From nobody Fri Nov 1 09:25:10 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E81481209CE; Fri, 1 Nov 2019 09:25:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Yoav Nir via Datatracker To: Cc: last-call@ietf.org, ace@ietf.org, draft-ietf-ace-cwt-proof-of-possession.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.108.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Yoav Nir Message-ID: <157262550387.31812.4531851658668957424@ietfa.amsl.com> Date: Fri, 01 Nov 2019 09:25:03 -0700 Archived-At: Subject: [Ace] Secdir telechat review of draft-ietf-ace-cwt-proof-of-possession-11 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Nov 2019 16:25:04 -0000 Reviewer: Yoav Nir Review result: Ready This is the second secdir review of this document. I'm reviewing version -11. The previous review was of version -08. All my concerns were addressed, except one: I still think it's strange that the Introduction section is an exact repeat of the Abstract. From nobody Sun Nov 3 14:57:08 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DAA21200F7; Sun, 3 Nov 2019 14:56:57 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.108.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157282181758.13473.5642952028017351768@ietfa.amsl.com> Date: Sun, 03 Nov 2019 14:56:57 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-02.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Nov 2019 22:56:58 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : MQTT-TLS profile of ACE Authors : Cigdem Sengul Anthony Kirby Paul Fremantle Filename : draft-ietf-ace-mqtt-tls-profile-02.txt Pages : 24 Date : 2019-11-03 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in an MQTT-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and server authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-02 https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Nov 3 15:08:14 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B3A1120074 for ; Sun, 3 Nov 2019 15:08:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i1WddCoJruzv for ; Sun, 3 Nov 2019 15:08:08 -0800 (PST) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCDBA12004D for ; Sun, 3 Nov 2019 15:08:07 -0800 (PST) Received: by mail-qt1-x82b.google.com with SMTP id t20so5516550qtn.9 for ; Sun, 03 Nov 2019 15:08:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=8iqv5bjlfx3TYjIw99tRFMHCd9BDlaA4BssQ2TSG7nQ=; b=pzvC29SMTUkVhECqApClim4GFsv/NO8Js/3r76cnZM1wWPlySvzZopLRI7dtbqbgEo nPMFh68/BS8PF7lrX00bLE6YhcW7HiZpKupkop2HcSBNSiZGkerU5LBklqRhUxKrGf/i TTGRTgzHOd0xtC/SeLtyUi/jqkZ/9ZZE6J7rwkW8vMAEKpfXeEYE+1Y8PuEB2LgUZjYn xNH0+1tj/3+/ASBV0/39CVcEiWkK/BMgOC6BmedJHGFyPFJDqkMVjWCfqK2YNIgNn9dm 0q+1zTG0w9chF36Su8O6QToqy9sKloR6DaKNSE0P5/MpEUq/T1NCZO/72ygYZAoQVZbc DUlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=8iqv5bjlfx3TYjIw99tRFMHCd9BDlaA4BssQ2TSG7nQ=; b=fJcgFYoK8/1rqxfGt32N1hpVcXTaUgN0nJpkbi9xNx+u8YRcNYijT4nSwpuwjjTRe/ KnUaMXWJwwSoA9P3tot38ob78vJd9s735B3WmgAT4Dpr7F9xmkOglpfxvNwXpdlpTRsr HV+GPrxrp608VpM8HvZ6on3/5o+OCVWyk9G15REIKh7NkriAL4VvRmA5tfWEOGFUONo6 3ttEdNfiGfaVNQ7PVT6q8ICuStZXdYzx/qDY7SrDghvoiZfQPO1hY+jGe3XEn0pjIKFm oZygPb01LHO5lK0lvm2c0+LYxi1RgZyiQPXe3wayO2jSX3SuFoNhJm6RFFdOt7dvxHe4 socQ== X-Gm-Message-State: APjAAAWbpdshAvzIap/Jc/lccVRg34RgmLn7DxZFNJoqLJelqTXOJsEF Z4aXg6LGXdWfkd5z/RA3KlUjKJ1JdzKZKQruL9kBkM2m5Tk= X-Google-Smtp-Source: APXvYqz0QhrhlL3IgHwbg1+KTNj+RrtyrtwfCKHm5sCjD1ACT1jeJZBL6c1po5Bcn1d5+3CKDSrHiIRrXpJ09kwWRUs= X-Received: by 2002:ac8:70c5:: with SMTP id g5mr6923505qtp.344.1572822486384; Sun, 03 Nov 2019 15:08:06 -0800 (PST) MIME-Version: 1.0 References: <157282181776.13473.12822667311244855764.idtracker@ietfa.amsl.com> <166A48BD-1812-40F6-AB35-925E49806912@nominet.uk> In-Reply-To: <166A48BD-1812-40F6-AB35-925E49806912@nominet.uk> From: Cigdem Sengul Date: Sun, 3 Nov 2019 23:07:55 +0000 Message-ID: To: ace@ietf.org Content-Type: multipart/alternative; boundary="000000000000988b440596794560" Archived-At: Subject: [Ace] Fwd: FW: New Version Notification for draft-ietf-ace-mqtt-tls-profile-02.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Nov 2019 23:08:12 -0000 --000000000000988b440596794560 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear ace, I have just submitted a new version of the mqtt_tls profile to address Jim and Daniel's comments. Mainly the changes include: Version 01 to 02: o Expanded Client connection authorization to capture different options for Client and Broker authentication over TLS and MQTT o Removed Payload (and specifically Client Identifier) from PoP validation in favor of using tls-exporter for a TLS-session based challenge. o Moved token transport via "authz-info" topic from the Appendix to the main text. o Clarified Will scope. o Added MQTT AUTH to terminology. o Typo fixes, and simplification of figures. Tried to capture all input, however, I am aware that the part that uses tls-exporter for PoP is under-specified. However, this got a bit confusing to specify after reading the ace-coap-est channel binding and tls-unique discussion. Also looked at other drafts like QUIC, TTLS etc. that use tls-exporter to export keying material and challenge information. It seems necessary to register a new label for the exporter? Thanks, --Cigdem =EF=BB=BFOn 03/11/2019, 22:57, "internet-drafts@ietf.org" wrote: A new version of I-D, draft-ietf-ace-mqtt-tls-profile-02.txt has been successfully submitted by Cigdem Sengul and posted to the IETF repository. Name: draft-ietf-ace-mqtt-tls-profile Revision: 02 Title: MQTT-TLS profile of ACE Document date: 2019-11-02 Group: ace Pages: 24 URL: https://www.ietf.org/internet-drafts/draft-ietf-ace-mqtt-tls-profile-02.txt Status: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ Htmlized: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-02 Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-mqtt-tls-profile-02 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in an MQTT-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and server authentication. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --000000000000988b440596794560 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

D= ear ace,=C2=A0

I have just submitted a new version of the mqtt_tls profile to addre= ss Jim and Daniel's comments.=C2=A0
Main= ly the changes include:

=C2=A0Version 01 to 02:


=C2=A0=C2=A0 o=C2=A0 Expanded Client connection authorization to capture differ= ent

=C2=A0 =C2=A0 =C2=A0 options for Client and Broker auth= entication over TLS and MQTT


=C2=A0=C2=A0 o=C2=A0 Removed Payload (and specifically Client Identifier) from = PoP

=C2=A0 =C2=A0 =C2=A0 validation in f= avor of using tls-exporter for a TLS-session

=C2=A0 =C2=A0 =C2=A0 based challenge.


=C2=A0=C2=A0 o=C2=A0 Moved token transport via "authz-info" topic fro= m the Appendix to

=C2=A0 =C2=A0 =C2=A0 the main text.


=C2=A0=C2=A0 o=C2=A0 Clarified Will scope.


=C2=A0=C2=A0 o=C2=A0 Added MQTT AUTH to terminology.


=C2=A0=C2=A0 o=C2=A0 Typo fixes, and simplification of figures.


Tried to c= apture all input, however,=C2=A0
I am aware= that the part that uses tls-exporter for PoP is under-specified.=C2=A0
However, this got a bit confusing to specify a= fter reading the=C2=A0ace-coap-est channel binding and tls-unique discussio= n.
Also looked at other drafts like QUIC, T= TLS etc. that use tls-exporter to export keying material and challenge info= rmation.=C2=A0
It seems necessary to regist= er a new label for the exporter?=C2=A0

=
Thanks,
--Cigdem=C2=A0




=EF=BB=BFOn 03/11/2019, 22:57, "internet-drafts@ietf.org" <internet-drafts@ietf.org<= /a>> wrote:


=C2=A0 =C2=A0 A new version of I-D, draft-ietf-ace-mqtt-tls-profile-02.txt<= br> =C2=A0 =C2=A0 has been successfully submitted by Cigdem Sengul and posted t= o the
=C2=A0 =C2=A0 IETF repository.

=C2=A0 =C2=A0 Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0d= raft-ietf-ace-mqtt-tls-profile
=C2=A0 =C2=A0 Revision:=C2=A0 =C2=A002
=C2=A0 =C2=A0 Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 MQTT-T= LS profile of ACE
=C2=A0 =C2=A0 Document date:=C2=A0 =C2=A0 =C2=A0 2019-11-02
=C2=A0 =C2=A0 Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ace =C2=A0 =C2=A0 Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 24
=C2=A0 =C2=A0 URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/dra= ft-ietf-ace-mqtt-tls-profile-02.txt
=C2=A0 =C2=A0 Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tl= s-profile/
=C2=A0 =C2=A0 Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-02<= /a>
=C2=A0 =C2=A0 Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqt= t-tls-profile
=C2=A0 =C2=A0 Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-iet= f-ace-mqtt-tls-profile-02

=C2=A0 =C2=A0 Abstract:
=C2=A0 =C2=A0 =C2=A0 =C2=A0This document specifies a profile for the ACE (A= uthentication and
=C2=A0 =C2=A0 =C2=A0 =C2=A0Authorization for Constrained Environments) fram= ework to enable
=C2=A0 =C2=A0 =C2=A0 =C2=A0authorization in an MQTT-based publish-subscribe= messaging system.
=C2=A0 =C2=A0 =C2=A0 =C2=A0Proof-of-possession keys, bound to OAuth2.0 acce= ss tokens, are used
=C2=A0 =C2=A0 =C2=A0 =C2=A0to authenticate and authorize MQTT Clients.=C2= =A0 The protocol relies on
=C2=A0 =C2=A0 =C2=A0 =C2=A0TLS for confidentiality and server authenticatio= n.




=C2=A0 =C2=A0 Please note that it may take a couple of minutes from the tim= e of submission
=C2=A0 =C2=A0 until the htmlized version and diff are available at tools.ietf.= org.

=C2=A0 =C2=A0 The IETF Secretariat



--000000000000988b440596794560-- From nobody Mon Nov 4 07:13:15 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DC391200EC; Mon, 4 Nov 2019 07:13:01 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.108.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157288038149.16593.8067553640901560196@ietfa.amsl.com> Date: Mon, 04 Nov 2019 07:13:01 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-03.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Nov 2019 15:13:02 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Key Provisioning for Group Communication using ACE Authors : Francesca Palombini Marco Tiloca Filename : draft-ietf-ace-key-groupcomm-03.txt Pages : 41 Date : 2019-11-04 Abstract: This document defines message formats and procedures for requesting and distributing group keying material using the ACE framework, to protect communications between group members. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-key-groupcomm/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-03 https://datatracker.ietf.org/doc/html/draft-ietf-ace-key-groupcomm-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-key-groupcomm-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Nov 4 07:50:20 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B65012081E; Mon, 4 Nov 2019 07:50:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JHeWC-2BnWFx; Mon, 4 Nov 2019 07:50:16 -0800 (PST) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0630.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1f::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FA8D120089; Mon, 4 Nov 2019 07:50:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iHYHwKnZhZ8OGMrjZcKqKM3GXN0ovOSOsyb/i/VHxrZQ4lyi4s20Olk33sfvs+bbD+W97phS7rONof6X+25djLJp8pcbaL06NoGm3CVp0Rm1y5mMWB4bW7JkD3TL7mtWSY6EaaCMW+Jt0r6nUYvIZHqngKxZ1fzHevWATkvH0/c+PZJ4b2HCQuyd+PrKkiwXssBdGrXDzjGWwXD/RZ7fDoLuqhqS28h3MUYjwreFmolijCNHq/kJsH5nmMxH0IJAtda2m4ChdOkA3qCHQ/CLdgCUzLJ9H0xHjjZJt81fycYJgOryj1yn0IkR7IO+aunNYV5vctTW+sIbaM2PBFgrYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ejuNYfeHdekur692hYcsTasWi85+C/6Edm2TqSx8hC8=; b=ZvTkJ/gncAPvfF2E9o3dGyAzf1Ba1vETfprVuocFqQ2iKc6K2DyOhf4fAmG6BD0bqQcjHYgfj7/zR6UcqvszU6J4exJynR5FCPEdl0GH/gZWjX32lwVtHIYVwdwdIRRUbTlio34Mg0DZ71rDxOPN3VX4Vv+Q5N8pcGKgAxjySBeR0M4/475mRoZq9kBZ2MvWJ5mXWCMqvwdc9hp912X2ipFIBMex30TM3J7GCb4COrIIh+Rp7nAkxFF8ObAJAIdp2krY0bAOvnbfjnmACyyuvuU22Tq5cT6r5f95yHM8A9yCWTmtRDiByIg47ftqL7oBYXVtSi+MajCwAmsRRxebFA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ejuNYfeHdekur692hYcsTasWi85+C/6Edm2TqSx8hC8=; b=lqYVDF41X++om4RCx44CfLvMKWXTCZ/tZgpZ8orbfjQGSR1FRTNJ8b8SqSeVbJZh/wNbfjzcxTaU+2ANshrgSGmhL6/l+up1q3VsHUTBMQdBIWzCNiQMP2uUQAwulA50E6Q0kwyzwybDnjkbqjXxcZfPBhaoY+odkZcQ0nzLsvo= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB3296.eurprd07.prod.outlook.com (10.175.244.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.16; Mon, 4 Nov 2019 15:50:13 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.013; Mon, 4 Nov 2019 15:50:13 +0000 From: Francesca Palombini To: "ace@ietf.org" , "ace-chairs@ietf.org" CC: Marco Tiloca Thread-Topic: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-03.txt Thread-Index: AQHVkyKAf0XPn/eCnUGx3kSZZ+svHKd7OZWA Date: Mon, 4 Nov 2019 15:50:13 +0000 Message-ID: <565FACAA-7921-4F44-8617-2D551305F17C@ericsson.com> References: <157288038149.16593.8067553640901560196@ietfa.amsl.com> In-Reply-To: <157288038149.16593.8067553640901560196@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8a093ac2-a714-4fa6-ab4f-08d7613eae5c x-ms-traffictypediagnostic: VI1PR07MB3296: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0211965D06 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(39860400002)(136003)(396003)(376002)(366004)(53754006)(189003)(199004)(102836004)(229853002)(66446008)(8676002)(64756008)(4326008)(6246003)(66476007)(6506007)(26005)(99286004)(71190400001)(81166006)(71200400001)(86362001)(81156014)(76176011)(14444005)(6512007)(91956017)(256004)(6436002)(6306002)(8936002)(76116006)(25786009)(66946007)(6486002)(44832011)(66574012)(66556008)(11346002)(446003)(6116002)(3846002)(2616005)(476003)(486006)(66066001)(33656002)(5660300002)(2906002)(36756003)(478600001)(316002)(305945005)(7736002)(14454004)(110136005)(186003)(2501003)(966005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB3296; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fignwsstdYwsAcGQ3RRVUdCGNGFqDGeJbksJ5AUirelzWvAY1Nj+Jgh31UD41jY1ogNXE/2RwjJTDcv9qA8bbVSt3oXOadl7YOEOL8z5Q/gHzJ0vcbcA5bUZ0/V+KU19Q6fxm5V4zjhHhHihNc9NDxHePsAUbIHhK3WYtcSX0DhdTExLIu1wcAT3TyPE/485k8dqk+LhvsJDNMk9IeAW9Vlk8tu4bYhVK6U9J+fmM0JrtPwJcN0ohPHKne8dwA47gkEclviFB066DReEf36o5TqyDp+7pw+6GQ2u8EHfywwODfI1Hq5SWX5+y6Cgv6ohdOejKRcuKRSpAMs6J7IeCTy/cAhiMyovvRghLAbRueXm6VIpX0RikBOOeo3yEL/lcWxQWFQ4rl1mrcxDDvW+hZs6hNJqruMAZKNWV3Ech+mV5vjMB5/N46Nh5uUmjDIG7OIAN8SNADydjIH3tmkSEkVxni3sC75BB5B01QMfFR4= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8a093ac2-a714-4fa6-ab4f-08d7613eae5c X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2019 15:50:13.5390 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1orlJkXBin978vZKwJuTKXpETZpODXQfGLlAFF/20IMbZxZj1JmTDpNzGtTSUOFO/uBAItnZbP4xK+xuGv749Gfll0G/p+mrnla5v0Tl0biR5oohk7IuyMdwWYztaFFp X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB3296 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-03.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Nov 2019 15:50:19 -0000 SGkgYWxsLA0KDQpXZSB1cGRhdGVkIHRoZSBkcmFmdCBhY2NvcmRpbmcgdG8gdGhlIHZlcnkgdXNl ZnVsIGRpc2N1c3Npb24gdG8gSUVURiAxMDUgKCJSRVNUaWZpY2F0aW9uIikgYW5kIHJldmlld3Mg ZnJvbSBEYW5pZWwgYW5kIEx1ZHdpZyAodGhhbmsgeW91ISkuIEluIHRoZSBuZXh0IGNvdXBsZSBv ZiBkYXlzIHdlIHdpbGwgZ2V0IGJhY2sgdG8gdGhlIGluZGl2aWR1YWwgcmV2aWV3IHRocmVhZHMg YW5kIGFuc3dlciB0aG9zZSBpbiBkZXRhaWwsIGJ1dCB3ZSBmZWVsIHRoYXQgZXZlcnl0aGluZyB3 YXMgYWRkcmVzc2VkIHdpdGggdGhpcyBuZXcgdmVyc2lvbi4NCg0KQ2hhaXJzOiBJJ2QgbGlrZSB0 byByZXF1ZXN0IDEwLTE1IG1pbnV0ZXMgaW4gU2luZ2Fwb3JlIHRvIGRpc2N1c3MgaG93IHdlIHNv bHZlZCBwcmV2aW91cyBvcGVuIHBvaW50cyBhbmQgd2F5cyBmb3J3YXJkLg0KDQpUaGFua3MsDQpG cmFuY2VzY2ENCg0K77u/T24gMDQvMTEvMjAxOSwgMTY6MTQsICJBY2Ugb24gYmVoYWxmIG9mIGlu dGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPGFjZS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBv ZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc+IHdyb3RlOg0KDQogICAgDQogICAgQSBOZXcgSW50 ZXJuZXQtRHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRz IGRpcmVjdG9yaWVzLg0KICAgIFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIEF1dGhl bnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMg V0cgb2YgdGhlIElFVEYuDQogICAgDQogICAgICAgICAgICBUaXRsZSAgICAgICAgICAgOiBLZXkg UHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uIHVzaW5nIEFDRQ0KICAgICAgICAg ICAgQXV0aG9ycyAgICAgICAgIDogRnJhbmNlc2NhIFBhbG9tYmluaQ0KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgTWFyY28gVGlsb2NhDQogICAgCUZpbGVuYW1lICAgICAgICA6IGRyYWZ0 LWlldGYtYWNlLWtleS1ncm91cGNvbW0tMDMudHh0DQogICAgCVBhZ2VzICAgICAgICAgICA6IDQx DQogICAgCURhdGUgICAgICAgICAgICA6IDIwMTktMTEtMDQNCiAgICANCiAgICBBYnN0cmFjdDoN CiAgICAgICBUaGlzIGRvY3VtZW50IGRlZmluZXMgbWVzc2FnZSBmb3JtYXRzIGFuZCBwcm9jZWR1 cmVzIGZvciByZXF1ZXN0aW5nDQogICAgICAgYW5kIGRpc3RyaWJ1dGluZyBncm91cCBrZXlpbmcg bWF0ZXJpYWwgdXNpbmcgdGhlIEFDRSBmcmFtZXdvcmssIHRvDQogICAgICAgcHJvdGVjdCBjb21t dW5pY2F0aW9ucyBiZXR3ZWVuIGdyb3VwIG1lbWJlcnMuDQogICAgDQogICAgDQogICAgVGhlIElF VEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1hY2Uta2V5LWdyb3VwY29tbS8N CiAgICANCiAgICBUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6 DQogICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLWtleS1ncm91 cGNvbW0tMDMNCiAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0 LWlldGYtYWNlLWtleS1ncm91cGNvbW0tMDMNCiAgICANCiAgICBBIGRpZmYgZnJvbSB0aGUgcHJl dmlvdXMgdmVyc2lvbiBpcyBhdmFpbGFibGUgYXQ6DQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcv cmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtYWNlLWtleS1ncm91cGNvbW0tMDMNCiAgICANCiAgICAN CiAgICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJv bSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQogICAgdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24g YW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICANCiAgICBJbnRl cm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6DQogICAg ZnRwOi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCiAgICANCiAgICBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIEFjZSBtYWlsaW5nIGxp c3QNCiAgICBBY2VAaWV0Zi5vcmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FjZQ0KICAgIA0KDQo= From nobody Mon Nov 4 07:57:32 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB4A6120AF1; Mon, 4 Nov 2019 07:57:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J86rYVIWFFd8; Mon, 4 Nov 2019 07:57:00 -0800 (PST) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10041.outbound.protection.outlook.com [40.107.1.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18CCE120ACB; Mon, 4 Nov 2019 07:57:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RK9p++HfLqOYjAyMTABwDryMWuacZNh+pUlAvjGPuxOW0qgbpR1hs0c5y7RVP/Lp1er62kK51GNvCVLBPcBv/6CVrueanAWUq0LAHM4RV803EOpqVyi1kdkLkBhaAL6hhXKuvj4LBQDOUV/JYmDD9DAP3XvsGdn4l6/84oiQMuLzcSTDRjfjTr24XWLfzaH0uVGUOTRngNyaKFjCl0RXoqQQeHBlAEcHjQqdiymz98ZmFTSEF1BH8oplGj4O5DrUh1tw9Orf85LFxtqvwGMpht1dnpQ3JYwOlZPH+4uHMZU6ymPZed/zjv/oUD+ijXNLbT90jXuUL56HzT35Awb6CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Iy9ZT9Q/Gu3I4l7MnA8TIb/Knyu5hknOemm4D4dBFEE=; b=hP9nGieThD8o3zKEBT0oqp26Fffukn6EKWGd9+ZsW9ZA0NJ5ck5iN0q3rorqy34fYwd24S6vfJGsIQucHT3spyi6l9QbK6bSWqFdXw0UycQI6Y87EHLEERZrCoG+bY7jOHRxqw0g2vjXbTj18io8PjXCTShuPLoB38si0Bme7z5zyqoOQcaK8nzifno/OlDsPpyy/+v2ooOCfaE3o1N69o/94TGq0yziz/sIU5/HfwY0r1jH+q/3D8QQgaeluKZTCcJhWLVFwnHER0bEUpmlSlEr+40f/lGbQjV1hk1cvhbhbM2eikmGl06OE7XRiljlXleXh17DM4o/dUp2jpxljg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Iy9ZT9Q/Gu3I4l7MnA8TIb/Knyu5hknOemm4D4dBFEE=; b=asYqEP/8CY1FYMsdEmfApQKr45qSAdBYeBM3teETWCJd54oIyTmjJANblW0otL3ToWBRZMaeu+BORIwYoRH50ubvk1v90AMHt4ppg/fkiv2vbD+VMf5dJJy0f2v9jAK8tH0zV74ZkK9tVmkxmPClOGOTVBqIzAwXDiN1QfwmtKo= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB4400.eurprd07.prod.outlook.com (20.176.8.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.16; Mon, 4 Nov 2019 15:56:57 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.013; Mon, 4 Nov 2019 15:56:57 +0000 From: Francesca Palombini To: Ace Wg , "ace-chairs@ietf.org" , "core@ietf.org" Thread-Topic: New Version Notification for draft-palombini-ace-coap-pubsub-profile-06.txt Thread-Index: AQHVkybocWDc7kQcpkiy0jr260YLMad7O20A Date: Mon, 4 Nov 2019 15:56:57 +0000 Message-ID: <123FF049-518F-4E9B-A10A-CA5B7D1E5117@ericsson.com> References: <157288233098.16520.7649642743864601735.idtracker@ietfa.amsl.com> In-Reply-To: <157288233098.16520.7649642743864601735.idtracker@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2dfcd7a2-761a-4f28-fa31-08d7613f9f30 x-ms-traffictypediagnostic: VI1PR07MB4400: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0211965D06 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(376002)(136003)(39860400002)(396003)(366004)(189003)(199004)(66446008)(478600001)(36756003)(476003)(66476007)(99286004)(2501003)(305945005)(7736002)(2201001)(25786009)(966005)(44832011)(5660300002)(8676002)(316002)(66574012)(81166006)(81156014)(110136005)(76176011)(66946007)(71200400001)(71190400001)(6512007)(66066001)(6436002)(14454004)(6306002)(2473003)(486006)(6116002)(3846002)(450100002)(8936002)(6506007)(15650500001)(102836004)(11346002)(446003)(64756008)(14444005)(256004)(66556008)(561944003)(2906002)(76116006)(91956017)(33656002)(229853002)(186003)(26005)(2616005)(86362001)(6486002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB4400; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ktGqKgLS/9HhGQaQsr4qZ3MZbpO8AYWgXxusi2cwszXJWn3JHC6MaF5+22bNns1S1/wN2ov5JN4XLsCKgTOLJG+kWSveMWJAYiJWu8hH88TqY1KWRVLrK988fEFepRx8n1hqvuOiG4Jz6nCuFXzi+rQlkW2FJHgkc9dSYEol2jR6LfHj1bC+6/jy8Ckt/sgcUwUnYbMUXOU60tALtT5COLtTqxhmAS+Ikjy5kBUU0GkQMsl5FM3uLC1SUTJRJEfvpJIyyQvQHLGrX+8ALieL0Xb2Bnu+Zzta6lqpJAK1QhOW4D7glJNeIUHYV6tNG5QzLg29KQ4lzKf6ysGD9xUvCaET4Ase/lqbAEfjY/CzHfIsDFA/HF4sFna9jm3LmNLCY/UpY0EhPD6txxrIhG8znYzMB+2/99D9SsTvY5NvpUpLY0yfkYfil7CkrpHpPmKCZ8wleabTywWOEXeZwD1T4kOI6zXSxQLbcf8Ws5gLhog= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <83A71613E7B5DF4C8E777CBFBA05F50F@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2dfcd7a2-761a-4f28-fa31-08d7613f9f30 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2019 15:56:57.6316 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tgBnFbzOaA7TcejX25ODxkHx2lPcFAQgs59SxLo1CwrIcminpQBHEpHGZHlaohqWWv3E8jOala285anGOohdOlYaGWslyqNnvpNzXma0STyVW91xOXHpWbRtWOL9CiFj X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB4400 Archived-At: Subject: [Ace] FW: New Version Notification for draft-palombini-ace-coap-pubsub-profile-06.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Nov 2019 15:57:14 -0000 DQpIaSwNCg0KSSBqdXN0IHN1Ym1pdHRlZCBhbiB1cGRhdGUgdG8gdGhlIENvQVAgUHViU3ViIHBy b2ZpbGUuIFRoaXMgdXBkYXRlIHJlZmxlY3RzIHRoZSB1cGRhdGUgaW4gdGhlIGFjZS1rZXktZ3Jv dXBjb21tIGRyYWZ0Lg0KDQpBQ0UgQ2hhaXJzOiBJJ2QgbGlrZSB0byByZXF1ZXN0IDEwIG1pbnV0 ZXMgZHVyaW5nIElFVEYxMDYsIHBvc3NpYmx5IGFmdGVyIGFjZS1rZXktZ3JvdXBjb21tLiBJJ2Qg bGlrZSBmb3IgdGhlIGNoYWlycyB0byBhc2sgZm9yIGFkb3B0aW9uIGluIHRoZSB3ZywgZWl0aGVy IG5vdyBpbiB0aGUgbWFpbGluZyBsaXN0IG9yIGR1cmluZyB0aGUgZjJmIG1lZXRpbmcuIEFzIEkg aGF2ZSBtZW50aW9uZWQsIEkgZmVlbCBsaWtlIHdlIGFyZSBsYWNraW5nIHdvcmsgb24gQ29BUCBQ dWJTdWIgc2VjdXJpdHksIGFuZCB0aGlzIGlzIG15IHByb3Bvc2FsIChzdGlsbCByb3VnaCkgdG8g d29yayBvbiB0aGF0LiBBcyBDb0FQIFB1YlN1YiBpcyBhcHByb2FjaGluZyBtYXR1cml0eSwgd2Ug bmVlZCB0byBzdGFydCB3b3JraW5nIG9uIHNlY3VyaW5nIGl0LiBUaGlzIGRyYWZ0IGRlc2NyaWJl cyBhIHByb2ZpbGUgb2YgQUNFIGZvciBDb0FQIFB1YnN1YiwgYnV0IGFsc28gaW5jbHVkZXMgYSBt ZWNoYW5pc20gYmFzZWQgb24gQ09TRSB0byBwcm90ZWN0IHRoZSBjb250ZW50IG9mIHB1YmxpY2F0 aW9ucy4gDQoNCkNDIENvUkUgYmVjYXVzZSBDb0FQIFB1YlN1YiBpcyBpcyBDb1JFLg0KDQpUaGFu a3MsDQpGcmFuY2VzY2ENCg0K77u/T24gMDQvMTEvMjAxOSwgMTY6NDUsICJpbnRlcm5ldC1kcmFm dHNAaWV0Zi5vcmciIDxpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc+IHdyb3RlOg0KDQogICAgDQog ICAgQSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0LXBhbG9tYmluaS1hY2UtY29hcC1wdWJzdWIt cHJvZmlsZS0wNi50eHQNCiAgICBoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IEZy YW5jZXNjYSBQYWxvbWJpbmkgYW5kIHBvc3RlZCB0byB0aGUNCiAgICBJRVRGIHJlcG9zaXRvcnku DQogICAgDQogICAgTmFtZToJCWRyYWZ0LXBhbG9tYmluaS1hY2UtY29hcC1wdWJzdWItcHJvZmls ZQ0KICAgIFJldmlzaW9uOgkwNg0KICAgIFRpdGxlOgkJQ29BUCBQdWItU3ViIFByb2ZpbGUgZm9y IEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9u bWVudHMgKEFDRSkNCiAgICBEb2N1bWVudCBkYXRlOgkyMDE5LTExLTA0DQogICAgR3JvdXA6CQlJ bmRpdmlkdWFsIFN1Ym1pc3Npb24NCiAgICBQYWdlczoJCTE5DQogICAgVVJMOiAgICAgICAgICAg IGh0dHBzOi8vd3d3LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy9kcmFmdC1wYWxvbWJpbmktYWNl LWNvYXAtcHVic3ViLXByb2ZpbGUtMDYudHh0DQogICAgU3RhdHVzOiAgICAgICAgIGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBhbG9tYmluaS1hY2UtY29hcC1wdWJzdWIt cHJvZmlsZS8NCiAgICBIdG1saXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LXBhbG9tYmluaS1hY2UtY29hcC1wdWJzdWItcHJvZmlsZS0wNg0KICAgIEh0bWxpemVk OiAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LXBhbG9t YmluaS1hY2UtY29hcC1wdWJzdWItcHJvZmlsZQ0KICAgIERpZmY6ICAgICAgICAgICBodHRwczov L3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtcGFsb21iaW5pLWFjZS1jb2FwLXB1YnN1 Yi1wcm9maWxlLTA2DQogICAgDQogICAgQWJzdHJhY3Q6DQogICAgICAgVGhpcyBzcGVjaWZpY2F0 aW9uIGRlZmluZXMgYW4gYXBwbGljYXRpb24gcHJvZmlsZSBmb3IgYXV0aGVudGljYXRpb24NCiAg ICAgICBhbmQgYXV0aG9yaXphdGlvbiBmb3IgcHVibGlzaGVycyBhbmQgc3Vic2NyaWJlcnMgaW4g YSBwdWItc3ViIHNldHRpbmcNCiAgICAgICBzY2VuYXJpbyBpbiBhIGNvbnN0cmFpbmVkIGVudmly b25tZW50LCB1c2luZyB0aGUgQUNFIGZyYW1ld29yay4gIFRoaXMNCiAgICAgICBwcm9maWxlIHJl bGllcyBvbiB0cmFuc3BvcnQgbGF5ZXIgb3IgYXBwbGljYXRpb24gbGF5ZXIgc2VjdXJpdHkgdG8N CiAgICAgICBhdXRob3JpemUgdGhlIHB1Ymxpc2hlciB0byB0aGUgYnJva2VyLiAgTW9yZW92ZXIs IGl0IHJlbGllcyBvbg0KICAgICAgIGFwcGxpY2F0aW9uIGxheWVyIHNlY3VyaXR5IGZvciBwdWJs aXNoZXItYnJva2VyIGFuZCBzdWJzY3JpYmVyLWJyb2tlcg0KICAgICAgIGNvbW11bmljYXRpb24u DQogICAgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgIA0KICAgIA0KICAgIFBs ZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0 aW1lIG9mIHN1Ym1pc3Npb24NCiAgICB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlm ZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KICAgIA0KICAgIFRoZSBJRVRGIFNl Y3JldGFyaWF0DQogICAgDQogICAgDQoNCg== From nobody Mon Nov 4 08:21:48 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B19EB120A62; Mon, 4 Nov 2019 08:21:28 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.108.0 Auto-Submitted: auto-generated Precedence: bulk Cc: rdd@cert.org, The IESG , ace-chairs@ietf.org, kaduk@mit.edu, ace@ietf.org, draft-ietf-ace-cwt-proof-of-possession@ietf.org, rfc-editor@rfc-editor.org Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <157288448872.16630.4058400626255158313.idtracker@ietfa.amsl.com> Date: Mon, 04 Nov 2019 08:21:28 -0800 Archived-At: Subject: [Ace] Protocol Action: 'Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs)' to Proposed Standard (draft-ietf-ace-cwt-proof-of-possession-11.txt) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Nov 2019 16:21:29 -0000 The IESG has approved the following document: - 'Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs)' (draft-ietf-ace-cwt-proof-of-possession-11.txt) as Proposed Standard This document is the product of the Authentication and Authorization for Constrained Environments Working Group. The IESG contact persons are Benjamin Kaduk and Roman Danyliw. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-cwt-proof-of-possession/ Technical Summary This document specifies describes how to declare in a CBOR Web Token (CWT) that the presenter of the CWT possesses a particular proof-of-possession key. It is a functional equivalent to the proof of possession key semantics in JSON Web Tokens (JWTs) (RFC 7800) but using CBOR/CWT instead of JSON/JWT. Working Group Summary The WG has reached consensus to publish this protocol specification as a Proposed Standard so that it tracks the equivalent work with JWTs (RFC 7800). It has been subjected to review from the community of interest and the details have been testing through various CWT implementations. Document Quality This document went through the usual level of review for the WG. WGLC and AD evaluation revealed some issues to address with respect to clarity, but no major flaws were found. Personnel Roman Danyliw is the document shepherd. Benjamin Kaduk is the responsible AD. From nobody Mon Nov 4 10:40:00 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ED05120144; Mon, 4 Nov 2019 10:39:50 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.108.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157289279040.13988.8280752125183601340@ietfa.amsl.com> Date: Mon, 04 Nov 2019 10:39:50 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-oscore-03.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Nov 2019 18:39:54 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Key Management for OSCORE Groups in ACE Authors : Marco Tiloca Jiye Park Francesca Palombini Filename : draft-ietf-ace-key-groupcomm-oscore-03.txt Pages : 33 Date : 2019-11-04 Abstract: This document describes a method to request and provision keying material in group communication scenarios where the group communication is based on CoAP and secured with Object Security for Constrained RESTful Environments (OSCORE). The proposed method delegates the authentication and authorization of new client nodes that join an OSCORE group through a Group Manager server. This approach builds on the ACE framework for Authentication and Authorization, and leverages protocol-specific transport profiles of ACE to achieve communication security, proof-of-possession and server authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-key-groupcomm-oscore/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore-03 https://datatracker.ietf.org/doc/html/draft-ietf-ace-key-groupcomm-oscore-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-key-groupcomm-oscore-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Nov 5 03:03:45 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A3C01208BE for ; Tue, 5 Nov 2019 03:03:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eCU4GDl5gBPM for ; Tue, 5 Nov 2019 03:03:40 -0800 (PST) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02on060b.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe06::60b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D36CB1208D4 for ; Tue, 5 Nov 2019 03:03:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VC658qI3yUhceH9ce1c4H/BeGHx6KsmItrcyU/MjLk6LNltJLxeByeJ4kYM3Xw8Ff91Bv0tJKeFyiF8qfPa9HLPi2+WnBaPJuyksTvJLghhM5EDYB8cxcC/q8XxYDokEhUa5A9xijJCo+CnIrrF+tPO69TOpPSP4037pF7+EA+/cA3ZXJuzpuK7Hte1YlQPqCEOEwtSJuhDXvAoskRnbuN8WMJrJSnxiGPHvlK46ylTvqQ6dXlrAy4MYasA0biPOT3i/gy7Rs2lfPc+IciJO6d9QBMNPz/9B3o/tGXzHpu6QmHcvQ9ByCv3AVozdCjg2XSImFYVh2HUwKhucVHnMHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gN4RCLV88jNYJRbPQrxqHEmMPHI0DJDYB+CBnewy2q4=; b=ILx+DwT72iDX65/fVo2sOpjf3aA04nXYqU1U9GzTUX/c/rlg1JbZOwACP7U83IPRTnLlfEhsZxly+rvnDxEnlQWwxE4+lVUOxgsgT7ITa05Q++H9aebgeNVxtcOQXLCLqEmYaNsrvtYKhLvvdJubCGG9a/ZRTPMuRhc+U5FG1NVA1Lnd3oE4fHPaUxnm7YQQZCFjGbF8xWcvREFCw6a9fBSXGSPI4hi3bhrBg82JV2dtxsGRj1lKPeQWhBQgH37ZG5koGzxbJqYuQrihOJPM+MRlChUxp0ux0t9NDGyPLqHwxThH7Fse4n5eMpfy2EMI6b5VOPlRgpGt9HbOpkiGKA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gN4RCLV88jNYJRbPQrxqHEmMPHI0DJDYB+CBnewy2q4=; b=CRXnkM6M7Jpy9Xj4zvQi0PH9Wp5K6rrsp5T8o7AZf4ijN2CTDXd48FHZjkfp5hFXgKPoj2aWYSSjFCUMTx+oz0ZMr69LZLXm+P9KBspSgLW/EhmCt6+ry6Iz2+hiXjyNy9i0tOB7bXtIztRrp/HTHXt0pFa5dq0hNgsydupIRFE= Received: from HE1P18901CA0005.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:8b::15) by DB8P189MB0732.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:127::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 11:03:37 +0000 Received: from AM5EUR02FT059.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e1e::201) by HE1P18901CA0005.outlook.office365.com (2603:10a6:3:8b::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2408.24 via Frontend Transport; Tue, 5 Nov 2019 11:03:37 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by AM5EUR02FT059.mail.protection.outlook.com (10.152.9.204) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 11:03:36 +0000 Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 12:03:36 +0100 References: <157289633849.13976.13407883548112694188.idtracker@ietfa.amsl.com> To: From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <157289633849.13976.13407883548112694188.idtracker@ietfa.amsl.com> Message-ID: Date: Tue, 5 Nov 2019 12:03:35 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <157289633849.13976.13407883548112694188.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="SHZFt4h0KQrvnMZZ9XNNbSCJJdHMHpkAw" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(136003)(396003)(39860400002)(189003)(199004)(5024004)(11346002)(316002)(446003)(31686004)(66574012)(2616005)(5660300002)(336012)(22746008)(26005)(386003)(15650500001)(7736002)(16526019)(478600001)(76176011)(81156014)(568964002)(966005)(81166006)(8676002)(22756006)(2906002)(186003)(606006)(44832011)(486006)(476003)(8936002)(126002)(2351001)(33964004)(70586007)(16586007)(16576012)(36756003)(71190400001)(356004)(40036005)(3846002)(6116002)(31696002)(6306002)(106002)(54896002)(65956001)(86362001)(21480400003)(236005)(65806001)(70206006)(235185007)(14444005)(6916009)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:DB8P189MB0732; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ba0a8f8a-5059-4779-c4ce-08d761dfce7d X-MS-TrafficTypeDiagnostic: DB8P189MB0732: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 63Wpkm65RGNc+XOMuSA0EYtCqcyEXzJWqqnCGihS3mz0WN7b8Vpzfqarp/0D2di10gjVfpSJxN1R3uRfgwhhxsFdlWjZH8C0eNoY9DcREhG2luUv8BKe3lHedQg3dNs0GdwWPuD8L1ngHQlhOBFHfBesgnUoXTysOZLlDmwFdAg9u+pSWer0Y3MyjJXDjikkX/hqPz0SKdx6PAgsHfArNZoFrQ+BP0K+YXjOFgj/bkZp8/TVbK5YVdUJHhrL2aaoqi8VxNTayl3qq8PFKP0u9DRIjAVeeZmbyW74165iSZQ5BP/AeP39l2/Ydh8wdEdU16psCbiuK9EN7QKNWz3DWHEC1shU0v1h6p+BMObA8F/kR7GP4xXW8435E+MI9DSi3iGviSUayuSs3efRNjPdkkwvvzhGNAWibrs9FL9S0nvhSdaH3HULdXmSgviqrIUD X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 11:03:36.5634 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ba0a8f8a-5059-4779-c4ce-08d761dfce7d X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8P189MB0732 Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-group-oscore-profile-01.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 11:03:43 -0000 --SHZFt4h0KQrvnMZZ9XNNbSCJJdHMHpkAw Content-Type: multipart/mixed; boundary="JCOZazTSmETT0I1GGbHInUNEHOd8PRg3L"; protected-headers="v1" From: Marco Tiloca To: ace@ietf.org Message-ID: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-group-oscore-profile-01.txt References: <157289633849.13976.13407883548112694188.idtracker@ietfa.amsl.com> In-Reply-To: <157289633849.13976.13407883548112694188.idtracker@ietfa.amsl.com> --JCOZazTSmETT0I1GGbHInUNEHOd8PRg3L Content-Type: multipart/alternative; boundary="------------B285139C03D09FDB5A56264D" Content-Language: en-US This is a multi-part message in MIME format. --------------B285139C03D09FDB5A56264D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have submitted an updated version of the draft "Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework" https://tools.ietf.org/html/draft-tiloca-ace-group-oscore-profile-01 The document describes a profile of ACE where client and server can communicate with OSCORE and Group OSCORE. This supports fine-grained access control in group communication environments, where different group members have different access rights to resources of other group members. The pairwise OSCORE security context between the client and server is established in a way similar to the OSCORE profile, and is securely bound to the Group OSCORE security context previously obtained when joining the OSCORE group. This update is mostly about: 1) More discussions on relevant use cases in the introduction, including input from BACnet (thanks, Dave!). 2) Addressed issue about possible client impersonation, by proving client's possession of its own private key to the AS and including the client's public key in the Access Token (thanks, Jim!). 3) Alignment with the latest v -08 of the OSCORE profile. Comments are very welcome! Best, /Marco -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-group-oscore-profile-01.txt Date: Mon, 4 Nov 2019 11:38:58 -0800 From: internet-drafts@ietf.org To: Ludwig Seitz , Marco Tiloca , Rikard Hoeglund , Francesca Palombini A new version of I-D, draft-tiloca-ace-group-oscore-profile-01.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-group-oscore-profile Revision: 01 Title: Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework Document date: 2019-11-04 Group: Individual Submission Pages: 35 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-group-oscore-profil= e-01.txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-group-oscore-profile/ Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-group-oscore-profile-01 Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-group-oscore-profi= le Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-tiloca-ace-group-oscore-profile= -01 Abstract: This document specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. The profile uses Object Security for Constrained RESTful Environments (OSCORE) and/or Group OSCORE to provide communication security between a Client and (a group of) Resource Server(s). Furthermore, the profile uses (Group) OSCORE to provide server authentication, and OSCORE to achieve proof-of-possession for a key owned by the Client and bound to an OAuth 2.0 Access Token. Also, the profile provides proof-of-group-membership for the Client, by securely binding the pre-established Group OSCORE Security Context to the pairwise OSCORE Security Context newly established with the Resource Server. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------B285139C03D09FDB5A56264D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have submitted an updated version of the draft "Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework"

