to be a short term
issue as well.)

4.=C2=A0 I must admit = that I am disappointed that there is no challenge response
mechanism in = the MQTT specifications.=C2=A0 I don't know that anything can be
don= e at this point about it but there are some security issues that need tobe highlighted because of this in the security considerations section.=C2= =A0 Only
the v3 seems to have this problem.=C2=A0 Also doing the channel= binding would
deal with this problem as well.=C2=A0 Might just need som= e general discussions
around the channel binding text.

5.=C2=A0 I= s there an intention to provide a "standard" format for the scope= field
or just to leave it as ad hoc?

6.=C2=A0 It might be reason= able in section 2.1.3 to note that even if a result is
cached, that cach= ed check should be limited for a specific amount of time to
recheck if t= he token is still active.=C2=A0 More of an issue in terms of how long
to= cache for introspection.

7.=C2=A0 In section 2.1.4 - I would presum= e that the last paragraph should be
extended to say that the token is st= ored only for the length of the
connection.=C2=A0 That is the token alwa= ys needs to be supplied every time a
connect message is sent.

Jim=


_______________________________________________
Ace mailing = list
Ace@ietf.org<= br>= https://www.ietf.org/mailman/listinfo/ace

--000000000000e5099b05899e6133-- From nobody Fri May 24 09:52:53 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F97C12016C for ; Fri, 24 May 2019 09:52:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3QJwYBBIf_CI for ; Fri, 24 May 2019 09:52:49 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130041.outbound.protection.outlook.com [40.107.13.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69933120139 for ; Fri, 24 May 2019 09:52:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aFg7Yy9wWCtCHaeDG6Ugl9jnsHzW5w7MY3yqPuhvJTY=; b=xhmxxjfEq36d4n9NJZYRDm3B3FitJ2nzSjVHMt2kPEemWIGtgIeWlvVsxT9BTayt3ZrESwvB2sf0afu9gKbKXzdjK+k9M5gyQMPXKPPkNuDUquXNYtmo1O0dVgU0zqd3In9nBewV/26YzcQHyA3d4mlC/nvwgfd3Vh/3uqD52do= Received: from DBBPR08MB4539.eurprd08.prod.outlook.com (20.179.44.144) by DBBPR08MB4458.eurprd08.prod.outlook.com (20.179.43.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.15; Fri, 24 May 2019 16:52:44 +0000 Received: from DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::91a5:7d70:3c7e:d096]) by DBBPR08MB4539.eurprd08.prod.outlook.com ([fe80::91a5:7d70:3c7e:d096%6]) with mapi id 15.20.1922.018; Fri, 24 May 2019 16:52:44 +0000 From: Hannes Tschofenig To: Michael StJohns , "ace@ietf.org" Thread-Topic: [Ace] EST over CoAP: Randomness Thread-Index: AdUGcOnxX76zbRm2S2qe/nEWIh3V6AEMI0QAAAJINfAA8RoFAAD4IHXQ Date: Fri, 24 May 2019 16:52:44 +0000 Message-ID: References: <0a75faf6-0968-d266-b99e-cf400b311477@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.123.119] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ad2cb71c-51b8-48f9-aee5-08d6e0683e6d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(4618075)(2017052603328)(7193020); SRVR:DBBPR08MB4458; x-ms-traffictypediagnostic: DBBPR08MB4458: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0047BC5ADE x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(396003)(136003)(39860400002)(376002)(366004)(40434004)(189003)(199004)(71190400001)(71200400001)(110136005)(25786009)(229853002)(99286004)(7696005)(33656002)(53546011)(316002)(66574012)(68736007)(478600001)(2501003)(66066001)(76176011)(26005)(3846002)(6506007)(2906002)(186003)(6116002)(6246003)(5660300002)(66946007)(66446008)(64756008)(66556008)(66476007)(52536014)(74316002)(72206003)(305945005)(102836004)(8936002)(966005)(7736002)(81156014)(73956011)(9686003)(8676002)(256004)(14444005)(5024004)(53936002)(81166006)(76116006)(55016002)(6306002)(11346002)(86362001)(6436002)(446003)(476003)(486006)(14454004); DIR:OUT; SFP:1101; SCL:1; SRVR:DBBPR08MB4458; H:DBBPR08MB4539.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: UA8Wl3EVE1lL+7hPbvoL3deNz6EwEr5n6xirRpUqXtnEn79RsM7gQoUMlijYgOA/2BykbRyRJK7Pp8C/gTBHkgc8fnDHb1cWtisUR0jgb1XrgGFCKZU9SEYiCvknpPlc0konwXRDxebVFOsbSNjY2BZvK7Kbrni9N+fS2IVfCT9LNHuv9fwwzc1DuWUqgJpMCp4SYfAYn8mFPbXE+6xLYOpj4ETebkbYVUL+zQbDCPmcyp7zJ4ytpxIJTbdPz+W9WdVCSPT9D04Y911oWQe4aqKHfJdef3ZXyop2ixydtMukUQBVOxoQE+iTN5R7BlkaSfvtMU2EKWKgJt5SFz0JlbrSXCDeBREotq+yCEqq6nZOGm2yIfXqdndpbTnvPMqnU84DxDhfbU5ZQdHrWHXAGz9SjLB90ChtcCelKSyer0A= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: ad2cb71c-51b8-48f9-aee5-08d6e0683e6d X-MS-Exchange-CrossTenant-originalarrivaltime: 24 May 2019 16:52:44.6790 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Hannes.Tschofenig@arm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4458 Archived-At: Subject: Re: [Ace] EST over CoAP: Randomness X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 May 2019 16:52:51 -0000 SGkgTWlrZSwNCg0KQSBmZXcgcmVtYXJrcyBpbmxpbmUuDQoNCk9uIDUvMTQvMjAxOSA3OjI5IFBN LCBIYW5uZXMgVHNjaG9mZW5pZyB3cm90ZToNCj4gSGkgUGF1bCwNCj4NCj4gTXkgdW5kZXJzdGFu ZGluZyBmcm9tIHJlYWRpbmcgdGhlIGRyYWZ0IHRleHQgd2FzIHRoYXQgdGhlICJjb3N0IiB3YXMg YWN0dWFsbHkgdGFsa2luZyBhYm91dCAiZW5lcmd5IGNvc3QiIHJhdGhlciB0aGFuICJtb25ldGFy eSBjb3N0Ii4NCj4gVGhlIG1vbmV0YXJ5IGNvc3QgbWF5IGFsc28gYmUgaW50ZXJlc3RpbmcuDQo+ DQo+IEl0IGlzIGRpZmZpY3VsdCB0byBqdWRnZSB0aGUgZXh0cmEgY29zdCBvZiBhIFJORyBpbiBh biBNQ1UgYmVjYXVzZQ0KPiAoYSkgeW91IHJhcmVseSBmaW5kIGFuIE1DVSB3aXRoIGFuZCB3aXRo b3V0IE1DVSAoa2VlcGluZyBhbGwgb3RoZXINCj4gZmVhdHVyZXMgdGhlIHNhbWUpLA0KIndpdGgg YW5kIHdpdGhvdXQgUk5HIj8NCj4gKGIpIGV2ZW4gaWYgeW91IGZpbmQgb25lIHRoZXJlIGFyZSBv dGhlciBmYWN0b3JzIHRoYXQgaW1wYWN0IHRoZSBjb3N0DQo+IChzdWNoIGFzIHBvcHVsYXJpdHkg b2YgYSBwYXJ0aWN1bGFyIE1DVSksDQo+IChjKSBSTkcgZmVhdHVyZXMgYXJlIG9mdGVuIHByb3Zp ZGVkIHdpdGggb3RoZXIgZmVhdHVyZXMgKHN1Y2ggYXMNCj4gU0hBMjU2IGFuZCBBRVMgaW4gaGFy ZHdhcmUpLCBhbmQNClVtLi4uIHlvdSB1c3VhbGx5IG5lZWQgb25lIG9yIHRoZSBvdGhlciBvZiB0 aGVzZSB0byBkbyBhIGdvb2QgaW1wbGVtZW50YXRpb24gb2YgYSBEUkJHIGFuZCBoYXJkd2FyZSB2 ZXJzaW9ucyB0ZW5kIHRvIGJlIGxlc3MgImNvc3RseSINCmVuZXJneSB3aXNlIHRoYW4gc29mdHdh cmUgb25lcy4NCj4gKGQpIGNvc3QgYW5kIHByaWNlIG9mIGFuIE1DVSBhcmUgZGlmZmVyZW50IGFz cGVjdHMuDQoNClRoYXQgaGF2ZSBubyBiZWFyaW5nIG9uIHRoZSBwcm90b2NvbCBkZXNpZ24gcGFz dCBhIGNlcnRhaW4gc2V0IG9mDQptaW5pbXVtcy4gICBJJ20gYmVnaW5uaW5nIHRvIHRoaW5rIGl0 cyB0aW1lIGZvciAibWluaW11bSByZXF1aXJlbWVudHMNCmZvciBpbnRlcm5ldCBob3N0cyAtIDIw MjAgZWRpdGlvbiIgUkZDcy4gIFdlIHNlZW0gdG8gYmUgYmFjayBpbiB0aGUgc2FtZQ0Kc2V0IG9m IGFyZ3VtZW50cyAgdGhhdCBBTllUSElORyBzaG91bGQgYmUgYWJsZSB0byBiZSBhbiBpbnRlcm5l dCBkZXZpY2UNCmFsYmlldCB3aXRoIGV2ZW4gbG93ZXIgdGhyZXNob2xkcyB0aGFuIHdlIHdlcmUg YSBmZXcgeWVhcnMgYWdvLiAgQUNFIGlzDQpwdXNoaW5nIHRob3NlIGJvdW5kYXJpZXMsIGJ1dCB3 ZSBzZWVtIHRvIGJlIGNoYXNpbmcgImNvc3QgLT4gMCINCg0KW0hhbm5lc10gR29vZCB0aGF0IHlv dSBhcmUgc3VwcG9ydGluZyBteSBhcmd1bWVudC4gSSBiZWxpZXZlIHRoaXMgaXMgdGhlIGZpcnN0 IHRpbWUgeW91IGFncmVlIHdpdGggbWUuDQoNCkFsbCBnb29kIHBvaW50cywgYnV0IGlnbm9yaW5n IHRoZSBmYWN0IHRoYXQgbmVlZHMgZHJpdmUgdGhlIHByb3RvY29scw0Kd2hpY2ggZHJpdmUgdGhl IE1DVSBkZXZlbG9wbWVudC4gIE5PVCBNQ1VzIGxpbWl0IHRoZSBwcm90b2NvbHMgd2hpY2gNCmxp bWl0IHRoZSBuZWVkcy4NCg0KW0hhbm5lc10gWW91IHNob3VsZCBqb2luIHRoZSBFREhPQyBkaXNj dXNzaW9uIHdoZXJlIHlvdSBjYW4gaGVhciBhIGxvdCBhYm91dCBob3cgTUNVcyBhbmQgbmV0d29y a3MgbGltaXQgKHNlY3VyaXR5KSBwcm90b2NvbHMuDQoNCkluIG90aGVyIHdvcmRzLCBpZiB0aGUg Y29tbXVuaXR5ICh0aHJvdWdoIHByb3RvY29sIGRlZmluaXRpb25zKSBkb2Vzbid0DQpyZXF1aXJl IHRoZSBSTkcsIHRoZW4gdGhlIE1DVSBkZXZlbG9wZXJzIHdvbid0IGluY2x1ZGUgaXQuDQoNCltI YW5uZXNdIEx1Y2tpbHkgc2lsaWNvbiB2ZW5kb3JzIGFscmVhZHkgaW5jbHVkZSBSTkdzIGluIE1D VXMuIFRoYXQgbWlzc2lvbiBnb3QgYWNjb21wbGlzaGVkLg0KDQpXaXRoIHJlc3BlY3QgdG8gUk5H IGVuZXJneSBjb3N0cyAtIHRoZSBhcmd1bWVudCB0aGF0IHRoZXkgYXJlIHRvbw0KZXhwZW5zaXZl IGVuZXJneSB3aXNlIGlzIHByZXR0eSBib2d1cy4NCg0KW0hhbm5lc10gQ29tcGxldGVseSBhZ3Jl ZSB3aXRoIHlvdS4NCkx1Y2tpbHkgdGhhdCB0ZXh0IHBhcnQgZ290IGNoYW5nZWQgaW4gdGhlIGxh dGVzdCB2ZXJzaW9uIG9mIHRoZSBkcmFmdCBhcyBhIGNvbnNlcXVlbmNlIG9mIHRoZSByZWNlbnQg bWFpbGluZyBsaXN0IGRpc2N1c3Npb24uDQoNCiAgUk5HcyBnZW5lcmFsbHkgaGF2ZSB0d28gcGFy dHMgLQ0KYSBUUk5HIG9yIGVudHJvcHkgc291cmNlLCBhbmQgYSBEUkJHIHNlZWRlZCBmcm9tIHRo ZSBlbnRyb3B5IHNvdXJjZS4NClRoZSBlbmVyZ3kgY29zdHMgZm9yIHRoZSBEUkJHIGFyZSBtaWNy b3Njb3BpYy4gVGhlIGVuZXJneSBjb3N0cyBmb3IgYQ0KVFJORyBhcmUgcmVsYXRlZCBtb3JlIHRv IHRoZSB0aW1lIG5lZWRlZCB0byBpbml0aWFsbHkgZmlsbCB0aGUgZW50cm9weQ0KcG9vbCAoZS5n LiBnZXR0aW5nIHRoZSBub2lzeSBkaW9kZXMgbWFraW5nIG5vaXNlLCBnZXR0aW5nIHRoZSByaW5n DQpvc2NpbGxhdG9ycyByaW5naW5nIGV0YykgdGhhbiB0byBrZWVwaW5nIGl0IHJ1bm5pbmcgdG8g Z2V0IGEgZmV3DQp0aG91c2FuZCBiaXRzLiAgRG9pbmcgdGhpcyBzYXkgb25jZSBhIHllYXIgdG8g c2VlZCB0aGUgRFJCRyBpc24ndCBnb2luZw0KdG8ga2lsbCB0aGUgbGlmZXRpbWUgb2YgYSBiYXR0 ZXJ5IGRldmljZS4NCg0KW0hhbm5lc10gV2VsbCBzYWlkLiBJIGhhZCBob3BlZCB0aGF0IHNvbWVv bmUgd291bGQgZ28gaW50byB0aGUgZGV0YWlscyBhbmQgeW91IGRpZC4NCkJ0dywgZGlkIHlvdSB3 YXRjaCBteSB3ZWJpbmFyIGFib3V0IFJOR3MgaHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/ dj14UUYyVTZBa1NqSSA/DQoNCkNpYW8NCkhhbm5lcw0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUg Y29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRp YWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRl ZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8g bm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9y IGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVk aXVtLiBUaGFuayB5b3UuDQo= From nobody Fri May 24 21:47:48 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C4CF120316 for ; Fri, 24 May 2019 21:47:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=FLAcPNGG; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=DRyGkCi0 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OHpZmODXJ6ul for ; Fri, 24 May 2019 21:47:43 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47B6F120048 for ; Fri, 24 May 2019 21:47:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10904; q=dns/txt; s=iport; t=1558759663; x=1559969263; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=OjBhvoJE9MTfW1DK4jJ63MsvL2WomoFdZ23ual80Gm8=; b=FLAcPNGGoddbrw6Oyepa7Xkeo36AmxBh1wmT3pBVijJOTrSxmW5wGiCf Mp1Q8Z8tvXh3IYnPAg0fVmpRprWvmuW8pijzepAV0AE9V3L2GW2S6Q0TA HdIOVnanYbRGvrBnFSXaUQYLVvuS7YaIygcD177vV4YGDqjU1kdqbaAH3 w=; IronPort-PHdr: =?us-ascii?q?9a23=3A2+i/2xziigaIaJXXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhWN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZudCkT+NPfsZgQxHd9JUxlu+HToeUU=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BIAACcx+hc/5JdJa1cCRwBAQEEAQE?= =?us-ascii?q?HBAEBgVEHAQELAYE9JCwDaVUgBAsohBODRwOEUoonSoINlyuBLhSBEANUCQE?= =?us-ascii?q?BAQwBAScGAgEBhEACF4IoIzQJDgEDAQEEAQECAQRtHAyFSgEBAQMBEhEEDQw?= =?us-ascii?q?BATgEBwQCAQgRBAEBAwIZDQICAjAVCAgCBAESCBqDAYFqAw4PAQ6aFwKBOIh?= =?us-ascii?q?fcXwzgnkBAQWBMgGDTRiCDwMGgQwoAYRohmoXgUA/gRFGgU5+PoJhAQECgSw?= =?us-ascii?q?BCAoBBwIYFYJzMoImizuCUIZ5k00JAoINhjOMeoIfimWJQYxphwCOcwIEAgQ?= =?us-ascii?q?FAg4BAQWBTzhmcXAVgyeCD4NwilNyCoEfiy6CQwEB?= X-IronPort-AV: E=Sophos;i="5.60,509,1549929600"; d="scan'208";a="559578523" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 May 2019 04:47:42 +0000 Received: from XCH-RCD-020.cisco.com (xch-rcd-020.cisco.com [173.37.102.30]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id x4P4lfex031987 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 25 May 2019 04:47:42 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-RCD-020.cisco.com (173.37.102.30) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 24 May 2019 23:47:40 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 24 May 2019 23:47:40 -0500 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Sat, 25 May 2019 00:47:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OjBhvoJE9MTfW1DK4jJ63MsvL2WomoFdZ23ual80Gm8=; b=DRyGkCi0d1Uyvt5if5CzULdBU4w1rA575g7q6X762ut1NjvGPuqH7qBP0qq2Giq5BblbVMQx9r+rlrms5iDJEq1DTMmZ6rAdGIVIt8+IawBCuTHWO6RIp0nVkE/V9A7miY0QZBQvKj3ia6z7u4R/ASManUfh3ryWcVOqWANWi8w= Received: from MWHPR11MB1838.namprd11.prod.outlook.com (10.175.53.141) by MWHPR11MB1597.namprd11.prod.outlook.com (10.172.54.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.16; Sat, 25 May 2019 04:47:38 +0000 Received: from MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12]) by MWHPR11MB1838.namprd11.prod.outlook.com ([fe80::4964:5495:9121:8f12%7]) with mapi id 15.20.1922.019; Sat, 25 May 2019 04:47:38 +0000 From: "Panos Kampanakis (pkampana)" To: Esko Dijk , "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt Thread-Index: AQHVDMWddQFmHhPwYk+M2tBX23+L/6ZvciLAgAQfnoCAAI3gkIACEHMAgAKOvbA= Date: Sat, 25 May 2019 04:47:38 +0000 Message-ID: References: <155810704144.26327.4695280572619758639@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1007::26c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 20eaf539-182a-487f-093e-08d6e0cc1d04 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MWHPR11MB1597; x-ms-traffictypediagnostic: MWHPR11MB1597: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0048BCF4DA x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(136003)(396003)(366004)(39860400002)(199004)(189003)(13464003)(76176011)(55016002)(52536014)(8936002)(81166006)(7696005)(74316002)(478600001)(5660300002)(110136005)(76116006)(229853002)(66446008)(6306002)(14454004)(66476007)(66556008)(66946007)(53936002)(64756008)(73956011)(9686003)(33656002)(71190400001)(6436002)(966005)(476003)(2906002)(7736002)(446003)(486006)(46003)(81156014)(186003)(2501003)(86362001)(14444005)(256004)(25786009)(6246003)(316002)(71200400001)(99286004)(102836004)(6116002)(53546011)(6506007)(68736007)(8676002)(305945005)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1597; H:MWHPR11MB1838.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: TaIyf1IA/q/T9S7PIiot5cxU/4mGdUX+Lq/1s2Nxwt0ZG4vL4gyvH+k6sS8UJrz0XEGpORi8r7Y+Pqz/OYihCier5JBolD6Chzz1WKFDqRkWGy9QSan8mla893Ro8lfbBe6SjG/4lEfAOYcaTFCZEyvjpdJU+Jrogmn//6blIpqyNKC0a8H9clEl+yhV8OfqDvrF1gyVmSZt3R+79ln78ZG4Uxfew6deMkun0GBhNCwpk2qM/NocEz1qU3y0lKBOjeChtz4PQQZRtDoJInpZnMUksoCs82/lUSJM7w9ALns9cNFQW6YhwkXCvtsQQ9g3PsibkygGhI9IJ1DznKIVRSbwlNl2jWAYt6uf01BQBN7FwanrAN8GQUl/kFK+qymfGAnkhPnn/NUSjvHqscJawxDehxz57mIHXbRmCRfHmDo= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 20eaf539-182a-487f-093e-08d6e0cc1d04 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 May 2019 04:47:38.3337 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pkampana@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1597 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.30, xch-rcd-020.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 May 2019 04:47:47 -0000 SGkgRXNrbywNCg0KVGhhbmsgeW91IGFnYWluLiBBZ2FpbiBhIHZlcnkgZWxhYm9yYXRlIHJldmll dyBhbmQgZm91bmQgc29tZSBnb29kIG5pdHMgaW4gdGhlIERlbGF5ZWQgcmVzcG9uc2VzIHNlY3Rp b24uIFRvIG1ha2UgaXQgZWFzaWVyIEkgbG9nZ2VkIHRoZSBpc3N1ZXMgYW5kIGZpeGVzIGhlcmUg aHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMvaXNzdWVzLzE0NSANCg0K VGhlIHVwZGF0ZWQgZG9jIGlzIGhlcmUgaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9F U1QtY29hcHMvYmxvYi9tYXN0ZXIvZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QudHh0IGFuZCB0aGUg ZGlmZnMgYXJlIGhlcmUgaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMv Y29tbWl0LzRhZDUyMTBmYWY2MjRjNjdlMTk5OGRhNzVlYTA1MWRlNjE2ZTkxYjEjZGlmZi0zYTcx MmVkYjQzZjZlYWNlN2ZiMTY2NzMyOGQ2NTMwNyAgDQoNClJncw0KUGFub3MNCg0KLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRh bmN5Lm5sPiANClNlbnQ6IFR1ZXNkYXksIE1heSAyMSwgMjAxOSA2OjMxIFBNDQpUbzogUGFub3Mg S2FtcGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNjby5jb20+OyBhY2VAaWV0Zi5vcmcN CkNjOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdEBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtBY2Vd IEktRCBBY3Rpb246IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dA0KDQpIZWxsbyBQYW5v cywNCg0KRm9yIHRoZSBkcmFmdCB0ZXh0IEkgaGF2ZSBhIGNvdXBsZSBvZiBtb3JlIHJldmlldyBy ZW1hcmtzOg0KDQoqIHBhZ2UgOCBmaXJzdCBidWxsZXQ6IGEgcHJldmlvdXNseSBpc3N1ZXMgY2xp ZW50IGNlcnRpZmljYXRlIGNvdWxkIGFsc28gZXhwaXJlLCBpbiBzb21lIGNhc2VzIGV2ZW4gd2l0 aG91dCB0aGUgY2xpZW50IGtub3dpbmcuIElmIHRoZSBjbGllbnQgdGhlbiBwZXJmb3JtcyBzaW1w bGUgcmUtZW5yb2xsbWVudCAtLSB1c2luZyBpdHMgcHJldmlvdXMgb3BlcmF0aW9uYWwgY2VydCBh cyBhdXRoZW50aWNhdGlvbiwgd2hhdCB3b3VsZCBoYXBwZW4/ICBJIHdvdWxkIGV4cGVjdCB0aGUg c2VydmVyIE1BWSBhbHNvIHdhbnQgdG8gdXNlIHRoaXMgY2VydGlmaWNhdGUgdG8gYXV0aGVudGlj YXRlIHRoZSBjbGllbnQuIEJlY2F1c2UgdGhlIHB1cnBvc2Ugb2YgdGhlIGNsaWVudCBjb25uZWN0 aW5nIGFnYWluIHRvIHRoZSBFU1Qgc2VydmVyIGlzIHRvIGRvIHNpbXBsZSByZS1lbnJvbGxtZW50 LCB0byBnZXQgYSBuZXcgY2VydGlmaWNhdGUuICAgU3VwcG9zZSBhIGNhc2Ugd2hlcmUgdGhlIGhh bmRzaGFrZSB0byB0aGUgRVNUIHNlcnZlciBmYWlscyBiZWNhdXNlIHRoZSBFU1Qgc2VydmVyIHJl amVjdHMgdGhlIGV4cGlyZWQgb3BlcmF0aW9uYWwgY2VydDogIHdoYXQgd291bGQgdGhlIGNsaWVu dCBkbyBub3c/IEl0IGNvdWxkIGJlIGEgY2VydGlmaWNhdGVfZXhwaXJlZCBtZXNzYWdlLiAgUkZD IDcwMzAgcHJvdmlkZXMgbm8gZ3VpZGFuY2UgaW4gdGhpcyBtYXR0ZXI7IHdvdWxkIEVTVC1jb2Fw cyBuZWVkIHRvIGRlZmluZSB0aGlzPyBFLmcuIGNsaWVudCBTSE9VTEQgcmV0cnkgdXNpbmcgdGhl IGJ1bGxldCAjMiBjZXJ0aWZpY2F0ZSAoZS5nLiBJRGV2SUQpPw0KDQoqIHBhZ2UgOCBtaWRkbGU6 ICJDb0FQIGFuZCBEVExTIGNhbiBwcm92aWRlIHByb29mLW9mLWlkZW50aXR5IGZvciBFU1QtY29h cHMgY2xpZW50cyBhbmQgc2VydmVycyB3aXRoIHNpbXBsZSBQS0kgbWVzc2FnZXMgYXMgZGVzY3Jp YmVkIGluIFNlY3Rpb24gMy4xIG9mIFtSRkM1MjcyXSAiDQpMb29raW5nIHVwIHRoaXMgc2VjdGlv biBpdCBzYXlzOiAiVGhlIFNpbXBsZSBQS0kgUmVxdWVzdCBNVVNUIE5PVCBiZSB1c2VkIGlmIGEg cHJvb2Ytb2YtaWRlbnRpdHkgbmVlZHMgdG8gYmUgaW5jbHVkZWQuIiAgIFRoaXMgc2VlbXMgdG8g c2F5IHRoZSBvcHBvc2l0ZSBvZiB0aGUgYWJvdmUgdGV4dD8gIFRoaXMgcmVxdWlyZXMgYXQgbGVh c3Qgc29tZSBtb3JlIGV4cGxhbmF0aW9uLg0KDQoqIHBhZ2UgOCBtaWRkbGU6ICJNb3Jlb3Zlciwg Y2hhbm5lbC1iaW5kaW5nIGluZm9ybWF0aW9uIGZvciBsaW5raW5nIHByb29mLW9mLWlkZW50aXR5 IHdpdGggY29ubmVjdGlvbi1iYXNlZCBwcm9vZi1vZi1wb3NzZXNzaW9uIGlzIE9QVElPTkFMIGZv ciBFU1QtY29hcHMiICAtPiBpcyBpdCBPUFRJT05BTCBmb3IgY2xpZW50LCBzZXJ2ZXIsIG9yIGJv dGg/IEkgd291bGQgYXNzdW1lIGl0IGlzIE9QVElPTkFMIGZvciBib3RoLiBJZiB0aGUgKGxpZ2h0 LXdlaWdodCkgY2xpZW50IGRvZXMgbm90IGltcGxlbWVudCBpdCBhbmQgaWYgdGhlIHNlcnZlciBk b2VzIG1hbmRhdGUgaXQsIHRoZSBjbGllbnQgY2FuIG5vdCBjb25uZWN0IHRvIHRoYXQgc2VydmVy IGlmIGl0cyBwb2xpY3kgaXMgc2V0IHRvICJsaW5raW5nIFBPUC9pZGVudGl0eSByZXF1aXJlZCIu DQoNCiogcGFnZSAxNCB0b3AgYnVsbGV0OiAiVGhlIENvQVAgT3B0aW9ucyB1c2VkIGFyZSAuLi4u ICIgDQogIC0+IHRoZSBpdGVtIEJsb2NrIGNvdWxkIGJlIGV4cGFuZGVkIHRvICJCbG9jazEsIEJs b2NrMiIgdG8gY2FwdHVyZSB0aGUgYWN0dWFsIE9wdGlvbiBuYW1lcy4NCiAgLT4gTG9jYXRpb24t UGF0aCBpcyBuZXZlciB1c2VkIGluIGFueSBvZiB0aGUgQ29BUCBpbnRlcmFjdGlvbnMgZGVmaW5l ZDsgc2hvdWxkIGJlIHJlbW92ZWQuDQoNCiogUGFnZSAxNCBmaXJzdCA1LjUgcGFyYWdyYXBoOiAi U2ltaWxhcmx5LCAyLjAxLCAyLjAyIG9yIDIuMDQgTVVTVCBiZSB1c2VkIGluIHJlc3BvbnNlIHRv IEVTVCBQT1NUIHJlcXVlc3RzIg0KICAtPiAyLjAxIENyZWF0ZWQgaXMgbGlrZSBIVFRQIDIwMSwg d2hpY2ggaXMgbm90IHVzZWQgaW4gRVNUIC0gc28gY2FuIGJlIHJlbW92ZWQgaGVyZS4NCiAgLT4g Mi4wMiBEZWxldGVkIGhhcyBubyBIVFRQIGVxdWl2YWxlbnQsIHNvIGlzIG5vdCB1c2VkIGluIEVT VC4gSXQgc2hvdWxkIGJlIHJlbW92ZWQgaGVyZS4NCiAgLT4gdGhhdCBsZWF2ZXMgb25seSAyLjA0 IHJlc3BvbnNlcy4gSG93ZXZlciB0aGUgdGV4dCBzaG91bGQgc2F5IHRoaXMgaXMgZm9yIHN1Y2Nl c3NmdWwgKEhUVFAgMjAwIG9yIDIwMiBpbiBFU1QpIHJlc3BvbnNlcyAsIHNvIHN1Z2dlc3Rpb24g aXMgdG8gY2hhbmdlIGFib3ZlIHNlbnRlbmNlIHRvOiAiU2ltaWxhcmx5LCAyLjA0IE1VU1QgYmUg dXNlZCBpbiBhIHJlc3BvbnNlIHRvIGEgc3VjY2Vzc2Z1bCBFU1QgUE9TVCByZXF1ZXN0Ig0KDQoq IHBhZ2UgMTQgYm90dG9tOiAiRVNUIG1ha2VzIHVzZSBvZiBIVFRQIDIwNCBhbmQgNDA0IHJlc3Bv bnNlcyB3aGVuIGEgcmVzb3VyY2UgaXMgbm90ICBhdmFpbGFibGUgZm9yIHRoZSBjbGllbnQuICBU aGUgZXF1aXZhbGVudCBDb0FQIGNvZGVzIHRvIHVzZSBpbiBhbiBFU1QtY29hcHMgcmVzcG9uc2Vz IGFyZSAyLjA0IGFuZCA0LjA0LiAgIg0KICAtPiBDb0FQIDIuMDQgY2FuIG9ubHkgYmUgdXNlZCBp biByZXNwb25zZXMgdG8gUE9TVCBvciBQVVQgcmVxdWVzdHMsIG5vdCBmb3IgR0VUIHJlc3BvbnNl cy4NCiAgLT4gc28gaW4gQ29BUCB0aGUgc2VydmVyIGNvdWxkIGVpdGhlciByZXR1cm4gMi4wNSB3 aXRoIGVtcHR5IHBheWxvYWQgKGVxdWl2YWxlbnQgdG8gSFRUUCAyMDQpLCBvciByZXR1cm4gNC4w NCAoZXF1aXZhbGVudCB0byBIVFRQIDQwNCkNCg0KKiBwYWdlIDE1IGJvdHRvbTogIlRoZSBFU1Qt Y29hcHMgY2xpZW50IGFuZCBzZXJ2ZXIgTVVTVCBzdXBwb3J0IEJsb2NrMi4gIEJsb2NrMSBNVVNU IGJlIHN1cHBvcnRlZCBmb3IgRVNULWNvYXBzIGVucm9sbG1lbnQgcmVxdWVzdHMgdGhhdCBleGNl ZWQgdGhlIFBhdGggTVRVLiINCiAgLT4gY291bGQgYmUgY2xhcmlmaWVkIGJldHRlciwgSSBleHBl Y3QgYSBFU1QtY29hcHMgc2VydmVyIE1VU1Qgc3VwcG9ydCBCbG9jazEgYmVjYXVzZSB0aGF0IHNl cnZlciBkb2Vzbid0IGtub3cgaW4gYWR2YW5jZSBob3cgYmlnIHRoZSBjbGllbnQncyByZXF1ZXN0 IHBheWxvYWQgaXMgZ29pbmcgdG8gYmUgYW5kIHdoZXRoZXIgdGhhdCBjbGllbnQgd2lsbCB1c2Ug QmxvY2sxLg0KICAtPiBlLmcuICJUaGUgRVNULWNvYXBzIGNsaWVudCBhbmQgc2VydmVyIE1VU1Qg c3VwcG9ydCBCbG9jazIuICBUaGUgRVNULWNvYXBzIHNlcnZlciBNVVNUIHN1cHBvcnQgQmxvY2sx LiBUaGUgRVNULWNvYXBzIGNsaWVudCBNVVNUIHN1cHBvcnQgQmxvY2sxIGlmIGl0IHNlbmRzIEVT VC1jb2FwcyByZXF1ZXN0cyB3aXRoIGFuIElQIHBhY2tldCBzaXplIHRoYXQgZXhjZWVkcyB0aGUg UGF0aCBNVFUuIg0KDQoqIHBhZ2UgMTYgZXhhbXBsZTogdGhlIHBheWxvYWRzIGFyZSBub3QgaW5k aWNhdGluZyB0aGF0IGVhY2ggIntDU1IgcmVxfSIgcGF5bG9hZCBpcyBkaWZmZXJlbnQuIEkuZS4s IGEgZGlmZmVyZW50IGJsb2NrLiBJdCB3b3VsZCBiZSBtb3JlIGNsZWFyIGlmIHRoYXQgaXMgc2hv d24gZS5nLiAie0NTUiAxfSIsICJ7Q1NSIDJ9IiwgLi4uIHVwIHRvICJ7Q1NSIE4xKzF9Ii4gVGhl ICJyZXEiIHN0cmluZyBpcyBub3QgbmVlZGVkIHNpbmNlIHRoZSBSIGluIENTUiBhbHJlYWR5IHN0 YW5kcyBmb3IgcmVxdWVzdC4NCg0KKiBwYWdlIDE3IGV4YW1wbGU6IHNlZSBhYm92ZSBwYXlsb2Fk cyByZW1hcms7IGFuZCB0aGUgZm9sbG93aW5nOg0KICAtLT4gd2hhdCBJIGZpbmQgc3RyYW5nZSBo ZXJlIGlzIHRoYXQgYSBibG9ja3dpc2UgUE9TVCByZXF1ZXN0IGVuZHMgd2l0aCBhIDUuMDMgcmVz cG9uc2UsIGFuZCB0aGVuIHRoZSBzYW1lIHJlcXVlc3QgYWZ0ZXIgdGhhdCBnaXZlcyBhIDIuMDEg cmVzcG9uc2UuIEluIENvQVAgQUZBSUssIG9uZSByZXF1ZXN0IGNhbiBuZXZlciBnaXZlIDIgcmVz cG9uc2VzIGluIHNlcXVlbmNlLg0KICAtLT4gb25jZSBhIHJlc3BvbnNlIGlzIGRlbGl2ZXJlZCBi YWNrIHRvIHRoZSBjbGllbnQgcGlnZ3liYWNrZWQgb24gYW4gQUNLLCB0aGUgc2VydmVyIGNsb3Nl cyB0aGUgdHJhbnNhY3Rpb24gbm9ybWFsbHkgYW5kIG5vIGZ1cnRoZXIgc3RhdGUgZm9yIHRoZSB0 cmFuc2FjdGlvbiBpcyBrZXB0Lg0KICAtLT4gbm9ybWFsbHkgaWYgYSBzZXJ2ZXIgc2VuZHMgNS4w MyB3aXRoIE1heC1BZ2UgdGhlIGNsaWVudCBuZWVkcyB0byBzZW5kIGEgbmV3IHJlcXVlc3QgaS5l LiByZXRyeSB3aXRoIGEgbmV3IHJlcXVlc3QgYWZ0ZXIgdGhpcyB3YWl0aW5nIHRpbWUuICAgVGhh dCBpbXBsaWVzIHRoZSBjbGllbnQgd291bGQgbmVlZCB0byByZXNlbmQgdGhlIGVudGlyZSByZXF1 ZXN0OiBhbGwgYmxvY2tzIG9mIGl0IQ0KICAtLT4gSSBkbyByZWFsaXplIHRoYXQgcmVzZW5kaW5n IGFsbCBibG9ja3MgaXMgdmVyeSBpbmVmZmljaWVudCA7IGJ1dCBhdCB0aGUgc2FtZSB0aW1lIHRo ZSBleGFtcGxlIGFsc28gc2VlbXMgaW5jb21wYXRpYmxlIHdpdGggQ29BUCBzcGVjcy4NCiAgLS0+ IGFub3RoZXIgcXVlc3Rpb24gaXMgd2h5IGRvZXMgdGhlIHNlcnZlciB1c2UgQmxvY2syIG9wdGlv biBpbiB0aGUgNS4wMyByZXNwb25zZSB0aGF0IGhhcyBubyBwYXlsb2FkLiBJbiBSRkMgNzk1OSBT ZWN0aW9uIDIuMSwgInRoZSBCbG9jazIgT3B0aW9uIHBlcnRhaW5zIHRvIHRoZSByZXNwb25zZSBw YXlsb2FkIiBhbmQgInBheWxvYWQtYmVhcmluZyByZXNwb25zZXMiLiBTbyBpdCBzaG91bGQgYmUg anVzdCBsZWZ0IG91dCBpbiB0aGUgcmVzcG9uc2Ugd2l0aG91dCBwYXlsb2FkIEkgdGhpbmsuDQog IC0tPiBJIHVuZGVyc3RhbmQgdGhpcyBzZXF1ZW5jZSBvZiBtZXNzYWdlcyB3YXMgdGVzdGVkIHVz aW5nIGludGVyb3BzL2NvZGU7IHdhcyBhIHNwZWNpZmljIENvQVAgbGlicmFyeSB1c2VkIHRoYXQg ZXhoaWJpdHMgdGhpcyBiZWhhdmlvcj8gSSB3b3VsZCBiZSBpbnRlcmVzdGVkIHRvIHVuZGVyc3Rh bmQgYmV0dGVyIHdoeSB0aGlzIHdvcmtzLg0KDQpIb3BlIHRoZXNlIGNvbW1lbnRzIGNhbiBzdGls bCBiZSB1c2VkIGZvciBpbXByb3ZlbWVudCBvZiB0aGUgc3BlYy4gSSB3aWxsIHNlbmQgZnVydGhl ciByZXZpZXcgY29tbWVudHMgaW4gYSBuZXh0IGVtYWlsOiBzdGlsbCBuZWVkIHRvIHdyaXRlIHRo ZXNlIGRvd24uDQoNCkJlc3QgcmVnYXJkcw0KRXNrbw0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0NCkZyb206IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lz Y28uY29tPiANClNlbnQ6IE1vbmRheSwgTWF5IDIwLCAyMDE5IDE3OjMxDQpUbzogRXNrbyBEaWpr IDxlc2tvLmRpamtAaW90Y29uc3VsdGFuY3kubmw+OyBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJF OiBbQWNlXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0KVGhh bmtzIEVza28uIA0KDQpBZGRyZXNzZWQgaW4gaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAx NS9FU1QtY29hcHMvYmxvYi84NGNlMGMxZDVlNzY4ZDQwZTk3MTg0MjE0YmFlNDA0ZGEyMWJkMDUw L2RyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LnhtbCBUd28gY29tbWVudHM6IA0KDQo+IHBhZ2UgMTEg Ym90dG9tIHJlcXVpcmVtZW50OiAiIFRoZSBjbGllbnQgU0hPVUxEIHVzZSByZXNvdXJjZSBkaXNj b3Zlcnkgd2hlbiBoZSBpcyB1bmF3YXJlIG9mIHRoZSBhdmFpbGFibGUgIEVTVC1jb2FwcyByZXNv dXJjZXMuIiAtIHdoZW4gYW4gRVNUIHNlcnZlciBpcyBrbm93biwgdGhpcyByZXF1aXJlbWVudCBk b2VzIG5vdCByZWFsbHkgYXBwbHkgc2luY2UgdGhlIHNlcnZlciBhbHdheXMgc3VwcG9ydHMgLndl bGwta25vd24gRVNUIHJlc291cmNlcy4gIFNvIEkgcmVhZCBpdCBhcyBkb2luZyBhbiBSRCBkaXNj b3Zlcnkgb3IgbXVsdGljYXN0IENvQVAgZGlzY292ZXJ5IGlmIHRoZSBjbGllbnQgZG9lc24ndCBr bm93biB0aGUgRVNUIHNlcnZlciBhZGRyZXNzLiAgSG9wZSB0aGlzIGlzIGNsZWFyIGVub3VnaCBp biB0aGUgdGV4dCBhbmQgaW50ZW5kZWQ/DQoNClRoZXJlIGFyZSBvcHRpb25hbCByZXNvdXJjZXMg bGlrZSAvYXR0LCAvc2tnIGFuZCAvc2tjIHRoYXQgdGhlIHNlcnZlciBkb2VzIG5vdCBoYXZlIHRv IHN1cHBvcnQsIHNvIHRoYXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcgdG8u IA0KDQo+IHBhZ2UgMTEgYm90dG9tOiAiIEl0IGlzIHVwIHRvIHRoZSBpbXBsZW1lbnRhdGlvbiB0 byBjaG9vc2UgaXRzIHJlc291cmNlIHBhdGhz4oCdIC0+IHNlZW1zIG5vdCByZWFsbHkgdGhlIGNh c2UsIGJlY2F1c2UgdGhlIHJvb3QgcmVzb3VyY2Ugc3RydWN0dXJlIGlzIGZvcmNlZCBieSB0aGUg c3BlY2lmaWNhdGlvbi4gSXQgY291bGQgaGF2ZSBiZWVuIGRlc2lnbmVkIGFzIGZyZWUgY2hvaWNl IChiZWNhdXNlIGl0IGNhbiBiZSBkaXNjb3ZlcmVkIGFueXdheSkgYnV0IGl0IGlzIG5vdC4NCg0K VGhlIHRleHQgc2F5cyB0aGF0IHRoZSBzZXJ2ZXIgTVVTVCBzdXBwb3J0IHRoZSBkZWZhdWx0IC8u d2VsbC1rbm93bi9lc3Qgcm9vdCByZXNvdXJjZSBhbmQgaXQgU0hPVUxEIHN1cHBvcnQgcmVzb3Vy Y2UgZGlzY292ZXJ5IGZvciBub24tZGVmYXVsdCBVUklzIChsaWtlIC9lc3Qgb3IgL2VzdC9BcmJp dHJhcnlMYWJlbCkgb3IgcG9ydHMuIEluIHRoZSBsYXR0ZXIgY2FzZSBpdCBpcyB1cCB0byB0aGUg c2VydmVyIHRvIGRlY2lkZSB0aGUgcGF0aHMgaGUgbWFrZXMgaXRzIHJlc291cmNlcyBhdmFpbGFi bGUgYXQuIFRoYXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcgdG8uIEJ1dCB5 b3UgYXJlIHJpZ2h0OyBJIHJlYWxpemVkIHRoYXQgdGhpcyBzZW50ZW5jZSBpcyByZWR1bmRhbnQg c28gSSBvbmx5IGtlcHQgIlRocm91Z2hvdXQgdGhpcyBkb2N1bWVudCB0aGUgZXhhbXBsZSByb290 IHJlc291cmNlIG9mIC9lc3QgaXMgdXNlZC4iDQoNCldpbGwgcmV1cGxvYWQgdGhlIG5leHQgaXRl cmF0aW9uIGluIGEgZmV3IGRheXMuIA0KDQpSZ3MsDQpQYW5vcw0KDQoNCg== From nobody Mon May 27 14:56:39 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FA49120043; Mon, 27 May 2019 14:56:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bov76lEddkhW; Mon, 27 May 2019 14:56:30 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 956BB1200CD; Mon, 27 May 2019 14:56:28 -0700 (PDT) Received: from Jude (192.168.1.155) by mail2.augustcellars.com (192.168.1.201) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 27 May 2019 14:55:42 -0700 From: Jim Schaad To: 'Francesca Palombini' CC: , References: <4B0C53D0-D41A-4AC3-912C-4E214BA1A85F@ericsson.com> In-Reply-To: <4B0C53D0-D41A-4AC3-912C-4E214BA1A85F@ericsson.com> Date: Mon, 27 May 2019 14:55:39 -0700 Message-ID: <010601d514d6$ee026970$ca073c50$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0107_01D5149C.41AA2120" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQDEzdIpA3rfv0cbIuP/jvleUBx2P6if33BA X-Originating-IP: [192.168.1.155] Archived-At: Subject: Re: [Ace] draft-ietf-ace-key-groupcomm review X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 May 2019 21:56:38 -0000 ------=_NextPart_000_0107_01D5149C.41AA2120 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is most of them. =20 Jim =20 =20 From: Francesca Palombini =20 Sent: Monday, May 27, 2019 4:43 AM To: Jim Schaad Cc: Ace ; draft-ietf-ace-key-groupcomm@ietf.org Subject: draft-ietf-ace-key-groupcomm review =20 Hi Jim, =20 Thank you so much for the in depth review. Apologies for the delay, we = have had several meetings and back and forth between authors and have = finally gone through your comments, and that took a while longer than = expected. We have combined below all the mails regarding = ace-key-groupcomm, so to keep the discussion in one single thread. =20 For some of the comments, we=E2=80=99d like to get more input from you, = while for others we have pointed out the proposal to fix the issue. For = the latter, we mark them with AP and we=E2=80=99ll start implementing = them in the document, if you don=E2=80=99t object. =20 ------------------------ Security Model and other issues for group messaging - 09/04/2019 =20 I need to look at this more closely =E2=80=93 will respond later =20 I have been going through the design process for getting software = running for Montreal and I have come across the following issues that I think = need some discussion. Some of these may just need clarification in documents = but other are more substantive. =20 It took me a while to determine that one of the strange issues I was = having is that when looking just at the multicast case my mental model of who = was making the decisions on if access was allowed did not seem to make a = good match to what was being documented. =20 I rather expected that all of the ACL decisions were going to be made on the AS and none on the KDC. =20 This is correct. The model for the ace-key-groupcomm (and consequently = ace-key-groupcomm-oscore and ace-coap-pubsub) is that the AS does all of = the ACL and KDC does the key distribution. =20 This meant that the inclusion of scope in all of the messages was redundant if = sending messages to a per group resource. =20 You are correct, scope is indeed redundant in some messages, for example = in the Key Distribution Request, as it is present in the token. (See = point 12 below) =20 Part of the questions involved here are who does the configuration for what key groups are associated with what application groups. =20 I was always thinking of a single key group which was identified by the AS and sent to the KDC without the KDC needing to know = the details of multiple resources for that key group. This of course does = not match the model in the document. Some text on what model is being laid = out is probably worthwhile. =20 We=E2=80=99d like clarifications here: why do you say that this does not = match the current model? That was the objective anyway. =20 There was discussions for the ACE OAuth document about how to handle multiple access tokens for a single entity that need to be looked at in = the context of a KDC. The current rule is that a resource server needs only = to keep one token for any single supplicant. This was mostly discussed in = the context of adding and subtracting privileges for the supplicant. It may = be that this also needs to be viewed in the context of having completely disjoint resources on a single RS which are going to have different AS tokens issued. =20 Thus for example, if there is a KDC which is servicing two different key groups. The supplicant gets a token for group1, gets the = keys from the KDC. It then asks for a token for group2. Given that the lifetimes of these different tokens could be radically different does it really make sense to require that the two AS tokens be merged together (assuming they are from the same source) or would it make more sense to relax the RS only needs to keep one token rule. An easy way out of this might be to say one token per resource, but for constrained devices it = could be one token per RS. =20 We agree with relaxing the =E2=80=9Cone token per RS per = client=E2=80=9D. The requirement makes sense when one RS is associated = with one AS, but in our case the KDC could be associated with several AS = for different scopes. = = draft-ietf-ace-oauth-authz-24#section-5.1 says "... the AS in charge of a resource hosted at the RS ..." So this = is a more general problem, as it is allowed in the ACE framework to have = multiple ASs covering different resources/scopes at a same RS. We think = this requirement should be relaxed in the general case, as merging = tokens from different ASs would definitely be a problem. We=E2=80=99d = like to raise this issue to the ACE framework authors and get feedback = from the WG. =20 Jim =20 ------------------------ =20 draft-ietf-ace-key-groupcomm - 03/04/2019 03:00 =20 I read this document on the flight back with the idea of thinking about doing an implementation. In the process I found that it does not seem = to be ready to start on an implementation. =20 Just a note: no, this document is not written to be implemented on its = own, but paired with one of the dependent documents, such as = ace-key-groupcomm-oscore and ace-coap-pubsub, which give the details = that are missing (a bit like framework and profiles). =20 1. This document is written explicitly in terms of using CBOR as the encoding format. Should it be written such that either JSON or CBOR can = be used for the underlying encoding? While I personally don't care, it may = be that either Hannes or the MQTT authors might find this to be something = that would be useful. =20 We haven=E2=80=99t noticed interest from the WG, but if there is we can = definitely define it more generally. For now we will anyway add some = note to say that using JSON is possible (conversion specified in = Sections 4.1 and 4.2 of RFC 7049) (AP1) [JLS] That makes sense to me. 2. Is there a content type that is planned for the messages used in = this document? If the plan was to use application/ace+cbor then this both = needs to be stated and should be cleared with the group in general. If there = is no plan to create one then it would be useful to state this. =20 Where ACE is used (3 first messages), the content-format used is the one = defined in ACE (application/ace+cbor and possibly application/cwt). In = the last 2 messages (Key distribution Request and Response) the = content-format is supposed to be application/cbor, as that is the type = of the payload: we will explicitly add that. (AP2) [JLS] Looks good 3. The document does not have a table which deals with abbreviations, = does this mean that the full text string is what is going to be the key? Depending on the content type being considered, these values could be assigned (new registry) or marked as TBD, but if this is supposed to = happen then it needs to be placed in the document. =20 Yes, we need to do this. We will create a new registry for them, and = re-use the same number as ACE as much as possible (for parameters that = appear in both, such as =E2=80=98profile=E2=80=99, = =E2=80=98exp=E2=80=99) (AP3) [JLS] Sounds reasonable. I am currently building a spreadsheet with = some of this date and will forward it to you. 4. Should the references to RFC 7390 be replaced with the new document being considered for the CoRE working group? =20 Yes, hoping that it moves forward quickly. For now we can mention both. = (AP4) [JLS] Sounds good. 5. Section 2 - In the last paragraph - should the word "further" be omitted as there did not seem to be any previous communications = discussed. =20 Yes, remains of copy-paste. (AP5) [JLS] Sounds good. 6. Section 3.1 - Is there a reason why one cannot request access from = the AS for multiple groups/topics in the same request to the AS? 'scope' =20 This was the case in a previous version of the document. We got feedback = that this was too complicated and not a hot need. We can reconsider if = more people in the WG want this. [JLS] I can understand this reaction. You might also look at the MQTT = document which is allowing for this and see if alignment is needed. 7. Section 3.1 - Is there a definition of the values for "role" that = can be requested. What is the type of this field for a single value, or for elements of the array? Is there a default if role is omitted on the request? =20 There is no definition in this doc for specific admitted values, that is = defined on the additional instances (ace-key-groupcomm-oscore, = ace-coap-pubsub). Roles are specific to the applications, so it makes = little sense to specify them in general. The default value, if any, = would also be defined in the instances. What we will do is to clarify = this in the text. Moreover, this will be part of the =E2=80=9CMandatory = to define=E2=80=9D (see point 39). (AP6) [JLS] I will need to think about this. It may make things hard on the = AS depending on how it is designed. 8. Section 3.2 - IN the last paragraph did you mean to say that a new = token would be returned or that the existing token can be returned. =20 That a new token would be returned. How can we clarify? [JLS] The string =E2=80=9Ccan simply replay with=E2=80=9D is what messed = me up. Better would be =E2=80=9Cthe AS replies with an Authorization = Response with a new access token.=E2=80=9D The use of = =E2=80=9Ccan=E2=80=9D is not the same as =E2=80=9Cwill=E2=80=9D. 9. Section 4.1 - If the 'client_cred' field in a request is filled in, = and it is not the same as the public key used to establish the TLS session between the client and the KDC, what is the procedure to do a POP on = this key? =20 In the specific case you describe, an easy solution would be to require = the client to use the same key in =E2=80=98client_cred=E2=80=99 and to = establish the TLS session, and that would solve the POP. But we do have = the open point on POP for the public key in the general case. Until now, = we kept that out of the scope of this and dependent documents (see = section 8 of ace-key-groupcomm-oscore), but we are looking to include = it. =20 One possibility we are considering is to sign the key distribution = request together with a nonce that was sent from the KDC (for the sake = of freshness), using the private key paired to the public key sent in = =E2=80=98client_cred=E2=80=99. Do you have feedback about this? [JLS] that would be a reasonable solution. You could potentially also = use a TLS exporter value as that would be channel bound. =20 10. Section 4.1 - What is the data structure for client_cred? =20 We will add that: we propose CBOR bstr. That is the most general format, = if for example COSE_Keys are used, they can be wrapped in a bstr. (AP7) [JLS] That should work. 11. Section 4.1 - For 'pub_keys_repos' what is the format of this field? =20 We will add that as CBOR array of tstr containing URIs. (AP8) [JLS] Looks good. =20 12. Section 4.2 - I am not completely sure that I understand what verification checking means in the first paragraph. =20 The KDC verifies that the =E2=80=98scope=E2=80=99 received in the Key = Distribution Request is the same as =E2=80=98scope=E2=80=99 stored in = the access token associated to this client. This scope field is not = strictly necessary, as all the info is in the token anyway (which is why = it is optional). But implementation feedback was that it is good to = have. [JLS] Does it have to be equal or can it be a subset? 13. Section 4.2 - What is the profile that I am checking for the 'kty' field? Was I supposed to have a chance to request a profile someplace? =20 The profile checking is against the ACE Groupcomm Profile registry = defined here, i.e. for now either "coap-group-oscore" of "coap-pubsub" = (so not the same as the ACE profile). This is to make sure that the = correct type of key is used, as defined in the instance document used = (such as ace-key-groupcomm-oscore). No, the client do not request the = profile, the AS determines it and sends it to the Client in the Key = Distribution Response. [JLS] I=E2=80=99ll have to look at this during implementation.=20 =20 14. Section 4.2 - Put the fact that the 'key' field is profile dependent = on the 'kty' in the 'key' paragraph. Is it legal to define a 'kty' which = does not have a 'key' field? If so then should this field be defined by the profile? Ok, I just read the full next paragraph and now I am just confused. =20 Yes, 'key' format is dependent on 'kty'. Also yes, in theory one profile = could define a =E2=80=98kty=E2=80=99 for which =E2=80=98key=E2=80=99 is = empty (Note that the =E2=80=98key=E2=80=99 field itself MUST be present = in the CBOR map). What is unclear and what paragraph are you referring = to? =20 15. Section 4.2 - What is the type of profile? =20 Int, as specified in the "CBOR Value" column of the ACE Groupcomm = Profile in Section 9.2. [JLS] Text gives a type for the other fields, or says is profile = specific, but not that one =20 16. Section 4.2 - Is exp supposed to be a UNIX time - if so then it = should say so. Might be easier to reference this as CBOR Tag 1 w/o the tag. =20 Yes, UNIX time, same as =E2=80=9Cexp=E2=80=9D defined in RFC7519. We = will clarify with a direct reference to that. (AP9) [JLS] sounds good 17. Section 4.2 - 'pub_keys "In case public keys are represented as COSE_KEYS" Does this mean that other items are legal - if so then how = am I supposed to know this. =20 Good point. We will move the negotiation that is now defined in the = ace-key-groupcomm-oscore (see for example 4.1 paragraph 2) to this = document, to make it more general. (AP10) [JLS] Sounds reasonable 18. Section 4.2 - What is the type of 'group_policies'? =20 We propose a CBOR map. See also point 2 of =E2=80=9CMail regarding = draft-ietf-ace-key-groupcomm=E2=80=9D for more details about this. = (AP11) [JLS] Sounds reasonable 19. Section 4.2 - What is the type of 'mgt_key_material'? =20 We propose CBOR bstr, with specific definition left to the instance = document, as it depends a lot on the particular scheme used in the = group. (AP12) =20 20. Section 4.2 - The last paragraph seems to be something of a non-sequitur. Perhaps this is better omitted and just put someplace = else, like the next section. =20 Yes, we will move that. Our proposal is to put it in the end of section = 4. (AP13) [JLS] I think that is reasonable 21. Section 5 - Is there some type of requirement for positive delivery = of new keys in the event of a KDC changing the key. I put this here wrt a = node leaving, but it applies equally to a node getting itself added. =20 We are not sure we understand this question. Are you asking about ACK of = (successful) delivery of new keys? In that case, if the rekeying is = performed node-by-node as described in this document, using confirmable = messages should be enough. Otherwise, it would be mostly left to the = single nodes to eventually find out that they are using stale key = material and should individually ask for the latest one. [JLS] For some types of lists, it makes sense that there should be some = type of forcing function that a sender is going to understand that there = are new keys before sending a message out. This would require a = positive delivery or a policy that says always check before sending. = Doing a multicast message cannot be done confirmable according to the = normal specifications so you would not necessarily do a fast = notification if it needs to be done on individual messages. I am not = sure what, if anything, needs to be said here. This may just be = considerations someplace =20 22. Section 5.1 - There currently is no way for an AS to communicate to = the KDC that an authorization has been revoked. There is only a way for a = KDC to ask the AS by introspection. The first sentence is problematic. Do = we need some type of extension to support this? =20 Right, that is not defined in ACE, we will remove this sentence. = We=E2=80=99d also like to get feedback from the WG about this. (AP14) [JLS] Makes sense. I think this just needs to be highlighted as = introspection. It might be nice to define a multiple token = introspection message at some point to the KDC could, in a single = message, get all of the statuses before doing a key update operation. 23. Section 5.2 - If a topic is provided and the user is authorized for = two topics which use the same group, what happens if the user asks to leave = one of those two topics but wants to say on the other? =20 =20 See section 5.2:=20 =20 Note that the 'role' field is omitted since such a request should only be used to leave a group altogether. If the leaving node wants to be part of a group with fewer roles, it does not need to communicate that to the KDC, and can simply stop acting according to such roles. =20 If two topics (application groups) are covered by the same security = group, and a user wants to stop following one topic while still being = authorized, it does not need to leave the security group, it can just = discard future messages related to that topic. The actual leaving of = application groups, e.g. unsubscribing from a topic, is out of the scope = of this document. [JLS] But the scope field is included in the token. I am not sure that = I see any use of the scope field here at all. 24. Section 5.2 - What is the purpose of providing the 'client_cred' in = a leave request. It makes more sense to provide the id in the group than = this Field. =20 Just to make it easier for the implementer on knowing which key to = remove on the KDC (it is optional and should match the key the KDC has. = But we can remove that, as the KDC is supposed to know that. (AP15) [JLS] Makes sense 25. Section 5.2 - It is not clear to me that the correct answer to a = badly formatted leave request is to send a bad request error back. I would = think that as long as the KDC can figure out what is being referred to then = the sender should be removed from the group. =20 Ok, "not formatted correctly" meant that the KDC cannot figure out what = it is asked to do. We will rephrase for clarity. (AP16) [JLS] Sounds good 26. Section 5.2 - It is not clear to me if the last paragraph means that = the KDC can remove the AS access token from it's database when a leave = occurs, or if it can only be removed when it expires. =20 That paragraph was meant to mean that the token can be removed only when = it expires (or when you update it). What are we missing? [JLS] You are not necessarily missing something. However this could be = done by the KDC forgetting the token when the leave occurs and the = client supplying the token again when it does a later join. This means = that the KDC only needs to have tokens for currently active members and = not for all past members which still have valid tokens. 27. Section 6 - If the 'exp' parameter is not specified, when does = keying material expire? This is not covered in the first paragraph. =20 Right, we missed this. We will add this to the Key Distribution = Response. (AP17) [JLS] Sounds good. 28. Section 6 - in the second paragraph it says that the problem is not being able to decrypt a message, the correct condition is not being able = to find key material. A corruption in the message should not require the entity to looking for a rekey event to be checked. This is a bad DOS = vector otherwise. =20 Right, we will clarify. (AP18) [JLS] sounds good 29. Section 6 - Should a KDC employ a best effort to keep the same kid = value when a group is rekeyed so that one could check the signature even if = the key material has moved on as this would provide a potential DOS attack = to be attenuated. =20 Yes, we will add a sentence about that (although we suggest a MAY employ = a best effort) after paragraph 2 of section 6. (AP19) [JLS] As long as the reasoning is included as well, that should be fine. 30. Section 6 - should a client keep a the decryption failures so that = they can be decrypted after getting new key material or is this to be treated = as a loss of message? =20 This would be up to the application to decide, and more related to = specifications about message exchange/processing like Group OSCORE. We = will add a sentence about this being application dependent. (AP20) [JLS] sounds fine 31. Section 6 - How does the event of sending the re-key material as a multicast message in general lock out the entity that just left the = group? This should be discussed. =20 We can surely clarify that this is not about one single multicast = message containing the key. The point is exactly about using secure = rekeying schemes that, by sending also multicast messages, are able to = lock out the leaving node and effectively exclude it. (AP21) [JLS] Sounds good =E2=80=93 a reference to such a scheme might be useful 32. Section 6 - There needs to be a method for a client to say that it needs a new key id someplace in the protocol which may or may not cause = a new re-key operation in the event that it sends too many messages on the current content. =20 Ok, we will add text on how to get updated keying material. =20 The proposal is to add a =E2=80=9CType=E2=80=9D field to requests, as we = have enough types to motivate that (key distribution request, leave = request, update key request, new key request). We will register the = different types in a new IANA registry. The two new types are intended = for current group members and are the following: =20 * =E2=80=9Cupdate=E2=80=9D: the node can send it to get updated keying = material (might get back the same, if it didn't change). =20 * =E2=80=9Cnew=E2=80=9D: the node can send it to retrieve a *new* key = id, if it needs new keying material (e.g. seq numbers have wrapped = around, expiration, etc). =20 We will also remove the =E2=80=9Cleave=E2=80=9D field as that is not = needed anymore. (AP22) [JLS] Sounds reasonable 33. Section 6.1 - What happens if I ask for a key re-distribution, but supply a different scope than for the original message < assumes a multi-topic scope>. I am not sure what the purpose of the scope is at = this time given that you are not checking roles as well. =20 Role is not checked as the Key Re-Distribution Request is done to = retrieve the group keying material, not the public keys for signature = verification. For example, in pubsub, the node is re-requesting the = symmetric key to protect the communication. The KDC does not need to = know nor check if the node is an authorized pub or a sub, but only that = it is authorized to that topic. Checking the scope make sure that a node = that is authorized for a certain topic does not request the material for = another topic. =20 Why would you want to ask key distribution for one scope only when both = scopes map to the same security keying material? [JLS] Because it is easier on the client. I can ask for the specific = token that caused the problem and not have to remember all of the = different topics that are associated with the group.=20 34. OUT OF ORDER - Should a KDC have a single resource which allows for = it to return a group based on what the topic/scope is that is passed in = without the client first knowing what the group id is going to be? =20 I interpret your question as follows: you are wondering if the following = mechanism is/should be supported: the client sends a request to a well = known resource on the KDC asking "what is the sec group for this = topic/application group?" (topic could be in the payload for example). = The KDC responds with info about the security group (Group ID, etc). If = that is the case, that is taken care of by the resource directory, as = described in draft draft-tiloca-core-oscore-discovery. The KDC could = take that role too. If that is not the correct interpretation of this = comment, then could you expand? [JLS] Actually I was thinking of something more general. I can post the = request to a single common resource name and the KDC would lookup what = the correct group id would be for the request and internally dispatch it = to the correct internal resource. Might be easier on clients if only = one point is needed and no directory lookup is needed. 35. OUT OF ORDER - are all of the resource names required to be at the root? If I have a KDC which is shared with something else (say a Pub = Sub server) then it would make sense to have post to /KDC/group-id. =20 No, they don=E2=80=99t need to be at the root, they just need to be = associated to the group. [JLS] Take a look at the resource directory and pub sub more the set of = templates that they are using. Would this makes sense to use here to = address such issues? 36. Section 7.1 - what is the format of get_pub_keys when group member = ids are included? =20 We propose bstr as default type. Instances may change that if they need = to. (AP23) [JLS] What would be a case where something else would really make sense? = The group member id is currently define as something set for OSCORE = are you thinking that a different protocol might format them = differently? 37. Section 7.2 - There is a race condition caused by the last = paragraph in this section. Entity A sends a message, leaves the group, Entity B = receives the message and asks for the public key. Is this an issue? =20 We don't think this as an issue. In fact, A could wait for a reply from = B before leaving the group if it is critical that B receives A's = message. Otherwise, we could add some text about a policy for KDC to = maintain leaving group members=E2=80=99 Public Keys for a certain amount = of time after their leaving, before discarding them. Would that solve = the issue? (AP24) [JLS] If the message is just a broadcast then I would not expect A to = wait for a response. Yes what you suggest would solve the issue, it = would also solve the issue if you decided that this is totally = reasonable as A should not expect its message to be processed after it = has left the group. 38. Section 91. - can the profile column have multiple values? =20 Yes. We will add some text about allowing several profiles in this = column. (AP25) [JLS] Sounds good. 39. It would be useful to have a section which describes all of the = items that a profile must cover in order to be used. =20 Good idea. We will add that. (AP26) [JLS] Sounds good. Jim =20 ----------------------------------------- =20 draft-ietf-ace-key-groupcomm - 03/04/2019 03:29 =20 Should there be a case described where messages are relatively rare, but confidentiality is rare. In this case a simple question to the KDC = about the current group ID would be useful. =20 Could you expand on "confidentiality is rare"? Now we are adding this = new paragraph where a node can request the keying material to check if = it's been updated (see point 32). That should cover this comment, if I = understand you correctly. [JLS] That was a typo =E2=80=93 It should be =E2=80=9CConfidentiality is = extremely high.=E2=80=9D The above message about having an = =E2=80=9Cupdate=E2=80=9D message to the KDC would deal with this case = and provides additional motivation to that message. Jim =20 ----------------------------------------- =20 Mail regarding draft-ietf-ace-key-groupcomm - 04/04/2019 03:42 =20 Some additional things that need to be thought about. =20 1. Someplace as part of the re-key discussions there ought to be some commentary on the wisdom of rate limiting the frequency of doing = re-keying operations. =20 Ok, we can expand on some considerations that are now just quickly = mentioned. Our proposal is to add that other than rekeying due to = membership changes (if relevant to the application), periodic rekeying = should occur at the minimum rate necessary to discourage an adversary to = derive the key material out of brute force and traffic = collection/analysis. (AP27) [JLS] The case that I was actually thinking about was the membership = change rekeying. If you have 30 joins in the course of a minute, you = might want to delay the rekey messages slightly or make the presumption = that there is not traffic that needs to be protected on a backwards = basis to the first join. Similar issues will arise for leaves. 2. I think that there should be an optional parameter that says "If this much time has elapsed since the last time you checked, see if the group = id has changed." This would be combined with a polling client to ensure = that they check for an updated key context before doing some operation. =20 Ok. We propose to implement this mechanism as follow: =20 * We will define the format of =E2=80=98group_policies=E2=80=99 as CBOR = map. =20 * We will define a new registry for =E2=80=98group_policies=E2=80=99. =20 * In this registry, we will define a new parameter that contains the = time as you describe. If you have ideas about the name, that would be = very helpful. =20 And since we define the registry, we can add the =E2=80=9Csync seq = number=E2=80=9D parameter in it as well, which is listed as an example = right now. (AP28) [JLS] Sounds good =E2=80=93 =E2=80=9Ckey update check interval=E2=80=9D = might be a name 3. What happens in the following situations: a) The key context is changed between a request being sent and the = server receiving the request. This could just be because the sender did not = get the notification of the key context changing. b) The response takes "a while" to generate and the key context is = changed after the request is received, but before the response is sent. =20 Situations a) and b) are essentially the same, with the difference that = they happen either on client or on server (the node receives a message = encrypted with old/non recognized context). What happens in that case is = that the receiver would contact the KDC to verify that its own keying = material has not being updated (using the new =E2=80=9Cupdate=E2=80=9D = method defined in point 32). When it realizes it has the latest one, it = discards the message, and optionally sends back an error response (in = case a) that would hint that the message did not go through. In case b), = when verification fails on the client, I would expect the client to be = configured to try again, and this time it should hit the new security = context on the server. =20 See also = = https://core-wg.github.io/oscore-groupcomm/draft-ietf-core-oscore-groupco= mm.html#rfc.section.8.4 about keeping old security context for a while. = Did you want the same type of considerations in ace-key-groupcomm as = well? [JLS] In the first case it is a simple race condition and some type of = configurable keep the last context for a while does deal with this. The = second case is a bit different in terms of =E2=80=93 does the response = get sent under the new context, the old context or not at all. I = don=E2=80=99t know that I have any idea of what the right answer is and = having this described would be useful. c) The key context is changed in the middle of a block-wise transfer. =20 To me this is no different than the cases above. If one block fails, the = total message would fail. Considerations above apply. Do you think we = need additional considerations about blockwise here? [JLS] One could say that the sender of the blocks just changes the keys = and continues. As long as both sides get the new keying I don=E2=80=99t = think that this would cause a problem. But again yes it has much of the = same issues as above although it does have fun that it applies to both = the sender and the recipient. It is more problematic than the above = message in that depending on how fast keys are changed, you are going to = consume a large amount of the network resending the message from start = again and again. This is more of a problem than it is for case b above. Jim =20 ------------- =20 Thanks, Francesca and Marco =20 =20 ------=_NextPart_000_0107_01D5149C.41AA2120 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

This is most of = them.