https://tools.ietf.org/html/d= raft-tiloca-ace-group-oscore-profile-01

The document describes a profile of ACE where client and server can communicate with OSCORE and Group OSCORE. This supports fine-grained access control in group communication environments, where different group members have different access rights to resources of other group members. The pairwise OSCORE security context between the client and server is established in a way similar to the OSCORE profile, and is securely bound to the Group OSCORE security context previously obtained when joining the OSCORE group.

This update is mostly about:

1) More discussions on relevant use cases in the introduction, including input from BACnet (thanks, Dave!).

2) Addressed issue about possible client impersonation, by proving client's possession of its own private key to the AS and including the client's public key in the Access Token (thanks, Jim!).

3) Alignment with the latest v -08 of the OSCORE profile.


Comments are very welcome!

Best,
/Marco


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-group-oscore-profile-01.txt
Dat= e: Mon, 4 Nov 2019 11:38:58 -0800
Fro= m: internet-drafts@ietf.org
To:= Ludwig Seitz <ludwig.seitz@ri.se>, Marco Tiloca <marco.tiloca@ri.se>, Rikard Hoeglund <rikard.hoglund@ri.se>, Francesca Palombini <francesca.palombini@ericsson.com>



A new version of I-D, draft-tiloca-ace-group-oscore-profile-01.txt<= br> has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-group-oscore-profile
Revision: 01
Title: Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework
Document date: 2019-11-04
Group: Individual Submission
Pages: 35
URL: https://www.ietf.org= /internet-drafts/draft-tiloca-ace-group-oscore-profile-01.txt
Status: https://datatracker.ie= tf.org/doc/draft-tiloca-ace-group-oscore-profile/
Htmlized: https://tools.ietf.org/html= /draft-tiloca-ace-group-oscore-profile-01
Htmlized: https://datatracker.ietf.o= rg/doc/html/draft-tiloca-ace-group-oscore-profile
Diff: https://www.ietf.org/rfcd= iff?url2=3Ddraft-tiloca-ace-group-oscore-profile-01

Abstract:
This document specifies a profile for the Authentication and
Authorization for Constrained Environments (ACE) framework. The
= profile uses Object Security for Constrained RESTful Environments (OSCORE) and/or Group OSCORE to provide communication security
between a Client and (a group of) Resource Server(s). Furthermore,<= br> the profile uses (Group) OSCORE to provide server authentication, and
OSCORE to achieve proof-of-possession for a key owned by the Client
and bound to an OAuth 2.0 Access Token. Also, the profile provides<= br> proof-of-group-membership for the Client, by securely binding the pre-established Group OSCORE Security Context to the pairwise OSCORE
Security Context newly established with the Resource Server.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--------------B285139C03D09FDB5A56264D-- --JCOZazTSmETT0I1GGbHInUNEHOd8PRg3L-- --SHZFt4h0KQrvnMZZ9XNNbSCJJdHMHpkAw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3BVwcACgkQ7iZktA5Y 2kNlVAgAmsW5hHdYOZhcaeNlRZvTBVbV+6JBayZ+TJp9bqUPmxvMcpESm+kwoWY8 CLWqYTSMnqpDvWe42+AiBRYjJi/vHm2ldrQE8Tmp3H7o1zvc/pWk5LziUhHt62uj 9/5MD7XL5KzHSGOQjfDGgiXbiVEXJUAMB+DRbBAcKoOhDeAfSa6GJpnKzl8eA0sO nsnEQ+eO2gPzAY4JBO6v8nl5nJq9xa3Txv3HkryINgICh7qRCxWb5ZBD56ICEjIQ zywv1fyzFXR45Vi/zYQbbZAmn+am/v4vkJut6VqBek68xtGQ2C6I2r6yxK4jeU4W JowV2alp4PKFSU5CBaE4xoIFC9i/Ew== =c4wn -----END PGP SIGNATURE----- --SHZFt4h0KQrvnMZZ9XNNbSCJJdHMHpkAw-- From nobody Tue Nov 5 03:06:18 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54D171208D4 for ; Tue, 5 Nov 2019 03:06:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vQNiAnkdkxza for ; Tue, 5 Nov 2019 03:06:14 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30064.outbound.protection.outlook.com [40.107.3.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D938120894 for ; Tue, 5 Nov 2019 03:06:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=K/VilMxIffXnnoAZFuoKoG52SOlDp1PViL6HfMHecJj6pUwl/ezW6lYLWXbcq7C2DfG1WPQZr6H1aVBONe4uacIuMU/WCK2mgP8JG93TSjj55UtwtDNuB4jKGQnvFwYc7qtexXcfWck8Vjn3sBBwZeHgwtOalvpVa7Ft22XS4p1WxizIKXgAZOJWuunZXdUanQIayhpnB3tGV977tPTj2reAEZj15xwE0UCJ7XqNihZnGjBUN9JV0h8skIiU64C9kSjcT9lbU1jHRKLVZkdOrswjf1wdGQOaf4KJML7X6YShWSkUjMoXttgOB7QlgmS1bXpPMaGdPmD6UP3PuTNd1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Sb6tsaLf7zmALfavNxEtUHJ8SHz/fWJWEdAmkdwYRjM=; b=btsefiDAdfi4WotrwlVTTaNtuLrjzfQ01OOYWJchonLTSvmN6LCn/ju3x+82uKwkJW9yFifK0Wt0PXSeK8Zil8Ffo3mZ1AoHwduJ1w9t2RMwgcHdgfkIN7a7wMhBeM00kIP0+J+X7z6U6Fc7OH0bh8rEqIiPH/yTZtRhBSkkwZOPo/oiZcISZWrn4bAjPtZdc6R/BkYurGyf1ztpjaejck+8IoLB25bdp855YTfPxONrAcKgaB4mhZRwcNSxVmyctnEGOM2Av+VlsCR7G/R+2XLUE+WtDxFqvUbSUpyd6aKsN/h0iT+LDjCPDBizYw4ao0MgYpX0W4Bf1lZnAgyvaA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Sb6tsaLf7zmALfavNxEtUHJ8SHz/fWJWEdAmkdwYRjM=; b=f2rFo2fl0/yWBimZy+tE63qjzlsUZvIdDWa5AwQpGpwR01zy7BmPNT/BU/ipa4YJYiL1DT/XGq18PDwX93TRNSQfNH/jKz4V1ovUxAMgwG1No1hX3f6E3+IfFl7udt342iarhJgBHbF4JvqDA85LE9a3FQ7moZM9s3Ke1/reKvE= Received: from VI1P18901CA0019.EURP189.PROD.OUTLOOK.COM (2603:10a6:801::29) by VI1P189MB0335.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 11:06:11 +0000 Received: from AM5EUR02FT037.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e1e::204) by VI1P18901CA0019.outlook.office365.com (2603:10a6:801::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24 via Frontend Transport; Tue, 5 Nov 2019 11:06:11 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by AM5EUR02FT037.mail.protection.outlook.com (10.152.8.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 11:06:11 +0000 Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 12:06:10 +0100 References: <157289480552.13936.10827971714986515583.idtracker@ietfa.amsl.com> To: From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <157289480552.13936.10827971714986515583.idtracker@ietfa.amsl.com> Message-ID: <4c17cf9f-07e0-b806-e750-d29a04ac140e@ri.se> Date: Tue, 5 Nov 2019 12:06:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <157289480552.13936.10827971714986515583.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="nGEVXOpViIZ04PPHHJQ1pX5ujWgLolZ89" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(376002)(396003)(346002)(136003)(189003)(199004)(15650500001)(40036005)(36756003)(606006)(126002)(21480400003)(478600001)(336012)(14444005)(58126008)(86362001)(22746008)(65806001)(5024004)(2351001)(568964002)(186003)(16526019)(2906002)(26005)(22756006)(7736002)(236005)(486006)(76176011)(966005)(33964004)(70586007)(70206006)(54896002)(6306002)(316002)(16586007)(71190400001)(11346002)(16576012)(2616005)(31696002)(66574012)(8936002)(6116002)(3846002)(6916009)(31686004)(356004)(81166006)(446003)(81156014)(106002)(5660300002)(44832011)(476003)(235185007)(8676002)(65956001)(386003); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0335; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8a41d12f-ffba-43d2-3db9-08d761e02aac X-MS-TrafficTypeDiagnostic: VI1P189MB0335: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QMwq/byoLsPORjoao3lxsvVMFEZTjmqA67SK1f8Vicb5jLUJRtZaAWa32Uivn5xFJQbUrISKYQw0LV7WjXoSNaHpzatRQWksSNGuZ19ceZcEmjkRiioiv7rqByn4Wx04vfpB+Up7LrFyTSkBjALURVVJwt6W3gmVL5V83SjfHGYB7iGiO7+HhTiqeL2OFSUhp1F518amdfyJdHKX6ynj9/kb8Ra8jodjxb89ITfozqiyGj5F5l6C0b5t5wEBq7VuOu6snXtLePzeDWVoOc1YoEPsxG0ujQlsx2+Ic7v4PRE0cbIZvGI1LVjIVySxd16BOp16DyPrir4CCkkvSScs3QvhNBCMo7mbMmzuSuIvu3M8iFMmPvtn/jTzxZB7sVtfLcaBeF1sN+dbDi88Qzi6cpntnao/VxtkhTVDRX7kH0V1bhg/aXKv/JtJMpgVuLh7 X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 11:06:11.2003 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8a41d12f-ffba-43d2-3db9-08d761e02aac X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0335 Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-oscore-gm-admin-00.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 11:06:17 -0000 --nGEVXOpViIZ04PPHHJQ1pX5ujWgLolZ89 Content-Type: multipart/mixed; boundary="a6O6dN6FEHsREByqHfgwRuCGZjQF1auRu"; protected-headers="v1" From: Marco Tiloca To: ace@ietf.org Message-ID: <4c17cf9f-07e0-b806-e750-d29a04ac140e@ri.se> Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-oscore-gm-admin-00.txt References: <157289480552.13936.10827971714986515583.idtracker@ietfa.amsl.com> In-Reply-To: <157289480552.13936.10827971714986515583.idtracker@ietfa.amsl.com> --a6O6dN6FEHsREByqHfgwRuCGZjQF1auRu Content-Type: multipart/alternative; boundary="------------A810CAE3CF14B56AF0B3C6DB" Content-Language: en-US This is a multi-part message in MIME format. --------------A810CAE3CF14B56AF0B3C6DB Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have recently submitted a new draft "Admin Interface for the OSCORE Group Manager". https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin The document describes a RESTful interface on the OSCORE Group Manager, intended for Administrators to create and delete OSCORE groups, as well as set, retrieve and update their configuration. The ACE framework is used to ensure authentication and authorization of the Administrator (client) at the Group Manager (resource server). This interface is aligned and consistent with the other RESTful interface on the Group Manager defined in [1] and rather intended for joining nodes and current group members. Comments are very welcome. Best, /Marco [1] https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-oscore-gm-admin-00.txt Date: Mon, 4 Nov 2019 11:13:25 -0800 From: internet-drafts@ietf.org To: Marco Tiloca , Peter van der Stok , Rikard Hoeglund , Francesca Palombini A new version of I-D, draft-tiloca-ace-oscore-gm-admin-00.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-oscore-gm-admin Revision: 00 Title: Admin Interface for the OSCORE Group Manager Document date: 2019-11-04 Group: Individual Submission Pages: 19 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-oscore-gm-admin-00.= txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-oscore-gm-admin= / Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin-00= Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-oscore-gm-admin Abstract: Group communication for CoAP can be secured using Group Object Security for Constrained RESTful Environments (Group OSCORE). A Group Manager is responsible to handle the joining of new group members, as well as to manage and distribute the group key material. This document defines a RESTful admin interface at the Group Manager, that allows an Administrator entity to create and delete OSCORE groups, as well as to retrieve and update their configuration. The ACE framework for Authentication and Authorization is used to enforce authentication and authorization of the Administrator at the Group Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof-of-possession and server authentication. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------A810CAE3CF14B56AF0B3C6DB Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have recently submitted a new draft "Admin Interface for the OSCORE Group Manager".

https://tools.ietf.org/html/draft-til= oca-ace-oscore-gm-admin

The document describes a RESTful interface on the OSCORE Group Manager, intended for Administrators to create and delete OSCORE groups, as well as set, retrieve and update their configuration.

The ACE framework is used to ensure authentication and authorization of the Administrator (client) at the Group Manager (resource server).

This interface is aligned and consistent with the other RESTful interface on the Group Manager defined in [1] and rather intended for joining nodes and current group members.

Comments are very welcome.

Best,
/Marco

[1] https://tools.ietf.org/html/dr= aft-ietf-ace-key-groupcomm-oscore


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-oscore-gm-admin-00.txt
Dat= e: Mon, 4 Nov 2019 11:13:25 -0800
Fro= m: internet-drafts@ietf.org
To:= Marco Tiloca <marco.tiloca@ri.se>, Peter van der Stok <consultancy@vanderstok.org>, Rikard Ho= eglund <rikard.hoglund@ri.se>, Francesca Palombini <francesca.palombini@ericsson.com>



A new version of I-D, draft-tiloca-ace-oscore-gm-admin-00.txt
has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-oscore-gm-admin
Revision: 00
Title: Admin Interface for the OSCORE Group Manager
Document date: 2019-11-04
Group: Individual Submission
Pages: 19
URL: https://www.ietf.org/inte= rnet-drafts/draft-tiloca-ace-oscore-gm-admin-00.txt
Status: https://datatracker.ietf.or= g/doc/draft-tiloca-ace-oscore-gm-admin/
Htmlized: https://tools.ietf.org/html/draf= t-tiloca-ace-oscore-gm-admin-00
Htmlized: https://datatracker.iet= f.org/doc/html/draft-tiloca-ace-oscore-gm-admin


Abstract:
Group communication for CoAP can be secured using Group Object
Security for Constrained RESTful Environments (Group OSCORE). A
= Group Manager is responsible to handle the joining of new group
= members, as well as to manage and distribute the group key material.
This document defines a RESTful admin interface at the Group Manager,
that allows an Administrator entity to create and delete OSCORE
= groups, as well as to retrieve and update their configuration. The<= br> ACE framework for Authentication and Authorization is used to enforce
authentication and authorization of the Administrator at the Group<= br> Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof-of-possession and server
authentication.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--------------A810CAE3CF14B56AF0B3C6DB-- --a6O6dN6FEHsREByqHfgwRuCGZjQF1auRu-- --nGEVXOpViIZ04PPHHJQ1pX5ujWgLolZ89 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3BV6IACgkQ7iZktA5Y 2kMVtgf+LJ9751QK1zD/2J//OKNAlEmClFvNCkty8mUBKZ1BclO9EpeGy1HH3jKW psLWiFmAT7VICI6pitem/pG0Q/SE6Ognmm6Q9wY7b8LXLjgPGEGuNZF01z+Zh42P l5wOnSu/QgGqwgNbXTjN9KEKtWnwedvBP9ZrIVADPina3rXRPNQxAHASVeBWTkMS me82bRg9GwEZUfMJHvkF6HA+1D5cOkGcokDrzNyhps0h+NOAuiOANpj+RqBrjJQI FhcM+zs5GCbcX3k6QV6YCi4k29hkvfLvAX0qfSv9/nIumkcfRpdDVTm9+Yc3qBKj pSdcTMzYJ+a9Nxx30nbF0zNvY+exqg== =dwxv -----END PGP SIGNATURE----- --nGEVXOpViIZ04PPHHJQ1pX5ujWgLolZ89-- From nobody Tue Nov 5 03:09:21 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A05231208E2 for ; Tue, 5 Nov 2019 03:09:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pNOLOIUXazQB for ; Tue, 5 Nov 2019 03:09:17 -0800 (PST) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00065.outbound.protection.outlook.com [40.107.0.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 037E5120894 for ; Tue, 5 Nov 2019 03:09:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JESsHp5ixg5Rue/CHg4wh3vkdyZKxRd7l3iOd4wIJhbotuxXZ4ChKhppKDcYBZrSMX5oAebCeSyGHLGQbwkMTUz3Pcg7L5JdGO0mlEiYL9+nyuHteTHBqO9n8s4nER5Kf4ndfzKdTuRS3Cr2O/XbFSyZ6Xxh1JigtOuYm4eyfMgt0s5YgPERfiS8VQ9jF2rm3784gYXlBxTbIMqcSh8mVG1sDLAKhP/XPxrpL40jwTAJuf3rO7sCoTuNwDewyGL9+GTSg1VSYh+9m/8tFhTNl8q+EtvB4PVXgnSIQha/44bJAkeYGUijY/A7GSeCGOSVV0aOLpKvjSyupGsiEULpTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zf7GPUvNCA5mZXqyxJpBap4GnLVVRF7HkSZJMcV97yA=; b=nUXYChUbLzxHMvtKqzKcJh4wRmtaa7IH1L03mohMGLnpwBGGarDt4beIr2qfvD98JdmyHe3cvIfMj0YX/9JGl1l9ZmLkCUnhZX6HHbUBxqgW/XsymHuf5AKBl3wFmmV5mvB3/eo4WhTwXQU9TcKN4J9Xdmmd3/mDFUCuFpq91L1ROztsD5loA6/xlB4b8+gMtRAgiJkOTr4Q3npxkQ0L5DxgnNaXL14ErqcFY3S4YNzDIKtgr2hPGYt9O7U0GqeuPoiLlu9H3TpO6byx3QYif4Y5+JBevFsMicmX9LHuLsC3r96EPl3KRNrtanRY2InAbMbCE/DEo25/JVvJWJTW7Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zf7GPUvNCA5mZXqyxJpBap4GnLVVRF7HkSZJMcV97yA=; b=Sa4AIs+cQbvgqFdl4cdFgkE8ITOlxdel+WLKhWP9uZjMRz1Q+Z8ShfEkJeElt9bnBAEzKJiQ83TTAkl7ATvNukFuoqbqYEClXT5BlDCNBpHr+3W9Ri95qgQ3alr3PF9bcIraxOehM0vKue50CMrkCVl6WlIB5GhmbfesIFgIdUQ= Received: from VI1P189CA0035.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:2a::48) by HE1P18901MB0027.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:9b::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 11:09:11 +0000 Received: from HE1EUR02FT008.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::207) by VI1P189CA0035.outlook.office365.com (2603:10a6:802:2a::48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24 via Frontend Transport; Tue, 5 Nov 2019 11:09:11 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT008.mail.protection.outlook.com (10.152.10.77) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 11:09:10 +0000 Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 12:09:10 +0100 References: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com> To: From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com> Message-ID: <57445f36-47d9-1576-97d3-1f96a703557e@ri.se> Date: Tue, 5 Nov 2019 12:09:09 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="oule5DjUvMgqV2olpMYz74LyizyTYDYJZ" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(346002)(136003)(39860400002)(376002)(396003)(189003)(199004)(606006)(3846002)(15650500001)(70586007)(6116002)(2351001)(31696002)(36756003)(26005)(316002)(33964004)(2616005)(386003)(126002)(21480400003)(40036005)(16576012)(11346002)(76176011)(6916009)(22756006)(336012)(446003)(5024004)(14444005)(16586007)(2906002)(70206006)(71190400001)(31686004)(58126008)(66574012)(22746008)(236005)(86362001)(478600001)(54896002)(2473003)(6306002)(966005)(106002)(65806001)(229853002)(476003)(7736002)(186003)(16526019)(44832011)(356004)(5660300002)(568964002)(81156014)(8936002)(81166006)(235185007)(65956001)(8676002)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1P18901MB0027; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b756ecba-d6ca-49a8-b4f1-08d761e095a7 X-MS-TrafficTypeDiagnostic: HE1P18901MB0027: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: hu4A6YX/pUMKUwCrJitQVSgHXGpnk0ISc1xTeN5I8bTv9nROfrnDn1hRAtX4an2BWjSlgRaSk/t+Yys/d44CFUi8lrmcJVgaEbqBDqni9QM4hS2Li2cKrZF4imB4YxSYuicEhHEMsRJnPc4qH3vwQ1GG/phsEI2tXf3cNUxMhuVztMGCJo/g6Ugzp53UTI5ehKHLIbZkMfA6K2W+0fxd5sRZPa+PG5A4Pd9JmwMOQvtWmTxjCUMlvIRdtJAmv4zpztklRLkQJS2bMRepsoxWlfO4moQt0qwJfyvxa4eXxOVmWj4ebmZsgPzI9EdWUB3VMoS2Zavx8uCn3XJGQ6J6CYUY90AU6xOQ7oxr6a9X0PB3g//g2/Hv2XpSLDVYKR5EnHMkO6iZqstEggp3mHjvLuG2YfNa2xnvQWgtcSpp7gbv1AcGTZrnpU0n16BoBwHN X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 11:09:10.6918 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b756ecba-d6ca-49a8-b4f1-08d761e095a7 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1P18901MB0027 Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 11:09:21 -0000 --oule5DjUvMgqV2olpMYz74LyizyTYDYJZ Content-Type: multipart/mixed; boundary="E8pItTjGHAt3JMmd2TbmCmGLJ2eLH9RoR"; protected-headers="v1" From: Marco Tiloca To: ace@ietf.org Message-ID: <57445f36-47d9-1576-97d3-1f96a703557e@ri.se> Subject: Fwd: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt References: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com> In-Reply-To: <157289555650.13868.8624534448888694215.idtracker@ietfa.amsl.com> --E8pItTjGHAt3JMmd2TbmCmGLJ2eLH9RoR Content-Type: multipart/alternative; boundary="------------6DE5ACE8F3F429A9049D5A95" Content-Language: en-US This is a multi-part message in MIME format. --------------6DE5ACE8F3F429A9049D5A95 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have recently submitted a new draft "Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework". https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification The document describes how an Authorization Server can notify Clients and Resource Servers of revoked but yet not expired Access Tokens. This is achieved by means of device-specific Token Revocation List (TRL) resources at the AS, that the associated device can access and observe by using resource observation for CoAP. This approach complements token introspection at the AS, and does not require additional endpoints on Clients and Resource Servers. Comments are very welcome. Best, /Marco -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt Date: Mon, 4 Nov 2019 11:25:56 -0800 From: internet-drafts@ietf.org To: Ludwig Seitz , Grace Lewis , Sebastian Echeverria , Marco Tiloca , Francesca Palombini A new version of I-D, draft-tiloca-ace-revoked-token-notification-00.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-revoked-token-notification Revision: 00 Title: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework Document date: 2019-11-04 Group: Individual Submission Pages: 10 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-revoked-token-notif= ication-00.txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-revoked-token-notificat= ion/ Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification-0= 0 Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-revoked-token-noti= fication Abstract: This document specifies a method of the Authentication and Authorization for Constrained Environments (ACE) framework, which allows an Authorization Server to notify Clients and Resource Servers (i.e., registered devices) about revoked Access Tokens. The method relies on resource observation for the Constrained Application Protocol (CoAP), with Clients and Resource Servers observing a dedicated, device-specific Token Revocation List on the Authorization Server. Resulting unsolicited notifications of revoked Access Tokens complement alternative approaches such as token introspection, while not requiring additional endpoints on Clients and Resource Servers. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------6DE5ACE8F3F429A9049D5A95 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have recently submitted a new draft "Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework".

https://tools.ietf.org/html/dr= aft-tiloca-ace-revoked-token-notification

The document describes how an Authorization Server can notify Clients and Resource Servers of revoked but yet not expired Access Tokens. This is achieved by means of device-specific Token Revocation List (TRL) resources at the AS, that the associated device can access and observe by using resource observation for CoAP.

This approach complements token introspection at the AS, and does not require additional endpoints on Clients and Resource Servers.
=
Comments are very welcome.

Best,
/Marco


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-revoked-token-notification-00.txt
Dat= e: Mon, 4 Nov 2019 11:25:56 -0800
Fro= m: internet-drafts@ietf.org
To:= Ludwig Seitz <ludwig.seitz@ri.se>, Grace Lewis <glewis@sei.cmu.edu>, Sebastian Echeverria <secheverria@sei.cmu.edu>, Marco Tiloca <marco.tiloca@ri.se>, Francesca Palombini <francesca.palombini@ericsson.com>



A new version of I-D, draft-tiloca-ace-revoked-token-notification-00.txt
has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-revoked-token-notification
Revision: 00
Title: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework
Document date: 2019-11-04
Group: Individual Submission
Pages: 10
URL: https://www.ie= tf.org/internet-drafts/draft-tiloca-ace-revoked-token-notification-00.txt=
Status: https://datatracker.ietf= =2Eorg/doc/draft-tiloca-ace-revoked-token-notification/
Htmlized: https://tools.ietf.org/html= /draft-tiloca-ace-revoked-token-notification-00
Htmlized: https://datatracker.= ietf.org/doc/html/draft-tiloca-ace-revoked-token-notification