 

Jim

 

 

From: Francesca Palombini = <francesca.palombini@ericsson.com>
Sent: Monday, May = 27, 2019 4:43 AM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: Ace = <ace-bounces@ietf.org>; = draft-ietf-ace-key-groupcomm@ietf.org
Subject: = draft-ietf-ace-key-groupcomm review

 

Hi = Jim,

 

Thank you so much = for the in depth review. Apologies for the delay, we have had several = meetings and back and forth between authors and have finally gone = through your comments, and that took a while longer than expected. We = have combined below all the mails regarding ace-key-groupcomm, so to = keep the discussion in one single thread.

 

For some of the = comments, we=E2=80=99d like to get more input from you, while for others = we have pointed out the proposal to fix the issue. For the latter, we = mark them with AP and we=E2=80=99ll start implementing them in the = document, if you don=E2=80=99t object.

 

--------------------= ----

Security Model and = other issues for group messaging - 09/04/2019

 

I need to look at this more closely =E2=80=93 = will respond later

 

I have been going = through the design process for getting software running

for Montreal and I = have come across the following issues that I think need

some discussion. = Some of these may just need clarification in documents but

other are more = substantive.

 

It took me a while = to determine that one of the strange issues I was having

is that when = looking just at the multicast case my mental model of who = was

making the = decisions on if access was allowed did not seem to make a = good

match to what was = being documented.

 

I rather expected = that all of the ACL

decisions were = going to be made on the AS and none on the KDC.

 

This is correct. = The model for the ace-key-groupcomm (and consequently = ace-key-groupcomm-oscore and ace-coap-pubsub) is that the AS does all of = the ACL and KDC does the key distribution.

 

This = meant

that the inclusion = of scope in all of the messages was redundant if sending

messages to a per = group resource.

 

You are correct, = scope is indeed redundant in some messages, for example in the Key = Distribution Request, as it is present in the token. (See point 12 = below)

 

Part of the = questions involved here are

who does the = configuration for what key groups are associated with what

application = groups.

 

I was always = thinking of a single key group which was

identified by the = AS and sent to the KDC without the KDC needing to know the

details of multiple = resources for that key group. This of course does not

match the model in = the document. Some text on what model is being laid out

is probably = worthwhile.

 

We=E2=80=99d like = clarifications here: why do you say that this does not match the current = model? That was the objective anyway.

 

There was = discussions for the ACE OAuth document about how to handle

multiple access = tokens for a single entity that need to be looked at in the

context of a KDC. = The current rule is that a resource server needs only to

keep one token for = any single supplicant. This was mostly discussed in the

context of adding = and subtracting privileges for the supplicant. It may be

that this also = needs to be viewed in the context of having completely

disjoint resources = on a single RS which are going to have different AS

tokens = issued.

 

Thus for example, = if there is a KDC which is servicing two

different key = groups. The supplicant gets a token for group1, gets the = keys

from the KDC. It = then asks for a token for group2. Given that the

lifetimes of these = different tokens could be radically different does it

really make sense = to require that the two AS tokens be merged together

(assuming they are = from the same source) or would it make more sense to

relax the RS only = needs to keep one token rule. An easy way out of this

might be to say one = token per resource, but for constrained devices it could

be one token per = RS.

 

We agree with = relaxing the =E2=80=9Cone token per RS per client=E2=80=9D. The = requirement makes sense when one RS is associated with one AS, but in = our case the KDC could be associated with several AS for different = scopes. d= raft-ietf-ace-oauth-authz-24#section-5.1

=

s= ays "... the AS in charge of a resource hosted at the RS ..." =  So this is a more general problem, as it is allowed in the ACE = framework to have multiple ASs covering different resources/scopes at a = same RS. We think this requirement should be relaxed in the general = case, as merging tokens from different ASs would definitely be a = problem. We=E2=80=99d like to raise this issue to the ACE framework = authors and get feedback from the WG.

 

Jim

 

--------------------= ----

 

draft-ietf-ace-key-g= roupcomm - 03/04/2019 03:00

 

I read this = document on the flight back with the idea of thinking about

doing an = implementation.  In the process I found that it does not seem to = be

ready to start on = an implementation.

 

Just a note: no, = this document is not written to be implemented on its own, but paired = with one of the dependent documents, such as ace-key-groupcomm-oscore = and ace-coap-pubsub, which give the details that are missing (a bit like = framework and profiles).

 

1.  This = document is written explicitly in terms of using CBOR as the

encoding format. =  Should it be written such that either JSON or CBOR can = be

used for the = underlying encoding?  While I personally don't care, it may = be

that either Hannes = or the MQTT authors might find this to be something that

would be = useful.

 

We = haven=E2=80=99t noticed interest from the WG, but if there is we can = definitely define it more generally. For now we will anyway add some = note to say that using JSON is possible (conversion specified in = Sections 4.1 and 4.2 of RFC 7049) (AP1)

[JLS] That makes sense to me.

2.  Is there a = content type that is planned for the messages used in this

document?  If = the plan was to use application/ace+cbor then this both = needs

to be stated and = should be cleared with the group in general.  If there = is

no plan to create = one then it would be useful to state this.

 

Where ACE is used = (3 first messages), the content-format used is the one defined in ACE = (application/ace+cbor and possibly application/cwt). In the last 2 = messages (Key distribution Request and Response) the content-format is = supposed to be application/cbor, as that is the type of the payload: we = will explicitly add that. (AP2)

[JLS] Looks good

3.  The = document does not have a table which deals with abbreviations, = does

this mean that the = full text string is what is going to be the key?

Depending on the = content type being considered, these values could be

assigned (new = registry) or marked as TBD, but if this is supposed to = happen

then it needs to be = placed in the document.

 

Yes, we need to = do this. We will create a new registry for them, and re-use the same = number as ACE as much as possible (for parameters that appear in both, = such as =E2=80=98profile=E2=80=99, =E2=80=98exp=E2=80=99) = (AP3)

[JLS] Sounds reasonable.=C2=A0 I am currently = building a spreadsheet with some of this date and will forward it to = you.

4.  Should the = references to RFC 7390 be replaced with the new document

being considered = for the CoRE working group?

 

Yes, hoping that = it moves forward quickly. For now we can mention both. (AP4)

[JLS] Sounds good.

5. =   Section 2 - In the last paragraph - should the word = "further" be

omitted as there = did not seem to be any previous communications discussed.

 

Yes, remains of = copy-paste. (AP5)

[JLS] Sounds good.

6.  Section = 3.1 - Is there a reason why one cannot request access from = the

AS for multiple = groups/topics in the same request to the AS? 'scope'

 

This was the case = in a previous version of the document. We got feedback that this was too = complicated and not a hot need. We can reconsider if more people in the = WG want this.

[JLS] I can understand this reaction.=C2=A0 You = might also look at the MQTT document which is allowing for this and see = if alignment is needed.

7.  Section = 3.1 - Is there a definition of the values for "role" that can = be

requested. =  What is the type of this field for a single value, or = for

elements of the = array?  Is there a default if role is omitted on the

request?

 

There is no = definition in this doc for specific admitted values, that is defined on = the additional instances (ace-key-groupcomm-oscore, ace-coap-pubsub). = Roles are specific to the applications, so it makes little sense to = specify them in general. The default value, if any, would also be = defined in the instances. What we will do is to clarify this in the = text. Moreover, this will be part of the =E2=80=9CMandatory to = define=E2=80=9D (see point 39). (AP6)

[JLS] I will need to think about this.=C2=A0 It = may make things hard on the AS depending on how it is = designed.

8.  Section = 3.2 - IN the last paragraph did you mean to say that a new = token

would be returned = or that the existing token can be returned.

 

That a new token = would be returned. How can we clarify?

[JLS] The string =E2=80=9Ccan simply replay = with=E2=80=9D is what messed me up.=C2=A0 Better would be =E2=80=9Cthe = AS replies with an Authorization Response with a new access = token.=E2=80=9D=C2=A0 The use of =E2=80=9Ccan=E2=80=9D is not the same = as =E2=80=9Cwill=E2=80=9D.

9.  Section = 4.1 - If the 'client_cred' field in a request is filled in, = and

it is not the same = as the public key used to establish the TLS session

between the client = and the KDC, what is the procedure to do a POP on this

key?

 

In the specific = case you describe, an easy solution would be to require the client to = use the same key in =E2=80=98client_cred=E2=80=99 and to establish the = TLS session, and that would solve the POP. But we do have the open point = on POP for the public key in the general case. Until now, we kept that = out of the scope of this and dependent documents (see section 8 of = ace-key-groupcomm-oscore), but we are looking to include it.

 

One possibility = we are considering is to sign the key distribution request together with = a nonce that was sent from the KDC (for the sake of freshness), =  using the private key paired to the public key sent in = =E2=80=98client_cred=E2=80=99. Do you have feedback about = this?

[JLS] that would be a reasonable solution.=C2=A0 = You could potentially also use a TLS exporter value as that would be = channel bound.

 

10.  Section = 4.1 - What is the data structure for client_cred?

 

We will add that: = we propose CBOR bstr. That is the most general format, if for example =  COSE_Keys are used, they can be wrapped in a bstr. = (AP7)

[JLS] That should work.

11. Section 4.1 - = For 'pub_keys_repos' what is the format of this field?

 

We will add that = as CBOR array of tstr containing URIs. (AP8)

[JLS] Looks good.

 

12. Section 4.2 - I = am not completely sure that I understand what

verification = checking means in the first paragraph.

 

The KDC verifies = that the =E2=80=98scope=E2=80=99 received in the Key Distribution = Request is the same as =E2=80=98scope=E2=80=99 stored in the access = token associated to this client. This scope field is not strictly = necessary, as all the info is in the token anyway (which is why it is = optional). But implementation feedback was that it is good to = have.

[JLS] Does it have to be equal or can it be a = subset?

13. Section 4.2 - = What is the profile that I am checking for the 'kty'

field?  Was I = supposed to have a chance to request a profile someplace?

 

The profile = checking is against the ACE Groupcomm Profile registry defined here, = i.e. for now either "coap-group-oscore" of = "coap-pubsub" (so not the same as the ACE profile). This is to = make sure that the correct type of key is used, as defined in the = instance document used (such as ace-key-groupcomm-oscore). No, the = client do not request the profile, the AS determines it and sends it to = the Client in the Key Distribution Response.

[JLS] I=E2=80=99ll have to look at this during = implementation.

 

14. Section 4.2 - = Put the fact that the 'key' field is profile dependent on

the 'kty' in the = 'key' paragraph.  Is it legal to define a 'kty' which = does

not have a 'key' = field?  If so then should this field be defined by the

profile?  Ok, = I just read the full next paragraph and now I am just

confused.

 

Yes, 'key' format = is dependent on 'kty'. Also yes, in theory one profile could define a = =E2=80=98kty=E2=80=99 for which =E2=80=98key=E2=80=99 is empty (Note = that the =E2=80=98key=E2=80=99 field itself MUST be present in the CBOR = map). What is unclear and what paragraph are you referring = to?

 

15. Section 4.2 - = What is the type of profile?

 

Int, as specified = in the "CBOR Value" column of the ACE Groupcomm Profile in = Section 9.2.

[JLS] Text gives a type for the other fields, or = says is profile specific, but not that one

 

16. Section 4.2 - = Is exp supposed to be a UNIX time - if so then it should

say so.  Might = be easier to reference this as CBOR Tag 1 w/o the tag.

 

Yes, UNIX time, = same as =E2=80=9Cexp=E2=80=9D defined in RFC7519. We will clarify with a = direct reference to that. (AP9)

[JLS] sounds good

17.  Section = 4.2 - 'pub_keys  "In case public keys are represented = as

COSE_KEYS" =  Does this mean that other items are legal - if so then how am = I

supposed to know = this.

 

Good point. We = will move the negotiation that is now defined in the = ace-key-groupcomm-oscore (see for example 4.1 paragraph 2) to this = document, to make it more general. (AP10)

[JLS] Sounds reasonable

18.  Section = 4.2 - What is the type of 'group_policies'?

 

We propose a CBOR = map. See also point 2 of =E2=80=9CMail regarding = draft-ietf-ace-key-groupcomm=E2=80=9D for more details about this. =  (AP11)

[JLS] Sounds reasonable

19.  Section = 4.2 - What is the type of 'mgt_key_material'?

 

We propose CBOR = bstr, with specific definition left to the instance document, as it = depends a lot on the particular scheme used in the group. = (AP12)

 

20.  Section = 4.2 - The last paragraph seems to be something of a

non-sequitur. =   Perhaps this is better omitted and just put someplace = else,

like the next = section.

 

Yes, we will move = that. Our proposal is to put it in the end of section 4. = (AP13)

[JLS] I think that is = reasonable

21. Section 5 - Is = there some type of requirement for positive delivery of

new keys in the = event of a KDC changing the key.  I put this here wrt a = node

leaving, but it = applies equally to a node getting itself added.

 

We are not sure = we understand this question. Are you asking about ACK of (successful) = delivery of new keys? In that case, if the rekeying is performed = node-by-node as described in this document, using confirmable messages = should be enough. Otherwise, it would be mostly left to the single nodes = to eventually find out that they are using stale key material and should = individually ask for the latest one.

[JLS] For some types of lists, it makes sense = that there should be some type of forcing function that a sender is = going to understand that there are new keys before sending a message = out.=C2=A0 This would require a positive delivery or a policy that says = always check before sending.=C2=A0 Doing a multicast message cannot be = done confirmable according to the normal specifications so you would = not=C2=A0 necessarily do a fast notification if it needs to be done on = individual messages.=C2=A0 I am not sure what, if anything, needs to be = said here.=C2=A0 This may just be considerations = someplace

 

22.  Section = 5.1 - There currently is no way for an AS to communicate to = the

KDC that an = authorization has been revoked.  There is only a way for a = KDC

to ask the AS by = introspection.  The first sentence is problematic.  Do = we

need some type of = extension to support this?

 

Right, that is = not defined in ACE, we will remove this sentence. We=E2=80=99d also like = to get feedback from the WG about this. (AP14)

[JLS] Makes sense.=C2=A0 I think this just needs = to be highlighted as introspection.=C2=A0 It might be nice to define a = multiple token introspection message at some point to the KDC could, in = a single message, get all of the statuses before doing a key update = operation.

23.  Section = 5.2 - If a topic is provided and the user is authorized for = two

topics which use = the same group, what happens if the user asks to leave one

of those two topics = but wants to say on the other?  

 

See section 5.2: =

 

  Note = that the 'role' field is omitted since such a request should

  only = be used to leave a group altogether.  If the leaving node = wants

  to be = part of a group with fewer roles, it does not need to

  commun= icate that to the KDC, and can simply stop acting according = to

  such = roles.

 

If two topics = (application groups) are covered by the same security group, and a user = wants to stop following one topic while still being authorized, it does = not need to leave the security group, it can just discard future = messages related to that topic. The actual leaving of application = groups, e.g. unsubscribing from a topic, is out of the scope of this = document.

[JLS] But the scope field is included in the = token.=C2=A0 I am not sure that I see any use of the scope field here at = all.

24.  Section = 5.2 - What is the purpose of providing the 'client_cred' in = a

leave request. =  It makes more sense to provide the id in the group than = this

Field.

 

Just to make it = easier for the implementer on knowing which key to remove on the KDC (it = is optional and should match the key the KDC has. But we can remove = that, as the KDC is supposed to know that. (AP15)

[JLS] Makes sense

25. Section 5.2 - =  It is not clear to me that the correct answer to a = badly

formatted leave = request is to send a bad request error back.  I would = think

that as long as the = KDC can figure out what is being referred to then the

sender should be = removed from the group.

 

Ok, "not = formatted correctly" meant that the KDC cannot figure out what it = is asked to do. We will rephrase for clarity. (AP16)

[JLS] Sounds good

26. Section 5.2 - = It is not clear to me if the last paragraph means that the

KDC can remove the = AS access token from it's database when a leave occurs,

or if it can only = be removed when it expires.

 

That paragraph = was meant to mean that the token can be removed only when it expires (or = when you update it). What are we missing?

[JLS] You are not necessarily missing = something.=C2=A0 However this could be done by the KDC forgetting the = token when the leave occurs and the client supplying the token again = when it does a later join.=C2=A0 This means that the KDC only needs to = have tokens for currently active members and not for all past members = which still have valid tokens.

27.  Section 6 = - If the 'exp' parameter is not specified, when does keying

material expire? =  This is not covered in the first paragraph.

 

Right, we missed = this. We will add this to the Key Distribution Response. = (AP17)

[JLS] Sounds good.

28.  Section 6 = - in the second paragraph it says that the problem is not

being able to = decrypt a message, the correct condition is not being able = to

find key material. =  A corruption in the message should not require the

entity to looking = for a rekey event to be checked.  This is a bad DOS = vector

otherwise.

 

Right, we will = clarify. (AP18)

[JLS] sounds good

29. Section 6 - = Should a KDC employ a best effort to keep the same kid value

when a group is = rekeyed so that one could check the signature even if the

key material has = moved on as this would provide a potential DOS attack to be

attenuated.

 

Yes, we will add = a sentence about that (although we suggest a MAY employ a best effort) = after paragraph 2 of section 6. (AP19)

[JLS] As long as the reasoning is included as = well, that should be fine.

30.  Section 6 = - should a client keep a the decryption failures so that = they

can be decrypted = after getting new key material or is this to be treated as

a loss of = message?

 

This would be up = to the application to decide, and more related to specifications about = message exchange/processing like Group OSCORE. We will add a sentence = about this being application dependent. (AP20)

[JLS] sounds fine

31.  Section 6 = - How does the event of sending the re-key material as a

multicast message = in general lock out the entity that just left the group?

This should be = discussed.

 

We can surely = clarify that this is not about one single multicast message containing = the key. The point is exactly about using secure rekeying schemes that, = by sending also multicast messages, are able to lock out the leaving = node and effectively exclude it. (AP21)

[JLS] Sounds good =E2=80=93 a reference to such = a scheme might be useful

32.  Section 6 = - There needs to be a method for a client to say that it

needs a new key id = someplace in the protocol which may or may not cause a

new re-key = operation in the event that it sends too many messages on = the

current = content.

 

Ok, we will add = text on how to get updated keying material.

 

The proposal is = to add a =E2=80=9CType=E2=80=9D field to requests, as we have enough = types to motivate that (key distribution request, leave request, update = key request, new key request). We will register the different types in a = new IANA registry. The two new types are intended for current group = members and are the following:

 

* = =E2=80=9Cupdate=E2=80=9D: the node can send it to get updated keying = material (might get back the same, if it didn't change).

 

* = =E2=80=9Cnew=E2=80=9D: the node can send it to retrieve a *new* key id, = if it needs new keying material (e.g. seq numbers have wrapped around, = expiration, etc).

 

We will also = remove the =E2=80=9Cleave=E2=80=9D field as that is not needed anymore. = (AP22)

[JLS] Sounds reasonable

33.  Section = 6.1 - What happens if I ask for a key re-distribution, but

supply a different = scope than for the original message < assumes a

multi-topic = scope>.  I am not sure what the purpose of the scope is at = this

time given that you = are not checking roles as well.

 

Role is not = checked as the Key Re-Distribution Request is done to retrieve the group = keying material, not the public keys for signature verification. For = example, in pubsub, the node is re-requesting the symmetric key to = protect the communication. The KDC does not need to know nor check if = the node is an authorized pub or a sub, but only that it is authorized = to that topic. Checking the scope make sure that a node that is = authorized for a certain topic does not request the material for another = topic.

 

Why would you = want to ask key distribution for one scope only when both scopes map to = the same security keying material?

[JLS] Because it is easier on the client.=C2=A0 = I can ask for the specific token that caused the problem and not have to = remember all of the different topics that are associated with the group. =

34.  OUT OF = ORDER - Should a KDC have a single resource which allows for = it

to return a group = based on what the topic/scope is that is passed in without

the client first = knowing what the group id is going to be?

 

I interpret your = question as follows: you are wondering if the following mechanism = is/should be supported: the client sends a request to a well known = resource on the KDC asking "what is the sec group for this = topic/application group?" (topic could be in the payload for = example). The KDC responds with info about the security group (Group ID, = etc). If that is the case, that is taken care of by the resource = directory, as described in draft draft-tiloca-core-oscore-discovery. The = KDC could take that role too. If that is not the correct interpretation = of this comment, then could you expand?

[JLS] Actually I was thinking of something more = general.=C2=A0 I can post the request to a single common resource name = and the KDC would lookup what the correct group id would be for the = request and internally dispatch it to the correct internal = resource.=C2=A0 Might be easier on clients if only one point is needed = and no directory lookup is needed.

35.  OUT OF = ORDER - are all of the resource names required to be at the

root?  If I = have a KDC which is shared with something else (say a Pub = Sub

server) then it = would make sense to have post to /KDC/group-id.

 

No, they = don=E2=80=99t need to be at the root, they just need to be associated to = the group.

[JLS] Take a look at the resource directory and = pub sub more the set of templates that they are using. =C2=A0Would this = makes sense to use here to address such issues?

36.  Section = 7.1 - what is the format of get_pub_keys when group member = ids

are = included?

 

We propose bstr = as default type. Instances may change that if they need to. = (AP23)

[JLS] What would be a case where something else = would really make sense?=C2=A0 The group member id is currently define = as something set for OSCORE=C2=A0 are you thinking that a different = protocol might format them differently?

37.  Section = 7.2 - There is a race condition caused by the last paragraph = in

this section. =  Entity A sends a message, leaves the group, Entity B = receives

the message and = asks for the public key.  Is this an issue?

 

We don't think = this as an issue. In fact, A could wait for a reply from B before = leaving the group if it is critical that B receives A's message. = Otherwise, we could add some text about a policy for KDC to maintain = leaving group members=E2=80=99 Public Keys for a certain amount of time = after their leaving, before discarding them. Would that solve the issue? = (AP24)

[JLS] If the message is just a broadcast then I = would not expect A to wait for a response.=C2=A0 Yes what you suggest = would solve the issue, it would also solve the issue if you decided that = this is totally reasonable as A should not expect its message to be = processed after it has left the group.

38. Section 91. - = can the profile column have multiple values?

 

Yes. We will add = some text about allowing several profiles in this column. = (AP25)

[JLS] Sounds good.

39.  It would = be useful to have a section which describes all of the items

that a profile must = cover in order to be used.

 

Good idea. We = will add that. (AP26)

[JLS] Sounds good.

Jim

 

--------------------= ---------------------

 

draft-ietf-ace-key-g= roupcomm - 03/04/2019 03:29

 

Should there be a = case described where messages are relatively rare, but

confidentiality is = rare.  In this case a simple question to the KDC about

the current group = ID would be useful.

 

Could you expand = on "confidentiality is rare"? Now we are adding this new = paragraph where a node can request the keying material to check if it's = been updated (see point 32). That should cover this comment, if I = understand you correctly.

[JLS] That was a typo =E2=80=93 It should be = =E2=80=9CConfidentiality is extremely high.=E2=80=9D=C2=A0 The above = message about having an =E2=80=9Cupdate=E2=80=9D message to the KDC = would deal with this case and provides additional motivation to that = message.

Jim

 

--------------------= ---------------------

 

Mail regarding = draft-ietf-ace-key-groupcomm - 04/04/2019 03:42

 

Some additional = things that need to be thought about.

 

1.  Someplace = as part of the re-key discussions there ought to be some

commentary on the = wisdom of rate limiting the frequency of doing re-keying

operations.

 

Ok, we can expand = on some considerations that are now just quickly mentioned. Our proposal = is to add that other than rekeying due to membership changes (if = relevant to the application), periodic rekeying should occur at the = minimum rate necessary to discourage an adversary to derive the key = material out of brute force and traffic collection/analysis. = (AP27)

[JLS] The case that I was actually thinking = about was the membership change rekeying.=C2=A0 If you have 30 joins in = the course of a minute, you might want to delay the rekey messages = slightly or make the presumption that there is not traffic that needs to = be protected on a backwards basis to the first join.=C2=A0 Similar = issues will arise for leaves.

2. I think that = there should be an optional parameter that says "If = this

much time has = elapsed since the last time you checked, see if the group id

has changed." =  This would be combined with a polling client to ensure = that

they check for an = updated key context before doing some operation.

 

Ok. We propose to = implement this mechanism as follow:

 

* We will define = the format of =E2=80=98group_policies=E2=80=99 as CBOR map.

 

* We will define = a new registry for =E2=80=98group_policies=E2=80=99.

 

* In this = registry, we will define a new parameter that contains the time as you = describe. If you have ideas about the name, that would be very = helpful.

 

And since we = define the registry, we can add the =E2=80=9Csync seq number=E2=80=9D = parameter in it as well, which is listed as an example right now. = (AP28)

[JLS] Sounds good =E2=80=93 =E2=80=9Ckey update = check interval=E2=80=9D might be a name

3.  What = happens in the following situations:

a) The key context = is changed between a request being sent and the server

receiving the = request.  This could just be because the sender did not = get

the notification of = the key context changing.

b) The response = takes "a while" to generate and the key context is = changed

after the request = is received, but before the response is sent.

 

Situations a) and = b) are essentially the same, with the difference that they happen either = on client or on server (the node receives a message encrypted with = old/non recognized context). What happens in that case is that the = receiver would contact the KDC to verify that its own keying material = has not being updated (using the new =E2=80=9Cupdate=E2=80=9D method = defined in point 32). When it realizes it has the latest one, it = discards the message, and optionally sends back an error response (in = case a) that would hint that the message did not go through. In case b), = when verification fails on the client, I would expect the client to be = configured to try again, and this time it should hit the new security = context on the server.

 

See also = https://core-wg.gi= thub.io/oscore-groupcomm/draft-ietf-core-oscore-groupcomm.html#rfc.sectio= n.8.4 about keeping = old security context for a while. Did you want the same type of = considerations in ace-key-groupcomm as well?

[JLS] In the first case it is a simple race = condition and some type of configurable keep the last context for a = while does deal with this.=C2=A0 The second case is a bit different in = terms of =E2=80=93 does the response get sent under the new context, the = old context or not at all.=C2=A0 I don=E2=80=99t know that I have any = idea of what the right answer is and having this described would be = useful.

c)  The key = context is changed in the middle of a block-wise transfer.

 

To me this is no = different than the cases above. If one block fails, the total message = would fail. Considerations above apply. Do you think we need additional = considerations about blockwise here?

[JLS] One could say that the sender of the = blocks just changes the keys and continues.=C2=A0 As long as both sides = get the new keying I don=E2=80=99t think that this would cause a = problem.=C2=A0 But again yes it has much of the same issues as above = although it does have fun that it applies to both the sender and the = recipient.=C2=A0 It is more problematic than the above message in that = depending on how fast keys are changed, you are going to consume a large = amount of the network resending the message from start again and = again.=C2=A0 This is more of a problem than it is for case b = above.

Jim

 

-------------=

 

Thanks,

Francesca and = Marco

 

 