Abstract:
This document specifies a method of the Authentication and
Authorization for Constrained Environments (ACE) framework, which allows an Authorization Server to notify Clients and Resource Servers
(i.e., registered devices) about revoked Access Tokens. The method<= br> relies on resource observation for the Constrained Application
Protocol (CoAP), with Clients and Resource Servers observing a
dedicated, device-specific Token Revocation List on the Authorization
Server. Resulting unsolicited notifications of revoked Access Tokens
complement alternative approaches such as token introspection, while
not requiring additional endpoints on Clients and Resource Servers.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--------------6DE5ACE8F3F429A9049D5A95-- --E8pItTjGHAt3JMmd2TbmCmGLJ2eLH9RoR-- --oule5DjUvMgqV2olpMYz74LyizyTYDYJZ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3BWFUACgkQ7iZktA5Y 2kPVQAf/WqxTjIgAMsK+Laj8QQijrxDIAd+WKiqVDThBEmrJlky++rn4EQ1qOXLo a6v9IZ2tCbBwXPD8UnErk6TFF8NGMiZJQGp5B6zLsuJppn1wxbmx3uucG2pAO9Yq F3X0cyKK4Ogm+OqE74CUJM/9/kNyGZbmFeQF4tu8ZtwW8+feyV9m09gtHczw0pVn kYBr2Ljx/YLLs9yTIR621h6WKmuREz/XHP3JvzxM2sAJEqddQmCDCmZVe+0jTosh qWFRXrkx+wYAlLNghFbADsgdq3dfVkYKSH01RSp3XVd0uo9yc1MKSTQ2HXg/JNPe 7XiAqgKuZw40+xEPzCt8KKw9s0upiA== =fB9s -----END PGP SIGNATURE----- --oule5DjUvMgqV2olpMYz74LyizyTYDYJZ-- From nobody Tue Nov 5 03:33:11 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD82012087B for ; Tue, 5 Nov 2019 03:33:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Odo3Xfy2pe3 for ; Tue, 5 Nov 2019 03:33:07 -0800 (PST) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40043.outbound.protection.outlook.com [40.107.4.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 998581200F5 for ; Tue, 5 Nov 2019 03:33:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZJjh7/gg1YUraS4vGJm1hDR34bdYgAEV/gj4DoWGlc2fXuytXt+pjgQNxQfsd4Lrhj99ITDoaA5A/GyAWX8qpFYsEGaV34khKEbZ7mY+Dv9xL359EjOqhPp6juqs9bMS7VkvvNyPxdUrQrgwNR7WbANcH2ge0yCjFYFNm2aiwrcZB9UUQt7ovGmx/ek3VEWfsTi/cUKgVDwn01wap+vnjIZQnebqMa9+cLa86PiVcwO9C6xtKBdExo4d5w0u9Z/Qse97ORJQmj+/t79ELZ4xlTjL3T5BNvrJ9LNpKjXRjVwaIz1uVocbn3KdNsAtk7UI0H1YCduE23KVrkzzsz/kIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C6hA+M1LTF8PLR5Di6QdQM/1TWaTloU6qqGsPFp5NB4=; b=fFndWgDDUPEk6XDdljMVMmrxH5znleKE791yvIewqrjT8DmfGlMld2hatpwRFNbytoGes8QYQbzTvvuLnIA5un6/G5L4KRu2vPz0Hk9QbdCUnz9+7eYrEe2zH2zGbgUZVg6ifb9Fj9GUgC0eeb16toVRPf1nOJfR80tNcvnwDN/U1BMgjCaPxBe1Em95erhIEVDHJaWAicWh26SIFWLjnQQjr1Y3X5suXSFDo/AuDEVeKW+gFZiktgZbfl4aqW+koQyIoIuQ4WvJBUBXcHEJzn1t2ZDTyk13cUq7nZA9YtXTtXAsEHLw0jy3E4/WWHSJ70l0SU0+gKwK/JyfbBYW+w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C6hA+M1LTF8PLR5Di6QdQM/1TWaTloU6qqGsPFp5NB4=; b=kPcKmDBk0iANdEjxElI2NZ+vXABkN7bUp/BAXvf9th2TgVHISa9COSHImrgsuL2Kerk4TqkCAyJjlarOBoCY4QqlUgL0vxFu0WTcyG9mjm48K6CcVbuM6R3k+20usCP7gnPfA1rJzEJ/q8uNH8goBJUUeDr8ZB3ImSsE7nLgt/0= Received: from HE1P189CA0031.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:53::44) by DB8P189MB0668.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:fd::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 11:33:03 +0000 Received: from HE1EUR02FT014.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::208) by HE1P189CA0031.outlook.office365.com (2603:10a6:7:53::44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2430.20 via Frontend Transport; Tue, 5 Nov 2019 11:33:03 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT014.mail.protection.outlook.com (10.152.10.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 11:33:02 +0000 Received: from [10.112.134.122] (10.100.0.158) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 12:33:01 +0100 To: Daniel Migault , Jim Schaad References: CC: "ace@ietf.org" From: Ludwig Seitz Message-ID: <45ab1a56-d4be-9445-34a3-66a07a5249e3@ri.se> Date: Tue, 5 Nov 2019 12:33:01 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000508040104060604000408" X-Originating-IP: [10.100.0.158] X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(979002)(4636009)(346002)(396003)(136003)(39860400002)(376002)(189003)(199004)(356004)(58126008)(5000100001)(235185007)(22746008)(5024004)(14444005)(81156014)(31686004)(71190400001)(81166006)(22756006)(8936002)(2906002)(229853002)(40036005)(305945005)(7736002)(478600001)(486006)(336012)(4326008)(568964002)(6246003)(5660300002)(65956001)(8676002)(11346002)(446003)(476003)(6116002)(3846002)(44832011)(26005)(53546011)(386003)(36756003)(16526019)(76176011)(316002)(186003)(31696002)(86362001)(16576012)(110136005)(16586007)(106002)(6306002)(70206006)(2616005)(126002)(966005)(70586007)(65806001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB8P189MB0668; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 42012e40-cf85-4e5a-fdc5-08d761e3eb29 X-MS-TrafficTypeDiagnostic: DB8P189MB0668: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: WtrlBPhyGiAA1VF5JaObFVAF03hY/IKz92r2Pfa1DXwAlZ9zDh917F2TDMugpEd/nRns2fPhh+VkYyuaJwJeGnc8ulCx9fiCVOiOjYcjJ9oSYswQeqLYjHFA/w2j1WvDH+Wx/5NhMZ+dSWV7YdGlFzQnYLlbXR8sXqjIm526ejwEvB5aAz2sTHGPvI8HznnNx+XI3AfI81mSHaRkLi3FwPH623d5Wu0TUyh1AOtlFdxpvplwb4oA04Y0+BNcsXa1XGu7CLMSQa++rnBzuC9pPsNffG7OWD/8JL2N/KgdUmCY8mwdwe1ZF+uaUhvNBkq3VhczxguaEc8zIW0zb65EBDmGCM8Gu9jXedjsr1M0ZMOPbf6xS+Ov15GDHKsUvpicmlgeensfZjyN5YrvoJXymXbE8M7hGBZMFJiqcfZ9gf/S2cO4cphIMbwAK2LY25FL X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 11:33:02.6352 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 42012e40-cf85-4e5a-fdc5-08d761e3eb29 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8P189MB0668 Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 11:33:10 -0000 --------------ms000508040104060604000408 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 31/10/2019 19:26, Daniel Migault wrote: > Hi, >=20 > The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 .= =20 > Please let us know if there are topic you would like to present by=20 > Wednesday November 6. Slides are expected to be uploaded by =A0Sunday=20 > November 17. >=20 > Please remember the draft deadline is Monday November 4 >=20 > https://datatracker.ietf.org/meeting/106/important-dates/ >=20 > Yours, >=20 > Jim and Daniel >=20 Hello Jim, Daniel, I would like a 10 minute slot to present https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification I will be presenting on site (i.e. not remote). /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms000508040104060604000408 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTEwNTEx MzMwMVowLwYJKoZIhvcNAQkEMSIEIAJGjbDYkoSZDdjIW71Z0JsrWoIkGCrDg/sBjMx/EBF3 MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAEn/0spLPYS95bhZdZYU7hofHSjybJhwgk9M0f+uTPD8Z RNzlzY/jVa9jd9TK5YuY7u3auRlUyaYNLDquyzqXf/d8a25hwxmNW+HwXYBzvKwFUZ+bDmIG fxphejeFGNMeo1WujDl2Q4g/uvJOyAKphjOzBhEWzheIX/SIrnEfsdMtwPPY0PbYufRTFjBK eg2Dyk+OseYyfAEiqIUJV5muOEyUR62v9oqcYuUNCvNs2ANjQbQeNcL3Kih30pcIcvKWMSAQ nixEIfLmNpdLXGHBo5q06+uzoXkgoetwpn1rK14UoWkPMWsKOsJoFUNW+ZtFZuS0drpKlX1+ CgEzLcz9rwAAAAAAAA== --------------ms000508040104060604000408-- From nobody Tue Nov 5 03:38:44 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22D391208EB for ; Tue, 5 Nov 2019 03:38:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0P-WO3vIv9z for ; Tue, 5 Nov 2019 03:38:41 -0800 (PST) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BB9A120803 for ; Tue, 5 Nov 2019 03:38:40 -0800 (PST) Received: by mail-qt1-x833.google.com with SMTP id r22so18792620qtt.2 for ; Tue, 05 Nov 2019 03:38:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Wv7/95KQrcNn+8nHHKAl3PqXUXOIm4xi9jNre1SWmOU=; b=I5vhg5NiR+rZ4apg11jmPCrhbDdxjRWhHUiIBmQuvUODPYxEcFqA2pKI3MGpaStEjN OMF4k1Ods0YlIJCdc8Gs2RcyJnT/1Hgcrqejhkgpf4jmWVawvUFc5GEOuG4yl0CFwnub S+WdXr53IIG8jwzaXF6b4xUpYCKdYptA+yE2lXxvI6ghZlUCuxMbuGhAfeUKL0ZUhXBU 3tonQHrGa+u6ouI/x5GtJr3jLBkcX19YFlXuwARH9UWhSnx8cRPR/fAL6PhFmtzLCFT+ t6m+8Z616sVOTiFxXPRLL91m+HHs6ZggbkqJDy9dAlwKAfSCt9/FWXkfJhQ3r2mFAXzs wiYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Wv7/95KQrcNn+8nHHKAl3PqXUXOIm4xi9jNre1SWmOU=; b=CbiwQuVGD58+0SmyzFeE1pcPYLMrL/EygPAKRqzVaCSKwrz09CBIrL4J0Hi8SR1rXQ PCSw35iYEK/XbpDbk6lhQIZpUFTQ7N7OlIH/YADWng8GSzlQIgzNPzu5ZTjUGh9TY1GU drm3XzACyZpFP2XbD85hyitJOSxJFHcFZp1oFjtSjHaYheUrr3SwqbwFZftc8otKGYEv hHY9GYEX9qLudFfIWka+oG+yEAyJqb0dAS2m6CVzSjZJJby8OsR5HZfeITbDlYuIyJEt OhL8xmH5LDbjxvxDGg+B8evvxPEQQOiVhh3FjCuZqttxPgwSucXtKdi7FnaTNYbREto4 V1Vw== X-Gm-Message-State: APjAAAW/dmNpbes/SV+DbViJCQrO09QpV10EhQpq2sAHYRRq7/JpKV3E 3HO4kyGt6vKkSSbN6cJPiIGsIzXL6diQD0uZA+PTBIohG98= X-Google-Smtp-Source: APXvYqyxJV+uwfebtGyhJFfKHcWLpQWEWGEpcCEffWY24qcK1NeoFcKj6V0Cy9raOEw//JtTkKmizxI1yOxJuav0K+Y= X-Received: by 2002:aed:33c2:: with SMTP id v60mr13943669qtd.168.1572953919931; Tue, 05 Nov 2019 03:38:39 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Cigdem Sengul Date: Tue, 5 Nov 2019 11:38:28 +0000 Message-ID: To: Daniel Migault Cc: Ace Wg Content-Type: multipart/alternative; boundary="000000000000a54ab9059697df99" Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 11:38:43 -0000 --000000000000a54ab9059697df99 Content-Type: text/plain; charset="UTF-8" Hello Jim and Daniel, I would like 10 minutes in the agenda to present the updates we made to the: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ I will be presenting remotely. Thanks, --Cigdem On Thu, Oct 31, 2019 at 6:27 PM Daniel Migault wrote: > Hi, > > > > The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 . > Please let us know if there are topic you would like to present by > Wednesday November 6. Slides are expected to be uploaded by Sunday > November 17. > > > > Please remember the draft deadline is Monday November 4 > > https://datatracker.ietf.org/meeting/106/important-dates/ > > > > Yours, > > Jim and Daniel > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000a54ab9059697df99 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Jim and Daniel,=C2=A0

I would lik= e 10 minutes in the agenda to present the updates we made to the:=C2=A0

I = will be presenting remotely.=C2=A0

Thanks,
--Cigdem=C2=A0

On Thu, Oct 31, 2019 at 6:27 PM Daniel Migault <d= aniel.migault=3D40ericsson= .com@dmarc.ietf.org> wrote:

Hi,

=C2=A0

The ACE WG is meeting at the IETF 106 Tuesday Novemb= er 19 15:20-16:50 . Please let us know if there are topic you would like to= present by Wednesday November 6. Slides are expected to be uploaded by =C2= =A0Sunday November 17.

=C2=A0

Please remember the draft deadline is Monday Novembe= r 4

https://datatracker.ietf.org/meeting/10= 6/important-dates/

=C2=A0

Yours,

Jim and Daniel

=C2=A0

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--000000000000a54ab9059697df99-- From nobody Tue Nov 5 06:51:35 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4509B120984; Tue, 5 Nov 2019 06:50:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9jgAZicq0_CT; Tue, 5 Nov 2019 06:50:33 -0800 (PST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50086.outbound.protection.outlook.com [40.107.5.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DF8B120089; Tue, 5 Nov 2019 06:30:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JIMIh3szFu9TH1GLtFMy/qjqbIu6tHn3e22jG1VxjHc6rkrAEyz/dP3pgx5ryLB8ISLQU9tzGW0PuDNrqSVYW8NHV+hbTrhI0CINItBG1qDvqxlnGzrZAobp+i4kvdXtsHZf/PlueoaOSYzyGzyyn3QOQ0wg7I9BBPjw5uKl55f9iURB6Z6mowhPjORRHISM5k4ESJh5d2zyhZ16alyZ2rl2AIYZT0gjFSfhvrsafkYtfVXh6Z401eJKWeurldbHwU5FD5hzgYx7p4TJ7jQ+CytUYkEStJXb0AW0Vy/1J2+vXp10F3JgjwtWSLHxWnaVXJtm9PnKef5b8z6LeK1oYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wbjahX4oc6TMjEyTo8n6XgMhn/p6YkLgNcrHdx06bPA=; b=dRGfztaZ4mjqvt0Z5utLIOyjkGK7H6b3R7c/5pvB/jd6ViWy5T+RWqVKw+ssCtKETMOfQ6Sv50tjX+wlE1FtZ49Yj01E2DkbKHdXVH5JcfoUFLahCvNmGL7NPHE5K2ZUwpeL6A0N4+KmZ1iFSCQQ/b49283K+TQHQ93voNRqRHbJ42jGtMh0X0OB2TCIb8AAVc0d01jiacR0m8lFej7uPOslmoiTNeYHju7SLn+aC752V8wxWHxfpxVPBlgmR5HmrzwIETA10UeO2C8lyjAWz9MO44uf7i60Q1T0ORlldEhLC5WlvOFOEsCKvQ7l4DybSzTLQ/Sf9iX8aaXzmg3VgA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wbjahX4oc6TMjEyTo8n6XgMhn/p6YkLgNcrHdx06bPA=; b=WpylYjXjBthojG+kAgq8qDWqtY0HynmlHYd0fe6GMjQKU5RNlxaUMbbnV+OGv5xHhMF8IJ6rrwygZUTi0xQ/pVNOCBrnzu5f+V1oAldF42QLBSZplV4gYbq+Gm/9ZxzESYgvtL+Nf2WHI/rFRRecdkj4QaNKNwTBbQ5NpOUud/4= Received: from HE1P18901CA0024.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:8b::34) by AM5P18901MB0002.EURP189.PROD.OUTLOOK.COM (2603:10a6:203:76::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 14:25:47 +0000 Received: from HE1EUR02FT009.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::200) by HE1P18901CA0024.outlook.office365.com (2603:10a6:3:8b::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2408.24 via Frontend Transport; Tue, 5 Nov 2019 14:25:47 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT009.mail.protection.outlook.com (10.152.10.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 14:25:46 +0000 Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 15:25:46 +0100 To: Ludwig Seitz , CC: "ace@ietf.org" References: From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: Date: Tue, 5 Nov 2019 15:25:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IdvlrWFiS6lmgASAJMUO6d3Y3AB8U4lzj" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(376002)(396003)(346002)(136003)(39860400002)(189003)(199004)(2616005)(2906002)(966005)(11346002)(21480400003)(8676002)(4326008)(16526019)(186003)(71190400001)(5024004)(14444005)(22746008)(446003)(568964002)(65806001)(6246003)(58126008)(229853002)(110136005)(316002)(16586007)(36756003)(66574012)(235185007)(40036005)(16576012)(478600001)(450100002)(3846002)(6116002)(53546011)(81156014)(33964004)(126002)(26005)(70586007)(31696002)(70206006)(5660300002)(356004)(6666004)(22756006)(65956001)(106002)(31686004)(8936002)(336012)(305945005)(6306002)(386003)(76176011)(7736002)(86362001)(44832011)(486006)(476003)(81166006); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5P18901MB0002; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bffed2ba-e4d9-4c6c-2ca7-08d761fc0cc4 X-MS-TrafficTypeDiagnostic: AM5P18901MB0002: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: rt9D6B0AbRRLrd2Z0NK1TeZs49bPhMH2vOOixlC0QJJtJyMvPgztLvfM7eEQ+qOugflVS834Gbl6tZ3m0dHDaut7mBD1AEmbme18yhwS7QIvACQ5mtDj3HGvr9ZaRcjAhdVJZXLMAbYBUmrQLx18i8Q0Pd6uMFCOFqPots6UHgwbOXxKxMRZUrUqVoDobdDqBKC+DRPdGmJ1b6DeMcV4ggEqJ3UDMQ9B90ffw1iPiZwynCrbnsMhs0Txwh7q3XBPUVmdB6ureUfakEepw2djiTM2JZhjQ37kwHRlxg6c2tshw+JQELQub3wRImiKj7sFB6BqFwFRlSmpPfLUcZoaZ+TM/bGEH+jxkDDkUx2k+3szZL/2ENMwMWmcHkk6JbIiBoSVMnClYLOlec2A49fFVelFBzGD2NMCUB2NEqW6AxR5j9XH4PT1dSfFY24Bdx8w X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 14:25:46.9409 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: bffed2ba-e4d9-4c6c-2ca7-08d761fc0cc4 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P18901MB0002 Archived-At: Subject: Re: [Ace] Review of draft-ietf-ace-key-groupcomm-oscore X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 14:50:43 -0000 --IdvlrWFiS6lmgASAJMUO6d3Y3AB8U4lzj Content-Type: multipart/mixed; boundary="LwEVbBoNL6fECMEBVy7U5o2ZIraHPURJN"; protected-headers="v1" From: Marco Tiloca To: Ludwig Seitz , draft-ietf-ace-key-groupcomm-oscore@ietf.org Cc: "ace@ietf.org" Message-ID: Subject: Re: Review of draft-ietf-ace-key-groupcomm-oscore References: In-Reply-To: --LwEVbBoNL6fECMEBVy7U5o2ZIraHPURJN Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Hi Ludwig, Thank you very much for your review! We have addressed your points in the recently submitted v -03. https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore-03 Please, see our replies inline below. Best, /Marco On 7/22/19 1:14 PM, Ludwig Seitz wrote: > Hello Marco, Jiye, Francesca, > > I have read draft-ietf-ace-key-groupcomm-02 and I have a few comments > for you: > > =3D=3D > =C2=A01.1 > "The URI of a join resource is fixed." > > How can that be a requirement? The Group Manager might also be a > mobile unit that changes address as it moves through different networks= =2E > Perhaps rephrase to "The URI-Path of a join resource is fixed"? Right, we in fact meant URI-Path. Note that "join resource" has been renamed as "group-membership resource", consistently with what planned for other related documents. The joining process itself does not change. > > =3D=3D > 1.1 > "Monitor: ... This corresponds to the term "silent server" used in > [I-D.ietf-core-oscore-groupcomm]." > > Any special reason for defining an separate equivalent term? Otherwise > this only makes the set of documents harder to read. Yes, the reason is using the word "server" only for the ACE AS and RS, while avoiding it for roles of nodes in the OSCORE group, that would probably create more confusion. > > =3D=3D > 2. > "To this end, the AS must signal the specific transport profile to > use, consistently with requirements and assumptions defined in the ACE > framework [I-D.ietf-ace-oauth-authz]." > > Note that in the ACE framework the AS does not have the obligation to > signal the profile, since the assumed base-case is that the profiles > are pre-configured and well-known in most constrained applications > (this is an update from previous versions of the ACE framework). > Right, we have relaxed the "must" to "MAY", and mention the most common case of pre-configured profile usage. > =3D=3D > All document: Update references to OSCORE to point to RFC 8613 Done. > > =3D=3D > 2. > "2. The joining node transfers authentication and authorization > information to the Group Manager by posting the obtained Access Token > (see Section 4)." > > Although it is explained in section 4 you might want to mention > already here _where_ the information is POSTed (or replace "posting" > with "sending") Done. > > =3D=3D > 2. > "5.=C2=A0 The joining node and the Group Manager maintain the secure > channel, to support possible future communications." > > Maintaining such a channel is costly in terms of memory, is that > really a requirement? > > Also in the case of object security, speaking of a 'channel' is > misleading. Sure, it is very much expected to be used for key management operations, e.g. asking the GM for new keys, unsolicited (group) rekeying and so on. We clarified this at the end of step 5. We have replaced "channel" with "association". > > =3D=3D > 3.2 > "Also, the 'profile' parameter ..." > > See previous comment on profile being optional in the ACE framework Now fixed, also consistently with the other related comment above. > > =3D=3D > > 4. > "the Access Token post" > > I don't think this term is well-understood in general. I'd suggest > removing it with something less REST-centric for the uninitiated > reader, like e.g. "the sending of the Access Token to ..." Done. > > =3D=3D > 4.1 > " Note that the CBOR map specified as payload of the 2.01 (Created) > =C2=A0=C2=A0 response may include further parameters," > > Note that the ACE framework does not specify this response payload to > be a CBOR map. Please explicitly state here that you are deviating > from the default payload format in the ACE framework. We added this clarification at the end of the above different paragraph starting with: "The payload of the 2.01 (Created) response is a CBOR map"= =2E > > =3D=3D > 4.2 > "In case the joining node knows the encoding of public keys in the > OSCORE group, as well as the countersignature algorithm and possible > associated parameters used in the OSCORE group, the included public > key MUST be in a consistent format. " > > What is a "consistent format"? Please rephrase to be more specific. > Or did you mean "compatible format"? We have rephrased it as "MUST be compatible with those criteria" mentioned right above. Also, we have further clarified what has to match.= > > =3D=3D > 4.3 > "That is, the public key has to be encoded as=C2=A0 expected in the OSC= ORE > group, and has to be consistent with the counter signature algorithm > and possible associated parameters used in the OSCORE group." > > What is "consistent with the ... algorithms and ... parameters"? > Did you mean "compatible"? Yes, just replaced "consistent" with "compatible", here and in the rest of the document. > > =3D=3D > 4.3 > "The 'profile' parameter MUST be present and has value > coap_group_oscore_app (TBD), which is defined in Section 9.3 of this > specification." > > See comments on 'profile' before. This is different, it's an application profile indicated by the GM to tell the joining node what the keying material is intended for. It is not indicating a transport profile (e.g., the OSCORE profile) communicated by the AS when requesting an Access Token. > > =3D=3D > 6. > "In this case, the joining node MAY not provide again its own public > key to the Group Manager," > > This could be misunderstood to mean "MAY NOT ...", how about > rephrasing this to: "MAY choose not to provide ..." ? > Done (now current Section 5). > =3D=3D > 7. > "When doing so, the Group Manager MAY take a best effort to preserve > the same unchanged Sender IDs for all group members" > > This is incorrect use of requirements language. This 'MAY' can not be > tested and the arguments for claiming conformance to this requirement > would be quite diffuse. I suggest to require maintaining the Sender > IDs. Why should the GM change them in the first place? > > (Now current Section 13) As agreed at IETF 105, we have changed it to "Also, the Group Manager MUST preserve the same ... ". As to the Group Manager that may more generally end up changing the Sender ID of a single group member, this is described in current Section 7, as for the reason and the way it happens. Thank you very much again for your review! > Regards, > > Ludwig > > --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --LwEVbBoNL6fECMEBVy7U5o2ZIraHPURJN-- --IdvlrWFiS6lmgASAJMUO6d3Y3AB8U4lzj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3BhlgACgkQ7iZktA5Y 2kMLZggAhk8/RPeFzRZSD5MuSwLiH7HT/i6Hdrq7epJVgWiJOKGHo4qHMafc1eBA bmaE7xSCuIbbXtqX34sy6ONpXlLCQD+lmQ2TG2KVXDT1geck/9mQGwuyEAPkSbsl XigYGerJMadwDQCHJ5ZLmfLF89BXRkaciwpGiJviOYMobI1U2WP4/aPi7hsa0H93 NvoKczkHxKd84ZEVDLhZsyNM1kkJ4WZ3xP6NDa8YiUxhJ9S13381GjN8o6XriH0V TT3bBEvchZe2VpG/Z9+XIzI1KelUJWJ2aFyXz++TCyaoIVi+1J2NPCyOyamwdx6p GVJ1A/pZ9K2fs23ABSzNHGKdsQRq1A== =GHj2 -----END PGP SIGNATURE----- --IdvlrWFiS6lmgASAJMUO6d3Y3AB8U4lzj-- From nobody Tue Nov 5 06:52:48 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 329C01209B8 for ; Tue, 5 Nov 2019 06:51:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3_CiSp21hZ7h for ; Tue, 5 Nov 2019 06:50:59 -0800 (PST) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20065.outbound.protection.outlook.com [40.107.2.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 610C112082E for ; Tue, 5 Nov 2019 06:34:36 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AVOJtmrEhJnF91WsLZHii4Yv6QkDnAp1n3rjFfbeRuRls/dQsqc4FS6LHf8upSdmXUbfaskR6rSvZ621uzqZ9XQReiUbDVjh01rmkZBWJrPggP5HlkNNO9wrpli7xgit/OQCwtM3NWbSm6P5KkfZ5WUlecIWS8cHvu64MFphcAB+T71/aM39t1jhUv1X3V2vTceOr0fzpYebRUbzozQXWHjrk3KAjoG1JlS6OVIK7aPSxKNn1Q/4W4oje/KAaMn84qT5r73xmakxakOe+/OELYFt4YFtAlPQ4o45kZW307oRUWLKn4bbHObMl5o2DJXkEOr2ISeAUt+vLjsQd0OaKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3sbjqrXfVtLVuuuWZ8Jufc1LwK+/6wJ0LjE7KK1a+G4=; b=k7NcjG5b6WizcoFD11B8EQut0eF+tfjWYpOoaemWY53eS5k4oqFLegJA3IBtRh71FjIh9j1VOC2Kx6w0HSo2XX8e3XuXhghSQosjL/t+pX+EcycQYgyyr5rRXeRSodVSi5WBMorTOnw7JTuNQ5JXViLMboC1c5AjZSxCAQ7yXR7eYHTBkeOKvg0K1aJ8odMBpSGPZ5U5uzG+xp7jRE7GXGhxBpDkipxBAgEt7VZAmE/ZmsAdqFc+Inpn80QZ+WNR9e/5WkWveZu5UZYGytEHq/sv8LwK7f52/YF0NVyJ/sc2zCTDkIYFrpE9WfauBKesn+cLVc9QtmXaZt+mw4hqPA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3sbjqrXfVtLVuuuWZ8Jufc1LwK+/6wJ0LjE7KK1a+G4=; b=wyLTWC0wAWJY7ztQrQhPgW8oy2YX3IcEvo7XSdk3oenm1HaYfUSk5PgrwBqxqKKiITqN2vcSZZl9q1j225t7rUa4pU8/AyOtk9V7yrLlvgD/Q5q6d12vLbpZj7Dk/h+fYP00+c/Kahz1XNO9HRXjUo7mxMarEZ9WwUDdXnsQHc8= Received: from DB6P18901CA0005.EURP189.PROD.OUTLOOK.COM (2603:10a6:4:16::15) by AM5P189MB0483.EURP189.PROD.OUTLOOK.COM (2603:10a6:206:1e::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2408.24; Tue, 5 Nov 2019 13:24:42 +0000 Received: from VE1EUR02FT056.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::200) by DB6P18901CA0005.outlook.office365.com (2603:10a6:4:16::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2430.20 via Frontend Transport; Tue, 5 Nov 2019 13:24:42 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT056.mail.protection.outlook.com (10.152.13.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2387.20 via Frontend Transport; Tue, 5 Nov 2019 13:24:42 +0000 Received: from [10.8.3.8] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Tue, 5 Nov 2019 14:24:41 +0100 To: Daniel Migault , Jim Schaad References: CC: Ace Wg From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: <6999550b-7d50-75b9-5ac6-73601d5d5089@ri.se> Date: Tue, 5 Nov 2019 14:24:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="3349jMQ613jRLwQYkYD1Eow3BsctsuQkd" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(136003)(346002)(376002)(396003)(39860400002)(199004)(189003)(966005)(2906002)(44832011)(478600001)(16576012)(16586007)(40036005)(54896002)(3846002)(790700001)(229853002)(7736002)(236005)(568964002)(5024004)(6306002)(70586007)(235185007)(5660300002)(4326008)(22746008)(31686004)(66574012)(6116002)(2616005)(86362001)(22756006)(45080400002)(21480400003)(71190400001)(81166006)(606006)(65806001)(446003)(11346002)(476003)(126002)(70206006)(65956001)(8676002)(81156014)(14444005)(6246003)(6666004)(356004)(336012)(186003)(16526019)(58126008)(316002)(106002)(110136005)(76176011)(386003)(53546011)(26005)(486006)(36756003)(31696002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5P189MB0483; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ef2ee119-81fe-4602-edea-08d761f38471 X-MS-TrafficTypeDiagnostic: AM5P189MB0483: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 0212BDE3BE X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: IxS23ydSVRM0/J0jqf0KEis+mogST6qsbDEXKATvkN8hxx1ha6x4Zq1qd+jiwMN/L36dM2Xbi6GtpyWFe5nSn84TVGAu7knr6xAkG1KMyKojj+dyd94pRbiQ/iRgsOJ143QjT2UfX7Tfp59nCJudhTzmEDfwIbv+97k4dMJq8hPpqWMCpJVJQLg/62eURJ/Ex5JQU1KkTIngBUiocfcZRR+MDFyjbefiiM2hH8pOxmgNaPt8t5eFrri+z0AlA6T+sZy79f7g8i/f/npKZabYGIG8EcsVv32hlzjcHbQloSUr49v2NVu7d3HP2p60Bq7xNyG03abtnQI0kZXBikVJRuhB7Eqron+f+Us2jDd6DF4a+yz2+gMtJPr0gBzzihbven9jKCGC9ip/XyDQBHoGewigXx6L8HorJwprWnt8lKE1csATpXDEzrIofLToVsWB X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2019 13:24:42.2119 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ef2ee119-81fe-4602-edea-08d761f38471 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5P189MB0483 Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 14:51:07 -0000 --3349jMQ613jRLwQYkYD1Eow3BsctsuQkd Content-Type: multipart/mixed; boundary="suohxXlxmURBkHp2OB8XySVRUw5TO12Wy"; protected-headers="v1" From: Marco Tiloca To: Daniel Migault , Jim Schaad Cc: Ace Wg Message-ID: <6999550b-7d50-75b9-5ac6-73601d5d5089@ri.se> Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations References: In-Reply-To: --suohxXlxmURBkHp2OB8XySVRUw5TO12Wy Content-Type: multipart/alternative; boundary="------------577322C1A6F958928300F51C" Content-Language: en-US This is a multi-part message in MIME format. --------------577322C1A6F958928300F51C Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hello Daniel, Jim, I would like to ask for the following presentation slots, preferably after draft-ietf-ace-key-groupcomm . 1) 10 minutes for https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore-03 2) 10 minutes for https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin 3) 10-15 minutes for https://tools.ietf.org/html/draft-tiloca-ace-group-oscore-profile-01 I will be presenting on site (i.e. not remote). Thanks, /Marco On 10/31/19 7:26 PM, Daniel Migault wrote: > > Hi, > > =A0 > > The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 > . Please let us know if there are topic you would like to present by > Wednesday November 6. Slides are expected to be uploaded by =A0Sunday > November 17. > > =A0 > > Please remember the draft deadline is Monday November 4 > > https://datatracker.ietf.org/meeting/106/important-dates/ > > =A0 > > Yours, > > Jim and Daniel > > =A0 > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=E5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --------------577322C1A6F958928300F51C Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hello Daniel, Jim,

I would like to ask for the following presentation slots, preferably after draft-ietf-ace-key-groupcomm .

1) 10 minutes for https://tools.ietf.org/html/dra= ft-ietf-ace-key-groupcomm-oscore-03

2) 10 minutes for https://tools.ietf.org/html/draft-til= oca-ace-oscore-gm-admin

3) 10-15 minutes for https://tools.ietf.org/html/d= raft-tiloca-ace-group-oscore-profile-01


I will be presenting on site (i.e. not remote).

Thanks,
/Marco

On 10/31/19 7:26 PM, Daniel Migault wrote:

Hi,

=A0

The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 . Please let us know if there are topic you would like to present by Wednesday November 6. Slides are expected to be uploaded by =A0Sunday November 17.

=A0

Please remember the draft deadline is Monday November 4

https://datat= racker.ietf.org/meeting/106/important-dates/

=A0

Yours,

Jim and Daniel

=A0


____________________________=
___________________
Ace mailing list
Ace@ie=
tf.org
https://www.ietf.org/mailman/listinfo/ace


--=20
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistag=E5ngen 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www=
=2Eri.se
--------------577322C1A6F958928300F51C-- --suohxXlxmURBkHp2OB8XySVRUw5TO12Wy-- --3349jMQ613jRLwQYkYD1Eow3BsctsuQkd Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3BeBEACgkQ7iZktA5Y 2kONRAf/YE7kda7KPfbvhQkiPfsJLcSAOqrWSu188c4VBnq0YOY8zkfkoUlaOw0a pT3xUpTdfN8i7TQ6ZnSHXcaxrKQRXFUJqI1leISEdi6p5CP1BzTqnyuxMLH1BhEN yUixZxngKrIX5MP+xLSerRVNfDO7vk2eWsPHqhlHyOUQ5cxE69FHAS8WPm7LTL5e PrAga7q/2oz7FUlZyykm+m5LypiUtXpKQruJc9CipsVkQZRxlZcoC5+fwzR8xhuD TdlfbVfdfElUJM2jDxJe+1hl+BjDLhHg9NEeVMzyv2blicy2rt5etEObhjXk2Sy1 NlHf29xgNkODAdcY9wE5TLeFjpRQcw== =/EaP -----END PGP SIGNATURE----- --3349jMQ613jRLwQYkYD1Eow3BsctsuQkd-- From nobody Tue Nov 5 13:03:17 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FDB7120BC9 for ; Tue, 5 Nov 2019 13:03:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.565 X-Spam-Level: X-Spam-Status: No, score=-1.565 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.082, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gAXX-3b3TbGr for ; Tue, 5 Nov 2019 13:03:14 -0800 (PST) Received: from mail-vk1-f176.google.com (mail-vk1-f176.google.com [209.85.221.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8B01120B7E for ; Tue, 5 Nov 2019 13:03:13 -0800 (PST) Received: by mail-vk1-f176.google.com with SMTP id p68so5059077vkd.0 for ; Tue, 05 Nov 2019 13:03:13 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0PclR8oi+i28Is79Xcywp67i6w+C3Abg8Ly7I1et11Y=; b=b3f7U6pbKM3GeKBudwpuwll/KxEtEwk68ruTzIgUpzxiWRVbUytP49wgZgcf2ID+qT c0C/pZJwOqaKvt2eYDxHUnhQ5gCa3H/xkqZsus/i4SkBBOf2hYd8BjjzsbLM2e515yYT /A6ns1XsQvra/0q81G8FLgTguLz3+l8uVNUhk/9BZuvHubzKRfmFXvs9PYlHLE+ImkSj TqabwOil/m6A73vXGeZRU4QnPppZH4VoUybxyaliaYEOf0DtzB8ZeIWHiFPmv+Bm4WdY CP+A6WUT3ux1GmiHdK8hSWYBeqg12CRuJLx1NZYFLtEsHmkpNrbjx4HlUJTwZLc+6w7v ZLTg== X-Gm-Message-State: APjAAAVxM+9yMXARZ9EN0q7VFjPXbac9P2PJTfawGvF2VKjdSmHk6u0y Raz4I1ofhVbH9WqfvExsEm3GTfGOk8RB8JhxNMo= X-Google-Smtp-Source: APXvYqy35tqiISC6lhct8gMW54heH0sndBTeJ4WtgJm/bA4IMfB9SHyWtziHCh4jVus8+qGdkVgsGdVPaMQmBM4kK7U= X-Received: by 2002:a1f:a592:: with SMTP id o140mr15315422vke.30.1572987792902; Tue, 05 Nov 2019 13:03:12 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Daniel Migault Date: Tue, 5 Nov 2019 16:03:01 -0500 Message-ID: To: Cigdem Sengul Cc: Daniel Migault , Ace Wg Content-Type: multipart/alternative; boundary="000000000000a1cf7605969fc211" Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Nov 2019 21:03:16 -0000 --000000000000a1cf7605969fc211 Content-Type: text/plain; charset="UTF-8" Thanks for the feed back, please find the current agneda below: https://datatracker.ietf.org/doc/agenda-106-ace/ Yours, Daniel On Tue, Nov 5, 2019 at 6:38 AM Cigdem Sengul wrote: > Hello Jim and Daniel, > > I would like 10 minutes in the agenda to present the updates we made to > the: > https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ > > I will be presenting remotely. > > Thanks, > --Cigdem > > On Thu, Oct 31, 2019 at 6:27 PM Daniel Migault 40ericsson..com@dmarc.ietf.org <40ericsson.com@dmarc.ietf.org>> wrote: > >> Hi, >> >> >> >> The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 . >> Please let us know if there are topic you would like to present by >> Wednesday November 6. Slides are expected to be uploaded by Sunday >> November 17. >> >> >> >> Please remember the draft deadline is Monday November 4 >> >> https://datatracker.ietf.org/meeting/106/important-dates/ >> >> >> >> Yours, >> >> Jim and Daniel >> >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >> > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000a1cf7605969fc211 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the feed back, please find the current agn= eda below:

https://datatracker.ietf.org/doc/agenda-106-ace/

Yours,=C2=A0
Daniel

On Tue, Nov 5, 2019 = at 6:38 AM Cigdem Sengul <cig= dem.sengul@gmail.com> wrote:
Hello Jim and Daniel,=C2=A0

I would like 10 minutes in the agenda to present the updates we ma= de to the:=C2=A0

I will be presenting remotely.=C2=A0

=
Thanks,
--Cigdem=C2=A0

On Thu, Oct 31, 2019 at 6:27 PM = Daniel Migault <daniel.migault=3D40ericsson..com@dmarc.ietf.org> wrote:

Hi,

=C2=A0

The ACE WG is meeting at the IETF 106 Tuesday Novemb= er 19 15:20-16:50 . Please let us know if there are topic you would like to= present by Wednesday November 6. Slides are expected to be uploaded by =C2= =A0Sunday November 17.

=C2=A0

Please remember the draft deadline is Monday Novembe= r 4

https://datatracker.ietf.org/meeting/10= 6/important-dates/

=C2=A0

Yours,

Jim and Daniel

=C2=A0

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--000000000000a1cf7605969fc211-- From nobody Tue Nov 5 23:24:52 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37C13120BC9 for ; Tue, 5 Nov 2019 23:24:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NyzOO6mb4K6f for ; Tue, 5 Nov 2019 23:24:48 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150059.outbound.protection.outlook.com [40.107.15.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE197120B96 for ; Tue, 5 Nov 2019 23:24:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BMzsxqt8kkgI1OKOwIw+a1oLohzzVAJML73/hUw60omeMBwqdSVdybie1RkE5IZLQY6xbHy4NZ0avb4rx4266cy/uPUS+v+Hf77BgbF8MpCFDT1P3gXSA2hW4nvecz/CMphFfJlco3/KJOlySTum/Y/BLMcW3+xtdPUm6n7CUkQHEkFKQC/wVAW81ULYv5kMzMvaRPOC3C6mkoYhXjqOgDEwpc8VeoGBNUqhn9DKoa5EUlZU7w3ybvXK3GSTFPVRhMAE+6zTYVpFtr4RIg53RlVeH0oDbRMySfzbeZqPfj//VgnbkbEXclk3UCa9b9RrViBzPrvr4fRniRtrrfxjNQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C1GFL49A1Zw/HZ4WWddo0nssuUlMKdYuM5IJt742JoE=; b=lEoIkKs7EVRR7X9QawGOCwWvRd6SMDPLBimaBTmZkGN2yigOrk8bhH/CGbasQSoGdb6NiFC4v72tkbR9JejXy8EQPU8DWXxzHcQA3nA2BU1gsKSJCiEMlPLta9cKxAJYtgsNfcdiXOWRzbXU3OhGv00SZxcHMnQy2u9JpO9eMeldHErgBe4cegw5tzPRzSiY9WSHXeb+xfS0Pn1xZOiR66CzJ+VRMkjuc2PJnOW1DzLkXgju0LpA9rbVQ45SnMAW23qhlnpRcYQ0PNK4/1MvV7P3UVN5ykcDK5JxEGy0KfPpxa/Y//QxPSjOOE4Nr8b2QU6rDtoZvDG3mwGZ0xkeJg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C1GFL49A1Zw/HZ4WWddo0nssuUlMKdYuM5IJt742JoE=; b=L3ifAqEeOHVi6XJnCeWWmrYuJe2jc2VDZSXJxDCjTlPJ0PYq7NFAyKXRECgsnsE8Gcp2xQPrmi/6lJAISdiwzZlhQh8/0FGIwMePbHc7TfwROcJC0y82FgZr07uRS+4svydMNjCmsGqwj/CpRjsGV5PuVOkYDtGb1ipfzVQgwRg= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB3455.eurprd07.prod.outlook.com (10.175.244.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.16; Wed, 6 Nov 2019 07:24:45 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.017; Wed, 6 Nov 2019 07:24:45 +0000 From: Francesca Palombini To: Daniel Migault CC: Ace Wg Thread-Topic: [Ace] ACE@IETF106 - agenda items and presentations Thread-Index: AdWQGMJ3Gb/LqHncSJGCsrwsE1w84QDtMgcAABO3eYAAF88sgA== Date: Wed, 6 Nov 2019 07:24:45 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ee90cfce-bca8-484b-b457-08d7628a6640 x-ms-traffictypediagnostic: VI1PR07MB3455: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(396003)(346002)(366004)(39860400002)(376002)(189003)(199004)(51914003)(476003)(25786009)(102836004)(186003)(33656002)(6246003)(66446008)(6486002)(64756008)(66556008)(229853002)(6436002)(91956017)(2906002)(4326008)(478600001)(236005)(36756003)(6512007)(54896002)(6306002)(14444005)(66476007)(71190400001)(256004)(71200400001)(66946007)(3846002)(6116002)(81156014)(606006)(99286004)(9326002)(486006)(76116006)(14454004)(26005)(966005)(316002)(66066001)(8936002)(53546011)(6506007)(76176011)(44832011)(446003)(7736002)(2616005)(86362001)(8676002)(5660300002)(81166006)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB3455; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zGLo1lUbSDs8FTv48CjYLxlxGsDzx53bDha0yrwDxjvyXfkkUrjcoi9U0ulWyzvGFIBcWwDvz9I4lUkOW0DSpokcai6G08/Sa8uiXZNqO793VGNXYEv45kxBOyIzBF/ZcsBv6xkagpLN4XtebQLzloBlUfa0QElKbATF80wc8xUqRk/0KKbH+8bDTvWb49epxHoK+wSLoHLyxGiMcHPKC6bqWg/U2gfuqSt2b3mvD3XZZiq4GhyJ/3wZ2tIEuBvPKMQ6dM/o5HzD7oRv6MkXirJwq+o9p6RYo4foPZNUyGEViDZ2rT87y1bshU9m2yPX1WhgKhVLO7flv/PKbbDlkyiTAYVe0/IpjNeCXSX323WX8kTJLlKq1kWWgFi1Hnt2FaHuTmKgK51/sm0elIZKueUgpmcQ/OOcWiMdYP0QwQIcsbmlpYN4TrDCJMNL3qlhg2QyEx3kgIWltINoIRW/8DKx5HcX8skyZCrLk5FmIuU= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_EA90073266464864B8AAC0E879619792ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: ee90cfce-bca8-484b-b457-08d7628a6640 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 07:24:45.6010 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ZMPvW68JtqiMjGwa9P4qbuKmqOXv0vn9yUJlGfhFL4qDK+UJP25ksEuD6CO9iJ6E+o9H4BvokMc9vRsvby87LgDETZIPFjWk9fJEXgOAnWY/izSmY84C3wfGPhZyU6UV X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB3455 Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 07:24:50 -0000 --_000_EA90073266464864B8AAC0E879619792ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGFuaWVsLA0KDQpZb3UgbWlzc2VkIG15IHJlcXVlc3QgdG8gcHJlc2VudCBhY2Uta2V5LWdy b3VwY29tbSBhbmQgY29hcC1wdWJzdWItcHJvZmlsZS4gSeKAmWQgbmVlZCAxNSBtaW51dGVzIGZv ciB0aGUgZmlyc3QgYW5kIDEwIGZvciB0aGUgc2Vjb25kLg0KDQpUaGFua3MsDQpGcmFuY2VzY2EN Cg0KRnJvbTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIERhbmllbCBN aWdhdWx0IDxkYW5pZWwubWlnYXVsdD00MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZz4NCkRh dGU6IFR1ZXNkYXksIDUgTm92ZW1iZXIgMjAxOSBhdCAyMjowMw0KVG86IENpZ2RlbSBTZW5ndWwg PGNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPg0KQ2M6IEFjZSBXZyA8YWNlQGlldGYub3JnPiwgRGFu aWVsIE1pZ2F1bHQgPGRhbmllbC5taWdhdWx0PTQwZXJpY3Nzb24uY29tQGRtYXJjLmlldGYub3Jn Pg0KU3ViamVjdDogUmU6IFtBY2VdIEFDRUBJRVRGMTA2IC0gYWdlbmRhIGl0ZW1zIGFuZCBwcmVz ZW50YXRpb25zDQoNClRoYW5rcyBmb3IgdGhlIGZlZWQgYmFjaywgcGxlYXNlIGZpbmQgdGhlIGN1 cnJlbnQgYWduZWRhIGJlbG93Og0KDQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9h Z2VuZGEtMTA2LWFjZS8NCg0KWW91cnMsDQpEYW5pZWwNCg0KT24gVHVlLCBOb3YgNSwgMjAxOSBh dCA2OjM4IEFNIENpZ2RlbSBTZW5ndWwgPGNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPG1haWx0bzpj aWdkZW0uc2VuZ3VsQGdtYWlsLmNvbT4+IHdyb3RlOg0KSGVsbG8gSmltIGFuZCBEYW5pZWwsDQoN Ckkgd291bGQgbGlrZSAxMCBtaW51dGVzIGluIHRoZSBhZ2VuZGEgdG8gcHJlc2VudCB0aGUgdXBk YXRlcyB3ZSBtYWRlIHRvIHRoZToNCiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9k cmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxlLw0KDQpJIHdpbGwgYmUgcHJlc2VudGluZyBy ZW1vdGVseS4NCg0KVGhhbmtzLA0KLS1DaWdkZW0NCg0KT24gVGh1LCBPY3QgMzEsIDIwMTkgYXQg NjoyNyBQTSBEYW5pZWwgTWlnYXVsdCA8ZGFuaWVsLm1pZ2F1bHQ9NDBlcmljc3Nvbi4uY29tQGRt YXJjLmlldGYub3JnPG1haWx0bzo0MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZz4+IHdyb3Rl Og0KSGksDQoNClRoZSBBQ0UgV0cgaXMgbWVldGluZyBhdCB0aGUgSUVURiAxMDYgVHVlc2RheSBO b3ZlbWJlciAxOSAxNToyMC0xNjo1MCAuIFBsZWFzZSBsZXQgdXMga25vdyBpZiB0aGVyZSBhcmUg dG9waWMgeW91IHdvdWxkIGxpa2UgdG8gcHJlc2VudCBieSBXZWRuZXNkYXkgTm92ZW1iZXIgNi4g U2xpZGVzIGFyZSBleHBlY3RlZCB0byBiZSB1cGxvYWRlZCBieSAgU3VuZGF5IE5vdmVtYmVyIDE3 Lg0KDQpQbGVhc2UgcmVtZW1iZXIgdGhlIGRyYWZ0IGRlYWRsaW5lIGlzIE1vbmRheSBOb3ZlbWJl ciA0DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTA2L2ltcG9ydGFudC1k YXRlcy8NCg0KWW91cnMsDQpKaW0gYW5kIERhbmllbA0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGlldGYub3Jn PG1haWx0bzpBY2VAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2FjZQ0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N CkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg== --_000_EA90073266464864B8AAC0E879619792ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <9F2DACC159726341BE1AAB8FA8E2213D@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIu MHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PkhpIERhbmllbCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+WW91IG1pc3NlZCBteSByZXF1ZXN0IHRvIHByZXNlbnQgYWNlLWtl eS1ncm91cGNvbW0gYW5kIGNvYXAtcHVic3ViLXByb2ZpbGUuIEnigJlkIG5lZWQgMTUgbWludXRl cyBmb3IgdGhlIGZpcnN0IGFuZCAxMCBmb3IgdGhlIHNlY29uZC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+VGhhbmtzLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t ZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+RnJhbmNlc2NhPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+QWNlICZsdDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVo YWxmIG9mIERhbmllbCBNaWdhdWx0ICZsdDtkYW5pZWwubWlnYXVsdD00MGVyaWNzc29uLmNvbUBk bWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgNSBOb3ZlbWJlciAy MDE5IGF0IDIyOjAzPGJyPg0KPGI+VG86IDwvYj5DaWdkZW0gU2VuZ3VsICZsdDtjaWdkZW0uc2Vu Z3VsQGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzogPC9iPkFjZSBXZyAmbHQ7YWNlQGlldGYub3Jn Jmd0OywgRGFuaWVsIE1pZ2F1bHQgJmx0O2RhbmllbC5taWdhdWx0PTQwZXJpY3Nzb24uY29tQGRt YXJjLmlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0FjZV0gQUNFQElFVEYx MDYgLSBhZ2VuZGEgaXRlbXMgYW5kIHByZXNlbnRhdGlvbnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgZm9y IHRoZSBmZWVkIGJhY2ssIHBsZWFzZSBmaW5kIHRoZSBjdXJyZW50IGFnbmVkYSBiZWxvdzo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9hZ2VuZGEtMTA2LWFjZS8iPmh0dHBzOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2FnZW5kYS0xMDYtYWNlLzwvYT48bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllvdXJzLCZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGFuaWVsPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgTm92IDUs IDIwMTkgYXQgNjozOCBBTSBDaWdkZW0gU2VuZ3VsICZsdDs8YSBocmVmPSJtYWlsdG86Y2lnZGVt LnNlbmd1bEBnbWFpbC5jb20iPmNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SGVsbG8gSmltIGFuZCBEYW5pZWwsJm5ic3A7IDxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3b3VsZCBsaWtlIDEwIG1pbnV0ZXMgaW4gdGhl IGFnZW5kYSB0byBwcmVzZW50IHRoZSB1cGRhdGVzIHdlIG1hZGUgdG8gdGhlOiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PGEg aHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1hY2UtbXF0 dC10bHMtcHJvZmlsZS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxlLzwvYT48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3aWxsIGJlIHByZXNl bnRpbmcgcmVtb3RlbHkuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tQ2lnZGVtJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFRodSwgT2N0IDMxLCAyMDE5IGF0 IDY6MjcgUE0gRGFuaWVsIE1pZ2F1bHQgJmx0O2RhbmllbC5taWdhdWx0PTxhIGhyZWY9Im1haWx0 bzo0MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwZXJpY3Nz b24uLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIGxhbmc9IkVOLVVTIj5IaSwNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBBQ0UgV0cg aXMgbWVldGluZyBhdCB0aGUgSUVURiAxMDYgVHVlc2RheSBOb3ZlbWJlciAxOSAxNToyMC0xNjo1 MCAuIFBsZWFzZSBsZXQgdXMga25vdyBpZiB0aGVyZSBhcmUgdG9waWMgeW91IHdvdWxkIGxpa2Ug dG8gcHJlc2VudCBieSBXZWRuZXNkYXkgTm92ZW1iZXINCiA2LiBTbGlkZXMgYXJlIGV4cGVjdGVk IHRvIGJlIHVwbG9hZGVkIGJ5ICZuYnNwO1N1bmRheSBOb3ZlbWJlciAxNy4gPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBs YW5nPSJFTi1VUyI+UGxlYXNlIHJlbWVtYmVyIHRoZSBkcmFmdCBkZWFkbGluZSBpcyBNb25kYXkg Tm92ZW1iZXIgNDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gbGFuZz0iRU4tVVMiPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcv bWVldGluZy8xMDYvaW1wb3J0YW50LWRhdGVzLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDYvaW1wb3J0YW50LWRhdGVzLzwvYT48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIGxhbmc9IkVOLVVTIj5Zb3VycywNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPkppbSBhbmQgRGFuaWVsPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f PGJyPg0KQWNlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBY2VAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwvcD4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpBY2UgbWFpbGluZyBsaXN0PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRm Lm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2FjZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_EA90073266464864B8AAC0E879619792ericssoncom_-- From nobody Wed Nov 6 04:43:23 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02239120886; Wed, 6 Nov 2019 04:43:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oNSJZlIyVFFd; Wed, 6 Nov 2019 04:43:16 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30055.outbound.protection.outlook.com [40.107.3.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB0A112087E; Wed, 6 Nov 2019 04:43:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Zh028JMtQBTmwedthZnc8C+uHwxmACE9l1QbdROR6BKN+ZEJweeETeWH7B3x+tKWX3kvWsukZiSiVLs6m6+xatjATsDbAAlD24XpcIS8orODjTpIs2pUxL2kUg+9XPBSjnIl31cqjzyKeh4BPgHTJVK+zOS617nuprZzfoW7D5zd4mZJPVl96lYiBP74Y2EO2JTc6fsDuH4AXFA4d1E8Ia5NVTLqHpU3wGFuT23ZzWTkb2Eal5hDR7+d9WQ14tyNKXi9E0EVQR3joUP5lY/2oFSN8DRCcmZoWJHuEo2n6fZPRGvmY4FeRrtN5SA/NL+9jtokItrYqwQZmLAhNPXZLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/YulaD9IlwYrrYTGqdzntTUZlcX/zizUnSUzpeeL6BI=; b=S4oQNQh+dhfi1HJTAayXyTGMKcTLjnETTfJWNxw6BU52xzaNxbJ/eTH8FprMgB5dTtD0sqAxSF0pjLiHYmc8o0Hx1bT0JWmcebVvsHphJcXc4sNSjEWaE1tw58Kbs0dCdsfQ9NO7DBjYBN4lvHTYH7+zaxQ0nAUdRrKnOr4RMAX4Vt4bq0wv+cN4kPwdWeDlmJr1S9IE3Ax1hySuE1cTi91NbOaikBiSH1WGoIJWBECZZAn3nRq2NbocNu6MRi6Bj8Oy4g+vMDu1xaNJSGa74rmZocSPQ9YUhWY5ezEhz8PauBq5hvH6W8m6UJ2FKJTiKxcVg+Uqi3ns/32mzUPylQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/YulaD9IlwYrrYTGqdzntTUZlcX/zizUnSUzpeeL6BI=; b=cQUYWlkcNrGAux1oMM9Wuv79J8OZrOwHFGmIUUFN26AxVXlCw43kDSbbJhKukk6EORrofHOTcKYpXZoY+Bpy2pF5HDjj2w+X25vGRsMty4DqHBiwpDagkuFcN1qucVoKHqSOqbIK02t+0tLrVAGQqhJJCFj7vbQfzcrNpYvA+HA= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB3071.eurprd07.prod.outlook.com (10.170.239.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.16; Wed, 6 Nov 2019 12:43:10 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.017; Wed, 6 Nov 2019 12:43:10 +0000 From: Francesca Palombini To: Ludwig Seitz , "ace@ietf.org" CC: "draft-ietf-ace-key-groupcomm@ietf.org" Thread-Topic: Review of draft-ietf-ace-key-groupcomm Thread-Index: AQHVPiQplIgMsLYvtU2keDvcPHncYad+0/eA Date: Wed, 6 Nov 2019 12:43:10 +0000 Message-ID: <7803195E-C22B-4EDE-BA68-A247E1D7A65D@ericsson.com> References: <7000332e-9853-fcc5-c98f-b2d8f2fb4060@ri.se> In-Reply-To: <7000332e-9853-fcc5-c98f-b2d8f2fb4060@ri.se> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ab9a57b3-783c-4a7b-d867-08d762b6e190 x-ms-traffictypediagnostic: VI1PR07MB3071: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(376002)(396003)(39860400002)(366004)(136003)(189003)(199004)(6116002)(6486002)(76116006)(2616005)(3846002)(2906002)(11346002)(446003)(6246003)(102836004)(6512007)(71190400001)(26005)(66946007)(99936001)(186003)(66066001)(14444005)(256004)(305945005)(33656002)(7736002)(229853002)(476003)(6436002)(486006)(44832011)(66616009)(91956017)(110136005)(316002)(66476007)(71200400001)(86362001)(8676002)(14454004)(36756003)(81156014)(8936002)(6506007)(2501003)(5660300002)(81166006)(25786009)(4326008)(99286004)(66446008)(478600001)(66556008)(64756008)(76176011); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB3071; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zSZe1VCtNXuZwgaS0QhnfiiFEc92dywlSow2Be+pNjo2d1VwniRoRZCrLEKwN3lbdEj1eUoYHob8O2YO5RUqb9Y0METKiXh+nqPYCPAdmgQMnLurrCTDr4yNGEpeqLlTepuOaHkreBIdmAblHo5L8fhZN68XPcP23gSvEI8HMi+C1uCz292Zm9etNTHNHHYxKa/zIdxi9rPQ4yT3JVRxyQWuZd1VTOS8xucnsxsnpATvYN/4osCk+eNRnsMsNzzlidicVMmGtHRjGlso4QrFtJwusGvpQtw1Y0hKuMwz6w5CuOGttZcDGZ5s7KgrYZuOnhI06qKMmxUlkttyd08lh6Es/BiKgqiWZ0Iuw/DJjFgQFRjyc9sem3G7WcGzRrA3HzDAma8dPVI36/JHUow6gRuHy4wYCSeZabyWsq3Htf6SlPtyioiP31j/HxE5gG7X x-ms-exchange-transport-forked: True Content-type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3655892589_1852886273" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: ab9a57b3-783c-4a7b-d867-08d762b6e190 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 12:43:10.2651 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: gCVDhu1RXNLsCVevH3drYehSugQEVrTJKdJUnuRrPRXTI5rmNc01/6Gz1QdM+LdZFS+VBelE+5HYMiksne1XFlnIy1qSzq2CAWxfpATZVar4XYcVQmS/hOc4YF85FAzI X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB3071 Archived-At: Subject: Re: [Ace] Review of draft-ietf-ace-key-groupcomm X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 12:43:19 -0000 --B_3655892589_1852886273 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Ludwig, Thank you so much for your detailed review! We have addressed your comments= in the -03 update submitted. It might be a bit hard to see from the diff, a= s we also made a restructuring based on comments at IETF105, but I answer to= detailed comments inline. Thanks again, Francesca =EF=BB=BFOn 19/07/2019, 13:21, "Ludwig Seitz" wrote: Hello Francesca, Marco, =20 I have finally managed to read the whole of draft-ietf-ace-key-groupcom= m=20 and have a few comments for you: =20 =20 Figure 2: I suggest you move the "Defined in ..." to the left they way it is now, it looks as if the Dispatcher was defined in the AC= E=20 framework. FP: Ok, done. =20 =3D=3D "3.1. MUST contain ... 'grant_type'" =20 This is no longer true. Grant_type was made optional in one of the=20 latest updates of the ACE framework. When it is absent,=20 grant_type=3Dclient_credentials is assumed as default. FP: Ah, we had missed this, thanks for pointing that out! So fixed as you s= uggest. =20 =3D=3D 3.3 "... and includes the following parameters: " =20 How is that supposed to work? The framework defines sending of the toke= n=20 to /authz-info as a CoAP POST, where the payload is the bytes of the=20 token. In order to include additional parameters you would have to=20 redefine this payload to be a CBOR map (as the OSCORE profile does). FP: We do specify the content-format to be ace+cbor in that case, now we ha= ve clarified that the payload is a CBOR Map, containing token plus those par= ameters. =20 =3D=3D The whole section 3 talks about parameters send back and forth between=20 the client and the KDC without defining how these are carried. It seems= =20 to be implied that there are CBOR maps in the payload, but that should=20 be made explicit, especially where it differs from what the framework=20 defines. =20 FP: Yes, we have now clarified that. =3D=3D 3.1 the text about the parameters in the client's post to the=20 /authz-info endpoint at the KDC talks about parameters "sign_info" and=20 "pub_key_enc" and claims they are specified in 3.3.1 and 3.3.2, but=20 these sections specify the parameters for the "AS request creation=20 hints" messages and not in this context. At least some clarification=20 should be added. =20 FP: Ok, we have now added some text about that at the end of sections 3.3.1= and 3.3.2. =3D=3D Section 4 =20 "If not previously established, the Client and the KDC MUST first establish a pairwise secure communication channel using ACE." =20 This sentence is not strictly correct. Using what part of ACE? The ACE=20 framework just says that you should establish a secure communication=20 channel, it's the specific profiles that define how these channels are=20 established. Please add some clarification. =20 FP: Note that this text is now moved to section 4.2. We have clarified by r= eplacing with the 2 following sentences:=20 " If not previously established, the Client and the KDC MUST first establish a pairwise secure communication channel (REQ15). This can be achieved, for instance, by using a transport profile of ACE." =3D=3D =20 "The Client and the KDC MAY use that same secure channel to protect=20 further pairwise communications, that MUST be secured." =20 This is very questionable use of requirements language. How do I claim=20 or test conformance with the second MUST? =20 FP: Right. We have rephrased. The MUST was not supposed to be normative " The Client and the KDC MAY use that same secure channel to protect further pairwise communications that must be secured." =3D=3D Section 4: "The same set of message ..." should be "messages" FP: Ok, this text actually disappeared with the restructuring. =20 =3D=3D " Note that proof-of-possession to bind the access token to the Client is performed by using the proof-of-possession key bound to the acce= ss token for establishing secure communication between the Client and the KDC." =20 This may or may not be true for a specific secure communication protoco= l (e.g. think of DTLS with X.509 certificates without client=20 authentication). You need to require this from the underlying secure=20 communication protocol. FP: Thanks for pointing this out. We replaced the previous text with the fo= llowing: " The secure communication protocol is REQUIRED to establish the secure channel by using the proof-of-possession key bound to the access token. As a result, the proof-of-possession to bind the access token to the Client is performed by using the proof-of-possession key bound to the access token for establishing secure communication between the Client and the KDC." =20 =3D=3D 4.1 "The endpoint in the KDC is associated to the 'scope' value of the=20 Authorization Request/Response." =20 Associated how? This is too unspecific to lead to interoperable=20 implementations. I would like to see this association specified in deta= il. =20 FP: This text disappeared with the restructuring. Now we do give "default" = names for the endpoints at the KDC, similar to how ACE does it. =3D=3D 4.2 "as defined in the "ACE Groupcomm Key" registry, defined in Section= =20 11.5." =20 If possible, rephrase this to avoid the double use of "defined". FP: Ok, done. =20 =3D=3D 5.2 =20 "If the leaving node wants to be part of a group with fewer roles, it=20 does not need to communicate that to the KDC, and can simply stop actin= g=20 according to such roles." =20 There are legitimate cases where a node might want to explicitly=20 deactivate roles it is currently using (principle of least priviledge)=20 and not just stop using them. =20 FP: I will answer to this comment in a