------=_NextPart_000_0107_01D5149C.41AA2120-- From nobody Tue May 28 02:29:42 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 792211200FF; Tue, 28 May 2019 02:29:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6nhIQTMH5Nsn; Tue, 28 May 2019 02:29:36 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50066.outbound.protection.outlook.com [40.107.5.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 569BE12003E; Tue, 28 May 2019 02:29:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0MrmOMAgr6ZN6TzquEunaEtrReWSmaDcW0k81w/Speg=; b=UhPYV8BkGGCALieTwuQRiB0+LPKWd/KdvourTgH1xIRlbJHbVAS2BwMgSJ156TLO9OOH8q3QMjWRZw8r8eKRw/iSnPGprpDx8Cq9SBVi94xPnO9nS85AqsVJie75z9CT4oP0QvlYHNqe1JsyBf0VU6m95tjKUEeUGGBX7pGQJAA= Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com (10.168.185.17) by HE1PR0701MB2617.eurprd07.prod.outlook.com (10.168.184.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.14; Tue, 28 May 2019 09:29:28 +0000 Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::8a9:a4d6:303b:45f0]) by HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::8a9:a4d6:303b:45f0%5]) with mapi id 15.20.1943.015; Tue, 28 May 2019 09:29:28 +0000 From: Francesca Palombini To: Jim Schaad , "ace@ietf.org" CC: "draft-ietf-ace-key-groupcomm-oscore@ietf.org" Thread-Topic: draft-ietf-ace-key-groupcomm-oscore Thread-Index: AQHVFTfYPpErjgyNn0iE0xOyD54uCQ== Date: Tue, 28 May 2019 09:29:28 +0000 Message-ID: <3775CA7A-0174-4261-BBFA-09EFEAA07B4F@ericsson.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.87] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 91ebc228-8f07-4f56-4431-08d6e34efb6c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:HE1PR0701MB2617; x-ms-traffictypediagnostic: HE1PR0701MB2617: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00514A2FE6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(376002)(396003)(39860400002)(366004)(51444003)(189003)(199004)(110136005)(82746002)(86362001)(81166006)(8676002)(102836004)(3846002)(6116002)(25786009)(2501003)(14454004)(2906002)(6506007)(316002)(5660300002)(256004)(14444005)(66066001)(9326002)(66476007)(44832011)(7736002)(561944003)(8936002)(66556008)(186003)(6246003)(64756008)(53936002)(4326008)(33656002)(4743002)(26005)(71190400001)(71200400001)(83716004)(486006)(99286004)(6486002)(6436002)(68736007)(81156014)(476003)(66446008)(2616005)(76116006)(66946007)(73956011)(508600001)(6306002)(54896002)(6512007)(229853002)(36756003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2617; H:HE1PR0701MB2746.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 3QLdsByhh0dn85U5IdIgFbD6CCT3k37zW1i4DH4lSjLBoSmfrbh0LF2NVFigxJD9H3dM1clHXYb2kDfdg+3MdH+6awnztRjJlD1kfsbkrs/nK4jBTLtsYkVJJYY+XkVCimTLTT2QabrSJiMv2U0Sj9qyVFfZwDPFH9eKtbgxaoha6h987KW5QtDjNVOUiFTKcNdw+Y/4ma4uFu5/NJ8gX8xlaFk3trkiwF7EcItQW2Bqm0IMKJHDcFaH51pe8d+oV85Fw7YNhr2ZEOsO0yY5MBpNq6uWN8SgJkZdi7s/YGtIBaNt+1Da8SeVIp48pW/yybcQqYnJCBjjrGWqLReZuutn5nplQrRk58R4ziPmItSubtL23sKENoTSR98GN11EhuLNq2IPLUlKsSOUICtAD2aZbmQfIKwRBxQErGcNY0g= Content-Type: multipart/alternative; boundary="_000_3775CA7A01744261BBFA09EFEAA07B4Fericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 91ebc228-8f07-4f56-4431-08d6e34efb6c X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2019 09:29:28.2933 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: francesca.palombini@ericsson.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2617 Archived-At: Subject: Re: [Ace] draft-ietf-ace-key-groupcomm-oscore X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 09:29:40 -0000 --_000_3775CA7A01744261BBFA09EFEAA07B4Fericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmltLA0KVGhhbmtzIGFnYWluIGZvciB5b3VyIGluIGRlcHRoIHJldmlldy4gV2UgaGF2ZSBp ZGVudGlmaWVkIDcgY2xlYXIgQVBzIGZyb20gc29tZSBvZiB5b3VyIHJldmlldyBjb21tZW50cywg YW5kIHdlIGhvcGUgdGhhdCB3ZSBhbnN3ZXIgdGhlIG90aGVyIChpbmxpbmUpLiBQbGVhc2UgbGV0 IHVzIGtub3cgaWYgdGhhdCBpcyBvaywgYW5kIHdlIHdpbGwgdXBkYXRlIHRoZSBkb2N1bWVudCBh cyBzb29uIGFzIHBvc3NpYmxlLg0KDQpUaGFua3MsDQpGcmFuY2VzY2EgYW5kIE1hcmNvDQoNCkkg d2FzIHdhbmRlcmluZyB0aHJvdWdoIHRoZSBkb2N1bWVudCB3aXRoIGEgdmlldyB0byBpbXBsZW1l bnRpbmcgYW5kIGhhdmUNCnRoZSBmb2xsb3dpbmcgcXVlc3Rpb25zOg0KDQoxLiAgQWJzdHJhY3Q6 IEZyb20gdGhlIGZpcnN0IHBhcmFncmFwaCBJIGFtIG5vdCBzdXJlIGlmIHRoZSBncm91cA0KY29t bXVuaWNhdGlvbnMgb3IgdGhlIGNvbW11bmljYXRpb25zIHRvIHRoZSBLREMgYXJlIHNlY3VyZWQg d2l0aCBPU0NPUkUuDQoNClsqXSBPaywgd2UgcHJvcG9zZSB0byBjaGFuZ2Ug4oCcd2hlcmUgY29t bXVuaWNhdGlvbnMgYXJlIGJhc2Vk4oCdIHRvIOKAnHdoZXJlIHRoZSBncm91cCBjb21tdW5pY2F0 aW9uIGlzIGJhc2Vk4oCdLiBUaGUgY29tbXVuaWNhdGlvbiB0byB0aGUgS0RDIGlzIHVwIHRvIHRo ZSBwcm9maWxlIG9mIEFDRSB1c2VkIGJldHdlZW4gdGhlIGpvaW5pbmcgbm9kZSBhbmQgdGhlIEtE Qy4gKEFQMSkNCg0KMi4gIFNlY3Rpb24gMy4xIC0gInJlcXVlc3RlciIgc2VlbXMgdG8gYmUgYW4g b2RkIG5hbWUgZm9yICJzZW5kZXIiIG9yDQoicHVibGlzaGVyIg0KDQpbKl0gVGhpcyBwYXJ0aWN1 bGFyIGRvY3VtZW50IGRvZXMgbm90IGNvbnNpZGVyIHRoZSBjb25jZXB0IG9mIHB1Ymxpc2hlci4g UmVxdWVzdGVyIHdhcyBjaG9zZW4gdG8gaWRlbnRpZnkgYSBjbGllbnQgaW4gYSBncm91cCBjb21t dW5pY2F0aW9uIHNldHRpbmcsIGkuZS4gc3RyZXNzaW5nIHRoYXQgaXQgc2VuZHMgKGdyb3VwKSBy ZXF1ZXN0cyBhbmQgcmVjZWl2ZXMgKHVuaWNhc3QpIHJlc3BvbnNlcy4gU2VuZGVyIHdvdWxkIG5v dCBiZSBjb3JyZWN0LCBhcyBib3RoIGNsaWVudHMgYW5kIHNlcnZlcnMgYXJlIHNlbmRlcnMgYXQg c29tZSBwb2ludCBkdXJpbmcgdGhlIG1lc3NhZ2UgZXhjaGFuZ2UuDQoNCjMuIFNlY3Rpb24gMy4x IC0gSSBhbSB0cnlpbmcgdG8gZmlndXJlIG91dCB3aHkgYSBHaWQgd291bGQgYmUgYSByZWFzb25h YmxlDQp2YWx1ZSBmb3IgdGhlIHNjb3BlLiAgVGhpcyBtZWFucyB0aGF0IHRoZSBBUyBpcyBnb2lu ZyB0byBiZSB0aGUgb25lIHRvDQphc3NpZ24gdGhlIEdpZCB2YWx1ZSBpbiBtYW55IGNhc2VzIGFz IGl0IG5lZWRzIHRvIGNoZWNrIHRoZSBzY29wZSB2YWx1ZQ0KdGhlcmUuICBJcyB0aGF0IGdvaW5n IHRvIGJlIGEgY29tbW9uIGNhc2U/ICBJLmUuIEFyZSBHaWRzIGdvaW5nIHRvIGJlDQphc3NpZ25l ZCBieSBhZG1pbmlzdHJhdG9ycz8NCg0KWypdIFRoZSBHaWQgb2YgdGhlIEF1dGhvcml6YXRpb24g UmVxdWVzdCB3b3VsZCBiZSBhIHJlYXNvbmFibGUgc2NvcGUgYmVjYXVzZSB0aGUgam9pbiByZXNv dXJjZSBpcyBhc3NvY2lhdGVkIHRvIGl0IChhdCB0aGUgR00pLiBUaGUgR00gcmVjZWl2aW5nIGEg Sm9pbiBSZXF1ZXN0IG11c3QgYmUgYWJsZSB0byByZXRyaWV2ZSB0aGUgY29ycmVjdCBHaWQgZm9s bG93aW5nIHRoZSBhY2Nlc3MgdG8gdGhlIGpvaW4gcmVzb3VyY2UuIE5vLCB0aGUgQVMgZG9lcyBu b3QgYXNzaWduIHRoZSBHaWQgdmFsdWUgKGlmIHRoYXQgaXMgdXNlZCBhcyBzY29wZSBpbiB0aGUg QXV0aG9yaXphdGlvbiBSZXF1ZXN0KS4gVGhlIEFTIG9ubHkgbmVlZHMgdG8gY2hlY2sgdGhhdCB0 aGUgY2xpZW50IGlzIGF1dGhvcml6ZWQgdG8gZ2V0IGFuIGFjY2VzcyB0b2tlbiBmb3IgdGhhdCBz Y29wZSwgcmVnYXJkbGVzcyB0aGF0IGl0IGlzIGEgam9pbiByZXNvdXJjZS4gVGhlIEdpZCBpcyBh c3NpZ25lZCBieSB0aGUgcmVzb3VyY2Ugb3duZXIgb2YgdGhlIGpvaW4gcmVzb3VyY2UgYXQgdGhl IEdNLCB0aGF0IGlzIGFuIGFkbWluaXN0cmF0b3IuDQoNCjQuIFNlY3Rpb24gMy4xIC0gSXMgdGhl IGZvcm0gaW4gQXBwZW5kaXggQyBvZiB0aGUgR2lkIGluIHNvbWUgcmVzcGVjdA0KbWFuZGF0b3J5 PyAgSWYgaXQgaXMgbm90LCB0aGVuIGhvdyBkb2VzIGEgcmVjZWl2ZXIgb2YgYSBtZXNzYWdlIGRp c3Rpbmd1aXNoDQpiZXR3ZWVuIHR3byBkaWZmZXJlbnQgZ3JvdXBzIHRoYXQgYXJlIHVzaW5nIHRo ZSBzYW1lIG11bHRpY2FzdCBhZGRyZXNzPyAgSXMNCnRoYXQgZ29pbmcgdG8gYmUgYSBub24tc3Vw cG9ydGVkIGNhc2U/ICBUaGUgbW9zdCBjb21tb24gY2FzZSBvZiB0aGlzIHdvdWxkDQpiZSBoYXZp bmcgdHdvIGRpZmZlcmVudCBncm91cHMgb24gdGhlIGRlZmF1bHQgQ29BUCBtdWx0aWNhc3QgYWRk cmVzcyB0YWxraW5nDQp0byBSRHMgd2l0aCBkaWZmZXJlbnQgcGVybWlzc2lvbnMgYXQgdGhlIFJE IHRvIHNlZSB0aGluZ3MuDQoNClsqXSBBcyBvZiBub3csIHRoYXQgaXMganVzdCBhbiBleGFtcGxl LCB3ZSBtaWdodCByZWNvbnNpZGVyIGFuZCBtYWtlIHRoaXMgYXQgbGVhc3QgbWFuZGF0b3J5IHRv IGltcGxlbWVudCwgc28gaXQgd291bGQgYmUgZ29vZCB3aXRoIG1vcmUgZmVlZGJhY2sgb24gdGhp cy4gVGhlIHJlcXVpcmVtZW50cyBhbnl3YXkgYXJlIHRoYXQgaW4gYSBHTSBhbGwgdGhlIEdpZHMg YXJlIHVuaXF1ZSwgYW5kIHRoYXQgYSBHaWQgaXMgY2hhbmdlZCBhZnRlciBhIGdyb3VwIHJla2V5 aW5nLiBUaGUgZm9ybWF0IGluIGFwcGVuZGl4IEMgZ3VhcmFudGVlcyBib3RoLiBJZiB5b3VyIHNl Y29uZCBxdWVzdGlvbiByZWZlcnMgdG8gb25lIG5vZGUgaW4gMiBncm91cHMgKG1hbmFnZWQgYnkg MiBkaWZmZXJlbnQgR01zKSwgd2hlcmUgdGhlc2UgMiBHaWRzIGNvbGxpZGUsIHRoZW4gdGhhdCBp cyB1cCB0byB0aGUgYXBwbGljYXRpb24gdG8gZGVjaWRlIGhvdyB0byBkZWFsIHdpdGggaXQgKGRp c2NhcmQsIHRyeSBib3RoIGNvbnRleHRz4oCmKS4gV2UgYnJpZWZseSBkaXNjdXNzIHNlYyBjb25z IGFib3V0IGl0IGluIHNlY3Rpb24gOC41IG9mIGNvcmUtb3Njb3JlLWdyb3VwY29tbS4gSG93ZXZl ciwgdGhhdCBpcyBpbmRlcGVuZGVudCBmcm9tIHRoZSBmb3JtYXQgb2YgdGhlIEdpZCwgYXMgbG9u ZyBhcyB0aGUgcmVxdWlyZW1lbnRzIGFyZSBtZXQuDQoNCjUuIFNlY3Rpb24gNC4xIC0gSSBjYW4g dW5kZXJzdGFuZCB0aGluZ3MgcmVsYXRpdmUgdG8gdGhlIGtleV9pbmZvIGJsb2IgdGhhdA0KaXMg YmVpbmcgcmV0dXJuZWQuICBJIGFtIG5vdCBzdXJlIHRoYXQgSSB0aGluayB0aGF0IHRoaXMgaXMg YmVpbmcgZGVmaW5lZA0KY29ycmVjdGx5IGhvd2V2ZXIuICBJdCBtYWtlcyBtb3JlIHNlbnNlIHRv IG1lIHRvIGhhdmUgdGhlIGZvbGxvd2luZzoNCmtleV9pbmZvID0gWyBzaWduX2FsZzogQ09TRV9B bGdvcml0aG0sID9zaWduX3BhcmFtZXRlcnMgOiBtYXAsDQo/a2V5X3BhcmFtZXRlcnM6IG1hcCBd IHdoZXJlIHRoZSB0d28gbWFwcyBhcmUgZmlsbGVkIGluIGZyb20gdGhlIHJlcXVpcmVkDQpmaXhl ZCBwYXJhbWV0ZXJzIGZyb20gdGhlIHR3byBDT1NFIHJlZ2lzdHJpZXMuICBUaGlzIHdvdWxkIGVu ZCB1cCB3aXRoDQpzb21ldGhpbmcgbGlrZSB0aGUgZm9sbG93aW5nIGFzIGEgcG90ZW50aWFsIHZh bHVlICAgWyBzaWduX2FsZzogRUNEU0EsDQprZXlfcGFyYW1ldGVyczogeydrdHknOidFQzInLCAn Y3J2JzogJ1AyNTYnfV0NCg0KWypdIE9rLCB3ZSBjYW4gaW1wbGVtZW50IHRoYXQuIFRvIG1ha2Ug c3VyZSB3ZSB1bmRlcnN0YW5kIHlvdXIgcHJvcG9zYWwsIOKAmGtleV9wYXJhbWV0ZXJz4oCZIGFy ZSB0YWtlbiBmcm9tIENPU0UgS2V5IENvbW1vbiBQYXJhbWV0ZXJzIGFuZCBDT1NFIEtleSBUeXBl IFBhcmFtZXRlcnMgcmVnaXN0cmllcz8NCldoYXQgYWJvdXQg4oCYc2lnbl9wYXJhbWV0ZXJz4oCZ PyBDYW4gd2UgYmUgc3VyZSB0aGF0IHRob3NlIHR3byBmaWVsZCB3b3VsZCBjb3ZlciBhbGwgcGFy YW1ldGVycyBvZiBleGlzdGluZyBhbmQgZnV0dXJlIGFsZ29yaXRobXM/IElmIGEgbmV3IGFsZ29y aXRobSBkZWZpbmVzIGl0cyBvd24gcmVnaXN0cnksIHdlIHdvdWxkIG5lZWQgdG8gYWRkIHRoYXQs IGFuZCBzYXkgdmFsdWVzIGZyb20gdGhhdCByZWdpc3RyeSBjYW4gYWxzbyBiZSB1c2VkIGluIHRo aXMgbWFwLiAoQVAyKQ0KDQo2LiBTZWN0aW9uIDQuMS4xIC0gd2h5IGlzIHRoZSBrZXkgaW5mbyBw YXJhbWV0ZXIgZm9ybWF0IGFwcGxpY2F0aW9uDQpzcGVjaWZpYz8gIEkgd291bGQgaGF2ZSBhc3N1 bWVkIHRoYXQgaXQgd2FzIHRoZSBzYW1lIGFzIGluIHRoZSBwcmV2aW91cw0Kc2VjdGlvbi4NCg0K WypdIFJpZ2h0LCBwcm9wb3NhbCB0byBjaGFuZ2Ug4oCcSXRzIGZvcm1hdOKAnSB0byDigJxJdHMg ZXhhY3QgY29udGVudOKAnS4gKEFQMykNCg0KNy4gIFNlY3Rpb24gNC4yIC0gZm9yICdjbGllbnRf Y3JlZCcsIEkgYW0gdW5zdXJlIHdoYXQgdGhlIGNsaWVudCBpcyBzdXBwb3NlZA0KdG8gZG8gaWYg dGhlIGpvaW5pbmcgbm9kZSBkb2VzIG5vdCBrbm93IHRoZSBjb3VudGVyc2lnbmF0dXJlIGFsZ29y aXRobS4gIENhbg0KdGhlIGluY2x1ZGUgcHVibGljIGtleSBub3QgYmUgaW4gYSBjb25zaXN0ZW50 IGZvcm1hdD8gIFdoYXQgZG9lcyBjb25zaXN0ZW50DQpmb3JtYXQgZXZlbiBtZWFuPw0KDQpbKl0g Q29uc2lzdGVudCBmb3JtYXQgcmVmZXJzIHRvIHRoZSBrZXkgdHlwZSBiYXNlZCBvbiB0aGUgY291 bnRlcnNpZ25hdHVyZSBhbGdvcml0aG0gdXNlZC4gSWYgdGhlIGpvaW5pbmcgbm9kZSBkb2VzIG5v dCBrbm93IHRoZSBjb3VudGVyc2lnbmF0dXJlIGFsZ29yaXRobSwgaXQgbWlnaHQganVzdCBvbWl0 IHRoaXMgcGFyYW1ldGVyLCBvciBzZW5kIGEgcHVibGljIGtleSBhcyBhIGd1ZXNzLiBJZiB0aGUg Z3Vlc3MgaXMgaW5jb3JyZWN0LCB0aGUgR00gd2lsbCByZXBseSBhcyBzcGVjaWZpZWQgaW4gNC4z IChzZWUgcG9pbnQgOCkuDQoNCjguIFNlY3Rpb24gNC4zIC0gSSBkb24ndCB1bmRlcnN0YW5kIHdo eSB0aGUgR00gaXMgYWNjZXB0aW5nIHRoZSBqb2luIHJlcXVlc3QNCmlmIHRoZSBjbGllbnRfY3Jl ZCBwYXNzZWQgaW4gd2FzIG5vdCBpbiB0aGUgY29ycmVjdCBmb3JtYXQuICBJcyB0aGlzIGEgdHlw bz8NCg0KWypdIFRoZSByZWFzb24gZm9yIHJlc3BvbmRpbmcgd2l0aCBhIG5vbi1lcnJvciByZXNw b25zZSBjb2RlIGlzIHRvIGJlIGFibGUgdG8gdXNlIHRoZSBwYXlsb2FkIHRvIHByb3ZpZGUgdGhl IGtleSBpbmZvIGluIGEgQ0JPUiBtYXAuIFdpdGggYSA0LlhYIHJlc3BvbnNlLCB0aGF0IHdvdWxk IG5vdCBiZSBwb3NzaWJsZSBzaW5jZSB0aGUgcGF5bG9hZCBpcyBzdXBwb3NlZCB0byBiZSBhIGRp YWdub3N0aWMgaHVtYW4gcmVhZGFibGUgdGV4dCBzdHJpbmcuIFdlIGFyZSB3aWxsaW5nIHRvIGNo YW5nZSB0aGF0IGlmIHRoZSBXRy9Db0FQIGV4cGVydHMgY2FuIGNvbmZpcm0gdGhhdCB3b3VsZCBi ZSBvay4NCg0KOS4gIFNlY3Rpb24gNiAtIEkgZG9uJ3Qga25vdyB0aGF0IHRoZSB0aGlyZCBidWxs ZXQgaXMgaW4gdGhlIGxpc3Qgb2YgY2FzZXMNCndoZXJlIHRoZSBjbGllbnRfY3JlZCBwYXJhbWV0 ZXIgaXMgbm90IHJlcXVpcmVkLg0KDQpbKl0gV2VsbCBzcG90dGVkLCBhbmQgaXQgbmVlZHMgdG8g YmUgY2xhcmlmaWVkLiBBY3R1YWxseSwgdGhlIHRoaXJkIGJ1bGxldCBzaG91bGQgc2F5IHRoYXQg aWYgdGhlIFBvUCBrZXkgaW4gdGhlIGFjY2VzcyB0b2tlbiBoYXMgdGhlIGZvcm1hdCBleHBlY3Rl ZCBpbiB0aGUgZ3JvdXAgYW5kIHRoZSBjbGllbnQgaXMgYXdhcmUgb2YgdGhhdCwgdGhlbiB0aGUg Y2xpZW50IGNhbiBza2lwIHByb3ZpZGluZyBpdHMgb3duIHB1YmxpYyBrZXkgbGF0ZXIgb24gaW4g 4oCYY2xpZW50X2NyZWTigJkuIChBUDQpDQoNCjEwLiAgU2VjdGlvbiA2IC0gV2hhdCBpcyB0aGUg UE9QIG1ldGhvZCBmb3IgdGhlIGZvdXJ0aCBidWxsZXQgbWV0aG9kPw0KDQpbKl0gV2UgYWRkcmVz cyB0aGlzIGFzIHdlbGwgaW4gcG9pbnQgOSBvZiB5b3VyIHJldmlldyBjb21tZW50cywgdG8gd2hp Y2ggd2Ugc2F5OiDigJxVbnRpbCBub3csIHdlIGtlcHQgdGhhdCBvdXQgb2YgdGhlIHNjb3BlIG9m IHRoaXMgYW5kIGRlcGVuZGVudCBkb2N1bWVudHMgKHNlZSBzZWN0aW9uIDggb2YgYWNlLWtleS1n cm91cGNvbW0tb3Njb3JlKSwgYnV0IHdlIGFyZSBsb29raW5nIHRvIGluY2x1ZGUgaXQuDQpPbmUg cG9zc2liaWxpdHkgd2UgYXJlIGNvbnNpZGVyaW5nIGlzIHRvIHNpZ24gdGhlIGtleSBkaXN0cmli dXRpb24gcmVxdWVzdCB0b2dldGhlciB3aXRoIGEgbm9uY2UgdGhhdCB3YXMgc2VudCBmcm9tIHRo ZSBLREMgKGZvciB0aGUgc2FrZSBvZiBmcmVzaG5lc3MpLCAgdXNpbmcgdGhlIHByaXZhdGUga2V5 IHBhaXJlZCB0byB0aGUgcHVibGljIGtleSBzZW50IGluIOKAmGNsaWVudF9jcmVk4oCZLuKAnA0K WW91IHNlZW1lZCBvayB3aXRoIHRoaXMsIHNvIHdlIHdpbGwgaW1wbGVtZW50IGl0IGhlcmUuIChB UDUpDQoNCjExLiBTZWN0aW9uIDYgLSBXaGF0IGhhcHBlbnMgaWYgYW55IG9mIGZpcnN0IHRocmVl IGJ1bGxldHMgaXMgdHJ1ZSwgYnV0IHRoZQ0KY2FjaGVkIGtleSBkb2VzIG5vdCBtYXRjaCB0aGUg cmVxdWlyZWQga2V5IHBhcmFtZXRlcnMgZm9yIHRoZSBzaWduaW5nDQphbGdvcml0aG0uICBJbiBz b21lIG9mIHRoZXNlIGNhc2VzIHRoZXJlIGlzIG5vIGNoZWNrIHRoYXQgYW55IHNpZ25hdHVyZQ0K YWxnb3JpdGhtIHBhcmFtZXRlcnMgdGhhdCBtaWdodCBleGlzdCBhcmUgZ29pbmcgdG8gYmUgY2hl Y2tlZCBhbmQgZW5mb3JjZWQuDQoNClsqXSBUaGUgZmlyc3QgYnVsbGV0IHBvaW50IGlzIGFjdHVh bGx5IGFib3V0IG5vdCBwcm92aWRpbmcgYSBrZXksIHNvIG5vIGNoZWNrIG5lZWRzIHRvIGJlIGRv bmUuDQpUaGUgc2Vjb25kIGJ1bGxldCBwb2ludCBpcyBhYm91dCBhIHByZXZpb3VzbHkgcHJvdmlk ZWQga2V5LCBzbyB0aGUgY2hlY2sgd291bGQgYmUgZG9uZSBhcyBkZXNjcmliZWQuDQpUaGlyZCBi dWxsZXQ6IHllcyB3ZSBuZWVkIHRvIGNsYXJpZnkuIChBUDYpDQoNCjEyLiAgU2VjdGlvbiA3IC0g VGhpcyB0ZXh0IGltcGxpZXMgdG8gbWUgdGhhdCBhbGwgdXNlcnMgb2YgYSBncm91cCBrZXkgbmVl ZA0KdG8gYmUgYWJsZSB0byBhY3QgYXMgc2VydmVycyBhbmQgaGF2ZSBhIGZpeGVkIHBvcnQgbnVt YmVyIHdoaWNoIHdhcyBzdXBwbGllZA0Kc29tZSBob3cgdG8gdGhlIEdNIHNvIHRoYXQgaXQgY2Fu IGJlIG5vdGlmaWVkLiAgIFRoaXMgY291bGQgYmUgZG9uZSBieQ0Ka2VlcGluZyB1cCB0aGUgRFRM UyBzZXNzaW9uLCBidXQgdGhhdCBpcyBzdGlsbCBhIGxpdHRsZSBiaXQgdHJpY2t5IGFuZCB3b3Vs ZA0Kbm90IHdvcmsgZm9yIE9TQ09SRSBiYXNlZCBtZXNzYWdlcy4gIFRoaXMgdGV4dCBtaWdodCB3 YW50IHRvIHBvaW50IHRvIHRoZQ0Kc2VjdGlvbiBpbiB0aGUgaWV0Zi1hY2Uta2V5LWdyb3VwY29t bSB0aGF0IGRlYWxzIHdpdGggdGhpcyBhbmQgcmVxdWlyZSB0aGF0DQp0aGUgcXVlcnkgb3Igc3Vi c2NyaWJlIG1ldGhvZHMgYmUgc3VwcG9ydGVkLiAgQWx0aG91Z2ggYm90aCBvZiB0aG9zZSBzdWZm ZXINCmZyb20gdGhlIGxhY2sgb2YgaGFyZCBicmVhayBvbiB0aGUgcGFydCBvZiBwdWJsaXNoZXJz Lg0KDQpbKl0gWWVzLCB0aGF0IGlzIGNvcnJlY3QsIGdyb3VwIG1lbWJlcnMgd291bGQgbmVlZCB0 byBhY3QgYXMgc2VydmVycy4gVGhlIHBvcnQgbnVtYmVyIGNvdWxkIGJlIGVpdGhlciBkZWZhdWx0 IG9yIHBhcnQgb2YgdGhlIEpvaW4gUmVxdWVzdCAoaW4gYSBuZXcgZmllbGQg4oCccmVrZXlpbmcg dXJp4oCdPyksIHdpdGggdGhlIGdyb3VwIG1lbWJlciBhc3N1bWluZyB0aGF0IHRoZSByZWtleWlu ZyBpcyBkb25lIHdpdGggdGhpcyAodW5pY2FzdCkgZGVmYXVsdCBhbGdvcml0aG0uIFRoZSBHTSBj b3VsZCB0aGVuIGVpdGhlciBjb25maXJtLCBvciBjb21tdW5pY2F0ZSB0byB0aGUgam9pbmluZyBu b2RlIGEgZGlmZmVyZW50IGdyb3VwIHJla2V5aW5nIHNjaGVtZSAoaW4g4oCcZ3JvdXBfcG9saWNp ZXPigJ0pIGFuZCBwb3J0IGFuZCByZXNvdXJjZSAoaW4gdGhlIG5ldyBmaWVsZCDigJxyZWtleWlu ZyB1cmnigJ0pIGluIHRoZSBKb2luIFJlc3BvbnNlLiBIb3dldmVyLCB0aGF0IGlzIHF1aXRlIGhl YXZ5IG9uIHRoZSBncm91cCBtZW1iZXIsIHdoaWNoIGlzIGEgcmVhc29uIHRvIHVzZSBSRCBpbnN0 ZWFkIHRvIGRpc2NvdmVyIGluIGFkdmFuY2UgdGhlIHJla2V5aW5nIHNjaGVtZSBhbmQgcmVrZXlp bmcgdXJpIGFzIGxpbmtlZCB0YXJnZXQgYXR0cmlidXRlcyBvZiB0aGUgam9pbiByZXNvdXJjZS4g V291bGQgdGhhdCB3b3JrPyBBbHNvIHdoeSBkbyB5b3Ugc2F5IHRoYXQgaXQgd291bGQgbm90IHdv cmsgZm9yIE9TQ09SRSBiYXNlZCBtZXNzYWdlcz8gV2UgY291bGQgZWFzaWx5IHNwZWNpZnkgdGhh dCB3aGVuIHVzaW5nIHRoZSBPU0NPUkUgcHJvZmlsZSBiZXR3ZWVuIGdyb3VwIG1lbWJlciBhbmQg R00sIHRoZSBub2RlcyBuZWVkIHRvIGhhdmUgYm90aCByb2xlcywgc28gY29uZmlndXJlIHRoZWly IGtleWluZyBtYXRlcmlhbCBhY2NvcmRpbmdseSAoZm9yIGV4YW1wbGU6IHRoZSBncm91cCBtZW1i ZXLigJlzIHJlY2lwaWVudCBjb250ZXh0IG5lZWQgdG8gY29udGFpbiBhIHJlcGxheSB3aW5kb3cp LiAoQVA3KQ0KDQpKaW0NCg0KDQo= --_000_3775CA7A01744261BBFA09EFEAA07B4Fericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBw dCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0K PGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiM5OTAwRkYiPkhpIEppbSw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6Izk5MDBGRiI+VGhhbmtzIGFnYWluIGZvciB5b3VyIGluIGRlcHRoIHJldmll dy4gV2UgaGF2ZSBpZGVudGlmaWVkIDcgY2xlYXIgQVBzIGZyb20gc29tZSBvZiB5b3VyIHJldmll dyBjb21tZW50cywgYW5kIHdlIGhvcGUgdGhhdCB3ZSBhbnN3ZXIgdGhlIG90aGVyIChpbmxpbmUp LiBQbGVhc2UgbGV0DQogdXMga25vdyBpZiB0aGF0IGlzIG9rLCBhbmQgd2Ugd2lsbCB1cGRhdGUg dGhlIGRvY3VtZW50IGFzIHNvb24gYXMgcG9zc2libGUuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5U aGFua3MsPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAw RkYiPkZyYW5jZXNjYSBhbmQgTWFyY288L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6YmxhY2siPkkgd2FzIHdhbmRlcmluZyB0aHJvdWdoIHRoZSBkb2N1bWVudCB3aXRo IGEgdmlldyB0byBpbXBsZW1lbnRpbmcgYW5kIGhhdmU8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRoZSBmb2xsb3dpbmcgcXVlc3Rpb25zOjwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6YmxhY2siPjEuICZuYnNwO0Fic3RyYWN0OiBGcm9tIHRoZSBmaXJzdCBwYXJhZ3Jh cGggSSBhbSBub3Qgc3VyZSBpZiB0aGUgZ3JvdXA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmNvbW11bmljYXRpb25zIG9yIHRoZSBjb21tdW5pY2F0 aW9ucyB0byB0aGUgS0RDIGFyZSBzZWN1cmVkIHdpdGggT1NDT1JFLjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5 MDBGRiI+WypdIE9rLCB3ZSBwcm9wb3NlIHRvIGNoYW5nZSDigJx3aGVyZSBjb21tdW5pY2F0aW9u cyBhcmUgYmFzZWTigJ0gdG8g4oCcd2hlcmUgdGhlIGdyb3VwIGNvbW11bmljYXRpb24gaXMgYmFz ZWTigJ0uIFRoZSBjb21tdW5pY2F0aW9uIHRvIHRoZSBLREMgaXMgdXAgdG8gdGhlIHByb2ZpbGUg b2YNCiBBQ0UgdXNlZCBiZXR3ZWVuIHRoZSBqb2luaW5nIG5vZGUgYW5kIHRoZSBLREMuIChBUDEp PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4yLiAmbmJz cDtTZWN0aW9uIDMuMSAtICZxdW90O3JlcXVlc3RlciZxdW90OyBzZWVtcyB0byBiZSBhbiBvZGQg bmFtZSBmb3IgJnF1b3Q7c2VuZGVyJnF1b3Q7IG9yPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mcXVvdDtwdWJsaXNoZXImcXVvdDs8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM5OTAwRkYiPlsqXSBUaGlzIHBhcnRpY3VsYXIgZG9jdW1lbnQgZG9lcyBub3QgY29uc2lk ZXIgdGhlIGNvbmNlcHQgb2YgcHVibGlzaGVyLiBSZXF1ZXN0ZXIgd2FzIGNob3NlbiB0byBpZGVu dGlmeSBhIGNsaWVudCBpbiBhIGdyb3VwIGNvbW11bmljYXRpb24gc2V0dGluZywgaS5lLiBzdHJl c3NpbmcNCiB0aGF0IGl0IHNlbmRzIChncm91cCkgcmVxdWVzdHMgYW5kIHJlY2VpdmVzICh1bmlj YXN0KSByZXNwb25zZXMuIFNlbmRlciB3b3VsZCBub3QgYmUgY29ycmVjdCwgYXMgYm90aCBjbGll bnRzIGFuZCBzZXJ2ZXJzIGFyZSBzZW5kZXJzIGF0IHNvbWUgcG9pbnQgZHVyaW5nIHRoZSBtZXNz YWdlIGV4Y2hhbmdlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+My4gU2VjdGlvbiAzLjEgLSBJIGFtIHRyeWluZyB0byBmaWd1cmUgb3V0IHdoeSBhIEdp ZCB3b3VsZCBiZSBhIHJlYXNvbmFibGU8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPnZhbHVlIGZvciB0aGUgc2NvcGUuICZuYnNwO1RoaXMgbWVhbnMg dGhhdCB0aGUgQVMgaXMgZ29pbmcgdG8gYmUgdGhlIG9uZSB0bzwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+YXNzaWduIHRoZSBHaWQgdmFsdWUgaW4g bWFueSBjYXNlcyBhcyBpdCBuZWVkcyB0byBjaGVjayB0aGUgc2NvcGUgdmFsdWU8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRoZXJlLiAmbmJzcDtJ cyB0aGF0IGdvaW5nIHRvIGJlIGEgY29tbW9uIGNhc2U/ICZuYnNwO0kuZS4gQXJlIEdpZHMgZ29p bmcgdG8gYmU8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPmFzc2lnbmVkIGJ5IGFkbWluaXN0cmF0b3JzPzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+Wypd IFRoZSBHaWQgb2YgdGhlIEF1dGhvcml6YXRpb24gUmVxdWVzdCB3b3VsZCBiZSBhIHJlYXNvbmFi bGUgc2NvcGUgYmVjYXVzZSB0aGUgam9pbiByZXNvdXJjZSBpcyBhc3NvY2lhdGVkIHRvIGl0IChh dCB0aGUgR00pLiBUaGUgR00gcmVjZWl2aW5nIGEgSm9pbiBSZXF1ZXN0DQogbXVzdCBiZSBhYmxl IHRvIHJldHJpZXZlIHRoZSBjb3JyZWN0IEdpZCBmb2xsb3dpbmcgdGhlIGFjY2VzcyB0byB0aGUg am9pbiByZXNvdXJjZS4gTm8sIHRoZSBBUyBkb2VzIG5vdCBhc3NpZ24gdGhlIEdpZCB2YWx1ZSAo aWYgdGhhdCBpcyB1c2VkIGFzIHNjb3BlIGluIHRoZSBBdXRob3JpemF0aW9uIFJlcXVlc3QpLiBU aGUgQVMgb25seSBuZWVkcyB0byBjaGVjayB0aGF0IHRoZSBjbGllbnQgaXMgYXV0aG9yaXplZCB0 byBnZXQgYW4gYWNjZXNzDQogdG9rZW4gZm9yIHRoYXQgc2NvcGUsIHJlZ2FyZGxlc3MgdGhhdCBp dCBpcyBhIGpvaW4gcmVzb3VyY2UuIFRoZSBHaWQgaXMgYXNzaWduZWQgYnkgdGhlIHJlc291cmNl IG93bmVyIG9mIHRoZSBqb2luIHJlc291cmNlIGF0IHRoZSBHTSwgdGhhdCBpcyBhbiBhZG1pbmlz dHJhdG9yLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ NC4gU2VjdGlvbiAzLjEgLSBJcyB0aGUgZm9ybSBpbiBBcHBlbmRpeCBDIG9mIHRoZSBHaWQgaW4g c29tZSByZXNwZWN0PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5tYW5kYXRvcnk/ICZuYnNwO0lmIGl0IGlzIG5vdCwgdGhlbiBob3cgZG9lcyBhIHJl Y2VpdmVyIG9mIGEgbWVzc2FnZSBkaXN0aW5ndWlzaDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+YmV0d2VlbiB0d28gZGlmZmVyZW50IGdyb3VwcyB0 aGF0IGFyZSB1c2luZyB0aGUgc2FtZSBtdWx0aWNhc3QgYWRkcmVzcz8gJm5ic3A7SXM8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRoYXQgZ29pbmcg dG8gYmUgYSBub24tc3VwcG9ydGVkIGNhc2U/ICZuYnNwO1RoZSBtb3N0IGNvbW1vbiBjYXNlIG9m IHRoaXMgd291bGQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPmJlIGhhdmluZyB0d28gZGlmZmVyZW50IGdyb3VwcyBvbiB0aGUgZGVmYXVsdCBDb0FQ IG11bHRpY2FzdCBhZGRyZXNzIHRhbGtpbmc8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPnRvIFJEcyB3aXRoIGRpZmZlcmVudCBwZXJtaXNzaW9ucyBh dCB0aGUgUkQgdG8gc2VlIHRoaW5ncy48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlsqXSBBcyBvZiBu b3csIHRoYXQgaXMganVzdCBhbiBleGFtcGxlLCB3ZSBtaWdodCByZWNvbnNpZGVyIGFuZCBtYWtl IHRoaXMgYXQgbGVhc3QgbWFuZGF0b3J5IHRvIGltcGxlbWVudCwgc28gaXQgd291bGQgYmUgZ29v ZCB3aXRoIG1vcmUgZmVlZGJhY2sgb24gdGhpcy4gVGhlIHJlcXVpcmVtZW50cw0KIGFueXdheSBh cmUgdGhhdCBpbiBhIEdNIGFsbCB0aGUgR2lkcyBhcmUgdW5pcXVlLCBhbmQgdGhhdCBhIEdpZCBp cyBjaGFuZ2VkIGFmdGVyIGEgZ3JvdXAgcmVrZXlpbmcuIFRoZSBmb3JtYXQgaW4gYXBwZW5kaXgg QyBndWFyYW50ZWVzIGJvdGguIElmIHlvdXIgc2Vjb25kIHF1ZXN0aW9uIHJlZmVycyB0byBvbmUg bm9kZSBpbiAyIGdyb3VwcyAobWFuYWdlZCBieSAyIGRpZmZlcmVudCBHTXMpLCB3aGVyZSB0aGVz ZSAyIEdpZHMgY29sbGlkZSwgdGhlbg0KIHRoYXQgaXMgdXAgdG8gdGhlIGFwcGxpY2F0aW9uIHRv IGRlY2lkZSBob3cgdG8gZGVhbCB3aXRoIGl0IChkaXNjYXJkLCB0cnkgYm90aCBjb250ZXh0c+KA pikuIFdlIGJyaWVmbHkgZGlzY3VzcyBzZWMgY29ucyBhYm91dCBpdCBpbiBzZWN0aW9uIDguNSBv ZiBjb3JlLW9zY29yZS1ncm91cGNvbW0uIEhvd2V2ZXIsIHRoYXQgaXMgaW5kZXBlbmRlbnQgZnJv bSB0aGUgZm9ybWF0IG9mIHRoZSBHaWQsIGFzIGxvbmcgYXMgdGhlIHJlcXVpcmVtZW50cyBhcmUN CiBtZXQuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+NS4gU2VjdGlvbiA0LjEgLSBJIGNhbiB1bmRlcnN0 YW5kIHRoaW5ncyByZWxhdGl2ZSB0byB0aGUga2V5X2luZm8gYmxvYiB0aGF0PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5pcyBiZWluZyByZXR1cm5l ZC4gJm5ic3A7SSBhbSBub3Qgc3VyZSB0aGF0IEkgdGhpbmsgdGhhdCB0aGlzIGlzIGJlaW5nIGRl ZmluZWQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2si PmNvcnJlY3RseSBob3dldmVyLiAmbmJzcDtJdCBtYWtlcyBtb3JlIHNlbnNlIHRvIG1lIHRvIGhh dmUgdGhlIGZvbGxvd2luZzo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPmtleV9pbmZvID0gWyBzaWduX2FsZzogQ09TRV9BbGdvcml0aG0sID9zaWdu X3BhcmFtZXRlcnMgOiBtYXAsPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj4/a2V5X3BhcmFtZXRlcnM6IG1hcCBdIHdoZXJlIHRoZSB0d28gbWFwcyBh cmUgZmlsbGVkIGluIGZyb20gdGhlIHJlcXVpcmVkPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5maXhlZCBwYXJhbWV0ZXJzIGZyb20gdGhlIHR3byBD T1NFIHJlZ2lzdHJpZXMuICZuYnNwO1RoaXMgd291bGQgZW5kIHVwIHdpdGg8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnNvbWV0aGluZyBsaWtlIHRo ZSBmb2xsb3dpbmcgYXMgYSBwb3RlbnRpYWwgdmFsdWUgJm5ic3A7Jm5ic3A7WyBzaWduX2FsZzog RUNEU0EsPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNr Ij5rZXlfcGFyYW1ldGVyczogeydrdHknOidFQzInLCAnY3J2JzogJ1AyNTYnfV08L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM5OTAwRkYiPlsqXSBPaywgd2UgY2FuIGltcGxlbWVudCB0aGF0LiBUbyBtYWtlIHN1cmUg d2UgdW5kZXJzdGFuZCB5b3VyIHByb3Bvc2FsLCDigJhrZXlfcGFyYW1ldGVyc+KAmSBhcmUgdGFr ZW4gZnJvbSBDT1NFIEtleSBDb21tb24gUGFyYW1ldGVycyBhbmQgQ09TRSBLZXkgVHlwZSBQYXJh bWV0ZXJzDQogcmVnaXN0cmllcz8gPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiM5OTAwRkYiPldoYXQgYWJvdXQg4oCYc2lnbl9wYXJhbWV0ZXJz4oCZPyBDYW4g d2UgYmUgc3VyZSB0aGF0IHRob3NlIHR3byBmaWVsZCB3b3VsZCBjb3ZlciBhbGwgcGFyYW1ldGVy cyBvZiBleGlzdGluZyBhbmQgZnV0dXJlIGFsZ29yaXRobXM/IElmIGEgbmV3IGFsZ29yaXRobSBk ZWZpbmVzIGl0cyBvd24NCiByZWdpc3RyeSwgd2Ugd291bGQgbmVlZCB0byBhZGQgdGhhdCwgYW5k IHNheSB2YWx1ZXMgZnJvbSB0aGF0IHJlZ2lzdHJ5IGNhbiBhbHNvIGJlIHVzZWQgaW4gdGhpcyBt YXAuIChBUDIpPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTox Mi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNr Ij42LiBTZWN0aW9uIDQuMS4xIC0gd2h5IGlzIHRoZSBrZXkgaW5mbyBwYXJhbWV0ZXIgZm9ybWF0 IGFwcGxpY2F0aW9uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5zcGVjaWZpYz8gJm5ic3A7SSB3b3VsZCBoYXZlIGFzc3VtZWQgdGhhdCBpdCB3YXMg dGhlIHNhbWUgYXMgaW4gdGhlIHByZXZpb3VzPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5zZWN0aW9uLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+Wypd IFJpZ2h0LCBwcm9wb3NhbCB0byBjaGFuZ2Ug4oCcSXRzIGZvcm1hdOKAnSB0byDigJxJdHMgZXhh Y3QgY29udGVudOKAnS4gKEFQMyk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPjcuICZuYnNwO1NlY3Rpb24gNC4yIC0gZm9yICdjbGllbnRfY3JlZCcsIEkg YW0gdW5zdXJlIHdoYXQgdGhlIGNsaWVudCBpcyBzdXBwb3NlZDwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+dG8gZG8gaWYgdGhlIGpvaW5pbmcgbm9k ZSBkb2VzIG5vdCBrbm93IHRoZSBjb3VudGVyc2lnbmF0dXJlIGFsZ29yaXRobS4gJm5ic3A7Q2Fu PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj50aGUg aW5jbHVkZSBwdWJsaWMga2V5IG5vdCBiZSBpbiBhIGNvbnNpc3RlbnQgZm9ybWF0PyAmbmJzcDtX aGF0IGRvZXMgY29uc2lzdGVudDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+Zm9ybWF0IGV2ZW4gbWVhbj88L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlsq XSBDb25zaXN0ZW50IGZvcm1hdCByZWZlcnMgdG8gdGhlIGtleSB0eXBlIGJhc2VkIG9uIHRoZSBj b3VudGVyc2lnbmF0dXJlIGFsZ29yaXRobSB1c2VkLiBJZiB0aGUgam9pbmluZyBub2RlIGRvZXMg bm90IGtub3cgdGhlIGNvdW50ZXJzaWduYXR1cmUgYWxnb3JpdGhtLCBpdA0KIG1pZ2h0IGp1c3Qg b21pdCB0aGlzIHBhcmFtZXRlciwgb3Igc2VuZCBhIHB1YmxpYyBrZXkgYXMgYSBndWVzcy4gSWYg dGhlIGd1ZXNzIGlzIGluY29ycmVjdCwgdGhlIEdNIHdpbGwgcmVwbHkgYXMgc3BlY2lmaWVkIGlu IDQuMyAoc2VlIHBvaW50IDgpLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj44LiBTZWN0aW9uIDQuMyAtIEkgZG9uJ3QgdW5kZXJzdGFuZCB3aHkgdGhl IEdNIGlzIGFjY2VwdGluZyB0aGUgam9pbiByZXF1ZXN0PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5pZiB0aGUgY2xpZW50X2NyZWQgcGFzc2VkIGlu IHdhcyBub3QgaW4gdGhlIGNvcnJlY3QgZm9ybWF0LiAmbmJzcDtJcyB0aGlzIGEgdHlwbz88L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiM5OTAwRkYiPlsqXSBUaGUgcmVhc29uIGZvciByZXNwb25kaW5nIHdpdGggYSBu b24tZXJyb3IgcmVzcG9uc2UgY29kZSBpcyB0byBiZSBhYmxlIHRvIHVzZSB0aGUgcGF5bG9hZCB0 byBwcm92aWRlIHRoZSBrZXkgaW5mbyBpbiBhIENCT1IgbWFwLiBXaXRoIGEgNC5YWCByZXNwb25z ZSwgdGhhdA0KIHdvdWxkIG5vdCBiZSBwb3NzaWJsZSBzaW5jZSB0aGUgcGF5bG9hZCBpcyBzdXBw b3NlZCB0byBiZSBhIGRpYWdub3N0aWMgaHVtYW4gcmVhZGFibGUgdGV4dCBzdHJpbmcuIFdlIGFy ZSB3aWxsaW5nIHRvIGNoYW5nZSB0aGF0IGlmIHRoZSBXRy9Db0FQIGV4cGVydHMgY2FuIGNvbmZp cm0gdGhhdCB3b3VsZCBiZSBvay48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPjkuICZuYnNwO1NlY3Rpb24gNiAtIEkgZG9uJ3Qga25vdyB0aGF0IHRoZSB0 aGlyZCBidWxsZXQgaXMgaW4gdGhlIGxpc3Qgb2YgY2FzZXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPndoZXJlIHRoZSBjbGllbnRfY3JlZCBwYXJh bWV0ZXIgaXMgbm90IHJlcXVpcmVkLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+WypdIFdlbGwgc3Bv dHRlZCwgYW5kIGl0IG5lZWRzIHRvIGJlIGNsYXJpZmllZC4gQWN0dWFsbHksIHRoZSB0aGlyZCBi dWxsZXQgc2hvdWxkIHNheSB0aGF0IGlmIHRoZSBQb1Aga2V5IGluIHRoZSBhY2Nlc3MgdG9rZW4g aGFzIHRoZSBmb3JtYXQgZXhwZWN0ZWQgaW4gdGhlIGdyb3VwDQogYW5kIHRoZSBjbGllbnQgaXMg YXdhcmUgb2YgdGhhdCwgdGhlbiB0aGUgY2xpZW50IGNhbiBza2lwIHByb3ZpZGluZyBpdHMgb3du IHB1YmxpYyBrZXkgbGF0ZXIgb24gaW4g4oCYY2xpZW50X2NyZWTigJkuIChBUDQpPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4xMC4gJm5ic3A7U2VjdGlv biA2IC0gV2hhdCBpcyB0aGUgUE9QIG1ldGhvZCBmb3IgdGhlIGZvdXJ0aCBidWxsZXQgbWV0aG9k Pzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+WypdIFdlIGFkZHJlc3MgdGhpcyBhcyB3ZWxsIGluIHBv aW50IDkgb2YgeW91ciByZXZpZXcgY29tbWVudHMsIHRvIHdoaWNoIHdlIHNheTog4oCcVW50aWwg bm93LCB3ZSBrZXB0IHRoYXQgb3V0IG9mIHRoZSBzY29wZSBvZiB0aGlzIGFuZCBkZXBlbmRlbnQg ZG9jdW1lbnRzIChzZWUNCiBzZWN0aW9uIDggb2YgYWNlLWtleS1ncm91cGNvbW0tb3Njb3JlKSwg YnV0IHdlIGFyZSBsb29raW5nIHRvIGluY2x1ZGUgaXQuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPk9uZSBwb3NzaWJpbGl0eSB3ZSBhcmUgY29u c2lkZXJpbmcgaXMgdG8gc2lnbiB0aGUga2V5IGRpc3RyaWJ1dGlvbiByZXF1ZXN0IHRvZ2V0aGVy IHdpdGggYSBub25jZSB0aGF0IHdhcyBzZW50IGZyb20gdGhlIEtEQyAoZm9yIHRoZSBzYWtlIG9m IGZyZXNobmVzcyksICZuYnNwO3VzaW5nDQogdGhlIHByaXZhdGUga2V5IHBhaXJlZCB0byB0aGUg cHVibGljIGtleSBzZW50IGluIOKAmGNsaWVudF9jcmVk4oCZLuKAnDwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5Zb3Ugc2VlbWVkIG9rIHdpdGgg dGhpcywgc28gd2Ugd2lsbCBpbXBsZW1lbnQgaXQgaGVyZS4gKEFQNSk8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjExLiBTZWN0aW9uIDYgLSBXaGF0IGhh cHBlbnMgaWYgYW55IG9mIGZpcnN0IHRocmVlIGJ1bGxldHMgaXMgdHJ1ZSwgYnV0IHRoZTwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Y2FjaGVkIGtl eSBkb2VzIG5vdCBtYXRjaCB0aGUgcmVxdWlyZWQga2V5IHBhcmFtZXRlcnMgZm9yIHRoZSBzaWdu aW5nPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5h bGdvcml0aG0uICZuYnNwO0luIHNvbWUgb2YgdGhlc2UgY2FzZXMgdGhlcmUgaXMgbm8gY2hlY2sg dGhhdCBhbnkgc2lnbmF0dXJlPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj5hbGdvcml0aG0gcGFyYW1ldGVycyB0aGF0IG1pZ2h0IGV4aXN0IGFyZSBn b2luZyB0byBiZSBjaGVja2VkIGFuZCBlbmZvcmNlZC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlsq XSBUaGUgZmlyc3QgYnVsbGV0IHBvaW50IGlzIGFjdHVhbGx5IGFib3V0IG5vdCBwcm92aWRpbmcg YSBrZXksIHNvIG5vIGNoZWNrIG5lZWRzIHRvIGJlIGRvbmUuPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlRoZSBzZWNvbmQgYnVsbGV0IHBvaW50 IGlzIGFib3V0IGEgcHJldmlvdXNseSBwcm92aWRlZCBrZXksIHNvIHRoZSBjaGVjayB3b3VsZCBi ZSBkb25lIGFzIGRlc2NyaWJlZC48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6Izk5MDBGRiI+VGhpcmQgYnVsbGV0OiB5ZXMgd2UgbmVlZCB0byBjbGFyaWZ5LiAo QVA2KSAmbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9t OjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPjEyLiAmbmJzcDtTZWN0aW9uIDcgLSBUaGlzIHRleHQgaW1wbGllcyB0byBtZSB0aGF0IGFs bCB1c2VycyBvZiBhIGdyb3VwIGtleSBuZWVkPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOmJsYWNrIj50byBiZSBhYmxlIHRvIGFjdCBhcyBzZXJ2ZXJzIGFuZCBo YXZlIGEgZml4ZWQgcG9ydCBudW1iZXIgd2hpY2ggd2FzIHN1cHBsaWVkPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5zb21lIGhvdyB0byB0aGUgR00g c28gdGhhdCBpdCBjYW4gYmUgbm90aWZpZWQuICZuYnNwOyZuYnNwO1RoaXMgY291bGQgYmUgZG9u ZSBieTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ a2VlcGluZyB1cCB0aGUgRFRMUyBzZXNzaW9uLCBidXQgdGhhdCBpcyBzdGlsbCBhIGxpdHRsZSBi aXQgdHJpY2t5IGFuZCB3b3VsZDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+bm90IHdvcmsgZm9yIE9TQ09SRSBiYXNlZCBtZXNzYWdlcy4gJm5ic3A7 VGhpcyB0ZXh0IG1pZ2h0IHdhbnQgdG8gcG9pbnQgdG8gdGhlPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5zZWN0aW9uIGluIHRoZSBpZXRmLWFjZS1r ZXktZ3JvdXBjb21tIHRoYXQgZGVhbHMgd2l0aCB0aGlzIGFuZCByZXF1aXJlIHRoYXQ8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRoZSBxdWVyeSBv ciBzdWJzY3JpYmUgbWV0aG9kcyBiZSBzdXBwb3J0ZWQuICZuYnNwO0FsdGhvdWdoIGJvdGggb2Yg dGhvc2Ugc3VmZmVyPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5mcm9tIHRoZSBsYWNrIG9mIGhhcmQgYnJlYWsgb24gdGhlIHBhcnQgb2YgcHVibGlz aGVycy48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlsqXSBZZXMsIHRoYXQgaXMgY29ycmVjdCwgZ3Jv dXAgbWVtYmVycyB3b3VsZCBuZWVkIHRvIGFjdCBhcyBzZXJ2ZXJzLiBUaGUgcG9ydCBudW1iZXIg Y291bGQgYmUgZWl0aGVyIGRlZmF1bHQgb3IgcGFydCBvZiB0aGUgSm9pbiBSZXF1ZXN0IChpbiBh IG5ldyBmaWVsZCDigJxyZWtleWluZw0KIHVyaeKAnT8pLCB3aXRoIHRoZSBncm91cCBtZW1iZXIg YXNzdW1pbmcgdGhhdCB0aGUgcmVrZXlpbmcgaXMgZG9uZSB3aXRoIHRoaXMgKHVuaWNhc3QpIGRl ZmF1bHQgYWxnb3JpdGhtLiBUaGUgR00gY291bGQgdGhlbiBlaXRoZXIgY29uZmlybSwgb3IgY29t bXVuaWNhdGUgdG8gdGhlIGpvaW5pbmcgbm9kZSBhIGRpZmZlcmVudCBncm91cCByZWtleWluZyBz Y2hlbWUgKGluIOKAnGdyb3VwX3BvbGljaWVz4oCdKSBhbmQgcG9ydCBhbmQgcmVzb3VyY2UgKGlu IHRoZQ0KIG5ldyBmaWVsZCDigJxyZWtleWluZyB1cmnigJ0pIGluIHRoZSBKb2luIFJlc3BvbnNl LiBIb3dldmVyLCB0aGF0IGlzIHF1aXRlIGhlYXZ5IG9uIHRoZSBncm91cCBtZW1iZXIsIHdoaWNo IGlzIGEgcmVhc29uIHRvIHVzZSBSRCBpbnN0ZWFkIHRvIGRpc2NvdmVyIGluIGFkdmFuY2UgdGhl IHJla2V5aW5nIHNjaGVtZSBhbmQgcmVrZXlpbmcgdXJpIGFzIGxpbmtlZCB0YXJnZXQgYXR0cmli dXRlcyBvZiB0aGUgam9pbiByZXNvdXJjZS4gV291bGQgdGhhdCB3b3JrPw0KIEFsc28gd2h5IGRv IHlvdSBzYXkgdGhhdCBpdCB3b3VsZCBub3Qgd29yayBmb3IgT1NDT1JFIGJhc2VkIG1lc3NhZ2Vz PyBXZSBjb3VsZCBlYXNpbHkgc3BlY2lmeSB0aGF0IHdoZW4gdXNpbmcgdGhlIE9TQ09SRSBwcm9m aWxlIGJldHdlZW4gZ3JvdXAgbWVtYmVyIGFuZCBHTSwgdGhlIG5vZGVzIG5lZWQgdG8gaGF2ZSBi b3RoIHJvbGVzLCBzbyBjb25maWd1cmUgdGhlaXIga2V5aW5nIG1hdGVyaWFsIGFjY29yZGluZ2x5 IChmb3IgZXhhbXBsZTogdGhlDQogZ3JvdXAgbWVtYmVy4oCZcyByZWNpcGllbnQgY29udGV4dCBu ZWVkIHRvIGNvbnRhaW4gYSByZXBsYXkgd2luZG93KS4gKEFQNyk8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkppbTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_3775CA7A01744261BBFA09EFEAA07B4Fericssoncom_-- From nobody Tue May 28 03:31:15 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F07C1200E3 for ; Tue, 28 May 2019 03:31:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x_uBhvtln3H0 for ; Tue, 28 May 2019 03:31:10 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20126.outbound.protection.outlook.com [40.107.2.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E115512006D for ; Tue, 28 May 2019 03:31:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancynl-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RCI2DPzc7aZzKC+jb3ONkcDmXGpXrQ43Cad8EIVzzf4=; b=OBEiYZBIyE0ICFmqQOh3Ga48VsXuC6Ei8hZGMJB9DQAvvRjxcodlDypLpaB9KXVv/m0xnTZNTcoogyqe2xCaJOTJ1It9MQfzmwC2nsrpGwMI7j61CJGrz29aZjlxkfaEQbG5oHQcUfF9QDiJ8jfvgCZl6HSaHE7ale3jYXaH4Pw= Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM (10.172.229.12) by DB6P190MB0344.EURP190.PROD.OUTLOOK.COM (10.175.241.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.19; Tue, 28 May 2019 10:31:05 +0000 Received: from DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20]) by DB6P190MB0054.EURP190.PROD.OUTLOOK.COM ([fe80::c46d:5ae5:fe3e:ca20%8]) with mapi id 15.20.1922.021; Tue, 28 May 2019 10:31:05 +0000 From: Esko Dijk To: "Panos Kampanakis (pkampana)" , "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments Thread-Index: AdUVJ+lbWrozVAUnQ9q1cKpVrur+kw== Date: Tue, 28 May 2019 10:31:05 +0000 Message-ID: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [2001:1c02:3101:4800:7d29:94ef:ab04:f14d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 35a4069c-36ac-48ac-6882-08d6e357971c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6P190MB0344; x-ms-traffictypediagnostic: DB6P190MB0344: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00514A2FE6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(396003)(366004)(376002)(346002)(39830400003)(13464003)(51914003)(189003)(199004)(52084003)(2906002)(33656002)(476003)(486006)(44832011)(46003)(74482002)(966005)(53936002)(6246003)(5660300002)(14454004)(25786009)(52536014)(508600001)(76116006)(66446008)(66946007)(30864003)(73956011)(99286004)(8936002)(81156014)(64756008)(81166006)(8676002)(66476007)(66556008)(110136005)(7736002)(86362001)(14444005)(256004)(6506007)(53546011)(71200400001)(71190400001)(74316002)(102836004)(7696005)(229853002)(6116002)(186003)(6436002)(9686003)(55016002)(6306002)(316002)(305945005)(68736007)(2501003); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6P190MB0344; H:DB6P190MB0054.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 0t2WyHTWQcOgc5q/3rz5upzZlNUYI8qNp3DvbX+1SggqhyA0vSiEl3kNUIV82+avpckkAOMwsJtlQuycYgDL+rfDmV7l6Bx/IXn6hU+XUuA5NaNgckV/0nvGOv/Y7XoLcAgDUOrL+YyYugzWwMfefbE9WjnOTM/FJgsX9agmwuB1+lRiUZUK3An1DWA8MJzxhXwW4eBhLCYoqXvxwqieyvDS1g1AUWiTgDgTYcO1gzVFBH3fR5pAzVcFS5zpFTHJ172f5X5rceivvJREcxrjN7JluIwGYaySZCEDv3wPtVKRcGuqbCmQs4AFPZwScxOY0AmQhlo4j4MfOxeLO3qtzTyDx82VOTX06LNg+rWUg4g2YBA4VZPsppZiAeCEmttBuv8OzWdBe27iAUCljr1BdrPSFvp32/Cuz2hBpPz9vaI= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: 35a4069c-36ac-48ac-6882-08d6e357971c X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2019 10:31:05.4203 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: esko.dijk@iotconsultancy.nl X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P190MB0344 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 10:31:14 -0000 SGVsbG8sDQoNClRoYW5rcyBmb3IgdGhlIHVwZGF0ZSEgRmlyc3QsIHJlZ2FyZGluZyB0aGUgY2hh bmdlczoNCg0KKiANCiAgIG1hcHBpbmcgb2YgSFRUUCByZXNwb25zZSBjb2RlcyB0byBDb0FQIHJl c3BvbnNlIGNvZGVzLiAgVGhlIHN1Y2Nlc3MNCiAgIGNvZGUgaW4gcmVzcG9uc2UgdG8gYW4gRVNU LWNvYXBzIEdFVCByZXF1ZXN0ICgvY2FjZXJ0cywgL2NzcmF0dHJzKSwNCiAgIGlzIDIuMDUuICBT aW1pbGFybHksIDIuMDEgaXMgdXNlZCBpbiByZXNwb25zZSB0byBFU1QtY29hcHMgUE9TVA0KICAg cmVxdWVzdHMgKC9zaW1wbGVlbnJvbGwsIC9zaW1wbGVyZWVucm9sbCwgL3NlcnZlcmtleWdlbiku ICBTZWN0aW9uIDcNCiAgIG9mIFtSRkM4MDc1XSBtYXBzIDIuMDIgKERlbGV0ZWQpIG9yIDIuMDQg KENoYW5nZWQpIHRvIGFuIEhUVFAgMjAwIE9LDQogICByZXNwb25zZSwgYnV0IDIuMDEgKENyZWF0 ZWQpIGlzIG1vcmUgc3VpdGFibGUgZm9yIHRoZSBjcmVhdGlvbiBvZg0KICAgY2VydGlmaWNhdGVz IGluIHRoZSBjb250ZXh0IG9mIEVTVC1jb2Fwcy4NCi0+IDIuMDEgQ3JlYXRlZCBpcyBub3cgdXNl ZCBhcyBQT1NUIHJlc3BvbnNlLiAgV2hpbGUgSSBhZ3JlZSB0aGF0IGl0IHNvdW5kcyBtb3JlIGxv Z2ljYWwgdG8gdXNlIDIuMDEgdGhhbiAyLjA0IChzaW5jZSBhIGNlcnRpZmljYXRlIGlzIGNyZWF0 ZWQgYnkgdGhlIHNlcnZlciwgYmFzZWQgb24gdGhlIENTUiksIHRoZXJlIGlzIHRoZSBDb0FQIGxl dmVsIGV4cGVjdGF0aW9uIHRoYXQgd2hlbiB1c2luZyAyLjAxIHRoZSByZXNvdXJjZSBpcyBjcmVh dGVkIGF0IHRoZSBsb2NhdGlvbiBvZiB0aGUgcmVxdWVzdCAtIHRoYXQgaXMsIGZvciBleGFtcGxl LCBhdCAvc2VuLiBTbyBpZiB0aGUgY2xpZW50IHdvdWxkIGRvIGEgR0VUIC9zZW4gaXQgd291bGQg Z2V0IHRoZSBhY3R1YWwgcHJldmlvdXNseSBjcmVhdGVkIGNlcnRpZmljYXRlLiAoV2hpY2ggaXMg bm90IHRoZSBjYXNlLikgVGhlIHRleHQgaW4gUkZDIDcyNTIgdGhhdCBzdGF0ZXMgdGhpcyBpcyAi T3RoZXJ3aXNlLCB0aGUgcmVzb3VyY2Ugd2FzIGNyZWF0ZWQgYXQgdGhlIHJlcXVlc3QgVVJJLiIg ICBTbyAyLjAxIGlzIHVzZWQgdG8gY3JlYXRlIG5ldyBDb0FQICpyZXNvdXJjZXMqIHRoYXQgY2Fu IGJlIGZvdW5kIGF0IHRoZSBzZXJ2ZXIgdXNpbmcgYSBzdWJzZXF1ZW50IEdFVCByZXF1ZXN0LiBB bmQgMi4wNCBpcyB1c2VkIHRvIGV4ZWN1dGUgYWN0aW9ucyBsaWtlICdjcmVhdGUgeCcgLCB0aGUg cmVzdWx0IG9mIHdoaWNoIGlzIHJldHVybmVkIGluIHRoZSByZXNwb25zZSBidXQgb3RoZXJ3aXNl IG5vdCBhdmFpbGFibGUgYW55d2hlcmUgb24gdGhlIHNlcnZlciBhbnltb3JlLiBUaGUgbGF0dGVy IGlzIHRoZSBjYXNlIGluIHRoZSBFU1QtY29hcHMgcHJvdG9jb2wgZmxvdyBhcyB0aGVyZSdzIG5v IHdheSB0byBHRVQgdGhlIHJlc3VsdGluZyBjZXJ0aWZpY2F0ZSBsYXRlciBvbi4NCi0+IHRoZSBy ZXNvdXJjZXMgaW4gYnJhY2tldHMgc2hvdWxkIG5vdyBiZSB0aGUgc2hvcnQgcmVzb3VyY2UgbmFt ZXMsIHNpbmNlIHdlIHRhbGsgYWJvdXQgRVNULWNvYXBzIHJlc291cmNlcyBub3QgRVNUIHJlc291 cmNlcyBhbnltb3JlLiBTbyAiR0VUIHJlcXVlc3QgKC9jcnRzLCAvYXR0KSIgZXRjLg0KDQoqICJF U1QgbWFrZXMgdXNlIG9mIEhUVFAgMjA0IHJlc3BvbnNlcyB3aGVuIGEgcmVzb3VyY2UgaXMgbm90 IGF2YWlsYWJsZSBmb3IgdGhlIGNsaWVudC4iDQotPiBFU1Qgc3RhdGVzIGVpdGhlciAyMDQgb3Ig NDA0IGNhbiBiZSB1c2VkOyB3aGljaCBpbiBDb0FQIHRyYW5zbGF0ZXMgdG8gNC4wNCBOb3QgRm91 bmQgIGlmIHRoZSByZXNvdXJjZSBpcyBub3QgYXZhaWxhYmxlIHRvIHRoZSBjbGllbnQsIGkuZS4g ZG9lcyBub3QgZXhpc3QuIFRoYXQgc2VlbXMgdGhlIGVhc2llc3QgdHJhbnNsYXRpb24gaGVyZS4g VGhvdWdoIHRoZSBzZXJ2ZXIgY291bGQgYWxzbyBzZW5kIDIuMDUgd2l0aCBhbiBlbXB0eSB6ZXJv LWxlbmd0aCBwYXlsb2FkLCB0byBleHByZXNzIHRoYXQgaXQgaGFzIHRoYXQgZnVuY3Rpb24gYXZh aWxhYmxlIGJ1dCB0aGVyZSBpcyAibm90aGluZyIgdGhlcmUgZm9yIHRoZSBjbGllbnQuDQoNCiog Mi4wNCBTSE9VTEQgb25seSBiZSB1c2VkIGluIHJlc3BvbnNlIHRvIGFuIEVTVC1jb2Fwcw0KICAg UE9TVCB3aGVuIHRoZSByZXNwb25zZSBjb21lcyBkZWxheWVkIGluIGEgc2VwYXJhdGUgKG5vdCBQ aWdneWJhY2tlZCkNCiAgIG1lc3NhZ2UgYWZ0ZXIgYW4gZW1wdHkgMC4wMCBtZXNzYWdlIChTZWN0 aW9uIDUuNykNCi0+IHRoaXMgc2VlbXMgc3RyYW5nZSwgdGhlIHJlc3BvbnNlIGNvZGUgcmVtYWlu cyB0aGUgc2FtZSB3aGV0aGVyIHNlcGFyYXRlIHJlc3BvbnNlIG9yIHBpZ2d5YmFja2VkIHJlc3Bv bnNlIGlzIHVzZWQuIEF0IHRoaXMgbGV2ZWwgb2YgcmVxdWVzdC9yZXNwb25zZSwgdGhlcmUncyBu byBuZWVkIHRvIHRyeSB0byBkZXRhaWwgdGhpcy4gSSBmZWVsIGl0IG9ubHkgbWFrZXMgaXQgbW9y ZSBjb21wbGV4OyB0aGUgYmFzZSBDb0FQIHByb3RvY29sIHNob3VsZCBoYW5kbGUgcGlnZ3liYWNr ZWQgdnMgc2VwYXJhdGUgZm9yIGJvdGggY2xpZW50IGFuZCBzZXJ2ZXIuIChXaXRob3V0IGltcGFj dCBvbiByZXNwb25zZSBjb2RlcykuDQoNCiogVGFibGUgMzogdGhlICI0Lnh4IiBjYW4gYmUgIjQu eHggLyA1Lnh4IiBiZWNhdXNlIHRoZSA1Lnh4IGZhaWx1cmVzIGNhbiBhbHNvIG9jY3VyIGluIGFu eSBDb0FQIHNlcnZlciBpbiBwcmluY2lwbGUuICBJIGRvbid0IHJlYWxseSBzZWUgd2h5IDQuMDIg c2hvdWxkIGJlIG1lbnRpb25lZCBzZXBhcmF0ZWx5PyBJdCBhZ2FpbiBpcyBkZWZpbmVkIGluIHRo ZSBiYXNlIENvQVAgc3BlYyBhbmQgbm90IHJlYWxseSBvZiBpbnRlcmVzdCBmb3IgRVNULWNvYXBz LCBub3IgdXNlZCBieSBhbnkgZGVmaW5pdGlvbnMgb3IgZXhhbXBsZXMgaW4gdGhlIGN1cnJlbnQg c3BlY2lmaWNhdGlvbi4NCg0KDQpTZWNvbmQsIGJlbG93IGEgZmV3IG1vcmUgcmV2aWV3IGNvbW1l bnRzIG9uIHRoZSAtMTEgdmVyc2lvbjoNCg0KKiBFbmQgb2YgU2VjdGlvbiA2OiAiSWYgbmVjZXNz YXJ5LCB0aGUgRVNULWNvYXBzLXRvLUhUVFAgUmVnaXN0cmFyIHdpbGwgc3VwcG9ydCByZXNvdWNl IGRpc2NvdmVyeSBhY2NvcmRpbmcgdG8gdGhlIHJ1bGVzIGluIFNlY3Rpb24gNS4xLiINCi0+IHdo YXQgYWJvdXQgKGFsc28gYWRkZWQgbGV0dGVyIHRvICdyZXNvdWNlJykNCiJUaGUgRVNULWNvYXBz LXRvLUhUVFAgUmVnaXN0cmFyIE1VU1Qgc3VwcG9ydCByZXNvdXJjZSBkaXNjb3ZlcnkgYWNjb3Jk aW5nIHRvIHRoZSBydWxlcyBpbiBTZWN0aW9uIDUuMS4iDQpCZWNhdXNlIHRoaXMgUmVnaXN0cmFy IG9wZXJhdGVzIHRvIHRoZSBDb0FQIGNsaWVudCBmYWNpbmcgc2lkZSBleGFjdGx5IGxpa2UgYSBD b0FQIEVTVCBzZXJ2ZXIuIFNvIGl0IG11c3Qgc3VwcG9ydCB0aGUgc2FtZSBydWxlcyBmb3IgZGlz Y292ZXJ5LCBvciBlbHNlIGl0IHdvbid0IHdvcmsgKGUuZy4gYmUgbm90IGRpc2NvdmVyYWJsZSku DQoNCiogU2VjdGlvbiA5LjE6ICJUaGVzZSBoYXZlIGJlZW4gcmVnaXN0ZXJlZCBwcm92aXNpb25h bGx5IGluIHRoZSBFeHBlcnQgUmV2aWV3IHJhbmdlICgwLTI1NSkiDQotPiAiVGhlc2UgaGF2ZSBi ZWVuIHJlZ2lzdGVyZWQgcHJvdmlzaW9uYWxseSBpbiB0aGUgSUVURiBSZXZpZXcgb3IgSUVTRyBB cHByb3ZhbCByYW5nZSAoMjU2LTk5OTkpIg0KDQoqIFNlY3Rpb24gMTAuMTogDQogICBBIGNsaWVu dCB0aGF0IHBpcGVsaW5lcyBFU1QtY29hcHMgL2NydHMgcmVxdWVzdA0KICAgd2l0aCBvdGhlciBy ZXF1ZXN0cyBpbiB0aGUgc2FtZSBEVExTIGNvbm5lY3Rpb24gU0hPVUxEIHJldmFsaWRhdGUgdGhl DQogICBzZXJ2ZXIgY2VydGlmaWNhdGUgY2hhaW4gYWdhaW5zdCB0aGUgdXBkYXRlZCBFeHBsaWNp dCBUQSBmcm9tIHRoZQ0KICAgL2NydHMgcmVzcG9uc2UgYmVmb3JlIHByb2NlZWRpbmcgd2l0aCB0 aGUgc3Vic2VxdWVudCByZXF1ZXN0cy4gIA0KICAgSWYgdGhlIHNlcnZlciBjZXJ0aWZpY2F0ZSBj aGFpbiBkb2VzIG5vdCBhdXRoZW50aWNhdGUgYWdhaW5zdCB0aGUNCiAgIGRhdGFiYXNlLCB0aGUg Y2xpZW50IFNIT1VMRCBjbG9zZSB0aGUgY29ubmVjdGlvbiB3aXRob3V0IGNvbXBsZXRpbmcNCiAg IHRoZSByZXN0IG9mIHRoZSByZXF1ZXN0cy4gIFRoZSB1cGRhdGVkIEV4cGxpY2l0IFRBIE1VU1Qg Y29udGludWUgdG8NCiAgIGJlIHVzZWQgaW4gbmV3IERUTFMgY29ubmVjdGlvbnMuDQotPiBkb2Vz IHRoZSBsYXN0IHJlcXVpcmVtZW50IG1lYW4gbmV3IERUTFMgY29ubmVjdGlvbnMgdG8gdGhlIHNh bWUgRVNUIHNlcnZlcj8gT3IsIG5ldyBEVExTIGNvbm5lY3Rpb25zIHRvIGFueSBFU1Qgc2VydmVy KHMpIGluIHRoZSBmdXR1cmU/IA0KLT4gaXQgaXMgYWxzbyB1bmNsZWFyIGhlcmUgd2hldGhlciB0 aGUgdXBkYXRlZCBFeHBsaWNpdCBUQSBuZWVkcyB0byByZXBsYWNlIGFuIGV4aXN0aW5nIGNvbmZp Z3VyZWQgRXhwbGljaXQgVEEgKGUuZy4gb2J0YWluZWQgZnJvbSBhbiBBTklNQSB2b3VjaGVyIG9y IGEgcHJldmlvdXMgL2NydHMgcmVxdWVzdC4gKS4gIEkgd291bGQgdGhpbmsgbm90LCBlc3BlY2lh bGx5IGdpdmVuIHRoYXQgdGhlIHZlcmlmaWNhdGlvbiBvZiBpdCBmYWlsZWQgaW4gYWJvdmUgdGV4 dD8NCi0+IEkgd29uZGVyIHdoeSB0aGUgY2xpZW50IHdvdWxkIHRydXN0IGEgbmV3IEV4cGxpY2l0 IFRBLCBpZiB0aGUgRVNUIHNlcnZlciBpdHNlbGYgY2Fubm90IGJlIGF1dGhlbnRpY2F0ZWQgdXNp bmcgdGhhdCBUQS4gSXQgd2lsbCBkaXNjb25uZWN0IGFuZCB0aGVuIHVwb24gbmV4dCBEVExTIGNv bm5lY3Rpb24gdG8gdGhlIHNhbWUgc2VydmVyIHRoZSBoYW5kc2hha2Ugd2lsbCBmYWlsIGFnYWlu c3QgdGhlIG5ldyBUQS4gQW5kIHRoZSBjbGllbnQgY2FuJ3QgcGVyZm9ybSBFU1QgYW55bW9yZSB1 bnRpbCBmYWN0b3J5IHJlc2V0LiBPciBpcyB0aGUgZXhwZWN0YXRpb24gdGhhdCBpdCBzb21laG93 IHdpbGwgdXNlIGFub3RoZXIgRVNUIHNlcnZlciBmb3IgYSBzZWNvbmQgdHJ5Pw0KDQoqIFNlY3Rp b24gMTAuMTogImRlcGVuZCBpbiIgLT4gImRlcGVuZCBvbiINCg0KKiBTZWN0aW9uIDEwLjE6ICJl c3BlY2lhbGx5IHNpbmNlIHRoZSBwcmFjdGljYWxpdHkgb2Ygc3VjaCBhbiBhdHRhY2sgd291bGQg bm90IGV4cG9zZSBhbnkgbWVzc2FnZXMgZXhjaGFuZ2VkIHdpdGggRVNULWNvYXBzLiINCi0+IHJh dGhlciBjb21wbGV4IHNlbnRlbmNlLCB3aGF0IGFib3V0DQoiImVzcGVjaWFsbHkgc2luY2UgYSAz U0hBS0UgYXR0YWNrIGRvZXMgbm90IGV4cG9zZSBtZXNzYWdlcyBleGNoYW5nZWQgd2l0aCBFU1Qt Y29hcHMuIg0KDQoqIFNlY3Rpb24gMTAuMTogIlJlZ2FyZGluZyB0aGUgQ2VydGlmaWNhdGUgU2ln bmluZyBSZXF1ZXN0IChDU1IpLCBhIENBIGlzIGV4cGVjdGVkIHRvIGJlIGFibGUgdG8gZW5mb3Jj ZSBwb2xpY2llcyB0byByZWNvdmVyIGZyb20gaW1wcm9wZXIgQ1NSIHJlcXVlc3RzLiINCi0+IHNo b3VsZCBiZSAiYW4gRVNULWNvYXBzIHNlcnZlciBpcyBleHBlY3RlZCB0byIgPyAgIEJlY2F1c2Ug dGhpcyBzcGVjaWZpY2F0aW9uIGFuZCAxMC4xIGRlc2NyaWJlcyB0aGUgRVNULWNvYXBzIHNlcnZl ciwgbm90IGEgQ0EuDQoNCiogU2VjdGlvbnMgNS4xLCA1LjcsIDEwLjIgOiB3b3JkICJoZSIgaXMg dXNlZCB0byByZWZlciB0byBjbGllbnQgb3Igc2VydmVyLiBNYXliZSB0aGlzIHNob3VsZCBiZWNv bWUgIml0IiAobm90IGEgcGVyc29uKS4NCg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBrYW1wYW5hQGNpc2NvLmNvbT4g DQpTZW50OiBTYXR1cmRheSwgTWF5IDI1LCAyMDE5IDA2OjQ4DQpUbzogRXNrbyBEaWprIDxlc2tv LmRpamtAaW90Y29uc3VsdGFuY3kubmw+OyBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBbQWNl XSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0KSGkgRXNrbywN Cg0KVGhhbmsgeW91IGFnYWluLiBBZ2FpbiBhIHZlcnkgZWxhYm9yYXRlIHJldmlldyBhbmQgZm91 bmQgc29tZSBnb29kIG5pdHMgaW4gdGhlIERlbGF5ZWQgcmVzcG9uc2VzIHNlY3Rpb24uIFRvIG1h a2UgaXQgZWFzaWVyIEkgbG9nZ2VkIHRoZSBpc3N1ZXMgYW5kIGZpeGVzIGhlcmUgaHR0cHM6Ly9n aXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMvaXNzdWVzLzE0NSANCg0KVGhlIHVwZGF0 ZWQgZG9jIGlzIGhlcmUgaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMv YmxvYi9tYXN0ZXIvZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QudHh0IGFuZCB0aGUgZGlmZnMgYXJl IGhlcmUgaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMvY29tbWl0LzRh ZDUyMTBmYWY2MjRjNjdlMTk5OGRhNzVlYTA1MWRlNjE2ZTkxYjEjZGlmZi0zYTcxMmVkYjQzZjZl YWNlN2ZiMTY2NzMyOGQ2NTMwNyAgDQoNClJncw0KUGFub3MNCg0KLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0NCkZyb206IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPiAN ClNlbnQ6IFR1ZXNkYXksIE1heSAyMSwgMjAxOSA2OjMxIFBNDQpUbzogUGFub3MgS2FtcGFuYWtp cyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNjby5jb20+OyBhY2VAaWV0Zi5vcmcNCkNjOiBkcmFm dC1pZXRmLWFjZS1jb2FwLWVzdEBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtBY2VdIEktRCBBY3Rp b246IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dA0KDQpIZWxsbyBQYW5vcywNCg0KRm9y IHRoZSBkcmFmdCB0ZXh0IEkgaGF2ZSBhIGNvdXBsZSBvZiBtb3JlIHJldmlldyByZW1hcmtzOg0K DQoqIHBhZ2UgOCBmaXJzdCBidWxsZXQ6IGEgcHJldmlvdXNseSBpc3N1ZXMgY2xpZW50IGNlcnRp ZmljYXRlIGNvdWxkIGFsc28gZXhwaXJlLCBpbiBzb21lIGNhc2VzIGV2ZW4gd2l0aG91dCB0aGUg Y2xpZW50IGtub3dpbmcuIElmIHRoZSBjbGllbnQgdGhlbiBwZXJmb3JtcyBzaW1wbGUgcmUtZW5y b2xsbWVudCAtLSB1c2luZyBpdHMgcHJldmlvdXMgb3BlcmF0aW9uYWwgY2VydCBhcyBhdXRoZW50 aWNhdGlvbiwgd2hhdCB3b3VsZCBoYXBwZW4/ICBJIHdvdWxkIGV4cGVjdCB0aGUgc2VydmVyIE1B WSBhbHNvIHdhbnQgdG8gdXNlIHRoaXMgY2VydGlmaWNhdGUgdG8gYXV0aGVudGljYXRlIHRoZSBj bGllbnQuIEJlY2F1c2UgdGhlIHB1cnBvc2Ugb2YgdGhlIGNsaWVudCBjb25uZWN0aW5nIGFnYWlu IHRvIHRoZSBFU1Qgc2VydmVyIGlzIHRvIGRvIHNpbXBsZSByZS1lbnJvbGxtZW50LCB0byBnZXQg YSBuZXcgY2VydGlmaWNhdGUuICAgU3VwcG9zZSBhIGNhc2Ugd2hlcmUgdGhlIGhhbmRzaGFrZSB0 byB0aGUgRVNUIHNlcnZlciBmYWlscyBiZWNhdXNlIHRoZSBFU1Qgc2VydmVyIHJlamVjdHMgdGhl IGV4cGlyZWQgb3BlcmF0aW9uYWwgY2VydDogIHdoYXQgd291bGQgdGhlIGNsaWVudCBkbyBub3c/ IEl0IGNvdWxkIGJlIGEgY2VydGlmaWNhdGVfZXhwaXJlZCBtZXNzYWdlLiAgUkZDIDcwMzAgcHJv dmlkZXMgbm8gZ3VpZGFuY2UgaW4gdGhpcyBtYXR0ZXI7IHdvdWxkIEVTVC1jb2FwcyBuZWVkIHRv IGRlZmluZSB0aGlzPyBFLmcuIGNsaWVudCBTSE9VTEQgcmV0cnkgdXNpbmcgdGhlIGJ1bGxldCAj MiBjZXJ0aWZpY2F0ZSAoZS5nLiBJRGV2SUQpPw0KDQoqIHBhZ2UgOCBtaWRkbGU6ICJDb0FQIGFu ZCBEVExTIGNhbiBwcm92aWRlIHByb29mLW9mLWlkZW50aXR5IGZvciBFU1QtY29hcHMgY2xpZW50 cyBhbmQgc2VydmVycyB3aXRoIHNpbXBsZSBQS0kgbWVzc2FnZXMgYXMgZGVzY3JpYmVkIGluIFNl Y3Rpb24gMy4xIG9mIFtSRkM1MjcyXSAiDQpMb29raW5nIHVwIHRoaXMgc2VjdGlvbiBpdCBzYXlz OiAiVGhlIFNpbXBsZSBQS0kgUmVxdWVzdCBNVVNUIE5PVCBiZSB1c2VkIGlmIGEgcHJvb2Ytb2Yt aWRlbnRpdHkgbmVlZHMgdG8gYmUgaW5jbHVkZWQuIiAgIFRoaXMgc2VlbXMgdG8gc2F5IHRoZSBv cHBvc2l0ZSBvZiB0aGUgYWJvdmUgdGV4dD8gIFRoaXMgcmVxdWlyZXMgYXQgbGVhc3Qgc29tZSBt b3JlIGV4cGxhbmF0aW9uLg0KDQoqIHBhZ2UgOCBtaWRkbGU6ICJNb3Jlb3ZlciwgY2hhbm5lbC1i aW5kaW5nIGluZm9ybWF0aW9uIGZvciBsaW5raW5nIHByb29mLW9mLWlkZW50aXR5IHdpdGggY29u bmVjdGlvbi1iYXNlZCBwcm9vZi1vZi1wb3NzZXNzaW9uIGlzIE9QVElPTkFMIGZvciBFU1QtY29h cHMiICAtPiBpcyBpdCBPUFRJT05BTCBmb3IgY2xpZW50LCBzZXJ2ZXIsIG9yIGJvdGg/IEkgd291 bGQgYXNzdW1lIGl0IGlzIE9QVElPTkFMIGZvciBib3RoLiBJZiB0aGUgKGxpZ2h0LXdlaWdodCkg Y2xpZW50IGRvZXMgbm90IGltcGxlbWVudCBpdCBhbmQgaWYgdGhlIHNlcnZlciBkb2VzIG1hbmRh dGUgaXQsIHRoZSBjbGllbnQgY2FuIG5vdCBjb25uZWN0IHRvIHRoYXQgc2VydmVyIGlmIGl0cyBw b2xpY3kgaXMgc2V0IHRvICJsaW5raW5nIFBPUC9pZGVudGl0eSByZXF1aXJlZCIuDQoNCiogcGFn ZSAxNCB0b3AgYnVsbGV0OiAiVGhlIENvQVAgT3B0aW9ucyB1c2VkIGFyZSAuLi4uICIgDQogIC0+ IHRoZSBpdGVtIEJsb2NrIGNvdWxkIGJlIGV4cGFuZGVkIHRvICJCbG9jazEsIEJsb2NrMiIgdG8g Y2FwdHVyZSB0aGUgYWN0dWFsIE9wdGlvbiBuYW1lcy4NCiAgLT4gTG9jYXRpb24tUGF0aCBpcyBu ZXZlciB1c2VkIGluIGFueSBvZiB0aGUgQ29BUCBpbnRlcmFjdGlvbnMgZGVmaW5lZDsgc2hvdWxk IGJlIHJlbW92ZWQuDQoNCiogUGFnZSAxNCBmaXJzdCA1LjUgcGFyYWdyYXBoOiAiU2ltaWxhcmx5 LCAyLjAxLCAyLjAyIG9yIDIuMDQgTVVTVCBiZSB1c2VkIGluIHJlc3BvbnNlIHRvIEVTVCBQT1NU IHJlcXVlc3RzIg0KICAtPiAyLjAxIENyZWF0ZWQgaXMgbGlrZSBIVFRQIDIwMSwgd2hpY2ggaXMg bm90IHVzZWQgaW4gRVNUIC0gc28gY2FuIGJlIHJlbW92ZWQgaGVyZS4NCiAgLT4gMi4wMiBEZWxl dGVkIGhhcyBubyBIVFRQIGVxdWl2YWxlbnQsIHNvIGlzIG5vdCB1c2VkIGluIEVTVC4gSXQgc2hv dWxkIGJlIHJlbW92ZWQgaGVyZS4NCiAgLT4gdGhhdCBsZWF2ZXMgb25seSAyLjA0IHJlc3BvbnNl cy4gSG93ZXZlciB0aGUgdGV4dCBzaG91bGQgc2F5IHRoaXMgaXMgZm9yIHN1Y2Nlc3NmdWwgKEhU VFAgMjAwIG9yIDIwMiBpbiBFU1QpIHJlc3BvbnNlcyAsIHNvIHN1Z2dlc3Rpb24gaXMgdG8gY2hh bmdlIGFib3ZlIHNlbnRlbmNlIHRvOiAiU2ltaWxhcmx5LCAyLjA0IE1VU1QgYmUgdXNlZCBpbiBh IHJlc3BvbnNlIHRvIGEgc3VjY2Vzc2Z1bCBFU1QgUE9TVCByZXF1ZXN0Ig0KDQoqIHBhZ2UgMTQg Ym90dG9tOiAiRVNUIG1ha2VzIHVzZSBvZiBIVFRQIDIwNCBhbmQgNDA0IHJlc3BvbnNlcyB3aGVu IGEgcmVzb3VyY2UgaXMgbm90ICBhdmFpbGFibGUgZm9yIHRoZSBjbGllbnQuICBUaGUgZXF1aXZh bGVudCBDb0FQIGNvZGVzIHRvIHVzZSBpbiBhbiBFU1QtY29hcHMgcmVzcG9uc2VzIGFyZSAyLjA0 IGFuZCA0LjA0LiAgIg0KICAtPiBDb0FQIDIuMDQgY2FuIG9ubHkgYmUgdXNlZCBpbiByZXNwb25z ZXMgdG8gUE9TVCBvciBQVVQgcmVxdWVzdHMsIG5vdCBmb3IgR0VUIHJlc3BvbnNlcy4NCiAgLT4g c28gaW4gQ29BUCB0aGUgc2VydmVyIGNvdWxkIGVpdGhlciByZXR1cm4gMi4wNSB3aXRoIGVtcHR5 IHBheWxvYWQgKGVxdWl2YWxlbnQgdG8gSFRUUCAyMDQpLCBvciByZXR1cm4gNC4wNCAoZXF1aXZh bGVudCB0byBIVFRQIDQwNCkNCg0KKiBwYWdlIDE1IGJvdHRvbTogIlRoZSBFU1QtY29hcHMgY2xp ZW50IGFuZCBzZXJ2ZXIgTVVTVCBzdXBwb3J0IEJsb2NrMi4gIEJsb2NrMSBNVVNUIGJlIHN1cHBv cnRlZCBmb3IgRVNULWNvYXBzIGVucm9sbG1lbnQgcmVxdWVzdHMgdGhhdCBleGNlZWQgdGhlIFBh dGggTVRVLiINCiAgLT4gY291bGQgYmUgY2xhcmlmaWVkIGJldHRlciwgSSBleHBlY3QgYSBFU1Qt Y29hcHMgc2VydmVyIE1VU1Qgc3VwcG9ydCBCbG9jazEgYmVjYXVzZSB0aGF0IHNlcnZlciBkb2Vz bid0IGtub3cgaW4gYWR2YW5jZSBob3cgYmlnIHRoZSBjbGllbnQncyByZXF1ZXN0IHBheWxvYWQg aXMgZ29pbmcgdG8gYmUgYW5kIHdoZXRoZXIgdGhhdCBjbGllbnQgd2lsbCB1c2UgQmxvY2sxLg0K ICAtPiBlLmcuICJUaGUgRVNULWNvYXBzIGNsaWVudCBhbmQgc2VydmVyIE1VU1Qgc3VwcG9ydCBC bG9jazIuICBUaGUgRVNULWNvYXBzIHNlcnZlciBNVVNUIHN1cHBvcnQgQmxvY2sxLiBUaGUgRVNU LWNvYXBzIGNsaWVudCBNVVNUIHN1cHBvcnQgQmxvY2sxIGlmIGl0IHNlbmRzIEVTVC1jb2FwcyBy ZXF1ZXN0cyB3aXRoIGFuIElQIHBhY2tldCBzaXplIHRoYXQgZXhjZWVkcyB0aGUgUGF0aCBNVFUu Ig0KDQoqIHBhZ2UgMTYgZXhhbXBsZTogdGhlIHBheWxvYWRzIGFyZSBub3QgaW5kaWNhdGluZyB0 aGF0IGVhY2ggIntDU1IgcmVxfSIgcGF5bG9hZCBpcyBkaWZmZXJlbnQuIEkuZS4sIGEgZGlmZmVy ZW50IGJsb2NrLiBJdCB3b3VsZCBiZSBtb3JlIGNsZWFyIGlmIHRoYXQgaXMgc2hvd24gZS5nLiAi e0NTUiAxfSIsICJ7Q1NSIDJ9IiwgLi4uIHVwIHRvICJ7Q1NSIE4xKzF9Ii4gVGhlICJyZXEiIHN0 cmluZyBpcyBub3QgbmVlZGVkIHNpbmNlIHRoZSBSIGluIENTUiBhbHJlYWR5IHN0YW5kcyBmb3Ig cmVxdWVzdC4NCg0KKiBwYWdlIDE3IGV4YW1wbGU6IHNlZSBhYm92ZSBwYXlsb2FkcyByZW1hcms7 IGFuZCB0aGUgZm9sbG93aW5nOg0KICAtLT4gd2hhdCBJIGZpbmQgc3RyYW5nZSBoZXJlIGlzIHRo YXQgYSBibG9ja3dpc2UgUE9TVCByZXF1ZXN0IGVuZHMgd2l0aCBhIDUuMDMgcmVzcG9uc2UsIGFu ZCB0aGVuIHRoZSBzYW1lIHJlcXVlc3QgYWZ0ZXIgdGhhdCBnaXZlcyBhIDIuMDEgcmVzcG9uc2Uu IEluIENvQVAgQUZBSUssIG9uZSByZXF1ZXN0IGNhbiBuZXZlciBnaXZlIDIgcmVzcG9uc2VzIGlu IHNlcXVlbmNlLg0KICAtLT4gb25jZSBhIHJlc3BvbnNlIGlzIGRlbGl2ZXJlZCBiYWNrIHRvIHRo ZSBjbGllbnQgcGlnZ3liYWNrZWQgb24gYW4gQUNLLCB0aGUgc2VydmVyIGNsb3NlcyB0aGUgdHJh bnNhY3Rpb24gbm9ybWFsbHkgYW5kIG5vIGZ1cnRoZXIgc3RhdGUgZm9yIHRoZSB0cmFuc2FjdGlv biBpcyBrZXB0Lg0KICAtLT4gbm9ybWFsbHkgaWYgYSBzZXJ2ZXIgc2VuZHMgNS4wMyB3aXRoIE1h eC1BZ2UgdGhlIGNsaWVudCBuZWVkcyB0byBzZW5kIGEgbmV3IHJlcXVlc3QgaS5lLiByZXRyeSB3 aXRoIGEgbmV3IHJlcXVlc3QgYWZ0ZXIgdGhpcyB3YWl0aW5nIHRpbWUuICAgVGhhdCBpbXBsaWVz IHRoZSBjbGllbnQgd291bGQgbmVlZCB0byByZXNlbmQgdGhlIGVudGlyZSByZXF1ZXN0OiBhbGwg YmxvY2tzIG9mIGl0IQ0KICAtLT4gSSBkbyByZWFsaXplIHRoYXQgcmVzZW5kaW5nIGFsbCBibG9j a3MgaXMgdmVyeSBpbmVmZmljaWVudCA7IGJ1dCBhdCB0aGUgc2FtZSB0aW1lIHRoZSBleGFtcGxl IGFsc28gc2VlbXMgaW5jb21wYXRpYmxlIHdpdGggQ29BUCBzcGVjcy4NCiAgLS0+IGFub3RoZXIg cXVlc3Rpb24gaXMgd2h5IGRvZXMgdGhlIHNlcnZlciB1c2UgQmxvY2syIG9wdGlvbiBpbiB0aGUg NS4wMyByZXNwb25zZSB0aGF0IGhhcyBubyBwYXlsb2FkLiBJbiBSRkMgNzk1OSBTZWN0aW9uIDIu MSwgInRoZSBCbG9jazIgT3B0aW9uIHBlcnRhaW5zIHRvIHRoZSByZXNwb25zZSBwYXlsb2FkIiBh bmQgInBheWxvYWQtYmVhcmluZyByZXNwb25zZXMiLiBTbyBpdCBzaG91bGQgYmUganVzdCBsZWZ0 IG91dCBpbiB0aGUgcmVzcG9uc2Ugd2l0aG91dCBwYXlsb2FkIEkgdGhpbmsuDQogIC0tPiBJIHVu ZGVyc3RhbmQgdGhpcyBzZXF1ZW5jZSBvZiBtZXNzYWdlcyB3YXMgdGVzdGVkIHVzaW5nIGludGVy b3BzL2NvZGU7IHdhcyBhIHNwZWNpZmljIENvQVAgbGlicmFyeSB1c2VkIHRoYXQgZXhoaWJpdHMg dGhpcyBiZWhhdmlvcj8gSSB3b3VsZCBiZSBpbnRlcmVzdGVkIHRvIHVuZGVyc3RhbmQgYmV0dGVy IHdoeSB0aGlzIHdvcmtzLg0KDQpIb3BlIHRoZXNlIGNvbW1lbnRzIGNhbiBzdGlsbCBiZSB1c2Vk IGZvciBpbXByb3ZlbWVudCBvZiB0aGUgc3BlYy4gSSB3aWxsIHNlbmQgZnVydGhlciByZXZpZXcg Y29tbWVudHMgaW4gYSBuZXh0IGVtYWlsOiBzdGlsbCBuZWVkIHRvIHdyaXRlIHRoZXNlIGRvd24u DQoNCkJlc3QgcmVnYXJkcw0KRXNrbw0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0N CkZyb206IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPiAN ClNlbnQ6IE1vbmRheSwgTWF5IDIwLCAyMDE5IDE3OjMxDQpUbzogRXNrbyBEaWprIDxlc2tvLmRp amtAaW90Y29uc3VsdGFuY3kubmw+OyBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBbQWNlXSBJ LUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0KVGhhbmtzIEVza28u IA0KDQpBZGRyZXNzZWQgaW4gaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29h cHMvYmxvYi84NGNlMGMxZDVlNzY4ZDQwZTk3MTg0MjE0YmFlNDA0ZGEyMWJkMDUwL2RyYWZ0LWll dGYtYWNlLWNvYXAtZXN0LnhtbCBUd28gY29tbWVudHM6IA0KDQo+IHBhZ2UgMTEgYm90dG9tIHJl cXVpcmVtZW50OiAiIFRoZSBjbGllbnQgU0hPVUxEIHVzZSByZXNvdXJjZSBkaXNjb3Zlcnkgd2hl biBoZSBpcyB1bmF3YXJlIG9mIHRoZSBhdmFpbGFibGUgIEVTVC1jb2FwcyByZXNvdXJjZXMuIiAt IHdoZW4gYW4gRVNUIHNlcnZlciBpcyBrbm93biwgdGhpcyByZXF1aXJlbWVudCBkb2VzIG5vdCBy ZWFsbHkgYXBwbHkgc2luY2UgdGhlIHNlcnZlciBhbHdheXMgc3VwcG9ydHMgLndlbGwta25vd24g RVNUIHJlc291cmNlcy4gIFNvIEkgcmVhZCBpdCBhcyBkb2luZyBhbiBSRCBkaXNjb3Zlcnkgb3Ig bXVsdGljYXN0IENvQVAgZGlzY292ZXJ5IGlmIHRoZSBjbGllbnQgZG9lc24ndCBrbm93biB0aGUg RVNUIHNlcnZlciBhZGRyZXNzLiAgSG9wZSB0aGlzIGlzIGNsZWFyIGVub3VnaCBpbiB0aGUgdGV4 dCBhbmQgaW50ZW5kZWQ/DQoNClRoZXJlIGFyZSBvcHRpb25hbCByZXNvdXJjZXMgbGlrZSAvYXR0 LCAvc2tnIGFuZCAvc2tjIHRoYXQgdGhlIHNlcnZlciBkb2VzIG5vdCBoYXZlIHRvIHN1cHBvcnQs IHNvIHRoYXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcgdG8uIA0KDQo+IHBh Z2UgMTEgYm90dG9tOiAiIEl0IGlzIHVwIHRvIHRoZSBpbXBsZW1lbnRhdGlvbiB0byBjaG9vc2Ug aXRzIHJlc291cmNlIHBhdGhz4oCdIC0+IHNlZW1zIG5vdCByZWFsbHkgdGhlIGNhc2UsIGJlY2F1 c2UgdGhlIHJvb3QgcmVzb3VyY2Ugc3RydWN0dXJlIGlzIGZvcmNlZCBieSB0aGUgc3BlY2lmaWNh dGlvbi4gSXQgY291bGQgaGF2ZSBiZWVuIGRlc2lnbmVkIGFzIGZyZWUgY2hvaWNlIChiZWNhdXNl IGl0IGNhbiBiZSBkaXNjb3ZlcmVkIGFueXdheSkgYnV0IGl0IGlzIG5vdC4NCg0KVGhlIHRleHQg c2F5cyB0aGF0IHRoZSBzZXJ2ZXIgTVVTVCBzdXBwb3J0IHRoZSBkZWZhdWx0IC8ud2VsbC1rbm93 bi9lc3Qgcm9vdCByZXNvdXJjZSBhbmQgaXQgU0hPVUxEIHN1cHBvcnQgcmVzb3VyY2UgZGlzY292 ZXJ5IGZvciBub24tZGVmYXVsdCBVUklzIChsaWtlIC9lc3Qgb3IgL2VzdC9BcmJpdHJhcnlMYWJl bCkgb3IgcG9ydHMuIEluIHRoZSBsYXR0ZXIgY2FzZSBpdCBpcyB1cCB0byB0aGUgc2VydmVyIHRv IGRlY2lkZSB0aGUgcGF0aHMgaGUgbWFrZXMgaXRzIHJlc291cmNlcyBhdmFpbGFibGUgYXQuIFRo YXQgaXMgd2hhdCB0aGlzIHNlbnRlbmNlIHdhcyByZWZlcnJpbmcgdG8uIEJ1dCB5b3UgYXJlIHJp Z2h0OyBJIHJlYWxpemVkIHRoYXQgdGhpcyBzZW50ZW5jZSBpcyByZWR1bmRhbnQgc28gSSBvbmx5 IGtlcHQgIlRocm91Z2hvdXQgdGhpcyBkb2N1bWVudCB0aGUgZXhhbXBsZSByb290IHJlc291cmNl IG9mIC9lc3QgaXMgdXNlZC4iDQoNCldpbGwgcmV1cGxvYWQgdGhlIG5leHQgaXRlcmF0aW9uIGlu IGEgZmV3IGRheXMuIA0KDQpSZ3MsDQpQYW5vcw0KDQoNCg== From nobody Tue May 28 11:28:17 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53C32120123 for ; Tue, 28 May 2019 11:28:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=Wb0dCmSs; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=YjcVhwJj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ia8PZhrD_VOG for ; Tue, 28 May 2019 11:28:12 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCFB8120090 for ; Tue, 28 May 2019 11:28:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=22456; q=dns/txt; s=iport; t=1559068091; x=1560277691; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=wOXR6ZB0Jq2Q9VFUDWC5lqOM9NXyPXFKfctHyYdUs6U=; b=Wb0dCmSsr4us9llXLHLzy8EkPtQmpKLgueNGSZ3FotWMSVvKHFYlll6J mZfsPqilYjRMzuS/x+KF+DEsv8bcp8snfH4TRaFZVdlodvs3OV6OegBP8 lRnVgvyCELr6hICFx/QJavA4VWChmhkt/KfVto/ajLfqbFIXtzCCz6odD 0=; IronPort-PHdr: =?us-ascii?q?9a23=3AcT6esxGOlpuR4Yisqp4EvJ1GYnJ96bzpIg4Y7I?