separate mail, to include Jim's poin= t. =3D=3D 6. "Then, if it wants to continue participating in the group communication, the node has to request new updated keying material = to the KDC." =20 should be "... keying material from the KDC." FP: Ok, fixed. =20 =3D=3D Sections 8. and 9. =20 Would be nice if there also were back-references to where those=20 parameters are defined in the draft. =20 FP: Now added. =20 /Ludwig =20 =20 --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 =20 =20 --B_3655892589_1852886273 Content-type: application/pkcs7-signature; name="smime.p7s" Content-transfer-encoding: base64 Content-disposition: attachment; filename="smime.p7s" MIIIPAYJKoZIhvcNAQcCoIIILTCCCCkCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgggYQMIIGDDCCA/SgAwIBAgIPAWPOv1KwaXNRKN9vQImWMA0GCSqGSIb3DQEBCwUAMEcx CzAJBgNVBAYTAlNFMREwDwYDVQQKDAhFcmljc3NvbjElMCMGA1UEAwwcRXJpY3Nzb24gTkwg SW5kaXZpZHVhbCBDQSB2MzAeFw0xODA2MDUwNzAwMzRaFw0yMTA2MDUwNzAwMzNaMHQxETAP BgNVBAoMCEVyaWNzc29uMRwwGgYDVQQDDBNGcmFuY2VzY2EgUGFsb21iaW5pMRAwDgYDVQQF EwdlZnJhcGFsMS8wLQYJKoZIhvcNAQkBFiBmcmFuY2VzY2EucGFsb21iaW5pQGVyaWNzc29u LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIvXieH2mfDGc7Qhz/Y+3oQs IHZmUO+OJ1jHM17m5TL/dpceKcbzPAzNzgdGgg4L10OMIKjS/UMQWmwa6LouXnZDIOzF7blW 8GoRKapGbc7koepzpJnOYAtFM8ctUiCSlii4PxkncrMrv47MuukmEJS7qpcnRPDTCdvshjzk hSigViTqh9KwSJEY+LAoC63tX1UoWY1TaaCGt3c/keYlGr8nD0Tsl80gZgOLfn8Yp9vXBVGj uxX8qsn+svIZOhLgAI66TapRgsUpGIsDpR9d/acvgPEdh96bNjeNR8vbwmSkbabDGzoBQwyf 4xEJTB8qe5urae/u4+wQhxyluepbdjECAwEAAaOCAcYwggHCMB8GA1UdIwQYMBaAFBx7GZ6X nHasID3Y3OORauPbLaZTMB0GA1UdDgQWBBTc3cwfOtVWns1ngPlcXYQoK0CZWzAOBgNVHQ8B Af8EBAMCBaAwVQYDVR0gBE4wTDBKBgwrBgEEAYIPAgMBARIwOjA4BggrBgEFBQcCARYsaHR0 cHM6Ly9yZXBvc2l0b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS9DUFMwKwYDVR0RBCQwIoEg ZnJhbmNlc2NhLnBhbG9tYmluaUBlcmljc3Nvbi5jb20wSAYDVR0fBEEwPzA9oDugOYY3aHR0 cDovL2NybC50cnVzdC50ZWxpYS5jb20vZXJpY3Nzb25ubGluZGl2aWR1YWxjYXYzLmNybDAd BgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwgYIGCCsGAQUFBwEBBHYwdDAoBggrBgEF BQcwAYYcaHR0cDovL29jc3AyLnRydXN0LnRlbGlhLmNvbTBIBggrBgEFBQcwAoY8aHR0cDov L2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS9lcmljc3Nvbm5saW5kaXZpZHVhbGNhdjMuY2Vy MA0GCSqGSIb3DQEBCwUAA4ICAQAv3Y5l9KSKEnFiwOZUkvaZ79M4aOawQOw8aTXhNft0sLBc Hm0MKAUQT4HDeeqKaPawTz4a2JNXC+r0ccPMpcTQ2Ro4SvinpKjv552Fzszq7InFYDOnFW1O 49ePOdlggrVqsQM2hmRwK6OFsu2n6Qrk+jb26BAGC1EBMrTZDokRIPYbIrBhSp6/tHbeFXoN Xzpm/YBDeWS4mDnqgPPlAXFdehaRxLJEad31fFk+W49fMszAp4L6qB65Oe9Ki4KlGMTpz8y6 +2eNvMPeA07h5+KUTtQQ5KPC2OCzeh+Z1odEVnRrCzXNfTzS1QchTf51s4CmwQ/6WmL6g2z7 tKVytxAiivm7T3loR2nX/zJE257gwzqsHnUQzVmh9QViKKvqVOO7+FGTB3ue/gQT/j12Dpe2 V19Bpz+XHnbA079YCPrc9B9NEY93prIT85W6ba+kd4PBaqrzuIQ4GGabFNzzTQduiJebUDzN EF4INluZyzBJozH10mSDTvnw0OksmJeGQgItD6nvSQbCwF7rCbG6xLxipcLzfZ2pgRAYL+TP mkECbEY1Xp+VbePSkWW98/aMlM79Ivkva4pmq4nCUttiX4R5UpL6Aab2cHNkJuyXaYhE2c4O 4hyxi50GgB/3iwoclE9QTNvTG/O0GNOzrWhAI4xCK081LmFLqqPTeYhE7yI5RDGCAfAwggHs AgEBMFowRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmlj c3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAg8BY86/UrBpc1Eo329AiZYwDQYJYIZIAWUDBAIB BQCgaTAvBgkqhkiG9w0BCQQxIgQgsL65PqzY3FnM/kTbo8bvmUFbsCByGmeA/opitPBJa+Iw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkxMTA2MTI0MzA5 WjANBgkqhkiG9w0BAQEFAASCAQBAzAapdviIJQUJxiJqPZyNh+Aqi2f4EW4RhjC3CTt84Vxv TtMCAXtjGyhVGVI4aKW1PkE5PRqaVL6F2P07nPvWLiwBxyDKljio5kw3Izyw1CcfJWEavgGd 8UNdda8YChv0FrJ3LRIQtZROFC04PVhver+1TKrDDDuDn7/JCgtJQ/g6tufw72lCRzmrHnoZ 7JN5jSNwb5eixdI3W4elkckKvBPkF4q90zMDgcQeGoRBk7BNi0T3xL0E8HkKVUyb+JFeDlsh aiQ0xsNnMcl4hospGJG5Kw2zs5l/97dbCicCDd2jsEYYt6v01wjwU6VNyIa2wThnuFm0UnXv QByqaIz0 --B_3655892589_1852886273-- From nobody Wed Nov 6 04:49:53 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14B9212088B; Wed, 6 Nov 2019 04:49:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ebk3E7sdnRdN; Wed, 6 Nov 2019 04:49:48 -0800 (PST) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10045.outbound.protection.outlook.com [40.107.1.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDB36120888; Wed, 6 Nov 2019 04:49:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jQ+crIij59/ji3U8KiJgRtT8gin+v84a3/5YYmCsk1jl+tSdFtyr6Aj4aG4qe0n1jtTRAWFRMN4AvnpJqA1hwnALo/HcjLj1Jnk0EPgd51q2ZBEpavvxGaZc6Xi88QmCXsAbkR5RUBMhlmZHuKI1YgUwaBj6BpW+NpjFun9iwLCUNLRKG/xTmu49JBC0ukee2kRFm+sni02WSr1EMLCsFgUnZKQY/5aIml9/5e3WKKfQf8Ong9a2m75Tg1sG7a7HZdORXamLv4s00hGgdLEr07KAF1ISka5jm1XcLpivDZxxdT6LdOFVJjk9D/t9cxm8CPFAhDCumXyBo8DKkw83YQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g8SMFmuT/9eFU3DG0WXBB6FQdscB6hzVpgyUwRvYORs=; b=AaIyvDykI3iNa4ZB2m7uuCUjbFYtXsJw9X0izVYklBgWO1uikRTrt7Ai3O23EPj2TR78G0iipw5Z5rUsY4/ckiscDndfzHel7oZonxSSQI9EkSykdFeUIi8VILPjXyXdwHAX5IwZpBBdQTHtvVs6VvNFX8IYFBrRUl2OJ3Xuua434XIAtxox1dlv6L6Z5jr1IbGeFupj5bOHd1nmG8LDMalXra4SIQ/KWC3Nwh3WFuE5+cuPsyHBIIaYkMgu22I3W8IhlMoiotsYZmG/O2KOo9ovLG+JUG6oU+muCETBb8qXjpIGvoor4I1/sWnVZyDAEUnUjJDO7iIbh8CAPg7OwA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g8SMFmuT/9eFU3DG0WXBB6FQdscB6hzVpgyUwRvYORs=; b=BKImzeYgA+julTt2MijKxZnKCuVh8yfKpNcIticKCunakQyGaYVRvAOvdNvrOXqDuuWFmCk9I8ZoISoJqHoHybO9WthvCk1utDQBrIQc58BZEPsiUVqqIF5E01XD4AwAXWyGUe6C7SfWJ+banF6lN0gS/Y1bipWpL+mtQsaBs5E= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB6157.eurprd07.prod.outlook.com (20.178.120.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.13; Wed, 6 Nov 2019 12:49:44 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.017; Wed, 6 Nov 2019 12:49:44 +0000 From: Francesca Palombini To: Jim Schaad , 'Ludwig Seitz' , "ace@ietf.org" CC: "draft-ietf-ace-key-groupcomm@ietf.org" Thread-Topic: [Ace] Review of draft-ietf-ace-key-groupcomm Thread-Index: AQHVPiQplIgMsLYvtU2keDvcPHncYabYL4uAgKamQoA= Date: Wed, 6 Nov 2019 12:49:44 +0000 Message-ID: <9F48C1A6-5F79-411D-AB1F-11FDB891EEBF@ericsson.com> References: <7000332e-9853-fcc5-c98f-b2d8f2fb4060@ri.se> <01aa01d54155$eef81900$cce84b00$@augustcellars.com> In-Reply-To: <01aa01d54155$eef81900$cce84b00$@augustcellars.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2ecebc36-37a8-405e-8a05-08d762b7cc50 x-ms-traffictypediagnostic: VI1PR07MB6157: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(366004)(39860400002)(376002)(136003)(346002)(199004)(189003)(13464003)(478600001)(66066001)(966005)(71190400001)(71200400001)(86362001)(14454004)(26005)(6512007)(6306002)(476003)(186003)(4326008)(2616005)(5660300002)(25786009)(2501003)(64756008)(66946007)(91956017)(76116006)(66556008)(66476007)(66446008)(2906002)(305945005)(7736002)(81166006)(6116002)(3846002)(6486002)(36756003)(6436002)(11346002)(446003)(44832011)(8936002)(486006)(8676002)(110136005)(33656002)(102836004)(6246003)(99286004)(6506007)(53546011)(316002)(14444005)(81156014)(76176011)(256004)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB6157; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: gK0DLRpW6iaBHm/roMoNyBRsSW6GYyrw/V7mqT4CQVn28l8XhJataYc1oxYfpv68Mb4Td+OH2XPI+IAnFRvqlGBm0qPjpEB+m8xU7dVy5lD9aIanrTl41PS+TLvNQVaM735H1A0CcFjVamHNMzmPy9HECeAGUi5DMRygyChi/1iriZymTYbJXyM8JO4zBmDMPQjjJ4fCgl0mezrIQOpYiG+SIqSIcfTr1Q1nGo+JyZWZrZFfadsYbl4Hj1wxxqotG/CEI3m7140bihrgAZu103Nl6cfV2azjvzFjAS1Ix6ZqB2MNzc2UTwp5bOMJ82rdOLrRRQzv1GuEfT0HxaCSPDwPUYrlc/W/5gDPAcciRJYrzsbc2qg6KN/Y1Ls8PaLTAPcblS0IiMsBKKar7lNI9Qg2X2jZmIyx9trpObyU2mmlvRh5Y0g+VZBMoB08ILIP86DuLkb4y7hpRLrN2lis6cyC5DKnFtFJWu0xz12lhm8= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <2E9627ACB09D7546B254BF1AAE8C5E40@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2ecebc36-37a8-405e-8a05-08d762b7cc50 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 12:49:44.2192 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: TtHKwPtXnBTF+md3h8Vd2xjXR5ANFHoDSD6EVEZitmEGQQSRn1SmI2si2te7pnGy2VTCJVJzVJoO7E29hKGIChLUJO8PSE540p3YKA+5hIGWRO672VF40PyLvhKqv1FV X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB6157 Archived-At: Subject: Re: [Ace] Review of draft-ietf-ace-key-groupcomm X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 12:49:51 -0000 SGksDQoNCkFuc3dlcmluZyB0aGUgb25lIGlzc3VlIGxlZnQgZnJvbSBMdWR3aWcncyByZXZpZXcs IGluY2x1ZGluZyBKaW0ncyByZWFjdGlvbiBpbmxpbmUuDQoNClRoYW5rcywNCkZyYW5jZXNjYQ0K DQrvu79PbiAyMy8wNy8yMDE5LCAxNDo1NiwgIkFjZSBvbiBiZWhhbGYgb2YgSmltIFNjaGFhZCIg PGFjZS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBpZXRmQGF1Z3VzdGNlbGxhcnMuY29t PiB3cm90ZToNCiAgICANCiAgICAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KICAgIEZyb206 IEFjZSA8YWNlLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2VpdHoNCiAg ICBTZW50OiBGcmlkYXksIEp1bHkgMTksIDIwMTkgNzoyMiBBTQ0KICAgIFRvOiBkcmFmdC1pZXRm LWFjZS1rZXktZ3JvdXBjb21tQGlldGYub3JnDQogICAgQ2M6IGFjZUBpZXRmLm9yZw0KICAgIFN1 YmplY3Q6IFtBY2VdIFJldmlldyBvZiBkcmFmdC1pZXRmLWFjZS1rZXktZ3JvdXBjb21tDQogICAg DQogICAgSGVsbG8gRnJhbmNlc2NhLCBNYXJjbywNCiAgICANCiAgICBJIGhhdmUgZmluYWxseSBt YW5hZ2VkIHRvIHJlYWQgdGhlIHdob2xlIG9mIGRyYWZ0LWlldGYtYWNlLWtleS1ncm91cGNvbW0g YW5kIGhhdmUgYSBmZXcgY29tbWVudHMgZm9yIHlvdToNCiAgICANCiAgICANCiAgICA9PQ0KICAg IDUuMg0KICAgIA0KICAgICJJZiB0aGUgbGVhdmluZyBub2RlIHdhbnRzIHRvIGJlIHBhcnQgb2Yg YSBncm91cCB3aXRoIGZld2VyIHJvbGVzLCBpdCANCiAgICBkb2VzIG5vdCBuZWVkIHRvIGNvbW11 bmljYXRlIHRoYXQgdG8gdGhlIEtEQywgYW5kIGNhbiBzaW1wbHkgc3RvcCBhY3RpbmcgDQogICAg YWNjb3JkaW5nIHRvICAgc3VjaCByb2xlcy4iDQogICAgDQogICAgVGhlcmUgYXJlIGxlZ2l0aW1h dGUgY2FzZXMgd2hlcmUgYSBub2RlIG1pZ2h0IHdhbnQgdG8gZXhwbGljaXRseSANCiAgICBkZWFj dGl2YXRlIHJvbGVzIGl0IGlzIGN1cnJlbnRseSB1c2luZyAocHJpbmNpcGxlIG9mIGxlYXN0IHBy aXZpbGVkZ2UpIA0KICAgIGFuZCBub3QganVzdCBzdG9wIHVzaW5nIHRoZW0uDQogICAgDQogICAg W0pMU10gSSB0cmltbWVkIGJlY2F1c2UgSSBvbmx5IHdhbnRlZCB0byBhZGRyZXNzIHRoaXMgb25l IHRvcGljLiAgSSB0b3RhbGx5IGFncmVlIHRoYXQgdGhlcmUgYXJlIGNhc2VzIHdoZXJlIGEgbm9k ZSBtaWdodCB3YW50IHRvIGRlYWN0aXZhdGUgcm9sZXMsIGhvd2V2ZXIgaW4gdGhlIGNhc2Ugb2Yg Z3JvdXAgY29tbXVuaWNhdGlvbiBJIGRvbid0IHNlZSBob3cgdGhpcyBjb3VsZCBiZSBkb25lIGlu IGEgcmVhc29uYWJsZSBtYW5uZXIuICANCiAgICANCkZQOiBJIGFncmVlIHdpdGggSmltIHRoYXQg SSBhbSBub3Qgc3VyZSB0aGlzIGNhbiBiZSBkb25lICJpbiBhIHJlYXNvbmFibGUgbWFubmVyIiAo d2hlcmUgcmVhc29uYWJsZSBtZWFucyAid29ydGggdGhlIGVmZm9ydCIpLg0KDQogICAgSWYgYSBu b2RlIHNheXMgLSBwbGVhc2Ugc3RvcCBhZHZlcnRpc2luZyBteSBwdWJsaWMga2V5IGJlY2F1c2Ug SSBhbSBubyBsb25nZXIgYSBwdWJsaXNoZXIsIHRoYXQgaXMgcmVhc29uYWJsZSBmb3IgYSBLREMg dG8gc3RhcnQgZG9pbmcuICBIb3dldmVyLCB0aGVyZSBhcmUgY3VycmVudGx5IG5vIHByb3Zpc2lv bnMgaW4gdGhlIHByb3RvY29sIGZvciBhIEtEQyB0byBhZHZlcnRpc2UgdGhhdCBmYWN0IHRvIGFs bCBvZiB0aGUgc3Vic2NyaWJlcnMuICAgRXZlbiBpZiBhIGtleSByb2xsIG92ZXIgd2VyZSB0byBv Y2N1ciwgYXMgdGhlIG5vZGUgc3RpbGwgaXMgcGFydCBvZiB0aGUgZ3JvdXAsIGl0IGNhbiBwcm9k dWNlIHRoZSBjb3JyZWN0IGtleSBtYXRlcmlhbCBhbmQgc2lnbiBhIG1lc3NhZ2UuICBBIHN1YnNj cmliZXIgd2l0aCB0aGUgc2lnbmF0dXJlIGtleSB3b3VsZCBzdWNjZXNzZnVsbHkgdmFsaWRhdGUg dGhlIHNpZ25hdHVyZSBhbmQgYWNjZXB0IGl0IHRoZSBtZXNzYWdlLCBvbmx5IHRob3NlIHN1YnNj cmliZXJzIHdoaWNoIGhhZCBub3QgeWV0IHB1bGxlZCBkb3duIGEgcHVibGljIGtleSB3b3VsZCBm YWlsIHRvIHZhbGlkYXRlIHRoZSBtZXNzYWdlLg0KICAgIA0KICAgIFRoaXMgd291bGQgcmVxdWly ZSBhIG5ldyBtZWNoYW5pc20gZm9yIHRoZSBwdXJwb3NlIG9mIGFza2luZyBpZiBhIHB1YmxpYyBr ZXkgaXMgc3RpbGwgYXNzb2NpYXRlZCB3aXRoIGEgc3BlY2lmaWMga2V5IGlkZW50aWZpZXIgKHdo aWNoIGlzIGEgZ29vZCByZWFzb24gZm9yIHRoZSBub3RlIGFib3V0IGtlZXBpbmcgdGhlIHNhbWUg a2V5IGlkcyB3aGVuIHJvbGxpbmcga2V5cykuICBJIGFtIG5vdCBzdXJlIHRoYXQgdGhlIHRyYWZm aWMgd291bGQgYmUgd29ydGggdGhlIGVmZm9ydCBmb3IgdGhpcyBzbWFsbCBnYWluLg0KDQpGUDog VGhlIEtEQyBrZWVwcyB0cmFjayBvZiBub2RlcyBiZWluZyBpbiB0aGUgZ3JvdXAgbm93LCBhbmQg Zm9yIGVhY2ggbm9kZSBpdCBoYXMgYW4gYXNzb2NpYXRlZCB0b2tlbiB3aXRoIGF1dGhvcml6YXRp b24gaW5mb3JtYXRpb24sIHNvIHRoZSBLREMga25vd3Mgd2hhdCByb2xlcyBlYWNoIG5vZGUgaGFz IHdpdGhpbiB0aGUgZ3JvdXAuIEEgcG9zc2libGUgbmV3IG1lY2hhbmlzbSB0byBzb2x2ZSB0aGlz IHdvdWxkIGJlOiB3ZSBjb3VsZCBhZGQNCiogIGFuIChvYnNlcnZhYmxlKSByZXNvdXJjZSBhdCB0 aGUgS0RDIHRoYXQgYWxsb3dzIGFueSBtZW1iZXIgb2YgdGhlIGdyb3VwIHRvIGdldCBpbmZvcm1h dGlvbiBhYm91dCBub2Rlc+KAmSByb2xlcywgc2F5IFBPU1RpbmcgYW4gYXJyYXkgb2Ygbm9kZSBp ZGVudGlmaWVycyB0byB0aGUgS0RDIGFuZCBnZXR0aW5nIGJhY2sgdGhlIHJvbGVzLCBvciBvYnNl cnZpbmcgaXQgYW5kIGdldHRpbmcgYW55IGNoYW5nZXMgaXQgbWlnaHQgaGFwcGVuLCBhbmQgDQoq IGFub3RoZXIgcmVzb3VyY2Ugd2hlcmUgYSBub2RlIGNhbiBQT1NUIHVwZGF0ZXMgdG8gaXRzIG93 biByb2xlDQpCdXQgSSBhbSBub3Qgc3VyZSB0aGF0IGlzIHZlcnkgdXNlZnVsL3dvcnRoIHRoZSBl ZmZvcnQgdnMgdGhlIGFtb3VudCBvZiB0cmFmZmljIGdlbmVyYXRlZC4gVGhlIG5vZGUgcmVxdWVz dGluZyB0byDigJxsZWF2ZSBhIHJvbGXigJ0gY291bGQgc3RpbGwgcmVxdWVzdCB0byDigJxnZXQg dGhlIHJvbGXigJ0gYWdhaW4sIGlmIGl0IGlzIHN0aWxsIGF1dGhvcml6ZWQgdG8gZG8gc28gKGZv ciBleGFtcGxlLCBhIHB1Ymxpc2hlciBjb3VsZCBkZWNpZGUgdG8gc3VkZGVubHkgb25seSBiZSBh IHN1YnNjcmliZXIsIGJ1dCBjb3VsZCBzdGlsbCBnZXQgYmFjayBpdHMgcHVibGlzaGVyIHJvbGUg aWYgaXQgd2FudGVkIHRvKS4gSSBhbSBpbnRlcmVzdGVkIGluIGhlYXJpbmcgbW9yZSBvcGluaW9u cyBhYm91dCB0aGlzICjigJxubyB3ZSBkb27igJl0IG5lZWQgdGhpc+KAnSDigJx5ZXMgd2UgbmVl ZCB0aGlzIGFuZCB3aHnigJ0pLg0KDQogICAgDQogICAgTm90ZSB0aGF0IGZvciBhIGdhdGVkIHRy YW5zbWlzc2lvbiBzeXN0ZW0gc3VjaCBhcyBhIHB1Yi1zdWIgc2VydmVyLCB0aGUgbm9kZSBjYW4g Z2V0IGxlc3NlciBwcml2aWxlZ2UgZm9yIHRoZSBnYXRlIHN5c3RlbSB3aXRob3V0IGdldHRpbmcg bGVzcyBwcml2aWxlZ2UgZm9yIHRoZSBLREMuDQogICAgDQogICAgSmltDQogICAgDQoNCg0KIA0K ICAgIC9MdWR3aWcNCiAgICANCiAgICANCiAgICAtLSANCiAgICBMdWR3aWcgU2VpdHosIFBoRA0K ICAgIFNlY3VyaXR5IExhYiwgUklTRQ0KICAgIFBob25lICs0NigwKTcwLTM0OSA5MiA1MQ0KICAg IA0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQogICAgQWNlIG1haWxpbmcgbGlzdA0KICAgIEFjZUBpZXRmLm9yZw0KICAgIGh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQogICAgDQoNCg== From nobody Wed Nov 6 05:43:58 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E04312089E for ; Wed, 6 Nov 2019 05:43:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.322 X-Spam-Level: X-Spam-Status: No, score=-0.322 tagged_above=-999 required=5 tests=[AC_BR_BONANZA=0.001, BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FUZZY_CREDIT=1.678, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wtMR7tTYmSwW for ; Wed, 6 Nov 2019 05:43:42 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0629.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe02::629]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EA3512010C for ; Wed, 6 Nov 2019 05:43:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FzYDoP7xbLYeJEeKbPG6Z0PLxAgXdzwtBjJbyAcwcrpFnR/ZsVB5cuL6eWsaqbSE5ljH084O4x1e84WBLZuVBmvKEKlBWt+qOApjIxM+zGcPlsZRU/pAPws2mdpBgSrU880uZjW9Bi4X4hukdMbnifN0yNOpj4PRGOoGtPWlw8DL3TpyaqPBo3SB08Pz4YYiOr+VLH7RyIAfYbq9rdcgZpxDWtic6Z8Naxvo0kqdyxbZCdD9K7lwXMJSopJFR7gC2pkvgZYuW2UgAlLn80EBm0uK6LLbECNkM6nyDoR66nZZxam5xDDxmD3Es3UdH96G0q3AXrXj3xKp3FVyna0rlg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=swG11DIkQ0+GBsbG9pYELiUm4F3HgEOFcGid91NCUsw=; b=iDnXmuaoE9EXV23htJ7aDIA9+w7Df30dFp58obiW0HeNGn3D2Qtw9H9jm9MCC5eLKkmxGPAxZfG02ikzMaj8rZsdPfbl1MKxpQAhD1eNluhBb1cdYZdUQNLdIdi7+SP0BbTypvDO0CFyxtkes+zgf0UsP7A+cA2P8M26XhE3PkoilXq58MFci98TBiimiXMCT2RGMU/q4SZ/U0CG3ZmC7ya2yhQG45QlSe+4sc+MNICaojRD8xRLayxqG8QyTbn5NQfMSddnpE6T2hZY7QjB5onV1y8MPHceoybtubtlZ92IQ1ei6/jskxVmZySTlOOC8R83Cs3eF38qSm6UU0zi8g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=swG11DIkQ0+GBsbG9pYELiUm4F3HgEOFcGid91NCUsw=; b=Ui5isx8v3vlJrEKIdu0U5K1OwBxXeQ3NE8COC+Xmb/Ipt3UKrgV7i0XnlHvD/ONNkhrc/n+Qp7UDfmDQo3zNo7zB2/NjwjcrSUFKtNpbzIVrmGOnCCQF/9GpFHsfHtEMPyDZ7Yf7dqsOLgeFLrf8SQuOmSdgbQ9u7pRf1P+TPho= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB4141.eurprd07.prod.outlook.com (52.134.25.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.16; Wed, 6 Nov 2019 13:43:36 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2430.017; Wed, 6 Nov 2019 13:43:36 +0000 From: Francesca Palombini To: Daniel Migault , "ace@ietf.org" Thread-Topic: [Ace] draft-ietf-ace-key-groupcomm-02 Thread-Index: AQHVNnrEaIRKU5ct/EiO/rb6HkiwdKd+9CqA Date: Wed, 6 Nov 2019 13:43:36 +0000 Message-ID: <894C46A9-1AE6-4A6E-89D5-C79B8C03E4EF@ericsson.com> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e453141d-c950-41e4-278f-08d762bf52b1 x-ms-traffictypediagnostic: VI1PR07MB4141:|VI1PR07MB4141: x-ms-exchange-purlcount: 14 x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10009020)(4636009)(39860400002)(136003)(366004)(346002)(376002)(396003)(15374003)(189003)(199004)(51444003)(36756003)(6436002)(110136005)(25786009)(66446008)(186003)(81166006)(14454004)(8676002)(66574012)(2501003)(476003)(14444005)(76176011)(66066001)(256004)(5660300002)(3846002)(6116002)(229853002)(236005)(6486002)(316002)(11346002)(102836004)(8936002)(446003)(86362001)(6512007)(6246003)(606006)(54896002)(66556008)(6306002)(966005)(64756008)(81156014)(2616005)(99286004)(91956017)(30864003)(76116006)(9326002)(53546011)(2906002)(26005)(7736002)(71200400001)(71190400001)(486006)(44832011)(6506007)(66476007)(33656002)(66946007)(478600001)(579004)(559001)(569006); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB4141; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: N6htGHcoNVNCPaPOkSxDLukQTThmg4LVwQGRsNX2K5rya9YTxl/SsNs6IMiiXrGL63mNHdJXmml9EzsoRej1Dvk2TntMCTMLVGIlKvoFJeQLz/qi6/KrpE8xX7dtCG143EebgB0lJZAXwPeEwI1Rompcx8MN4L7c+UnxgVLFVCEuyR4LPcy9t2kBRBT4Px0rMUjRniQClPMHkeo6hVHhybdhdO6WD1D4qa2dZuRDXntbVP0IZODt0b+6TIjWoL/MJC1XKedkUGIMlWDyfZ015k3vfhkwrhOmuE16aT12SwCdCTRvgfMbImXpjuw4LCA9/JY6ayJhfSMc8QsqoHZNkicDJ5w9RZXLxg3XPawQ8R4RpjkU423G8dQWoYzhxJHu/H0LqKhTnhHI9c6zowcCKv481NQNhTpf4iIpT8Fcr9yAKoFYbxC9NmtpuF/4UCJknACJSNdnsbxMSNySJhPhsr+lpr0sW1GNm+UbZzf6AUURmFzMBcsPLK+GAr1C7XcErIxK9v03WOheFzHcQ4LLdThuGegc1GqUOIBmg7bJ4DjLuJS3xCWQlVjwFBEHYQQAam8CY8tZ1sTDFTMLiTSTUqLmq25W2dmjbfA1+HpH+8Q= Content-Type: multipart/alternative; boundary="_000_894C46A91AE64A6E89D5C79B8C03E4EFericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: e453141d-c950-41e4-278f-08d762bf52b1 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 13:43:36.1442 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 5IDy1AASlaIse6dCC6OAmnLQcq1wuS84nrRarJvex3CJcCRWuvZLsAK5MQBT7HwMpshS8wl1hLwl+qxtYUJj8NGj9L0gOOP6ykw6yUqLRqTvW2y7uX0Mj12DzXf9+Q2p X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB4141 Archived-At: Subject: Re: [Ace] draft-ietf-ace-key-groupcomm-02 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 13:43:57 -0000 --_000_894C46A91AE64A6E89D5C79B8C03E4EFericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGFuaWVsLA0KDQpUaGFuayB5b3UgZm9yIHlvdXIgcmV2aWV3ISBBcyB5b3UgaGF2ZSBzZWVu LCB3ZSBoYXZlIHN1Ym1pdHRlZCBhIG5ldyB2ZXJzaW9uIG9mIHRoZSBkb2N1bWVudCwgdGhhdCB3 ZSBob3BlIGFkZHJlc3NlcyBhbGwgdGhlIGNvbW1lbnRzIHdlIGhhdmUgcmVjZWl2ZWQuIElubGlu ZSwgYW5zd2VycyB0byB5b3VyIGNvbW1lbnRzIGFuZCBxdWVzdGlvbnMsIHByZWZhY2VkIHdpdGgg 4oCcRlA64oCdLg0KDQpUaGFua3MsDQpGcmFuY2VzY2ENCg0KRnJvbTogQWNlIDxhY2UtYm91bmNl c0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIERhbmllbCBNaWdhdWx0IDxkYW5pZWwubWlnYXVsdEBl cmljc3Nvbi5jb20+DQpEYXRlOiBUdWVzZGF5LCA5IEp1bHkgMjAxOSBhdCAxOToyMQ0KVG86IEFj ZSBXZyA8YWNlQGlldGYub3JnPg0KU3ViamVjdDogW0FjZV0gZHJhZnQtaWV0Zi1hY2Uta2V5LWdy b3VwY29tbS0wMg0KDQpIaSwNCg0KUGxlYXNlIGZpbmQgc29tZSBjb21tZW50cyB3aGlsZSByZWFk aW5nIHRoZSBkb2N1bWVudC4gSSBhbHNvIGhhdmUgc29tZSBoaWdoIGxldmVsIHF1ZXN0aW9ucyB0 aGF0IEkgbWlnaHQgaGF2ZSBtaXNzZWQgaW4gdGhlIGRyYWZ0IG9yIHRoYXQgYXJlIGRlZmluZWQg c29tZXdoZXJlIGVsc2UuDQoNClRoZSBncm91cCBzZWVtcyB0byBiZSBkZWZpbmVkIGJ5IGl0cyBn cm91cCBtZW1iZXJzIGFuZCBlYWNoIG1lbWJlciBhcmUgcmVnaXN0ZXJlZCB3aXRoIHJlYWQgb3Ig d3JpdGUgYWNjZXNzLiBXaGF0IGlzIHVuY2xlYXIgdG8gbWUgaXMgaG93IHRoZXNlIHByb3BlcnRp ZXMgKHJlYWQsIHdyaXRlKSBhZmZlY3QgdGhlIGdyb3VwIGNvbW11bmljYXRpb24uIEFyZSB0aGVy ZSBhbnkgc3BlY2lmaWMgY3J5cHRvZ3JhcGhpYyBtYXRlcmlhbCBvciBkaWZmZXJlbnQgYWNjZXNz IHBvbGljaWVzIGltcGxlbWVudGVkIGJ5IHRoZSBSUyBmb3IgZWFjaCByb2xlID8NCg0KRlA6IFll cywgdGhhdCBpcyB1cCB0byB0aGUgYXBwbGljYXRpb24gdG8gZGVjaWRlLCB0aGUgc3BlY2lmaWNz IG9mIHRoYXQgYXJlIHNwZWNpZmllZCBpbiB0aGUgYXBwbGljYXRpb24gcHJvZmlsZXMgKHN1Y2gg YXMgYWNlLWtleS1ncm91cGNvbW0tb3Njb3JlIG9yIGFjZS1jb2FwLXB1YnN1Yi1wcm9maWxlKQ0K DQpJIGFtIG5vdCBlbnRpcmVseSBjbGVhciBob3cgdGhlIGdyb3VwIGNvbW11bmljYXRpb24gaXMg cHJvdGVjdGVkLiBJbiBwYXJ0aWN1bGFyLCBJIGFtIHdvbmRlcmluZyBpZiB0aGUgc291cmNlIGlz IGF1dGhlbnRpY2F0ZWQgb3IgaWYgdGhlIGtleSBpcyBzaGFyZWQgYmV0d2VlbiB0aGUgZGlmZmVy ZW50IG1lbWJlcnMgb2YgdGhlIGdyb3VwLiBJIGFtIGFsc28gd29uZGVyaW5nIGhvdyB0aGUgcHVi bGljIGtleSBhc3NvY2lhdGVkIHRvIGVhY2ggZ3JvdXAgbWVtYmVyIGlzIHVzZWQgYnkgYW5vdGhl ciBtZW1iZXIuDQoNCkZQOiBBZ2FpbiwgdGhvc2UgZGV0YWlscyBhcmUgc3BlY2lmaWVkIGluIHRo ZSBhcHBsaWNhdGlvbiBwcm9maWxlcy4gSW4gdGhlIGdyb3VwIE9TQ09SRSBvbmUgZm9yIGV4YW1w bGUsIHRoZSBzeW1tZXRyaWMga2V5aW5nIG1hdGVyaWFsIGlzIHNoYXJlZCBhbmQgdGhlIHB1Ymxp Yy9wcml2YXRlIGtleXMgYXJlIHVzZWQgdG8gY291bnRlcnNpZ24uIFdlIHRyaWVkIHRvIGFkZCBz b21lIHNlbnRlbmNlcyBhYm91dCB0aGF0LCBhbmQgdGhhdCBpcyBhbHNvIHJlZmxlY3RlZCBpbiB0 aGUgdXBkYXRlZCDigJxSZXF1aXJlbWVudHMgb24gQXBwbGljYXRpb24gUHJvZmlsZXPigJ0gQXBw ZW5kaXggaW4gdGhpcyBkb2N1bWVudCAoQXBwZW5kaXggQSkuDQoNClBsZWFzZSBmaW5kIHNvbWUg Y29tbWVudHMgb24gdGhlIGRvY3VtZW50cy4NCg0KWW91cnMsDQpEYW5pZWwNCg0KDQoNCg0KDQpB Q0UgV29ya2luZyBHcm91cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBGLiBQYWxvbWJpbmkNCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBFcmljc3NvbiBBQg0KSW50ZW5kZWQgc3RhdHVzOiBTdGFuZGFy ZHMgVHJhY2sgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTS4gVGlsb2NhDQpFeHBpcmVz OiBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFJJU0UgQUINCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSnVseSAwNSwgMjAxOQ0KDQoNCiAgICAgICAgICAgS2V5IFByb3Zpc2lvbmlu ZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiB1c2luZyBBQ0UNCiAgICAgICAgICAgICAgICAgIGRy YWZ0LWlldGYtYWNlLWtleS1ncm91cGNvbW0tMDINCg0KQWJzdHJhY3QNCg0KICAgVGhpcyBkb2N1 bWVudCBkZWZpbmVzIG1lc3NhZ2UgZm9ybWF0cyBhbmQgcHJvY2VkdXJlcyBmb3IgcmVxdWVzdGlu Zw0KICAgYW5kIGRpc3RyaWJ1dGluZyBncm91cCBrZXlpbmcgbWF0ZXJpYWwgdXNpbmcgdGhlIEFD RSBmcmFtZXdvcmssIHRvDQogICBwcm90ZWN0IGNvbW11bmljYXRpb25zIGJldHdlZW4gZ3JvdXAg bWVtYmVycy4NCg0KU3RhdHVzIG9mIFRoaXMgTWVtbw0KDQogICBUaGlzIEludGVybmV0LURyYWZ0 IGlzIHN1Ym1pdHRlZCBpbiBmdWxsIGNvbmZvcm1hbmNlIHdpdGggdGhlDQogICBwcm92aXNpb25z IG9mIEJDUCA3OCBhbmQgQkNQIDc5Lg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtpbmcg ZG9jdW1lbnRzIG9mIHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZw0KICAgVGFzayBGb3JjZSAoSUVU RikuICBOb3RlIHRoYXQgb3RoZXIgZ3JvdXBzIG1heSBhbHNvIGRpc3RyaWJ1dGUNCiAgIHdvcmtp bmcgZG9jdW1lbnRzIGFzIEludGVybmV0LURyYWZ0cy4gIFRoZSBsaXN0IG9mIGN1cnJlbnQgSW50 ZXJuZXQtDQogICBEcmFmdHMgaXMgYXQgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kcmFm dHMvY3VycmVudC8uDQoNCiAgIEludGVybmV0LURyYWZ0cyBhcmUgZHJhZnQgZG9jdW1lbnRzIHZh bGlkIGZvciBhIG1heGltdW0gb2Ygc2l4IG1vbnRocw0KICAgYW5kIG1heSBiZSB1cGRhdGVkLCBy ZXBsYWNlZCwgb3Igb2Jzb2xldGVkIGJ5IG90aGVyIGRvY3VtZW50cyBhdCBhbnkNCiAgIHRpbWUu ICBJdCBpcyBpbmFwcHJvcHJpYXRlIHRvIHVzZSBJbnRlcm5ldC1EcmFmdHMgYXMgcmVmZXJlbmNl DQogICBtYXRlcmlhbCBvciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAid29yayBpbiBwcm9n cmVzcy4iDQoNCiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSmFudWFyeSA2 LCAyMDIwLg0KDQpDb3B5cmlnaHQgTm90aWNlDQoNCiAgIENvcHlyaWdodCAoYykgMjAxOSBJRVRG IFRydXN0IGFuZCB0aGUgcGVyc29ucyBpZGVudGlmaWVkIGFzIHRoZQ0KICAgZG9jdW1lbnQgYXV0 aG9ycy4gIEFsbCByaWdodHMgcmVzZXJ2ZWQuDQoNCiAgIFRoaXMgZG9jdW1lbnQgaXMgc3ViamVj dCB0byBCQ1AgNzggYW5kIHRoZSBJRVRGIFRydXN0J3MgTGVnYWwNCiAgIFByb3Zpc2lvbnMgUmVs YXRpbmcgdG8gSUVURiBEb2N1bWVudHMNCiAgIChodHRwczovL3RydXN0ZWUuaWV0Zi5vcmcvbGlj ZW5zZS1pbmZvKSBpbiBlZmZlY3Qgb24gdGhlIGRhdGUgb2YNCiAgIHB1YmxpY2F0aW9uIG9mIHRo aXMgZG9jdW1lbnQuICBQbGVhc2UgcmV2aWV3IHRoZXNlIGRvY3VtZW50cw0KICAgY2FyZWZ1bGx5 LCBhcyB0aGV5IGRlc2NyaWJlIHlvdXIgcmlnaHRzIGFuZCByZXN0cmljdGlvbnMgd2l0aCByZXNw ZWN0DQogICB0byB0aGlzIGRvY3VtZW50LiAgQ29kZSBDb21wb25lbnRzIGV4dHJhY3RlZCBmcm9t IHRoaXMgZG9jdW1lbnQgbXVzdA0KICAgaW5jbHVkZSBTaW1wbGlmaWVkIEJTRCBMaWNlbnNlIHRl eHQgYXMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNC5lIG9mDQogICB0aGUgVHJ1c3QgTGVnYWwgUHJv dmlzaW9ucyBhbmQgYXJlIHByb3ZpZGVkIHdpdGhvdXQgd2FycmFudHkgYXMNCiAgIGRlc2NyaWJl ZCBpbiB0aGUgU2ltcGxpZmllZCBCU0QgTGljZW5zZS4NCg0KDQoNCg0KUGFsb21iaW5pICYgVGls b2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgIFtQYWdlIDFd DQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0 aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNClRhYmxlIG9mIENvbnRlbnRzDQoNCiAgIDEuICBJbnRy b2R1Y3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICAgMw0KICAgICAxLjEuICBUZXJtaW5vbG9neSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gICAzDQogICAyLiAgT3ZlcnZpZXcgIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4uIC4gICA0DQogICAzLiAgQXV0aG9yaXph dGlvbiB0byBKb2luIGEgR3JvdXAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDYN CiAgICAgMy4xLiAgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICAgNw0KICAgICAzLjIuICBBdXRob3JpemF0aW9uIFJlc3BvbnNlICAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA3DQogICAgIDMuMy4gIFRva2VuIFBvc3Qg IC4gLiAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA4DQogICA0 LiAgS2V5IERpc3RyaWJ1dGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgMTENCiAgICAgNC4xLiAgS2V5IERpc3RyaWJ1dGlvbiBSZXF1ZXN0ICAuIC4gLiAu IC4gLi4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTINCiAgICAgNC4yLiAgS2V5IERpc3RyaWJ1dGlv biBSZXNwb25zZSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxMw0KICAgNS4gIFJl bW92YWwgb2YgYSBOb2RlIGZyb20gdGhlIEdyb3VwICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gIDE2DQogICAgIDUuMS4gIEV4cGlyZWQgQXV0aG9yaXphdGlvbiAuIC4gLiAuIC4gLi4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDE2DQogICAgIDUuMi4gIFJlcXVlc3QgdG8gTGVhdmUgdGhl IEdyb3VwICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTYNCiAgIDYuICBSZXRyaWV2 YWwgb2YgTmV3IG9yIFVwZGF0ZWQgS2V5aW5nIE1hdGVyaWFsIC4gLiAuIC4gLiAuIC4gLiAuICAx Nw0KICAgICA2LjEuICBLZXkgUmUtRGlzdHJpYnV0aW9uIFJlcXVlc3QgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gIDE4DQogICAgIDYuMi4gIEtleSBSZS1EaXN0cmlidXRpb24gUmVzcG9u c2UgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTkNCiAgIDcuICBSZXRyaWV2YWwgb2Yg UHVibGljIEtleXMgZm9yIEdyb3VwIE1lbWJlcnMgIC4gLiAuIC4gLiAuIC4gLiAuICAxOQ0KICAg ICA3LjEuICBQdWJsaWMgS2V5IFJlcXVlc3QgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gIDIwDQogICAgIDcuMi4gIFB1YmxpYyBLZXkgUmVzcG9uc2UgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMjANCiAgIDguICBBQ0UgR3JvdXBjb21tIFBhcmFt ZXRlcnMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAyMQ0KICAgOS4gIEFD RSBHcm91cGNvbW0gUmVxdWVzdCBUeXBlICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gIDIyDQogICAxMC4gU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgMjMNCiAgICAgMTAuMS4gIFVwZGF0ZSBvZiBLZXlpbmcgTWF0 ZXJpYWwgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAyNA0KICAgICAxMC4yLiAgQmxv Y2stV2lzZSBDb25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDI0 DQogICAxMS4gSUFOQSBDb25zaWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgMjUNCiAgICAgMTEuMS4gIEFDRSBBdXRob3JpemF0aW9uIFNlcnZlciBS ZXF1ZXN0IENyZWF0aW9uIEhpbnRzIFJlZ2lzdHJ5ICAyNQ0KICAgICAxMS4yLiAgQUNFIFB1Ymxp YyBLZXkgRW5jb2RpbmcgUmVnaXN0cnkgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDI1DQogICAg IDExLjMuICBBQ0UgR3JvdXBjb21tIFBhcmFtZXRlcnMgUmVnaXN0cnkgIC4gLiAuIC4gLiAuIC4g LiAuIC4gLi4gIDI2DQogICAgIDExLjQuICBBY2UgR3JvdXBjb21tIFJlcXVlc3QgVHlwZSBSZWdp c3RyeSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAgMjYNCiAgICAgMTEuNS4gIEFDRSBHcm91cGNvbW0g S2V5IFJlZ2lzdHJ5IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAyNw0KICAgICAxMS42 LiAgQUNFIEdyb3VwY29tbSBQcm9maWxlIFJlZ2lzdHJ5IC4gLiAuIC4gLiAuIC4uIC4gLiAuIC4g LiAuICAyOA0KICAgICAxMS43LiAgQUNFIEdyb3VwY29tbSBQb2xpY3kgUmVnaXN0cnkgIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDI4DQogICAgIDExLjguICBTZXF1ZW5jZSBOdW1iZXIgU3lu Y2hyb25pemF0aW9uIE1ldGhvZCBSZWdpc3RyeSAgLiAuIC4gLi4gIDI5DQogICAgIDExLjkuICBF eHBlcnQgUmV2aWV3IEluc3RydWN0aW9ucyAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g IDI5DQogICAxMi4gUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAgMzANCiAgICAgMTIuMS4gIE5vcm1hdGl2ZSBSZWZlcmVuY2VzIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAzMA0KICAgICAxMi4yLiAgSW5mb3Jt YXRpdmUgUmVmZXJlbmNlcyAuIC4gLiAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAzMQ0K ICAgQXBwZW5kaXggQS4gIFJlcXVpcmVtZW50cyBvbiBBcHBsaWNhdGlvbiBQcm9maWxlcyAuIC4g LiAuIC4gLiAuIC4gIDMzDQogICBBcHBlbmRpeCBCLiAgRG9jdW1lbnQgVXBkYXRlcyAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMzMNCiAgICAgQi4xLiAgVmVyc2lvbiAtMDEg dG8gLTAyICAuIC4gLiAuIC4gLiAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMzQNCiAgICAg Qi4yLiAgVmVyc2lvbiAtMDAgdG8gLTAxICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAzNA0KICAgQWNrbm93bGVkZ21lbnRzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDM1DQogICBBdXRob3JzJyBBZGRyZXNzZXMgIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDM1DQoNCg0KDQoNCg0K DQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAg ICAgICAgICAgW1BhZ2UgMl0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9y IEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KMS4gIEludHJvZHVjdGlv bg0KDQogICBUaGlzIGRvY3VtZW50IGV4cGFuZHMgdGhlIEFDRSBmcmFtZXdvcmsgW0ktRC5pZXRm LWFjZS1vYXV0aC1hdXRoel0gdG8NCiAgIGRlZmluZSB0aGUgZm9ybWF0IG9mIG1lc3NhZ2VzIHVz ZWQgdG8gcmVxdWVzdCwgZGlzdHJpYnV0ZSBhbmQgcmVuZXcNCiAgIHRoZSBrZXlpbmcgbWF0ZXJp YWwgaW4gYSBncm91cCBjb21tdW5pY2F0aW9uIHNjZW5hcmlvLCBlLmcuIGJhc2VkIG9uDQogICBt dWx0aWNhc3QgW1JGQzczOTBdW0ktRC5kaWprLWNvcmUtZ3JvdXBjb21tLWJpc10gb3Igb24gcHVi bGlzaGluZy0NCiAgIHN1YnNjcmliaW5nIFtJLUQuaWV0Zi1jb3JlLWNvYXAtcHVic3ViXS4NCjxt Z2x0Pg0KDQpUaGlzIGlzIGEgbml0IHdoaWNoIG1heSBiZSBkdWUgdG8gbXkgZW5nbGlzaC4gTXkg bXkgcmVhZGluZyBvZiAiZS5nLi4NCmJhc2VkIG9uICIgc2VlbXMgdG8gYmUgbWlzbGVhZGluZyBo ZXJlIC0gYXQgbGVhc3QgdG8gbWUuIEkgYW0NCmludGVycHJldGluZyB0aGUgdGV4dCBhcyA3Mzkw IGFuZCB0aGUgdHdvIG90aGVyIGRyYWZ0cyBhcyBleGFtcGxlcyB0aGF0DQpjb3VsZCB0YWtlIGFk dmFudGFnZSBvZiB0aGUgY3VycmVudCBkb2N1bWVudC4gQXMgdGhlc2UgZG9jdW1lbnQgZG8gbm90 DQpzZWVtIHRvIGNvbnNpZGVyIG11bHRpY2FzdCBjb21tdW5pY2F0aW9uIGluIGdlbmVyYWwgLSA3 MzkwIHNlZW0gc2xpbWl0ZWQNCnRvIG9uZS10by1tYW55IC0sIHRoaXMgZ2l2ZXMsIGluIG15IG9w aW5pb24gYSBmYWxzZSBpbXByZXNzaW9uIHRoYXQgdGhlDQpzY2hlbWUgZGVzY3JpYmUgaW4gdGhp cyBkb2N1bWVudCBpcyBtdWNoIG1vcmUgZ2VuZXJhbC4gIFdoaWxlIHdlIGRvIG5vdA0Kd2FudCB0 byBwcmV2ZW50IG90aGVyIHByb3RvY29sIHRvIHJlLXVzZSB0aGUgc2NoZW1lIGRlZmluZWQgaGVy ZSwgSQ0KYmVsaWV2ZSBpdCB3b3VsZCBiZSBzYWZlciB0byByZXN0cmljdCB0aGUgY3VycmVudCBk b2N1bWVudCB0byB0aGVzZQ0KbGF0ZXN0IGRvY3VtZW50IGFzIHRoZXkgcHJvdmlkZSB0aGUgZ3Jv dXAgY29tbXVuaWNhdGlvbiBmcmFtZXdvcmsgd2UgYXJlDQp1c2luZyBoZXJlLiBJbiB0aGVzZSB3 ZXJlIG9ubHkgZXhhbXBsZXMsIEkgd291bGQgZXhwZWN0IHRoZSBkb2N1bWVudCB0bw0KcHJvdmlk ZSBhIGRlc2NyaXB0aW9uIGhvdyBhIG1vcmUgZ2VuZXJpYyBmcmFtZXdvcmsuDQoNCjwvbWdsdD4N Cg0KRlA6IEkgYW0gbm90IHN1cmUgSSB1bmRlcnN0YW5kIHdoYXQgeW91IHRoaW5rIGlzIG1pc2xl YWRpbmcuIFllcywgeW91ciBpbnRlcnByZXRhdGlvbiBpcyBjb3JyZWN0LCBDb0FQIGdyb3VwIGNv bW11bmljYXRpb24gYW5kIENvQVAgcHVic3ViIGFyZSAyIGV4YW1wbGVzIHdoZXJlIHRoaXMgc3Bl Y2lmaWNhdGlvbiBjYW4gYmUgdXNlZCwgYW5kIHRoZSBvbmx5IDIgIGNhc2VzIHdlIGNhbiB0aGlu ayBvZiByaWdodCBub3cuIEJ1dCBhcyB5b3Ugc2F5LCB3ZSBkbyBub3Qgd2FudCB0byBwcmV2ZW50 IG90aGVyIGdyb3VwIGNvbW11bmljYXRpb24gc2NlbmFyaW9zIHRvIHVzZSB0aGlzIHNwZWNpZmlj YXRpb24uIFdoYXQgZG8geW91IHRoaW5rIGlzIG1pc3NpbmcgZm9yIGl0IHRvIGJlIHJldXNlZCBp biBhbnkgZ2VuZXJhbCBncm91cCBjb21tdW5pY2F0aW9uIHNjZW5hcmlvPyBGb3IgZXhhbXBsZSwg YXMgbWVudGlvbmVkIGFib3ZlLCB0aGUgYXBwZW5kaXggQSBnaXZlcyBhIG51bWJlciBvZiByZXF1 aXJlbWVudHMgb24gd2hhdCBhbiBhcHBsaWNhdGlvbiBwcm9maWxlcyBtdXN0IGRlZmluZSwgdGhh dCBpbmNsdWRlcyB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbiBwcm90b2NvbCB1c2VkLg0KDQogICBU aGUgQUNFIGZyYW1ld29yayBpcyBiYXNlZA0KICAgb24gQ0JPUiBbUkZDNzA0OV0sIHNvIENCT1Ig aXMgdGhlIGZvcm1hdCB1c2VkIGluIHRoaXMgc3BlY2lmaWNhdGlvbi4NCiAgIEhvd2V2ZXIsIHVz aW5nIEpTT04gW1JGQzgyNTldIGluc3RlYWQgb2YgQ0JPUiBpcyBwb3NzaWJsZSwgdXNpbmcgdGhl DQogICBjb252ZXJzaW9uIG1ldGhvZCBzcGVjaWZpZWQgaW4gU2VjdGlvbnMgNC4xIGFuZCA0LjIg b2YgW1JGQzcwNDldLg0KDQo8bWdsdD4NClRoaXMgaXMgYSBjb21tZW50IGFuZCB0aGVyZSBpcyBw cm9iYWJseSBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9mIHRoZQ0KdGV4dCBhYm92ZSBJIGFtIG1p c3NpbmcuIE15IHJlYWRpbmcgaXMgdGhhdCBDQk9SIGFuZCBKU09OIGFyZSBzdXBwb3J0ZWQsDQpt ZWFuaW5nIHRoYXQgSSBjb3VsZCBzZW5kIGEgSlNPTiBwYWNrZXQgb3IgYSBDQk9SIHBhY2tldC4g VW5sZXNzIHRoaXMgaXMNCm5hdGl2ZWx5IHN1cHBvcnRlZCwgaXQgc2VlbXMgdG8gaW5kaWNhdGUg dGhhdCB0d28gZm9ybWF0IGFyZSBzdXBwb3J0ZWQNCmFuZCBJIHdvdWRsIGJlIGluY2xpbmVkIHRv IHNheSB3ZSBzaG91ZGwgbWF5YmUgcGljayBvbmUgb2YgdGhlbSBmb3INCmludGVyLW9wZXJhYmls aXR5LiBJbiB0aGlzIGNhc2UgQ0JPUiBtaWdodCBiZSBhcHByb3ByaWF0ZWQuDQoNCkkgYW0gcmVh ZGluZyB0aGF0IHRoZSBzdXBwb3J0IGZvciBKU09OIGlzIGVhc2lseSBhZGFwdGVkIGZyb20gdGhl DQpjdXJyZW50IGRvY3VtZW50YXRpb24sIGJ1dCBub3Qgc28gbXVjaCByZWNvbW1lbmRlZC4NCjwv bWdsdD4NCg0KRlA6IFllcywgdGhlIHRleHQgaXMgbWVhbnQgdG8gbWVhbjogdGhpcyBzcGVjaWZp Y2F0aW9uIHVzZXMgQ0JPUi4gQWRhcHRpbmcgdG8gSlNPTiBpcyBwb3NzaWJsZSAoYnV0IG5vdCBk b25lIGhlcmUpLg0KDQoNCiAgIFByb2ZpbGVzIHRoYXQgdXNlIGdyb3VwIGNvbW11bmljYXRpb24g Y2FuIGJ1aWxkIG9uIHRoaXMgZG9jdW1lbnQgdG8NCiAgIHNwZWNpZnkgdGhlIHNlbGVjdGlvbiBv ZiB0aGUgbWVzc2FnZSBwYXJhbWV0ZXJzIGRlZmluZWQgaW4gdGhpcw0KICAgZG9jdW1lbnQgdG8g dXNlIGFuZCB0aGVpciB2YWx1ZXMuICBLbm93biBhcHBsaWNhdGlvbnMgdGhhdCBjYW4NCiAgIGJl bmVmaXQgZnJvbSB0aGlzIGRvY3VtZW50IHdvdWxkIGJlLCBmb3IgZXhhbXBsZSwgdGhvc2UgYWRk cmVzc2luZw0KICAgZ3JvdXAgY29tbXVuaWNhdGlvbiBiYXNlZCBvbiBtdWx0aWNhc3QNCiAgIFtS RkM3MzkwXVtJLUQuZGlqay1jb3JlLWdyb3VwY29tbS1iaXNdIG9yIHB1Ymxpc2hpbmcvc3Vic2Ny aWJpbmcNCiAgIFtJLUQuaWV0Zi1jb3JlLWNvYXAtcHVic3ViXSBpbiBBQ0UuDQoNCjxtZ2x0Pg0K SSB3b3VsZCBzdWdnZXN0IHRvIGxpbWl0IHRoZSBkb2N1bWVudCB0byB0aGVzZSBkb2N1bWVudHMs IGVzcGVjaWFsbHkgaWYNCndlIGRvIG5vdCBlbnZpc2lvbiBhbnkgb3RoZXIgY2FzZXMgd2hpbGUg d3JpdGluZyB0aGlzIGRvY3VtZW50Lg0KDQpJIGJlbGlldmUgaXQgd291ZGwgYmUgYWxzbyBpbXBv cnRhbnQgdG8gcmVtaW5kIHNvbWUgY2hhcmFjdGVyaXN0aWNzIG9mDQp0aGVzZSBncm91cHMuIFR5 cGljYWxseSBpdCBzZWVtcyB0aGVzZSBncm91cHMgZW52aXNpb25lZCBvbmUtdG8tbWFueQ0KY29t bXVuaWNhdGlvbiBhbmQgYXJlIG5vdCBoaWdobHkgZHluYW1pYy4gSSBiZWxpZXZlIGl0IHdvdWRs IGJlIGhlbHBmdWwNCnRvIGhhdmUgdGhlIGxpbWl0YXRpb25zIG9yIGNoYXJhY3RlcmlzdGljcyBv ZiB0aGVzZSBncm91cHMsIHNvIGZ1dHVyZQ0KYXBwbGljYXRpb24gY291bGQgZWFzaWx5IHNlZSBp ZiB0aGUga2V5IG1hbmFnZW1lbnQgcHJvcG9zZSBmaXRzIHRoZWlyDQpyZXF1aXJlbWVudHMuDQo8 L21nbHQ+DQoNCkZQOiBXZSBkbyBub3QgZW52aXNpb24gb25lLXRvLW1hbnkgb25seSBjb21tdW5p Y2F0aW9ucyBub3IgaGF2ZSBhbnkgcmVxdWlyZW1lbnRzIG9uIGR5bmFtaWNzLiBBcyBJIHNhaWQs IEkgZGlzYWdyZWUgd2l0aCByZXN0cmljdGluZyB0aGUgY29udGV4dCBvZiB0aGlzIHNwZWNpZmlj YXRpb24sIGFzIGRvaW5nIHNvIHdvdWxkIG9ubHkgbWFrZSBmdXR1cmUgc3BlY2lmaWNhdGlvbnMg aGFyZGVyLg0KDQoNCiAgIElmIHRoZSBhcHBsaWNhdGlvbiByZXF1aXJlcyBiYWNrd2FyZCBhbmQg Zm9yd2FyZCBzZWN1cml0eSwgdXBkYXRlZA0KICAga2V5aW5nIG1hdGVyaWFsIGlzIGdlbmVyYXRl ZCBhbmQgZGlzdHJpYnV0ZWQgdG8gdGhlIGdyb3VwIG1lbWJlcnMNCiAgIChyZWtleWluZyksIHdo ZW4gbWVtYmVyc2hpcCBjaGFuZ2VzLiAgQSBrZXkgbWFuYWdlbWVudCBzY2hlbWUNCiAgIHBlcmZv cm1zIHRoZSBhY3R1YWwgZGlzdHJpYnV0aW9uIG9mIHRoZSB1cGRhdGVkIGtleWluZyBtYXRlcmlh bCB0bw0KICAgdGhlIGdyb3VwLiAgSW4gcGFydGljdWxhciwgdGhlIGtleSBtYW5hZ2VtZW50IHNj aGVtZSByZWtleXMgdGhlDQogICBjdXJyZW50IGdyb3VwIG1lbWJlcnMgd2hlbiBhIG5ldyBub2Rl IGpvaW5zIHRoZSBncm91cCwgYW5kIHRoZQ0KICAgcmVtYWluaW5nIGdyb3VwIG1lbWJlcnMgd2hl biBhIG5vZGUgbGVhdmVzIHRoZSBncm91cC4gIFRoaXMgZG9jdW1lbnQNCiAgIHByb3ZpZGVzIGEg bWVzc2FnZSBmb3JtYXQgZm9yIGdyb3VwIHJla2V5aW5nIHRoYXQgYWxsb3dzIHRvIGZ1bGZpbGwN CiAgIHRoZXNlIHJlcXVpcmVtZW50cy4gIFJla2V5aW5nIG1lY2hhbmlzbXMgY2FuIGJlIGJhc2Vk IG9uIFtSRkMyMDkzXSwNCiAgIFtSRkMyMDk0XSBhbmQgW1JGQzI2MjddLg0KDQo8bWdsdD4NClRo ZSBsYXRlc3QgcGFyYWdyYXBoIHByb3ZpZGVzIGEgaGlnaCBsZXZlbCB2aWV3IG9mIGhvdyB0aGUg cHJvdG9jb2wNCndvcmtzLiBUaGlzIGlzIHZlcnkgaGVscGZ1bCwgYnV0IG1heWJlIGFkZGl0aW9u YWwgdGV4dCAtIG9yIGEgZGVkaWNhdGVkDQp1c2UgY2FzZSBzZWN0aW9uIG1heSBiZSBuZWVkZWQg dG8gcHJvdmlkZSB0aGUgZnVsbCBsaWZlIGN5Y2xlIG9mIHRoZQ0Ka2V5cy4gVHlwaWNhbGx5LCBJ IGFtIHdvbmRlcmluZyBvbmUgYSBncm91cCBrZXlzIGFyZSBtYW5hZ2VkIGF0IHRoZQ0KaW5pdGlh bGl6YXRpb24gb2YgdGhlIGdyb3VwLiBNeSBpbnRlcnByZXRhdGlvbiBvZiB0aGUgdGV4dCBpcyB0 aGF0IGlmIEkNCmhhdmUgMTAwMCBiYXR0ZXJ5IHBvd2VyIG1vdGVzIGluIG15IGhvbWUgYW5kIGVh Y2ggb2YgdGhlbSBqb2luIHRoZSBncm91cA0Kb25lIGJ5IG9uZSwgSSB3aWxsIGhhdmUgMTAwMCBr ZXkgdXBkYXRlcy4gSSBiZWxpZXZlIGl0IHdvdWxkIGJlIGdvb2QgdG8NCmNsYXJpZnkgdGhpcy4N Cg0KDQo8L21nbHQ+DQoNCkZQOiBZb3VyIGludGVycHJldGF0aW9uIGlzIGNvcnJlY3QuIEhvdyB0 aGF0IGlzIGRvbmUgc3BlY2lmaWNhbGx5IGRlcGVuZHMgb24gdGhlIG1hbmFnZW1lbnQgc2NoZW1l IG1lY2hhbmlzbSB1c2VkLCBhbmQgb3V0IG9mIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuIEkgZG9u 4oCZdCBrbm93IHdoYXQgZWxzZSB0byBhZGQsIGlmIEkgdW5kZXJzdGFuZCBjb3JyZWN0bHkgdGhl IGZvbGxvd2luZyBzZW50ZW5jZSBzaG91bGQgY292ZXIgd2hhdCB5b3Ugc2FpZDoNCiDigJxJbiBw YXJ0aWN1bGFyLCB0aGUga2V5IG1hbmFnZW1lbnQgc2NoZW1lIHJla2V5cyB0aGUNCiAgIGN1cnJl bnQgZ3JvdXAgbWVtYmVycyB3aGVuIGEgbmV3IG5vZGUgam9pbnMgdGhlIGdyb3VwLCBhbmQgdGhl DQogICByZW1haW5pbmcgZ3JvdXAgbWVtYmVycyB3aGVuIGEgbm9kZSBsZWF2ZXMgdGhlIGdyb3Vw LuKAnQ0KUGxlYXNlIGxldCBtZSBrbm93IGlmIHRoYXTigJlzIG5vdCB0aGUgY2FzZS4NCg0KDQox LjEuICBUZXJtaW5vbG9neQ0KDQogICBUaGUga2V5IHdvcmRzICJNVVNUIiwgIk1VU1QgTk9UIiwg IlJFUVVJUkVEIiwgIlNIQUxMIiwgIlNIQUxMIE5PVCIsDQogICAiU0hPVUxEIiwgIlNIT1VMRCBO T1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZIiwgYW5kICJPUFRJT05BTCIgaW4gdGhpcw0KICAgZG9j dW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBbUkZDMjExOV0uICBU aGVzZQ0KICAgd29yZHMgbWF5IGFsc28gYXBwZWFyIGluIHRoaXMgZG9jdW1lbnQgaW4gbG93ZXJj YXNlLCBhYnNlbnQgdGhlaXINCiAgIG5vcm1hdGl2ZSBtZWFuaW5ncy4NCg0KICAgUmVhZGVycyBh cmUgZXhwZWN0ZWQgdG8gYmUgZmFtaWxpYXIgd2l0aCB0aGUgdGVybXMgYW5kIGNvbmNlcHRzDQog ICBkZXNjcmliZWQgaW4gW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0gYW5kIFtSRkM4MTUyXSwg c3VjaCBhcw0KICAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgKEFTKSBhbmQgUmVzb3VyY2UgU2VydmVy IChSUykuDQoNCiAgIFRoaXMgZG9jdW1lbnQgYWRkaXRpb25hbGx5IHVzZXMgdGhlIGZvbGxvd2lu ZyB0ZXJtaW5vbG9neToNCg0KICAgbyAgVHJhbnNwb3J0IHByb2ZpbGUsIHRvIGluZGljYXRlIGEg cHJvZmlsZSBvZiBBQ0UgYXMgcGVyDQogICAgICBTZWN0aW9uIDUuNi40LjMgb2YgW0ktRC5pZXRm LWFjZS1vYXV0aC1hdXRoel0uICBUaGF0IGlzLCBhDQogICAgICB0cmFuc3BvcnQgcHJvZmlsZSBz cGVjaWZpZXMgdGhlIGNvbW11bmljYXRpb24gcHJvdG9jb2wgYW5kDQogICAgICBjb21tdW5pY2F0 aW9uIHNlY3VyaXR5IHByb3RvY29sIGJldHdlZW4gYW4gQUNFIENsaWVudCBhbmQgUmVzb3VyY2UN Cg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAg ICAgICAgICAgICAgICBbUGFnZSAzXQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmlu ZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQogICAgICBTZXJ2 ZXIsIGFzIHdlbGwgYXMgcHJvb2Ytb2YtcG9zc2Vzc2lvbiBtZXRob2RzLCBpZiBpdCBzdXBwb3J0 cw0KICAgICAgcHJvb2Ytb2YtcG9zc2Vzc2lvbiBhY2Nlc3MgdG9rZW5zLiAgVHJhbnBvcnQgcHJv ZmlsZXMgb2YgQUNFDQogICAgICBpbmNsdWRlLCBmb3IgaW5zdGFuY2UsIFtJLUQuaWV0Zi1hY2Ut b3Njb3JlLXByb2ZpbGVdLA0KICAgICAgW0ktRC5pZXRmLWFjZS1kdGxzLWF1dGhvcml6ZV0gYW5k IFtJLUQuaWV0Zi1hY2UtbXF0dC10bHMtcHJvZmlsZV0uDQoNCiAgIG8gIEFwcGxpY2F0aW9uIHBy b2ZpbGUsIHRvIGluZGljYXRlIGEgcHJvZmlsZSBvZiBBQ0UgdGhhdCBkZWZpbmVzIGhvdw0KICAg ICAgYXBwbGljYXRpb25zIGVuZm9yY2UgYW5kIHVzZSBzdXBwb3J0aW5nIHNlY3VyaXR5IHNlcnZp Y2VzIHRoZXkNCiAgICAgIHJlcXVpcmUuICBUaGVzZSBzZXJ2aWNlcyBpbmNsdWRlLCBmb3IgaW5z dGFuY2UsIHByb3Zpc2lvbmluZywNCiAgICAgIHJldm9jYXRpb24gYW5kIChyZS0pZGlzdHJpYnV0 aW9uIG9mIGtleWluZyBtYXRlcmlhbC4gIEFuDQogICAgICBhcHBsaWNhdGlvbiBwcm9maWxlIG1h eSBkZWZpbmUgc3BlY2lmaWMgcHJvY2VkdXJlcyBhbmQgbWVzc2FnZQ0KICAgICAgZm9ybWF0cy4N Cg0KMi4gIE92ZXJ2aWV3DQoNCiAgICAgICArLS0tLS0tLS0tLS0tKyAgICAgICAgICAgICAgICAg ICstLS0tLS0tLS0tLSsNCiAgICAgICB8ICAgICBBUyAgICAgfCAgICAgICAgICAgICAgICAgIHwg ICAgS0RDICAgIHwNCiAgICAgICB8ICAgICAgICAgICAgfCAgICAgICAgLi0tLS0tLS0tPnwgICAg ICAgICAgIHwNCiAgICAgICArLS0tLS0tLS0tLS0tKyAgICAgICAvICAgICAgICAgICstLS0tLS0t LS0tLSsNCiAgICAgICAgICAgICBeICAgICAgICAgICAgIC8NCiAgICAgICAgICAgICB8ICAgICAg ICAgICAgLw0KICAgICAgICAgICAgIHYgICAgICAgICAgIC8gICAgICAgICAgICAgICAgICAgICAg ICAgICArLS0tLS0tLS0tLS0rDQogICAgICAgKy0tLS0tLS0tLS0tLSsgICAvICAgICAgKy0tLS0t LS0tLS0tLSsgICAgICAgIHwrLS0tLS0tLS0tLS0rDQogICAgICAgfCAgIENsaWVudCAgIHw8LScg ICAgICAgfCBEaXNwYXRjaGVyIHwgICAgICAgIHx8Ky0tLS0tLS0tLS0tKw0KICAgICAgIHwgICAg ICAgICAgICB8PC0tLS0tLS0tPnwgICAgKFJTKSAgICB8PC0tLS0tLS0+fHwgICBHcm91cCAgIHwN CiAgICAgICArLS0tLS0tLS0tLS0tKyAgICAgICAgICArLS0tLS0tLS0tLS0tKyAgICAgICAgICt8 ICBtZW1iZXJzICB8DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgKy0tLS0tLS0tLS0tKw0KDQogICAgICAgICAgICAgICAgICBGaWd1cmUgMTog S2V5IERpc3RyaWJ1dGlvbiBQYXJ0aWNpcGFudHMNCg0KICAgVGhlIGZvbGxvd2luZyBwYXJ0aWNp cGFudHMgKHNlZSBGaWd1cmUgMSkgdGFrZSBwYXJ0IGluIHRoZQ0KICAgYXV0aG9yaXphdGlvbiBh bmQga2V5IGRpc3RyaWJ1dGlvbi4NCg0KICAgbyAgQ2xpZW50IChDKTogbm9kZSB0aGF0IHdhbnRz IHRvIGpvaW4gdGhlIGdyb3VwIGNvbW11bmljYXRpb24uICBJdA0KICAgICAgY2FuIHJlcXVlc3Qg d3JpdGUgYW5kL29yIHJlYWQgcmlnaHRzLg0KPG1nbHQ+DQpJIGFtIHdvbmRlcmluZyBpZiBvbmUg Y2FuIGhhdmUgd3JpdGUgYWNjZXNzIHdpdGhvdXQgaGF2aW5nIHJlYWQgYWNjZXNzLg0KSXQgc2Vl bXMgdG8gbWUgLSBidXQgSSBtaWdodCBiZSB3cm9uZyAtIHRoYXQgd3JpdGUgYWNjZXNzIHByb3Zp ZGVzIHJlYWQNCmFjY2Vzcy4gSWYgdGhhdCBpcyBjb3JyZWN0LCBJIGFtIHdvbmRlcmluZyBpZiB3 ZSBjb3VsZCBoYXZlIHJlYWQgb3INCndyaXRlLg0KDQpUaGUgZmlndXJlIHNlZW1zIHRvIGdpdmUg dHdvIHJvbGVzIG9mIHRoZSBDbGllbnQ6IDEpIHRoZSBhYmlsaXR5IHRvIGpvaW4NCnRoZSBncm91 cCB3aXRoIHNvbWUgaW50ZXJhY3Rpb25zIHdpdGggS0RDIGFzIHdlbGwgYXMgMikgdGhlIGFiaWxp dHkgdG8NCnNlbmQgbWVzc2FnZSB3aXRoIHNvbWUgaW50ZXJhY3Rpb25zIHdpdGggdGhlIERpc3Bh dGNoZXIuIEkgYW0gd29uZGVyaW5nDQppZiB0aGVyZSBhcmUgYW55IHJlYXNvbnMgdGhlIGxhdGVz dCBpcyBub3QgbWVudGlvbmVkLg0KPC9tZ2x0Pg0KDQpGUDogVGhhdCByZWFsbHkgZGVwZW5kcyBv biB0aGUgc3BlY2lmaWMgYXBwbGljYXRpb24gcHJvZmlsZS4gRm9yIGV4YW1wbGUsIGluIGdyb3Vw IE9TQ09SRSBhcHBsaWNhdGlvbiBwcm9maWxlLCBvbmUgY2FuIG5vdCBoYXZlIHdyaXRlIGFjY2Vz cyB3aXRob3V0IHJlYWQgYWNjZXNzLCBhbmQgdGhhdCBpcyBiZWNhdXNlIG9mIHRoZSB1c2Ugb2Yg c3ltbWV0cmljIGtleXMgdG8gcHJvdGVjdCB0aGUgY29tbXVuaWNhdGlvbi4gQnV0IEkgY291bGQg aW1hZ2luZSB0aGF0IGEgZGlmZmVyZW50IHByb2ZpbGUgY291bGQgdXNlIHNldmVyYWwgc3ltbWV0 cmljIGtleXMgYW5kIG1ha2UgdGhlIHJlYWQgdnMgd3JpdGUgd29yay4NClRoZSBsYXRlc3QgaXMg bm90IG1lbnRpb25lZCBzaW5jZSBpdCBpcyBub3QgcGFydCBvZiB0aGlzIGZyYW1ld29yaywgYnV0 IGlzIG9uZSBvZiB0aGUgcmVxdWlyZW1lbnRzIGxpc3RlZCBpbiBBcHBlbmRpeCBBIGFuZCB0aHJv dWdob3V0IHRoZSB0ZXh0IHRoYXQgdGhlIGFwcGxpY2F0aW9uIHByb2ZpbGVzIGhhdmUgdG8gZGVm aW5lLCB0byBtYWtlIGdyb3VwIGNvbW11bmljYXRpb24gd29yayAo4oCcd2hhdCBncm91cCBjb21t dW5pY2F0aW9uIHByb3RvY29sIGlzIHVzZWTigJ0pLg0KDQoNCiAgIG8gIEF1dGhvcml6YXRpb24g U2VydmVyIChBUyk6IHNhbWUgYXMgQVMgaW4gdGhlIEFDRSBGcmFtZXdvcms7IGl0DQogICAgICBl bmZvcmNlcyBhY2Nlc3MgcG9saWNpZXMsIGFuZCBrbm93cyBpZiBhIG5vZGUgaXMgYWxsb3dlZCB0 byBqb2luDQogICAgICB0aGUgZ3JvdXAgd2l0aCB3cml0ZSBhbmQvb3IgcmVhZCByaWdodHMuDQoN CiAgIG8gIEtleSBEaXN0cmlidXRpb24gQ2VudGVyIChLREMpOiBtYWludGFpbnMgdGhlIGtleWlu