= =?us-ascii?q?YmgLtSc6Oluo7vJ1Hb+e4z1Q3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNV?= =?us-ascii?q?cejNkO2QkpAcqLE0r+eebpZikiFcJLfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DHAAAIfe1c/4wNJK1cCR4BBgcGgVI?= =?us-ascii?q?ICwGBPSQsA2lVIAQLKAqECYNHA45+SoINlyuBLhSBEANUCQEBAQwBARgPBgI?= =?us-ascii?q?BAYRAAheCTCM1CA4BAwEBBAEBAgEEbRwMhUoBAQEBAgEBARARBA0MAQEpAww?= =?us-ascii?q?EBwYBCBEEAQEDAh8HAgQlCxUICQEEARIIGoMBgWoDDg8BAgyfAwKBOIhfcXw?= =?us-ascii?q?zgnkBAQWBMgGDTxiCDwMGgQwohGmEIYJJF4FAP4ERRoFOfj6BBIFdAQECGIE?= =?us-ascii?q?UAQgKAQcBARgVgnMygiaLNgYCBg2CO4Z6kmhpCQKCDYVcWIx8gh+KZolEjG6?= =?us-ascii?q?BKIVajBI1BoIpAgQCBAUCDgEBBYFQATZDI3FwFTuCbIIPN4M5hRSFP3IKgR+?= =?us-ascii?q?LFw0XAQaBBAGBIAEB?= X-IronPort-AV: E=Sophos;i="5.60,523,1549929600"; d="scan'208";a="279198895" Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 28 May 2019 18:28:10 +0000 Received: from XCH-ALN-019.cisco.com (xch-aln-019.cisco.com [173.36.7.29]) by alln-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x4SISAER016232 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 28 May 2019 18:28:10 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-ALN-019.cisco.com (173.36.7.29) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 28 May 2019 13:28:09 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 28 May 2019 13:28:08 -0500 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 28 May 2019 14:28:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wOXR6ZB0Jq2Q9VFUDWC5lqOM9NXyPXFKfctHyYdUs6U=; b=YjcVhwJjvEnwA4SVt3C6QKykqGfILxL4sqJTl6VL410AiHBSALv0kJY5DwWdGZHrhOE0P5vdlpgRE003ZrnU3pVyYcur28onq0Pd19TAwd8nxE4EkPwMlNLSQd2qsZ5zgNaxuXP5nI9bH+yMdVlarqo+guklhesCIQcihBoTLTI= Received: from BN7PR11MB2547.namprd11.prod.outlook.com (52.135.244.29) by BN7PR11MB2833.namprd11.prod.outlook.com (52.135.246.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.15; Tue, 28 May 2019 18:28:07 +0000 Received: from BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5463:bad7:8321:766e]) by BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5463:bad7:8321:766e%6]) with mapi id 15.20.1922.021; Tue, 28 May 2019 18:28:07 +0000 From: "Panos Kampanakis (pkampana)" To: Esko Dijk , "ace@ietf.org" Thread-Topic: Esko's review from 5/28/2019 (was RE: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments) Thread-Index: AdUVfO4cNfPEoNTQSY2z0TbI0APVRQ== Date: Tue, 28 May 2019 18:28:07 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [173.38.117.76] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a527b2e9-390a-4f70-7cba-08d6e39a3b2e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:BN7PR11MB2833; x-ms-traffictypediagnostic: BN7PR11MB2833: x-ms-exchange-purlcount: 7 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00514A2FE6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(396003)(39860400002)(136003)(13464003)(51914003)(199004)(189003)(52084003)(53946003)(53936002)(74316002)(3846002)(2906002)(71190400001)(68736007)(30864003)(305945005)(76116006)(2501003)(14454004)(71200400001)(66066001)(6436002)(7696005)(966005)(66946007)(7736002)(6306002)(66446008)(66556008)(64756008)(9686003)(25786009)(73956011)(6246003)(33656002)(478600001)(81156014)(486006)(81166006)(6116002)(26005)(229853002)(99286004)(316002)(55016002)(5660300002)(256004)(102836004)(52536014)(86362001)(8676002)(66476007)(8936002)(110136005)(53546011)(14444005)(6506007)(476003)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:BN7PR11MB2833; H:BN7PR11MB2547.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XsuTlIcq60pIdjQcHT8XT2L8NLR+JwK5oLrdrMttZq+wja93Ip+75GobQN9FXBDn5pvPZz4tTqtb8SBNHCWLs6x9DY4tTPMi1fKdRx3pvy+EwFAB2SGxEHPbflW9hEPp0MgAIVJi2wUHC0E4fTt5Gh8V8wpDqqXaidYCr78XtdjT/TDziRvEG3JhEnOG9xsjiRjnaOhH8GJSXaSghF+DjzBoWdLKpnGq8V85yuWkQ5PzVdrGeesacxrM3btRAyvY5V3p8KzU6sGzXZGysmmWfDB7VgOWp2X7dqCvNUAoowqugy7EiosX2LNCftqWRFdrdhlmRCnJ+b1tZ5htQuyNVWvtTb/86t7erx2XWGui7L6u83vEgSdFlYnsw466iN3HRMEBOBPg5fAhX1f4k43kBVpD9NCpHvXFTVXvwKQEFlw= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: a527b2e9-390a-4f70-7cba-08d6e39a3b2e X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2019 18:28:07.5375 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pkampana@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2833 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.29, xch-aln-019.cisco.com X-Outbound-Node: alln-core-7.cisco.com Archived-At: Subject: Re: [Ace] Esko's review from 5/28/2019 (was RE: I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 18:28:15 -0000 SGkgRXNrbywNCg0KQ2hhbmdpbmcgc3ViamVjdCBsaW5lIHRvIGFkZHJlc3MgeW91ciBuZXcgcmV2 aWV3IGNvbW1lbnRzIGZpcnN0LiBJIHdpbGwgYWRkcmVzcyB5b3VyIHJlc3BvbnNlIHRvIHlvdXIg cHJldmlvdXMgcmV2aWV3IGluIHRoZSBvdGhlciB0aHJlYWQuDQoNClRoYW5rcyBhZ2FpbiBmb3Ig ZmluZGluZyB0aGVzZSBuaXRzIGFuZCBmb3IgeW91ciBzdWdnZXN0aW9ucy4gDQoNCj4gLT4gSSB3 b25kZXIgd2h5IHRoZSBjbGllbnQgd291bGQgdHJ1c3QgYSBuZXcgRXhwbGljaXQgVEEsIGlmIHRo ZSBFU1Qgc2VydmVyIGl0c2VsZiBjYW5ub3QgYmUgYXV0aGVudGljYXRlZCB1c2luZyB0aGF0IFRB LiBJdCB3aWxsIGRpc2Nvbm5lY3QgYW5kIHRoZW4gdXBvbiBuZXh0IERUTFMgY29ubmVjdGlvbiB0 byB0aGUgc2FtZSBzZXJ2ZXIgdGhlIGhhbmRzaGFrZSB3aWxsIGZhaWwgYWdhaW5zdCB0aGUgbmV3 IFRBLiBBbmQgdGhlIGNsaWVudCBjYW4ndCBwZXJmb3JtIEVTVCBhbnltb3JlIHVudGlsIGZhY3Rv cnkgcmVzZXQuIE9yIGlzIHRoZSBleHBlY3RhdGlvbiB0aGF0IGl0IHNvbWVob3cgd2lsbCB1c2Ug YW5vdGhlciBFU1Qgc2VydmVyIGZvciBhIHNlY29uZCB0cnk/DQoNCkFzIHlvdSBhcmUgcG9pbnRp bmcgb3V0LCB0aGlzIGlzIG5vdCBhIGxpa2VseSBzY2VuYXJpbyBiZWNhdXNlIHRoZSBjYWNlcnRz IHJlc3BvbnNlIGJldHRlciBpbmNsdWRlIHRoZSByb290IGNlcnQgdG8gYXV0aGVudGljYXRlIHRo ZSBFU1QtY29hcHMgc2VydmVyIGdvaW5nIGZvcndhcmQgb3IgdGhlIGNsaWVudHMgd2lsbCBiZSBk ZWFkIGluIHRoZSB3YXRlci4gVGhpcyB0ZXh0IGlzIGFkZGVkIHRvIGFkZHJlc3MgdGhlIFJGQzcw MzAgKFNlY3Rpb24gNC4xLjEpIGxhbmd1YWdlIHRoYXQgZXhwbGljaXRseSBzYXlzIHRoYXQgdGhl IHZlcnkgZmlyc3QgdGltZSB5b3UgZ28gZnJvbSBhbiBpbXBsaWNpdCB0byBhbiBleHBsaWNpdCBU QSB5b3UgYXJlIHN1cHBvc2VkIHRvIHRlYXJkb3duIHRoZSBjb25uZWN0aW9uIGFmdGVyIHlvdSBn ZXQgdGhlIGNhY2VydHMgcmVzcG9uc2UgYW5kIHN0YXJ0IHVzaW5nIHRoZSBuZXcgVEEgZ29pbmcg Zm9yd2FyZC4NCg0KSW4gc29tZSB1c2VjYXNlcyB3ZSBkb24ndCB3YW50IHRvIHJlbmVnb3RpYXRl IERUTFMgaW4gY29uc3RyYWluZWQgaGVhdmlseSB1dGlsaXplZCBtZWRpdW1zIGFuZCBlc3RhYmxp c2ggYSBuZXcgY29ubmVjdGlvbiBmb3IgZW5yb2xsbWVudCBhZnRlciBhIGNhY2VydHMgcmVxdWVz dCwgc28gSSBhZGRlZCB0aGlzIHRleHQgdG8gc2F5IHRoYXQgaXQgaXMgT0sgdG8ga2VlcCB0aGUg c2FtZSBjb25uZWN0aW9uIGJ1dCBtYWtlIHN1cmUgeW91IGNoZWNrIHRoYXQgdGhlIHNlcnZlciBj ZXJ0IGluIHRoaXMgY29ubmVjdGlvbiBzdGlsbCB2YWxpZGF0ZXMgYWdhaW5zdCB0aGUganVzdCBy ZWNlaXZlZCBjYWNlcnRzLg0KDQo+IFNlY3Rpb25zIDUuMSwgNS43LCAxMC4yIDogd29yZCAiaGUi IGlzIHVzZWQgdG8gcmVmZXIgdG8gY2xpZW50IG9yIHNlcnZlci4gTWF5YmUgdGhpcyBzaG91bGQg YmVjb21lICJpdCIgKG5vdCBhIHBlcnNvbikuDQoNCkkgd2VudCBhbmQgbWFkZSB0aGUgc2VudGVu Y2VzIHRocm91Z2hvdXQgdGhlIGRyYWZ0IHJlZmVycmluZyB0byBjbGllbnQgYXMgInNoZSIgYW5k IHRoZSBzZXJ2ZXIgImhlIi4gQmV0dGVyIHRvIGJlIGFibGUgdG8gZGlzdGluZ3Vpc2ggbGlrZSB0 aGF0IGJlY2F1c2UgIml0IiBjYW4gYmUgY29uZnVzaW5nLg0KDQpJIGZpeGVkIGFsbCB0aGUgcmVz dC4gDQoNCk1vcmUgZGV0YWlscyBpbiB0aGUgZ2l0aHViIGlzc3VlIGh0dHBzOi8vZ2l0aHViLmNv bS9TYW5LdW1hcjIwMTUvRVNULWNvYXBzL2lzc3Vlcy8xNDYgDQoNClRoZSBkaWZmIGlzIGhlcmUg aHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAxNS9FU1QtY29hcHMvY29tbWl0L2U1MzY4NzVi OWM2NTYwNTYyNTUzZGU0Y2U0MDAwYjRjZTM1YzgzYzc/ZGlmZj1zcGxpdCANCg0KUmdzLA0KUGFu b3MNCg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQWNlIDxhY2UtYm91bmNl c0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEVza28gRGlqaw0KU2VudDogVHVlc2RheSwgTWF5IDI4 LCAyMDE5IDY6MzEgQU0NClRvOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBrYW1wYW5h QGNpc2NvLmNvbT47IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtBY2VdIEktRCBBY3Rpb246 IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dCAvIGFkZGl0aW9uYWwgcmV2aWV3IGNvbW1l bnRzDQoNCkhlbGxvLA0KDQpUaGFua3MgZm9yIHRoZSB1cGRhdGUhIEZpcnN0LCByZWdhcmRpbmcg dGhlIGNoYW5nZXM6DQoNCiogDQogICBtYXBwaW5nIG9mIEhUVFAgcmVzcG9uc2UgY29kZXMgdG8g Q29BUCByZXNwb25zZSBjb2Rlcy4gIFRoZSBzdWNjZXNzDQogICBjb2RlIGluIHJlc3BvbnNlIHRv IGFuIEVTVC1jb2FwcyBHRVQgcmVxdWVzdCAoL2NhY2VydHMsIC9jc3JhdHRycyksDQogICBpcyAy LjA1LiAgU2ltaWxhcmx5LCAyLjAxIGlzIHVzZWQgaW4gcmVzcG9uc2UgdG8gRVNULWNvYXBzIFBP U1QNCiAgIHJlcXVlc3RzICgvc2ltcGxlZW5yb2xsLCAvc2ltcGxlcmVlbnJvbGwsIC9zZXJ2ZXJr ZXlnZW4pLiAgU2VjdGlvbiA3DQogICBvZiBbUkZDODA3NV0gbWFwcyAyLjAyIChEZWxldGVkKSBv ciAyLjA0IChDaGFuZ2VkKSB0byBhbiBIVFRQIDIwMCBPSw0KICAgcmVzcG9uc2UsIGJ1dCAyLjAx IChDcmVhdGVkKSBpcyBtb3JlIHN1aXRhYmxlIGZvciB0aGUgY3JlYXRpb24gb2YNCiAgIGNlcnRp ZmljYXRlcyBpbiB0aGUgY29udGV4dCBvZiBFU1QtY29hcHMuDQotPiAyLjAxIENyZWF0ZWQgaXMg bm93IHVzZWQgYXMgUE9TVCByZXNwb25zZS4gIFdoaWxlIEkgYWdyZWUgdGhhdCBpdCBzb3VuZHMg bW9yZSBsb2dpY2FsIHRvIHVzZSAyLjAxIHRoYW4gMi4wNCAoc2luY2UgYSBjZXJ0aWZpY2F0ZSBp cyBjcmVhdGVkIGJ5IHRoZSBzZXJ2ZXIsIGJhc2VkIG9uIHRoZSBDU1IpLCB0aGVyZSBpcyB0aGUg Q29BUCBsZXZlbCBleHBlY3RhdGlvbiB0aGF0IHdoZW4gdXNpbmcgMi4wMSB0aGUgcmVzb3VyY2Ug aXMgY3JlYXRlZCBhdCB0aGUgbG9jYXRpb24gb2YgdGhlIHJlcXVlc3QgLSB0aGF0IGlzLCBmb3Ig ZXhhbXBsZSwgYXQgL3Nlbi4gU28gaWYgdGhlIGNsaWVudCB3b3VsZCBkbyBhIEdFVCAvc2VuIGl0 IHdvdWxkIGdldCB0aGUgYWN0dWFsIHByZXZpb3VzbHkgY3JlYXRlZCBjZXJ0aWZpY2F0ZS4gKFdo aWNoIGlzIG5vdCB0aGUgY2FzZS4pIFRoZSB0ZXh0IGluIFJGQyA3MjUyIHRoYXQgc3RhdGVzIHRo aXMgaXMgIk90aGVyd2lzZSwgdGhlIHJlc291cmNlIHdhcyBjcmVhdGVkIGF0IHRoZSByZXF1ZXN0 IFVSSS4iICAgU28gMi4wMSBpcyB1c2VkIHRvIGNyZWF0ZSBuZXcgQ29BUCAqcmVzb3VyY2VzKiB0 aGF0IGNhbiBiZSBmb3VuZCBhdCB0aGUgc2VydmVyIHVzaW5nIGEgc3Vic2VxdWVudCBHRVQgcmVx dWVzdC4gQW5kIDIuMDQgaXMgdXNlZCB0byBleGVjdXRlIGFjdGlvbnMgbGlrZSAnY3JlYXRlIHgn ICwgdGhlIHJlc3VsdCBvZiB3aGljaCBpcyByZXR1cm5lZCBpbiB0aGUgcmVzcG9uc2UgYnV0IG90 aGVyd2lzZSBub3QgYXZhaWxhYmxlIGFueXdoZXJlIG9uIHRoZSBzZXJ2ZXIgYW55bW9yZS4gVGhl IGxhdHRlciBpcyB0aGUgY2FzZSBpbiB0aGUgRVNULWNvYXBzIHByb3RvY29sIGZsb3cgYXMgdGhl cmUncyBubyB3YXkgdG8gR0VUIHRoZSByZXN1bHRpbmcgY2VydGlmaWNhdGUgbGF0ZXIgb24uDQot PiB0aGUgcmVzb3VyY2VzIGluIGJyYWNrZXRzIHNob3VsZCBub3cgYmUgdGhlIHNob3J0IHJlc291 cmNlIG5hbWVzLCBzaW5jZSB3ZSB0YWxrIGFib3V0IEVTVC1jb2FwcyByZXNvdXJjZXMgbm90IEVT VCByZXNvdXJjZXMgYW55bW9yZS4gU28gIkdFVCByZXF1ZXN0ICgvY3J0cywgL2F0dCkiIGV0Yy4N Cg0KKiAiRVNUIG1ha2VzIHVzZSBvZiBIVFRQIDIwNCByZXNwb25zZXMgd2hlbiBhIHJlc291cmNl IGlzIG5vdCBhdmFpbGFibGUgZm9yIHRoZSBjbGllbnQuIg0KLT4gRVNUIHN0YXRlcyBlaXRoZXIg MjA0IG9yIDQwNCBjYW4gYmUgdXNlZDsgd2hpY2ggaW4gQ29BUCB0cmFuc2xhdGVzIHRvIDQuMDQg Tm90IEZvdW5kICBpZiB0aGUgcmVzb3VyY2UgaXMgbm90IGF2YWlsYWJsZSB0byB0aGUgY2xpZW50 LCBpLmUuIGRvZXMgbm90IGV4aXN0LiBUaGF0IHNlZW1zIHRoZSBlYXNpZXN0IHRyYW5zbGF0aW9u IGhlcmUuIFRob3VnaCB0aGUgc2VydmVyIGNvdWxkIGFsc28gc2VuZCAyLjA1IHdpdGggYW4gZW1w dHkgemVyby1sZW5ndGggcGF5bG9hZCwgdG8gZXhwcmVzcyB0aGF0IGl0IGhhcyB0aGF0IGZ1bmN0 aW9uIGF2YWlsYWJsZSBidXQgdGhlcmUgaXMgIm5vdGhpbmciIHRoZXJlIGZvciB0aGUgY2xpZW50 Lg0KDQoqIDIuMDQgU0hPVUxEIG9ubHkgYmUgdXNlZCBpbiByZXNwb25zZSB0byBhbiBFU1QtY29h cHMNCiAgIFBPU1Qgd2hlbiB0aGUgcmVzcG9uc2UgY29tZXMgZGVsYXllZCBpbiBhIHNlcGFyYXRl IChub3QgUGlnZ3liYWNrZWQpDQogICBtZXNzYWdlIGFmdGVyIGFuIGVtcHR5IDAuMDAgbWVzc2Fn ZSAoU2VjdGlvbiA1LjcpDQotPiB0aGlzIHNlZW1zIHN0cmFuZ2UsIHRoZSByZXNwb25zZSBjb2Rl IHJlbWFpbnMgdGhlIHNhbWUgd2hldGhlciBzZXBhcmF0ZSByZXNwb25zZSBvciBwaWdneWJhY2tl ZCByZXNwb25zZSBpcyB1c2VkLiBBdCB0aGlzIGxldmVsIG9mIHJlcXVlc3QvcmVzcG9uc2UsIHRo ZXJlJ3Mgbm8gbmVlZCB0byB0cnkgdG8gZGV0YWlsIHRoaXMuIEkgZmVlbCBpdCBvbmx5IG1ha2Vz IGl0IG1vcmUgY29tcGxleDsgdGhlIGJhc2UgQ29BUCBwcm90b2NvbCBzaG91bGQgaGFuZGxlIHBp Z2d5YmFja2VkIHZzIHNlcGFyYXRlIGZvciBib3RoIGNsaWVudCBhbmQgc2VydmVyLiAoV2l0aG91 dCBpbXBhY3Qgb24gcmVzcG9uc2UgY29kZXMpLg0KDQoqIFRhYmxlIDM6IHRoZSAiNC54eCIgY2Fu IGJlICI0Lnh4IC8gNS54eCIgYmVjYXVzZSB0aGUgNS54eCBmYWlsdXJlcyBjYW4gYWxzbyBvY2N1 ciBpbiBhbnkgQ29BUCBzZXJ2ZXIgaW4gcHJpbmNpcGxlLiAgSSBkb24ndCByZWFsbHkgc2VlIHdo eSA0LjAyIHNob3VsZCBiZSBtZW50aW9uZWQgc2VwYXJhdGVseT8gSXQgYWdhaW4gaXMgZGVmaW5l ZCBpbiB0aGUgYmFzZSBDb0FQIHNwZWMgYW5kIG5vdCByZWFsbHkgb2YgaW50ZXJlc3QgZm9yIEVT VC1jb2Fwcywgbm9yIHVzZWQgYnkgYW55IGRlZmluaXRpb25zIG9yIGV4YW1wbGVzIGluIHRoZSBj dXJyZW50IHNwZWNpZmljYXRpb24uDQoNCg0KU2Vjb25kLCBiZWxvdyBhIGZldyBtb3JlIHJldmll dyBjb21tZW50cyBvbiB0aGUgLTExIHZlcnNpb246DQoNCiogRW5kIG9mIFNlY3Rpb24gNjogIklm IG5lY2Vzc2FyeSwgdGhlIEVTVC1jb2Fwcy10by1IVFRQIFJlZ2lzdHJhciB3aWxsIHN1cHBvcnQg cmVzb3VjZSBkaXNjb3ZlcnkgYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBpbiBTZWN0aW9uIDUuMS4i DQotPiB3aGF0IGFib3V0IChhbHNvIGFkZGVkIGxldHRlciB0byAncmVzb3VjZScpDQoiVGhlIEVT VC1jb2Fwcy10by1IVFRQIFJlZ2lzdHJhciBNVVNUIHN1cHBvcnQgcmVzb3VyY2UgZGlzY292ZXJ5 IGFjY29yZGluZyB0byB0aGUgcnVsZXMgaW4gU2VjdGlvbiA1LjEuIg0KQmVjYXVzZSB0aGlzIFJl Z2lzdHJhciBvcGVyYXRlcyB0byB0aGUgQ29BUCBjbGllbnQgZmFjaW5nIHNpZGUgZXhhY3RseSBs aWtlIGEgQ29BUCBFU1Qgc2VydmVyLiBTbyBpdCBtdXN0IHN1cHBvcnQgdGhlIHNhbWUgcnVsZXMg Zm9yIGRpc2NvdmVyeSwgb3IgZWxzZSBpdCB3b24ndCB3b3JrIChlLmcuIGJlIG5vdCBkaXNjb3Zl cmFibGUpLg0KDQoqIFNlY3Rpb24gOS4xOiAiVGhlc2UgaGF2ZSBiZWVuIHJlZ2lzdGVyZWQgcHJv dmlzaW9uYWxseSBpbiB0aGUgRXhwZXJ0IFJldmlldyByYW5nZSAoMC0yNTUpIg0KLT4gIlRoZXNl IGhhdmUgYmVlbiByZWdpc3RlcmVkIHByb3Zpc2lvbmFsbHkgaW4gdGhlIElFVEYgUmV2aWV3IG9y IElFU0cgQXBwcm92YWwgcmFuZ2UgKDI1Ni05OTk5KSINCg0KKiBTZWN0aW9uIDEwLjE6IA0KICAg QSBjbGllbnQgdGhhdCBwaXBlbGluZXMgRVNULWNvYXBzIC9jcnRzIHJlcXVlc3QNCiAgIHdpdGgg b3RoZXIgcmVxdWVzdHMgaW4gdGhlIHNhbWUgRFRMUyBjb25uZWN0aW9uIFNIT1VMRCByZXZhbGlk YXRlIHRoZQ0KICAgc2VydmVyIGNlcnRpZmljYXRlIGNoYWluIGFnYWluc3QgdGhlIHVwZGF0ZWQg RXhwbGljaXQgVEEgZnJvbSB0aGUNCiAgIC9jcnRzIHJlc3BvbnNlIGJlZm9yZSBwcm9jZWVkaW5n IHdpdGggdGhlIHN1YnNlcXVlbnQgcmVxdWVzdHMuICANCiAgIElmIHRoZSBzZXJ2ZXIgY2VydGlm aWNhdGUgY2hhaW4gZG9lcyBub3QgYXV0aGVudGljYXRlIGFnYWluc3QgdGhlDQogICBkYXRhYmFz ZSwgdGhlIGNsaWVudCBTSE9VTEQgY2xvc2UgdGhlIGNvbm5lY3Rpb24gd2l0aG91dCBjb21wbGV0 aW5nDQogICB0aGUgcmVzdCBvZiB0aGUgcmVxdWVzdHMuICBUaGUgdXBkYXRlZCBFeHBsaWNpdCBU QSBNVVNUIGNvbnRpbnVlIHRvDQogICBiZSB1c2VkIGluIG5ldyBEVExTIGNvbm5lY3Rpb25zLg0K LT4gZG9lcyB0aGUgbGFzdCByZXF1aXJlbWVudCBtZWFuIG5ldyBEVExTIGNvbm5lY3Rpb25zIHRv IHRoZSBzYW1lIEVTVCBzZXJ2ZXI/IE9yLCBuZXcgRFRMUyBjb25uZWN0aW9ucyB0byBhbnkgRVNU IHNlcnZlcihzKSBpbiB0aGUgZnV0dXJlPyANCi0+IGl0IGlzIGFsc28gdW5jbGVhciBoZXJlIHdo ZXRoZXIgdGhlIHVwZGF0ZWQgRXhwbGljaXQgVEEgbmVlZHMgdG8gcmVwbGFjZSBhbiBleGlzdGlu ZyBjb25maWd1cmVkIEV4cGxpY2l0IFRBIChlLmcuIG9idGFpbmVkIGZyb20gYW4gQU5JTUEgdm91 Y2hlciBvciBhIHByZXZpb3VzIC9jcnRzIHJlcXVlc3QuICkuICBJIHdvdWxkIHRoaW5rIG5vdCwg ZXNwZWNpYWxseSBnaXZlbiB0aGF0IHRoZSB2ZXJpZmljYXRpb24gb2YgaXQgZmFpbGVkIGluIGFi b3ZlIHRleHQ/DQotPiBJIHdvbmRlciB3aHkgdGhlIGNsaWVudCB3b3VsZCB0cnVzdCBhIG5ldyBF eHBsaWNpdCBUQSwgaWYgdGhlIEVTVCBzZXJ2ZXIgaXRzZWxmIGNhbm5vdCBiZSBhdXRoZW50aWNh dGVkIHVzaW5nIHRoYXQgVEEuIEl0IHdpbGwgZGlzY29ubmVjdCBhbmQgdGhlbiB1cG9uIG5leHQg RFRMUyBjb25uZWN0aW9uIHRvIHRoZSBzYW1lIHNlcnZlciB0aGUgaGFuZHNoYWtlIHdpbGwgZmFp bCBhZ2FpbnN0IHRoZSBuZXcgVEEuIEFuZCB0aGUgY2xpZW50IGNhbid0IHBlcmZvcm0gRVNUIGFu eW1vcmUgdW50aWwgZmFjdG9yeSByZXNldC4gT3IgaXMgdGhlIGV4cGVjdGF0aW9uIHRoYXQgaXQg c29tZWhvdyB3aWxsIHVzZSBhbm90aGVyIEVTVCBzZXJ2ZXIgZm9yIGEgc2Vjb25kIHRyeT8NCg0K KiBTZWN0aW9uIDEwLjE6ICJkZXBlbmQgaW4iIC0+ICJkZXBlbmQgb24iDQoNCiogU2VjdGlvbiAx MC4xOiAiZXNwZWNpYWxseSBzaW5jZSB0aGUgcHJhY3RpY2FsaXR5IG9mIHN1Y2ggYW4gYXR0YWNr IHdvdWxkIG5vdCBleHBvc2UgYW55IG1lc3NhZ2VzIGV4Y2hhbmdlZCB3aXRoIEVTVC1jb2Fwcy4i DQotPiByYXRoZXIgY29tcGxleCBzZW50ZW5jZSwgd2hhdCBhYm91dA0KIiJlc3BlY2lhbGx5IHNp bmNlIGEgM1NIQUtFIGF0dGFjayBkb2VzIG5vdCBleHBvc2UgbWVzc2FnZXMgZXhjaGFuZ2VkIHdp dGggRVNULWNvYXBzLiINCg0KKiBTZWN0aW9uIDEwLjE6ICJSZWdhcmRpbmcgdGhlIENlcnRpZmlj YXRlIFNpZ25pbmcgUmVxdWVzdCAoQ1NSKSwgYSBDQSBpcyBleHBlY3RlZCB0byBiZSBhYmxlIHRv IGVuZm9yY2UgcG9saWNpZXMgdG8gcmVjb3ZlciBmcm9tIGltcHJvcGVyIENTUiByZXF1ZXN0cy4i DQotPiBzaG91bGQgYmUgImFuIEVTVC1jb2FwcyBzZXJ2ZXIgaXMgZXhwZWN0ZWQgdG8iID8gICBC ZWNhdXNlIHRoaXMgc3BlY2lmaWNhdGlvbiBhbmQgMTAuMSBkZXNjcmliZXMgdGhlIEVTVC1jb2Fw cyBzZXJ2ZXIsIG5vdCBhIENBLg0KDQoqIFNlY3Rpb25zIDUuMSwgNS43LCAxMC4yIDogd29yZCAi aGUiIGlzIHVzZWQgdG8gcmVmZXIgdG8gY2xpZW50IG9yIHNlcnZlci4gTWF5YmUgdGhpcyBzaG91 bGQgYmVjb21lICJpdCIgKG5vdCBhIHBlcnNvbikuDQoNCg0KDQotLS0tLU9yaWdpbmFsIE1lc3Nh Z2UtLS0tLQ0KRnJvbTogUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpIDxwa2FtcGFuYUBjaXNj by5jb20+IA0KU2VudDogU2F0dXJkYXksIE1heSAyNSwgMjAxOSAwNjo0OA0KVG86IEVza28gRGlq ayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPjsgYWNlQGlldGYub3JnDQpTdWJqZWN0OiBS RTogW0FjZV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEudHh0DQoNCkhp IEVza28sDQoNClRoYW5rIHlvdSBhZ2Fpbi4gQWdhaW4gYSB2ZXJ5IGVsYWJvcmF0ZSByZXZpZXcg YW5kIGZvdW5kIHNvbWUgZ29vZCBuaXRzIGluIHRoZSBEZWxheWVkIHJlc3BvbnNlcyBzZWN0aW9u LiBUbyBtYWtlIGl0IGVhc2llciBJIGxvZ2dlZCB0aGUgaXNzdWVzIGFuZCBmaXhlcyBoZXJlIGh0 dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUvRVNULWNvYXBzL2lzc3Vlcy8xNDUgDQoNClRo ZSB1cGRhdGVkIGRvYyBpcyBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUvRVNU LWNvYXBzL2Jsb2IvbWFzdGVyL2RyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LnR4dCBhbmQgdGhlIGRp ZmZzIGFyZSBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUvRVNULWNvYXBzL2Nv bW1pdC80YWQ1MjEwZmFmNjI0YzY3ZTE5OThkYTc1ZWEwNTFkZTYxNmU5MWIxI2RpZmYtM2E3MTJl ZGI0M2Y2ZWFjZTdmYjE2NjczMjhkNjUzMDcgIA0KDQpSZ3MNClBhbm9zDQoNCi0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBFc2tvIERpamsgPGVza28uZGlqa0Bpb3Rjb25zdWx0YW5j eS5ubD4gDQpTZW50OiBUdWVzZGF5LCBNYXkgMjEsIDIwMTkgNjozMSBQTQ0KVG86IFBhbm9zIEth bXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPjsgYWNlQGlldGYub3JnDQpD YzogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3RAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBbQWNlXSBJ LUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0KSGVsbG8gUGFub3Ms DQoNCkZvciB0aGUgZHJhZnQgdGV4dCBJIGhhdmUgYSBjb3VwbGUgb2YgbW9yZSByZXZpZXcgcmVt YXJrczoNCg0KKiBwYWdlIDggZmlyc3QgYnVsbGV0OiBhIHByZXZpb3VzbHkgaXNzdWVzIGNsaWVu dCBjZXJ0aWZpY2F0ZSBjb3VsZCBhbHNvIGV4cGlyZSwgaW4gc29tZSBjYXNlcyBldmVuIHdpdGhv dXQgdGhlIGNsaWVudCBrbm93aW5nLiBJZiB0aGUgY2xpZW50IHRoZW4gcGVyZm9ybXMgc2ltcGxl IHJlLWVucm9sbG1lbnQgLS0gdXNpbmcgaXRzIHByZXZpb3VzIG9wZXJhdGlvbmFsIGNlcnQgYXMg YXV0aGVudGljYXRpb24sIHdoYXQgd291bGQgaGFwcGVuPyAgSSB3b3VsZCBleHBlY3QgdGhlIHNl cnZlciBNQVkgYWxzbyB3YW50IHRvIHVzZSB0aGlzIGNlcnRpZmljYXRlIHRvIGF1dGhlbnRpY2F0 ZSB0aGUgY2xpZW50LiBCZWNhdXNlIHRoZSBwdXJwb3NlIG9mIHRoZSBjbGllbnQgY29ubmVjdGlu ZyBhZ2FpbiB0byB0aGUgRVNUIHNlcnZlciBpcyB0byBkbyBzaW1wbGUgcmUtZW5yb2xsbWVudCwg dG8gZ2V0IGEgbmV3IGNlcnRpZmljYXRlLiAgIFN1cHBvc2UgYSBjYXNlIHdoZXJlIHRoZSBoYW5k c2hha2UgdG8gdGhlIEVTVCBzZXJ2ZXIgZmFpbHMgYmVjYXVzZSB0aGUgRVNUIHNlcnZlciByZWpl Y3RzIHRoZSBleHBpcmVkIG9wZXJhdGlvbmFsIGNlcnQ6ICB3aGF0IHdvdWxkIHRoZSBjbGllbnQg ZG8gbm93PyBJdCBjb3VsZCBiZSBhIGNlcnRpZmljYXRlX2V4cGlyZWQgbWVzc2FnZS4gIFJGQyA3 MDMwIHByb3ZpZGVzIG5vIGd1aWRhbmNlIGluIHRoaXMgbWF0dGVyOyB3b3VsZCBFU1QtY29hcHMg bmVlZCB0byBkZWZpbmUgdGhpcz8gRS5nLiBjbGllbnQgU0hPVUxEIHJldHJ5IHVzaW5nIHRoZSBi dWxsZXQgIzIgY2VydGlmaWNhdGUgKGUuZy4gSURldklEKT8NCg0KKiBwYWdlIDggbWlkZGxlOiAi Q29BUCBhbmQgRFRMUyBjYW4gcHJvdmlkZSBwcm9vZi1vZi1pZGVudGl0eSBmb3IgRVNULWNvYXBz IGNsaWVudHMgYW5kIHNlcnZlcnMgd2l0aCBzaW1wbGUgUEtJIG1lc3NhZ2VzIGFzIGRlc2NyaWJl ZCBpbiBTZWN0aW9uIDMuMSBvZiBbUkZDNTI3Ml0gIg0KTG9va2luZyB1cCB0aGlzIHNlY3Rpb24g aXQgc2F5czogIlRoZSBTaW1wbGUgUEtJIFJlcXVlc3QgTVVTVCBOT1QgYmUgdXNlZCBpZiBhIHBy b29mLW9mLWlkZW50aXR5IG5lZWRzIHRvIGJlIGluY2x1ZGVkLiIgICBUaGlzIHNlZW1zIHRvIHNh eSB0aGUgb3Bwb3NpdGUgb2YgdGhlIGFib3ZlIHRleHQ/ICBUaGlzIHJlcXVpcmVzIGF0IGxlYXN0 IHNvbWUgbW9yZSBleHBsYW5hdGlvbi4NCg0KKiBwYWdlIDggbWlkZGxlOiAiTW9yZW92ZXIsIGNo YW5uZWwtYmluZGluZyBpbmZvcm1hdGlvbiBmb3IgbGlua2luZyBwcm9vZi1vZi1pZGVudGl0eSB3 aXRoIGNvbm5lY3Rpb24tYmFzZWQgcHJvb2Ytb2YtcG9zc2Vzc2lvbiBpcyBPUFRJT05BTCBmb3Ig RVNULWNvYXBzIiAgLT4gaXMgaXQgT1BUSU9OQUwgZm9yIGNsaWVudCwgc2VydmVyLCBvciBib3Ro PyBJIHdvdWxkIGFzc3VtZSBpdCBpcyBPUFRJT05BTCBmb3IgYm90aC4gSWYgdGhlIChsaWdodC13 ZWlnaHQpIGNsaWVudCBkb2VzIG5vdCBpbXBsZW1lbnQgaXQgYW5kIGlmIHRoZSBzZXJ2ZXIgZG9l cyBtYW5kYXRlIGl0LCB0aGUgY2xpZW50IGNhbiBub3QgY29ubmVjdCB0byB0aGF0IHNlcnZlciBp ZiBpdHMgcG9saWN5IGlzIHNldCB0byAibGlua2luZyBQT1AvaWRlbnRpdHkgcmVxdWlyZWQiLg0K DQoqIHBhZ2UgMTQgdG9wIGJ1bGxldDogIlRoZSBDb0FQIE9wdGlvbnMgdXNlZCBhcmUgLi4uLiAi IA0KICAtPiB0aGUgaXRlbSBCbG9jayBjb3VsZCBiZSBleHBhbmRlZCB0byAiQmxvY2sxLCBCbG9j azIiIHRvIGNhcHR1cmUgdGhlIGFjdHVhbCBPcHRpb24gbmFtZXMuDQogIC0+IExvY2F0aW9uLVBh dGggaXMgbmV2ZXIgdXNlZCBpbiBhbnkgb2YgdGhlIENvQVAgaW50ZXJhY3Rpb25zIGRlZmluZWQ7 IHNob3VsZCBiZSByZW1vdmVkLg0KDQoqIFBhZ2UgMTQgZmlyc3QgNS41IHBhcmFncmFwaDogIlNp bWlsYXJseSwgMi4wMSwgMi4wMiBvciAyLjA0IE1VU1QgYmUgdXNlZCBpbiByZXNwb25zZSB0byBF U1QgUE9TVCByZXF1ZXN0cyINCiAgLT4gMi4wMSBDcmVhdGVkIGlzIGxpa2UgSFRUUCAyMDEsIHdo aWNoIGlzIG5vdCB1c2VkIGluIEVTVCAtIHNvIGNhbiBiZSByZW1vdmVkIGhlcmUuDQogIC0+IDIu MDIgRGVsZXRlZCBoYXMgbm8gSFRUUCBlcXVpdmFsZW50LCBzbyBpcyBub3QgdXNlZCBpbiBFU1Qu IEl0IHNob3VsZCBiZSByZW1vdmVkIGhlcmUuDQogIC0+IHRoYXQgbGVhdmVzIG9ubHkgMi4wNCBy ZXNwb25zZXMuIEhvd2V2ZXIgdGhlIHRleHQgc2hvdWxkIHNheSB0aGlzIGlzIGZvciBzdWNjZXNz ZnVsIChIVFRQIDIwMCBvciAyMDIgaW4gRVNUKSByZXNwb25zZXMgLCBzbyBzdWdnZXN0aW9uIGlz IHRvIGNoYW5nZSBhYm92ZSBzZW50ZW5jZSB0bzogIlNpbWlsYXJseSwgMi4wNCBNVVNUIGJlIHVz ZWQgaW4gYSByZXNwb25zZSB0byBhIHN1Y2Nlc3NmdWwgRVNUIFBPU1QgcmVxdWVzdCINCg0KKiBw YWdlIDE0IGJvdHRvbTogIkVTVCBtYWtlcyB1c2Ugb2YgSFRUUCAyMDQgYW5kIDQwNCByZXNwb25z ZXMgd2hlbiBhIHJlc291cmNlIGlzIG5vdCAgYXZhaWxhYmxlIGZvciB0aGUgY2xpZW50LiAgVGhl IGVxdWl2YWxlbnQgQ29BUCBjb2RlcyB0byB1c2UgaW4gYW4gRVNULWNvYXBzIHJlc3BvbnNlcyBh cmUgMi4wNCBhbmQgNC4wNC4gICINCiAgLT4gQ29BUCAyLjA0IGNhbiBvbmx5IGJlIHVzZWQgaW4g cmVzcG9uc2VzIHRvIFBPU1Qgb3IgUFVUIHJlcXVlc3RzLCBub3QgZm9yIEdFVCByZXNwb25zZXMu DQogIC0+IHNvIGluIENvQVAgdGhlIHNlcnZlciBjb3VsZCBlaXRoZXIgcmV0dXJuIDIuMDUgd2l0 aCBlbXB0eSBwYXlsb2FkIChlcXVpdmFsZW50IHRvIEhUVFAgMjA0KSwgb3IgcmV0dXJuIDQuMDQg KGVxdWl2YWxlbnQgdG8gSFRUUCA0MDQpDQoNCiogcGFnZSAxNSBib3R0b206ICJUaGUgRVNULWNv YXBzIGNsaWVudCBhbmQgc2VydmVyIE1VU1Qgc3VwcG9ydCBCbG9jazIuICBCbG9jazEgTVVTVCBi ZSBzdXBwb3J0ZWQgZm9yIEVTVC1jb2FwcyBlbnJvbGxtZW50IHJlcXVlc3RzIHRoYXQgZXhjZWVk IHRoZSBQYXRoIE1UVS4iDQogIC0+IGNvdWxkIGJlIGNsYXJpZmllZCBiZXR0ZXIsIEkgZXhwZWN0 IGEgRVNULWNvYXBzIHNlcnZlciBNVVNUIHN1cHBvcnQgQmxvY2sxIGJlY2F1c2UgdGhhdCBzZXJ2 ZXIgZG9lc24ndCBrbm93IGluIGFkdmFuY2UgaG93IGJpZyB0aGUgY2xpZW50J3MgcmVxdWVzdCBw YXlsb2FkIGlzIGdvaW5nIHRvIGJlIGFuZCB3aGV0aGVyIHRoYXQgY2xpZW50IHdpbGwgdXNlIEJs b2NrMS4NCiAgLT4gZS5nLiAiVGhlIEVTVC1jb2FwcyBjbGllbnQgYW5kIHNlcnZlciBNVVNUIHN1 cHBvcnQgQmxvY2syLiAgVGhlIEVTVC1jb2FwcyBzZXJ2ZXIgTVVTVCBzdXBwb3J0IEJsb2NrMS4g VGhlIEVTVC1jb2FwcyBjbGllbnQgTVVTVCBzdXBwb3J0IEJsb2NrMSBpZiBpdCBzZW5kcyBFU1Qt Y29hcHMgcmVxdWVzdHMgd2l0aCBhbiBJUCBwYWNrZXQgc2l6ZSB0aGF0IGV4Y2VlZHMgdGhlIFBh dGggTVRVLiINCg0KKiBwYWdlIDE2IGV4YW1wbGU6IHRoZSBwYXlsb2FkcyBhcmUgbm90IGluZGlj YXRpbmcgdGhhdCBlYWNoICJ7Q1NSIHJlcX0iIHBheWxvYWQgaXMgZGlmZmVyZW50LiBJLmUuLCBh IGRpZmZlcmVudCBibG9jay4gSXQgd291bGQgYmUgbW9yZSBjbGVhciBpZiB0aGF0IGlzIHNob3du IGUuZy4gIntDU1IgMX0iLCAie0NTUiAyfSIsIC4uLiB1cCB0byAie0NTUiBOMSsxfSIuIFRoZSAi cmVxIiBzdHJpbmcgaXMgbm90IG5lZWRlZCBzaW5jZSB0aGUgUiBpbiBDU1IgYWxyZWFkeSBzdGFu ZHMgZm9yIHJlcXVlc3QuDQoNCiogcGFnZSAxNyBleGFtcGxlOiBzZWUgYWJvdmUgcGF5bG9hZHMg cmVtYXJrOyBhbmQgdGhlIGZvbGxvd2luZzoNCiAgLS0+IHdoYXQgSSBmaW5kIHN0cmFuZ2UgaGVy ZSBpcyB0aGF0IGEgYmxvY2t3aXNlIFBPU1QgcmVxdWVzdCBlbmRzIHdpdGggYSA1LjAzIHJlc3Bv bnNlLCBhbmQgdGhlbiB0aGUgc2FtZSByZXF1ZXN0IGFmdGVyIHRoYXQgZ2l2ZXMgYSAyLjAxIHJl c3BvbnNlLiBJbiBDb0FQIEFGQUlLLCBvbmUgcmVxdWVzdCBjYW4gbmV2ZXIgZ2l2ZSAyIHJlc3Bv bnNlcyBpbiBzZXF1ZW5jZS4NCiAgLS0+IG9uY2UgYSByZXNwb25zZSBpcyBkZWxpdmVyZWQgYmFj ayB0byB0aGUgY2xpZW50IHBpZ2d5YmFja2VkIG9uIGFuIEFDSywgdGhlIHNlcnZlciBjbG9zZXMg dGhlIHRyYW5zYWN0aW9uIG5vcm1hbGx5IGFuZCBubyBmdXJ0aGVyIHN0YXRlIGZvciB0aGUgdHJh bnNhY3Rpb24gaXMga2VwdC4NCiAgLS0+IG5vcm1hbGx5IGlmIGEgc2VydmVyIHNlbmRzIDUuMDMg d2l0aCBNYXgtQWdlIHRoZSBjbGllbnQgbmVlZHMgdG8gc2VuZCBhIG5ldyByZXF1ZXN0IGkuZS4g cmV0cnkgd2l0aCBhIG5ldyByZXF1ZXN0IGFmdGVyIHRoaXMgd2FpdGluZyB0aW1lLiAgIFRoYXQg aW1wbGllcyB0aGUgY2xpZW50IHdvdWxkIG5lZWQgdG8gcmVzZW5kIHRoZSBlbnRpcmUgcmVxdWVz dDogYWxsIGJsb2NrcyBvZiBpdCENCiAgLS0+IEkgZG8gcmVhbGl6ZSB0aGF0IHJlc2VuZGluZyBh bGwgYmxvY2tzIGlzIHZlcnkgaW5lZmZpY2llbnQgOyBidXQgYXQgdGhlIHNhbWUgdGltZSB0aGUg ZXhhbXBsZSBhbHNvIHNlZW1zIGluY29tcGF0aWJsZSB3aXRoIENvQVAgc3BlY3MuDQogIC0tPiBh bm90aGVyIHF1ZXN0aW9uIGlzIHdoeSBkb2VzIHRoZSBzZXJ2ZXIgdXNlIEJsb2NrMiBvcHRpb24g aW4gdGhlIDUuMDMgcmVzcG9uc2UgdGhhdCBoYXMgbm8gcGF5bG9hZC4gSW4gUkZDIDc5NTkgU2Vj dGlvbiAyLjEsICJ0aGUgQmxvY2syIE9wdGlvbiBwZXJ0YWlucyB0byB0aGUgcmVzcG9uc2UgcGF5 bG9hZCIgYW5kICJwYXlsb2FkLWJlYXJpbmcgcmVzcG9uc2VzIi4gU28gaXQgc2hvdWxkIGJlIGp1 c3QgbGVmdCBvdXQgaW4gdGhlIHJlc3BvbnNlIHdpdGhvdXQgcGF5bG9hZCBJIHRoaW5rLg0KICAt LT4gSSB1bmRlcnN0YW5kIHRoaXMgc2VxdWVuY2Ugb2YgbWVzc2FnZXMgd2FzIHRlc3RlZCB1c2lu ZyBpbnRlcm9wcy9jb2RlOyB3YXMgYSBzcGVjaWZpYyBDb0FQIGxpYnJhcnkgdXNlZCB0aGF0IGV4 aGliaXRzIHRoaXMgYmVoYXZpb3I/IEkgd291bGQgYmUgaW50ZXJlc3RlZCB0byB1bmRlcnN0YW5k IGJldHRlciB3aHkgdGhpcyB3b3Jrcy4NCg0KSG9wZSB0aGVzZSBjb21tZW50cyBjYW4gc3RpbGwg YmUgdXNlZCBmb3IgaW1wcm92ZW1lbnQgb2YgdGhlIHNwZWMuIEkgd2lsbCBzZW5kIGZ1cnRoZXIg cmV2aWV3IGNvbW1lbnRzIGluIGEgbmV4dCBlbWFpbDogc3RpbGwgbmVlZCB0byB3cml0ZSB0aGVz ZSBkb3duLg0KDQpCZXN0IHJlZ2FyZHMNCkVza28NCg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBrYW1wYW5hQGNpc2Nv LmNvbT4gDQpTZW50OiBNb25kYXksIE1heSAyMCwgMjAxOSAxNzozMQ0KVG86IEVza28gRGlqayA8 ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPjsgYWNlQGlldGYub3JnDQpTdWJqZWN0OiBSRTog W0FjZV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEudHh0DQoNClRoYW5r cyBFc2tvLiANCg0KQWRkcmVzc2VkIGluIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUv RVNULWNvYXBzL2Jsb2IvODRjZTBjMWQ1ZTc2OGQ0MGU5NzE4NDIxNGJhZTQwNGRhMjFiZDA1MC9k cmFmdC1pZXRmLWFjZS1jb2FwLWVzdC54bWwgVHdvIGNvbW1lbnRzOiANCg0KPiBwYWdlIDExIGJv dHRvbSByZXF1aXJlbWVudDogIiBUaGUgY2xpZW50IFNIT1VMRCB1c2UgcmVzb3VyY2UgZGlzY292 ZXJ5IHdoZW4gaGUgaXMgdW5hd2FyZSBvZiB0aGUgYXZhaWxhYmxlICBFU1QtY29hcHMgcmVzb3Vy Y2VzLiIgLSB3aGVuIGFuIEVTVCBzZXJ2ZXIgaXMga25vd24sIHRoaXMgcmVxdWlyZW1lbnQgZG9l cyBub3QgcmVhbGx5IGFwcGx5IHNpbmNlIHRoZSBzZXJ2ZXIgYWx3YXlzIHN1cHBvcnRzIC53ZWxs LWtub3duIEVTVCByZXNvdXJjZXMuICBTbyBJIHJlYWQgaXQgYXMgZG9pbmcgYW4gUkQgZGlzY292 ZXJ5IG9yIG11bHRpY2FzdCBDb0FQIGRpc2NvdmVyeSBpZiB0aGUgY2xpZW50IGRvZXNuJ3Qga25v d24gdGhlIEVTVCBzZXJ2ZXIgYWRkcmVzcy4gIEhvcGUgdGhpcyBpcyBjbGVhciBlbm91Z2ggaW4g dGhlIHRleHQgYW5kIGludGVuZGVkPw0KDQpUaGVyZSBhcmUgb3B0aW9uYWwgcmVzb3VyY2VzIGxp a2UgL2F0dCwgL3NrZyBhbmQgL3NrYyB0aGF0IHRoZSBzZXJ2ZXIgZG9lcyBub3QgaGF2ZSB0byBz dXBwb3J0LCBzbyB0aGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVmZXJyaW5nIHRvLiAN Cg0KPiBwYWdlIDExIGJvdHRvbTogIiBJdCBpcyB1cCB0byB0aGUgaW1wbGVtZW50YXRpb24gdG8g Y2hvb3NlIGl0cyByZXNvdXJjZSBwYXRoc+KAnSAtPiBzZWVtcyBub3QgcmVhbGx5IHRoZSBjYXNl LCBiZWNhdXNlIHRoZSByb290IHJlc291cmNlIHN0cnVjdHVyZSBpcyBmb3JjZWQgYnkgdGhlIHNw ZWNpZmljYXRpb24uIEl0IGNvdWxkIGhhdmUgYmVlbiBkZXNpZ25lZCBhcyBmcmVlIGNob2ljZSAo YmVjYXVzZSBpdCBjYW4gYmUgZGlzY292ZXJlZCBhbnl3YXkpIGJ1dCBpdCBpcyBub3QuDQoNClRo ZSB0ZXh0IHNheXMgdGhhdCB0aGUgc2VydmVyIE1VU1Qgc3VwcG9ydCB0aGUgZGVmYXVsdCAvLndl bGwta25vd24vZXN0IHJvb3QgcmVzb3VyY2UgYW5kIGl0IFNIT1VMRCBzdXBwb3J0IHJlc291cmNl IGRpc2NvdmVyeSBmb3Igbm9uLWRlZmF1bHQgVVJJcyAobGlrZSAvZXN0IG9yIC9lc3QvQXJiaXRy YXJ5TGFiZWwpIG9yIHBvcnRzLiBJbiB0aGUgbGF0dGVyIGNhc2UgaXQgaXMgdXAgdG8gdGhlIHNl cnZlciB0byBkZWNpZGUgdGhlIHBhdGhzIGhlIG1ha2VzIGl0cyByZXNvdXJjZXMgYXZhaWxhYmxl IGF0LiBUaGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVmZXJyaW5nIHRvLiBCdXQgeW91 IGFyZSByaWdodDsgSSByZWFsaXplZCB0aGF0IHRoaXMgc2VudGVuY2UgaXMgcmVkdW5kYW50IHNv IEkgb25seSBrZXB0ICJUaHJvdWdob3V0IHRoaXMgZG9jdW1lbnQgdGhlIGV4YW1wbGUgcm9vdCBy ZXNvdXJjZSBvZiAvZXN0IGlzIHVzZWQuIg0KDQpXaWxsIHJldXBsb2FkIHRoZSBuZXh0IGl0ZXJh dGlvbiBpbiBhIGZldyBkYXlzLiANCg0KUmdzLA0KUGFub3MNCg0KDQpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGll dGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZQ0K From nobody Tue May 28 15:44:49 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B37371200A4; Tue, 28 May 2019 15:44:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ZE1pNG7BNck; Tue, 28 May 2019 15:44:46 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3A71120090; Tue, 28 May 2019 15:44:42 -0700 (PDT) Received: from Jude (192.168.1.155) by mail2.augustcellars.com (192.168.1.201) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 28 May 2019 15:44:36 -0700 From: Jim Schaad To: CC: Date: Tue, 28 May 2019 15:44:33 -0700 Message-ID: <017f01d515a6$ed172890$c74579b0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdUUNPLwUpqoK9aaSuCnTZIzn4sN5w== X-Originating-IP: [192.168.1.155] Archived-At: Subject: [Ace] Comments about draft-dijk-core-groupcomm-bis-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 22:44:48 -0000 Comments on this draft. 1. I have an existential problem with this document. This is a standards track document that is claiming to do an update to an experimental draft. However, this is something that I would not expect to be done and it is not clear just what the updates to that document are and how one would make edits to that document in order to apply the updates. My general expectation for an experimental document is that it would be 1) declared a failure and killed, 2) declare a partial success and updated for a new experiment (and thus a new experimental document) or 3) declare a resounding success then replaced with either a standards or information document. 2. You are claiming to update RFC 7641, but it is not clear to me what is being updated and just what the implications of doing this update are. As an example of the types of thing that should be clarified are: * If a server does not return a response, should it setup to do a later observe operation? * More information on how correlation should be done with responses. As an example, if you do unary observe and the response is routed through a proxy, there are no problems as long as the responses are not later re-routed through a new proxy. However for multicast, if you have two different servers on the far side of a proxy how does one distinguish between the two of them if everything is coming through a single proxy? 3. The introduction does not acknowledge that the same thing can be done via pub-sub. It is ok to declare this out of scope but it needs to be done in up front in the introduction (and probably also in the abstract). 4. I am not sure that it makes sense to say one should be familiar with terms from Group OSCORE as one would expect this to be from the general to the specific for terminology not the other way around. 5. In section 2.1.1 - you should state that the centralized directory would be pre-configured in the device. 6. In section 2.1.1 - Do we have any set of properties that are commonly defined for doing this? Services in the form of resources are easy to understand but I don't know how to do this easily. 7. In section 2.3 - It would make sense to distinguish between the cases of announcing a software update is available and actually distributing the software update by multicast. 8. Section 3.1.1 - It should potentially be stated here, but definitely somewhere that for non-secure groups membership in the group is defined by an endpoint and not by a central endpoint. This is important in terms of somebody "attacking" a non-secure group. 9. Section 3.1.2 - It would make sense to point to group naming as part of a directory as well as being for DNS. 10. Section 3.1.3 - One of the things that I had a problem with when implementation group broadcast was trying to decide which of the different local groups should be used for an IPv6 multicast address. A number of these different groups are defined for CoAP and a discussion of the differences or a pointer to the differences would be useful. 11. Section 3.2.1 - Another issue to highlight with tokens is that in the unicast case, the response is expected to come in on the same connection it was sent on. Thus two different connections can re-use the same token without any problems. That is not true for multicast as the connection it comes it on will, by definition, not be the one it was sent on. 12. Section 3.2.1 - Might want to mention the use of Accept as one way to think about server response delay as you at least know that you are expecting a response from the server if you have received an accept. 13. Section 3.2.3 - Need to talk about multicast messages, proxies and caching of results. 14. Section 3.2.5 - Does RFC7641 define behavior about receiving a "duplicate" observer request? Would you reply a second time or not? 15. Section 6.1 - next to last paragraph - /values does not/values, but does not/ 16. Section 6.2 - Should have a consideration about the speed of re-keying vs the frequency of joins/leaves. Jim From nobody Tue May 28 16:06:38 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C541D1200B7; Tue, 28 May 2019 16:06:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NHwA69CgCWSL; Tue, 28 May 2019 16:06:34 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C73B1200A4; Tue, 28 May 2019 16:06:32 -0700 (PDT) Received: from Jude (192.168.1.155) by mail2.augustcellars.com (192.168.1.201) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 28 May 2019 16:06:05 -0700 From: Jim Schaad To: 'Francesca Palombini' , CC: References: <3775CA7A-0174-4261-BBFA-09EFEAA07B4F@ericsson.com> In-Reply-To: <3775CA7A-0174-4261-BBFA-09EFEAA07B4F@ericsson.com> Date: Tue, 28 May 2019 16:06:01 -0700 Message-ID: <018501d515a9$ed26d8a0$c77489e0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0186_01D5156F.40CCE2A0" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQHO6Ux8YdSoHFUgmucX9gLJKVkqCaaNe4JQ X-Originating-IP: [192.168.1.155] Archived-At: Subject: Re: [Ace] draft-ietf-ace-key-groupcomm-oscore X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 May 2019 23:06:37 -0000 ------=_NextPart_000_0186_01D5156F.40CCE2A0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Francesca Palombini =20 Sent: Tuesday, May 28, 2019 2:29 AM To: Jim Schaad ; ace@ietf.org Cc: draft-ietf-ace-key-groupcomm-oscore@ietf.org Subject: Re: draft-ietf-ace-key-groupcomm-oscore=20 =20 Hi Jim, Thanks again for your in depth review. We have identified 7 clear APs = from some of your review comments, and we hope that we answer the other = (inline). Please let us know if that is ok, and we will update the = document as soon as possible. =20 Thanks, Francesca and Marco =20 I was wandering through the document with a view to implementing and = have the following questions: =20 1. Abstract: From the first paragraph I am not sure if the group communications or the communications to the KDC are secured with OSCORE. =20 [*] Ok, we propose to change =E2=80=9Cwhere communications are = based=E2=80=9D to =E2=80=9Cwhere the group communication is = based=E2=80=9D. The communication to the KDC is up to the profile of ACE = used between the joining node and the KDC. (AP1) [JLS] Should be ok. =20 2. Section 3.1 - "requester" seems to be an odd name for "sender" or "publisher" =20 [*] This particular document does not consider the concept of publisher. = Requester was chosen to identify a client in a group communication = setting, i.e. stressing that it sends (group) requests and receives = (unicast) responses. Sender would not be correct, as both clients and = servers are senders at some point during the message exchange. [JLS] I will probably complain again at a later date. My problem is = that requester is not the opposite of listener. A different set might = be =E2=80=9Crequester=E2=80=9D, =E2=80=9Cresponder=E2=80=9D, = =E2=80=9Cmonitor=E2=80=9D 3. Section 3.1 - I am trying to figure out why a Gid would be a = reasonable value for the scope. This means that the AS is going to be the one to assign the Gid value in many cases as it needs to check the scope value there. Is that going to be a common case? I.e. Are Gids going to be assigned by administrators? =20 [*] The Gid of the Authorization Request would be a reasonable scope = because the join resource is associated to it (at the GM). The GM = receiving a Join Request must be able to retrieve the correct Gid = following the access to the join resource. No, the AS does not assign = the Gid value (if that is used as scope in the Authorization Request). = The AS only needs to check that the client is authorized to get an = access token for that scope, regardless that it is a join resource. The = Gid is assigned by the resource owner of the join resource at the GM, = that is an administrator. [JLS] Ok =E2=80=93 so the answer to my question is yes. I wanted to be = sure it was not a registration process on the KDC (I think). 4. Section 3.1 - Is the form in Appendix C of the Gid in some respect mandatory? If it is not, then how does a receiver of a message = distinguish between two different groups that are using the same multicast address? = Is that going to be a non-supported case? The most common case of this = would be having two different groups on the default CoAP multicast address = talking to RDs with different permissions at the RD to see things. =20 [*] As of now, that is just an example, we might reconsider and make = this at least mandatory to implement, so it would be good with more = feedback on this. The requirements anyway are that in a GM all the Gids = are unique, and that a Gid is changed after a group rekeying. The format = in appendix C guarantees both. If your second question refers to one = node in 2 groups (managed by 2 different GMs), where these 2 Gids = collide, then that is up to the application to decide how to deal with = it (discard, try both contexts=E2=80=A6). We briefly discuss sec cons = about it in section 8.5 of core-oscore-groupcomm. However, that is = independent from the format of the Gid, as long as the requirements are = met. [JLS] My question dealt with having two different KDCs each of which has = a Gid and that Gid collides for some reason. The groups of the two KDCs = are distinct and the resources accessible by those different KDCs are = distinct and are quite possibly two different applications. =20 5. Section 4.1 - I can understand things relative to the key_info blob = that is being returned. I am not sure that I think that this is being = defined correctly however. It makes more sense to me to have the following: key_info =3D [ sign_alg: COSE_Algorithm, ?sign_parameters : map, ?key_parameters: map ] where the two maps are filled in from the = required fixed parameters from the two COSE registries. This would end up with something like the following as a potential value [ sign_alg: ECDSA, key_parameters: {'kty':'EC2', 'crv': 'P256'}] =20 [*] Ok, we can implement that. To make sure we understand your proposal, = =E2=80=98key_parameters=E2=80=99 are taken from COSE Key Common = Parameters and COSE Key Type Parameters registries?=20 What about =E2=80=98sign_parameters=E2=80=99? Can we be sure that those = two field would cover all parameters of existing and future algorithms? = If a new algorithm defines its own registry, we would need to add that, = and say values from that registry can also be used in this map. (AP2) [JLS] Sounds good. 6. Section 4.1.1 - why is the key info parameter format application specific? I would have assumed that it was the same as in the previous section. =20 [*] Right, proposal to change =E2=80=9CIts format=E2=80=9D to = =E2=80=9CIts exact content=E2=80=9D. (AP3) [JLS] Sounds good 7. Section 4.2 - for 'client_cred', I am unsure what the client is = supposed to do if the joining node does not know the countersignature algorithm. = Can the include public key not be in a consistent format? What does = consistent format even mean? =20 [*] Consistent format refers to the key type based on the = countersignature algorithm used. If the joining node does not know the = countersignature algorithm, it might just omit this parameter, or send a = public key as a guess. If the guess is incorrect, the GM will reply as = specified in 4.3 (see point 8).=20 [JLS] I don=E2=80=99t know what point 8 is =E2=80=93 There are 6 points = for the outer list and the inner point 8 defines a field and does not = define a response. 8. Section 4.3 - I don't understand why the GM is accepting the join = request if the client_cred passed in was not in the correct format. Is this a = typo? =20 [*] The reason for responding with a non-error response code is to be = able to use the payload to provide the key info in a CBOR map. With a = 4.XX response, that would not be possible since the payload is supposed = to be a diagnostic human readable text string. We are willing to change = that if the WG/CoAP experts can confirm that would be ok. [JLS] So I return a 2.01 in both cases, and based on the content the = client needs to determine what is happening? We are breaking the 4.xx = response already in the OAuth framework by returning an error response. = I would think that it would make more sense to continue that trend. 9. Section 6 - I don't know that the third bullet is in the list of = cases where the client_cred parameter is not required. =20 [*] Well spotted, and it needs to be clarified. Actually, the third = bullet should say that if the PoP key in the access token has the format = expected in the group and the client is aware of that, then the client = can skip providing its own public key later on in = =E2=80=98client_cred=E2=80=99. (AP4) [JLS] Will need to read after update. 10. Section 6 - What is the POP method for the fourth bullet method? =20 [*] We address this as well in point 9 of your review comments, to which = we say: =E2=80=9CUntil now, we kept that out of the scope of this and = dependent documents (see section 8 of ace-key-groupcomm-oscore), but we = are looking to include it. One possibility we are considering is to sign the key distribution = request together with a nonce that was sent from the KDC (for the sake = of freshness), using the private key paired to the public key sent in = =E2=80=98client_cred=E2=80=99.=E2=80=9C You seemed ok with this, so we will implement it here. (AP5) [JLS] This is a problem that is going to need to be solved at some point = for the OAuth framework as well at some point in the future. But may be = more of a problem here. You might want to talk to Ludwig about the = solution space. 11. Section 6 - What happens if any of first three bullets is true, but = the cached key does not match the required key parameters for the signing algorithm. In some of these cases there is no check that any signature algorithm parameters that might exist are going to be checked and = enforced. =20 [*] The first bullet point is actually about not providing a key, so no = check needs to be done. The second bullet point is about a previously provided key, so the check = would be done as described. Third bullet: yes we need to clarify. (AP6) =20 [JLS] Sounds good. 12. Section 7 - This text implies to me that all users of a group key = need to be able to act as servers and have a fixed port number which was = supplied some how to the GM so that it can be notified. This could be done by keeping up the DTLS session, but that is still a little bit tricky and = would not work for OSCORE based messages. This text might want to point to = the section in the ietf-ace-key-groupcomm that deals with this and require = that the query or subscribe methods be supported. Although both of those = suffer from the lack of hard break on the part of publishers. =20 [*] Yes, that is correct, group members would need to act as servers. = The port number could be either default or part of the Join Request (in = a new field =E2=80=9Crekeying uri=E2=80=9D?), with the group member = assuming that the rekeying is done with this (unicast) default = algorithm. The GM could then either confirm, or communicate to the = joining node a different group rekeying scheme (in = =E2=80=9Cgroup_policies=E2=80=9D) and port and resource (in the new = field =E2=80=9Crekeying uri=E2=80=9D) in the Join Response. However, = that is quite heavy on the group member, which is a reason to use RD = instead to discover in advance the rekeying scheme and rekeying uri as = linked target attributes of the join resource. Would that work? Also why = do you say that it would not work for OSCORE based messages? We could = easily specify that when using the OSCORE profile between group member = and GM, the nodes need to have both roles, so configure their keying = material accordingly (for example: the group member=E2=80=99s recipient = context need to contain a replay window). (AP7) [JLS] I think that this may need to have a design session to figure out = all of the ramifications and problems. Jim =20 =20 ------=_NextPart_000_0186_01D5156F.40CCE2A0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From: Francesca Palombini = <francesca.palombini@ericsson.com>
Sent: Tuesday, May = 28, 2019 2:29 AM
To: Jim Schaad = <ietf@augustcellars.com>; ace@ietf.org
Cc: = draft-ietf-ace-key-groupcomm-oscore@ietf.org
Subject: Re: = draft-ietf-ace-key-groupcomm-oscore

 

H= i Jim,

T= hanks again for your in depth review. We have identified 7 clear APs = from some of your review comments, and we hope that we answer the other = (inline). Please let us know if that is ok, and we will update the = document as soon as possible.

 

T= hanks,

F= rancesca and Marco

 

I = was wandering through the document with a view to implementing and = have

the= following questions:

 

1. =  Abstract: From the first paragraph I am not sure if the = group

com= munications or the communications to the KDC are secured with = OSCORE.

 

[= *] Ok, we propose to change =E2=80=9Cwhere communications are = based=E2=80=9D to =E2=80=9Cwhere the group communication is = based=E2=80=9D. The communication to the KDC is up to the profile of ACE = used between the joining node and the KDC. (AP1)

[JLS] Should be = ok.

 

2. =  Section 3.1 - "requester" seems to be an odd name for = "sender" or

&qu= ot;publisher"

 

[= *] This particular document does not consider the concept of publisher. = Requester was chosen to identify a client in a group communication = setting, i.e. stressing that it sends (group) requests and receives = (unicast) responses. Sender would not be correct, as both clients and = servers are senders at some point during the message = exchange.

[JLS] I will probably complain = again at a later date.=C2=A0 My problem is that requester is not the = opposite of listener.=C2=A0 A different set might be = =E2=80=9Crequester=E2=80=9D, =E2=80=9Cresponder=E2=80=9D, = =E2=80=9Cmonitor=E2=80=9D

3. = Section 3.1 - I am trying to figure out why a Gid would be a = reasonable

val= ue for the scope.  This means that the AS is going to be the one = to

ass= ign the Gid value in many cases as it needs to check the scope = value

the= re.  Is that going to be a common case?  I.e. Are Gids going = to be

ass= igned by administrators?

 

[= *] The Gid of the Authorization Request would be a reasonable scope = because the join resource is associated to it (at the GM). The GM = receiving a Join Request must be able to retrieve the correct Gid = following the access to the join resource. No, the AS does not assign = the Gid value (if that is used as scope in the Authorization Request). = The AS only needs to check that the client is authorized to get an = access token for that scope, regardless that it is a join resource. The = Gid is assigned by the resource owner of the join resource at the GM, = that is an administrator.

[JLS] Ok =E2=80=93 so the = answer to my question is yes.=C2=A0 I wanted to be sure it was not a = registration process on the KDC (I think).

4. = Section 3.1 - Is the form in Appendix C of the Gid in some = respect

man= datory?  If it is not, then how does a receiver of a message = distinguish

bet= ween two different groups that are using the same multicast address? =  Is

tha= t going to be a non-supported case?  The most common case of this = would

be = having two different groups on the default CoAP multicast address = talking

to = RDs with different permissions at the RD to see things.

 

[= *] As of now, that is just an example, we might reconsider and make this = at least mandatory to implement, so it would be good with more feedback = on this. The requirements anyway are that in a GM all the Gids are = unique, and that a Gid is changed after a group rekeying. The format in = appendix C guarantees both. If your second question refers to one node = in 2 groups (managed by 2 different GMs), where these 2 Gids collide, = then that is up to the application to decide how to deal with it = (discard, try both contexts=E2=80=A6). We briefly discuss sec cons about = it in section 8.5 of core-oscore-groupcomm. However, that is independent = from the format of the Gid, as long as the requirements are = met.

[JLS] My question dealt with = having two different KDCs each of which has a Gid and that Gid collides = for some reason.=C2=A0 The groups of the two KDCs are distinct and the = resources accessible by those different KDCs are distinct and are quite = possibly two different applications.

 

5. = Section 4.1 - I can understand things relative to the key_info blob = that

is = being returned.  I am not sure that I think that this is being = defined

cor= rectly however.  It makes more sense to me to have the = following:

key= _info =3D [ sign_alg: COSE_Algorithm, ?sign_parameters : = map,

?ke= y_parameters: map ] where the two maps are filled in from the = required

fix= ed parameters from the two COSE registries.  This would end up = with

som= ething like the following as a potential value   [ sign_alg: = ECDSA,

key= _parameters: {'kty':'EC2', 'crv': 'P256'}]

 

[= *] Ok, we can implement that. To make sure we understand your proposal, = =E2=80=98key_parameters=E2=80=99 are taken from COSE Key Common = Parameters and COSE Key Type Parameters registries?

W= hat about =E2=80=98sign_parameters=E2=80=99? Can we be sure that those = two field would cover all parameters of existing and future algorithms? = If a new algorithm defines its own registry, we would need to add that, = and say values from that registry can also be used in this map. = (AP2)

[JLS] Sounds = good.

6. = Section 4.1.1 - why is the key info parameter format = application

spe= cific?  I would have assumed that it was the same as in the = previous

sec= tion.

 

[= *] Right, proposal to change =E2=80=9CIts format=E2=80=9D to = =E2=80=9CIts exact content=E2=80=9D. (AP3)

[JLS] Sounds = good

7. =  Section 4.2 - for 'client_cred', I am unsure what the client is = supposed

to = do if the joining node does not know the countersignature algorithm. =  Can

the= include public key not be in a consistent format?  What does = consistent

for= mat even mean?

 

[= *] Consistent format refers to the key type based on the = countersignature algorithm used. If the joining node does not know the = countersignature algorithm, it might just omit this parameter, or send a = public key as a guess. If the guess is incorrect, the GM will reply as = specified in 4.3 (see point 8).

[JLS] I don=E2=80=99t know what = point 8 is =E2=80=93 There are 6 points for the outer list and the inner = point 8 defines a field and does not define a = response.

8. = Section 4.3 - I don't understand why the GM is accepting the join = request

if = the client_cred passed in was not in the correct format.  Is this a = typo?

 

[= *] The reason for responding with a non-error response code is to be = able to use the payload to provide the key info in a CBOR map. With a = 4.XX response, that would not be possible since the payload is supposed = to be a diagnostic human readable text string. We are willing to change = that if the WG/CoAP experts can confirm that would be ok.

[JLS] So I return a 2.01 in = both cases, and based on the content the client needs to determine what = is happening?=C2=A0 =C2=A0We are breaking the 4.xx response already in = the OAuth framework by returning an error response.=C2=A0 I would think = that it would make more sense to continue that = trend.

9. =  Section 6 - I don't know that the third bullet is in the list of = cases

whe= re the client_cred parameter is not required.

 

[= *] Well spotted, and it needs to be clarified. Actually, the third = bullet should say that if the PoP key in the access token has the format = expected in the group and the client is aware of that, then the client = can skip providing its own public key later on in = =E2=80=98client_cred=E2=80=99. (AP4)

[JLS] Will need to read after = update.

10.=  Section 6 - What is the POP method for the fourth bullet = method?

 

[= *] We address this as well in point 9 of your review comments, to which = we say: =E2=80=9CUntil now, we kept that out of the scope of this and = dependent documents (see section 8 of ace-key-groupcomm-oscore), but we = are looking to include it.

O= ne possibility we are considering is to sign the key distribution = request together with a nonce that was sent from the KDC (for the sake = of freshness),  using the private key paired to the public key sent = in =E2=80=98client_cred=E2=80=99.=E2=80=9C

Y= ou seemed ok with this, so we will implement it here. (AP5)

[JLS] This is a problem that is = going to need to be solved at some point for the OAuth framework as well = at some point in the future.=C2=A0 But may be more of a problem = here.=C2=A0 You might want to talk to Ludwig about the solution = space.

11.= Section 6 - What happens if any of first three bullets is true, but = the

cac= hed key does not match the required key parameters for the = signing

alg= orithm.  In some of these cases there is no check that any = signature

alg= orithm parameters that might exist are going to be checked and = enforced.

 

[= *] The first bullet point is actually about not providing a key, so no = check needs to be done.

T= he second bullet point is about a previously provided key, so the check = would be done as described.

T= hird bullet: yes we need to clarify. (AP6)  

[JLS] Sounds = good.

12.=  Section 7 - This text implies to me that all users of a group key = need

to = be able to act as servers and have a fixed port number which was = supplied

som= e how to the GM so that it can be notified.   This could be = done by

kee= ping up the DTLS session, but that is still a little bit tricky and = would

not= work for OSCORE based messages.  This text might want to point to = the

sec= tion in the ietf-ace-key-groupcomm that deals with this and require = that

the= query or subscribe methods be supported.  Although both of those = suffer

fro= m the lack of hard break on the part of publishers.

 

[= *] Yes, that is correct, group members would need to act as servers. The = port number could be either default or part of the Join Request (in a = new field =E2=80=9Crekeying uri=E2=80=9D?), with the group member = assuming that the rekeying is done with this (unicast) default = algorithm. The GM could then either confirm, or communicate to the = joining node a different group rekeying scheme (in = =E2=80=9Cgroup_policies=E2=80=9D) and port and resource (in the new = field =E2=80=9Crekeying uri=E2=80=9D) in the Join Response. However, = that is quite heavy on the group member, which is a reason to use RD = instead to discover in advance the rekeying scheme and rekeying uri as = linked target attributes of the join resource. Would that work? Also why = do you say that it would not work for OSCORE based messages? We could = easily specify that when using the OSCORE profile between group member = and GM, the nodes need to have both roles, so configure their keying = material accordingly (for example: the group member=E2=80=99s recipient = context need to contain a replay window). (AP7)

[JLS] I think that this may = need to have a design session to figure out all of the ramifications and = problems.

Jim=

 

 