ZyBtYXRlcmlhbCB0bw0KICAgICAgcHJvdGVjdCBncm91cCBjb21tdW5pY2F0aW9ucywgYW5kIHBy b3ZpZGVzIGl0IHRvIENsaWVudHMNCiAgICAgIGF1dGhvcml6ZWQgdG8gam9pbiB0aGUgZ3JvdXAu ICBEdXJpbmcgdGhlIGZpcnN0IHBhcnQgb2YgdGhlDQogICAgICBleGNoYW5nZSAoU2VjdGlvbiAz KSwgaXQgdGFrZXMgdGhlIHJvbGUgb2YgdGhlIFJTIGluIHRoZSBBQ0UNCiAgICAgIEZyYW1ld29y ay4gIER1cmluZyB0aGUgc2Vjb25kIHBhcnQgKFNlY3Rpb24gNCksIHdoaWNoIGlzIG5vdCBiYXNl ZA0KICAgICAgb24gdGhlIEFDRSBGcmFtZXdvcmssIGl0IGRpc3RyaWJ1dGVzIHRoZSBrZXlpbmcg bWF0ZXJpYWwuICBJbg0KICAgICAgYWRkaXRpb24sIGl0IHByb3ZpZGVzIHRoZSBsYXRlc3Qga2V5 aW5nIG1hdGVyaWFsIHRvIGdyb3VwIG1lbWJlcnMNCiAgICAgIHdoZW4gcmVxdWVzdGVkLiAgSWYg cmVxdWlyZWQgYnkgdGhlIGFwcGxpY2F0aW9uLCB0aGUgS0RDIHJlbmV3cw0KDQoNCg0KDQpQYWxv bWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAg ICAgW1BhZ2UgNF0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3Vw IENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgICAgYW5kIHJlLWRpc3RyaWJ1 dGVzIHRoZSBrZXlpbmcgbWF0ZXJpYWwgaW4gdGhlIGdyb3VwIHdoZW4NCiAgICAgIG1lbWJlcnNo aXAgY2hhbmdlcy4NCg0KICAgbyAgRGlzcGF0Y2hlcjogZW50aXR5IHRocm91Z2ggd2hpY2ggdGhl IENsaWVudHMgY29tbXVuaWNhdGUgd2l0aCB0aGUNCiAgICAgIGdyb3VwIGFuZCB3aGljaCBkaXN0 cmlidXRlcyBtZXNzYWdlcyB0byB0aGUgZ3JvdXAgbWVtYmVycy4uDQogICAgICBFeGFtcGxlcyBv ZiBkaXNwYXRjaGVycyBhcmU6IHRoZSBCcm9rZXIgbm9kZSBpbiBhIHB1Yi1zdWIgc2V0dGluZzsN CiAgICAgIGEgcmVsYXllciBub2RlIGZvciBncm91cCBjb21tdW5pY2F0aW9uIHRoYXQgZGVsaXZl cnMgZ3JvdXANCiAgICAgIG1lc3NhZ2VzIGFzIG11bHRpcGxlIHVuaWNhc3QgbWVzc2FnZXMgdG8g YWxsIGdyb3VwIG1lbWJlcnM7IGFuDQogICAgICBpbXBsaWNpdCBlbnRpdHkgYXMgaW4gYSBtdWx0 aWNhc3QgY29tbXVuaWNhdGlvbiBzZXR0aW5nLCB3aGVyZQ0KICAgICAgbWVzc2FnZXMgYXJlIHRy YW5zbWl0dGVkIHRvIGEgbXVsdGljYXN0IElQIGFkZHJlc3MgYW5kIGRlbGl2ZXJlZA0KICAgICAg b24gdGhlIHRyYW5zcG9ydCBjaGFubmVsLg0KDQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyB0 aGUgbWVzc2FnZSBmbG93cyBhbmQgZm9ybWF0cyBmb3I6DQoNCiAgIG8gIEF1dGhvcml6aW5nIGEg bmV3IG5vZGUgdG8gam9pbiB0aGUgZ3JvdXAgKFNlY3Rpb24gMyksIGFuZA0KICAgICAgcHJvdmlk aW5nIGl0IHdpdGggdGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCB0byBjb21tdW5pY2F0ZSB3aXRo DQogICAgICB0aGUgb3RoZXIgZ3JvdXAgbWVtYmVycyAoU2VjdGlvbiA0KS4NCg0KICAgbyAgUmVt b3Zpbmcgb2YgYSBjdXJyZW50IG1lbWJlciBmcm9tIHRoZSBncm91cCAoU2VjdGlvbiA1KS4NCg0K ICAgbyAgUmV0cmlldmluZyBrZXlpbmcgbWF0ZXJpYWwgYXMgYSBjdXJyZW50IGdyb3VwIG1lbWJl ciAoU2VjdGlvbiA2DQogICAgICBhbmQgU2VjdGlvbiA3KS4NCg0KICAgbyAgUmVuZXdpbmcgYW5k IHJlLWRpc3RyaWJ1dGluZyB0aGUgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIChyZWtleWluZykNCiAg ICAgIHVwb24gYSBtZW1iZXJzaGlwIGNoYW5nZSBpbiB0aGUgZ3JvdXAgKFNlY3Rpb24gNC4yIGFu ZCBTZWN0aW9uIDUpLg0KDQogICBGaWd1cmUgMiBwcm92aWRlcyBhIGhpZ2ggbGV2ZWwgb3ZlcnZp ZXcgb2YgdGhlIG1lc3NhZ2UgZmxvdyBmb3IgYQ0KICAgbm9kZSBqb2luaW5nIGEgZ3JvdXAgY29t bXVuaWNhdGlvbiBzZXR0aW5nLg0KDQogIEMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBB UyAgICAgS0RDICAgRGlzcGF0Y2hlciAgICAgICAgICBHcm91cA0KICB8ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgfCAgICAgICB8ICAgICAgICB8ICAgICAgICAgICAgICAgTWVtYmVyDQog IHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgIHwgICAgICAgIHwgXCAgICAg ICAgICAgICAgIHwNCiAgfCAgICAgQXV0aG9yaXphdGlvbiBSZXF1ZXN0ICAgIHwgICAgICAgfCAg ICAgICAgfCB8IERlZmluZWQgICAgICAgfA0KICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0+fCAgICAgICB8ICAgICAgICB8IHwgaW4gdGhlIEFDRSAgICB8DQogIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgICAgIHwgICAgICAgIHwgfCBmcmFtZXdvcmsgICAgIHwNCiAg fCAgICAgQXV0aG9yaXphdGlvbiBSZXNwb25zZSAgIHwgICAgICAgfCAgICAgICAgfCB8ICAgICAg ICAgICAgICAgfA0KICB8PC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAgICAgICB8ICAg ICAgICB8IHwgICAgICAgICAgICAgICB8DQogIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgICAgIHwgICAgICAgIHwgfCAgICAgICAgICAgICAgIHwNCiAgfC0tLS0tLS0tLSBUb2tl biBQb3N0IC0tLS0tLS0tLS0tLS0tLS0+fCAgICAgICAgfCAvICAgICAgICAgICAgICAgfA0KICB8 ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICB8ICAgICAgICAg ICAgICAgICB8DQogIHwtLS0tIEtleSBEaXN0cmlidXRpb24gUmVxdWVzdCAtLS0tLS0tPnwgICAg ICAgIHwgICAgICAgICAgICAgICAgIHwNCiAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAgICAgfCAgICAgICAgICAgICAgICAgfA0KICB8PC0tLSBLZXkgRGlzdHJp YnV0aW9uIFJlc3BvbnNlIC0tLS0tLSB8IC0tLSBHcm91cCBSZWtleWluZyAtLS0tLT58DQogIHwg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAg ICAgICAgIHwNCiAgfDw9PT09PT09PT09PT09PT09PT0gUHJvdGVjdGVkIGNvbW11bmljYXRpb24g PT09fD09PT09PT09PT09PT09PT0+fA0KICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICB8DQoNCiAgICAgICAgICAgICAgRmln dXJlIDI6IE1lc3NhZ2UgRmxvdyBVcG9uIE5ldyBOb2RlJ3MgSm9pbmluZw0KPG1nbHQ+DQoiRGVm aW5lZCBpbiB0aGUgQUNFIGZyYW1ld29yayIgOiBpdCBpcyB1bmNsZWFyIHRvIG1lIGlmIGl0IGRl c2lnbmF0ZXMNCnRoZSBESXNwYXRjaGVyIG9mIHRoZSBBdXRob3JpemF0aW9uIGFuZCBUb2tlbiBQ b3N0IGV4Y2hhbmdlcy4gSSB0aGluaw0KdGhhdCBpcyB0aGUgbGF0ZXN0Lg0KDQpGUDogWWVzLCB0 aGF04oCZcyByaWdodC4gV2UgaGF2ZSBjaGFuZ2VkIHRoZSBmaWd1cmUgdG8gdHJ5IHRvIG1ha2Ug aXQgY2xlYXJlci4NCg0KSSB1bmRlcnN0YW5kIHRoZSBEaXNwYXRjaGVyIGlzIG5vdCBpbnZvbHZl ZCBpbiB0aGUgZGlzdHJpYnV0aW9uIG9mIHRoZQ0Ka2V5aW5nIG1hdGVyaWFsLCBidXQgb25seSB0 byB0aGUgZGlzdHJpYnV0aW9uIG9mIHRoZSBtZXNzYWdlcy4gSWYgdGhhdA0KaXMgY29ycmVjdCwg aXQgZG9lcyBub3QgYXBwZWFyIGNsZWFybHkgb24gdGhlIGZpZ3VyZSwgbWF5YmUgcGxhY2luZw0K RGlzcGF0Y2hlciBhbmQgR3JvdXAgTWVtYmVycyBiZWxvdyB0aGUgR3JvdXAgS2V5aW5nIGFycm93 IHdvdWxkIGNsYXJpZnkNCnRoaXMuLg0KDQpGUDogT2ssIGRvbmUuDQoNCkkgdGhpbmsgUHJvdGVj dGVkIGNvbW11bmljYXRpb24gaXMgbm90IGluIHRoZSBzY29wZSBvZiB0aGlzIGRyYWZ0LCBzbyBp dA0KbWlnaHQgc3BlY2lmaWVkIGFzIHdlbGwgYXMgaXQgaXMgYmVpbmcgZG9uZSBmb3IgdGhlIEFD RSBmcmFtZXdvcmsgLSBpZg0KdGhhdCBpcyBjb3JyZWN0Lg0KDQpGUDogVGhhdCBpcyBjb3JyZWN0 LiBBbmQgaXQgaXMgc3BlY2lmaWVkIGluIHRoZSBhcHBlbmRpeCBBIGFuZCBub3cgaW4gdGhlIG1h aW4gYm9keSBvZiB0aGUgZG9jdW1lbnQ6DQoNCuKAnCAgIFNwZWNpZmljIGFwcGxpY2F0aW9uIHBy b2ZpbGVzIHRoYXQgYnVpbGQgb24gdGhpcyBkb2N1bWVudCBNVVNUDQogICBzcGVjaWZ5IGhvdyBl eGFjdGx5IHRoZSBrZXlpbmcgbWF0ZXJpYWwgaXMgdXNlZCB0byBwcm90ZWN0IHRoZSBncm91cA0K ICAgY29tbXVuaWNhdGlvbg0K4oCcDQoNClByb3RlY3RlZCBjb21tdW5pY2F0aW9uIGlzIHVzdWFs bHkgaW50ZXJwcmV0ZWQgYXMgZW5kLXRvLWVuZCBzZWN1cml0eQ0KYW5kIHRoaXMgbWF5IG5vdCBi ZSBhY2hpZXZlZCB3aXRoIGdyb3VwIGNvbW11bmljYXRpb24uIE1heWJlIHNlY3VyZQ0KZ3JvdXAg Y29tbXVuaWNhdGlvbiBtaWdodCBiZSBtb3JlIGFwcHJvcHJpYXRlZC4uDQoNCkZQOiBPaywgZG9u ZS4NCg0KPC9tZ2x0Pg0KDQpGUDoNCg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBp cmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgICBbUGFnZSA1XQ0KDQpJbnRlcm5ldC1E cmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5 IDIwMTkNCg0KDQogICBUaGUgZXhjaGFuZ2Ugb2YgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IGFuZCBB dXRob3JpemF0aW9uIFJlc3BvbnNlDQogICBiZXR3ZWVuIENsaWVudCBhbmQgQVMgTVVTVCBiZSBz ZWN1cmVkLCBhcyBzcGVjaWZpZWQgYnkgdGhlIHRyYW5zcG9ydA0KICAgcHJvZmlsZSBvZiBBQ0Ug dXNlZCBiZXR3ZWVuIENsaWVudCBhbmQgS0RDLg0KDQogICBUaGUgZXhjaGFuZ2Ugb2YgS2V5IERp c3RyaWJ1dGlvbiBSZXF1ZXN0IGFuZCBLZXkgRGlzdHJpYnV0aW9uDQogICBSZXNwb25zZSBiZXR3 ZWVuIENsaWVudCBhbmQgS0RDIE1VU1QgYmUgc2VjdXJlZCwgYXMgYSByZXN1bHQgb2YgdGhlDQog ICB0cmFuc3BvcnQgcHJvZmlsZSBvZiBBQ0UgdXNlZCBiZXR3ZWVuIENsaWVudCBhbmQgS0RDLg0K DQogICBBbGwgZnVydGhlciBjb21tdW5pY2F0aW9ucyBiZXR3ZWVuIHRoZSBDbGllbnQgYW5kIHRo ZSBLREMgTVVTVCBiZQ0KICAgc2VjdXJlZCwgZm9yIGluc3RhbmNlIHdpdGggdGhlIHNhbWUgc2Vj dXJpdHkgbWVjaGFuaXNtIHVzZWQgZm9yIHRoZQ0KICAgS2V5IERpc3RyaWJ1dGlvbiBleGNoYW5n ZS4NCg0KICAgQWxsIGNvbW11bmljYXRpb25zIGJldHdlZW4gYSBDbGllbnQgYW5kIHRoZSBvdGhl ciBncm91cCBtZW1iZXJzIE1VU1QNCiAgIGJlIHNlY3VyZWQgdXNpbmcgdGhlIGtleWluZyBtYXRl cmlhbCBwcm92aWRlZCBpbiBTZWN0aW9uIDQuDQoNCjMuICBBdXRob3JpemF0aW9uIHRvIEpvaW4g YSBHcm91cA0KDQogICBUaGlzIHNlY3Rpb24gZGVzY3JpYmVzIGluIGRldGFpbCB0aGUgZm9ybWF0 IG9mIG1lc3NhZ2VzIGV4Y2hhbmdlZCBieQ0KICAgdGhlIHBhcnRpY2lwYW50cyB3aGVuIGEgbm9k ZSByZXF1ZXN0cyBhY2Nlc3MgdG8gYSBncm91cC4gIFRoZSBmaXJzdA0KICAgcGFydCBvZiB0aGUg ZXhjaGFuZ2UgaXMgYmFzZWQgb24gQUNFIFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdLg0KDQog ICBBcyBkZWZpbmVkIGluIFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdLCB0aGUgQ2xpZW50IHJl cXVlc3RzIGZyb20NCiAgIHRoZSBBUyBhbiBhdXRob3JpemF0aW9uIHRvIGpvaW4gdGhlIGdyb3Vw IHRocm91Z2ggdGhlIEtEQyAoc2VlDQogICBTZWN0aW9uIDMuMSkuICBJZiB0aGUgcmVxdWVzdCBp cyBhcHByb3ZlZCBhbmQgYXV0aG9yaXphdGlvbiBpcw0KICAgZ3JhbnRlZCwgdGhlIEFTIHByb3Zp ZGVzIHRoZSBDbGllbnQgd2l0aCBhIHByb29mLW9mLXBvc3Nlc3Npb24gYWNjZXNzDQogICB0b2tl biBhbmQgcGFyYW1ldGVycyB0byBzZWN1cmVseSBjb21tdW5pY2F0ZSB3aXRoIHRoZSBLREMgKHNl ZQ0KICAgU2VjdGlvbiAzLjIpLiAgQ29tbXVuaWNhdGlvbnMgYmV0d2VlbiB0aGUgQ2xpZW50IGFu ZCB0aGUgQVMgTVVTVCBiZQ0KICAgc2VjdXJlZCwgYWNjb3JkaW5nIHRvIHRoZSB0cmFuc3BvcnQg cHJvZmlsZSBvZiBBQ0UgdXNlZC4gIFRoZQ0KICAgQ29udGVudC1Gb3JtYXQgdXNlZCBpbiB0aGUg bWVzc2FnZXMgaXMgdGhlIG9uZSBzcGVjaWZpZWQgYnkgdGhlIHVzZWQNCiAgIHRyYW5zcG9ydCBw cm9maWxlIG9mIEFDRSAoZS5nLiBhcHBsaWNhdGlvbi9hY2UrY2JvciBmb3IgdGhlIGZpcnN0IHR3 bw0KICAgbWVzc2FnZXMgYW5kIGFwcGxpY2F0aW9uL2N3dCBmb3IgdGhlIHRoaXJkIG1lc3NhZ2Us IGRlcGVuZGluZyBvbiB0aGUNCiAgIGZvcm1hdCBvZiB0aGUgYWNjZXNzIHRva2VuKS4NCg0KICAg RmlndXJlIDMgZ2l2ZXMgYW4gb3ZlcnZpZXcgb2YgdGhlIGV4Y2hhbmdlIGRlc2NyaWJlZCBhYm92 ZS4NCg0KICAgICAgICAgQ2xpZW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBBUyAgS0RDDQogICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgfA0KICAgICAgICAgICAgfC0tLS0gQXV0aG9yaXphdGlv biBSZXF1ZXN0OiBQT1NUIC90b2tlbiAtLS0tLS0+fCAgIHwNCiAgICAgICAgICAgIHwgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICB8DQogICAgICAgICAg ICB8PC0tLSBBdXRob3JpemF0aW9uIFJlc3BvbnNlOiAyLjAxIChDcmVhdGVkKSAtLS18ICAgfA0K ICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIHwNCiAgICAgICAgICAgIHwtLS0tLSBQT1NUIFRva2VuOiBQT1NUIC9hdXRoei1pbmZv IC0tLS0tLS0tLS0tLS0tLT58DQogICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfA0KDQogICAgICAgICAgICAgICBGaWd1cmUgMzog TWVzc2FnZSBGbG93IG9mIEpvaW4gQXV0aG9yaXphdGlvbg0KDQoNCg0KDQoNCg0KUGFsb21iaW5p ICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgIFtQ YWdlIDZdDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21t dW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCjMuMS4gIEF1dGhvcml6YXRpb24gUmVxdWVz dA0KDQogICBUaGUgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IHNlbnQgZnJvbSB0aGUgQ2xpZW50IHRv IHRoZSBBUyBpcyBhcw0KICAgZGVmaW5lZCBpbiBTZWN0aW9uIDUuNi4xIG9mIFtJLUQuaWV0Zi1h Y2Utb2F1dGgtYXV0aHpdIGFuZCBNVVNUDQogICBjb250YWluIHRoZSBmb2xsb3dpbmcgcGFyYW1l dGVyczoNCg0KICAgbyAgJ2dyYW50X3R5cGUnLCB3aXRoIHZhbHVlICJjbGllbnRfY3JlZGVudGlh bHMiLg0KDQogICBBZGRpdGlvbmFsbHksIHRoZSBBdXRob3JpemF0aW9uIFJlcXVlc3QgTUFZIGNv bnRhaW4gdGhlIGZvbGxvd2luZw0KICAgcGFyYW1ldGVycywgd2hpY2gsIGlmIGluY2x1ZGVkLCBN VVNUIGhhdmUgdGhlIGNvcnJlc3BvbmRpbmcgdmFsdWVzOg0KDQo8bWdsdD4NCkkgYmVsaWV2ZSB0 aGUgdmFsdWUgaXMgdW5kZXJzdG9vZCBhcyB0aGUgdmFsdWUgaW4gYSBkaWN0aW9uYXJ5IChrZXks DQp2YWx1ZSkgLSByYXRoZXIgdGhlbiB0aGUgdmFsdWUgb2YgdGhlIHZhbHVlIGl0c2VsZi4NCg0K SSBzdWdnZXN0IHRvIHByb3ZpZGUgZXhwbGljaXRseSBob3cgdGhlIEFTIGJlaGF2ZXMgaWYgdGhl IHZhbHVlIGZvcm1hdA0KaXMgbm90IHJlY29nbml6ZWQgb3IgaWYgdGhlIHByb3ZpZGVkIHZhbHVl IGlzIHVua25vd24gdG8gdGhlIEFTLiBNb3JlDQpzcGVjaWZpY2FsbHksIGlzIHRoZSBwYXJhbWV0 ZXIgaWdub3JlZCBvciB0aGUgZXhjaGFuZ2UgYWJvcnRlZC4NCjwvbWdsdD4NCg0KRlA6IFRoaXMg c3BlY2lmaWMgZmllbGQgZGlzYXBwZWFyZWQgd2l0aCB1cGRhdGVzIGZvbGxvd2luZyBMdWR3aWfi gJlzIHJldmlldywgYnV0IHlvdXIgY29tbWVudHMgc3RpbGwgc3RhbmQgZm9yIGFsbCB0aGUgb3Ro ZXIgZmllbGRzLg0KVGhlIHBvaW50IGFib3V0IHZhbHVlIGlzIHZhbGlkLCBhbHRob3VnaCBJIHRo aW5rIHRoaXMgaXMgY2xlYXIgZW5vdWdoIGFuZCB0cnlpbmcgdG8gbWFrZSBpdCDigJxtb3JlIGNv cnJlY3TigJ0gd291bGQgbWFrZSBpdCBoYXJkZXIgdG8gcmVhZCAod2l0aCB2YWx1ZSBvZiB2YWx1 ZT8pLg0KQXMgdGhpcyBpcyB0aGUgQUNFIGV4Y2hhbmdlLCB0aGUgQUNFIHJ1bGVzIGFwcGx5IGhl cmUuIEkuZS4gZXJyb3IgbWVzc2FnZXMgYXBwbHkgaWYgdGhlIHBhcmFtZXRlcnMgYXJlIG5vdCBy ZWNvZ25pemVkIChzZWUgaHR0cHM6Ly9hY2Utd2cuZ2l0aHViLmlvL2FjZS1vYXV0aC9kcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoei5odG1sI2Vycm9yc1Rva2VuICkNCg0KDQogICBvICAnc2NvcGUn LCBjb250YWluaW5nIHRoZSBpZGVudGlmaWVyIG9mIHRoZSBzcGVjaWZpYyBncm91cCAob3IgdG9w aWMNCiAgICAgIGluIHRoZSBjYXNlIG9mIHB1Yi1zdWIpIHRoYXQgdGhlIENsaWVudCB3aXNoZXMg dG8gYWNjZXNzLCBhbmQNCiAgICAgIG9wdGlvbmFsbHkgdGhlIHJvbGUocykgdGhhdCB0aGUgQ2xp ZW50IHdpc2hlcyB0byB0YWtlLiAgVGhpcyB2YWx1ZQ0KICAgICAgaXMgYSBDQk9SIGFycmF5IGVu Y29kZWQgYXMgYSBieXRlIHN0cmluZywgd2hpY2ggY29udGFpbnM6DQoNCiAgICAgICogIEFzIGZp cnN0IGVsZW1lbnQsIHRoZSBpZGVudGlmaWVyIG9mIHRoZSBzcGVjaWZpYyBncm91cCBvcg0KICAg ICAgICAgdG9waWMuDQoNCiAgICAgICogIE9wdGlvbmFsbHksIGFzIHNlY29uZCBlbGVtZW50LCB0 aGUgcm9sZSAob3IgQ0JPUiBhcnJheSBvZg0KICAgICAgICAgcm9sZXMpIHRoZSBDbGllbnQgd2lz aGVzIHRvIHRha2UgaW4gdGhlIGdyb3VwLg0KDQogICAgICBUaGUgZW5jb2Rpbmcgb2YgdGhlIGdy b3VwIG9yIHRvcGljIGlkZW50aWZpZXIgYW5kIG9mIHRoZSByb2xlDQogICAgICBpZGVudGlmaWVy cyBpcyBhcHBsaWNhdGlvbiBzcGVjaWZpYy4NCg0KICAgbyAgJ2F1ZGllbmNlJywgd2l0aCBhbiBp ZGVudGlmaWVyIG9mIGEgS0RDLg0KDQogICBvICAncmVxX2NuZicsIGFzIGRlZmluZWQgaW4gU2Vj dGlvbiAzLjEgb2YNCiAgICAgIFtJLUQuaWV0Zi1hY2Utb2F1dGgtcGFyYW1zXSwgb3B0aW9uYWxs eSBjb250YWluaW5nIHRoZSBwdWJsaWMga2V5DQogICAgICBvciBhIHJlZmVyZW5jZSB0byB0aGUg cHVibGljIGtleSBvZiB0aGUgQ2xpZW50LCBpZiBpdCB3aXNoZXMgdG8NCiAgICAgIGNvbW11bmlj YXRlIHRoYXQgdG8gdGhlIEFTLg0KDQogICBvICBPdGhlciBhZGRpdGlvbmFsIHBhcmFtZXRlcnMg YXMgZGVmaW5lZCBpbg0KICAgICAgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0sIGlmIG5lY2Vz c2FyeS4NCg0KMy4yLiAgQXV0aG9yaXphdGlvbiBSZXNwb25zZQ0KDQogICBUaGUgQXV0aG9yaXph dGlvbiBSZXNwb25zZSBzZW50IGZyb20gdGhlIEFTIHRvIHRoZSBDbGllbnQgaXMgYXMNCiAgIGRl ZmluZWQgaW4gU2VjdGlvbiA1LjYuMiBvZiBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XSBhbmQg TVVTVA0KICAgY29udGFpbiB0aGUgZm9sbG93aW5nIHBhcmFtZXRlcnM6DQoNCiAgIG8gICdhY2Nl c3NfdG9rZW4nLCBjb250YWluaW5nIHRoZSBwcm9vZi1vZi1wb3NzZXNzaW9uIGFjY2VzcyB0b2tl bi4NCg0KICAgbyAgJ2NuZicgaWYgc3ltbWV0cmljIGtleXMgYXJlIHVzZWQsIG5vdCBwcmVzZW50 IGlmIGFzeW1tZXRyaWMga2V5cw0KICAgICAgYXJlIHVzZWQuICBUaGlzIHBhcmFtZXRlciBpcyBk ZWZpbmVkIGluIFNlY3Rpb24gMy4yIG9mDQogICAgICBbSS1ELmlldGYtYWNlLW9hdXRoLXBhcmFt c10gYW5kIGNvbnRhaW5zIHRoZSBzeW1tZXRyaWMgcHJvb2Ytb2YtDQogICAgICBwb3NzZXNzaW9u IGtleSB0aGF0IHRoZSBDbGllbnQgaXMgc3VwcG9zZWQgdG8gdXNlIHdpdGggdGhlIEtEQy4NCg0K DQoNCg0KUGFsb21iaW5pICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAg ICAgICAgICAgICAgIFtQYWdlIDddDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5n IGZvciBHcm91cCBDb21tdW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCiAgIG8gICdyc19j bmYnIGlmIGFzeW1tZXRyaWMga2V5cyBhcmUgdXNlZCwgbm90IHByZXNlbnQgaWYgc3ltbWV0cmlj DQogICAgICBrZXlzIGFyZSB1c2VkLiAgVGhpcyBwYXJhbWV0ZXIgaXMgYXMgZGVmaW5lZCBpbiBT ZWN0aW9uIDMuMiBvZg0KICAgICAgW0ktRC5pZXRmLWFjZS1vYXV0aC1wYXJhbXNdIGFuZCBjb250 YWlucyBpbmZvcm1hdGlvbiBhYm91dCB0aGUNCiAgICAgIHB1YmxpYyBrZXkgb2YgdGhlIEtEQy4N Cg0KICAgbyAgJ2V4cCcsIGNvbnRhaW5zIHRoZSBsaWZldGltZSBpbiBzZWNvbmRzIG9mIHRoZSBh Y2Nlc3MgdG9rZW4uICBUaGlzDQogICAgICBwYXJhbWV0ZXIgTUFZIGJlIG9taXR0ZWQgaWYgdGhl IGFwcGxpY2F0aW9uIGRlZmluZXMgaG93IHRoZQ0KICAgICAgZXhwaXJhdGlvbiB0aW1lIGlzIGNv bW11bmljYXRlZCB0byB0aGUgQ2xpZW50IHZpYSBvdGhlciBtZWFucywgb3INCiAgICAgIGlmIGl0 IGVzdGFibGlzaGVzIGEgZGVmYXVsdCB2YWx1ZS4NCg0KICAgQWRkaXRpb25hbGx5LCB0aGUgQXV0 aG9yaXphdGlvbiBSZXNwb25zZSBNQVkgY29udGFpbiB0aGUgZm9sbG93aW5nDQogICBwYXJhbWV0 ZXJzLCB3aGljaCwgaWYgaW5jbHVkZWQsIE1VU1QgaGF2ZSB0aGUgY29ycmVzcG9uZGluZyB2YWx1 ZXM6DQoNCjxtZ2x0Pg0KU2FtZSBjb21tZW50IGFzIGFib3ZlIHJlZ2FyZGluZyB0aGUgTVVTVCBz dGF0ZW1lbnQuDQo8L21nbHQ+DQoNCkZQOiBBcyB0aGlzIGlzIHN0aWxsIHBhcnQgb2YgdGhlIEFD RSBleGNoYW5nZSwgdGhlIGJlaGF2aW91ciBvZiB0aGUgY2xpZW50IGluIGNhc2Ugb2YgZXJyb3Ig aXMgZGVmaW5lZCB0aGVyZS4NCg0KDQogICBvICAnc2NvcGUnLCB3aGljaCBtaXJyb3JzIHRoZSAn c2NvcGUnIHBhcmFtZXRlciBpbiB0aGUgQXV0aG9yaXphdGlvbg0KICAgICAgUmVxdWVzdCAoc2Vl IFNlY3Rpb24gMy4xKS4gIEl0cyB2YWx1ZSBpcyBhIENCT1IgYXJyYXkgZW5jb2RlZCBhcyBhDQog ICAgICBieXRlIHN0cmluZywgY29udGFpbmluZzoNCg0KICAgICAgKiAgQXMgZmlyc3QgZWxlbWVu dCwgdGhlIGlkZW50aWZpZXIgb2YgdGhlIHNwZWNpZmljIGdyb3VwIG9yIHRvcGljDQogICAgICAg ICB0aGUgQ2xpZW50IGlzIGF1dGhvcml6ZWQgdG8gYWNjZXNzLg0KDQogICAgICAqICBPcHRpb25h bGx5LCBhcyBzZWNvbmQgZWxlbWVudCwgdGhlIHJvbGUgKG9yIENCT1IgYXJyYXkgb2YNCiAgICAg ICAgIHJvbGVzKSB0aGUgQ2xpZW50IGlzIGF1dGhvcml6ZWQgdG8gdGFrZSBpbiB0aGUgZ3JvdXAu DQoNCiAgICAgIFRoZSBlbmNvZGluZyBvZiB0aGUgZ3JvdXAgb3IgdG9waWMgaWRlbnRpZmllciBh bmQgb2YgdGhlIHJvbGUNCiAgICAgIGlkZW50aWZpZXJzIGlzIGFwcGxpY2F0aW9uIHNwZWNpZmlj Lg0KDQogICBvICBPdGhlciBhZGRpdGlvbmFsIHBhcmFtZXRlcnMgYXMgZGVmaW5lZCBpbg0KICAg ICAgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0sIGlmIG5lY2Vzc2FyeS4NCg0KICAgVGhlIGFj Y2VzcyB0b2tlbiBNVVNUIGNvbnRhaW4gYWxsIHRoZSBwYXJhbWV0ZXJzIGRlZmluZWQgYWJvdmUN CiAgIChpbmNsdWRpbmcgdGhlIHNhbWUgJ3Njb3BlJyBhcyBpbiB0aGlzIG1lc3NhZ2UsIGlmIHBy ZXNlbnQsIG9yIHRoZQ0KICAgJ3Njb3BlJyBvZiB0aGUgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IG90 aGVyd2lzZSksIGFuZCBhZGRpdGlvbmFsbHkNCiAgIG90aGVyIG9wdGlvbmFsIHBhcmFtZXRlcnMg dGhhdCB0aGUgdHJhbnNwb3J0IHByb2ZpbGUgb2YgQUNFIHJlcXVpcmVzLg0KDQogICBXaGVuIHJl Y2VpdmluZyBhbiBBdXRob3JpemF0aW9uIFJlcXVlc3QgZnJvbSBhIENsaWVudCB0aGF0IHdhcw0K ICAgcHJldmlvdXNseSBhdXRob3JpemVkLCBhbmQgd2hpY2ggc3RpbGwgb3ducyBhIHZhbGlkIG5v biBleHBpcmVkDQogICBhY2Nlc3MgdG9rZW4sIHRoZSBBUyByZXBsaWVzIHdpdGggYW4gQXV0aG9y aXphdGlvbiBSZXNwb25zZSB3aXRoIGENCiAgIG5ldyBhY2Nlc3MgdG9rZW4uDQoNCjMuMy4gIFRv a2VuIFBvc3QNCg0KICAgVGhlIENsaWVudCBzZW5kcyBhIENvQVAgUE9TVCByZXF1ZXN0IGluY2x1 ZGluZyB0aGUgYWNjZXNzIHRva2VuIHRvDQogICB0aGUgS0RDLCBhcyBzcGVjaWZpZWQgaW4gU2Vj dGlvbiA1LjguMSBvZiBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XS4NCiAgIElmIHRoZSBzcGVj aWZpYyB0cmFuc3BvcnQgcHJvZmlsZSBvZiBBQ0UgZGVmaW5lcyBpdCwgdGhlIENsaWVudCBNQVkN CiAgIHVzZSBhIGRpZmZlcmVudCBlbmRwb2ludCB0aGFuIC9hdXRoei1pbmZvIGF0IHRoZSBLREMg dG8gcG9zdCB0aGUNCiAgIGFjY2VzcyB0b2tlbiB0by4NCg0KDQoNCg0KDQpQYWxvbWJpbmkgJiBU aWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICAgW1BhZ2Ug OF0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmlj YXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgT3B0aW9uYWxseSwgdGhlIENsaWVudCBtaWdo dCBuZWVkIHRvIHJlcXVlc3QgbmVjZXNzYXJ5IGluZm9ybWF0aW9uDQogICBjb25jZXJuaW5nIHRo ZSBwdWJsaWMga2V5cyBpbiB0aGUgZ3JvdXAsIGFzIHdlbGwgYXMgY29uY2VybmluZyB0aGUNCiAg IGFsZ29yaXRobSBhbmQgcmVsYXRlZCBwYXJhbWV0ZXJzIGZvciBjb21wdXRpbmcgc2lnbmF0dXJl cyBpbiB0aGUNCiAgIGdyb3VwLiAgSW4gc3VjaCBhIGNhc2UsIHRoZSBqb2luaW5nIG5vZGUgTUFZ IGFzayBmb3IgdGhhdCBpbmZvcm1hdGlvbg0KICAgdG8gdGhlIEtEQyBpbiB0aGlzIHNhbWUgcmVx dWVzdC4gIFRvIHRoaXMgZW5kLCBpdCBzZW5kcyB0aGUgQ29BUCBQT1NUDQogICByZXF1ZXN0IHRv IHRoZSAvYXV0aHotaW5mbyBlbmRwb2ludCB1c2luZyB0aGUgQ29udGVudC1Gb3JtYXQNCiAgICJh cHBsaWNhdGlvbi9hY2UrY2JvciIgZGVmaW5lZCBpbiBTZWN0aW9uIDguMTQgb2YNCiAgIFtJLUQu aWV0Zi1hY2Utb2F1dGgtYXV0aHpdLCBhbmQgaW5jbHVkZXMgYWxzbyB0aGUgZm9sbG93aW5nDQog ICBwYXJhbWV0ZXJzOg0KDQo8bWdsdD4NClRoYXQgdGhlIENsaWVudCBNQVkgYXNrIGZvciB0aGlz IGluZm9ybWF0aW9uIHN1Z2dlc3RzIHRoYXQgdGhpcyBpcyBub3QNCm5lY2Vzc2FyeS4gSXQgd291 bGQgbWF5YmUgd29ydGggaW5kaWNhdGluZyB3aGVuIHRoZXNlIGluZm9ybWF0aW9uIGFyZSBub3QN CnJlcXVlc3RlZC4gSSBzZWUgdHdvIGNhc2VzIDEpIHdoZW4gcHVibGljIGtleSBpcyBub3QgaW52 b2x2ZWQsIGFuZCAyKQ0Kd2hlbiB0aGlzIGlzIHByZS1jb25maWd1cmVkIG9yIHByb3ZpZGVkIGJ5 IG90aGVyIG1lYW5zLg0KDQpJIGFtIG5vdCBzdXJlIHRoZXNlIGNhc2VzIG1ha2Ugc2Vuc2VzLCBi dXQgaW4gdGhlIGxhdGVzdCBjYXNlcywgaXQgd291bGQNCmJlIGdvb2QgdG8gc3BlY2lmeSB3aHkg d2UgZG8gbm90IGVuZCB1cCBpbiBhIGRlYWQgbG9jay4NCg0KUHVibGljIGtleSBpcyBhc3NvY2lh dGVkIHdpdGggYXV0aGVudGljYXRpb24uIEkgdW5kZXJzdGFuZCB0aGF0IHRoZQ0KYXV0aGVudGlj YXRpb24gaXMgbmVjZXNzYXJ5IHRvIHRoZSBSUyByYXRoZXIgdGhhbiB0aGUgZ3JvdXAgbWVtYmVy cy4gSWYNCnRoYXQgaXMgY29ycmVjdCwgSSBiZWxpZXZlIHRoYXQgc3BlY2lmeWluZyB0aGUgZW50 aXR5IGFzc29jaWF0ZWQgdG8gdGhlDQpwdWJsaWMga2V5IC0gaGVyZSB0aGUgUlMgLSB3b3VsZCBi ZSBjbGVhcmVyLg0KDQo8L21nbHQ+DQoNCkZQOiBUaGUgZmlyc3Qgc2VudGVuY2UgaW4gdGhlIHBh cmFncmFwaCBpcyBtZWFudCB0byBpbmRpY2F0ZSB3aGVuIHRoZXNlIGluZm9ybWF0aW9uIGFyZSBy ZXF1ZXN0ZWQuIFdlIGRvIHdhbnQgdG8ga2VlcCB0aGlzIGFzIGdlbmVyYWwgYXMgcG9zc2libGUg YmVjYXVzZSB3ZSBtaWdodCBub3Qga25vdyB3aGF0IHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlcyB3 aWxsIG5lZWQuDQpUaGUgcG9pbnQgaXMgdGhhdCBldmVuIGlmIHRoaXMgaW5mb3JtYXRpb24gaXMg bm90IHNlbnQgaGVyZSBpbiB0aGlzIHRva2VuIFBPU1QsIGl0IGNhbiBiZSByZXRyaWV2ZWQgaW4g dGhlIGZvbGxvd2luZyBleGNoYW5nZS4gQW5kIGFib3V0IHRoZSBwdWJsaWMga2V5LCBubyB0aGF0 IHdvdWxkIGJlIHRoZSBwdWJsaWMga2V5cyBvZiB0aGUgZ3JvdXAgbWVtYmVycy4gVGhpcyBpcyBn ZW5lcmFsIGluZm9ybWF0aW9uIG9mIGVuY29kaW5nIG9mIHB1YmxpYyBrZXlzLCBub3QgdGhlIHB1 YmxpYyBrZXlzIHRoZW1zZWx2ZXMuDQoNCg0KICAgbyAgJ3NpZ25faW5mbycgZGVmaW5lZCBpbiBT ZWN0aW9uIDMuMy4xLCBlbmNvZGluZyB0aGUgQ0JPUiBzaW1wbGUNCiAgICAgIHZhbHVlIE51bGws IHRvIHJlcXVpcmUgaW5mb3JtYXRpb24gYW5kIHBhcmFtZXRlcnMgb24gdGhlIHNpZ25hdHVyZQ0K ICAgICAgYWxnb3JpdGhtIGFuZCBvbiB0aGUgcHVibGljIGtleXMgdXNlZCBpbiB0aGUgZ3JvdXAu DQoNCiAgIG8gICdwdWJfa2V5X2VuYycgZGVmaW5lZCBpbiBTZWN0aW9uIDMuMy4yLCBlbmNvZGlu ZyB0aGUgQ0JPUiBzaW1wbGUNCiAgICAgIHZhbHVlIE51bGwsIHRvIHJlcXVpcmUgaW5mb3JtYXRp b24gb24gdGhlIGV4YWN0IGVuY29kaW5nIG9mIHB1YmxpYw0KICAgICAga2V5cyB1c2VkIGluIHRo ZSBncm91cC4NCg0KICAgVGhlIENEREwgbm90YXRpb24gb2YgdGhlICdzaWduX2luZm8nIGFuZCAn cHViX2tleV9lbmMnIHBhcmFtZXRlcnMNCiAgIGZvcm1hdHRlZCBhcyBpbiB0aGUgcmVxdWVzdCBp cyBnaXZlbiBiZWxvdy4NCg0KICAgICAgc2lnbl9pbmZvX3JlcSA9IG5pbA0KDQogICAgICBwdWJf a2V5X2VuY19yZXEgPSBuaWwNCg0KICAgQWx0ZXJuYXRpdmVseSwgdGhlIGpvaW5pbmcgbm9kZSBt YXkgcmV0cmlldmUgdGhpcyBpbmZvcm1hdGlvbiBieQ0KICAgb3RoZXIgbWVhbnMuDQoNCiAgIEFm dGVyIHN1Y2Nlc3NmdWwgdmVyaWZpY2F0aW9uLCB0aGUgQ2xpZW50IGlzIGF1dGhvcml6ZWQgdG8g cmVjZWl2ZQ0KICAgdGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCBmcm9tIHRoZSBLREMgYW5kIGpv aW4gdGhlIGdyb3VwLiAgSW4NCiAgIHBhcnRpY3VsYXIsIHRoZSBLREMgcmVwbGllcyB0byB0aGUg