------=_NextPart_000_0186_01D5156F.40CCE2A0-- From nobody Wed May 29 03:32:49 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C64E51200B1; Wed, 29 May 2019 03:32:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n5cZnubAJ6N6; Wed, 29 May 2019 03:32:42 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130078.outbound.protection.outlook.com [40.107.13.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3671C120019; Wed, 29 May 2019 03:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=snjBsvoE9ZRuImM9p/P/agEcwlUkA0BqLprj/LQ2U5Q=; b=DwuVOCsxX4mEna8vYxMEoS1ATwwUlej+HKG0sgiJ1/frjWY8TJuwvzli2Cn5pdj+N/EGQzRMfWz0tdBEz/u9BtvMbz8x/Z8I1YbpkthW2MxaKb4FU9Lm0SfmbFdlS7lmUcx9b5wGtQi3GkEBOSr2ZKAQdl4ONlQhTxGiNMBQz50= Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com (10.168.185.17) by HE1PR0701MB2412.eurprd07.prod.outlook.com (10.168.128.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.13; Wed, 29 May 2019 10:32:36 +0000 Received: from HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::8a9:a4d6:303b:45f0]) by HE1PR0701MB2746.eurprd07.prod.outlook.com ([fe80::8a9:a4d6:303b:45f0%5]) with mapi id 15.20.1943.015; Wed, 29 May 2019 10:32:36 +0000 From: Francesca Palombini To: Jim Schaad CC: "ace@ietf.org" , "draft-ietf-ace-key-groupcomm@ietf.org" Thread-Topic: draft-ietf-ace-key-groupcomm review Thread-Index: AQHVFIFGL+A3ZkfO8Umj1bY95rbDLqZ/hNWAgAKHWIA= Date: Wed, 29 May 2019 10:32:36 +0000 Message-ID: <89396BDA-89FD-4064-B609-D557E864C9D7@ericsson.com> References: <4B0C53D0-D41A-4AC3-912C-4E214BA1A85F@ericsson.com> <010601d514d6$ee026970$ca073c50$@augustcellars.com> In-Reply-To: <010601d514d6$ee026970$ca073c50$@augustcellars.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 55fa1ad1-2a43-4186-c23c-08d6e420f7c3 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:HE1PR0701MB2412; x-ms-traffictypediagnostic: HE1PR0701MB2412: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0052308DC6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(376002)(136003)(396003)(346002)(39860400002)(51914003)(199004)(189003)(4326008)(6916009)(53946003)(99286004)(7736002)(186003)(66066001)(606006)(6512007)(25786009)(236005)(6506007)(71200400001)(6306002)(68736007)(82746002)(26005)(229853002)(3846002)(6116002)(11346002)(14444005)(256004)(33656002)(486006)(36756003)(476003)(446003)(44832011)(2616005)(53936002)(6246003)(76176011)(71190400001)(83716004)(54896002)(561944003)(5660300002)(2906002)(6486002)(66476007)(66556008)(8936002)(66446008)(8676002)(30864003)(81156014)(81166006)(6436002)(508600001)(54906003)(14454004)(66946007)(64756008)(966005)(316002)(73956011)(76116006)(9326002)(102836004)(86362001)(559001)(579004); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2412; H:HE1PR0701MB2746.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: PJ86sthr9g/70LC41FKTFrJ0oQJh9u+4NfNi69VN7jhT5P1oOfVJIRhnjmCYdEqYDEM9sUa/pv7BmXTwhXvpXS3fPa+yGxjVKCDlIz9MoA66SinuBtJY2W2BCla/6Yia3ia2CS1eDvgKuXPRKW2Cz2fP6bO3nJ6Xoj1UbxAX483pOKhmTUrnwT/0+XT3bAXd2cYkAcsTD/+Bg+8GNfSQ3UmztXflyHcNltGgULxJCXjpF8Z/xj3WRlN0kUbR0KsRnfe3pX0pXR1/DiwQ1kDFY5CAEqrDcwEOe3O90JJc7phklWOK3oeNJfsRETbpl7MIcMv39lWYBuczQb+JO1flFJlMmZ57qv8eCWwDSq3hX6gh0p9ysXV/fS/jt31C7LeepK/PNbrYq/mvYsWvMBz3b7uvser0T6Fs3ghOWxDVydk= Content-Type: multipart/alternative; boundary="_000_89396BDA89FD4064B609D557E864C9D7ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 55fa1ad1-2a43-4186-c23c-08d6e420f7c3 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 May 2019 10:32:36.5150 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: francesca.palombini@ericsson.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2412 Archived-At: Subject: Re: [Ace] draft-ietf-ace-key-groupcomm review X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 10:32:48 -0000 --_000_89396BDA89FD4064B609D557E864C9D7ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmltLA0KDQpUaGFua3MgZm9yIHlvdXIgcHJvbXB0IHJlcGx5ISBJIGN1dCBvdXQgdGhlIGNv bW1lbnRzIHRoYXQgd2VyZSBva2F5ZWQsIGFuZCBvbmx5IGtlcHQgdGhvc2UgdGhhdCBlaXRoZXIg YXJlIG5vdCBva2F5ZWQsIG5lZWQgbW9yZSBkaXNjdXNzaW9uLCBvciBmb3Igd2hpY2ggd2UgaGF2 ZSBwcm9wb3NlZCBuZXcgQVBzIGZvbGxvd2luZyB5b3VyIHJlc3BvbnNlLiBBcHByb3ZlZCBBUHMg YXJlIG5vdyB0cmFja2VkIGFzIGdpdGh1YiBpc3N1ZXMgYW5kIHdlIHdpbGwgYmUgd29ya2luZyBv biB0aG9zZSBpbiB0aGUgYnJhbmNoIHYtMDItV0lQLiBOZXcgY29tbWVudHMgaW4gcmVkLCBwcmVm YWNlZCB3aXRoIFtGUF0uDQoNClRoYW5rIHlvdSBhZ2FpbiwNCkZyYW5jZXNjYSBhbmQgTWFyY28N Cg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNClNlY3VyaXR5IE1vZGVsIGFuZCBvdGhlciBp c3N1ZXMgZm9yIGdyb3VwIG1lc3NhZ2luZyAtIDA5LzA0LzIwMTkNCg0KSSBuZWVkIHRvIGxvb2sg YXQgdGhpcyBtb3JlIGNsb3NlbHkg4oCTIHdpbGwgcmVzcG9uZCBsYXRlcg0KDQpbRlBdIE9rLiBU aGFua3MgSmltIGZvciB0YWtpbmcgdGhlIHRpbWUNCg0KSSBoYXZlIGJlZW4gZ29pbmcgdGhyb3Vn aCB0aGUgZGVzaWduIHByb2Nlc3MgZm9yIGdldHRpbmcgc29mdHdhcmUgcnVubmluZw0KDQpmb3Ig TW9udHJlYWwgYW5kIEkgaGF2ZSBjb21lIGFjcm9zcyB0aGUgZm9sbG93aW5nIGlzc3VlcyB0aGF0 IEkgdGhpbmsgbmVlZA0KDQpzb21lIGRpc2N1c3Npb24uIFNvbWUgb2YgdGhlc2UgbWF5IGp1c3Qg bmVlZCBjbGFyaWZpY2F0aW9uIGluIGRvY3VtZW50cyBidXQNCg0Kb3RoZXIgYXJlIG1vcmUgc3Vi c3RhbnRpdmUuDQoNCkl0IHRvb2sgbWUgYSB3aGlsZSB0byBkZXRlcm1pbmUgdGhhdCBvbmUgb2Yg dGhlIHN0cmFuZ2UgaXNzdWVzIEkgd2FzIGhhdmluZw0KDQppcyB0aGF0IHdoZW4gbG9va2luZyBq dXN0IGF0IHRoZSBtdWx0aWNhc3QgY2FzZSBteSBtZW50YWwgbW9kZWwgb2Ygd2hvIHdhcw0KDQpt YWtpbmcgdGhlIGRlY2lzaW9ucyBvbiBpZiBhY2Nlc3Mgd2FzIGFsbG93ZWQgZGlkIG5vdCBzZWVt IHRvIG1ha2UgYSBnb29kDQoNCm1hdGNoIHRvIHdoYXQgd2FzIGJlaW5nIGRvY3VtZW50ZWQuDQoN CkkgcmF0aGVyIGV4cGVjdGVkIHRoYXQgYWxsIG9mIHRoZSBBQ0wNCg0KZGVjaXNpb25zIHdlcmUg Z29pbmcgdG8gYmUgbWFkZSBvbiB0aGUgQVMgYW5kIG5vbmUgb24gdGhlIEtEQy4NCg0KVGhpcyBp cyBjb3JyZWN0LiBUaGUgbW9kZWwgZm9yIHRoZSBhY2Uta2V5LWdyb3VwY29tbSAoYW5kIGNvbnNl cXVlbnRseSBhY2Uta2V5LWdyb3VwY29tbS1vc2NvcmUgYW5kIGFjZS1jb2FwLXB1YnN1YikgaXMg dGhhdCB0aGUgQVMgZG9lcyBhbGwgb2YgdGhlIEFDTCBhbmQgS0RDIGRvZXMgdGhlIGtleSBkaXN0 cmlidXRpb24uDQoNClRoaXMgbWVhbnQNCg0KdGhhdCB0aGUgaW5jbHVzaW9uIG9mIHNjb3BlIGlu IGFsbCBvZiB0aGUgbWVzc2FnZXMgd2FzIHJlZHVuZGFudCBpZiBzZW5kaW5nDQoNCm1lc3NhZ2Vz IHRvIGEgcGVyIGdyb3VwIHJlc291cmNlLg0KDQpZb3UgYXJlIGNvcnJlY3QsIHNjb3BlIGlzIGlu ZGVlZCByZWR1bmRhbnQgaW4gc29tZSBtZXNzYWdlcywgZm9yIGV4YW1wbGUgaW4gdGhlIEtleSBE aXN0cmlidXRpb24gUmVxdWVzdCwgYXMgaXQgaXMgcHJlc2VudCBpbiB0aGUgdG9rZW4uIChTZWUg cG9pbnQgMTIgYmVsb3cpDQoNClBhcnQgb2YgdGhlIHF1ZXN0aW9ucyBpbnZvbHZlZCBoZXJlIGFy ZQ0KDQp3aG8gZG9lcyB0aGUgY29uZmlndXJhdGlvbiBmb3Igd2hhdCBrZXkgZ3JvdXBzIGFyZSBh c3NvY2lhdGVkIHdpdGggd2hhdA0KDQphcHBsaWNhdGlvbiBncm91cHMuDQoNCkkgd2FzIGFsd2F5 cyB0aGlua2luZyBvZiBhIHNpbmdsZSBrZXkgZ3JvdXAgd2hpY2ggd2FzDQoNCmlkZW50aWZpZWQg YnkgdGhlIEFTIGFuZCBzZW50IHRvIHRoZSBLREMgd2l0aG91dCB0aGUgS0RDIG5lZWRpbmcgdG8g a25vdyB0aGUNCg0KZGV0YWlscyBvZiBtdWx0aXBsZSByZXNvdXJjZXMgZm9yIHRoYXQga2V5IGdy b3VwLiBUaGlzIG9mIGNvdXJzZSBkb2VzIG5vdA0KDQptYXRjaCB0aGUgbW9kZWwgaW4gdGhlIGRv Y3VtZW50LiBTb21lIHRleHQgb24gd2hhdCBtb2RlbCBpcyBiZWluZyBsYWlkIG91dA0KDQppcyBw cm9iYWJseSB3b3J0aHdoaWxlLg0KDQpXZeKAmWQgbGlrZSBjbGFyaWZpY2F0aW9ucyBoZXJlOiB3 aHkgZG8geW91IHNheSB0aGF0IHRoaXMgZG9lcyBub3QgbWF0Y2ggdGhlIGN1cnJlbnQgbW9kZWw/ IFRoYXQgd2FzIHRoZSBvYmplY3RpdmUgYW55d2F5Lg0KDQpUaGVyZSB3YXMgZGlzY3Vzc2lvbnMg Zm9yIHRoZSBBQ0UgT0F1dGggZG9jdW1lbnQgYWJvdXQgaG93IHRvIGhhbmRsZQ0KDQptdWx0aXBs ZSBhY2Nlc3MgdG9rZW5zIGZvciBhIHNpbmdsZSBlbnRpdHkgdGhhdCBuZWVkIHRvIGJlIGxvb2tl ZCBhdCBpbiB0aGUNCg0KY29udGV4dCBvZiBhIEtEQy4gVGhlIGN1cnJlbnQgcnVsZSBpcyB0aGF0 IGEgcmVzb3VyY2Ugc2VydmVyIG5lZWRzIG9ubHkgdG8NCg0Ka2VlcCBvbmUgdG9rZW4gZm9yIGFu eSBzaW5nbGUgc3VwcGxpY2FudC4gVGhpcyB3YXMgbW9zdGx5IGRpc2N1c3NlZCBpbiB0aGUNCg0K Y29udGV4dCBvZiBhZGRpbmcgYW5kIHN1YnRyYWN0aW5nIHByaXZpbGVnZXMgZm9yIHRoZSBzdXBw bGljYW50LiBJdCBtYXkgYmUNCg0KdGhhdCB0aGlzIGFsc28gbmVlZHMgdG8gYmUgdmlld2VkIGlu IHRoZSBjb250ZXh0IG9mIGhhdmluZyBjb21wbGV0ZWx5DQoNCmRpc2pvaW50IHJlc291cmNlcyBv biBhIHNpbmdsZSBSUyB3aGljaCBhcmUgZ29pbmcgdG8gaGF2ZSBkaWZmZXJlbnQgQVMNCg0KdG9r ZW5zIGlzc3VlZC4NCg0KVGh1cyBmb3IgZXhhbXBsZSwgaWYgdGhlcmUgaXMgYSBLREMgd2hpY2gg aXMgc2VydmljaW5nIHR3bw0KDQpkaWZmZXJlbnQga2V5IGdyb3Vwcy4gVGhlIHN1cHBsaWNhbnQg Z2V0cyBhIHRva2VuIGZvciBncm91cDEsIGdldHMgdGhlIGtleXMNCg0KZnJvbSB0aGUgS0RDLiBJ dCB0aGVuIGFza3MgZm9yIGEgdG9rZW4gZm9yIGdyb3VwMi4gR2l2ZW4gdGhhdCB0aGUNCg0KbGlm ZXRpbWVzIG9mIHRoZXNlIGRpZmZlcmVudCB0b2tlbnMgY291bGQgYmUgcmFkaWNhbGx5IGRpZmZl cmVudCBkb2VzIGl0DQoNCnJlYWxseSBtYWtlIHNlbnNlIHRvIHJlcXVpcmUgdGhhdCB0aGUgdHdv IEFTIHRva2VucyBiZSBtZXJnZWQgdG9nZXRoZXINCg0KKGFzc3VtaW5nIHRoZXkgYXJlIGZyb20g dGhlIHNhbWUgc291cmNlKSBvciB3b3VsZCBpdCBtYWtlIG1vcmUgc2Vuc2UgdG8NCg0KcmVsYXgg dGhlIFJTIG9ubHkgbmVlZHMgdG8ga2VlcCBvbmUgdG9rZW4gcnVsZS4gQW4gZWFzeSB3YXkgb3V0 IG9mIHRoaXMNCg0KbWlnaHQgYmUgdG8gc2F5IG9uZSB0b2tlbiBwZXIgcmVzb3VyY2UsIGJ1dCBm b3IgY29uc3RyYWluZWQgZGV2aWNlcyBpdCBjb3VsZA0KDQpiZSBvbmUgdG9rZW4gcGVyIFJTLg0K DQpXZSBhZ3JlZSB3aXRoIHJlbGF4aW5nIHRoZSDigJxvbmUgdG9rZW4gcGVyIFJTIHBlciBjbGll bnTigJ0uIFRoZSByZXF1aXJlbWVudCBtYWtlcyBzZW5zZSB3aGVuIG9uZSBSUyBpcyBhc3NvY2lh dGVkIHdpdGggb25lIEFTLCBidXQgaW4gb3VyIGNhc2UgdGhlIEtEQyBjb3VsZCBiZSBhc3NvY2lh dGVkIHdpdGggc2V2ZXJhbCBBUyBmb3IgZGlmZmVyZW50IHNjb3Blcy4gZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHotMjQjc2VjdGlvbi01LjE8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI0I3NlY3Rpb24tNS4xPg0KDQpzYXlzICIuLi4gdGhl IEFTIGluIGNoYXJnZSBvZiBhIHJlc291cmNlIGhvc3RlZCBhdCB0aGUgUlMgLi4uIiAgU28gdGhp cyBpcyBhIG1vcmUgZ2VuZXJhbCBwcm9ibGVtLCBhcyBpdCBpcyBhbGxvd2VkIGluIHRoZSBBQ0Ug ZnJhbWV3b3JrIHRvIGhhdmUgbXVsdGlwbGUgQVNzIGNvdmVyaW5nIGRpZmZlcmVudCByZXNvdXJj ZXMvc2NvcGVzIGF0IGEgc2FtZSBSUy4gV2UgdGhpbmsgdGhpcyByZXF1aXJlbWVudCBzaG91bGQg YmUgcmVsYXhlZCBpbiB0aGUgZ2VuZXJhbCBjYXNlLCBhcyBtZXJnaW5nIHRva2VucyBmcm9tIGRp ZmZlcmVudCBBU3Mgd291bGQgZGVmaW5pdGVseSBiZSBhIHByb2JsZW0uIFdl4oCZZCBsaWtlIHRv IHJhaXNlIHRoaXMgaXNzdWUgdG8gdGhlIEFDRSBmcmFtZXdvcmsgYXV0aG9ycyBhbmQgZ2V0IGZl ZWRiYWNrIGZyb20gdGhlIFdHLg0KDQpKaW0NCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoN CmRyYWZ0LWlldGYtYWNlLWtleS1ncm91cGNvbW0gLSAwMy8wNC8yMDE5IDAzOjAwDQoNCjMuICBU aGUgZG9jdW1lbnQgZG9lcyBub3QgaGF2ZSBhIHRhYmxlIHdoaWNoIGRlYWxzIHdpdGggYWJicmV2 aWF0aW9ucywgZG9lcw0KDQp0aGlzIG1lYW4gdGhhdCB0aGUgZnVsbCB0ZXh0IHN0cmluZyBpcyB3 aGF0IGlzIGdvaW5nIHRvIGJlIHRoZSBrZXk/DQoNCkRlcGVuZGluZyBvbiB0aGUgY29udGVudCB0 eXBlIGJlaW5nIGNvbnNpZGVyZWQsIHRoZXNlIHZhbHVlcyBjb3VsZCBiZQ0KDQphc3NpZ25lZCAo bmV3IHJlZ2lzdHJ5KSBvciBtYXJrZWQgYXMgVEJELCBidXQgaWYgdGhpcyBpcyBzdXBwb3NlZCB0 byBoYXBwZW4NCg0KdGhlbiBpdCBuZWVkcyB0byBiZSBwbGFjZWQgaW4gdGhlIGRvY3VtZW50Lg0K DQpZZXMsIHdlIG5lZWQgdG8gZG8gdGhpcy4gV2Ugd2lsbCBjcmVhdGUgYSBuZXcgcmVnaXN0cnkg Zm9yIHRoZW0sIGFuZCByZS11c2UgdGhlIHNhbWUgbnVtYmVyIGFzIEFDRSBhcyBtdWNoIGFzIHBv c3NpYmxlIChmb3IgcGFyYW1ldGVycyB0aGF0IGFwcGVhciBpbiBib3RoLCBzdWNoIGFzIOKAmHBy b2ZpbGXigJksIOKAmGV4cOKAmSkgKEFQMykNCg0KW0pMU10gU291bmRzIHJlYXNvbmFibGUuICBJ IGFtIGN1cnJlbnRseSBidWlsZGluZyBhIHNwcmVhZHNoZWV0IHdpdGggc29tZSBvZiB0aGlzIGRh dGUgYW5kIHdpbGwgZm9yd2FyZCBpdCB0byB5b3UuDQpbRlBdIEdvdCBpdCwgdGhhbmsgeW91IGZv ciB0aGF0LCBpdCB3aWxsIGJlIHZlcnkgdXNlZnVsIQ0KDQoNCg0KNi4gIFNlY3Rpb24gMy4xIC0g SXMgdGhlcmUgYSByZWFzb24gd2h5IG9uZSBjYW5ub3QgcmVxdWVzdCBhY2Nlc3MgZnJvbSB0aGUN Cg0KQVMgZm9yIG11bHRpcGxlIGdyb3Vwcy90b3BpY3MgaW4gdGhlIHNhbWUgcmVxdWVzdCB0byB0 aGUgQVM/ICdzY29wZScNCg0KVGhpcyB3YXMgdGhlIGNhc2UgaW4gYSBwcmV2aW91cyB2ZXJzaW9u IG9mIHRoZSBkb2N1bWVudC4gV2UgZ290IGZlZWRiYWNrIHRoYXQgdGhpcyB3YXMgdG9vIGNvbXBs aWNhdGVkIGFuZCBub3QgYSBob3QgbmVlZC4gV2UgY2FuIHJlY29uc2lkZXIgaWYgbW9yZSBwZW9w bGUgaW4gdGhlIFdHIHdhbnQgdGhpcy4NCg0KW0pMU10gSSBjYW4gdW5kZXJzdGFuZCB0aGlzIHJl YWN0aW9uLiAgWW91IG1pZ2h0IGFsc28gbG9vayBhdCB0aGUgTVFUVCBkb2N1bWVudCB3aGljaCBp cyBhbGxvd2luZyBmb3IgdGhpcyBhbmQgc2VlIGlmIGFsaWdubWVudCBpcyBuZWVkZWQuDQpbRlBd IE9rLCB3ZSB3aWxsIChBUDI5KQ0KDQoNCg0KNy4gIFNlY3Rpb24gMy4xIC0gSXMgdGhlcmUgYSBk ZWZpbml0aW9uIG9mIHRoZSB2YWx1ZXMgZm9yICJyb2xlIiB0aGF0IGNhbiBiZQ0KDQpyZXF1ZXN0 ZWQuICBXaGF0IGlzIHRoZSB0eXBlIG9mIHRoaXMgZmllbGQgZm9yIGEgc2luZ2xlIHZhbHVlLCBv ciBmb3INCg0KZWxlbWVudHMgb2YgdGhlIGFycmF5PyAgSXMgdGhlcmUgYSBkZWZhdWx0IGlmIHJv bGUgaXMgb21pdHRlZCBvbiB0aGUNCg0KcmVxdWVzdD8NCg0KVGhlcmUgaXMgbm8gZGVmaW5pdGlv biBpbiB0aGlzIGRvYyBmb3Igc3BlY2lmaWMgYWRtaXR0ZWQgdmFsdWVzLCB0aGF0IGlzIGRlZmlu ZWQgb24gdGhlIGFkZGl0aW9uYWwgaW5zdGFuY2VzIChhY2Uta2V5LWdyb3VwY29tbS1vc2NvcmUs IGFjZS1jb2FwLXB1YnN1YikuIFJvbGVzIGFyZSBzcGVjaWZpYyB0byB0aGUgYXBwbGljYXRpb25z LCBzbyBpdCBtYWtlcyBsaXR0bGUgc2Vuc2UgdG8gc3BlY2lmeSB0aGVtIGluIGdlbmVyYWwuIFRo ZSBkZWZhdWx0IHZhbHVlLCBpZiBhbnksIHdvdWxkIGFsc28gYmUgZGVmaW5lZCBpbiB0aGUgaW5z dGFuY2VzLiBXaGF0IHdlIHdpbGwgZG8gaXMgdG8gY2xhcmlmeSB0aGlzIGluIHRoZSB0ZXh0LiBN b3Jlb3ZlciwgdGhpcyB3aWxsIGJlIHBhcnQgb2YgdGhlIOKAnE1hbmRhdG9yeSB0byBkZWZpbmXi gJ0gKHNlZSBwb2ludCAzOSkuIChBUDYpDQoNCltKTFNdIEkgd2lsbCBuZWVkIHRvIHRoaW5rIGFi b3V0IHRoaXMuICBJdCBtYXkgbWFrZSB0aGluZ3MgaGFyZCBvbiB0aGUgQVMgZGVwZW5kaW5nIG9u IGhvdyBpdCBpcyBkZXNpZ25lZC4NCltGUF0gT2ssIHdlIHdpbGwgaG9sZCBvZmYgb24gdGhpcyBB UCB1bnRpbCB3ZSBnZXQgbW9yZSBkaXNjdXNzaW9uLg0KDQo4LiAgU2VjdGlvbiAzLjIgLSBJTiB0 aGUgbGFzdCBwYXJhZ3JhcGggZGlkIHlvdSBtZWFuIHRvIHNheSB0aGF0IGEgbmV3IHRva2VuDQoN CndvdWxkIGJlIHJldHVybmVkIG9yIHRoYXQgdGhlIGV4aXN0aW5nIHRva2VuIGNhbiBiZSByZXR1 cm5lZC4NCg0KVGhhdCBhIG5ldyB0b2tlbiB3b3VsZCBiZSByZXR1cm5lZC4gSG93IGNhbiB3ZSBj bGFyaWZ5Pw0KDQpbSkxTXSBUaGUgc3RyaW5nIOKAnGNhbiBzaW1wbHkgcmVwbGF5IHdpdGjigJ0g aXMgd2hhdCBtZXNzZWQgbWUgdXAuICBCZXR0ZXIgd291bGQgYmUg4oCcdGhlIEFTIHJlcGxpZXMg d2l0aCBhbiBBdXRob3JpemF0aW9uIFJlc3BvbnNlIHdpdGggYSBuZXcgYWNjZXNzIHRva2VuLuKA nSAgVGhlIHVzZSBvZiDigJxjYW7igJ0gaXMgbm90IHRoZSBzYW1lIGFzIOKAnHdpbGzigJ0uDQpb RlBdIE9rLCB0aGFua3MgZm9yIHRoZSBjbGFyaWZpY2F0aW9uLiBXaWxsIGZpeCAoQVAzMCkNCg0K OS4gIFNlY3Rpb24gNC4xIC0gSWYgdGhlICdjbGllbnRfY3JlZCcgZmllbGQgaW4gYSByZXF1ZXN0 IGlzIGZpbGxlZCBpbiwgYW5kDQoNCml0IGlzIG5vdCB0aGUgc2FtZSBhcyB0aGUgcHVibGljIGtl eSB1c2VkIHRvIGVzdGFibGlzaCB0aGUgVExTIHNlc3Npb24NCg0KYmV0d2VlbiB0aGUgY2xpZW50 IGFuZCB0aGUgS0RDLCB3aGF0IGlzIHRoZSBwcm9jZWR1cmUgdG8gZG8gYSBQT1Agb24gdGhpcw0K DQprZXk/DQoNCkluIHRoZSBzcGVjaWZpYyBjYXNlIHlvdSBkZXNjcmliZSwgYW4gZWFzeSBzb2x1 dGlvbiB3b3VsZCBiZSB0byByZXF1aXJlIHRoZSBjbGllbnQgdG8gdXNlIHRoZSBzYW1lIGtleSBp biDigJhjbGllbnRfY3JlZOKAmSBhbmQgdG8gZXN0YWJsaXNoIHRoZSBUTFMgc2Vzc2lvbiwgYW5k IHRoYXQgd291bGQgc29sdmUgdGhlIFBPUC4gQnV0IHdlIGRvIGhhdmUgdGhlIG9wZW4gcG9pbnQg b24gUE9QIGZvciB0aGUgcHVibGljIGtleSBpbiB0aGUgZ2VuZXJhbCBjYXNlLiBVbnRpbCBub3cs IHdlIGtlcHQgdGhhdCBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoaXMgYW5kIGRlcGVuZGVudCBkb2N1 bWVudHMgKHNlZSBzZWN0aW9uIDggb2YgYWNlLWtleS1ncm91cGNvbW0tb3Njb3JlKSwgYnV0IHdl IGFyZSBsb29raW5nIHRvIGluY2x1ZGUgaXQuDQoNCk9uZSBwb3NzaWJpbGl0eSB3ZSBhcmUgY29u c2lkZXJpbmcgaXMgdG8gc2lnbiB0aGUga2V5IGRpc3RyaWJ1dGlvbiByZXF1ZXN0IHRvZ2V0aGVy IHdpdGggYSBub25jZSB0aGF0IHdhcyBzZW50IGZyb20gdGhlIEtEQyAoZm9yIHRoZSBzYWtlIG9m IGZyZXNobmVzcyksICB1c2luZyB0aGUgcHJpdmF0ZSBrZXkgcGFpcmVkIHRvIHRoZSBwdWJsaWMg a2V5IHNlbnQgaW4g4oCYY2xpZW50X2NyZWTigJkuIERvIHlvdSBoYXZlIGZlZWRiYWNrIGFib3V0 IHRoaXM/DQoNCltKTFNdIHRoYXQgd291bGQgYmUgYSByZWFzb25hYmxlIHNvbHV0aW9uLiAgWW91 IGNvdWxkIHBvdGVudGlhbGx5IGFsc28gdXNlIGEgVExTIGV4cG9ydGVyIHZhbHVlIGFzIHRoYXQg d291bGQgYmUgY2hhbm5lbCBib3VuZC4NCg0KW0ZQXSBPaywgd2Ugd2lsbCBzdGFydCBieSBza2V0 Y2hpbmcgdGhpcyBzb2x1dGlvbiwgd2UgY2FuIGRpc2N1c3MgbW9yZSBhZnRlciB3ZSBoYXZlIGEg cHJvcG9zYWwuIChBUDMxKQ0KDQoNCjEyLiBTZWN0aW9uIDQuMiAtIEkgYW0gbm90IGNvbXBsZXRl bHkgc3VyZSB0aGF0IEkgdW5kZXJzdGFuZCB3aGF0DQoNCnZlcmlmaWNhdGlvbiBjaGVja2luZyBt ZWFucyBpbiB0aGUgZmlyc3QgcGFyYWdyYXBoLg0KDQpUaGUgS0RDIHZlcmlmaWVzIHRoYXQgdGhl IOKAmHNjb3Bl4oCZIHJlY2VpdmVkIGluIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgaXMg dGhlIHNhbWUgYXMg4oCYc2NvcGXigJkgc3RvcmVkIGluIHRoZSBhY2Nlc3MgdG9rZW4gYXNzb2Np YXRlZCB0byB0aGlzIGNsaWVudC4gVGhpcyBzY29wZSBmaWVsZCBpcyBub3Qgc3RyaWN0bHkgbmVj ZXNzYXJ5LCBhcyBhbGwgdGhlIGluZm8gaXMgaW4gdGhlIHRva2VuIGFueXdheSAod2hpY2ggaXMg d2h5IGl0IGlzIG9wdGlvbmFsKS4gQnV0IGltcGxlbWVudGF0aW9uIGZlZWRiYWNrIHdhcyB0aGF0 IGl0IGlzIGdvb2QgdG8gaGF2ZS4NCg0KW0pMU10gRG9lcyBpdCBoYXZlIHRvIGJlIGVxdWFsIG9y IGNhbiBpdCBiZSBhIHN1YnNldD8NCltGUF0gUmlnaHQsIGl0IGNhbiBiZSBhIHN1YnNldC4gV2ls bCBhZGQgdGhhdCAoQVAzMikNCg0KDQoNCjEzLiBTZWN0aW9uIDQuMiAtIFdoYXQgaXMgdGhlIHBy b2ZpbGUgdGhhdCBJIGFtIGNoZWNraW5nIGZvciB0aGUgJ2t0eScNCg0KZmllbGQ/ICBXYXMgSSBz dXBwb3NlZCB0byBoYXZlIGEgY2hhbmNlIHRvIHJlcXVlc3QgYSBwcm9maWxlIHNvbWVwbGFjZT8N Cg0KVGhlIHByb2ZpbGUgY2hlY2tpbmcgaXMgYWdhaW5zdCB0aGUgQUNFIEdyb3VwY29tbSBQcm9m aWxlIHJlZ2lzdHJ5IGRlZmluZWQgaGVyZSwgaS5lLiBmb3Igbm93IGVpdGhlciAiY29hcC1ncm91 cC1vc2NvcmUiIG9mICJjb2FwLXB1YnN1YiIgKHNvIG5vdCB0aGUgc2FtZSBhcyB0aGUgQUNFIHBy b2ZpbGUpLiBUaGlzIGlzIHRvIG1ha2Ugc3VyZSB0aGF0IHRoZSBjb3JyZWN0IHR5cGUgb2Yga2V5 IGlzIHVzZWQsIGFzIGRlZmluZWQgaW4gdGhlIGluc3RhbmNlIGRvY3VtZW50IHVzZWQgKHN1Y2gg YXMgYWNlLWtleS1ncm91cGNvbW0tb3Njb3JlKS4gTm8sIHRoZSBjbGllbnQgZG8gbm90IHJlcXVl c3QgdGhlIHByb2ZpbGUsIHRoZSBBUyBkZXRlcm1pbmVzIGl0IGFuZCBzZW5kcyBpdCB0byB0aGUg Q2xpZW50IGluIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlc3BvbnNlLg0KDQpbSkxTXSBJ4oCZbGwg aGF2ZSB0byBsb29rIGF0IHRoaXMgZHVyaW5nIGltcGxlbWVudGF0aW9uLg0KW0ZQXSBPay4gVG8g bWFrZSB0aGlzIGVhc2llciwgd2Ugd2lsbCBhbHNvIGNsYXJpZnkgaW4gdGhlIHRleHQgdGhlIGRp ZmZlcmVuY2UgYmV0d2VlbiDigJx0cmFuc3BvcnQgcHJvZmlsZXPigJ0gKHN1Y2ggYXMgRFRMUyBw cm9maWxlLCBPU0NPUkUgcHJvZmlsZSwgTVFUVCBwcm9maWxlKSBhbmQg4oCcYXBwbGljYXRpb24g cHJvZmlsZXPigJ0gKHN1Y2ggYXMgIGFjZS1rZXktZ3JvdXBjb21tLW9zY29yZSBvciBhY2UtY29h cC1wdWJzdWIpIChBUDMzKQ0KDQoxNC4gU2VjdGlvbiA0LjIgLSBQdXQgdGhlIGZhY3QgdGhhdCB0 aGUgJ2tleScgZmllbGQgaXMgcHJvZmlsZSBkZXBlbmRlbnQgb24NCg0KdGhlICdrdHknIGluIHRo ZSAna2V5JyBwYXJhZ3JhcGguICBJcyBpdCBsZWdhbCB0byBkZWZpbmUgYSAna3R5JyB3aGljaCBk b2VzDQoNCm5vdCBoYXZlIGEgJ2tleScgZmllbGQ/ICBJZiBzbyB0aGVuIHNob3VsZCB0aGlzIGZp ZWxkIGJlIGRlZmluZWQgYnkgdGhlDQoNCnByb2ZpbGU/ICBPaywgSSBqdXN0IHJlYWQgdGhlIGZ1 bGwgbmV4dCBwYXJhZ3JhcGggYW5kIG5vdyBJIGFtIGp1c3QNCg0KY29uZnVzZWQuDQoNClllcywg J2tleScgZm9ybWF0IGlzIGRlcGVuZGVudCBvbiAna3R5Jy4gQWxzbyB5ZXMsIGluIHRoZW9yeSBv bmUgcHJvZmlsZSBjb3VsZCBkZWZpbmUgYSDigJhrdHnigJkgZm9yIHdoaWNoIOKAmGtleeKAmSBp cyBlbXB0eSAoTm90ZSB0aGF0IHRoZSDigJhrZXnigJkgZmllbGQgaXRzZWxmIE1VU1QgYmUgcHJl c2VudCBpbiB0aGUgQ0JPUiBtYXApLiBXaGF0IGlzIHVuY2xlYXIgYW5kIHdoYXQgcGFyYWdyYXBo IGFyZSB5b3UgcmVmZXJyaW5nIHRvPw0KDQoxNS4gU2VjdGlvbiA0LjIgLSBXaGF0IGlzIHRoZSB0 eXBlIG9mIHByb2ZpbGU/DQoNCkludCwgYXMgc3BlY2lmaWVkIGluIHRoZSAiQ0JPUiBWYWx1ZSIg Y29sdW1uIG9mIHRoZSBBQ0UgR3JvdXBjb21tIFByb2ZpbGUgaW4gU2VjdGlvbiA5LjIuDQoNCltK TFNdIFRleHQgZ2l2ZXMgYSB0eXBlIGZvciB0aGUgb3RoZXIgZmllbGRzLCBvciBzYXlzIGlzIHBy b2ZpbGUgc3BlY2lmaWMsIGJ1dCBub3QgdGhhdCBvbmUNCltGUF0gT2ssIHdlIHdpbGwgYWRkIHRo YXQgaW4gdGhlIHRleHQgYXMgd2VsbC4gKEFQMzQpDQoNCg0KMjEuIFNlY3Rpb24gNSAtIElzIHRo ZXJlIHNvbWUgdHlwZSBvZiByZXF1aXJlbWVudCBmb3IgcG9zaXRpdmUgZGVsaXZlcnkgb2YNCg0K bmV3IGtleXMgaW4gdGhlIGV2ZW50IG9mIGEgS0RDIGNoYW5naW5nIHRoZSBrZXkuICBJIHB1dCB0 aGlzIGhlcmUgd3J0IGEgbm9kZQ0KDQpsZWF2aW5nLCBidXQgaXQgYXBwbGllcyBlcXVhbGx5IHRv IGEgbm9kZSBnZXR0aW5nIGl0c2VsZiBhZGRlZC4NCg0KV2UgYXJlIG5vdCBzdXJlIHdlIHVuZGVy c3RhbmQgdGhpcyBxdWVzdGlvbi4gQXJlIHlvdSBhc2tpbmcgYWJvdXQgQUNLIG9mIChzdWNjZXNz ZnVsKSBkZWxpdmVyeSBvZiBuZXcga2V5cz8gSW4gdGhhdCBjYXNlLCBpZiB0aGUgcmVrZXlpbmcg aXMgcGVyZm9ybWVkIG5vZGUtYnktbm9kZSBhcyBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVudCwg dXNpbmcgY29uZmlybWFibGUgbWVzc2FnZXMgc2hvdWxkIGJlIGVub3VnaC4gT3RoZXJ3aXNlLCBp dCB3b3VsZCBiZSBtb3N0bHkgbGVmdCB0byB0aGUgc2luZ2xlIG5vZGVzIHRvIGV2ZW50dWFsbHkg ZmluZCBvdXQgdGhhdCB0aGV5IGFyZSB1c2luZyBzdGFsZSBrZXkgbWF0ZXJpYWwgYW5kIHNob3Vs ZCBpbmRpdmlkdWFsbHkgYXNrIGZvciB0aGUgbGF0ZXN0IG9uZS4NCg0KW0pMU10gRm9yIHNvbWUg dHlwZXMgb2YgbGlzdHMsIGl0IG1ha2VzIHNlbnNlIHRoYXQgdGhlcmUgc2hvdWxkIGJlIHNvbWUg dHlwZSBvZiBmb3JjaW5nIGZ1bmN0aW9uIHRoYXQgYSBzZW5kZXIgaXMgZ29pbmcgdG8gdW5kZXJz dGFuZCB0aGF0IHRoZXJlIGFyZSBuZXcga2V5cyBiZWZvcmUgc2VuZGluZyBhIG1lc3NhZ2Ugb3V0 LiAgVGhpcyB3b3VsZCByZXF1aXJlIGEgcG9zaXRpdmUgZGVsaXZlcnkgb3IgYSBwb2xpY3kgdGhh dCBzYXlzIGFsd2F5cyBjaGVjayBiZWZvcmUgc2VuZGluZy4gIERvaW5nIGEgbXVsdGljYXN0IG1l c3NhZ2UgY2Fubm90IGJlIGRvbmUgY29uZmlybWFibGUgYWNjb3JkaW5nIHRvIHRoZSBub3JtYWwg c3BlY2lmaWNhdGlvbnMgc28geW91IHdvdWxkIG5vdCAgbmVjZXNzYXJpbHkgZG8gYSBmYXN0IG5v dGlmaWNhdGlvbiBpZiBpdCBuZWVkcyB0byBiZSBkb25lIG9uIGluZGl2aWR1YWwgbWVzc2FnZXMu ICBJIGFtIG5vdCBzdXJlIHdoYXQsIGlmIGFueXRoaW5nLCBuZWVkcyB0byBiZSBzYWlkIGhlcmUu ICBUaGlzIG1heSBqdXN0IGJlIGNvbnNpZGVyYXRpb25zIHNvbWVwbGFjZQ0KDQpbRlBdIE9rLCB3 ZSB3aWxsIGFkZCB0aGUgZm9sbG93aW5nIGNvbnNpZGVyYXRpb24g4oCcSW4gdGhlIGNhc2Ugd2hl cmUgaXQgaXMgcmVxdWlyZWQgdGhhdCBhIG5vZGUgb25seSB1c2VzIHVwLXRvLWRhdGUga2V5cyBm b3Igc2VuZGluZyBncm91cCBtZXNzYWdlcywgc2luY2UgQ09OIGlzIG5vdCBzdXBwb3J0ZWQgaW4g Z3JvdXAgY29tbXVuaWNhdGlvbiwgdGhlIGFwcGxpY2F0aW9uIG5lZWRzIHRvIHNldCB1cCBhIG1l Y2hhbmlzbSB0byBjaGVjayB0aGUgc3VjY2Vzc2Z1bCBkZWxpdmVyeSBvZiB0aGUgbWVzc2FnZSwg b3IgcG9saWNpZXMgdG8gYWx3YXlzIHVwZGF0ZSB0aGUga2V5cyBiZWZvcmUgc2VuZGluZy4gU3Vj aCBtZWNoYW5pc21zIGFyZSBvdXQgb2Ygc2NvcGUgb2YgdGhpcyBkb2N1bWVudC7igJ0gV291bGQg dGhhdCBjb3ZlciB5b3VyIHBvaW50PyAoQVAzNSkNCg0KMjIuICBTZWN0aW9uIDUuMSAtIFRoZXJl IGN1cnJlbnRseSBpcyBubyB3YXkgZm9yIGFuIEFTIHRvIGNvbW11bmljYXRlIHRvIHRoZQ0KDQpL REMgdGhhdCBhbiBhdXRob3JpemF0aW9uIGhhcyBiZWVuIHJldm9rZWQuICBUaGVyZSBpcyBvbmx5 IGEgd2F5IGZvciBhIEtEQw0KDQp0byBhc2sgdGhlIEFTIGJ5IGludHJvc3BlY3Rpb24uICBUaGUg Zmlyc3Qgc2VudGVuY2UgaXMgcHJvYmxlbWF0aWMuICBEbyB3ZQ0KDQpuZWVkIHNvbWUgdHlwZSBv ZiBleHRlbnNpb24gdG8gc3VwcG9ydCB0aGlzPw0KDQpSaWdodCwgdGhhdCBpcyBub3QgZGVmaW5l ZCBpbiBBQ0UsIHdlIHdpbGwgcmVtb3ZlIHRoaXMgc2VudGVuY2UuIFdl4oCZZCBhbHNvIGxpa2Ug dG8gZ2V0IGZlZWRiYWNrIGZyb20gdGhlIFdHIGFib3V0IHRoaXMuIChBUDE0KQ0KDQpbSkxTXSBN YWtlcyBzZW5zZS4gIEkgdGhpbmsgdGhpcyBqdXN0IG5lZWRzIHRvIGJlIGhpZ2hsaWdodGVkIGFz IGludHJvc3BlY3Rpb24uICBJdCBtaWdodCBiZSBuaWNlIHRvIGRlZmluZSBhIG11bHRpcGxlIHRv a2VuIGludHJvc3BlY3Rpb24gbWVzc2FnZSBhdCBzb21lIHBvaW50IHRvIHRoZSBLREMgY291bGQs IGluIGEgc2luZ2xlIG1lc3NhZ2UsIGdldCBhbGwgb2YgdGhlIHN0YXR1c2VzIGJlZm9yZSBkb2lu ZyBhIGtleSB1cGRhdGUgb3BlcmF0aW9uLg0KW0ZQXSBPaywgd2Ugd2lsbCBkZWxldGUgdGhhdCBm aXJzdCBzZW50ZW5jZSBhbmQgcmVwbGFjZSB3aXRoIOKAnElmIHRoZSBub2RlIGlzIG5vdCBhdXRo b3JpemVkIGFueW1vcmUsIHRoZSBLREMgY2FuIG9wdGlvbmFsbHkgZ2V0IHRoYXQgaW5mb3JtYXRp b24gZnJvbSB0aGUgQVMgdmlhIHRoZSBJbnRyb3NwZWN0aW9uIEVuZHBvaW50IChzZWUgU2VjdGlv biA1Ljcgb2YgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHop4oCdLiAoQVAxNCkNClllcywgd2Ug YWdyZWUgaXQgd291bGQgYmUgbmljZSAoaXQgd291bGQgYmUgZW5vdWdoIHRvIGFsbG93IGZvciBh biBhcnJheXMgb2YgdG9rZW5zIHJhdGhlciB0aGFuIG9uZSB0b2tlbiBpbiB0aGUgcGF5bG9hZCBv ZiB0aGUgaW50cm9zcGVjdGlvbiByZXF1ZXN0LCBzZWN0aW9uIDUuNy4xIG9mIGRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6KS4gSXQgd291bGQgYmUgYWxzbyBuaWNlIGZvciB0aGUgQ2xpZW50IHRv IGJlIGFibGUgdG8gT2JzZXJ2ZSB0aGUgaW50cm9zcGVjdGlvbiBlbmRwb2ludCBhdCB0aGUgQVMu IFdlIHNob3VsZCBkZWZpbml0ZWx5IGRpc2N1c3MgdGhlc2UgMiBwb2ludHMgIHdpdGggTHVkd2ln IGFuZCB0aGUgV0csIGFzIHRoaXMgbWlnaHQgYmUgbW9yZSBnZW5lcmFsIHRoYW4gYWNlLWtleS1n cm91cGNvbW0sIGFsdGhvdWdoIHdlIHdvdWxkIGRlZmluaXRlbHkgbWFrZSB1c2Ugb2YgaXQuDQoN Cg0KMjMuICBTZWN0aW9uIDUuMiAtIElmIGEgdG9waWMgaXMgcHJvdmlkZWQgYW5kIHRoZSB1c2Vy IGlzIGF1dGhvcml6ZWQgZm9yIHR3bw0KDQp0b3BpY3Mgd2hpY2ggdXNlIHRoZSBzYW1lIGdyb3Vw LCB3aGF0IGhhcHBlbnMgaWYgdGhlIHVzZXIgYXNrcyB0byBsZWF2ZSBvbmUNCg0Kb2YgdGhvc2Ug dHdvIHRvcGljcyBidXQgd2FudHMgdG8gc2F5IG9uIHRoZSBvdGhlcj8NCg0KU2VlIHNlY3Rpb24g NS4yOg0KDQogIE5vdGUgdGhhdCB0aGUgJ3JvbGUnIGZpZWxkIGlzIG9taXR0ZWQgc2luY2Ugc3Vj aCBhIHJlcXVlc3Qgc2hvdWxkDQoNCiBvbmx5IGJlIHVzZWQgdG8gbGVhdmUgYSBncm91cCBhbHRv Z2V0aGVyLiAgSWYgdGhlIGxlYXZpbmcgbm9kZSB3YW50cw0KDQogdG8gYmUgcGFydCBvZiBhIGdy b3VwIHdpdGggZmV3ZXIgcm9sZXMsIGl0IGRvZXMgbm90IG5lZWQgdG8NCg0KIGNvbW11bmljYXRl IHRoYXQgdG8gdGhlIEtEQywgYW5kIGNhbiBzaW1wbHkgc3RvcCBhY3RpbmcgYWNjb3JkaW5nIHRv DQoNCiBzdWNoIHJvbGVzLg0KDQpJZiB0d28gdG9waWNzIChhcHBsaWNhdGlvbiBncm91cHMpIGFy ZSBjb3ZlcmVkIGJ5IHRoZSBzYW1lIHNlY3VyaXR5IGdyb3VwLCBhbmQgYSB1c2VyIHdhbnRzIHRv IHN0b3AgZm9sbG93aW5nIG9uZSB0b3BpYyB3aGlsZSBzdGlsbCBiZWluZyBhdXRob3JpemVkLCBp dCBkb2VzIG5vdCBuZWVkIHRvIGxlYXZlIHRoZSBzZWN1cml0eSBncm91cCwgaXQgY2FuIGp1c3Qg ZGlzY2FyZCBmdXR1cmUgbWVzc2FnZXMgcmVsYXRlZCB0byB0aGF0IHRvcGljLiBUaGUgYWN0dWFs IGxlYXZpbmcgb2YgYXBwbGljYXRpb24gZ3JvdXBzLCBlLmcuIHVuc3Vic2NyaWJpbmcgZnJvbSBh IHRvcGljLCBpcyBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuDQoNCltKTFNdIEJ1 dCB0aGUgc2NvcGUgZmllbGQgaXMgaW5jbHVkZWQgaW4gdGhlIHRva2VuLiAgSSBhbSBub3Qgc3Vy ZSB0aGF0IEkgc2VlIGFueSB1c2Ugb2YgdGhlIHNjb3BlIGZpZWxkIGhlcmUgYXQgYWxsLg0KW0ZQ XSBSaWdodC4gV2UgcHJvcG9zZSB0aGUgZm9sbG93aW5nIGNoYW5nZTogbWFrZSBzY29wZSBvcHRp b25hbCBpbiB0aGUgbWVzc2FnZSAoc2FtZSByZWFzb25pbmcgYXMgS2V5IGRpc3RyaWJ1dGlvbiBy ZXF1ZXN0LCBpdCBpcyBub3QgbmVjZXNzYXJ5IGJ1dCBpdCBtaWdodCBiZSB1c2VmdWwgZm9yIGlt cGxlbWVudGF0aW9ucykuIChBUDM2KQ0KDQoNCg0KMjYuIFNlY3Rpb24gNS4yIC0gSXQgaXMgbm90 IGNsZWFyIHRvIG1lIGlmIHRoZSBsYXN0IHBhcmFncmFwaCBtZWFucyB0aGF0IHRoZQ0KDQpLREMg Y2FuIHJlbW92ZSB0aGUgQVMgYWNjZXNzIHRva2VuIGZyb20gaXQncyBkYXRhYmFzZSB3aGVuIGEg bGVhdmUgb2NjdXJzLA0KDQpvciBpZiBpdCBjYW4gb25seSBiZSByZW1vdmVkIHdoZW4gaXQgZXhw aXJlcy4NCg0KVGhhdCBwYXJhZ3JhcGggd2FzIG1lYW50IHRvIG1lYW4gdGhhdCB0aGUgdG9rZW4g Y2FuIGJlIHJlbW92ZWQgb25seSB3aGVuIGl0IGV4cGlyZXMgKG9yIHdoZW4geW91IHVwZGF0ZSBp dCkuIFdoYXQgYXJlIHdlIG1pc3Npbmc/DQoNCltKTFNdIFlvdSBhcmUgbm90IG5lY2Vzc2FyaWx5 IG1pc3Npbmcgc29tZXRoaW5nLiAgSG93ZXZlciB0aGlzIGNvdWxkIGJlIGRvbmUgYnkgdGhlIEtE QyBmb3JnZXR0aW5nIHRoZSB0b2tlbiB3aGVuIHRoZSBsZWF2ZSBvY2N1cnMgYW5kIHRoZSBjbGll bnQgc3VwcGx5aW5nIHRoZSB0b2tlbiBhZ2FpbiB3aGVuIGl0IGRvZXMgYSBsYXRlciBqb2luLiAg VGhpcyBtZWFucyB0aGF0IHRoZSBLREMgb25seSBuZWVkcyB0byBoYXZlIHRva2VucyBmb3IgY3Vy cmVudGx5IGFjdGl2ZSBtZW1iZXJzIGFuZCBub3QgZm9yIGFsbCBwYXN0IG1lbWJlcnMgd2hpY2gg c3RpbGwgaGF2ZSB2YWxpZCB0b2tlbnMuDQpbRlBdIFRoYXTigJlzIHJpZ2h0LCBhbmQgdGhlcmUg YXJlIHByb3MgYW5kIGNvbnMgZm9yIGJvdGggY2FzZXM6IHRoZSBjdXJyZW50IG9uZSBoYXMgbGVz cyBtZXNzYWdlcyBleGNoYW5nZWQgYnV0IG1vcmUgbWVtb3J5IG9uIHRoZSBLREMgKHRvIGtlZXAg dHJhY2sgb2Ygbm90LWV4cGlyZWQgdG9rZW5zKSwgdGhlIG9uZSB5b3UgbWVudGlvbiByZXF1aXJl IGxlc3MgbWVtb3J5IG9uIHRoZSBLREMsIGJ1dCBtb3JlIG1lc3NhZ2VzLiBJIHRoaW5rIG1lc3Nh Z2UgZXhjaGFuZ2VzIGFyZSBtb3JlIGltcGFjdGZ1bCwgc28gSSB3b3VsZCBrZWVwIHRoYXQgb3B0 aW9uLiBCdXQgd2UgY291bGQgYWRkIGEgc2VudGVuY2UgY2xhcmlmeWluZyB0aGF0IGlmIHRoZSBL REMgbWVtb3J5IGlzIG5vdCBzdWZmaWNpZW50LCBpdCBtaWdodCBkaXNjYXJkIHBhc3QtbWVtYmVy cyB2YWxpZCB0b2tlbnMsIGluIHdoaWNoIGNhc2UgdGhlIGpvaW5pbmcgb2xkIG1lbWJlcnMgd2ls bCBuZWVkIHRvIHJlcG9zdCB0aGUgdG9rZW4gYWZ0ZXIgcmVjZWl2aW5nIGFuIGVycm9yIHJlc3Bv bnNlIHRvIHRoZSBrZXkgZGlzdHJpYnV0aW9uIHJlcXVlc3QuIChBUDM3KQ0KDQoNCg0KMzMuICBT ZWN0aW9uIDYuMSAtIFdoYXQgaGFwcGVucyBpZiBJIGFzayBmb3IgYSBrZXkgcmUtZGlzdHJpYnV0 aW9uLCBidXQNCg0Kc3VwcGx5IGEgZGlmZmVyZW50IHNjb3BlIHRoYW4gZm9yIHRoZSBvcmlnaW5h bCBtZXNzYWdlIDwgYXNzdW1lcyBhDQoNCm11bHRpLXRvcGljIHNjb3BlPi4gIEkgYW0gbm90IHN1 cmUgd2hhdCB0aGUgcHVycG9zZSBvZiB0aGUgc2NvcGUgaXMgYXQgdGhpcw0KDQp0aW1lIGdpdmVu IHRoYXQgeW91IGFyZSBub3QgY2hlY2tpbmcgcm9sZXMgYXMgd2VsbC4NCg0KUm9sZSBpcyBub3Qg Y2hlY2tlZCBhcyB0aGUgS2V5IFJlLURpc3RyaWJ1dGlvbiBSZXF1ZXN0IGlzIGRvbmUgdG8gcmV0 cmlldmUgdGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCwgbm90IHRoZSBwdWJsaWMga2V5cyBmb3Ig c2lnbmF0dXJlIHZlcmlmaWNhdGlvbi4gRm9yIGV4YW1wbGUsIGluIHB1YnN1YiwgdGhlIG5vZGUg aXMgcmUtcmVxdWVzdGluZyB0aGUgc3ltbWV0cmljIGtleSB0byBwcm90ZWN0IHRoZSBjb21tdW5p Y2F0aW9uLiBUaGUgS0RDIGRvZXMgbm90IG5lZWQgdG8ga25vdyBub3IgY2hlY2sgaWYgdGhlIG5v ZGUgaXMgYW4gYXV0aG9yaXplZCBwdWIgb3IgYSBzdWIsIGJ1dCBvbmx5IHRoYXQgaXQgaXMgYXV0 aG9yaXplZCB0byB0aGF0IHRvcGljLiBDaGVja2luZyB0aGUgc2NvcGUgbWFrZSBzdXJlIHRoYXQg YSBub2RlIHRoYXQgaXMgYXV0aG9yaXplZCBmb3IgYSBjZXJ0YWluIHRvcGljIGRvZXMgbm90IHJl cXVlc3QgdGhlIG1hdGVyaWFsIGZvciBhbm90aGVyIHRvcGljLg0KDQpXaHkgd291bGQgeW91IHdh bnQgdG8gYXNrIGtleSBkaXN0cmlidXRpb24gZm9yIG9uZSBzY29wZSBvbmx5IHdoZW4gYm90aCBz Y29wZXMgbWFwIHRvIHRoZSBzYW1lIHNlY3VyaXR5IGtleWluZyBtYXRlcmlhbD8NCg0KW0pMU10g QmVjYXVzZSBpdCBpcyBlYXNpZXIgb24gdGhlIGNsaWVudC4gIEkgY2FuIGFzayBmb3IgdGhlIHNw ZWNpZmljIHRva2VuIHRoYXQgY2F1c2VkIHRoZSBwcm9ibGVtIGFuZCBub3QgaGF2ZSB0byByZW1l bWJlciBhbGwgb2YgdGhlIGRpZmZlcmVudCB0b3BpY3MgdGhhdCBhcmUgYXNzb2NpYXRlZCB3aXRo IHRoZSBncm91cC4NCltGUF0gVGhhdOKAmXMgYSBnb29kIHBvaW50LiBXZSB3aWxsIGFkZCBzb21l dGhpbmcgYWJvdXQgdGhpcyBpZiB3ZSByZWNvbnNpZGVyIGFib3V0IHRoZSBtdWx0aS10b3BpYy9n cm91cCBzY29wZSAoc2VlIHBvaW50IDYgZnJvbSBwcmV2aW91cyBlbWFpbCkuDQoNCg0KMzQuICBP VVQgT0YgT1JERVIgLSBTaG91bGQgYSBLREMgaGF2ZSBhIHNpbmdsZSByZXNvdXJjZSB3aGljaCBh bGxvd3MgZm9yIGl0DQoNCnRvIHJldHVybiBhIGdyb3VwIGJhc2VkIG9uIHdoYXQgdGhlIHRvcGlj L3Njb3BlIGlzIHRoYXQgaXMgcGFzc2VkIGluIHdpdGhvdXQNCg0KdGhlIGNsaWVudCBmaXJzdCBr bm93aW5nIHdoYXQgdGhlIGdyb3VwIGlkIGlzIGdvaW5nIHRvIGJlPw0KDQpJIGludGVycHJldCB5 b3VyIHF1ZXN0aW9uIGFzIGZvbGxvd3M6IHlvdSBhcmUgd29uZGVyaW5nIGlmIHRoZSBmb2xsb3dp bmcgbWVjaGFuaXNtIGlzL3Nob3VsZCBiZSBzdXBwb3J0ZWQ6IHRoZSBjbGllbnQgc2VuZHMgYSBy ZXF1ZXN0IHRvIGEgd2VsbCBrbm93biByZXNvdXJjZSBvbiB0aGUgS0RDIGFza2luZyAid2hhdCBp cyB0aGUgc2VjIGdyb3VwIGZvciB0aGlzIHRvcGljL2FwcGxpY2F0aW9uIGdyb3VwPyIgKHRvcGlj IGNvdWxkIGJlIGluIHRoZSBwYXlsb2FkIGZvciBleGFtcGxlKS4gVGhlIEtEQyByZXNwb25kcyB3 aXRoIGluZm8gYWJvdXQgdGhlIHNlY3VyaXR5IGdyb3VwIChHcm91cCBJRCwgZXRjKS4gSWYgdGhh dCBpcyB0aGUgY2FzZSwgdGhhdCBpcyB0YWtlbiBjYXJlIG9mIGJ5IHRoZSByZXNvdXJjZSBkaXJl Y3RvcnksIGFzIGRlc2NyaWJlZCBpbiBkcmFmdCBkcmFmdC10aWxvY2EtY29yZS1vc2NvcmUtZGlz Y292ZXJ5LiBUaGUgS0RDIGNvdWxkIHRha2UgdGhhdCByb2xlIHRvby4gSWYgdGhhdCBpcyBub3Qg dGhlIGNvcnJlY3QgaW50ZXJwcmV0YXRpb24gb2YgdGhpcyBjb21tZW50LCB0aGVuIGNvdWxkIHlv dSBleHBhbmQ/DQoNCltKTFNdIEFjdHVhbGx5IEkgd2FzIHRoaW5raW5nIG9mIHNvbWV0aGluZyBt b3JlIGdlbmVyYWwuICBJIGNhbiBwb3N0IHRoZSByZXF1ZXN0IHRvIGEgc2luZ2xlIGNvbW1vbiBy ZXNvdXJjZSBuYW1lIGFuZCB0aGUgS0RDIHdvdWxkIGxvb2t1cCB3aGF0IHRoZSBjb3JyZWN0IGdy b3VwIGlkIHdvdWxkIGJlIGZvciB0aGUgcmVxdWVzdCBhbmQgaW50ZXJuYWxseSBkaXNwYXRjaCBp dCB0byB0aGUgY29ycmVjdCBpbnRlcm5hbCByZXNvdXJjZS4gIE1pZ2h0IGJlIGVhc2llciBvbiBj bGllbnRzIGlmIG9ubHkgb25lIHBvaW50IGlzIG5lZWRlZCBhbmQgbm8gZGlyZWN0b3J5IGxvb2t1 cCBpcyBuZWVkZWQuDQpbRlBdIE9rLCB3ZSB3aWxsIHRyeSB0byBza2V0Y2ggc29tZXRoaW5nIGlu IEFwcGVuZGl4IGFib3V0IHRoaXMsIGFueXdheSB3ZSBzdWdnZXN0IHRoaXMgdG8gYmUgYW4gb3B0 aW9uYWwgbWVjaGFuaXNtIHRoYXQgTUFZIGJlIHN1cHBvcnRlZCBieSBHTS4gKEFQMzgpDQoNCg0K MzUuICBPVVQgT0YgT1JERVIgLSBhcmUgYWxsIG9mIHRoZSByZXNvdXJjZSBuYW1lcyByZXF1aXJl ZCB0byBiZSBhdCB0aGUNCg0Kcm9vdD8gIElmIEkgaGF2ZSBhIEtEQyB3aGljaCBpcyBzaGFyZWQg d2l0aCBzb21ldGhpbmcgZWxzZSAoc2F5IGEgUHViIFN1Yg0KDQpzZXJ2ZXIpIHRoZW4gaXQgd291 bGQgbWFrZSBzZW5zZSB0byBoYXZlIHBvc3QgdG8gL0tEQy9ncm91cC1pZC4NCg0KTm8sIHRoZXkg ZG9u4oCZdCBuZWVkIHRvIGJlIGF0IHRoZSByb290LCB0aGV5IGp1c3QgbmVlZCB0byBiZSBhc3Nv Y2lhdGVkIHRvIHRoZSBncm91cC4NCg0KW0pMU10gVGFrZSBhIGxvb2sgYXQgdGhlIHJlc291cmNl IGRpcmVjdG9yeSBhbmQgcHViIHN1YiBtb3JlIHRoZSBzZXQgb2YgdGVtcGxhdGVzIHRoYXQgdGhl eSBhcmUgdXNpbmcuICBXb3VsZCB0aGlzIG1ha2VzIHNlbnNlIHRvIHVzZSBoZXJlIHRvIGFkZHJl c3Mgc3VjaCBpc3N1ZXM/DQpbRlBdIEFyZSB5b3Ugc2F5aW5nIHlvdSB3b3VsZCBsaWtlIHVzIHRv IGRlZmluZSBhIC53ZWxsLWtub3duIHVyaS1wYXRoIHRoYXQgc2hvdWxkIGJlIHVzZWQ/IEkuZS4g dGhhdCBlYWNoIGFwcGxpY2F0aW9uIHByb2ZpbGUgc2hvdWxkIGRlZmluZSBpdCAoZm9yIGV4YW1w bGUg4oCcLndlbGwta25vd24va2RjLy4uLi9HSUQx4oCdLCBvciDigJwud2VsbC1rbm93bi9wdWJz dWIvLi4uL3RvcGljMeKAnSksIGFuZCBhY2Uta2V5LWdyb3VwY29tbSBkZWZpbmVzIGEgcmVnaXN0 cnkgZm9yIGl0PyBUaGF0IGlzIGEgcG9zc2liaWxpdHksIGFsdGhvdWdoIEkgYW0gbm90IHN1cmUg SSBzZWUgdGhlIHBvaW50IG9mIG1hbmRhdGluZyBpdC4gV2hhdCBpcyB0aGUgaXNzdWUgeW91IHJl ZmVyIHRvPyAoQVAzOSkNCg0KDQozNi4gIFNlY3Rpb24gNy4xIC0gd2hhdCBpcyB0aGUgZm9ybWF0 IG9mIGdldF9wdWJfa2V5cyB3aGVuIGdyb3VwIG1lbWJlciBpZHMNCg0KYXJlIGluY2x1ZGVkPw0K DQpXZSBwcm9wb3NlIGJzdHIgYXMgZGVmYXVsdCB0eXBlLiBJbnN0YW5jZXMgbWF5IGNoYW5nZSB0 aGF0IGlmIHRoZXkgbmVlZCB0by4gKEFQMjMpDQoNCltKTFNdIFdoYXQgd291bGQgYmUgYSBjYXNl IHdoZXJlIHNvbWV0aGluZyBlbHNlIHdvdWxkIHJlYWxseSBtYWtlIHNlbnNlPyAgVGhlIGdyb3Vw IG1lbWJlciBpZCBpcyBjdXJyZW50bHkgZGVmaW5lIGFzIHNvbWV0aGluZyBzZXQgZm9yIE9TQ09S RSAgYXJlIHlvdSB0aGlua2luZyB0aGF0IGEgZGlmZmVyZW50IHByb3RvY29sIG1pZ2h0IGZvcm1h dCB0aGVtIGRpZmZlcmVudGx5Pw0KW0ZQXSBTb3JyeSwgbGV04oCZcyBjbGFyaWZ5LiBXaGVuIHdl IHNheSBic3RyIHdlIHJlZmVyIHRvIHRoZSBncm91cCBtZW1iZXIgaWRzIGNvbnRhaW5lZCBpbnRv IHRoZSBnZXRfcHViX2tleXMsIHdoaWNoIGlzIGEgQ0JPUiBhcnJheS4gSSBkb27igJl0IGtub3cg aWYgc29tZXRoaW5nIGVsc2Ugd291bGQgbWFrZSBzZW5zZSwgeWVzLCB3ZSB3ZXJlIHRyeWluZyB0 byBiZSBnZW5lcmFsIGluIGNhc2UgYSBkaWZmZXJlbnQgcHJvdG9jb2wgbWlnaHQgd2FudCB0byBm b3JtYXQgZGlmZmVyZW50bHkuIEFsdGhvdWdoIHRoZXkgY291bGQgYWx3YXlzIHdyYXAgYXMgYnN0 ciwgc28gd2Ugc3VnZ2VzdCB3ZSBkb27igJl0IG1lbnRpb24g4oCcaW5zdGFuY2VzIG1heSBjaGFu Z2UgdGhhdOKAnSAoQVAyMykNCg0KDQozNy4gIFNlY3Rpb24gNy4yIC0gVGhlcmUgaXMgYSByYWNl IGNvbmRpdGlvbiBjYXVzZWQgYnkgdGhlIGxhc3QgcGFyYWdyYXBoIGluDQoNCnRoaXMgc2VjdGlv bi4gIEVudGl0eSBBIHNlbmRzIGEgbWVzc2FnZSwgbGVhdmVzIHRoZSBncm91cCwgRW50aXR5IEIg cmVjZWl2ZXMNCg0KdGhlIG1lc3NhZ2UgYW5kIGFza3MgZm9yIHRoZSBwdWJsaWMga2V5LiAgSXMg dGhpcyBhbiBpc3N1ZT8NCg0KV2UgZG9uJ3QgdGhpbmsgdGhpcyBhcyBhbiBpc3N1ZS4gSW4gZmFj dCwgQSBjb3VsZCB3YWl0IGZvciBhIHJlcGx5IGZyb20gQiBiZWZvcmUgbGVhdmluZyB0aGUgZ3Jv dXAgaWYgaXQgaXMgY3JpdGljYWwgdGhhdCBCIHJlY2VpdmVzIEEncyBtZXNzYWdlLiBPdGhlcndp c2UsIHdlIGNvdWxkIGFkZCBzb21lIHRleHQgYWJvdXQgYSBwb2xpY3kgZm9yIEtEQyB0byBtYWlu dGFpbiBsZWF2aW5nIGdyb3VwIG1lbWJlcnPigJkgUHVibGljIEtleXMgZm9yIGEgY2VydGFpbiBh bW91bnQgb2YgdGltZSBhZnRlciB0aGVpciBsZWF2aW5nLCBiZWZvcmUgZGlzY2FyZGluZyB0aGVt LiBXb3VsZCB0aGF0IHNvbHZlIHRoZSBpc3N1ZT8gKEFQMjQpDQoNCltKTFNdIElmIHRoZSBtZXNz YWdlIGlzIGp1c3QgYSBicm9hZGNhc3QgdGhlbiBJIHdvdWxkIG5vdCBleHBlY3QgQSB0byB3YWl0 IGZvciBhIHJlc3BvbnNlLiAgWWVzIHdoYXQgeW91IHN1Z2dlc3Qgd291bGQgc29sdmUgdGhlIGlz c3VlLCBpdCB3b3VsZCBhbHNvIHNvbHZlIHRoZSBpc3N1ZSBpZiB5b3UgZGVjaWRlZCB0aGF0IHRo aXMgaXMgdG90YWxseSByZWFzb25hYmxlIGFzIEEgc2hvdWxkIG5vdCBleHBlY3QgaXRzIG1lc3Nh Z2UgdG8gYmUgcHJvY2Vzc2VkIGFmdGVyIGl0IGhhcyBsZWZ0IHRoZSBncm91cC4NCltGUF0gT2ss IHdlIHdpbGwgZm9ybXVsYXRlIHNvbWV0aGluZyBhYm91dCB0aGF0ICh0YWtpbmcgaW50byBjb25z aWRlcmF0aW9ucyBib3RoIHBvc3NpYmlsaXRpZXMpLiAoQVAyNCkNCg0KLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCg0KTWFpbCByZWdhcmRpbmcgZHJhZnQtaWV0Zi1h Y2Uta2V5LWdyb3VwY29tbSAtIDA0LzA0LzIwMTkgMDM6NDINCg0KU29tZSBhZGRpdGlvbmFsIHRo aW5ncyB0aGF0IG5lZWQgdG8gYmUgdGhvdWdodCBhYm91dC4NCg0KMS4gIFNvbWVwbGFjZSBhcyBw YXJ0IG9mIHRoZSByZS1rZXkgZGlzY3Vzc2lvbnMgdGhlcmUgb3VnaHQgdG8gYmUgc29tZQ0KDQpj b21tZW50YXJ5IG9uIHRoZSB3aXNkb20gb2YgcmF0ZSBsaW1pdGluZyB0aGUgZnJlcXVlbmN5IG9m IGRvaW5nIHJlLWtleWluZw0KDQpvcGVyYXRpb25zLg0KDQpPaywgd2UgY2FuIGV4cGFuZCBvbiBz b21lIGNvbnNpZGVyYXRpb25zIHRoYXQgYXJlIG5vdyBqdXN0IHF1aWNrbHkgbWVudGlvbmVkLiBP dXIgcHJvcG9zYWwgaXMgdG8gYWRkIHRoYXQgb3RoZXIgdGhhbiByZWtleWluZyBkdWUgdG8gbWVt YmVyc2hpcCBjaGFuZ2VzIChpZiByZWxldmFudCB0byB0aGUgYXBwbGljYXRpb24pLCBwZXJpb2Rp YyByZWtleWluZyBzaG91bGQgb2NjdXIgYXQgdGhlIG1pbmltdW0gcmF0ZSBuZWNlc3NhcnkgdG8g ZGlzY291cmFnZSBhbiBhZHZlcnNhcnkgdG8gZGVyaXZlIHRoZSBrZXkgbWF0ZXJpYWwgb3V0IG9m IGJydXRlIGZvcmNlIGFuZCB0cmFmZmljIGNvbGxlY3Rpb24vYW5hbHlzaXMuIChBUDI3KQ0KDQpb SkxTXSBUaGUgY2FzZSB0aGF0IEkgd2FzIGFjdHVhbGx5IHRoaW5raW5nIGFib3V0IHdhcyB0aGUg bWVtYmVyc2hpcCBjaGFuZ2UgcmVrZXlpbmcuICBJZiB5b3UgaGF2ZSAzMCBqb2lucyBpbiB0aGUg Y291cnNlIG9mIGEgbWludXRlLCB5b3UgbWlnaHQgd2FudCB0byBkZWxheSB0aGUgcmVrZXkgbWVz c2FnZXMgc2xpZ2h0bHkgb3IgbWFrZSB0aGUgcHJlc3VtcHRpb24gdGhhdCB0aGVyZSBpcyBub3Qg dHJhZmZpYyB0aGF0IG5lZWRzIHRvIGJlIHByb3RlY3RlZCBvbiBhIGJhY2t3YXJkcyBiYXNpcyB0 byB0aGUgZmlyc3Qgam9pbi4gIFNpbWlsYXIgaXNzdWVzIHdpbGwgYXJpc2UgZm9yIGxlYXZlcy4N CltGUF0gQWggb2ssIHRoYW5rcyBmb3IgdGhlIGNsYXJpZmljYXRpb25zLiBXZSB3aWxsIGRlZmlu aXRlbHkgYWRkIHNvbWUgY29uc2lkZXJhdGlvbnMgYWJvdXQgdGhhdC4gKEFQMjcpDQoNCg0KMy4g IFdoYXQgaGFwcGVucyBpbiB0aGUgZm9sbG93aW5nIHNpdHVhdGlvbnM6DQoNCmEpIFRoZSBrZXkg Y29udGV4dCBpcyBjaGFuZ2VkIGJldHdlZW4gYSByZXF1ZXN0IGJlaW5nIHNlbnQgYW5kIHRoZSBz ZXJ2ZXINCg0KcmVjZWl2aW5nIHRoZSByZXF1ZXN0LiAgVGhpcyBjb3VsZCBqdXN0IGJlIGJlY2F1 c2UgdGhlIHNlbmRlciBkaWQgbm90IGdldA0KDQp0aGUgbm90aWZpY2F0aW9uIG9mIHRoZSBrZXkg Y29udGV4dCBjaGFuZ2luZy4NCg0KYikgVGhlIHJlc3BvbnNlIHRha2VzICJhIHdoaWxlIiB0byBn ZW5lcmF0ZSBhbmQgdGhlIGtleSBjb250ZXh0IGlzIGNoYW5nZWQNCg0KYWZ0ZXIgdGhlIHJlcXVl c3QgaXMgcmVjZWl2ZWQsIGJ1dCBiZWZvcmUgdGhlIHJlc3BvbnNlIGlzIHNlbnQuDQoNClNpdHVh dGlvbnMgYSkgYW5kIGIpIGFyZSBlc3NlbnRpYWxseSB0aGUgc2FtZSwgd2l0aCB0aGUgZGlmZmVy ZW5jZSB0aGF0IHRoZXkgaGFwcGVuIGVpdGhlciBvbiBjbGllbnQgb3Igb24gc2VydmVyICh0aGUg bm9kZSByZWNlaXZlcyBhIG1lc3NhZ2UgZW5jcnlwdGVkIHdpdGggb2xkL25vbiByZWNvZ25pemVk IGNvbnRleHQpLiBXaGF0IGhhcHBlbnMgaW4gdGhhdCBjYXNlIGlzIHRoYXQgdGhlIHJlY2VpdmVy IHdvdWxkIGNvbnRhY3QgdGhlIEtEQyB0byB2ZXJpZnkgdGhhdCBpdHMgb3duIGtleWluZyBtYXRl cmlhbCBoYXMgbm90IGJlaW5nIHVwZGF0ZWQgKHVzaW5nIHRoZSBuZXcg4oCcdXBkYXRl4oCdIG1l dGhvZCBkZWZpbmVkIGluIHBvaW50IDMyKS4gV2hlbiBpdCByZWFsaXplcyBpdCBoYXMgdGhlIGxh dGVzdCBvbmUsIGl0IGRpc2NhcmRzIHRoZSBtZXNzYWdlLCBhbmQgb3B0aW9uYWxseSBzZW5kcyBi YWNrIGFuIGVycm9yIHJlc3BvbnNlIChpbiBjYXNlIGEpIHRoYXQgd291bGQgaGludCB0aGF0IHRo ZSBtZXNzYWdlIGRpZCBub3QgZ28gdGhyb3VnaC4gSW4gY2FzZSBiKSwgd2hlbiB2ZXJpZmljYXRp b24gZmFpbHMgb24gdGhlIGNsaWVudCwgSSB3b3VsZCBleHBlY3QgdGhlIGNsaWVudCB0byBiZSBj b25maWd1cmVkIHRvIHRyeSBhZ2FpbiwgYW5kIHRoaXMgdGltZSBpdCBzaG91bGQgaGl0IHRoZSBu ZXcgc2VjdXJpdHkgY29udGV4dCBvbiB0aGUgc2VydmVyLg0KDQpTZWUgYWxzbyBodHRwczovL2Nv cmUtd2cuZ2l0aHViLmlvL29zY29yZS1ncm91cGNvbW0vZHJhZnQtaWV0Zi1jb3JlLW9zY29yZS1n cm91cGNvbW0uaHRtbCNyZmMuc2VjdGlvbi44LjRhYm91dCBrZWVwaW5nIG9sZCBzZWN1cml0eSBj b250ZXh0IGZvciBhIHdoaWxlLiBEaWQgeW91IHdhbnQgdGhlIHNhbWUgdHlwZSBvZiBjb25zaWRl cmF0aW9ucyBpbiBhY2Uta2V5LWdyb3VwY29tbSBhcyB3ZWxsPw0KDQpbSkxTXSBJbiB0aGUgZmly c3QgY2FzZSBpdCBpcyBhIHNpbXBsZSByYWNlIGNvbmRpdGlvbiBhbmQgc29tZSB0eXBlIG9mIGNv bmZpZ3VyYWJsZSBrZWVwIHRoZSBsYXN0IGNvbnRleHQgZm9yIGEgd2hpbGUgZG9lcyBkZWFsIHdp dGggdGhpcy4gIFRoZSBzZWNvbmQgY2FzZSBpcyBhIGJpdCBkaWZmZXJlbnQgaW4gdGVybXMgb2Yg 4oCTIGRvZXMgdGhlIHJlc3BvbnNlIGdldCBzZW50IHVuZGVyIHRoZSBuZXcgY29udGV4dCwgdGhl IG9sZCBjb250ZXh0IG9yIG5vdCBhdCBhbGwuICBJIGRvbuKAmXQga25vdyB0aGF0IEkgaGF2ZSBh bnkgaWRlYSBvZiB3aGF0IHRoZSByaWdodCBhbnN3ZXIgaXMgYW5kIGhhdmluZyB0aGlzIGRlc2Ny aWJlZCB3b3VsZCBiZSB1c2VmdWwuDQpbRlBdIE9rLCBmb3IgdGhlIGZpcnN0IGNhc2Ugd2Ugd2ls bCBhZGQgdGhlc2UgdHlwZSBvZiBjb25zaWRlcmF0aW9ucyBoZXJlLiAoQVA0MCkuIEkgdW5kZXJz dGFuZCBiZXR0ZXIgeW91ciBjYXNlIGIpOiB0aGUgcmVxdWVzdCBpcyBhY3R1YWxseSBhY2NlcHRl ZC4gV2Ugd291bGQgc2F5OiBpZiB0aGVyZSBhcmUgcG9saWNpZXMgZm9yIGtlZXBpbmcgdGhlIG9s ZCBjb250ZXh0IGZvciBhIHdoaWxlLCBpdCBjb3VsZCBiZSBhY2NlcHRlZCB0aGF0IHRoZSBzZXJ2 ZXIgcHJvdGVjdHMgdGhlIHJlc3BvbnNlIHdpdGggdGhlIG5ldyBzZWMgY3R4LiBJbiB0aGUgZ2Vu ZXJhbCBjYXNlLCBpdCB3b3VsZCBkaXNjYXJkLiBJdCBkZWZpbml0ZWx5IG5lZWQgdG8gYmUgZGVz Y3JpYmVkIChBUDQxKQ0KDQoNCg0KYykgIFRoZSBrZXkgY29udGV4dCBpcyBjaGFuZ2VkIGluIHRo ZSBtaWRkbGUgb2YgYSBibG9jay13aXNlIHRyYW5zZmVyLg0KDQpUbyBtZSB0aGlzIGlzIG5vIGRp ZmZlcmVudCB0aGFuIHRoZSBjYXNlcyBhYm92ZS4gSWYgb25lIGJsb2NrIGZhaWxzLCB0aGUgdG90 YWwgbWVzc2FnZSB3b3VsZCBmYWlsLiBDb25zaWRlcmF0aW9ucyBhYm92ZSBhcHBseS4gRG8geW91 IHRoaW5rIHdlIG5lZWQgYWRkaXRpb25hbCBjb25zaWRlcmF0aW9ucyBhYm91dCBibG9ja3dpc2Ug aGVyZT8NCg0KW0pMU10gT25lIGNvdWxkIHNheSB0aGF0IHRoZSBzZW5kZXIgb2YgdGhlIGJsb2Nr cyBqdXN0IGNoYW5nZXMgdGhlIGtleXMgYW5kIGNvbnRpbnVlcy4gIEFzIGxvbmcgYXMgYm90aCBz aWRlcyBnZXQgdGhlIG5ldyBrZXlpbmcgSSBkb27igJl0IHRoaW5rIHRoYXQgdGhpcyB3b3VsZCBj YXVzZSBhIHByb2JsZW0uICBCdXQgYWdhaW4geWVzIGl0IGhhcyBtdWNoIG9mIHRoZSBzYW1lIGlz c3VlcyBhcyBhYm92ZSBhbHRob3VnaCBpdCBkb2VzIGhhdmUgZnVuIHRoYXQgaXQgYXBwbGllcyB0 byBib3RoIHRoZSBzZW5kZXIgYW5kIHRoZSByZWNpcGllbnQuICBJdCBpcyBtb3JlIHByb2JsZW1h dGljIHRoYW4gdGhlIGFib3ZlIG1lc3NhZ2UgaW4gdGhhdCBkZXBlbmRpbmcgb24gaG93IGZhc3Qg a2V5cyBhcmUgY2hhbmdlZCwgeW91IGFyZSBnb2luZyB0byBjb25zdW1lIGEgbGFyZ2UgYW1vdW50 IG9mIHRoZSBuZXR3b3JrIHJlc2VuZGluZyB0aGUgbWVzc2FnZSBmcm9tIHN0YXJ0IGFnYWluIGFu ZCBhZ2Fpbi4gIFRoaXMgaXMgbW9yZSBvZiBhIHByb2JsZW0gdGhhbiBpdCBpcyBmb3IgY2FzZSBi IGFib3ZlLg0KW0ZQXSBUaGF04oCZcyByaWdodC4gV2Ugd2lsbCB0cnkgdG8gc2tldGNoIHNvbWUg Y29uc2lkZXJhdGlvbnMgYWJvdXQgdGhpcyBhcyB3ZWxsIChBUDQyKS4NCg0KDQoNCkppbQ0KDQot LS0tLS0tLS0tLS0tDQoNCg0K --_000_89396BDA89FD4064B609D557E864C9D7ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <0D78F5D1ED89F9419EF41C79729B977F@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHls ZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBw dCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48 L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9IiMwNTYzQzEiIHZsaW5r PSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPkhpIEppbSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPlRoYW5rcyBmb3IgeW91ciBw cm9tcHQgcmVwbHkhIEkgY3V0IG91dCB0aGUgY29tbWVudHMgdGhhdCB3ZXJlIG9rYXllZCwgYW5k IG9ubHkga2VwdCB0aG9zZSB0aGF0IGVpdGhlciBhcmUgbm90IG9rYXllZCwgbmVlZCBtb3JlIGRp c2N1c3Npb24sIG9yIGZvciB3aGljaCB3ZSBoYXZlIHByb3Bvc2VkIG5ldyBBUHMgZm9sbG93aW5n IHlvdXIgcmVzcG9uc2UuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9y OnJlZCI+DQogQXBwcm92ZWQgQVBzIGFyZSBub3cgdHJhY2tlZCBhcyBnaXRodWIgaXNzdWVzIGFu ZCB3ZSB3aWxsIGJlIHdvcmtpbmcgb24gdGhvc2UgaW4gdGhlIGJyYW5jaCB2LTAyLVdJUC4gTmV3 IGNvbW1lbnRzIGluIHJlZCwgcHJlZmFjZWQgd2l0aCBbRlBdLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOnJlZCI+VGhhbmsgeW91IGFnYWluLDxicj4NCkZyYW5jZXNjYSBhbmQg TWFyY288L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBj bSI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48Yj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+U2VjdXJpdHkgTW9kZWwgYW5kIG90aGVyIGlzc3VlcyBmb3IgZ3JvdXAgbWVzc2FnaW5n IC0gMDkvMDQvMjAxOTwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDcw QzAiPkkgbmVlZCB0byBsb29rIGF0IHRoaXMgbW9yZSBjbG9zZWx5IOKAkyB3aWxsIHJlc3BvbmQg bGF0ZXI8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4t Ym90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOnJlZCI+W0ZQXSBPay4gVGhhbmtzIEppbSBmb3IgdGFraW5nIHRo ZSB0aW1lPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFj ayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+SSBoYXZlIGJlZW4gZ29pbmcgdGhyb3VnaCB0aGUgZGVz aWduIHByb2Nlc3MgZm9yIGdldHRpbmcgc29mdHdhcmUgcnVubmluZzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPmZvciBNb250cmVhbCBhbmQgSSBoYXZlIGNvbWUgYWNyb3NzIHRoZSBmb2xsb3dpbmcgaXNz dWVzIHRoYXQgSSB0aGluayBuZWVkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+c29tZSBkaXNjdXNzaW9u LiBTb21lIG9mIHRoZXNlIG1heSBqdXN0IG5lZWQgY2xhcmlmaWNhdGlvbiBpbiBkb2N1bWVudHMg YnV0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+b3RoZXIgYXJlIG1vcmUgc3Vic3RhbnRpdmUuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+SXQgdG9vayBtZSBhIHdoaWxlIHRvIGRldGVybWluZSB0aGF0IG9uZSBvZiB0 aGUgc3RyYW5nZSBpc3N1ZXMgSSB3YXMgaGF2aW5nPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+aXMgdGhh dCB3aGVuIGxvb2tpbmcganVzdCBhdCB0aGUgbXVsdGljYXN0IGNhc2UgbXkgbWVudGFsIG1vZGVs IG9mIHdobyB3YXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5tYWtpbmcgdGhlIGRlY2lzaW9ucyBvbiBp ZiBhY2Nlc3Mgd2FzIGFsbG93ZWQgZGlkIG5vdCBzZWVtIHRvIG1ha2UgYSBnb29kPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+bWF0Y2ggdG8gd2hhdCB3YXMgYmVpbmcgZG9jdW1lbnRlZC48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5JIHJhdGhlciBleHBlY3RlZCB0aGF0IGFsbCBvZiB0aGUgQUNMPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+ZGVjaXNpb25zIHdlcmUgZ29pbmcgdG8gYmUgbWFkZSBvbiB0aGUgQVMgYW5kIG5v bmUgb24gdGhlIEtEQy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBj bTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlRoaXMgaXMgY29ycmVjdC4gVGhlIG1v ZGVsIGZvciB0aGUgYWNlLWtleS1ncm91cGNvbW0gKGFuZCBjb25zZXF1ZW50bHkgYWNlLWtleS1n cm91cGNvbW0tb3Njb3JlIGFuZCBhY2UtY29hcC1wdWJzdWIpIGlzIHRoYXQgdGhlIEFTIGRvZXMg YWxsIG9mIHRoZSBBQ0wgYW5kDQogS0RDIGRvZXMgdGhlIGtleSBkaXN0cmlidXRpb24uPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2si PlRoaXMgbWVhbnQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj50aGF0IHRoZSBpbmNsdXNpb24gb2Ygc2Nv cGUgaW4gYWxsIG9mIHRoZSBtZXNzYWdlcyB3YXMgcmVkdW5kYW50IGlmIHNlbmRpbmc8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAx cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj5tZXNzYWdlcyB0byBhIHBlciBncm91cCByZXNvdXJjZS48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiM5OTAwRkYiPllvdSBhcmUgY29ycmVjdCwgc2NvcGUgaXMgaW5kZWVkIHJlZHVuZGFudCBpbiBz b21lIG1lc3NhZ2VzLCBmb3IgZXhhbXBsZSBpbiB0aGUgS2V5IERpc3RyaWJ1dGlvbiBSZXF1ZXN0 LCBhcyBpdCBpcyBwcmVzZW50IGluIHRoZSB0b2tlbi4gKFNlZSBwb2ludCAxMiBiZWxvdyk8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+UGFydCBvZiB0aGUgcXVlc3Rpb25zIGludm9sdmVkIGhlcmUgYXJlPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+d2hvIGRvZXMgdGhlIGNvbmZpZ3VyYXRpb24gZm9yIHdoYXQga2V5IGdyb3VwcyBhcmUg YXNzb2NpYXRlZCB3aXRoIHdoYXQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5hcHBsaWNhdGlvbiBncm91 cHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRv bTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+SSB3YXMgYWx3YXlzIHRoaW5raW5nIG9mIGEgc2luZ2xlIGtl eSBncm91cCB3aGljaCB3YXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5pZGVudGlmaWVkIGJ5IHRoZSBB UyBhbmQgc2VudCB0byB0aGUgS0RDIHdpdGhvdXQgdGhlIEtEQyBuZWVkaW5nIHRvIGtub3cgdGhl PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRv bTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+ZGV0YWlscyBvZiBtdWx0aXBsZSByZXNvdXJjZXMgZm9yIHRo YXQga2V5IGdyb3VwLiBUaGlzIG9mIGNvdXJzZSBkb2VzIG5vdDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2si Pm1hdGNoIHRoZSBtb2RlbCBpbiB0aGUgZG9jdW1lbnQuIFNvbWUgdGV4dCBvbiB3aGF0IG1vZGVs IGlzIGJlaW5nIGxhaWQgb3V0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+aXMgcHJvYmFibHkgd29ydGh3 aGlsZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4t Ym90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90 dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPldl4oCZZCBsaWtlIGNsYXJpZmljYXRpb25zIGhlcmU6 IHdoeSBkbyB5b3Ugc2F5IHRoYXQgdGhpcyBkb2VzIG5vdCBtYXRjaCB0aGUgY3VycmVudCBtb2Rl bD8gVGhhdCB3YXMgdGhlIG9iamVjdGl2ZSBhbnl3YXkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJn aW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlRoZXJlIHdhcyBkaXNjdXNz aW9ucyBmb3IgdGhlIEFDRSBPQXV0aCBkb2N1bWVudCBhYm91dCBob3cgdG8gaGFuZGxlPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+bXVsdGlwbGUgYWNjZXNzIHRva2VucyBmb3IgYSBzaW5nbGUgZW50aXR5 IHRoYXQgbmVlZCB0byBiZSBsb29rZWQgYXQgaW4gdGhlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Y29u dGV4dCBvZiBhIEtEQy4gVGhlIGN1cnJlbnQgcnVsZSBpcyB0aGF0IGEgcmVzb3VyY2Ugc2VydmVy IG5lZWRzIG9ubHkgdG88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBj bTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5rZWVwIG9uZSB0b2tlbiBmb3IgYW55 IHNpbmdsZSBzdXBwbGljYW50LiBUaGlzIHdhcyBtb3N0bHkgZGlzY3Vzc2VkIGluIHRoZTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAw MDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6YmxhY2siPmNvbnRleHQgb2YgYWRkaW5nIGFuZCBzdWJ0cmFjdGluZyBwcml2aWxl Z2VzIGZvciB0aGUgc3VwcGxpY2FudC4gSXQgbWF5IGJlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+dGhh dCB0aGlzIGFsc28gbmVlZHMgdG8gYmUgdmlld2VkIGluIHRoZSBjb250ZXh0IG9mIGhhdmluZyBj b21wbGV0ZWx5PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFy Z2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ZGlzam9pbnQgcmVzb3VyY2VzIG9uIGEgc2lu Z2xlIFJTIHdoaWNoIGFyZSBnb2luZyB0byBoYXZlIGRpZmZlcmVudCBBUzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPnRva2VucyBpc3N1ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+VGh1cyBmb3IgZXhhbXBsZSwg aWYgdGhlcmUgaXMgYSBLREMgd2hpY2ggaXMgc2VydmljaW5nIHR3bzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPmRpZmZlcmVudCBrZXkgZ3JvdXBzLiBUaGUgc3VwcGxpY2FudCBnZXRzIGEgdG9rZW4gZm9y IGdyb3VwMSwgZ2V0cyB0aGUga2V5czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmZyb20gdGhlIEtEQy4g SXQgdGhlbiBhc2tzIGZvciBhIHRva2VuIGZvciBncm91cDIuIEdpdmVuIHRoYXQgdGhlPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+bGlmZXRpbWVzIG9mIHRoZXNlIGRpZmZlcmVudCB0b2tlbnMgY291bGQg YmUgcmFkaWNhbGx5IGRpZmZlcmVudCBkb2VzIGl0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+cmVhbGx5 IG1ha2Ugc2Vuc2UgdG8gcmVxdWlyZSB0aGF0IHRoZSB0d28gQVMgdG9rZW5zIGJlIG1lcmdlZCB0 b2dldGhlcjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdp bi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPihhc3N1bWluZyB0aGV5IGFyZSBmcm9tIHRoZSBz YW1lIHNvdXJjZSkgb3Igd291bGQgaXQgbWFrZSBtb3JlIHNlbnNlIHRvPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+cmVsYXggdGhlIFJTIG9ubHkgbmVlZHMgdG8ga2VlcCBvbmUgdG9rZW4gcnVsZS4gQW4g ZWFzeSB3YXkgb3V0IG9mIHRoaXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5taWdodCBiZSB0byBzYXkg b25lIHRva2VuIHBlciByZXNvdXJjZSwgYnV0IGZvciBjb25zdHJhaW5lZCBkZXZpY2VzIGl0IGNv dWxkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+YmUgb25lIHRva2VuIHBlciBSUy48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5 OTAwRkYiPldlIGFncmVlIHdpdGggcmVsYXhpbmcgdGhlIOKAnG9uZSB0b2tlbiBwZXIgUlMgcGVy IGNsaWVudOKAnS4gVGhlIHJlcXVpcmVtZW50IG1ha2VzIHNlbnNlIHdoZW4gb25lIFJTIGlzIGFz c29jaWF0ZWQgd2l0aCBvbmUgQVMsIGJ1dCBpbiBvdXIgY2FzZSB0aGUgS0RDIGNvdWxkDQogYmUg YXNzb2NpYXRlZCB3aXRoIHNldmVyYWwgQVMgZm9yIGRpZmZlcmVudCBzY29wZXMuIDwvc3Bhbj48 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHotMjQjc2VjdGlvbi01LjEiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkY7YmFja2dyb3VuZDp3aGl0ZSI+ZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHotMjQjc2VjdGlvbi01LjE8L3NwYW4+PC9hPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkw MEZGO2JhY2tncm91bmQ6d2hpdGUiPnNheXMgJnF1b3Q7Li4uIHRoZSBBUyBpbiBjaGFyZ2Ugb2Yg YSByZXNvdXJjZSBob3N0ZWQgYXQgdGhlIFJTIC4uLiZxdW90OyAmbmJzcDtTbyB0aGlzIGlzIGEg bW9yZSBnZW5lcmFsIHByb2JsZW0sIGFzIGl0IGlzIGFsbG93ZWQgaW4gdGhlIEFDRSBmcmFtZXdv cmsNCiB0byBoYXZlIG11bHRpcGxlIEFTcyBjb3ZlcmluZyBkaWZmZXJlbnQgcmVzb3VyY2VzL3Nj b3BlcyBhdCBhIHNhbWUgUlMuIFdlIHRoaW5rIHRoaXMgcmVxdWlyZW1lbnQgc2hvdWxkIGJlIHJl bGF4ZWQgaW4gdGhlIGdlbmVyYWwgY2FzZSwgYXMgbWVyZ2luZyB0b2tlbnMgZnJvbSBkaWZmZXJl bnQgQVNzIHdvdWxkIGRlZmluaXRlbHkgYmUgYSBwcm9ibGVtLiBXZeKAmWQgbGlrZSB0byByYWlz ZSB0aGlzIGlzc3VlIHRvIHRoZSBBQ0UgZnJhbWV3b3JrIGF1dGhvcnMNCiBhbmQgZ2V0IGZlZWRi YWNrIGZyb20gdGhlIFdHLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90 dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5KaW08L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206 MTIuMHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207 bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRv bTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTou MDAwMXB0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+ZHJhZnQtaWV0Zi1hY2Uta2V5LWdyb3VwY29tbSAtIDAzLzA0 LzIwMTkgMDM6MDA8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjow Y207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207 bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+My4gJm5ic3A7VGhlIGRvY3VtZW50IGRv ZXMgbm90IGhhdmUgYSB0YWJsZSB3aGljaCBkZWFscyB3aXRoIGFiYnJldmlhdGlvbnMsIGRvZXM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9t Oi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOmJsYWNrIj50aGlzIG1lYW4gdGhhdCB0aGUgZnVsbCB0ZXh0IHN0cmluZyBp cyB3aGF0IGlzIGdvaW5nIHRvIGJlIHRoZSBrZXk/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg c3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+RGVwZW5k aW5nIG9uIHRoZSBjb250ZW50IHR5cGUgYmVpbmcgY29uc2lkZXJlZCwgdGhlc2UgdmFsdWVzIGNv dWxkIGJlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+YXNzaWduZWQgKG5ldyByZWdpc3RyeSkgb3IgbWFy a2VkIGFzIFRCRCwgYnV0IGlmIHRoaXMgaXMgc3VwcG9zZWQgdG8gaGFwcGVuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+dGhlbiBpdCBuZWVkcyB0byBiZSBwbGFjZWQgaW4gdGhlIGRvY3VtZW50Ljwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAw MDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFw dCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6Izk5MDBGRiI+WWVzLCB3ZSBuZWVkIHRvIGRvIHRoaXMuIFdlIHdpbGwgY3JlYXRlIGEg bmV3IHJlZ2lzdHJ5IGZvciB0aGVtLCBhbmQgcmUtdXNlIHRoZSBzYW1lIG51bWJlciBhcyBBQ0Ug YXMgbXVjaCBhcyBwb3NzaWJsZSAoZm9yIHBhcmFtZXRlcnMgdGhhdCBhcHBlYXIgaW4gYm90aCwN CiBzdWNoIGFzIOKAmHByb2ZpbGXigJksIOKAmGV4cOKAmSkgKEFQMyk8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjojMDA3MEMwIj5bSkxTXSBTb3VuZHMgcmVhc29uYWJsZS4gJm5i c3A7SSBhbSBjdXJyZW50bHkgYnVpbGRpbmcgYSBzcHJlYWRzaGVldCB3aXRoIHNvbWUgb2YgdGhp cyBkYXRlIGFuZCB3aWxsIGZvcndhcmQgaXQgdG8geW91Ljxicj4NCjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpyZWQiPltGUF0gR290IGl0LCB0aGFuayB5b3UgZm9y IHRoYXQsIGl0IHdpbGwgYmUgdmVyeSB1c2VmdWwhPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOiMwMDcwQzAiPjxicj4NCjxicj4NCjxicj4NCjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPjYuICZuYnNwO1NlY3Rpb24gMy4xIC0gSXMgdGhlcmUgYSByZWFzb24gd2h5IG9uZSBj YW5ub3QgcmVxdWVzdCBhY2Nlc3MgZnJvbSB0aGU8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5BUyBmb3Ig bXVsdGlwbGUgZ3JvdXBzL3RvcGljcyBpbiB0aGUgc2FtZSByZXF1ZXN0IHRvIHRoZSBBUz8gJ3Nj b3BlJzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1i b3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2si Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0 b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+VGhpcyB3YXMgdGhlIGNhc2UgaW4gYSBwcmV2aW91cyB2 ZXJzaW9uIG9mIHRoZSBkb2N1bWVudC4gV2UgZ290IGZlZWRiYWNrIHRoYXQgdGhpcyB3YXMgdG9v IGNvbXBsaWNhdGVkIGFuZCBub3QgYSBob3QgbmVlZC4gV2UgY2FuIHJlY29uc2lkZXIgaWYgbW9y ZSBwZW9wbGUNCiBpbiB0aGUgV0cgd2FudCB0aGlzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOiMwMDcwQzAiPltKTFNdIEkgY2FuIHVuZGVyc3RhbmQgdGhpcyByZWFjdGlvbi4g Jm5ic3A7WW91IG1pZ2h0IGFsc28gbG9vayBhdCB0aGUgTVFUVCBkb2N1bWVudCB3aGljaCBpcyBh bGxvd2luZyBmb3IgdGhpcyBhbmQgc2VlIGlmIGFsaWdubWVudCBpcyBuZWVkZWQuPGJyPg0KPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQXSBPaywgd2Ug d2lsbCAoQVAyOSk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAw NzBDMCI+PGJyPg0KPGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Ny4gJm5ic3A7U2Vj dGlvbiAzLjEgLSBJcyB0aGVyZSBhIGRlZmluaXRpb24gb2YgdGhlIHZhbHVlcyBmb3IgJnF1b3Q7 cm9sZSZxdW90OyB0aGF0IGNhbiBiZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnJlcXVlc3RlZC4gJm5i c3A7V2hhdCBpcyB0aGUgdHlwZSBvZiB0aGlzIGZpZWxkIGZvciBhIHNpbmdsZSB2YWx1ZSwgb3Ig Zm9yPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ZWxlbWVudHMgb2YgdGhlIGFycmF5PyAmbmJzcDtJcyB0 aGVyZSBhIGRlZmF1bHQgaWYgcm9sZSBpcyBvbWl0dGVkIG9uIHRoZTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPnJlcXVlc3Q/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207 bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFy Z2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5UaGVyZSBpcyBubyBkZWZpbml0aW9uIGlu IHRoaXMgZG9jIGZvciBzcGVjaWZpYyBhZG1pdHRlZCB2YWx1ZXMsIHRoYXQgaXMgZGVmaW5lZCBv biB0aGUgYWRkaXRpb25hbCBpbnN0YW5jZXMgKGFjZS1rZXktZ3JvdXBjb21tLW9zY29yZSwgYWNl LWNvYXAtcHVic3ViKS4NCiBSb2xlcyBhcmUgc3BlY2lmaWMgdG8gdGhlIGFwcGxpY2F0aW9ucywg c28gaXQgbWFrZXMgbGl0dGxlIHNlbnNlIHRvIHNwZWNpZnkgdGhlbSBpbiBnZW5lcmFsLiBUaGUg ZGVmYXVsdCB2YWx1ZSwgaWYgYW55LCB3b3VsZCBhbHNvIGJlIGRlZmluZWQgaW4gdGhlIGluc3Rh bmNlcy4gV2hhdCB3ZSB3aWxsIGRvIGlzIHRvIGNsYXJpZnkgdGhpcyBpbiB0aGUgdGV4dC4gTW9y ZW92ZXIsIHRoaXMgd2lsbCBiZSBwYXJ0IG9mIHRoZSDigJxNYW5kYXRvcnkgdG8NCiBkZWZpbmXi gJ0gKHNlZSBwb2ludCAzOSkuIChBUDYpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29s b3I6IzAwNzBDMCI+W0pMU10gSSB3aWxsIG5lZWQgdG8gdGhpbmsgYWJvdXQgdGhpcy4gJm5ic3A7 SXQgbWF5IG1ha2UgdGhpbmdzIGhhcmQgb24gdGhlIEFTIGRlcGVuZGluZyBvbiBob3cgaXQgaXMg ZGVzaWduZWQuPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9y OnJlZCI+W0ZQXSBPaywgd2Ugd2lsbCBob2xkIG9mZiBvbiB0aGlzIEFQIHVudGlsIHdlIGdldCBt b3JlIGRpc2N1c3Npb24uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjow Y207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+OC4gJm5ic3A7U2VjdGlvbiAzLjIg LSBJTiB0aGUgbGFzdCBwYXJhZ3JhcGggZGlkIHlvdSBtZWFuIHRvIHNheSB0aGF0IGEgbmV3IHRv a2VuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+d291bGQgYmUgcmV0dXJuZWQgb3IgdGhhdCB0aGUgZXhp c3RpbmcgdG9rZW4gY2FuIGJlIHJldHVybmVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+VGhhdCBhIG5l dyB0b2tlbiB3b3VsZCBiZSByZXR1cm5lZC4gSG93IGNhbiB3ZSBjbGFyaWZ5Pzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAiPltKTFNdIFRoZSBzdHJpbmcg4oCcY2Fu IHNpbXBseSByZXBsYXkgd2l0aOKAnSBpcyB3aGF0IG1lc3NlZCBtZSB1cC4gJm5ic3A7QmV0dGVy IHdvdWxkIGJlIOKAnHRoZSBBUyByZXBsaWVzIHdpdGggYW4gQXV0aG9yaXphdGlvbiBSZXNwb25z ZSB3aXRoIGEgbmV3IGFjY2VzcyB0b2tlbi7igJ0gJm5ic3A7VGhlIHVzZSBvZiDigJxjYW7igJ0g aXMgbm90IHRoZSBzYW1lIGFzIOKAnHdpbGzigJ0uPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQXSBPaywgdGhhbmtzIGZvciB0aGUgY2xhcmlm aWNhdGlvbi4gV2lsbCBmaXggKEFQMzApPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+OS4gJm5ic3A7U2Vj dGlvbiA0LjEgLSBJZiB0aGUgJ2NsaWVudF9jcmVkJyBmaWVsZCBpbiBhIHJlcXVlc3QgaXMgZmls bGVkIGluLCBhbmQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5pdCBpcyBub3QgdGhlIHNhbWUgYXMgdGhl IHB1YmxpYyBrZXkgdXNlZCB0byBlc3RhYmxpc2ggdGhlIFRMUyBzZXNzaW9uPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+YmV0d2VlbiB0aGUgY2xpZW50IGFuZCB0aGUgS0RDLCB3aGF0IGlzIHRoZSBwcm9j ZWR1cmUgdG8gZG8gYSBQT1Agb24gdGhpczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmtleT88L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAx cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM5OTAwRkYiPkluIHRoZSBzcGVjaWZpYyBjYXNlIHlvdSBkZXNjcmliZSwgYW4gZWFzeSBz b2x1dGlvbiB3b3VsZCBiZSB0byByZXF1aXJlIHRoZSBjbGllbnQgdG8gdXNlIHRoZSBzYW1lIGtl eSBpbiDigJhjbGllbnRfY3JlZOKAmSBhbmQgdG8gZXN0YWJsaXNoIHRoZSBUTFMgc2Vzc2lvbiwN CiBhbmQgdGhhdCB3b3VsZCBzb2x2ZSB0aGUgUE9QLiBCdXQgd2UgZG8gaGF2ZSB0aGUgb3BlbiBw b2ludCBvbiBQT1AgZm9yIHRoZSBwdWJsaWMga2V5IGluIHRoZSBnZW5lcmFsIGNhc2UuIFVudGls IG5vdywgd2Uga2VwdCB0aGF0IG91dCBvZiB0aGUgc2NvcGUgb2YgdGhpcyBhbmQgZGVwZW5kZW50 IGRvY3VtZW50cyAoc2VlIHNlY3Rpb24gOCBvZiBhY2Uta2V5LWdyb3VwY29tbS1vc2NvcmUpLCBi dXQgd2UgYXJlIGxvb2tpbmcgdG8gaW5jbHVkZSBpdC48L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPk9uZSBw b3NzaWJpbGl0eSB3ZSBhcmUgY29uc2lkZXJpbmcgaXMgdG8gc2lnbiB0aGUga2V5IGRpc3RyaWJ1 dGlvbiByZXF1ZXN0IHRvZ2V0aGVyIHdpdGggYSBub25jZSB0aGF0IHdhcyBzZW50IGZyb20gdGhl IEtEQyAoZm9yIHRoZSBzYWtlIG9mIGZyZXNobmVzcyksICZuYnNwO3VzaW5nDQogdGhlIHByaXZh dGUga2V5IHBhaXJlZCB0byB0aGUgcHVibGljIGtleSBzZW50IGluIOKAmGNsaWVudF9jcmVk4oCZ LiBEbyB5b3UgaGF2ZSBmZWVkYmFjayBhYm91dCB0aGlzPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwNzBDMCI+ W0pMU10gdGhhdCB3b3VsZCBiZSBhIHJlYXNvbmFibGUgc29sdXRpb24uICZuYnNwO1lvdSBjb3Vs ZCBwb3RlbnRpYWxseSBhbHNvIHVzZSBhIFRMUyBleHBvcnRlciB2YWx1ZSBhcyB0aGF0IHdvdWxk IGJlIGNoYW5uZWwgYm91bmQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPltGUF0gT2ssIHdlIHdpbGwgc3Rh cnQgYnkgc2tldGNoaW5nIHRoaXMgc29sdXRpb24sIHdlIGNhbiBkaXNjdXNzIG1vcmUgYWZ0ZXIg d2UgaGF2ZSBhIHByb3Bvc2FsLiAoQVAzMSk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNt O21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjEyLiBTZWN0aW9uIDQuMiAtIEkgYW0g bm90IGNvbXBsZXRlbHkgc3VyZSB0aGF0IEkgdW5kZXJzdGFuZCB3aGF0PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+dmVyaWZpY2F0aW9uIGNoZWNraW5nIG1lYW5zIGluIHRoZSBmaXJzdCBwYXJhZ3JhcGgu PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRv bTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTou MDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojOTkwMEZGIj5UaGUgS0RDIHZlcmlmaWVzIHRoYXQgdGhlIOKAmHNjb3Bl4oCZ IHJlY2VpdmVkIGluIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgaXMgdGhlIHNhbWUgYXMg 4oCYc2NvcGXigJkgc3RvcmVkIGluIHRoZSBhY2Nlc3MgdG9rZW4gYXNzb2NpYXRlZCB0byB0aGlz IGNsaWVudC4gVGhpcw0KIHNjb3BlIGZpZWxkIGlzIG5vdCBzdHJpY3RseSBuZWNlc3NhcnksIGFz IGFsbCB0aGUgaW5mbyBpcyBpbiB0aGUgdG9rZW4gYW55d2F5ICh3aGljaCBpcyB3aHkgaXQgaXMg b3B0aW9uYWwpLiBCdXQgaW1wbGVtZW50YXRpb24gZmVlZGJhY2sgd2FzIHRoYXQgaXQgaXMgZ29v ZCB0byBoYXZlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAiPltK TFNdIERvZXMgaXQgaGF2ZSB0byBiZSBlcXVhbCBvciBjYW4gaXQgYmUgYSBzdWJzZXQ/PGJyPg0K PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQXSBSaWdo dCwgaXQgY2FuIGJlIGEgc3Vic2V0LiBXaWxsIGFkZCB0aGF0IChBUDMyKTxicj4NCjxicj4NCjxi cj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1i b3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjEzLiBTZWN0aW9uIDQuMiAtIFdoYXQgaXMgdGhlIHBy b2ZpbGUgdGhhdCBJIGFtIGNoZWNraW5nIGZvciB0aGUgJ2t0eSc8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNr Ij5maWVsZD8gJm5ic3A7V2FzIEkgc3VwcG9zZWQgdG8gaGF2ZSBhIGNoYW5jZSB0byByZXF1ZXN0 IGEgcHJvZmlsZSBzb21lcGxhY2U/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5UaGUgcHJvZmlsZSBjaGVj a2luZyBpcyBhZ2FpbnN0IHRoZSBBQ0UgR3JvdXBjb21tIFByb2ZpbGUgcmVnaXN0cnkgZGVmaW5l ZCBoZXJlLCBpLmUuIGZvciBub3cgZWl0aGVyICZxdW90O2NvYXAtZ3JvdXAtb3Njb3JlJnF1b3Q7 IG9mICZxdW90O2NvYXAtcHVic3ViJnF1b3Q7IChzbyBub3QgdGhlIHNhbWUNCiBhcyB0aGUgQUNF IHByb2ZpbGUpLiBUaGlzIGlzIHRvIG1ha2Ugc3VyZSB0aGF0IHRoZSBjb3JyZWN0IHR5cGUgb2Yg a2V5IGlzIHVzZWQsIGFzIGRlZmluZWQgaW4gdGhlIGluc3RhbmNlIGRvY3VtZW50IHVzZWQgKHN1 Y2ggYXMgYWNlLWtleS1ncm91cGNvbW0tb3Njb3JlKS4gTm8sIHRoZSBjbGllbnQgZG8gbm90IHJl cXVlc3QgdGhlIHByb2ZpbGUsIHRoZSBBUyBkZXRlcm1pbmVzIGl0IGFuZCBzZW5kcyBpdCB0byB0 aGUgQ2xpZW50IGluIHRoZSBLZXkNCiBEaXN0cmlidXRpb24gUmVzcG9uc2UuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMDA3MEMwIj5bSkxTXSBJ4oCZbGwgaGF2ZSB0byBsb29rIGF0IHRoaXMgZHVyaW5nIGltcGxl bWVudGF0aW9uLjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPltGUF0gT2suIFRvIG1ha2UgdGhpcyBlYXNp ZXIsIHdlIHdpbGwgYWxzbyBjbGFyaWZ5IGluIHRoZSB0ZXh0IHRoZSBkaWZmZXJlbmNlIGJldHdl ZW4g4oCcdHJhbnNwb3J0IHByb2ZpbGVz4oCdIChzdWNoIGFzIERUTFMgcHJvZmlsZSwgT1NDT1JF IHByb2ZpbGUsIE1RVFQgcHJvZmlsZSkgYW5kIOKAnGFwcGxpY2F0aW9uIHByb2ZpbGVz4oCdIChz dWNoIGFzDQogJm5ic3A7YWNlLWtleS1ncm91cGNvbW0tb3Njb3JlIG9yIGFjZS1jb2FwLXB1YnN1 YikgKEFQMzMpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAw MDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6YmxhY2siPjE0LiBTZWN0aW9uIDQuMiAtIFB1dCB0aGUgZmFjdCB0aGF0IHRoZSAn a2V5JyBmaWVsZCBpcyBwcm9maWxlIGRlcGVuZGVudCBvbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRo ZSAna3R5JyBpbiB0aGUgJ2tleScgcGFyYWdyYXBoLiAmbmJzcDtJcyBpdCBsZWdhbCB0byBkZWZp bmUgYSAna3R5JyB3aGljaCBkb2VzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+bm90IGhhdmUgYSAna2V5 JyBmaWVsZD8gJm5ic3A7SWYgc28gdGhlbiBzaG91bGQgdGhpcyBmaWVsZCBiZSBkZWZpbmVkIGJ5 IHRoZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1i b3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnByb2ZpbGU/ICZuYnNwO09rLCBJIGp1c3QgcmVhZCB0 aGUgZnVsbCBuZXh0IHBhcmFncmFwaCBhbmQgbm93IEkgYW0ganVzdDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPmNvbmZ1c2VkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNt O21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29s b3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21h cmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+WWVzLCAna2V5JyBmb3JtYXQgaXMgZGVw ZW5kZW50IG9uICdrdHknLiBBbHNvIHllcywgaW4gdGhlb3J5IG9uZSBwcm9maWxlIGNvdWxkIGRl ZmluZSBhIOKAmGt0eeKAmSBmb3Igd2hpY2gg4oCYa2V54oCZIGlzIGVtcHR5IChOb3RlIHRoYXQg dGhlIOKAmGtleeKAmSBmaWVsZCBpdHNlbGYgTVVTVA0KIGJlIHByZXNlbnQgaW4gdGhlIENCT1Ig bWFwKS4gV2hhdCBpcyB1bmNsZWFyIGFuZCB3aGF0IHBhcmFncmFwaCBhcmUgeW91IHJlZmVycmlu ZyB0bz88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBj bSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+MTUuIFNlY3Rpb24gNC4yIC0gV2hhdCBpcyB0aGUgdHlwZSBvZiBwcm9maWxl Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0 b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206 LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6Izk5MDBGRiI+SW50LCBhcyBzcGVjaWZpZWQgaW4gdGhlICZxdW90O0NCT1Ig VmFsdWUmcXVvdDsgY29sdW1uIG9mIHRoZSBBQ0UgR3JvdXBjb21tIFByb2ZpbGUgaW4gU2VjdGlv biA5LjIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDA3MEMwIj5bSkxTXSBUZXh0IGdpdmVzIGEgdHlwZSBmb3Ig dGhlIG90aGVyIGZpZWxkcywgb3Igc2F5cyBpcyBwcm9maWxlIHNwZWNpZmljLCBidXQgbm90IHRo YXQgb25lPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOnJlZCI+W0ZQXSBPaywgd2Ugd2lsbCBhZGQgdGhhdCBpbiB0 aGUgdGV4dCBhcyB3ZWxsLiAoQVAzNCk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21h cmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjIxLiBTZWN0aW9uIDUgLSBJcyB0aGVyZSBz b21lIHR5cGUgb2YgcmVxdWlyZW1lbnQgZm9yIHBvc2l0aXZlIGRlbGl2ZXJ5IG9mPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+bmV3IGtleXMgaW4gdGhlIGV2ZW50IG9mIGEgS0RDIGNoYW5naW5nIHRoZSBr ZXkuICZuYnNwO0kgcHV0IHRoaXMgaGVyZSB3cnQgYSBub2RlPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ bGVhdmluZywgYnV0IGl0IGFwcGxpZXMgZXF1YWxseSB0byBhIG5vZGUgZ2V0dGluZyBpdHNlbGYg YWRkZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFj ayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJv dHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5XZSBhcmUgbm90IHN1cmUgd2UgdW5kZXJzdGFuZCB0 aGlzIHF1ZXN0aW9uLiBBcmUgeW91IGFza2luZyBhYm91dCBBQ0sgb2YgKHN1Y2Nlc3NmdWwpIGRl bGl2ZXJ5IG9mIG5ldyBrZXlzPyBJbiB0aGF0IGNhc2UsIGlmIHRoZSByZWtleWluZyBpcyBwZXJm b3JtZWQgbm9kZS1ieS1ub2RlDQogYXMgZGVzY3JpYmVkIGluIHRoaXMgZG9jdW1lbnQsIHVzaW5n IGNvbmZpcm1hYmxlIG1lc3NhZ2VzIHNob3VsZCBiZSBlbm91Z2guIE90aGVyd2lzZSwgaXQgd291 bGQgYmUgbW9zdGx5IGxlZnQgdG8gdGhlIHNpbmdsZSBub2RlcyB0byBldmVudHVhbGx5IGZpbmQg b3V0IHRoYXQgdGhleSBhcmUgdXNpbmcgc3RhbGUga2V5IG1hdGVyaWFsIGFuZCBzaG91bGQgaW5k aXZpZHVhbGx5IGFzayBmb3IgdGhlIGxhdGVzdCBvbmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDA3MEMwIj5b SkxTXSBGb3Igc29tZSB0eXBlcyBvZiBsaXN0cywgaXQgbWFrZXMgc2Vuc2UgdGhhdCB0aGVyZSBz aG91bGQgYmUgc29tZSB0eXBlIG9mIGZvcmNpbmcgZnVuY3Rpb24gdGhhdCBhIHNlbmRlciBpcyBn b2luZyB0byB1bmRlcnN0YW5kIHRoYXQgdGhlcmUgYXJlIG5ldyBrZXlzDQogYmVmb3JlIHNlbmRp bmcgYSBtZXNzYWdlIG91dC4gJm5ic3A7VGhpcyB3b3VsZCByZXF1aXJlIGEgcG9zaXRpdmUgZGVs aXZlcnkgb3IgYSBwb2xpY3kgdGhhdCBzYXlzIGFsd2F5cyBjaGVjayBiZWZvcmUgc2VuZGluZy4m bmJzcDsgRG9pbmcgYSBtdWx0aWNhc3QgbWVzc2FnZSBjYW5ub3QgYmUgZG9uZSBjb25maXJtYWJs ZSBhY2NvcmRpbmcgdG8gdGhlIG5vcm1hbCBzcGVjaWZpY2F0aW9ucyBzbyB5b3Ugd291bGQgbm90 ICZuYnNwO25lY2Vzc2FyaWx5IGRvIGEgZmFzdCBub3RpZmljYXRpb24NCiBpZiBpdCBuZWVkcyB0 byBiZSBkb25lIG9uIGluZGl2aWR1YWwgbWVzc2FnZXMuJm5ic3A7IEkgYW0gbm90IHN1cmUgd2hh dCwgaWYgYW55dGhpbmcsIG5lZWRzIHRvIGJlIHNhaWQgaGVyZS4mbmJzcDsgVGhpcyBtYXkganVz dCBiZSBjb25zaWRlcmF0aW9ucyBzb21lcGxhY2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnJlZCI+W0ZQXSBPaywg d2Ugd2lsbCBhZGQgdGhlIGZvbGxvd2luZyBjb25zaWRlcmF0aW9uIOKAnEluIHRoZSBjYXNlIHdo ZXJlIGl0IGlzIHJlcXVpcmVkIHRoYXQgYSBub2RlIG9ubHkgdXNlcyB1cC10by1kYXRlIGtleXMg Zm9yIHNlbmRpbmcgZ3JvdXAgbWVzc2FnZXMsIHNpbmNlIENPTg0KIGlzIG5vdCBzdXBwb3J0ZWQg aW4gZ3JvdXAgY29tbXVuaWNhdGlvbiwgdGhlIGFwcGxpY2F0aW9uIG5lZWRzIHRvIHNldCB1cCBh IG1lY2hhbmlzbSB0byBjaGVjayB0aGUgc3VjY2Vzc2Z1bCBkZWxpdmVyeSBvZiB0aGUgbWVzc2Fn ZSwgb3IgcG9saWNpZXMgdG8gYWx3YXlzIHVwZGF0ZSB0aGUga2V5cyBiZWZvcmUgc2VuZGluZy4g U3VjaCBtZWNoYW5pc21zIGFyZSBvdXQgb2Ygc2NvcGUgb2YgdGhpcyBkb2N1bWVudC7igJ0gV291 bGQgdGhhdCBjb3Zlcg0KIHlvdXIgcG9pbnQ/IChBUDM1KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2lu LWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4yMi4gJm5ic3A7U2VjdGlv biA1LjEgLSBUaGVyZSBjdXJyZW50bHkgaXMgbm8gd2F5IGZvciBhbiBBUyB0byBjb21tdW5pY2F0 ZSB0byB0aGU8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJn aW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5LREMgdGhhdCBhbiBhdXRob3JpemF0aW9uIGhh cyBiZWVuIHJldm9rZWQuICZuYnNwO1RoZXJlIGlzIG9ubHkgYSB3YXkgZm9yIGEgS0RDPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+dG8gYXNrIHRoZSBBUyBieSBpbnRyb3NwZWN0aW9uLiAmbmJzcDtUaGUg Zmlyc3Qgc2VudGVuY2UgaXMgcHJvYmxlbWF0aWMuICZuYnNwO0RvIHdlPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+bmVlZCBzb21lIHR5cGUgb2YgZXh0ZW5zaW9uIHRvIHN1cHBvcnQgdGhpcz88L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAx cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM5OTAwRkYiPlJpZ2h0LCB0aGF0IGlzIG5vdCBkZWZpbmVkIGluIEFDRSwgd2Ugd2lsbCBy ZW1vdmUgdGhpcyBzZW50ZW5jZS4gV2XigJlkIGFsc28gbGlrZSB0byBnZXQgZmVlZGJhY2sgZnJv bSB0aGUgV0cgYWJvdXQgdGhpcy4gKEFQMTQpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Y29sb3I6IzAwNzBDMCI+W0pMU10gTWFrZXMgc2Vuc2UuICZuYnNwO0kgdGhpbmsgdGhpcyBqdXN0 IG5lZWRzIHRvIGJlIGhpZ2hsaWdodGVkIGFzIGludHJvc3BlY3Rpb24uICZuYnNwO0l0IG1pZ2h0 IGJlIG5pY2UgdG8gZGVmaW5lIGEgbXVsdGlwbGUgdG9rZW4gaW50cm9zcGVjdGlvbiBtZXNzYWdl IGF0IHNvbWUgcG9pbnQgdG8gdGhlIEtEQyBjb3VsZCwgaW4gYSBzaW5nbGUgbWVzc2FnZSwgZ2V0 IGFsbCBvZiB0aGUNCiBzdGF0dXNlcyBiZWZvcmUgZG9pbmcgYSBrZXkgdXBkYXRlIG9wZXJhdGlv bi48YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6cmVkIj5b RlBdIE9rLCB3ZSB3aWxsIGRlbGV0ZSB0aGF0IGZpcnN0IHNlbnRlbmNlIGFuZCByZXBsYWNlIHdp dGgg4oCcSWYgdGhlIG5vZGUgaXMgbm90IGF1dGhvcml6ZWQgYW55bW9yZSwgdGhlIEtEQyBjYW4g b3B0aW9uYWxseSBnZXQgdGhhdCBpbmZvcm1hdGlvbiBmcm9tIHRoZSBBUyB2aWEgdGhlIEludHJv c3BlY3Rpb24gRW5kcG9pbnQgKHNlZSBTZWN0aW9uIDUuNyBvZiBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoeinigJ0uDQogKEFQMTQpPGJyPg0KWWVzLCB3ZSBhZ3JlZSBpdCB3b3VsZCBiZSBuaWNl IChpdCB3b3VsZCBiZSBlbm91Z2ggdG8gYWxsb3cgZm9yIGFuIGFycmF5cyBvZiB0b2tlbnMgcmF0 aGVyIHRoYW4gb25lIHRva2VuIGluIHRoZSBwYXlsb2FkIG9mIHRoZSBpbnRyb3NwZWN0aW9uIHJl cXVlc3QsIHNlY3Rpb24gNS43LjEgb2YgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHopLiBJdCB3 b3VsZCBiZSBhbHNvIG5pY2UgZm9yIHRoZSBDbGllbnQgdG8gYmUgYWJsZSB0byBPYnNlcnZlIHRo ZQ0KIGludHJvc3BlY3Rpb24gZW5kcG9pbnQgYXQgdGhlIEFTLiBXZSBzaG91bGQgZGVmaW5pdGVs eSBkaXNjdXNzIHRoZXNlIDIgcG9pbnRzICZuYnNwO3dpdGggTHVkd2lnIGFuZCB0aGUgV0csIGFz IHRoaXMgbWlnaHQgYmUgbW9yZSBnZW5lcmFsIHRoYW4gYWNlLWtleS1ncm91cGNvbW0sIGFsdGhv dWdoIHdlIHdvdWxkIGRlZmluaXRlbHkgbWFrZSB1c2Ugb2YgaXQuPGJyPg0KPGJyPg0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+MjMuICZuYnNwO1NlY3Rpb24gNS4yIC0gSWYgYSB0b3BpYyBpcyBwcm92 aWRlZCBhbmQgdGhlIHVzZXIgaXMgYXV0aG9yaXplZCBmb3IgdHdvPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+dG9waWNzIHdoaWNoIHVzZSB0aGUgc2FtZSBncm91cCwgd2hhdCBoYXBwZW5zIGlmIHRoZSB1 c2VyIGFza3MgdG8gbGVhdmUgb25lPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+b2YgdGhvc2UgdHdvIHRv cGljcyBidXQgd2FudHMgdG8gc2F5IG9uIHRoZSBvdGhlcj8gJm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkw MEZGIj5TZWUgc2VjdGlvbiA1LjI6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj4mbmJzcDsmbmJzcDtOb3Rl IHRoYXQgdGhlICdyb2xlJyBmaWVsZCBpcyBvbWl0dGVkIHNpbmNlIHN1Y2ggYSByZXF1ZXN0IHNo b3VsZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1i b3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+Jm5ic3A7b25seSBiZSB1c2VkIHRvIGxlYXZlIGEg Z3JvdXAgYWx0b2dldGhlci4gJm5ic3A7SWYgdGhlIGxlYXZpbmcgbm9kZSB3YW50czwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFw dCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6Izk5MDBGRiI+Jm5ic3A7dG8gYmUgcGFydCBvZiBhIGdyb3VwIHdpdGggZmV3ZXIgcm9s ZXMsIGl0IGRvZXMgbm90IG5lZWQgdG88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0i bWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPiZuYnNwO2NvbW11 bmljYXRlIHRoYXQgdG8gdGhlIEtEQywgYW5kIGNhbiBzaW1wbHkgc3RvcCBhY3RpbmcgYWNjb3Jk aW5nIHRvPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj4mbmJzcDtzdWNoIHJvbGVzLjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 Izk5MDBGRiI+SWYgdHdvIHRvcGljcyAoYXBwbGljYXRpb24gZ3JvdXBzKSBhcmUgY292ZXJlZCBi eSB0aGUgc2FtZSBzZWN1cml0eSBncm91cCwgYW5kIGEgdXNlciB3YW50cyB0byBzdG9wIGZvbGxv d2luZyBvbmUgdG9waWMgd2hpbGUgc3RpbGwgYmVpbmcgYXV0aG9yaXplZCwgaXQgZG9lcw0KIG5v dCBuZWVkIHRvIGxlYXZlIHRoZSBzZWN1cml0eSBncm91cCwgaXQgY2FuIGp1c3QgZGlzY2FyZCBm dXR1cmUgbWVzc2FnZXMgcmVsYXRlZCB0byB0aGF0IHRvcGljLiBUaGUgYWN0dWFsIGxlYXZpbmcg b2YgYXBwbGljYXRpb24gZ3JvdXBzLCBlLmcuIHVuc3Vic2NyaWJpbmcgZnJvbSBhIHRvcGljLCBp cyBvdXQgb2YgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gQnV0IHRoZSBzY29wZSBmaWVsZCBpcyBpbmNs dWRlZCBpbiB0aGUgdG9rZW4uICZuYnNwO0kgYW0gbm90IHN1cmUgdGhhdCBJIHNlZSBhbnkgdXNl IG9mIHRoZSBzY29wZSBmaWVsZCBoZXJlIGF0IGFsbC48YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6cmVkIj5bRlBdIFJpZ2h0LiBXZSBwcm9wb3NlIHRoZSBm b2xsb3dpbmcgY2hhbmdlOiBtYWtlIHNjb3BlIG9wdGlvbmFsIGluIHRoZSBtZXNzYWdlIChzYW1l IHJlYXNvbmluZyBhcyBLZXkgZGlzdHJpYnV0aW9uIHJlcXVlc3QsIGl0IGlzIG5vdCBuZWNlc3Nh cnkgYnV0IGl0IG1pZ2h0IGJlIHVzZWZ1bCBmb3IgaW1wbGVtZW50YXRpb25zKS4gKEFQMzYpPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAiPjxicj4NCjxi cj4NCjxicj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21h cmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjI2LiBTZWN0aW9uIDUuMiAtIEl0IGlzIG5v dCBjbGVhciB0byBtZSBpZiB0aGUgbGFzdCBwYXJhZ3JhcGggbWVhbnMgdGhhdCB0aGU8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAx cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj5LREMgY2FuIHJlbW92ZSB0aGUgQVMgYWNjZXNzIHRva2VuIGZyb20gaXQn cyBkYXRhYmFzZSB3aGVuIGEgbGVhdmUgb2NjdXJzLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPm9yIGlm IGl0IGNhbiBvbmx5IGJlIHJlbW92ZWQgd2hlbiBpdCBleHBpcmVzLjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBG RiI+VGhhdCBwYXJhZ3JhcGggd2FzIG1lYW50IHRvIG1lYW4gdGhhdCB0aGUgdG9rZW4gY2FuIGJl IHJlbW92ZWQgb25seSB3aGVuIGl0IGV4cGlyZXMgKG9yIHdoZW4geW91IHVwZGF0ZSBpdCkuIFdo YXQgYXJlIHdlIG1pc3Npbmc/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDtt YXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAw NzBDMCI+W0pMU10gWW91IGFyZSBub3QgbmVjZXNzYXJpbHkgbWlzc2luZyBzb21ldGhpbmcuICZu YnNwO0hvd2V2ZXIgdGhpcyBjb3VsZCBiZSBkb25lIGJ5IHRoZSBLREMgZm9yZ2V0dGluZyB0aGUg dG9rZW4gd2hlbiB0aGUgbGVhdmUgb2NjdXJzIGFuZCB0aGUgY2xpZW50IHN1cHBseWluZyB0aGUg dG9rZW4gYWdhaW4gd2hlbiBpdCBkb2VzIGEgbGF0ZXIgam9pbi4gJm5ic3A7VGhpcyBtZWFucyB0 aGF0DQogdGhlIEtEQyBvbmx5IG5lZWRzIHRvIGhhdmUgdG9rZW5zIGZvciBjdXJyZW50bHkgYWN0 aXZlIG1lbWJlcnMgYW5kIG5vdCBmb3IgYWxsIHBhc3QgbWVtYmVycyB3aGljaCBzdGlsbCBoYXZl IHZhbGlkIHRva2Vucy48YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Y29sb3I6cmVkIj5bRlBdIFRoYXTigJlzIHJpZ2h0LCBhbmQgdGhlcmUgYXJlIHByb3MgYW5kIGNv bnMgZm9yIGJvdGggY2FzZXM6IHRoZSBjdXJyZW50IG9uZSBoYXMgbGVzcyBtZXNzYWdlcyBleGNo YW5nZWQgYnV0IG1vcmUgbWVtb3J5IG9uIHRoZSBLREMgKHRvIGtlZXAgdHJhY2sgb2Ygbm90LWV4 cGlyZWQgdG9rZW5zKSwgdGhlIG9uZSB5b3UgbWVudGlvbiByZXF1aXJlIGxlc3MgbWVtb3J5DQog b24gdGhlIEtEQywgYnV0IG1vcmUgbWVzc2FnZXMuIEkgdGhpbmsgbWVzc2FnZSBleGNoYW5nZXMg YXJlIG1vcmUgaW1wYWN0ZnVsLCBzbyBJIHdvdWxkIGtlZXAgdGhhdCBvcHRpb24uIEJ1dCB3ZSBj b3VsZCBhZGQgYSBzZW50ZW5jZSBjbGFyaWZ5aW5nIHRoYXQgaWYgdGhlIEtEQyBtZW1vcnkgaXMg bm90IHN1ZmZpY2llbnQsIGl0IG1pZ2h0IGRpc2NhcmQgcGFzdC1tZW1iZXJzIHZhbGlkIHRva2Vu cywgaW4gd2hpY2ggY2FzZSB0aGUgam9pbmluZw0KIG9sZCBtZW1iZXJzIHdpbGwgbmVlZCB0byBy ZXBvc3QgdGhlIHRva2VuIGFmdGVyIHJlY2VpdmluZyBhbiBlcnJvciByZXNwb25zZSB0byB0aGUg a2V5IGRpc3RyaWJ1dGlvbiByZXF1ZXN0LiAoQVAzNyk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+PGJyPg0KPGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+MzMuICZuYnNwO1NlY3Rpb24gNi4xIC0gV2hhdCBoYXBwZW5zIGlmIEkgYXNrIGZv ciBhIGtleSByZS1kaXN0cmlidXRpb24sIGJ1dDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0 eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnN1cHBseSBh IGRpZmZlcmVudCBzY29wZSB0aGFuIGZvciB0aGUgb3JpZ2luYWwgbWVzc2FnZSAmbHQ7IGFzc3Vt ZXMgYTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1i b3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPm11bHRpLXRvcGljIHNjb3BlJmd0Oy4gJm5ic3A7SSBh bSBub3Qgc3VyZSB3aGF0IHRoZSBwdXJwb3NlIG9mIHRoZSBzY29wZSBpcyBhdCB0aGlzPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+dGltZSBnaXZlbiB0aGF0IHlvdSBhcmUgbm90IGNoZWNraW5nIHJvbGVz IGFzIHdlbGwuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFy Z2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpi bGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2lu LWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5Sb2xlIGlzIG5vdCBjaGVja2VkIGFzIHRoZSBL ZXkgUmUtRGlzdHJpYnV0aW9uIFJlcXVlc3QgaXMgZG9uZSB0byByZXRyaWV2ZSB0aGUgZ3JvdXAg a2V5aW5nIG1hdGVyaWFsLCBub3QgdGhlIHB1YmxpYyBrZXlzIGZvciBzaWduYXR1cmUgdmVyaWZp Y2F0aW9uLiBGb3INCiBleGFtcGxlLCBpbiBwdWJzdWIsIHRoZSBub2RlIGlzIHJlLXJlcXVlc3Rp bmcgdGhlIHN5bW1ldHJpYyBrZXkgdG8gcHJvdGVjdCB0aGUgY29tbXVuaWNhdGlvbi4gVGhlIEtE QyBkb2VzIG5vdCBuZWVkIHRvIGtub3cgbm9yIGNoZWNrIGlmIHRoZSBub2RlIGlzIGFuIGF1dGhv cml6ZWQgcHViIG9yIGEgc3ViLCBidXQgb25seSB0aGF0IGl0IGlzIGF1dGhvcml6ZWQgdG8gdGhh dCB0b3BpYy4gQ2hlY2tpbmcgdGhlIHNjb3BlIG1ha2Ugc3VyZSB0aGF0DQogYSBub2RlIHRoYXQg aXMgYXV0aG9yaXplZCBmb3IgYSBjZXJ0YWluIHRvcGljIGRvZXMgbm90IHJlcXVlc3QgdGhlIG1h dGVyaWFsIGZvciBhbm90aGVyIHRvcGljLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+V2h5IHdvdWxkIHlv dSB3YW50IHRvIGFzayBrZXkgZGlzdHJpYnV0aW9uIGZvciBvbmUgc2NvcGUgb25seSB3aGVuIGJv dGggc2NvcGVzIG1hcCB0byB0aGUgc2FtZSBzZWN1cml0eSBrZXlpbmcgbWF0ZXJpYWw/PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gQmVjYXVzZSBpdCBp cyBlYXNpZXIgb24gdGhlIGNsaWVudC4gJm5ic3A7SSBjYW4gYXNrIGZvciB0aGUgc3BlY2lmaWMg dG9rZW4gdGhhdCBjYXVzZWQgdGhlIHByb2JsZW0gYW5kIG5vdCBoYXZlIHRvIHJlbWVtYmVyIGFs bCBvZiB0aGUgZGlmZmVyZW50IHRvcGljcyB0aGF0IGFyZSBhc3NvY2lhdGVkIHdpdGggdGhlIGdy b3VwLjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpyZWQi PltGUF0gVGhhdOKAmXMgYSBnb29kIHBvaW50LiBXZSB3aWxsIGFkZCBzb21ldGhpbmcgYWJvdXQg dGhpcyBpZiB3ZSByZWNvbnNpZGVyIGFib3V0IHRoZSBtdWx0aS10b3BpYy9ncm91cCBzY29wZSAo c2VlIHBvaW50IDYgZnJvbSBwcmV2aW91cyBlbWFpbCkuDQo8YnI+DQo8YnI+DQo8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj4zNC4gJm5ic3A7T1VUIE9GIE9SREVSIC0gU2hvdWxkIGEgS0RDIGhhdmUgYSBz aW5nbGUgcmVzb3VyY2Ugd2hpY2ggYWxsb3dzIGZvciBpdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRv IHJldHVybiBhIGdyb3VwIGJhc2VkIG9uIHdoYXQgdGhlIHRvcGljL3Njb3BlIGlzIHRoYXQgaXMg cGFzc2VkIGluIHdpdGhvdXQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2lu OjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj50aGUgY2xpZW50IGZpcnN0IGtu b3dpbmcgd2hhdCB0aGUgZ3JvdXAgaWQgaXMgZ29pbmcgdG8gYmU/PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZG Ij5JIGludGVycHJldCB5b3VyIHF1ZXN0aW9uIGFzIGZvbGxvd3M6IHlvdSBhcmUgd29uZGVyaW5n IGlmIHRoZSBmb2xsb3dpbmcgbWVjaGFuaXNtIGlzL3Nob3VsZCBiZSBzdXBwb3J0ZWQ6IHRoZSBj bGllbnQgc2VuZHMgYSByZXF1ZXN0IHRvIGEgd2VsbCBrbm93biByZXNvdXJjZQ0KIG9uIHRoZSBL REMgYXNraW5nICZxdW90O3doYXQgaXMgdGhlIHNlYyBncm91cCBmb3IgdGhpcyB0b3BpYy9hcHBs aWNhdGlvbiBncm91cD8mcXVvdDsgKHRvcGljIGNvdWxkIGJlIGluIHRoZSBwYXlsb2FkIGZvciBl eGFtcGxlKS4gVGhlIEtEQyByZXNwb25kcyB3aXRoIGluZm8gYWJvdXQgdGhlIHNlY3VyaXR5IGdy b3VwIChHcm91cCBJRCwgZXRjKS4gSWYgdGhhdCBpcyB0aGUgY2FzZSwgdGhhdCBpcyB0YWtlbiBj YXJlIG9mIGJ5IHRoZSByZXNvdXJjZSBkaXJlY3RvcnksDQogYXMgZGVzY3JpYmVkIGluIGRyYWZ0 IGRyYWZ0LXRpbG9jYS1jb3JlLW9zY29yZS1kaXNjb3ZlcnkuIFRoZSBLREMgY291bGQgdGFrZSB0 aGF0IHJvbGUgdG9vLiBJZiB0aGF0IGlzIG5vdCB0aGUgY29ycmVjdCBpbnRlcnByZXRhdGlvbiBv ZiB0aGlzIGNvbW1lbnQsIHRoZW4gY291bGQgeW91IGV4cGFuZD88L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjojMDA3MEMwIj5bSkxTXSBBY3R1YWxseSBJIHdhcyB0aGlua2luZyBv ZiBzb21ldGhpbmcgbW9yZSBnZW5lcmFsLiAmbmJzcDtJIGNhbiBwb3N0IHRoZSByZXF1ZXN0IHRv IGEgc2luZ2xlIGNvbW1vbiByZXNvdXJjZSBuYW1lIGFuZCB0aGUgS0RDIHdvdWxkIGxvb2t1cCB3 aGF0IHRoZSBjb3JyZWN0IGdyb3VwIGlkIHdvdWxkIGJlIGZvciB0aGUgcmVxdWVzdCBhbmQgaW50 ZXJuYWxseSBkaXNwYXRjaA0KIGl0IHRvIHRoZSBjb3JyZWN0IGludGVybmFsIHJlc291cmNlLiAm bmJzcDtNaWdodCBiZSBlYXNpZXIgb24gY2xpZW50cyBpZiBvbmx5IG9uZSBwb2ludCBpcyBuZWVk ZWQgYW5kIG5vIGRpcmVjdG9yeSBsb29rdXAgaXMgbmVlZGVkLjxicj4NCjwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpyZWQiPltGUF0gT2ssIHdlIHdpbGwgdHJ5IHRv IHNrZXRjaCBzb21ldGhpbmcgaW4gQXBwZW5kaXggYWJvdXQgdGhpcywgYW55d2F5IHdlIHN1Z2dl c3QgdGhpcyB0byBiZSBhbiBvcHRpb25hbCBtZWNoYW5pc20gdGhhdCBNQVkgYmUgc3VwcG9ydGVk IGJ5IEdNLiAoQVAzOCk8YnI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4zNS4gJm5ic3A7 T1VUIE9GIE9SREVSIC0gYXJlIGFsbCBvZiB0aGUgcmVzb3VyY2UgbmFtZXMgcmVxdWlyZWQgdG8g YmUgYXQgdGhlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFy Z2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+cm9vdD8gJm5ic3A7SWYgSSBoYXZlIGEgS0RD IHdoaWNoIGlzIHNoYXJlZCB3aXRoIHNvbWV0aGluZyBlbHNlIChzYXkgYSBQdWIgU3ViPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+c2VydmVyKSB0aGVuIGl0IHdvdWxkIG1ha2Ugc2Vuc2UgdG8gaGF2ZSBw b3N0IHRvIC9LREMvZ3JvdXAtaWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1h cmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5ObywgdGhleSBkb27igJl0 IG5lZWQgdG8gYmUgYXQgdGhlIHJvb3QsIHRoZXkganVzdCBuZWVkIHRvIGJlIGFzc29jaWF0ZWQg dG8gdGhlIGdyb3VwLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2lu LWxlZnQ6MGNtIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAi PltKTFNdIFRha2UgYSBsb29rIGF0IHRoZSByZXNvdXJjZSBkaXJlY3RvcnkgYW5kIHB1YiBzdWIg bW9yZSB0aGUgc2V0IG9mIHRlbXBsYXRlcyB0aGF0IHRoZXkgYXJlIHVzaW5nLiAmbmJzcDtXb3Vs ZCB0aGlzIG1ha2VzIHNlbnNlIHRvIHVzZSBoZXJlIHRvIGFkZHJlc3Mgc3VjaCBpc3N1ZXM/PGJy Pg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQXSBB cmUgeW91IHNheWluZyB5b3Ugd291bGQgbGlrZSB1cyB0byBkZWZpbmUgYSAud2VsbC1rbm93biB1 cmktcGF0aCB0aGF0IHNob3VsZCBiZSB1c2VkPyBJLmUuIHRoYXQgZWFjaCBhcHBsaWNhdGlvbiBw cm9maWxlIHNob3VsZCBkZWZpbmUgaXQgKGZvciBleGFtcGxlIOKAnC53ZWxsLWtub3duL2tkYy8u Li4vR0lEMeKAnSwgb3Ig4oCcLndlbGwta25vd24vcHVic3ViLy4uLi90b3BpYzHigJ0pLA0KIGFu ZCBhY2Uta2V5LWdyb3VwY29tbSBkZWZpbmVzIGEgcmVnaXN0cnkgZm9yIGl0PyBUaGF0IGlzIGEg cG9zc2liaWxpdHksIGFsdGhvdWdoIEkgYW0gbm90IHN1cmUgSSBzZWUgdGhlIHBvaW50IG9mIG1h bmRhdGluZyBpdC4gV2hhdCBpcyB0aGUgaXNzdWUgeW91IHJlZmVyIHRvPyAoQVAzOSk8YnI+DQo8 YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4t Ym90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4zNi4gJm5ic3A7U2VjdGlvbiA3LjEgLSB3aGF0IGlz IHRoZSBmb3JtYXQgb2YgZ2V0X3B1Yl9rZXlzIHdoZW4gZ3JvdXAgbWVtYmVyIGlkczwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFw dCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPmFyZSBpbmNsdWRlZD88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0i bWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPldlIHByb3Bvc2Ug YnN0ciBhcyBkZWZhdWx0IHR5cGUuIEluc3RhbmNlcyBtYXkgY2hhbmdlIHRoYXQgaWYgdGhleSBu ZWVkIHRvLiAoQVAyMyk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjojMDA3MEMw Ij5bSkxTXSBXaGF0IHdvdWxkIGJlIGEgY2FzZSB3aGVyZSBzb21ldGhpbmcgZWxzZSB3b3VsZCBy ZWFsbHkgbWFrZSBzZW5zZT8gJm5ic3A7VGhlIGdyb3VwIG1lbWJlciBpZCBpcyBjdXJyZW50bHkg ZGVmaW5lIGFzIHNvbWV0aGluZyBzZXQgZm9yIE9TQ09SRSZuYnNwOyBhcmUgeW91IHRoaW5raW5n IHRoYXQgYSBkaWZmZXJlbnQgcHJvdG9jb2wgbWlnaHQgZm9ybWF0IHRoZW0gZGlmZmVyZW50bHk/ PGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQ XSBTb3JyeSwgbGV04oCZcyBjbGFyaWZ5LiBXaGVuIHdlIHNheSBic3RyIHdlIHJlZmVyIHRvIHRo ZSBncm91cCBtZW1iZXIgaWRzIGNvbnRhaW5lZCBpbnRvIHRoZSBnZXRfcHViX2tleXMsIHdoaWNo IGlzIGEgQ0JPUiBhcnJheS4gSSBkb27igJl0IGtub3cgaWYgc29tZXRoaW5nIGVsc2Ugd291bGQg bWFrZSBzZW5zZSwgeWVzLCB3ZSB3ZXJlIHRyeWluZyB0byBiZSBnZW5lcmFsDQogaW4gY2FzZSBh IGRpZmZlcmVudCBwcm90b2NvbCBtaWdodCB3YW50IHRvIGZvcm1hdCBkaWZmZXJlbnRseS4gQWx0 aG91Z2ggdGhleSBjb3VsZCBhbHdheXMgd3JhcCBhcyBic3RyLCBzbyB3ZSBzdWdnZXN0IHdlIGRv buKAmXQgbWVudGlvbiDigJxpbnN0YW5jZXMgbWF5IGNoYW5nZSB0aGF04oCdIChBUDIzKTxicj4N Cjxicj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdp bi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjM3LiAmbmJzcDtTZWN0aW9uIDcuMiAtIFRoZXJl IGlzIGEgcmFjZSBjb25kaXRpb24gY2F1c2VkIGJ5IHRoZSBsYXN0IHBhcmFncmFwaCBpbjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAw MDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6YmxhY2siPnRoaXMgc2VjdGlvbi4gJm5ic3A7RW50aXR5IEEgc2VuZHMgYSBtZXNz YWdlLCBsZWF2ZXMgdGhlIGdyb3VwLCBFbnRpdHkgQiByZWNlaXZlczwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPnRoZSBtZXNzYWdlIGFuZCBhc2tzIGZvciB0aGUgcHVibGljIGtleS4gJm5ic3A7SXMgdGhp cyBhbiBpc3N1ZT88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9y OmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJn aW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPldlIGRvbid0IHRoaW5rIHRoaXMgYXMgYW4g aXNzdWUuIEluIGZhY3QsIEEgY291bGQgd2FpdCBmb3IgYSByZXBseSBmcm9tIEIgYmVmb3JlIGxl YXZpbmcgdGhlIGdyb3VwIGlmIGl0IGlzIGNyaXRpY2FsIHRoYXQgQiByZWNlaXZlcyBBJ3MgbWVz c2FnZS4gT3RoZXJ3aXNlLA0KIHdlIGNvdWxkIGFkZCBzb21lIHRleHQgYWJvdXQgYSBwb2xpY3kg Zm9yIEtEQyB0byBtYWludGFpbiBsZWF2aW5nIGdyb3VwIG1lbWJlcnPigJkgUHVibGljIEtleXMg Zm9yIGEgY2VydGFpbiBhbW91bnQgb2YgdGltZSBhZnRlciB0aGVpciBsZWF2aW5nLCBiZWZvcmUg ZGlzY2FyZGluZyB0aGVtLiBXb3VsZCB0aGF0IHNvbHZlIHRoZSBpc3N1ZT8gKEFQMjQpPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gSWYgdGhlIG1lc3Nh Z2UgaXMganVzdCBhIGJyb2FkY2FzdCB0aGVuIEkgd291bGQgbm90IGV4cGVjdCBBIHRvIHdhaXQg Zm9yIGEgcmVzcG9uc2UuICZuYnNwO1llcyB3aGF0IHlvdSBzdWdnZXN0IHdvdWxkIHNvbHZlIHRo ZSBpc3N1ZSwgaXQgd291bGQgYWxzbyBzb2x2ZSB0aGUgaXNzdWUgaWYgeW91IGRlY2lkZWQgdGhh dCB0aGlzIGlzIHRvdGFsbHkgcmVhc29uYWJsZQ0KIGFzIEEgc2hvdWxkIG5vdCBleHBlY3QgaXRz IG1lc3NhZ2UgdG8gYmUgcHJvY2Vzc2VkIGFmdGVyIGl0IGhhcyBsZWZ0IHRoZSBncm91cC48YnI+ DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6cmVkIj5bRlBdIE9r LCB3ZSB3aWxsIGZvcm11bGF0ZSBzb21ldGhpbmcgYWJvdXQgdGhhdCAodGFraW5nIGludG8gY29u c2lkZXJhdGlvbnMgYm90aCBwb3NzaWJpbGl0aWVzKS4gKEFQMjQpPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+PGJyPg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAx cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQi PjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj5NYWlsIHJlZ2FyZGluZyBkcmFmdC1pZXRmLWFjZS1rZXktZ3JvdXBjb21t IC0gMDQvMDQvMjAxOSAwMzo0Mjwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjBjbSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFy Z2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+U29tZSBhZGRpdGlvbmFsIHRoaW5ncyB0aGF0 IG5lZWQgdG8gYmUgdGhvdWdodCBhYm91dC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHls ZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0i bWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4xLiAmbmJzcDtTb21l cGxhY2UgYXMgcGFydCBvZiB0aGUgcmUta2V5IGRpc2N1c3Npb25zIHRoZXJlIG91Z2h0IHRvIGJl IHNvbWU8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4t Ym90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5jb21tZW50YXJ5IG9uIHRoZSB3aXNkb20gb2YgcmF0 ZSBsaW1pdGluZyB0aGUgZnJlcXVlbmN5IG9mIGRvaW5nIHJlLWtleWluZzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPm9wZXJhdGlvbnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjow Y207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5Paywgd2UgY2FuIGV4cGFuZCBv biBzb21lIGNvbnNpZGVyYXRpb25zIHRoYXQgYXJlIG5vdyBqdXN0IHF1aWNrbHkgbWVudGlvbmVk LiBPdXIgcHJvcG9zYWwgaXMgdG8gYWRkIHRoYXQgb3RoZXIgdGhhbiByZWtleWluZyBkdWUgdG8g bWVtYmVyc2hpcCBjaGFuZ2VzIChpZg0KIHJlbGV2YW50IHRvIHRoZSBhcHBsaWNhdGlvbiksIHBl cmlvZGljIHJla2V5aW5nIHNob3VsZCBvY2N1ciBhdCB0aGUgbWluaW11bSByYXRlIG5lY2Vzc2Fy eSB0byBkaXNjb3VyYWdlIGFuIGFkdmVyc2FyeSB0byBkZXJpdmUgdGhlIGtleSBtYXRlcmlhbCBv dXQgb2YgYnJ1dGUgZm9yY2UgYW5kIHRyYWZmaWMgY29sbGVjdGlvbi9hbmFseXNpcy4gKEFQMjcp PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gVGhlIGNh c2UgdGhhdCBJIHdhcyBhY3R1YWxseSB0aGlua2luZyBhYm91dCB3YXMgdGhlIG1lbWJlcnNoaXAg Y2hhbmdlIHJla2V5aW5nLiAmbmJzcDtJZiB5b3UgaGF2ZSAzMCBqb2lucyBpbiB0aGUgY291cnNl IG9mIGEgbWludXRlLCB5b3UgbWlnaHQgd2FudCB0byBkZWxheSB0aGUgcmVrZXkgbWVzc2FnZXMg c2xpZ2h0bHkgb3IgbWFrZSB0aGUgcHJlc3VtcHRpb24gdGhhdA0KIHRoZXJlIGlzIG5vdCB0cmFm ZmljIHRoYXQgbmVlZHMgdG8gYmUgcHJvdGVjdGVkIG9uIGEgYmFja3dhcmRzIGJhc2lzIHRvIHRo ZSBmaXJzdCBqb2luLiAmbmJzcDtTaW1pbGFyIGlzc3VlcyB3aWxsIGFyaXNlIGZvciBsZWF2ZXMu PGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOnJlZCI+W0ZQ XSBBaCBvaywgdGhhbmtzIGZvciB0aGUgY2xhcmlmaWNhdGlvbnMuIFdlIHdpbGwgZGVmaW5pdGVs eSBhZGQgc29tZSBjb25zaWRlcmF0aW9ucyBhYm91dCB0aGF0LiAoQVAyNyk8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjMuICZu YnNwO1doYXQgaGFwcGVucyBpbiB0aGUgZm9sbG93aW5nIHNpdHVhdGlvbnM6PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+YSkgVGhlIGtleSBjb250ZXh0IGlzIGNoYW5nZWQgYmV0d2VlbiBhIHJlcXVlc3Qg YmVpbmcgc2VudCBhbmQgdGhlIHNlcnZlcjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxl PSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnJlY2VpdmluZyB0 aGUgcmVxdWVzdC4gJm5ic3A7VGhpcyBjb3VsZCBqdXN0IGJlIGJlY2F1c2UgdGhlIHNlbmRlciBk aWQgbm90IGdldDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21h cmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPnRoZSBub3RpZmljYXRpb24gb2YgdGhlIGtl eSBjb250ZXh0IGNoYW5naW5nLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJn aW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmIpIFRoZSByZXNwb25zZSB0 YWtlcyAmcXVvdDthIHdoaWxlJnF1b3Q7IHRvIGdlbmVyYXRlIGFuZCB0aGUga2V5IGNvbnRleHQg aXMgY2hhbmdlZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21h cmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmFmdGVyIHRoZSByZXF1ZXN0IGlzIHJlY2Vp dmVkLCBidXQgYmVmb3JlIHRoZSByZXNwb25zZSBpcyBzZW50Ljwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk5MDBGRiI+ U2l0dWF0aW9ucyBhKSBhbmQgYikgYXJlIGVzc2VudGlhbGx5IHRoZSBzYW1lLCB3aXRoIHRoZSBk aWZmZXJlbmNlIHRoYXQgdGhleSBoYXBwZW4gZWl0aGVyIG9uIGNsaWVudCBvciBvbiBzZXJ2ZXIg KHRoZSBub2RlIHJlY2VpdmVzIGEgbWVzc2FnZSBlbmNyeXB0ZWQgd2l0aA0KIG9sZC9ub24gcmVj b2duaXplZCBjb250ZXh0KS4gV2hhdCBoYXBwZW5zIGluIHRoYXQgY2FzZSBpcyB0aGF0IHRoZSBy ZWNlaXZlciB3b3VsZCBjb250YWN0IHRoZSBLREMgdG8gdmVyaWZ5IHRoYXQgaXRzIG93biBrZXlp bmcgbWF0ZXJpYWwgaGFzIG5vdCBiZWluZyB1cGRhdGVkICh1c2luZyB0aGUgbmV3IOKAnHVwZGF0 ZeKAnSBtZXRob2QgZGVmaW5lZCBpbiBwb2ludCAzMikuIFdoZW4gaXQgcmVhbGl6ZXMgaXQgaGFz IHRoZSBsYXRlc3Qgb25lLCBpdCBkaXNjYXJkcw0KIHRoZSBtZXNzYWdlLCBhbmQgb3B0aW9uYWxs eSBzZW5kcyBiYWNrIGFuIGVycm9yIHJlc3BvbnNlIChpbiBjYXNlIGEpIHRoYXQgd291bGQgaGlu dCB0aGF0IHRoZSBtZXNzYWdlIGRpZCBub3QgZ28gdGhyb3VnaC4gSW4gY2FzZSBiKSwgd2hlbiB2 ZXJpZmljYXRpb24gZmFpbHMgb24gdGhlIGNsaWVudCwgSSB3b3VsZCBleHBlY3QgdGhlIGNsaWVu dCB0byBiZSBjb25maWd1cmVkIHRvIHRyeSBhZ2FpbiwgYW5kIHRoaXMgdGltZSBpdCBzaG91bGQg aGl0DQogdGhlIG5ldyBzZWN1cml0eSBjb250ZXh0IG9uIHRoZSBzZXJ2ZXIuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj OTkwMEZGIj5TZWUgYWxzbw0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vY29yZS13Zy5naXRodWIu aW8vb3Njb3JlLWdyb3VwY29tbS9kcmFmdC1pZXRmLWNvcmUtb3Njb3JlLWdyb3VwY29tbS5odG1s I3JmYy5zZWN0aW9uLjguNCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzExNTVDQyI+aHR0cHM6Ly9jb3JlLXdnLmdpdGh1Yi5pby9v c2NvcmUtZ3JvdXBjb21tL2RyYWZ0LWlldGYtY29yZS1vc2NvcmUtZ3JvdXBjb21tLmh0bWwjcmZj LnNlY3Rpb24uOC40PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTkwMEZGIj5hYm91dA0KIGtlZXBpbmcgb2xkIHNl Y3VyaXR5IGNvbnRleHQgZm9yIGEgd2hpbGUuIERpZCB5b3Ugd2FudCB0aGUgc2FtZSB0eXBlIG9m IGNvbnNpZGVyYXRpb25zIGluIGFjZS1rZXktZ3JvdXBjb21tIGFzIHdlbGw/PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20iPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gSW4gdGhlIGZpcnN0IGNhc2Ug aXQgaXMgYSBzaW1wbGUgcmFjZSBjb25kaXRpb24gYW5kIHNvbWUgdHlwZSBvZiBjb25maWd1cmFi bGUga2VlcCB0aGUgbGFzdCBjb250ZXh0IGZvciBhIHdoaWxlIGRvZXMgZGVhbCB3aXRoIHRoaXMu ICZuYnNwO1RoZSBzZWNvbmQgY2FzZSBpcyBhIGJpdCBkaWZmZXJlbnQgaW4gdGVybXMgb2Yg4oCT IGRvZXMgdGhlIHJlc3BvbnNlIGdldCBzZW50DQogdW5kZXIgdGhlIG5ldyBjb250ZXh0LCB0aGUg b2xkIGNvbnRleHQgb3Igbm90IGF0IGFsbC4mbmJzcDsgSSBkb27igJl0IGtub3cgdGhhdCBJIGhh dmUgYW55IGlkZWEgb2Ygd2hhdCB0aGUgcmlnaHQgYW5zd2VyIGlzIGFuZCBoYXZpbmcgdGhpcyBk ZXNjcmliZWQgd291bGQgYmUgdXNlZnVsLjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjpyZWQiPltGUF0gT2ssIGZvciB0aGUgZmlyc3QgY2FzZSB3ZSB3aWxs IGFkZCB0aGVzZSB0eXBlIG9mIGNvbnNpZGVyYXRpb25zIGhlcmUuIChBUDQwKS4gSSB1bmRlcnN0 YW5kIGJldHRlciB5b3VyIGNhc2UgYik6IHRoZSByZXF1ZXN0IGlzIGFjdHVhbGx5IGFjY2VwdGVk LiBXZSB3b3VsZCBzYXk6IGlmIHRoZXJlIGFyZSBwb2xpY2llcyBmb3Iga2VlcGluZyB0aGUgb2xk IGNvbnRleHQNCiBmb3IgYSB3aGlsZSwgaXQgY291bGQgYmUgYWNjZXB0ZWQgdGhhdCB0aGUgc2Vy dmVyIHByb3RlY3RzIHRoZSByZXNwb25zZSB3aXRoIHRoZSBuZXcgc2VjIGN0eC4gSW4gdGhlIGdl bmVyYWwgY2FzZSwgaXQgd291bGQgZGlzY2FyZC4gSXQgZGVmaW5pdGVseSBuZWVkIHRvIGJlIGRl c2NyaWJlZCAoQVA0MSk8YnI+DQo8YnI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBzdHlsZT0ibWFyZ2luOjBjbTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5jKSAm bmJzcDtUaGUga2V5IGNvbnRleHQgaXMgY2hhbmdlZCBpbiB0aGUgbWlkZGxlIG9mIGEgYmxvY2st d2lzZSB0cmFuc2Zlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBj bTttYXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbTtt YXJnaW4tYm90dG9tOi4wMDAxcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5OTAwRkYiPlRvIG1lIHRoaXMgaXMgbm8gZGlmZmVy ZW50IHRoYW4gdGhlIGNhc2VzIGFib3ZlLiBJZiBvbmUgYmxvY2sgZmFpbHMsIHRoZSB0b3RhbCBt ZXNzYWdlIHdvdWxkIGZhaWwuIENvbnNpZGVyYXRpb25zIGFib3ZlIGFwcGx5LiBEbyB5b3UgdGhp bmsgd2UgbmVlZCBhZGRpdGlvbmFsDQogY29uc2lkZXJhdGlvbnMgYWJvdXQgYmxvY2t3aXNlIGhl cmU/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowY20i Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6IzAwNzBDMCI+W0pMU10gT25l IGNvdWxkIHNheSB0aGF0IHRoZSBzZW5kZXIgb2YgdGhlIGJsb2NrcyBqdXN0IGNoYW5nZXMgdGhl IGtleXMgYW5kIGNvbnRpbnVlcy4gJm5ic3A7QXMgbG9uZyBhcyBib3RoIHNpZGVzIGdldCB0aGUg bmV3IGtleWluZyBJIGRvbuKAmXQgdGhpbmsgdGhhdCB0aGlzIHdvdWxkIGNhdXNlIGEgcHJvYmxl bS4mbmJzcDsgQnV0IGFnYWluIHllcyBpdCBoYXMgbXVjaCBvZiB0aGUgc2FtZQ0KIGlzc3VlcyBh cyBhYm92ZSBhbHRob3VnaCBpdCBkb2VzIGhhdmUgZnVuIHRoYXQgaXQgYXBwbGllcyB0byBib3Ro IHRoZSBzZW5kZXIgYW5kIHRoZSByZWNpcGllbnQuICZuYnNwO0l0IGlzIG1vcmUgcHJvYmxlbWF0 aWMgdGhhbiB0aGUgYWJvdmUgbWVzc2FnZSBpbiB0aGF0IGRlcGVuZGluZyBvbiBob3cgZmFzdCBr ZXlzIGFyZSBjaGFuZ2VkLCB5b3UgYXJlIGdvaW5nIHRvIGNvbnN1bWUgYSBsYXJnZSBhbW91bnQg b2YgdGhlIG5ldHdvcmsgcmVzZW5kaW5nDQogdGhlIG1lc3NhZ2UgZnJvbSBzdGFydCBhZ2FpbiBh bmQgYWdhaW4uJm5ic3A7IFRoaXMgaXMgbW9yZSBvZiBhIHByb2JsZW0gdGhhbiBpdCBpcyBmb3Ig Y2FzZSBiIGFib3ZlLjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpyZWQiPltGUF0gVGhhdOKAmXMgcmlnaHQuIFdlIHdpbGwgdHJ5IHRvIHNrZXRjaCBzb21l IGNvbnNpZGVyYXRpb25zIGFib3V0IHRoaXMgYXMgd2VsbCAoQVA0MikuPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAiPjxicj4NCjxicj4NCjxicj4NCjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtO21hcmdpbi1ib3R0b206 LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPkppbTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJt YXJnaW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQ7Y29sb3I6YmxhY2siPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJn aW46MGNtO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPi0tLS0tLS0tLS0tLS08L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41 cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_89396BDA89FD4064B609D557E864C9D7ericssoncom_-- From nobody Wed May 29 14:56:46 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24A51120096; Wed, 29 May 2019 14:56:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iotconsultancynl.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UucaL4HNTrXG; Wed, 29 May 2019 14:56:41 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40113.outbound.protection.outlook.com [40.107.4.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94E25120134; Wed, 29 May 2019 14:56:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancynl.onmicrosoft.com; s=selector1-iotconsultancynl-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pRlXgDqqNObYHLPhJOvo+uHSMYJ0lH1ahH7uKLyqSQg=; b=CaZm14PzH54+NThQNYFAURoyO5KxgZrvatVXaY7v8+VER0haxOlAgTaW8NGQnWzF0IywXCI818WxJTl+eD7oWx/wuCmL/YvL52iFWOaMBgXB7onPYr/oUqvglsjEGvDmDDkP++rMgJgLYKZdWQzEoURFyuvGNbAKOnQcxQxDak8= Received: from AM5P190MB0275.EURP190.PROD.OUTLOOK.COM (10.161.89.148) by AM5P190MB0563.EURP190.PROD.OUTLOOK.COM (10.161.66.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.16; Wed, 29 May 2019 21:56:37 +0000 Received: from AM5P190MB0275.EURP190.PROD.OUTLOOK.COM ([fe80::9b3:4a09:dfc8:6487]) by AM5P190MB0275.EURP190.PROD.OUTLOOK.COM ([fe80::9b3:4a09:dfc8:6487%7]) with mapi id 15.20.1943.016; Wed, 29 May 2019 21:56:37 +0000 From: Esko Dijk To: Jim Schaad , "draft-dijk-core-groupcomm-bis@ietf.org" CC: "ace@ietf.org" , "core@ietf.org" Thread-Topic: Comments about draft-dijk-core-groupcomm-bis-00 Thread-Index: AdUUNPLwUpqoK9aaSuCnTZIzn4sN5wCM6LAw Date: Wed, 29 May 2019 21:56:36 +0000 Message-ID: References: <017f01d515a6$ed172890$c74579b0$@augustcellars.com> In-Reply-To: <017f01d515a6$ed172890$c74579b0$@augustcellars.com> Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=esko.dijk@iotconsultancy.nl; x-originating-ip: [2001:1c02:3101:4800:24b6:8e23:9589:19c9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f1874771-b2ec-432b-cb91-08d6e48085c6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:AM5P190MB0563; x-ms-traffictypediagnostic: AM5P190MB0563: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0052308DC6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39830400003)(136003)(396003)(376002)(366004)(199004)(189003)(13464003)(7736002)(76176011)(305945005)(52536014)(9686003)(2501003)(54906003)(316002)(6246003)(6506007)(110136005)(86362001)(6116002)(71200400001)(8936002)(53936002)(186003)(71190400001)(8676002)(99286004)(7696005)(55016002)(33656002)(81156014)(53546011)(81166006)(2906002)(74316002)(256004)(4326008)(486006)(476003)(102836004)(508600001)(44832011)(14444005)(25786009)(4743002)(229853002)(46003)(74482002)(5660300002)(446003)(11346002)(66946007)(76116006)(68736007)(73956011)(66476007)(66556008)(64756008)(66446008)(6436002)(14454004); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5P190MB0563; H:AM5P190MB0275.EURP190.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: iotconsultancy.nl does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 4eughSPM45rXqkoM9JP4oeG9AIgZcMAPjLeE/38z8gOK85/M5DnaxwZUDVZG0AOWXVtanDkDRAwnYp8K+61cMqqnr+OfkidLIz3hVmNrpC0LhKYjL6WS6FXzrgwZ1922lhCQ9A1FYk2SLDQWKjAIIYYf9ILJZbBIYPUetnFBdqv1TV2BiMUoBnSwNqBt1KsxY6u6kah4oz7m5PWwS5cp6vnlEU4/FAYJjuF5+9/koNB/6yPWpjNMlpkDyZUYjWSSbEjoApWDmG68vl5o42fVCmo0Tmtimm97+3Q41gwx+JA8q/LRDLWmWRGz1UOig1PPOL/ELxw75sHm43Cjsgjob3n4V12jEhRwt/w0ZJM041ztXyhcXILY4bRjzmiYG/FcTGVYIm8VXPShlkPID3Q82m8pfZot/sCPS+1vKKFfkyw= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: iotconsultancy.nl X-MS-Exchange-CrossTenant-Network-Message-Id: f1874771-b2ec-432b-cb91-08d6e48085c6 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 May 2019 21:56:36.9386 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 58bbf628-15d2-46bc-820b-863b6774d44b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: esko.dijk@iotconsultancy.nl X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P190MB0563 Archived-At: Subject: Re: [Ace] Comments about draft-dijk-core-groupcomm-bis-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 21:56:45 -0000 SGVsbG8gSmltLA0KDQpUaGFua3MgZm9yIHlvdXIgY29tbWVudHMgLSB0aGUgYXV0aG9ycyBhcmUg bm93IGxvb2tpbmcgaW50byB0aGVzZSBhbmQgd2UnbGwgcmVwbHkgYWdhaW4gYXMgc29vbiBhcyB3 ZSBoYXZlIGFuc3dlcnMuICBJIGFsc28gY29weSB0aGlzIHRvIHRoZSBDb1JFIFdHIGxpc3Q7IGFz IHRoZSBkcmFmdCB0YXJnZXRzIHRoZSBDb1JFIFdHLg0KDQpFc2tvDQoNCi0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tDQpGcm9tOiBKaW0gU2NoYWFkIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPiAN ClNlbnQ6IFdlZG5lc2RheSwgTWF5IDI5LCAyMDE5IDAwOjQ1DQpUbzogZHJhZnQtZGlqay1jb3Jl LWdyb3VwY29tbS1iaXNAaWV0Zi5vcmcNCkNjOiBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IENvbW1l bnRzIGFib3V0IGRyYWZ0LWRpamstY29yZS1ncm91cGNvbW0tYmlzLTAwIA0KDQpDb21tZW50cyBv biB0aGlzIGRyYWZ0Lg0KDQoxLiAgSSBoYXZlIGFuIGV4aXN0ZW50aWFsIHByb2JsZW0gd2l0aCB0 aGlzIGRvY3VtZW50LiAgVGhpcyBpcyBhIHN0YW5kYXJkcyB0cmFjayBkb2N1bWVudCB0aGF0IGlz IGNsYWltaW5nIHRvIGRvIGFuIHVwZGF0ZSB0byBhbiBleHBlcmltZW50YWwgZHJhZnQuDQpIb3dl dmVyLCB0aGlzIGlzIHNvbWV0aGluZyB0aGF0IEkgd291bGQgbm90IGV4cGVjdCB0byBiZSBkb25l IGFuZCBpdCBpcyBub3QgY2xlYXIganVzdCB3aGF0IHRoZSB1cGRhdGVzIHRvIHRoYXQgZG9jdW1l bnQgYXJlIGFuZCBob3cgb25lIHdvdWxkIG1ha2UNCmVkaXRzIHRvIHRoYXQgZG9jdW1lbnQgaW4g b3JkZXIgdG8gYXBwbHkgdGhlIHVwZGF0ZXMuICAgTXkgZ2VuZXJhbA0KZXhwZWN0YXRpb24gZm9y IGFuIGV4cGVyaW1lbnRhbCBkb2N1bWVudCBpcyB0aGF0IGl0IHdvdWxkIGJlIDEpIGRlY2xhcmVk IGEgZmFpbHVyZSBhbmQga2lsbGVkLCAyKSBkZWNsYXJlIGEgcGFydGlhbCBzdWNjZXNzIGFuZCB1 cGRhdGVkIGZvciBhIG5ldyBleHBlcmltZW50IChhbmQgdGh1cyBhIG5ldyBleHBlcmltZW50YWwg ZG9jdW1lbnQpIG9yIDMpIGRlY2xhcmUgYSByZXNvdW5kaW5nIHN1Y2Nlc3MgdGhlbiByZXBsYWNl ZCB3aXRoIGVpdGhlciBhIHN0YW5kYXJkcyBvciBpbmZvcm1hdGlvbiBkb2N1bWVudC4gIA0KDQoy LiAgWW91IGFyZSBjbGFpbWluZyB0byB1cGRhdGUgUkZDIDc2NDEsIGJ1dCBpdCBpcyBub3QgY2xl YXIgdG8gbWUgd2hhdCBpcyBiZWluZyB1cGRhdGVkIGFuZCBqdXN0IHdoYXQgdGhlIGltcGxpY2F0 aW9ucyBvZiBkb2luZyB0aGlzIHVwZGF0ZSBhcmUuICBBcyBhbiBleGFtcGxlIG9mIHRoZSB0eXBl cyBvZiB0aGluZyB0aGF0IHNob3VsZCBiZSBjbGFyaWZpZWQgYXJlOg0KKiAgSWYgYSBzZXJ2ZXIg ZG9lcyBub3QgcmV0dXJuIGEgcmVzcG9uc2UsIHNob3VsZCBpdCBzZXR1cCB0byBkbyBhIGxhdGVy IG9ic2VydmUgb3BlcmF0aW9uPw0KKiAgTW9yZSBpbmZvcm1hdGlvbiBvbiBob3cgY29ycmVsYXRp b24gc2hvdWxkIGJlIGRvbmUgd2l0aCByZXNwb25zZXMuICBBcyBhbiBleGFtcGxlLCBpZiB5b3Ug ZG8gdW5hcnkgb2JzZXJ2ZSBhbmQgdGhlIHJlc3BvbnNlIGlzIHJvdXRlZCB0aHJvdWdoIGEgcHJv eHksIHRoZXJlIGFyZSBubyBwcm9ibGVtcyBhcyBsb25nIGFzIHRoZSByZXNwb25zZXMgYXJlIG5v dCBsYXRlciByZS1yb3V0ZWQgdGhyb3VnaCBhIG5ldyBwcm94eS4gIEhvd2V2ZXIgZm9yIG11bHRp Y2FzdCwgaWYgeW91IGhhdmUgdHdvIGRpZmZlcmVudCBzZXJ2ZXJzIG9uIHRoZSBmYXIgc2lkZSBv ZiBhIHByb3h5IGhvdyBkb2VzIG9uZSBkaXN0aW5ndWlzaCBiZXR3ZWVuIHRoZSB0d28gb2YgdGhl bSBpZiBldmVyeXRoaW5nIGlzIGNvbWluZyB0aHJvdWdoIGEgc2luZ2xlIHByb3h5Pw0KDQozLiAg VGhlIGludHJvZHVjdGlvbiBkb2VzIG5vdCBhY2tub3dsZWRnZSB0aGF0IHRoZSBzYW1lIHRoaW5n IGNhbiBiZSBkb25lIHZpYSBwdWItc3ViLiAgSXQgaXMgb2sgdG8gZGVjbGFyZSB0aGlzIG91dCBv ZiBzY29wZSBidXQgaXQgbmVlZHMgdG8gYmUgZG9uZSBpbiB1cCBmcm9udCBpbiB0aGUgaW50cm9k dWN0aW9uIChhbmQgcHJvYmFibHkgYWxzbyBpbiB0aGUgYWJzdHJhY3QpLg0KDQo0LiAgSSBhbSBu b3Qgc3VyZSB0aGF0IGl0IG1ha2VzIHNlbnNlIHRvIHNheSBvbmUgc2hvdWxkIGJlIGZhbWlsaWFy IHdpdGggdGVybXMgZnJvbSBHcm91cCBPU0NPUkUgYXMgb25lIHdvdWxkIGV4cGVjdCB0aGlzIHRv IGJlIGZyb20gdGhlIGdlbmVyYWwgdG8gdGhlIHNwZWNpZmljIGZvciB0ZXJtaW5vbG9neSBub3Qg dGhlIG90aGVyIHdheSBhcm91bmQuDQoNCjUuICBJbiBzZWN0aW9uIDIuMS4xIC0geW91IHNob3Vs ZCBzdGF0ZSB0aGF0IHRoZSBjZW50cmFsaXplZCBkaXJlY3Rvcnkgd291bGQgYmUgcHJlLWNvbmZp Z3VyZWQgaW4gdGhlIGRldmljZS4NCg0KNi4gSW4gc2VjdGlvbiAyLjEuMSAtIERvIHdlIGhhdmUg YW55IHNldCBvZiBwcm9wZXJ0aWVzIHRoYXQgYXJlIGNvbW1vbmx5IGRlZmluZWQgZm9yIGRvaW5n IHRoaXM/ICBTZXJ2aWNlcyBpbiB0aGUgZm9ybSBvZiByZXNvdXJjZXMgYXJlIGVhc3kgdG8gdW5k ZXJzdGFuZCBidXQgSSBkb24ndCBrbm93IGhvdyB0byBkbyB0aGlzIGVhc2lseS4NCg0KNy4gSW4g c2VjdGlvbiAyLjMgLSBJdCB3b3VsZCBtYWtlIHNlbnNlIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4g dGhlIGNhc2VzIG9mIGFubm91bmNpbmcgYSBzb2Z0d2FyZSB1cGRhdGUgaXMgYXZhaWxhYmxlIGFu ZCBhY3R1YWxseSBkaXN0cmlidXRpbmcgdGhlIHNvZnR3YXJlIHVwZGF0ZSBieSBtdWx0aWNhc3Qu DQoNCjguIFNlY3Rpb24gMy4xLjEgLSBJdCBzaG91bGQgcG90ZW50aWFsbHkgYmUgc3RhdGVkIGhl cmUsIGJ1dCBkZWZpbml0ZWx5IHNvbWV3aGVyZSB0aGF0IGZvciBub24tc2VjdXJlIGdyb3VwcyBt ZW1iZXJzaGlwIGluIHRoZSBncm91cCBpcyBkZWZpbmVkIGJ5IGFuIGVuZHBvaW50IGFuZCBub3Qg YnkgYSBjZW50cmFsIGVuZHBvaW50LiAgVGhpcyBpcyBpbXBvcnRhbnQgaW4gdGVybXMgb2Ygc29t ZWJvZHkgImF0dGFja2luZyIgYSBub24tc2VjdXJlIGdyb3VwLg0KDQo5LiAgU2VjdGlvbiAzLjEu MiAtIEl0IHdvdWxkIG1ha2Ugc2Vuc2UgdG8gcG9pbnQgdG8gZ3JvdXAgbmFtaW5nIGFzIHBhcnQg b2YgYSBkaXJlY3RvcnkgYXMgd2VsbCBhcyBiZWluZyBmb3IgRE5TLiAgDQoNCjEwLiAgU2VjdGlv biAzLjEuMyAtIE9uZSBvZiB0aGUgdGhpbmdzIHRoYXQgSSBoYWQgYSBwcm9ibGVtIHdpdGggd2hl biBpbXBsZW1lbnRhdGlvbiBncm91cCBicm9hZGNhc3Qgd2FzIHRyeWluZyB0byBkZWNpZGUgd2hp Y2ggb2YgdGhlIGRpZmZlcmVudCBsb2NhbCBncm91cHMgc2hvdWxkIGJlIHVzZWQgZm9yIGFuIElQ djYgbXVsdGljYXN0IGFkZHJlc3MuICBBIG51bWJlciBvZiB0aGVzZSBkaWZmZXJlbnQgZ3JvdXBz IGFyZSBkZWZpbmVkIGZvciBDb0FQIGFuZCBhIGRpc2N1c3Npb24gb2YgdGhlIGRpZmZlcmVuY2Vz IG9yIGEgcG9pbnRlciB0byB0aGUgZGlmZmVyZW5jZXMgd291bGQgYmUgdXNlZnVsLg0KDQoxMS4g U2VjdGlvbiAzLjIuMSAtIEFub3RoZXIgaXNzdWUgdG8gaGlnaGxpZ2h0IHdpdGggdG9rZW5zIGlz IHRoYXQgaW4gdGhlIHVuaWNhc3QgY2FzZSwgdGhlIHJlc3BvbnNlIGlzIGV4cGVjdGVkIHRvIGNv bWUgaW4gb24gdGhlIHNhbWUgY29ubmVjdGlvbiBpdCB3YXMgc2VudCBvbi4gIFRodXMgdHdvIGRp ZmZlcmVudCBjb25uZWN0aW9ucyBjYW4gcmUtdXNlIHRoZSBzYW1lIHRva2VuIHdpdGhvdXQgYW55 IHByb2JsZW1zLiAgVGhhdCBpcyBub3QgdHJ1ZSBmb3IgbXVsdGljYXN0IGFzIHRoZSBjb25uZWN0 aW9uIGl0IGNvbWVzIGl0IG9uIHdpbGwsIGJ5IGRlZmluaXRpb24sIG5vdCBiZSB0aGUgb25lIGl0 IHdhcyBzZW50IG9uLg0KDQoxMi4gU2VjdGlvbiAzLjIuMSAtIE1pZ2h0IHdhbnQgdG8gbWVudGlv biB0aGUgdXNlIG9mIEFjY2VwdCBhcyBvbmUgd2F5IHRvIHRoaW5rIGFib3V0IHNlcnZlciByZXNw b25zZSBkZWxheSBhcyB5b3UgYXQgbGVhc3Qga25vdyB0aGF0IHlvdSBhcmUgZXhwZWN0aW5nIGEg cmVzcG9uc2UgZnJvbSB0aGUgc2VydmVyIGlmIHlvdSBoYXZlIHJlY2VpdmVkIGFuIGFjY2VwdC4N Cg0KMTMuIFNlY3Rpb24gMy4yLjMgLSBOZWVkIHRvIHRhbGsgYWJvdXQgbXVsdGljYXN0IG1lc3Nh Z2VzLCBwcm94aWVzIGFuZCBjYWNoaW5nIG9mIHJlc3VsdHMuDQoNCjE0LiBTZWN0aW9uIDMuMi41 IC0gRG9lcyBSRkM3NjQxIGRlZmluZSBiZWhhdmlvciBhYm91dCByZWNlaXZpbmcgYSAiZHVwbGlj YXRlIiBvYnNlcnZlciByZXF1ZXN0PyAgV291bGQgeW91IHJlcGx5IGEgc2Vjb25kIHRpbWUgb3Ig bm90PyANCg0KMTUuIFNlY3Rpb24gNi4xIC0gbmV4dCB0byBsYXN0IHBhcmFncmFwaCAtIC92YWx1 ZXMgZG9lcyBub3QvdmFsdWVzLCBidXQgZG9lcyBub3QvDQoNCjE2LiBTZWN0aW9uIDYuMiAtIFNo b3VsZCBoYXZlIGEgY29uc2lkZXJhdGlvbiBhYm91dCB0aGUgc3BlZWQgb2YgcmUta2V5aW5nIHZz IHRoZSBmcmVxdWVuY3kgb2Ygam9pbnMvbGVhdmVzLg0KDQpKaW0NCg0KDQo= From nobody Thu May 30 09:34:14 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93283120046 for ; Thu, 30 May 2019 09:34:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=GCiTTD2C; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=DEGCMKlv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 34ivo5PNiqJo for ; Thu, 30 May 2019 09:34:09 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA6FC12001A for ; Thu, 30 May 2019 09:34:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=20602; q=dns/txt; s=iport; t=1559234049; x=1560443649; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=CqwYqkJbDLvd1lMQ13dTy3BDj1R1MkNrdH0C9JEqFQw=; b=GCiTTD2CQEF+81ziW4HO12GlzTt4LM4CV/mpkFCucdeydS5KGYC9KfOw 2AoLYm3y1BvOI7/TxMVM+sD0+/EUl8YyZqMrON928uGg3Rbbm16XusjNG gUdb1BMnNBeEHVmoE2JrYXMjRQpLeYYS4EgW4xG9sE4WrV6UGzNI9YKCn 8=; IronPort-PHdr: =?us-ascii?q?9a23=3AhtCofBPXArc37vdTHk4l6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEu6w/l0fHCIPc7f8My/HbtaztQyQh2d6AqzhDFf4ETB?= =?us-ascii?q?oZkYMTlg0kDtSCDBjjL/fvdyU8FexJVURu+DewNk0GUMs=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BIAACRBfBc/4sNJK1cCRwBAQEEAQE?= =?us-ascii?q?HBAEBgVEHAQELAYE9JCwDaVUgBAsohBSDRwOEUoocSoINly6BLhSBEANUCQE?= =?us-ascii?q?BAQwBARgPBgIBAYRAAheCZiM0CQ4BAwEBBAEBAgEEbRwMhUoBAQEDAQEBEBE?= =?us-ascii?q?EDQwBASkDDAQHBAIBCBEEAQEDAiYCAgIlCxUICAEBBAESCBqDAYFqAw4PAQI?= =?us-ascii?q?Mnx4CgTiIX3F8M4J5AQEFgTIBg1UYgg8DBoEMKAGEaoQigkkXgUA/gRFGgU5?= =?us-ascii?q?+PoJhAQECGIEUAQgKAQcBARgVgnMygiaLQQIGDYI+hwGScWoJAoINhWJZjQO?= =?us-ascii?q?CIYptiUqMd4EphV6MUoIwAgQCBAUCDgEBBYFPOEQjcXAVO4JsE4F8N4M5hRS?= =?us-ascii?q?FP3IKgR+LDA0XAYIrAQE?= X-IronPort-AV: E=Sophos;i="5.60,531,1549929600"; d="scan'208";a="284107899" Received: from alln-core-6.cisco.com ([173.36.13.139]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 May 2019 16:34:03 +0000 Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id x4UGY3FE005301 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 30 May 2019 16:34:03 GMT Received: from xhs-aln-001.cisco.com (173.37.135.118) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 30 May 2019 11:34:02 -0500 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 30 May 2019 11:34:01 -0500 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 30 May 2019 11:34:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CqwYqkJbDLvd1lMQ13dTy3BDj1R1MkNrdH0C9JEqFQw=; b=DEGCMKlvCOipetHfQ5zZtUZlBI3m1ulwSAj2Vf7SIOOjVdXkytmfwoyC7o9RxYui4rE0XFlQb/deLMXgIWhUPFGad59TrRFDRtAPX49j/4denLfxmOI8E/9VuGEjOg5//vn+Jzh9ercmEYC+KtsXmUK/drsGXmj0bjegJjJof+Y= Received: from BN7PR11MB2547.namprd11.prod.outlook.com (52.135.244.29) by BN7PR11MB2753.namprd11.prod.outlook.com (52.135.245.157) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1922.17; Thu, 30 May 2019 16:33:59 +0000 Received: from BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5463:bad7:8321:766e]) by BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5463:bad7:8321:766e%6]) with mapi id 15.20.1922.024; Thu, 30 May 2019 16:33:59 +0000 From: "Panos Kampanakis (pkampana)" To: Esko Dijk , "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments Thread-Index: AdUVJ+lbWrozVAUnQ9q1cKpVrur+kwB3L1hQ Date: Thu, 30 May 2019 16:33:59 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1003::156] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 92bbc6a7-922d-41fb-188e-08d6e51c9e28 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:BN7PR11MB2753; x-ms-traffictypediagnostic: BN7PR11MB2753: x-ms-exchange-purlcount: 7 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00531FAC2C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(39860400002)(366004)(346002)(396003)(51914003)(189003)(52084003)(13464003)(199004)(2906002)(316002)(6306002)(33656002)(256004)(6116002)(71200400001)(66556008)(71190400001)(229853002)(478600001)(66476007)(55016002)(9686003)(2501003)(6436002)(86362001)(966005)(14444005)(53946003)(8936002)(66946007)(8676002)(76116006)(81166006)(99286004)(110136005)(446003)(81156014)(68736007)(64756008)(66446008)(7696005)(74316002)(76176011)(30864003)(186003)(11346002)(53936002)(46003)(53546011)(305945005)(486006)(52536014)(102836004)(25786009)(7736002)(73956011)(6246003)(5660300002)(6506007)(476003)(14454004); DIR:OUT; SFP:1101; SCL:1; SRVR:BN7PR11MB2753; H:BN7PR11MB2547.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ShifQIsIJXkzqAYiVz6ynZtTs4Ar3BiGW1u5mLuQKz8V75b34tvA3VFrZDfn6mQRJArxR4u281Nj61h+uW0b4jxU98MyKkpWYjaBd5f9wNLYT/OSJxfmvvMRtGCjtSfszx+GpBaZp3Ju6ED8wOOtmoJARER6WwLPXbeIv0VHEDpvR7k5epocTnr3dF/ZLJBu7hUBpJTs3Y53qfBeQwj8WsouHRUJCExD0z7ckNW1kUpitMl5FI+rqWFBn/a9oQ+JwgSzFIUMcmMhTQVm0o2spkbQOMu0qyqVwRaYA+rzuGFzgbiaijMpmK16/3/j7hEnsUpsIHuMXuMZpHEq0bVskhA/Er9Njsbt0pzPCCKjFNOyyRVQwHrTbnjTDtzF2gyOK6NNm+SSfNNoLkOcredMQ/hGkLftomg3oAI6TgFR+H4= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 92bbc6a7-922d-41fb-188e-08d6e51c9e28 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 May 2019 16:33:59.3077 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pkampana@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2753 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.11, xch-aln-001.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-coap-est-11.txt / additional review comments X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 May 2019 16:34:12 -0000 SGkgRXNrbywNCg0KSSBhZGRyZXNzZWQgYWxsIHlvdXIgcmVzcG9uc2VzIHRvIHRoaXMgdGhyZWFk LiBDaGVjayB0aGVtIG91dCBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUvRVNU LWNvYXBzL2lzc3Vlcy8xNDUjaXNzdWVjb21tZW50LTQ5NzA0MzYyNCANCg0KUHJhY3RpY2FsbHkg YWxsIHlvdXIgbml0cyBhbmQgc3VnZ2VzdGlvbnMgd2VyZSBhZGRyZXNzZWQuIA0KU3BlY2lmaWNh bGx5IGZvciBzd2FwcGluZyAyLjAxIHdpdGggMi4wNCB0aHJvdWdob3V0IHdpbGwgYmUgcGFpbmZ1 bCBmb3IgaW50ZXJvcCBpbXBsZW1lbnRlcnMgb2YgdGhlIGRyYWZ0LiBJIHdpc2ggd2UgaGFkIGNh dWdodCBpdCBlYXJsaWVyLCBidXQgSSBzYXcgeW91ciBwb2ludCBhbmQgSSBtYWRlIHRoZSBjaGFu Z2UuIA0KDQpUaGUgZGlmZnMgYXJlIGhlcmUgaHR0cHM6Ly9naXRodWIuY29tL1Nhbkt1bWFyMjAx NS9FU1QtY29hcHMvY29tbWl0L2FjZTc1NDE0YWMyMWQyNjUyZDkzYWQxYWI2NjNhNjU3NzI2OTY4 MTc/ZGlmZj11bmlmaWVkIA0KDQpJIGFtIHBsYW5uaW5nIHRvIHN1Ym1pdCBhIG5ldyB2ZXJzaW9u IG5leHQgV2VkbmVzZGF5LiANCg0KTGV0IG1lIGtub3cgaWYgdGhlcmUgaXMgYW55dGhpbmcgZWxz ZS4gDQoNClBhbm9zDQoNCg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQWNl IDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEVza28gRGlqaw0KU2VudDogVHVl c2RheSwgTWF5IDI4LCAyMDE5IDY6MzEgQU0NClRvOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFu YSkgPHBrYW1wYW5hQGNpc2NvLmNvbT47IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtBY2Vd IEktRCBBY3Rpb246IGRyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LTExLnR4dCAvIGFkZGl0aW9uYWwg cmV2aWV3IGNvbW1lbnRzDQoNCkhlbGxvLA0KDQpUaGFua3MgZm9yIHRoZSB1cGRhdGUhIEZpcnN0 LCByZWdhcmRpbmcgdGhlIGNoYW5nZXM6DQoNCiogDQogICBtYXBwaW5nIG9mIEhUVFAgcmVzcG9u c2UgY29kZXMgdG8gQ29BUCByZXNwb25zZSBjb2Rlcy4gIFRoZSBzdWNjZXNzDQogICBjb2RlIGlu IHJlc3BvbnNlIHRvIGFuIEVTVC1jb2FwcyBHRVQgcmVxdWVzdCAoL2NhY2VydHMsIC9jc3JhdHRy cyksDQogICBpcyAyLjA1LiAgU2ltaWxhcmx5LCAyLjAxIGlzIHVzZWQgaW4gcmVzcG9uc2UgdG8g RVNULWNvYXBzIFBPU1QNCiAgIHJlcXVlc3RzICgvc2ltcGxlZW5yb2xsLCAvc2ltcGxlcmVlbnJv bGwsIC9zZXJ2ZXJrZXlnZW4pLiAgU2VjdGlvbiA3DQogICBvZiBbUkZDODA3NV0gbWFwcyAyLjAy IChEZWxldGVkKSBvciAyLjA0IChDaGFuZ2VkKSB0byBhbiBIVFRQIDIwMCBPSw0KICAgcmVzcG9u c2UsIGJ1dCAyLjAxIChDcmVhdGVkKSBpcyBtb3JlIHN1aXRhYmxlIGZvciB0aGUgY3JlYXRpb24g b2YNCiAgIGNlcnRpZmljYXRlcyBpbiB0aGUgY29udGV4dCBvZiBFU1QtY29hcHMuDQotPiAyLjAx IENyZWF0ZWQgaXMgbm93IHVzZWQgYXMgUE9TVCByZXNwb25zZS4gIFdoaWxlIEkgYWdyZWUgdGhh dCBpdCBzb3VuZHMgbW9yZSBsb2dpY2FsIHRvIHVzZSAyLjAxIHRoYW4gMi4wNCAoc2luY2UgYSBj ZXJ0aWZpY2F0ZSBpcyBjcmVhdGVkIGJ5IHRoZSBzZXJ2ZXIsIGJhc2VkIG9uIHRoZSBDU1IpLCB0 aGVyZSBpcyB0aGUgQ29BUCBsZXZlbCBleHBlY3RhdGlvbiB0aGF0IHdoZW4gdXNpbmcgMi4wMSB0 aGUgcmVzb3VyY2UgaXMgY3JlYXRlZCBhdCB0aGUgbG9jYXRpb24gb2YgdGhlIHJlcXVlc3QgLSB0 aGF0IGlzLCBmb3IgZXhhbXBsZSwgYXQgL3Nlbi4gU28gaWYgdGhlIGNsaWVudCB3b3VsZCBkbyBh IEdFVCAvc2VuIGl0IHdvdWxkIGdldCB0aGUgYWN0dWFsIHByZXZpb3VzbHkgY3JlYXRlZCBjZXJ0 aWZpY2F0ZS4gKFdoaWNoIGlzIG5vdCB0aGUgY2FzZS4pIFRoZSB0ZXh0IGluIFJGQyA3MjUyIHRo YXQgc3RhdGVzIHRoaXMgaXMgIk90aGVyd2lzZSwgdGhlIHJlc291cmNlIHdhcyBjcmVhdGVkIGF0 IHRoZSByZXF1ZXN0IFVSSS4iICAgU28gMi4wMSBpcyB1c2VkIHRvIGNyZWF0ZSBuZXcgQ29BUCAq cmVzb3VyY2VzKiB0aGF0IGNhbiBiZSBmb3VuZCBhdCB0aGUgc2VydmVyIHVzaW5nIGEgc3Vic2Vx dWVudCBHRVQgcmVxdWVzdC4gQW5kIDIuMDQgaXMgdXNlZCB0byBleGVjdXRlIGFjdGlvbnMgbGlr ZSAnY3JlYXRlIHgnICwgdGhlIHJlc3VsdCBvZiB3aGljaCBpcyByZXR1cm5lZCBpbiB0aGUgcmVz cG9uc2UgYnV0IG90aGVyd2lzZSBub3QgYXZhaWxhYmxlIGFueXdoZXJlIG9uIHRoZSBzZXJ2ZXIg YW55bW9yZS4gVGhlIGxhdHRlciBpcyB0aGUgY2FzZSBpbiB0aGUgRVNULWNvYXBzIHByb3RvY29s IGZsb3cgYXMgdGhlcmUncyBubyB3YXkgdG8gR0VUIHRoZSByZXN1bHRpbmcgY2VydGlmaWNhdGUg bGF0ZXIgb24uDQotPiB0aGUgcmVzb3VyY2VzIGluIGJyYWNrZXRzIHNob3VsZCBub3cgYmUgdGhl IHNob3J0IHJlc291cmNlIG5hbWVzLCBzaW5jZSB3ZSB0YWxrIGFib3V0IEVTVC1jb2FwcyByZXNv dXJjZXMgbm90IEVTVCByZXNvdXJjZXMgYW55bW9yZS4gU28gIkdFVCByZXF1ZXN0ICgvY3J0cywg L2F0dCkiIGV0Yy4NCg0KKiAiRVNUIG1ha2VzIHVzZSBvZiBIVFRQIDIwNCByZXNwb25zZXMgd2hl biBhIHJlc291cmNlIGlzIG5vdCBhdmFpbGFibGUgZm9yIHRoZSBjbGllbnQuIg0KLT4gRVNUIHN0 YXRlcyBlaXRoZXIgMjA0IG9yIDQwNCBjYW4gYmUgdXNlZDsgd2hpY2ggaW4gQ29BUCB0cmFuc2xh dGVzIHRvIDQuMDQgTm90IEZvdW5kICBpZiB0aGUgcmVzb3VyY2UgaXMgbm90IGF2YWlsYWJsZSB0 byB0aGUgY2xpZW50LCBpLmUuIGRvZXMgbm90IGV4aXN0LiBUaGF0IHNlZW1zIHRoZSBlYXNpZXN0 IHRyYW5zbGF0aW9uIGhlcmUuIFRob3VnaCB0aGUgc2VydmVyIGNvdWxkIGFsc28gc2VuZCAyLjA1 IHdpdGggYW4gZW1wdHkgemVyby1sZW5ndGggcGF5bG9hZCwgdG8gZXhwcmVzcyB0aGF0IGl0IGhh cyB0aGF0IGZ1bmN0aW9uIGF2YWlsYWJsZSBidXQgdGhlcmUgaXMgIm5vdGhpbmciIHRoZXJlIGZv ciB0aGUgY2xpZW50Lg0KDQoqIDIuMDQgU0hPVUxEIG9ubHkgYmUgdXNlZCBpbiByZXNwb25zZSB0 byBhbiBFU1QtY29hcHMNCiAgIFBPU1Qgd2hlbiB0aGUgcmVzcG9uc2UgY29tZXMgZGVsYXllZCBp biBhIHNlcGFyYXRlIChub3QgUGlnZ3liYWNrZWQpDQogICBtZXNzYWdlIGFmdGVyIGFuIGVtcHR5 IDAuMDAgbWVzc2FnZSAoU2VjdGlvbiA1LjcpDQotPiB0aGlzIHNlZW1zIHN0cmFuZ2UsIHRoZSBy ZXNwb25zZSBjb2RlIHJlbWFpbnMgdGhlIHNhbWUgd2hldGhlciBzZXBhcmF0ZSByZXNwb25zZSBv ciBwaWdneWJhY2tlZCByZXNwb25zZSBpcyB1c2VkLiBBdCB0aGlzIGxldmVsIG9mIHJlcXVlc3Qv cmVzcG9uc2UsIHRoZXJlJ3Mgbm8gbmVlZCB0byB0cnkgdG8gZGV0YWlsIHRoaXMuIEkgZmVlbCBp dCBvbmx5IG1ha2VzIGl0IG1vcmUgY29tcGxleDsgdGhlIGJhc2UgQ29BUCBwcm90b2NvbCBzaG91 bGQgaGFuZGxlIHBpZ2d5YmFja2VkIHZzIHNlcGFyYXRlIGZvciBib3RoIGNsaWVudCBhbmQgc2Vy dmVyLiAoV2l0aG91dCBpbXBhY3Qgb24gcmVzcG9uc2UgY29kZXMpLg0KDQoqIFRhYmxlIDM6IHRo ZSAiNC54eCIgY2FuIGJlICI0Lnh4IC8gNS54eCIgYmVjYXVzZSB0aGUgNS54eCBmYWlsdXJlcyBj YW4gYWxzbyBvY2N1ciBpbiBhbnkgQ29BUCBzZXJ2ZXIgaW4gcHJpbmNpcGxlLiAgSSBkb24ndCBy ZWFsbHkgc2VlIHdoeSA0LjAyIHNob3VsZCBiZSBtZW50aW9uZWQgc2VwYXJhdGVseT8gSXQgYWdh aW4gaXMgZGVmaW5lZCBpbiB0aGUgYmFzZSBDb0FQIHNwZWMgYW5kIG5vdCByZWFsbHkgb2YgaW50 ZXJlc3QgZm9yIEVTVC1jb2Fwcywgbm9yIHVzZWQgYnkgYW55IGRlZmluaXRpb25zIG9yIGV4YW1w bGVzIGluIHRoZSBjdXJyZW50IHNwZWNpZmljYXRpb24uDQoNCg0KU2Vjb25kLCBiZWxvdyBhIGZl dyBtb3JlIHJldmlldyBjb21tZW50cyBvbiB0aGUgLTExIHZlcnNpb246DQoNCiogRW5kIG9mIFNl Y3Rpb24gNjogIklmIG5lY2Vzc2FyeSwgdGhlIEVTVC1jb2Fwcy10by1IVFRQIFJlZ2lzdHJhciB3 aWxsIHN1cHBvcnQgcmVzb3VjZSBkaXNjb3ZlcnkgYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBpbiBT ZWN0aW9uIDUuMS4iDQotPiB3aGF0IGFib3V0IChhbHNvIGFkZGVkIGxldHRlciB0byAncmVzb3Vj ZScpDQoiVGhlIEVTVC1jb2Fwcy10by1IVFRQIFJlZ2lzdHJhciBNVVNUIHN1cHBvcnQgcmVzb3Vy Y2UgZGlzY292ZXJ5IGFjY29yZGluZyB0byB0aGUgcnVsZXMgaW4gU2VjdGlvbiA1LjEuIg0KQmVj YXVzZSB0aGlzIFJlZ2lzdHJhciBvcGVyYXRlcyB0byB0aGUgQ29BUCBjbGllbnQgZmFjaW5nIHNp ZGUgZXhhY3RseSBsaWtlIGEgQ29BUCBFU1Qgc2VydmVyLiBTbyBpdCBtdXN0IHN1cHBvcnQgdGhl IHNhbWUgcnVsZXMgZm9yIGRpc2NvdmVyeSwgb3IgZWxzZSBpdCB3b24ndCB3b3JrIChlLmcuIGJl IG5vdCBkaXNjb3ZlcmFibGUpLg0KDQoqIFNlY3Rpb24gOS4xOiAiVGhlc2UgaGF2ZSBiZWVuIHJl Z2lzdGVyZWQgcHJvdmlzaW9uYWxseSBpbiB0aGUgRXhwZXJ0IFJldmlldyByYW5nZSAoMC0yNTUp Ig0KLT4gIlRoZXNlIGhhdmUgYmVlbiByZWdpc3RlcmVkIHByb3Zpc2lvbmFsbHkgaW4gdGhlIElF VEYgUmV2aWV3IG9yIElFU0cgQXBwcm92YWwgcmFuZ2UgKDI1Ni05OTk5KSINCg0KKiBTZWN0aW9u IDEwLjE6IA0KICAgQSBjbGllbnQgdGhhdCBwaXBlbGluZXMgRVNULWNvYXBzIC9jcnRzIHJlcXVl c3QNCiAgIHdpdGggb3RoZXIgcmVxdWVzdHMgaW4gdGhlIHNhbWUgRFRMUyBjb25uZWN0aW9uIFNI T1VMRCByZXZhbGlkYXRlIHRoZQ0KICAgc2VydmVyIGNlcnRpZmljYXRlIGNoYWluIGFnYWluc3Qg dGhlIHVwZGF0ZWQgRXhwbGljaXQgVEEgZnJvbSB0aGUNCiAgIC9jcnRzIHJlc3BvbnNlIGJlZm9y ZSBwcm9jZWVkaW5nIHdpdGggdGhlIHN1YnNlcXVlbnQgcmVxdWVzdHMuICANCiAgIElmIHRoZSBz ZXJ2ZXIgY2VydGlmaWNhdGUgY2hhaW4gZG9lcyBub3QgYXV0aGVudGljYXRlIGFnYWluc3QgdGhl DQogICBkYXRhYmFzZSwgdGhlIGNsaWVudCBTSE9VTEQgY2xvc2UgdGhlIGNvbm5lY3Rpb24gd2l0 aG91dCBjb21wbGV0aW5nDQogICB0aGUgcmVzdCBvZiB0aGUgcmVxdWVzdHMuICBUaGUgdXBkYXRl ZCBFeHBsaWNpdCBUQSBNVVNUIGNvbnRpbnVlIHRvDQogICBiZSB1c2VkIGluIG5ldyBEVExTIGNv bm5lY3Rpb25zLg0KLT4gZG9lcyB0aGUgbGFzdCByZXF1aXJlbWVudCBtZWFuIG5ldyBEVExTIGNv bm5lY3Rpb25zIHRvIHRoZSBzYW1lIEVTVCBzZXJ2ZXI/IE9yLCBuZXcgRFRMUyBjb25uZWN0aW9u cyB0byBhbnkgRVNUIHNlcnZlcihzKSBpbiB0aGUgZnV0dXJlPyANCi0+IGl0IGlzIGFsc28gdW5j bGVhciBoZXJlIHdoZXRoZXIgdGhlIHVwZGF0ZWQgRXhwbGljaXQgVEEgbmVlZHMgdG8gcmVwbGFj ZSBhbiBleGlzdGluZyBjb25maWd1cmVkIEV4cGxpY2l0IFRBIChlLmcuIG9idGFpbmVkIGZyb20g YW4gQU5JTUEgdm91Y2hlciBvciBhIHByZXZpb3VzIC9jcnRzIHJlcXVlc3QuICkuICBJIHdvdWxk IHRoaW5rIG5vdCwgZXNwZWNpYWxseSBnaXZlbiB0aGF0IHRoZSB2ZXJpZmljYXRpb24gb2YgaXQg ZmFpbGVkIGluIGFib3ZlIHRleHQ/DQotPiBJIHdvbmRlciB3aHkgdGhlIGNsaWVudCB3b3VsZCB0 cnVzdCBhIG5ldyBFeHBsaWNpdCBUQSwgaWYgdGhlIEVTVCBzZXJ2ZXIgaXRzZWxmIGNhbm5vdCBi ZSBhdXRoZW50aWNhdGVkIHVzaW5nIHRoYXQgVEEuIEl0IHdpbGwgZGlzY29ubmVjdCBhbmQgdGhl biB1cG9uIG5leHQgRFRMUyBjb25uZWN0aW9uIHRvIHRoZSBzYW1lIHNlcnZlciB0aGUgaGFuZHNo YWtlIHdpbGwgZmFpbCBhZ2FpbnN0IHRoZSBuZXcgVEEuIEFuZCB0aGUgY2xpZW50IGNhbid0IHBl cmZvcm0gRVNUIGFueW1vcmUgdW50aWwgZmFjdG9yeSByZXNldC4gT3IgaXMgdGhlIGV4cGVjdGF0 aW9uIHRoYXQgaXQgc29tZWhvdyB3aWxsIHVzZSBhbm90aGVyIEVTVCBzZXJ2ZXIgZm9yIGEgc2Vj b25kIHRyeT8NCg0KKiBTZWN0aW9uIDEwLjE6ICJkZXBlbmQgaW4iIC0+ICJkZXBlbmQgb24iDQoN CiogU2VjdGlvbiAxMC4xOiAiZXNwZWNpYWxseSBzaW5jZSB0aGUgcHJhY3RpY2FsaXR5IG9mIHN1 Y2ggYW4gYXR0YWNrIHdvdWxkIG5vdCBleHBvc2UgYW55IG1lc3NhZ2VzIGV4Y2hhbmdlZCB3aXRo IEVTVC1jb2Fwcy4iDQotPiByYXRoZXIgY29tcGxleCBzZW50ZW5jZSwgd2hhdCBhYm91dA0KIiJl c3BlY2lhbGx5IHNpbmNlIGEgM1NIQUtFIGF0dGFjayBkb2VzIG5vdCBleHBvc2UgbWVzc2FnZXMg ZXhjaGFuZ2VkIHdpdGggRVNULWNvYXBzLiINCg0KKiBTZWN0aW9uIDEwLjE6ICJSZWdhcmRpbmcg dGhlIENlcnRpZmljYXRlIFNpZ25pbmcgUmVxdWVzdCAoQ1NSKSwgYSBDQSBpcyBleHBlY3RlZCB0 byBiZSBhYmxlIHRvIGVuZm9yY2UgcG9saWNpZXMgdG8gcmVjb3ZlciBmcm9tIGltcHJvcGVyIENT UiByZXF1ZXN0cy4iDQotPiBzaG91bGQgYmUgImFuIEVTVC1jb2FwcyBzZXJ2ZXIgaXMgZXhwZWN0 ZWQgdG8iID8gICBCZWNhdXNlIHRoaXMgc3BlY2lmaWNhdGlvbiBhbmQgMTAuMSBkZXNjcmliZXMg dGhlIEVTVC1jb2FwcyBzZXJ2ZXIsIG5vdCBhIENBLg0KDQoqIFNlY3Rpb25zIDUuMSwgNS43LCAx MC4yIDogd29yZCAiaGUiIGlzIHVzZWQgdG8gcmVmZXIgdG8gY2xpZW50IG9yIHNlcnZlci4gTWF5 YmUgdGhpcyBzaG91bGQgYmVjb21lICJpdCIgKG5vdCBhIHBlcnNvbikuDQoNCg0KDQotLS0tLU9y aWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpIDxw a2FtcGFuYUBjaXNjby5jb20+IA0KU2VudDogU2F0dXJkYXksIE1heSAyNSwgMjAxOSAwNjo0OA0K VG86IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPjsgYWNlQGlldGYub3Jn DQpTdWJqZWN0OiBSRTogW0FjZV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3Qt MTEudHh0DQoNCkhpIEVza28sDQoNClRoYW5rIHlvdSBhZ2Fpbi4gQWdhaW4gYSB2ZXJ5IGVsYWJv cmF0ZSByZXZpZXcgYW5kIGZvdW5kIHNvbWUgZ29vZCBuaXRzIGluIHRoZSBEZWxheWVkIHJlc3Bv bnNlcyBzZWN0aW9uLiBUbyBtYWtlIGl0IGVhc2llciBJIGxvZ2dlZCB0aGUgaXNzdWVzIGFuZCBm aXhlcyBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUvRVNULWNvYXBzL2lzc3Vl cy8xNDUgDQoNClRoZSB1cGRhdGVkIGRvYyBpcyBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5L dW1hcjIwMTUvRVNULWNvYXBzL2Jsb2IvbWFzdGVyL2RyYWZ0LWlldGYtYWNlLWNvYXAtZXN0LnR4 dCBhbmQgdGhlIGRpZmZzIGFyZSBoZXJlIGh0dHBzOi8vZ2l0aHViLmNvbS9TYW5LdW1hcjIwMTUv RVNULWNvYXBzL2NvbW1pdC80YWQ1MjEwZmFmNjI0YzY3ZTE5OThkYTc1ZWEwNTFkZTYxNmU5MWIx I2RpZmYtM2E3MTJlZGI0M2Y2ZWFjZTdmYjE2NjczMjhkNjUzMDcgIA0KDQpSZ3MNClBhbm9zDQoN Ci0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBFc2tvIERpamsgPGVza28uZGlqa0Bp b3Rjb25zdWx0YW5jeS5ubD4gDQpTZW50OiBUdWVzZGF5LCBNYXkgMjEsIDIwMTkgNjozMSBQTQ0K VG86IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPjsgYWNl QGlldGYub3JnDQpDYzogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3RAaWV0Zi5vcmcNClN1YmplY3Q6 IFJFOiBbQWNlXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC0xMS50eHQNCg0K SGVsbG8gUGFub3MsDQoNCkZvciB0aGUgZHJhZnQgdGV4dCBJIGhhdmUgYSBjb3VwbGUgb2YgbW9y ZSByZXZpZXcgcmVtYXJrczoNCg0KKiBwYWdlIDggZmlyc3QgYnVsbGV0OiBhIHByZXZpb3VzbHkg aXNzdWVzIGNsaWVudCBjZXJ0aWZpY2F0ZSBjb3VsZCBhbHNvIGV4cGlyZSwgaW4gc29tZSBjYXNl cyBldmVuIHdpdGhvdXQgdGhlIGNsaWVudCBrbm93aW5nLiBJZiB0aGUgY2xpZW50IHRoZW4gcGVy Zm9ybXMgc2ltcGxlIHJlLWVucm9sbG1lbnQgLS0gdXNpbmcgaXRzIHByZXZpb3VzIG9wZXJhdGlv bmFsIGNlcnQgYXMgYXV0aGVudGljYXRpb24sIHdoYXQgd291bGQgaGFwcGVuPyAgSSB3b3VsZCBl eHBlY3QgdGhlIHNlcnZlciBNQVkgYWxzbyB3YW50IHRvIHVzZSB0aGlzIGNlcnRpZmljYXRlIHRv IGF1dGhlbnRpY2F0ZSB0aGUgY2xpZW50LiBCZWNhdXNlIHRoZSBwdXJwb3NlIG9mIHRoZSBjbGll bnQgY29ubmVjdGluZyBhZ2FpbiB0byB0aGUgRVNUIHNlcnZlciBpcyB0byBkbyBzaW1wbGUgcmUt ZW5yb2xsbWVudCwgdG8gZ2V0IGEgbmV3IGNlcnRpZmljYXRlLiAgIFN1cHBvc2UgYSBjYXNlIHdo ZXJlIHRoZSBoYW5kc2hha2UgdG8gdGhlIEVTVCBzZXJ2ZXIgZmFpbHMgYmVjYXVzZSB0aGUgRVNU IHNlcnZlciByZWplY3RzIHRoZSBleHBpcmVkIG9wZXJhdGlvbmFsIGNlcnQ6ICB3aGF0IHdvdWxk IHRoZSBjbGllbnQgZG8gbm93PyBJdCBjb3VsZCBiZSBhIGNlcnRpZmljYXRlX2V4cGlyZWQgbWVz c2FnZS4gIFJGQyA3MDMwIHByb3ZpZGVzIG5vIGd1aWRhbmNlIGluIHRoaXMgbWF0dGVyOyB3b3Vs ZCBFU1QtY29hcHMgbmVlZCB0byBkZWZpbmUgdGhpcz8gRS5nLiBjbGllbnQgU0hPVUxEIHJldHJ5 IHVzaW5nIHRoZSBidWxsZXQgIzIgY2VydGlmaWNhdGUgKGUuZy4gSURldklEKT8NCg0KKiBwYWdl IDggbWlkZGxlOiAiQ29BUCBhbmQgRFRMUyBjYW4gcHJvdmlkZSBwcm9vZi1vZi1pZGVudGl0eSBm b3IgRVNULWNvYXBzIGNsaWVudHMgYW5kIHNlcnZlcnMgd2l0aCBzaW1wbGUgUEtJIG1lc3NhZ2Vz IGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDMuMSBvZiBbUkZDNTI3Ml0gIg0KTG9va2luZyB1cCB0 aGlzIHNlY3Rpb24gaXQgc2F5czogIlRoZSBTaW1wbGUgUEtJIFJlcXVlc3QgTVVTVCBOT1QgYmUg dXNlZCBpZiBhIHByb29mLW9mLWlkZW50aXR5IG5lZWRzIHRvIGJlIGluY2x1ZGVkLiIgICBUaGlz IHNlZW1zIHRvIHNheSB0aGUgb3Bwb3NpdGUgb2YgdGhlIGFib3ZlIHRleHQ/ICBUaGlzIHJlcXVp cmVzIGF0IGxlYXN0IHNvbWUgbW9yZSBleHBsYW5hdGlvbi4NCg0KKiBwYWdlIDggbWlkZGxlOiAi TW9yZW92ZXIsIGNoYW5uZWwtYmluZGluZyBpbmZvcm1hdGlvbiBmb3IgbGlua2luZyBwcm9vZi1v Zi1pZGVudGl0eSB3aXRoIGNvbm5lY3Rpb24tYmFzZWQgcHJvb2Ytb2YtcG9zc2Vzc2lvbiBpcyBP UFRJT05BTCBmb3IgRVNULWNvYXBzIiAgLT4gaXMgaXQgT1BUSU9OQUwgZm9yIGNsaWVudCwgc2Vy dmVyLCBvciBib3RoPyBJIHdvdWxkIGFzc3VtZSBpdCBpcyBPUFRJT05BTCBmb3IgYm90aC4gSWYg dGhlIChsaWdodC13ZWlnaHQpIGNsaWVudCBkb2VzIG5vdCBpbXBsZW1lbnQgaXQgYW5kIGlmIHRo ZSBzZXJ2ZXIgZG9lcyBtYW5kYXRlIGl0LCB0aGUgY2xpZW50IGNhbiBub3QgY29ubmVjdCB0byB0 aGF0IHNlcnZlciBpZiBpdHMgcG9saWN5IGlzIHNldCB0byAibGlua2luZyBQT1AvaWRlbnRpdHkg cmVxdWlyZWQiLg0KDQoqIHBhZ2UgMTQgdG9wIGJ1bGxldDogIlRoZSBDb0FQIE9wdGlvbnMgdXNl ZCBhcmUgLi4uLiAiIA0KICAtPiB0aGUgaXRlbSBCbG9jayBjb3VsZCBiZSBleHBhbmRlZCB0byAi QmxvY2sxLCBCbG9jazIiIHRvIGNhcHR1cmUgdGhlIGFjdHVhbCBPcHRpb24gbmFtZXMuDQogIC0+ IExvY2F0aW9uLVBhdGggaXMgbmV2ZXIgdXNlZCBpbiBhbnkgb2YgdGhlIENvQVAgaW50ZXJhY3Rp b25zIGRlZmluZWQ7IHNob3VsZCBiZSByZW1vdmVkLg0KDQoqIFBhZ2UgMTQgZmlyc3QgNS41IHBh cmFncmFwaDogIlNpbWlsYXJseSwgMi4wMSwgMi4wMiBvciAyLjA0IE1VU1QgYmUgdXNlZCBpbiBy ZXNwb25zZSB0byBFU1QgUE9TVCByZXF1ZXN0cyINCiAgLT4gMi4wMSBDcmVhdGVkIGlzIGxpa2Ug SFRUUCAyMDEsIHdoaWNoIGlzIG5vdCB1c2VkIGluIEVTVCAtIHNvIGNhbiBiZSByZW1vdmVkIGhl cmUuDQogIC0+IDIuMDIgRGVsZXRlZCBoYXMgbm8gSFRUUCBlcXVpdmFsZW50LCBzbyBpcyBub3Qg dXNlZCBpbiBFU1QuIEl0IHNob3VsZCBiZSByZW1vdmVkIGhlcmUuDQogIC0+IHRoYXQgbGVhdmVz IG9ubHkgMi4wNCByZXNwb25zZXMuIEhvd2V2ZXIgdGhlIHRleHQgc2hvdWxkIHNheSB0aGlzIGlz IGZvciBzdWNjZXNzZnVsIChIVFRQIDIwMCBvciAyMDIgaW4gRVNUKSByZXNwb25zZXMgLCBzbyBz dWdnZXN0aW9uIGlzIHRvIGNoYW5nZSBhYm92ZSBzZW50ZW5jZSB0bzogIlNpbWlsYXJseSwgMi4w NCBNVVNUIGJlIHVzZWQgaW4gYSByZXNwb25zZSB0byBhIHN1Y2Nlc3NmdWwgRVNUIFBPU1QgcmVx dWVzdCINCg0KKiBwYWdlIDE0IGJvdHRvbTogIkVTVCBtYWtlcyB1c2Ugb2YgSFRUUCAyMDQgYW5k IDQwNCByZXNwb25zZXMgd2hlbiBhIHJlc291cmNlIGlzIG5vdCAgYXZhaWxhYmxlIGZvciB0aGUg Y2xpZW50LiAgVGhlIGVxdWl2YWxlbnQgQ29BUCBjb2RlcyB0byB1c2UgaW4gYW4gRVNULWNvYXBz IHJlc3BvbnNlcyBhcmUgMi4wNCBhbmQgNC4wNC4gICINCiAgLT4gQ29BUCAyLjA0IGNhbiBvbmx5 IGJlIHVzZWQgaW4gcmVzcG9uc2VzIHRvIFBPU1Qgb3IgUFVUIHJlcXVlc3RzLCBub3QgZm9yIEdF VCByZXNwb25zZXMuDQogIC0+IHNvIGluIENvQVAgdGhlIHNlcnZlciBjb3VsZCBlaXRoZXIgcmV0 dXJuIDIuMDUgd2l0aCBlbXB0eSBwYXlsb2FkIChlcXVpdmFsZW50IHRvIEhUVFAgMjA0KSwgb3Ig cmV0dXJuIDQuMDQgKGVxdWl2YWxlbnQgdG8gSFRUUCA0MDQpDQoNCiogcGFnZSAxNSBib3R0b206 ICJUaGUgRVNULWNvYXBzIGNsaWVudCBhbmQgc2VydmVyIE1VU1Qgc3VwcG9ydCBCbG9jazIuICBC bG9jazEgTVVTVCBiZSBzdXBwb3J0ZWQgZm9yIEVTVC1jb2FwcyBlbnJvbGxtZW50IHJlcXVlc3Rz IHRoYXQgZXhjZWVkIHRoZSBQYXRoIE1UVS4iDQogIC0+IGNvdWxkIGJlIGNsYXJpZmllZCBiZXR0 ZXIsIEkgZXhwZWN0IGEgRVNULWNvYXBzIHNlcnZlciBNVVNUIHN1cHBvcnQgQmxvY2sxIGJlY2F1 c2UgdGhhdCBzZXJ2ZXIgZG9lc24ndCBrbm93IGluIGFkdmFuY2UgaG93IGJpZyB0aGUgY2xpZW50 J3MgcmVxdWVzdCBwYXlsb2FkIGlzIGdvaW5nIHRvIGJlIGFuZCB3aGV0aGVyIHRoYXQgY2xpZW50 IHdpbGwgdXNlIEJsb2NrMS4NCiAgLT4gZS5nLiAiVGhlIEVTVC1jb2FwcyBjbGllbnQgYW5kIHNl cnZlciBNVVNUIHN1cHBvcnQgQmxvY2syLiAgVGhlIEVTVC1jb2FwcyBzZXJ2ZXIgTVVTVCBzdXBw b3J0IEJsb2NrMS4gVGhlIEVTVC1jb2FwcyBjbGllbnQgTVVTVCBzdXBwb3J0IEJsb2NrMSBpZiBp dCBzZW5kcyBFU1QtY29hcHMgcmVxdWVzdHMgd2l0aCBhbiBJUCBwYWNrZXQgc2l6ZSB0aGF0IGV4 Y2VlZHMgdGhlIFBhdGggTVRVLiINCg0KKiBwYWdlIDE2IGV4YW1wbGU6IHRoZSBwYXlsb2FkcyBh cmUgbm90IGluZGljYXRpbmcgdGhhdCBlYWNoICJ7Q1NSIHJlcX0iIHBheWxvYWQgaXMgZGlmZmVy ZW50LiBJLmUuLCBhIGRpZmZlcmVudCBibG9jay4gSXQgd291bGQgYmUgbW9yZSBjbGVhciBpZiB0 aGF0IGlzIHNob3duIGUuZy4gIntDU1IgMX0iLCAie0NTUiAyfSIsIC4uLiB1cCB0byAie0NTUiBO MSsxfSIuIFRoZSAicmVxIiBzdHJpbmcgaXMgbm90IG5lZWRlZCBzaW5jZSB0aGUgUiBpbiBDU1Ig YWxyZWFkeSBzdGFuZHMgZm9yIHJlcXVlc3QuDQoNCiogcGFnZSAxNyBleGFtcGxlOiBzZWUgYWJv dmUgcGF5bG9hZHMgcmVtYXJrOyBhbmQgdGhlIGZvbGxvd2luZzoNCiAgLS0+IHdoYXQgSSBmaW5k IHN0cmFuZ2UgaGVyZSBpcyB0aGF0IGEgYmxvY2t3aXNlIFBPU1QgcmVxdWVzdCBlbmRzIHdpdGgg YSA1LjAzIHJlc3BvbnNlLCBhbmQgdGhlbiB0aGUgc2FtZSByZXF1ZXN0IGFmdGVyIHRoYXQgZ2l2 ZXMgYSAyLjAxIHJlc3BvbnNlLiBJbiBDb0FQIEFGQUlLLCBvbmUgcmVxdWVzdCBjYW4gbmV2ZXIg Z2l2ZSAyIHJlc3BvbnNlcyBpbiBzZXF1ZW5jZS4NCiAgLS0+IG9uY2UgYSByZXNwb25zZSBpcyBk ZWxpdmVyZWQgYmFjayB0byB0aGUgY2xpZW50IHBpZ2d5YmFja2VkIG9uIGFuIEFDSywgdGhlIHNl cnZlciBjbG9zZXMgdGhlIHRyYW5zYWN0aW9uIG5vcm1hbGx5IGFuZCBubyBmdXJ0aGVyIHN0YXRl IGZvciB0aGUgdHJhbnNhY3Rpb24gaXMga2VwdC4NCiAgLS0+IG5vcm1hbGx5IGlmIGEgc2VydmVy IHNlbmRzIDUuMDMgd2l0aCBNYXgtQWdlIHRoZSBjbGllbnQgbmVlZHMgdG8gc2VuZCBhIG5ldyBy ZXF1ZXN0IGkuZS4gcmV0cnkgd2l0aCBhIG5ldyByZXF1ZXN0IGFmdGVyIHRoaXMgd2FpdGluZyB0 aW1lLiAgIFRoYXQgaW1wbGllcyB0aGUgY2xpZW50IHdvdWxkIG5lZWQgdG8gcmVzZW5kIHRoZSBl bnRpcmUgcmVxdWVzdDogYWxsIGJsb2NrcyBvZiBpdCENCiAgLS0+IEkgZG8gcmVhbGl6ZSB0aGF0 IHJlc2VuZGluZyBhbGwgYmxvY2tzIGlzIHZlcnkgaW5lZmZpY2llbnQgOyBidXQgYXQgdGhlIHNh bWUgdGltZSB0aGUgZXhhbXBsZSBhbHNvIHNlZW1zIGluY29tcGF0aWJsZSB3aXRoIENvQVAgc3Bl Y3MuDQogIC0tPiBhbm90aGVyIHF1ZXN0aW9uIGlzIHdoeSBkb2VzIHRoZSBzZXJ2ZXIgdXNlIEJs b2NrMiBvcHRpb24gaW4gdGhlIDUuMDMgcmVzcG9uc2UgdGhhdCBoYXMgbm8gcGF5bG9hZC4gSW4g UkZDIDc5NTkgU2VjdGlvbiAyLjEsICJ0aGUgQmxvY2syIE9wdGlvbiBwZXJ0YWlucyB0byB0aGUg cmVzcG9uc2UgcGF5bG9hZCIgYW5kICJwYXlsb2FkLWJlYXJpbmcgcmVzcG9uc2VzIi4gU28gaXQg c2hvdWxkIGJlIGp1c3QgbGVmdCBvdXQgaW4gdGhlIHJlc3BvbnNlIHdpdGhvdXQgcGF5bG9hZCBJ IHRoaW5rLg0KICAtLT4gSSB1bmRlcnN0YW5kIHRoaXMgc2VxdWVuY2Ugb2YgbWVzc2FnZXMgd2Fz IHRlc3RlZCB1c2luZyBpbnRlcm9wcy9jb2RlOyB3YXMgYSBzcGVjaWZpYyBDb0FQIGxpYnJhcnkg dXNlZCB0aGF0IGV4aGliaXRzIHRoaXMgYmVoYXZpb3I/IEkgd291bGQgYmUgaW50ZXJlc3RlZCB0 byB1bmRlcnN0YW5kIGJldHRlciB3aHkgdGhpcyB3b3Jrcy4NCg0KSG9wZSB0aGVzZSBjb21tZW50 cyBjYW4gc3RpbGwgYmUgdXNlZCBmb3IgaW1wcm92ZW1lbnQgb2YgdGhlIHNwZWMuIEkgd2lsbCBz ZW5kIGZ1cnRoZXIgcmV2aWV3IGNvbW1lbnRzIGluIGEgbmV4dCBlbWFpbDogc3RpbGwgbmVlZCB0 byB3cml0ZSB0aGVzZSBkb3duLg0KDQpCZXN0IHJlZ2FyZHMNCkVza28NCg0KDQoNCi0tLS0tT3Jp Z2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgPHBr YW1wYW5hQGNpc2NvLmNvbT4gDQpTZW50OiBNb25kYXksIE1heSAyMCwgMjAxOSAxNzozMQ0KVG86 IEVza28gRGlqayA8ZXNrby5kaWprQGlvdGNvbnN1bHRhbmN5Lm5sPjsgYWNlQGlldGYub3JnDQpT dWJqZWN0OiBSRTogW0FjZV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1hY2UtY29hcC1lc3QtMTEu dHh0DQoNClRoYW5rcyBFc2tvLiANCg0KQWRkcmVzc2VkIGluIGh0dHBzOi8vZ2l0aHViLmNvbS9T YW5LdW1hcjIwMTUvRVNULWNvYXBzL2Jsb2IvODRjZTBjMWQ1ZTc2OGQ0MGU5NzE4NDIxNGJhZTQw NGRhMjFiZDA1MC9kcmFmdC1pZXRmLWFjZS1jb2FwLWVzdC54bWwgVHdvIGNvbW1lbnRzOiANCg0K PiBwYWdlIDExIGJvdHRvbSByZXF1aXJlbWVudDogIiBUaGUgY2xpZW50IFNIT1VMRCB1c2UgcmVz b3VyY2UgZGlzY292ZXJ5IHdoZW4gaGUgaXMgdW5hd2FyZSBvZiB0aGUgYXZhaWxhYmxlICBFU1Qt Y29hcHMgcmVzb3VyY2VzLiIgLSB3aGVuIGFuIEVTVCBzZXJ2ZXIgaXMga25vd24sIHRoaXMgcmVx dWlyZW1lbnQgZG9lcyBub3QgcmVhbGx5IGFwcGx5IHNpbmNlIHRoZSBzZXJ2ZXIgYWx3YXlzIHN1 cHBvcnRzIC53ZWxsLWtub3duIEVTVCByZXNvdXJjZXMuICBTbyBJIHJlYWQgaXQgYXMgZG9pbmcg YW4gUkQgZGlzY292ZXJ5IG9yIG11bHRpY2FzdCBDb0FQIGRpc2NvdmVyeSBpZiB0aGUgY2xpZW50 IGRvZXNuJ3Qga25vd24gdGhlIEVTVCBzZXJ2ZXIgYWRkcmVzcy4gIEhvcGUgdGhpcyBpcyBjbGVh ciBlbm91Z2ggaW4gdGhlIHRleHQgYW5kIGludGVuZGVkPw0KDQpUaGVyZSBhcmUgb3B0aW9uYWwg cmVzb3VyY2VzIGxpa2UgL2F0dCwgL3NrZyBhbmQgL3NrYyB0aGF0IHRoZSBzZXJ2ZXIgZG9lcyBu b3QgaGF2ZSB0byBzdXBwb3J0LCBzbyB0aGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVm ZXJyaW5nIHRvLiANCg0KPiBwYWdlIDExIGJvdHRvbTogIiBJdCBpcyB1cCB0byB0aGUgaW1wbGVt ZW50YXRpb24gdG8gY2hvb3NlIGl0cyByZXNvdXJjZSBwYXRoc+KAnSAtPiBzZWVtcyBub3QgcmVh bGx5IHRoZSBjYXNlLCBiZWNhdXNlIHRoZSByb290IHJlc291cmNlIHN0cnVjdHVyZSBpcyBmb3Jj ZWQgYnkgdGhlIHNwZWNpZmljYXRpb24uIEl0IGNvdWxkIGhhdmUgYmVlbiBkZXNpZ25lZCBhcyBm cmVlIGNob2ljZSAoYmVjYXVzZSBpdCBjYW4gYmUgZGlzY292ZXJlZCBhbnl3YXkpIGJ1dCBpdCBp cyBub3QuDQoNClRoZSB0ZXh0IHNheXMgdGhhdCB0aGUgc2VydmVyIE1VU1Qgc3VwcG9ydCB0aGUg ZGVmYXVsdCAvLndlbGwta25vd24vZXN0IHJvb3QgcmVzb3VyY2UgYW5kIGl0IFNIT1VMRCBzdXBw b3J0IHJlc291cmNlIGRpc2NvdmVyeSBmb3Igbm9uLWRlZmF1bHQgVVJJcyAobGlrZSAvZXN0IG9y IC9lc3QvQXJiaXRyYXJ5TGFiZWwpIG9yIHBvcnRzLiBJbiB0aGUgbGF0dGVyIGNhc2UgaXQgaXMg dXAgdG8gdGhlIHNlcnZlciB0byBkZWNpZGUgdGhlIHBhdGhzIGhlIG1ha2VzIGl0cyByZXNvdXJj ZXMgYXZhaWxhYmxlIGF0LiBUaGF0IGlzIHdoYXQgdGhpcyBzZW50ZW5jZSB3YXMgcmVmZXJyaW5n IHRvLiBCdXQgeW91IGFyZSByaWdodDsgSSByZWFsaXplZCB0aGF0IHRoaXMgc2VudGVuY2UgaXMg cmVkdW5kYW50IHNvIEkgb25seSBrZXB0ICJUaHJvdWdob3V0IHRoaXMgZG9jdW1lbnQgdGhlIGV4 YW1wbGUgcm9vdCByZXNvdXJjZSBvZiAvZXN0IGlzIHVzZWQuIg0KDQpXaWxsIHJldXBsb2FkIHRo ZSBuZXh0IGl0ZXJhdGlvbiBpbiBhIGZldyBkYXlzLiANCg0KUmdzLA0KUGFub3MNCg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcg bGlzdA0KQWNlQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2FjZQ0K From nobody Fri May 31 17:52:05 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3FBB120128 for ; Fri, 31 May 2019 17:52:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hyKpxkThoMd8 for ; Fri, 31 May 2019 17:52:02 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 258F212011C for ; Fri, 31 May 2019 17:52:02 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 31 May 2019 17:51:55 -0700 From: Jim Schaad To: 'Ludwig Seitz' CC: Date: Fri, 31 May 2019 17:51:50 -0700 Message-ID: <000201d51814$34a85fc0$9df91f40$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdUWXkqDC0svTS0jSfCsrSxPhvL4Mg== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Transporting different types of cnf objects - CBOR vs JSON X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Jun 2019 00:52:04 -0000 Ludwig, I have been doing some adaptions of my codebase for dealing with the MQTT specification. In the process of this, I have identified the following items that I think needs some discussion. They may not need changes in any documents and maybe should get a new document. 1. The MQTT document is using the content type "application/json" over HTTPS for transporting messages. Does there need to be an "application/ace+json" defined as a media type, but not necessarily a CBOR media type? I think the answer may be yes, but it could be a new document. 2. If I use a "COSE_Key" confirmation method inside of an application/ace+json message, there is a potential problem and it could be dealt with in a number of different ways. * The JWT confirmation method is identified as "jwk". The COSE key must be translated into JOSE even if there is no equivalent key in JOSE. I.e. that is a fatal error * This does not make sense and the confirmation method should be changed to "cwk" so that either key format could be used in either encoding. 3. If the confirmation is changed, you would need to convert the COSE key to a binary string, base64 encoded it and pass as a string when occurring in a JSON encoding. There is not any other valid way to do this (except see above of just converting the key format). However, the opposite of putting a JOSE key into a COSE confirmation has three different options that could be used. * Encode the JOSE key to a string and pass as a string * Encode the JOSE key top level map as CBOR but leave all of the elements alone. * Encode the JOSE key in CBOR including conversion of base64 strings to binary data. (My first preference is probably the second option, but either of the first two make sense.) Jim