Q2xpZW50IHdpdGggYSAyLjAxIChDcmVhdGVkKQ0KICAgcmVzcG9uc2UsIHVzaW5nIENvbnRlbnQt Rm9ybWF0ICJhcHBsaWNhdGlvbi9hY2UrY2JvciIgZGVmaW5lZCBpbg0KICAgU2VjdGlvbiA4LjE0 IG9mIFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdLg0KDQogICBUaGUgcGF5bG9hZCBvZiB0aGUg Mi4wMSByZXNwb25zZSBpcyBhIENCT1IgbWFwLCB3aGljaCBNVVNUIGluY2x1ZGUgYQ0KICAgbm9u Y2UgTiBnZW5lcmF0ZWQgYnkgdGhlIEtEQy4gIFRoZSBDbGllbnQgbWF5IHVzZSB0aGlzIG5vbmNl IGZvcg0KICAgcHJvdmluZyB0aGUgcG9zc2Vzc2lvbiBvZiBpdHMgb3duIHByaXZhdGUga2V5IChz ZWUgdGhlDQogICAnY2xpZW50X2NyZWRfdmVyaWZ5JyBwYXJhbWV0ZXIgaW4gU2VjdGlvbiA0KS4N Cg0KICAgT3B0aW9uYWxseSwgaWYgdGhleSB3ZXJlIGluY2x1ZGVkIGluIHRoZSByZXF1ZXN0LCB0 aGUgQVMgTUFZIGluY2x1ZGUNCiAgIHRoZSAnc2lnbl9pbmZvJyBwYXJhbWV0ZXIgYXMgd2VsbCBh cyB0aGUgJ3B1Yl9rZXlfZW5jJyBwYXJhbWV0ZXINCiAgIGRlZmluZWQgaW4gU2VjdGlvbiAzLjMu MSBhbmQgU2VjdGlvbiAzLjMuMiBvZiB0aGlzIHNwZWNpZmljYXRpb24sDQogICByZXNwZWN0aXZl bHkuDQoNCiAgIFRoZSAnc2lnbl9pbmZvJyBwYXJhbWV0ZXIgTVVTVCBiZSBwcmVzZW50IGlmIHRo ZSBQT1NUIHJlcXVlc3QNCiAgIGluY2x1ZGVkIHRoZSAnc2lnbl9pbmZvJyBwYXJhbWV0ZXIgd2l0 aCB2YWx1ZSBOdWxsLiAgSWYgcHJlc2VudCwgdGhlDQogICAnc2lnbl9pbmZvJyBwYXJhbWV0ZXIg b2YgdGhlIDIuMDEgKENyZWF0ZWQpIHJlc3BvbnNlIGlzIGEgQ0JPUiBhcnJheQ0KICAgZm9ybWF0 dGVkIGFzIGZvbGxvd3MuDQoNCg0KDQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBK YW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICAgW1BhZ2UgOV0NCg0KSW50ZXJuZXQtRHJhZnQg IEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5 DQoNCg0KICAgbyAgVGhlIGZpcnN0IGVsZW1lbnQgJ3NpZ25fYWxnJyBpcyBhbiBpbnRlZ2VyIG9y IGEgdGV4dCBzdHJpbmcsDQogICAgICBpbmRpY2F0aW5nIHRoZSBzaWduYXR1cmUgYWxnb3JpdGht IHVzZWQgaW4gdGhlIGdyb3VwLiAgSXQgaXMNCiAgICAgIHJlcXVpcmVkIG9mIHRoZSBhcHBsaWNh dGlvbiBwcm9maWxlcyB0byBkZWZpbmUgc3BlY2lmaWMgdmFsdWVzIGZvcg0KICAgICAgdGhpcyBw YXJhbWV0ZXIuDQoNCiAgIG8gIFRoZSBzZWNvbmQgZWxlbWVudCAnc2lnbl9wYXJhbWV0ZXJzJyBp bmRpY2F0ZXMgdGhlIHBhcmFtZXRlcnMgb2YNCiAgICAgIHRoZSBzaWduYXR1cmUgYWxnb3JpdGht LiAgSXRzIHN0cnVjdHVyZSBkZXBlbmRzIG9uIHRoZSB2YWx1ZSBvZg0KICAgICAgJ3NpZ25fYWxn Jy4gIEl0IGlzIHJlcXVpcmVkIG9mIHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlcyB0byBkZWZpbmUN CiAgICAgIHNwZWNpZmljIHZhbHVlcyBmb3IgdGhpcyBwYXJhbWV0ZXIuICBJZiBubyBwYXJhbWV0 ZXJzIG9mIHRoZQ0KICAgICAgc2lnbmF0dXJlIGFsZ29yaXRobSBhcmUgc3BlY2lmaWVkLCAnc2ln bl9wYXJhbWV0ZXJzJyBNVVNUIGJlDQogICAgICBlbmNvZGluZyB0aGUgQ0JPUiBzaW1wbGUgdmFs dWUgTnVsbC4NCg0KICAgbyAgVGhlIHRoaXJkIGVsZW1lbnQgJ3NpZ25fa2V5X3BhcmFtZXRlcnMn IGluZGljYXRlcyB0aGUgcGFyYW1ldGVycw0KICAgICAgb2YgdGhlIGtleSB1c2VkIHdpdGggdGhl IHNpZ25hdHVyZSBhbGdvcml0aG0uICBJdHMgc3RydWN0dXJlDQogICAgICBkZXBlbmRzIG9uIHRo ZSB2YWx1ZSBvZiAnc2lnbl9hbGcnLiAgSXQgaXMgcmVxdWlyZWQgb2YgdGhlDQogICAgICBhcHBs aWNhdGlvbiBwcm9maWxlcyB0byBkZWZpbmUgc3BlY2lmaWMgdmFsdWVzIGZvciB0aGlzIHBhcmFt ZXRlci4NCiAgICAgIElmIG5vIHBhcmFtZXRlcnMgb2YgdGhlIGtleSB1c2VkIHdpdGggdGhlIHNp Z25hdHVyZSBhbGdvcml0aG0gYXJlDQogICAgICBzcGVjaWZpZWQsICdzaWduX2tleV9wYXJhbWV0 ZXJzJyBNVVNUIGJlIGVuY29kaW5nIHRoZSBDQk9SIHNpbXBsZQ0KICAgICAgdmFsdWUgTnVsbC4N Cg0KICAgVGhlICdwdWJfa2V5X2VuYycgcGFyYW1ldGVyIE1VU1QgYmUgcHJlc2VudCBpZiB0aGUg UE9TVCByZXF1ZXN0DQogICBpbmNsdWRlZCB0aGUgJ3B1Yl9rZXlfZW5jJyBwYXJhbWV0ZXIgd2l0 aCB2YWx1ZSBOdWxsLiAgSWYgcHJlc2VudCwNCiAgIHRoZSAncHViX2tleV9lbmMnIHBhcmFtZXRl ciBvZiB0aGUgMi4wMSAoQ3JlYXRlZCkgcmVzcG9uc2UgaXMgYSBDQk9SDQogICBpbnRlZ2VyLCBp bmRpY2F0aW5nIHRoZSBlbmNvZGluZyBvZiBwdWJsaWMga2V5cyB1c2VkIGluIHRoZSBncm91cC4N CiAgIFRoZSB2YWx1ZXMgb2YgdGhpcyBmaWVsZCBhcmUgcmVnaXN0ZXJlZCBpbiB0aGUgIkFDRSBQ dWJsaWMgS2V5DQogICBFbmNvZGluZyIgUmVnaXN0cnksIGRlZmluZWQgaW4gU2VjdGlvbiAxMS4y LiAgSXQgaXMgcmVxdWlyZWQgb2YgdGhlDQogICBhcHBsaWNhdGlvbiBwcm9maWxlcyB0byBkZWZp bmUgc3BlY2lmaWMgdmFsdWVzIHRvIHVzZSBmb3IgdGhpcw0KICAgcGFyYW1ldGVyLg0KDQogICBU aGUgQ0RETCBub3RhdGlvbiBvZiB0aGUgJ3NpZ25faW5mbycgYW5kICdwdWJfa2V5X2VuYycgcGFy YW1ldGVycw0KICAgZm9ybWF0dGVkIGFzIGluIHRoZSByZXNwb25zZSBpcyBnaXZlbiBiZWxvdy4N Cg0KICAgICAgc2lnbl9pbmZvX3JlcyA9IFsNCiAgICAgICAgc2lnbl9hbGcgOiBpbnQgLyB0c3Ry LA0KICAgICAgICBzaWduX3BhcmFtZXRlcnMgOiBhbnkgLyBuaWwsDQogICAgICAgIHNpZ25fa2V5 X3BhcmFtZXRlcnMgOiBhbnkgLyBuaWwNCiAgICAgIF0NCg0KICAgICAgcHViX2tleV9lbmNfcmVz ID0gaW50DQoNCiAgIE5vdGUgdGhhdCB0aGUgQ0JPUiBtYXAgc3BlY2lmaWVkIGFzIHBheWxvYWQg b2YgdGhlIDIuMDEgKENyZWF0ZWQpDQogICByZXNwb25zZSBtYXkgaW5jbHVkZSBmdXJ0aGVyIHBh cmFtZXRlcnMsIGUuZy4gYWNjb3JkaW5nIHRvIHRoZQ0KICAgc2lnbmFsbGVkIHRyYW5zcG9ydCBw cm9maWxlIG9mIEFDRS4NCg0KICAgTm90ZSB0aGF0IHRoaXMgc3RlcCBjb3VsZCBiZSBtZXJnZWQg d2l0aCB0aGUgZm9sbG93aW5nIG1lc3NhZ2UgZnJvbQ0KICAgdGhlIENsaWVudCB0byB0aGUgS0RD LCBuYW1lbHkgS2V5IERpc3RyaWJ1dGlvbiBSZXF1ZXN0Lg0KDQoNCg0KDQoNClBhbG9tYmluaSAm IFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdl IDEwXQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVu aWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQozLjMuMS4gICdzaWduX2luZm8nIFBhcmFtZXRl cg0KDQogICBUaGUgJ3NpZ25faW5mbycgcGFyYW1ldGVyIGlzIGFuIE9QVElPTkFMIHBhcmFtZXRl ciBvZiB0aGUgQVMgUmVxdWVzdA0KICAgQ3JlYXRpb24gSGludHMgbWVzc2FnZSBkZWZpbmVkIGlu IFNlY3Rpb24gNS4xLjIuIG9mDQogICBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XS4gIFRoaXMg cGFyYW1ldGVyIGNvbnRhaW5zIGluZm9ybWF0aW9uIGFuZA0KICAgcGFyYW1ldGVycyBhYm91dCB0 aGUgc2lnbmF0dXJlIGFsZ29yaXRobSBhbmQgdGhlIHB1YmxpYyBrZXlzIHRvIGJlDQogICB1c2Vk IGJldHdlZW4gdGhlIENsaWVudCBhbmQgdGhlIFJTLiAgSXRzIGV4YWN0IGNvbnRlbnQgaXMgYXBw bGljYXRpb24NCiAgIHNwZWNpZmljLg0KDQozLjMuMi4gICdwdWJfa2V5X2VuYycgUGFyYW1ldGVy DQoNCiAgIFRoZSAncHViX2tleV9lbmMnIHBhcmFtZXRlciBpcyBhbiBPUFRJT05BTCBwYXJhbWV0 ZXIgb2YgdGhlIEFTDQogICBSZXF1ZXN0IENyZWF0aW9uIEhpbnRzIG1lc3NhZ2UgZGVmaW5lZCBp biBTZWN0aW9uIDUuMS4yLiBvZg0KICAgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0uICBUaGlz IHBhcmFtZXRlciBjb250YWlucyBpbmZvcm1hdGlvbg0KICAgYWJvdXQgdGhlIGV4YWN0IGVuY29k aW5nIG9mIHB1YmxpYyBrZXlzIHRvIGJlIHVzZWQgYmV0d2VlbiB0aGUgQ2xpZW50DQogICBhbmQg dGhlIFJTLiAgSXRzIGV4YWN0IGNvbnRlbnQgaXMgYXBwbGljYXRpb24gc3BlY2lmaWMuDQoNCjQu ICBLZXkgRGlzdHJpYnV0aW9uDQoNCiAgIFRoaXMgc2VjdGlvbiBkZWZpbmVzIGhvdyB0aGUga2V5 aW5nIG1hdGVyaWFsIHVzZWQgZm9yIGdyb3VwDQogICBjb21tdW5pY2F0aW9uIGlzIGRpc3RyaWJ1 dGVkIGZyb20gdGhlIEtEQyB0byB0aGUgQ2xpZW50LCB3aGVuIGpvaW5pbmcNCiAgIHRoZSBncm91 cCBhcyBhIG5ldyBtZW1iZXIuDQoNCiAgIElmIG5vdCBwcmV2aW91c2x5IGVzdGFibGlzaGVkLCB0 aGUgQ2xpZW50IGFuZCB0aGUgS0RDIE1VU1QgZmlyc3QNCiAgIGVzdGFibGlzaCBhIHBhaXJ3aXNl IHNlY3VyZSBjb21tdW5pY2F0aW9uIGNoYW5uZWwgdXNpbmcgQUNFLg0KDQo8bWdsdD4NCkkgaGF2 ZSB0aGUgaW1wcmVzc2lvbiB0aGF0IHN1Y2ggYWdyZWVtZW50IGlzIHBlcmZvcm1lZCBkdXJpbmcg dGhlDQpyZWdpc3RyYXRpb24gcmVxdWVzdCAvIHJlc29wbnNlIHdpdGggdGhlIEFTLiBJcyB0aGF0 IGNvcnJlY3Qgb3IgYXJlIHdlDQpjb25zaWRlcmluZyBhbm90aGVyIGV4Y2hhbmdlID8NCjwvbWds dD4NCg0KRlA6IEkgYW0gbm90IHN1cmUgSSB1bmRlcnN0YW5kIHRoaXMgcXVlc3Rpb24uIFdoYXQg YWdyZWVtZW50PyBJZiB5b3UgbWVhbiB0aGUgS0RDLWNsaWVudCBzZWN1cmUgY2hhbm5lbCwgdGhl biBubywgdGhhdCBpcyBkb25lIGluZGVwZW5kZW50bHkuDQoNCg0KVGhlDQogICBleGNoYW5nZSBv ZiBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QtUmVzcG9uc2UgTVVTVCBvY2N1ciBvdmVyIHRoYXQN CiAgIHNlY3VyZSBjaGFubmVsLiAgVGhlIENsaWVudCBhbmQgdGhlIEtEQyBNQVkgdXNlIHRoYXQg c2FtZSBzZWN1cmUNCiAgIGNoYW5uZWwgdG8gcHJvdGVjdCBmdXJ0aGVyIHBhaXJ3aXNlIGNvbW11 bmljYXRpb25zLCB0aGF0IE1VU1QgYmUNCiAgIHNlY3VyZWQuLg0KDQogICBEdXJpbmcgdGhpcyBl eGNoYW5nZSwgdGhlIENsaWVudCBzZW5kcyBhIHJlcXVlc3QgdG8gdGhlIEFTLA0KICAgc3BlY2lm eWluZyB0aGUgZ3JvdXAgaXQgd2lzaGVzIHRvIGpvaW4gKHNlZSBTZWN0aW9uIDQuMSkuICBUaGVu LCB0aGUNCiAgIEtEQyB2ZXJpZmllcyB0aGUgYWNjZXNzIHRva2VuIGFuZCB0aGF0IHRoZSBDbGll bnQgaXMgYXV0aG9yaXplZCB0bw0KICAgam9pbiB0aGF0IGdyb3VwOyBpZiBzbywgaXQgcHJvdmlk ZXMgdGhlIENsaWVudCB3aXRoIHRoZSBrZXlpbmcNCiAgIG1hdGVyaWFsIHRvIHNlY3VyZWx5IGNv bW11bmljYXRlIHdpdGggdGhlIG1lbWJlciBvZiB0aGUgZ3JvdXAgKHNlZQ0KICAgU2VjdGlvbiA0 LjIpLiAgVGhlIENvbnRlbnQtRm9ybWF0IHVzZWQgaW4gdGhlIG1lc3NhZ2VzIGlzIHNldCB0bw0K ICAgYXBwbGljYXRpb24vY2Jvci4NCg0KPG1nbHQ+DQpJIGJlbGlldmUgdGhlIHBhcmFncmFwaCBh Ym92ZSBkZXNjcmliZXMgaG93IHRoZSBzZWN1cmUgY2hhbm5lbCBpcw0KZXN0YWJsaXNoZWQgYmV0 d2VlbiB0aGUgQ2xpZW50IGFuZCB0aGUgS0RDLiBJZiB0aGF0IGlzIGNvcnJlY3QgdGhhdCBtYXkN CmJlIG1lbnRpb24gZXhwbGljaXRseS4gSSB3b3VsZCBzdWdnZXN0IHRvIHJlcGxhY2UgIkR1cmlu ZyB0aGlzIGV4Y2hhbmdlIg0KYnkgIkR1cmluZyB0aGUgQXV0aG9yaXphdGlvbiByZXF1ZXN0L3Jl c3BvbnMgZSBleGNoYW5nZSIuDQoNCjwvbWdsdD4NCg0KRlA6IE5vLCB0aGUgcGFyYWdyYXBoIGFi b3ZlIGRlc2NyaWJlcyBob3cgdGhlIGNsaWVudCBnZXRzIHRoZSBrZXlpbmcgbWF0ZXJpYWwgdG8g aGF2ZSBzZWN1cmUgZ3JvdXAgY29tbXVuaWNhdGlvbi4g4oCcVGhpcyBleGNoYW5nZeKAnSBkb2Vz IG5vdCByZWZlciB0byDigJxhdXRob3JpemF0aW9uIHJlcXVlc3QvcmVzcG9uc2UgZXhjaGFuZ2Xi gJ0gYnV0IOKAnGpvaW5pbmcgdGhlIGdyb3Vw4oCdIGV4Y2hhbmdlLCBpLmUuIOKAnGtleSBkaXN0 cmlidXRpb24gcmVxdWVzdC1yZXNwb25zZSBleGNoYW5nZeKAnS4gVGhpcyBpcyBhIGhpZ2ggbGV2 ZWwgb3ZlcnZpZXcgb2Ygd2hhdCBpcyBkZWZpbmVkIGJlbG93LiBXZSB0cmllZCB0byBjbGFyaWZ5 IGluIG91ciB1cGRhdGU6IOKAnER1cmluZyB0aGUgZmlyc3QgZXhjaGFuZ2UgKOKAnGpvaW5pbmfi gJ0pIOKApuKAnQ0KDQoNCiAgIEZpZ3VyZSA0IGdpdmVzIGFuIG92ZXJ2aWV3IG9mIHRoZSBleGNo YW5nZSBkZXNjcmliZWQgYWJvdmUuDQoNCiAgICAgICAgIENsaWVudCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0RDDQogICAgICAgICAgICB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgICAgICB8 LS0tLSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3Q6IFBPU1QgL2dyb3VwLWlkIC0tLT58DQogICAg ICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8DQogICAgICAgICAgICB8PC0tLSBLZXkgRGlzdHJpYnV0aW9uIFJlc3BvbnNlOiAyLjAxIChD cmVhdGVkKSAtLS18DQogICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8DQoNCiAgICAgRmlndXJlIDQ6IE1lc3NhZ2UgRmxvdyBvZiBL ZXkgRGlzdHJpYnV0aW9uIHRvIGEgTmV3IEdyb3VwIE1lbWJlcg0KDQoNCg0KUGFsb21iaW5pICYg VGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgW1BhZ2Ug MTFdDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5p Y2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCiAgIFRoZSBzYW1lIHNldCBvZiBtZXNzYWdlIGNh biBhbHNvIGJlIHVzZWQgZm9yIHRoZSBmb2xsb3dpbmcgY2FzZXMsDQogICB3aGVuIHRoZSBDbGll bnQgaXMgYWxyZWFkeSBhIGdyb3VwIG1lbWJlcjoNCg0KICAgbyAgVGhlIENsaWVudCB3aXNoZXMg dG8gKHJlLSlnZXQgdGhlIGN1cnJlbnQga2V5aW5nIG1hdGVyaWFsLCBmb3INCiAgICAgIGNhc2Vz IHN1Y2ggYXMgZXhwaXJhdGlvbiwgbG9zcyBvciBzdXNwZWN0ZWQgbWlzbWF0Y2gsIGR1ZSB0byBl LmcuDQogICAgICByZWJvb3Qgb3IgbWlzc2VkIGdyb3VwIHJla2V5aW5nLiAgVGhpcyBpcyBmdXJ0 aGVyIGRpc2N1c3NlZCBpbg0KICAgICAgU2VjdGlvbiA2Lg0KDQogICBvICBUaGUgQ2xpZW50IHdp c2hlcyB0byAocmUtKWdldCB0aGUgcHVibGljIGtleXMgb2Ygb3RoZXIgZ3JvdXANCiAgICAgIG1l bWJlcnMsIGUuZy4gaWYgaXQgaXMgYXdhcmUgb2YgbmV3IG5vZGVzIGpvaW5pbmcgdGhlIGdyb3Vw IGFmdGVyDQogICAgICBpdHNlbGYuICBUaGlzIGlzIGZ1cnRoZXIgZGlzY3Vzc2VkIGluIFNlY3Rp b24gNy4NCg0KICAgQWRkaXRpb25hbGx5LCB0aGUgZm9ybWF0IG9mIHRoZSBwYXlsb2FkIG9mIHRo ZSBLZXkgRGlzdHJpYnV0aW9uDQogICBSZXNwb25zZSAoU2VjdGlvbiA0LjIpIGNhbiBiZSByZXVz ZWQgZm9yIG1lc3NhZ2VzIHNlbnQgYnkgdGhlIEtEQyB0bw0KICAgZGlzdHJpYnV0ZSB1cGRhdGVk IGdyb3VwIGtleWluZyBtYXRlcmlhbCwgaW4gY2FzZSBvZiBhIG5ldyBub2RlDQogICBqb2luaW5n IHRoZSBncm91cCBvciBvZiBhIGN1cnJlbnQgbWVtYmVyIGxlYXZpbmcgdGhlIGdyb3VwLiAgVGhl IGtleQ0KICAgbWFuYWdlbWVudCBzY2hlbWUgdXNlZCB0byBzZW5kIHN1Y2ggbWVzc2FnZXMgY291 bGQgcmVseSBvbiwgZS5nLiwNCiAgIG11bHRpY2FzdCBpbiBjYXNlIG9mIGEgbmV3IG5vZGUgam9p bmluZyBvciB1bmljYXN0IGluIGNhc2Ugb2YgYSBub2RlDQogICBsZWF2aW5nIHRoZSBncm91cC4N Cg0KICAgTm90ZSB0aGF0IHByb29mLW9mLXBvc3Nlc3Npb24gdG8gYmluZCB0aGUgYWNjZXNzIHRv a2VuIHRvIHRoZSBDbGllbnQNCiAgIGlzIHBlcmZvcm1lZCBieSB1c2luZyB0aGUgcHJvb2Ytb2Yt cG9zc2Vzc2lvbiBrZXkgYm91bmQgdG8gdGhlIGFjY2Vzcw0KICAgdG9rZW4gZm9yIGVzdGFibGlz aGluZyBzZWN1cmUgY29tbXVuaWNhdGlvbiBiZXR3ZWVuIHRoZSBDbGllbnQgYW5kDQogICB0aGUg S0RDLg0KDQogICBJZiB0aGUgYXBwbGljYXRpb24gcmVxdWlyZXMgYmFja3dhcmQgc2VjdXJpdHks IHRoZSBLREMgU0hBTEwgZ2VuZXJhdGUNCiAgIG5ldyBncm91cCBrZXlpbmcgbWF0ZXJpYWwgYW5k IHNlY3VyZWx5IGRpc3RyaWJ1dGUgaXQgdG8gYWxsIHRoZQ0KICAgY3VycmVudCBncm91cCBtZW1i ZXJzLCB1c2luZyB0aGUgbWVzc2FnZSBmb3JtYXQgZGVmaW5lZCBpbiB0aGlzDQogICBzZWN0aW9u LiAgQXBwbGljYXRpb24gcHJvZmlsZXMgbWF5IGRlZmluZSBhbHRlcm5hdGl2ZSBtZXNzYWdlDQog ICBmb3JtYXRzLg0KDQo8bWdsdD4NCkkgYW0gd29uZGVyaW5nIHdoeSBTSEFMTCBpcyBpbnRyb2R1 Y2VkIGhlcmUgYXMgTVVTVCBoYXMgYmVlbiB1c2VkDQp0aHJvdWdob3V0IHRoZSBkb2N1bWVudC4u IEkgZG8gbm90IHNlZSBhbnkgZGlmZmVyZW5jZSBiZXR3ZWVuIFNIQUxMIGFuZA0KTVVTVCwgc28g aWYgdGhhdCBpcyBjb3JyZWN0LCBJIHdvdWxkIHJlY29tbWVuZCB0byB1c2UgTVVTVCB0aHJvdWdo b3V0DQp0aGUgZG9jdW1lbnQuDQo8L21nbHQ+DQoNCkZQOiBTSEFMTCBhbmQgTVVTVCBhcmUgc3lu b255bXMsIHdoaWNoIGlzIHdoeSB3ZSBkaWQgbm90IHBheSBtdWNoIGF0dGVudGlvbiB0byB3aGF0 IHdhcyBiZWluZyB1c2VkLiBCdXQgd2Ugd2VudCBhaGVhZCBhbmQgY2hhbmdlIHRvIE1VU1QgaWYg eW91IHRoaW5rIGl04oCZcyBiZXR0ZXIvbW9yZSBjb25zaXN0ZW50Lg0KDQo0LjEuICBLZXkgRGlz dHJpYnV0aW9uIFJlcXVlc3QNCg0KICAgVGhlIENsaWVudCBzZW5kcyBhIEtleSBEaXN0cmlidXRp b24gUmVxdWVzdCB0byB0aGUgS0RDLiAgVGhpcw0KICAgY29ycmVzcG9uZHMgdG8gYSBDb0FQIFBP U1QgcmVxdWVzdCB0byB0aGUgZW5kcG9pbnQgaW4gdGhlIEtEQw0KICAgYXNzb2NpYXRlZCB0byB0 aGUgZ3JvdXAgdG8gam9pbi4gIFRoZSBlbmRwb2ludCBpbiB0aGUgS0RDIGlzDQogICBhc3NvY2lh dGVkIHRvIHRoZSAnc2NvcGUnIHZhbHVlIG9mIHRoZSBBdXRob3JpemF0aW9uIFJlcXVlc3QvDQog ICBSZXNwb25zZS4gIFRoZSBwYXlsb2FkIG9mIHRoaXMgcmVxdWVzdCBpcyBhIENCT1IgbWFwIHdo aWNoIE1VU1QNCiAgIGNvbnRhaW4gdGhlIGZvbGxvd2luZyBmaWVsZHM6DQoNCiAgIG8gICd0eXBl JywgZW5jb2RlZCBhcyBhIENCT1IgaW50LCB3aXRoIHZhbHVlIDEgKCJrZXkgZGlzdHJpYnV0aW9u IikuDQoNCiAgIEFkZGl0aW9uYWxseSwgdGhlIENCT1IgbWFwIGluIHRoZSBwYXlsb2FkIE1BWSBj b250YWluIHRoZSBmb2xsb3dpbmcNCiAgIGZpZWxkcywgd2hpY2gsIGlmIGluY2x1ZGVkLCBNVVNU IGhhdmUgdGhlIGNvcnJlc3BvbmRpbmcgdmFsdWVzOg0KDQogICBvICAnc2NvcGUnLCB3aXRoIHZh bHVlIHRoZSBzcGVjaWZpYyByZXNvdXJjZSB0aGF0IHRoZSBDbGllbnQgaXMNCiAgICAgIGF1dGhv cml6ZWQgdG8gYWNjZXNzIChpLmUuIGdyb3VwIG9yIHRvcGljIGlkZW50aWZpZXIpIGFuZCByb2xl KHMpLA0KICAgICAgZW5jb2RlZCBhcyBpbiBTZWN0aW9uIDMuMS4NCg0KDQoNClBhbG9tYmluaSAm IFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdl IDEyXQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVu aWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQogICBvICAnZ2V0X3B1Yl9rZXlzJywgaWYgdGhl IENsaWVudCB3aXNoZXMgdG8gcmVjZWl2ZSB0aGUgcHVibGljIGtleXMgb2YNCiAgICAgIHRoZSBv dGhlciBub2RlcyBpbiB0aGUgZ3JvdXAgZnJvbSB0aGUgS0RDLiAgVGhlIHZhbHVlIGlzIGFuIGVt cHR5DQogICAgICBDQk9SIGFycmF5LiAgVGhpcyBwYXJhbWV0ZXIgbWF5IGJlIHByZXNlbnQgaWYg dGhlIEtEQyBzdG9yZXMgdGhlDQogICAgICBwdWJsaWMga2V5cyBvZiB0aGUgbm9kZXMgaW4gdGhl IGdyb3VwIGFuZCBkaXN0cmlidXRlcyB0aGVtIHRvIHRoZQ0KICAgICAgQ2xpZW50OyBpdCBpcyB1 c2VsZXNzIHRvIGhhdmUgaGVyZSBpZiB0aGUgc2V0IG9mIHB1YmxpYyBrZXlzIG9mDQogICAgICB0 aGUgbWVtYmVycyBvZiB0aGUgZ3JvdXAgaXMga25vd24gaW4gYW5vdGhlciB3YXksIGUuZy4gaXQg d2FzDQogICAgICBwcm92aWRlZCBieSB0aGUgQVMuDQoNCjxtZ2x0Pg0KRm9yIGxhcmdlIGdyb3Vw cywgdGhlcmUgbWlnaHQgYmUgYSBuZWVkIHRvIGxpbWl0IHRoZSBzaXplIG9mIHRoZQ0KcmVzcG9u c2UgYW5kIHNvIHRvIGVuYWJsZSB0aGF0IHRoZSBiYXRjaCBvZiBrZXlzIGJlIHJldHJpZXZlZCBp bg0KbXVsdGlwbGUgZXhjaGFuZ2VzIG9yIHZpYSBhbm90aGVyIHJlZGlyZWN0aW9uIG1lY2hhbmlz bS4NCjwvbWdsdD4NCg0KRlA6IEdvb2QgcG9pbnQuIEFsdGhvdWdoIHNvbWUgY29tbXVuaWNhdGlv biBwcm90b2NvbHMgaGF2ZSB3YXlzIG9mIOKAnHNwbGl0dGluZyB0aGUgbWVzc2FnZeKAnSBpZiB0 b28gYmlnIChzZWUgQmxvY2t3aXNlIGZvciBDb0FQKSwgd2UgaGF2ZSBub3cgYWRkZWQgYSB3YXkg dG8gcmV0cmlldmUga2V5cyBiYXNlZCBvbiBpZGVudGlmaWVycy4gSW4gcHJhY3RpY2UsIGEgbm9k ZSBtYXkgbm90IGFzayBmb3IgYWxsIGtleXMgYW5kIG9ubHkgYXNrIGZvciB0aGUga2V5cyBpdCBu ZWVkcyB3aGVuIGl0IG5lZWRzIHRoZW0uDQoNCg0KICAgbyAgJ2NsaWVudF9jcmVkJywgd2l0aCB2 YWx1ZSB0aGUgcHVibGljIGtleSBvciBjZXJ0aWZpY2F0ZSBvZiB0aGUNCiAgICAgIENsaWVudCwg ZW5jb2RlZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcuICBJZiB0aGUgS0RDIGlzIG1hbmFnaW5nDQog ICAgICAoY29sbGVjdGluZyBmcm9tL2Rpc3RyaWJ1dGluZyB0byB0aGUgQ2xpZW50KSB0aGUgcHVi bGljIGtleXMgb2YNCiAgICAgIHRoZSBncm91cCBtZW1iZXJzLCB0aGlzIGZpZWxkIGNvbnRhaW5z IHRoZSBwdWJsaWMga2V5IG9mIHRoZQ0KICAgICAgQ2xpZW50LiAgVGhlIGRlZmF1bHQgZW5jb2Rp bmcgZm9yIHB1YmxpYyBrZXlzIGlzIENPU0UgS2V5cy4NCiAgICAgIEFsdGVybmF0aXZlIHNwZWNp ZmljIGVuY29kaW5ncyBvZiB0aGlzIHBhcmFtZXRlciBNQVkgYmUgZGVmaW5lZCBpbg0KICAgICAg YXBwbGljYXRpb25zIG9mIHRoaXMgc3BlY2lmaWNhdGlvbi4NCg0KICAgbyAgJ2NsaWVudF9jcmVk X3ZlcmlmeScsIGVuY29kZWQgYXMgYSBDQk9SIGJ5dGUgc3RyaW5nLiAgVGhpcw0KICAgICAgcGFy YW1ldGVyIGNvbnRhaW5zIGEgc2lnbmF0dXJlIGNvbXB1dGVkIGJ5IHRoZSBDbGllbnQgb3ZlciB0 aGUNCiAgICAgIG5vbmNlIE4gcmVjZWl2ZWQgZnJvbSB0aGUgS0RDIGluIHRoZSAyLjAxIChDcmVh dGVkKSByZXNwb25zZSB0bw0KICAgICAgdGhlIHRva2VuIFBPU1QgcmVxdWVzdCAoc2VlIFNlY3Rp b24gMy4zKS4gIFRoZSBDbGllbnQgY29tcHV0ZXMgdGhlDQogICAgICBzaWduYXR1cmUgYnkgdXNp bmcgaXRzIG93biBwcml2YXRlIGtleSwgd2hvc2UgY29ycmVzcG9uZGluZyBwdWJsaWMNCiAgICAg IGtleSBpcyBlaXRoZXIgZGlyZWN0bHkgc3BlY2lmaWVkIGluIHRoZSAnY2xpZW50X2NyZWQnIHBh cmFtZXRlciBvcg0KICAgICAgaW5jbHVkZWQgaW4gdGhlIGNlcnRpZmljYXRlIHNwZWNpZmllZCBp biB0aGUgJ2NsaWVudF9jcmVkJw0KICAgICAgcGFyYW1ldGVyLiAgVGhpcyBwYXJhbWV0ZXIgTVVT VCBiZSBwcmVzZW50IGlmIHRoZSAnY2xpZW50X2NyZWQnDQogICAgICBwYXJhbWV0ZXIgaXMgcHJl c2VudC4NCg0KICAgbyAgJ3B1Yl9rZXlzX3JlcG9zJywgY2FuIGJlIHByZXNlbnQgaWYgYSBjZXJ0 aWZpY2F0ZSBpcyBwcmVzZW50IGluDQogICAgICB0aGUgJ2NsaWVudF9jcmVkJyBmaWVsZCwgd2l0 aCB2YWx1ZSBhIGxpc3Qgb2YgcHVibGljIGtleQ0KICAgICAgcmVwb3NpdG9yaWVzIHN0b3Jpbmcg dGhlIGNlcnRpZmljYXRlIG9mIHRoZSBDbGllbnQuICBUaGlzDQogICAgICBwYXJhbWV0ZXIgaXMg ZW5jb2RlZCBhcyBhIENCT1IgYXJyYXkgb2YgQ0JPUiB0ZXh0IHN0cmluZ3MsIGVhY2ggb2YNCiAg ICAgIHdoaWNoIHNwZWNpZmllcyB0aGUgVVJJIG9mIGEga2V5IHJlcG9zaXRvcnkuDQoNCjQuMi4g IEtleSBEaXN0cmlidXRpb24gUmVzcG9uc2UNCg0KICAgVGhlIEtEQyB2ZXJpZmllcyB0aGF0IHRo ZSAnc2NvcGUnIHJlY2VpdmVkIGluIHRoZSBLZXkgRGlzdHJpYnV0aW9uDQogICBSZXF1ZXN0LCBp ZiBwcmVzZW50LCBpcyBhIHN1YnNldCBvZiB0aGUgJ3Njb3BlJyBzdG9yZWQgaW4gdGhlIGFjY2Vz cw0KICAgdG9rZW4gYXNzb2NpYXRlZCB0byB0aGlzIGNsaWVudC4gIElmIHZlcmlmaWNhdGlvbiBm YWlscywgdGhlIEtEQyBNVVNUDQogICByZXNwb25kIHdpdGggYSA0LjAxIChVbmF1dGhvcml6ZWQp IGVycm9yIG1lc3NhZ2UuDQoNCiAgIElmIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgaXMg bm90IGZvcm1hdHRlZCBjb3JyZWN0bHkgKGUuZy4gbm8NCiAgICdzY29wZScgZmllbGQgcHJlc2Vu dCB3aGlsZSBleHBlY3RlZCwgb3IgdW5rbm93biBmaWVsZHMgcHJlc2VudCksIHRoZQ0KICAgS0RD IE1VU1QgcmVzcG9uZCB3aXRoIDQuMDAgKEJhZCBSZXF1ZXN0KSBlcnJvciBtZXNzYWdlLg0KDQog ICBJZiB2ZXJpZmljYXRpb24gc3VjY2VlZHMsIHRoZSBLREMgc2VuZHMgYSBLZXkgRGlzdHJpYnV0 aW9uIHN1Y2Nlc3MNCiAgIFJlc3BvbnNlIHRvIHRoZSBDbGllbnQuICBUaGUgS2V5IERpc3RyaWJ1 dGlvbiBzdWNjZXNzIFJlc3BvbnNlDQogICBjb3JyZXNwb25kcyB0byBhIDIuMDEgQ3JlYXRlZCBt ZXNzYWdlLiAgVGhlIHBheWxvYWQgb2YgdGhpcyByZXNwb25zZQ0KICAgaXMgYSBDQk9SIG1hcCwg d2hpY2ggTVVTVCBjb250YWluOg0KDQoNCg0KDQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhw aXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICBbUGFnZSAxM10NCg0KSW50ZXJuZXQt RHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVs eSAyMDE5DQoNCg0KICAgbyAgJ2t0eScsIGlkZW50aWZ5aW5nIHRoZSBrZXkgdHlwZSBvZiB0aGUg J2tleScgcGFyYW1ldGVyLiAgVGhlIHNldA0KICAgICAgb2YgdmFsdWVzIGNhbiBiZSBmb3VuZCBp biB0aGUgIktleSBUeXBlIiBjb2x1bW4gb2YgdGhlICJBQ0UNCiAgICAgIEdyb3VwY29tbSBLZXki IFJlZ2lzdHJ5LiAgSW1wbGVtZW50YXRpb25zIE1VU1QgdmVyaWZ5IHRoYXQgdGhlIGtleQ0KICAg ICAgdHlwZSBtYXRjaGVzIHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlIGJlaW5nIHVzZWQsIGlmIHBy ZXNlbnQsIGFzDQogICAgICByZWdpc3RlcmVkIGluIHRoZSAiQUNFIEdyb3VwY29tbSBLZXkiIHJl Z2lzdHJ5Lg0KDQogICBvICAna2V5JywgY29udGFpbmluZyB0aGUga2V5aW5nIG1hdGVyaWFsIGZv ciB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbiwNCiAgICAgIG9yIGluZm9ybWF0aW9uIHJlcXVpcmVk IHRvIGRlcml2ZSBpdC4NCg0KICAgVGhlIGV4YWN0IGZvcm1hdCBvZiB0aGUgJ2tleScgdmFsdWUg TVVTVCBiZSBkZWZpbmVkIGluIGFwcGxpY2F0aW9ucw0KICAgb2YgdGhpcyBzcGVjaWZpY2F0aW9u LiAgQWRkaXRpb25hbGx5LCBkb2N1bWVudHMgc3BlY2lmeWluZyB0aGUga2V5DQogICBmb3JtYXQg TVVTVCByZWdpc3RlciBpdCBpbiB0aGUgIkFDRSBHcm91cGNvbW0gS2V5IiByZWdpc3RyeSwNCiAg IGluY2x1ZGluZyBpdHMgbmFtZSwgdHlwZSBhbmQgYXBwbGljYXRpb24gcHJvZmlsZSB0byBiZSB1 c2VkIHdpdGgsIGFzDQogICBkZWZpbmVkIGluIHRoZSAiQUNFIEdyb3VwY29tbSBLZXkiIHJlZ2lz dHJ5LCBkZWZpbmVkIGluIFNlY3Rpb24gMTEuNS4NCg0KICAgICArLS0tLS0tLS0tLSstLS0tLS0t LS0tLS0tLS0tKy0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICB8IE5h bWUgICAgIHwgS2V5IFR5cGUgVmFsdWUgfCBQcm9maWxlIHwgRGVzY3JpcHRpb24gICAgICAgICAg ICAgfA0KICAgICArLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLSstLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICB8IFJlc2VydmVkIHwgMCAgICAgICAgICAgICAgfCAg ICAgICAgIHwgVGhpcyB2YWx1ZSBpcyByZXNlcnZlZCAgfA0KICAgICArLS0tLS0tLS0tLSstLS0t LS0tLS0tLS0tLS0tKy0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KDQogICAg ICAgICAgICAgICAgICAgICAgICAgRmlndXJlIDU6IEtleSBUeXBlIFZhbHVlcw0KDQogICBPcHRp b25hbGx5LCB0aGUgS2V5IERpc3RyaWJ1dGlvbiBSZXNwb25zZSBNQVkgY29udGFpbiB0aGUgZm9s bG93aW5nDQogICBwYXJhbWV0ZXJzLCB3aGljaCwgaWYgaW5jbHVkZWQsIE1VU1QgaGF2ZSB0aGUg Y29ycmVzcG9uZGluZyB2YWx1ZXM6DQoNCiAgIG8gICdwcm9maWxlJywgd2l0aCB2YWx1ZSBhIENC T1IgaW50ZWdlciB0aGF0IE1VU1QgYmUgdXNlZCB0byB1bmlxdWVseQ0KICAgICAgaWRlbnRpZnkg dGhlIGFwcGxpY2F0aW9uIHByb2ZpbGUgZm9yIGdyb3VwIGNvbW11bmljYXRpb24uICBUaGUNCiAg ICAgIHZhbHVlIE1VU1QgYmUgcmVnaXN0ZXJlZCBpbiB0aGUgIkFDRSBHcm91cGNvbW0gUHJvZmls ZSIgUmVnaXN0cnkuDQoNCiAgIG8gICdleHAnLCB3aXRoIHZhbHVlIHRoZSBleHBpcmF0aW9uIHRp bWUgb2YgdGhlIGtleWluZyBtYXRlcmlhbCBmb3INCiAgICAgIHRoZSBncm91cCBjb21tdW5pY2F0 aW9uLCBlbmNvZGVkIGFzIGEgQ0JPUiB1bnNpZ25lZCBpbnRlZ2VyIG9yDQogICAgICBmbG9hdGlu Zy1wb2ludCBudW1iZXIuICBUaGlzIGZpZWxkIGNvbnRhaW5zIGEgbnVtZXJpYyB2YWx1ZQ0KICAg ICAgcmVwcmVzZW50aW5nIHRoZSBudW1iZXIgb2Ygc2Vjb25kcyBmcm9tIDE5NzAtMDEtMDFUMDA6 MDA6MDBaIFVUQw0KICAgICAgdW50aWwgdGhlIHNwZWNpZmllZCBVVEMgZGF0ZS90aW1lLCBpZ25v cmluZyBsZWFwIHNlY29uZHMsDQogICAgICBhbmFsb2dvdXMgdG8gd2hhdCBzcGVjaWZpZWQgaW4g U2VjdGlvbiAyIG9mIFtSRkM3NTE5XS4NCg0KICAgbyAgJ3B1Yl9rZXlzJywgbWF5IG9ubHkgYmUg cHJlc2VudCBpZiAnZ2V0X3B1Yl9rZXlzJyB3YXMgcHJlc2VudCBpbg0KICAgICAgdGhlIEtleSBE aXN0cmlidXRpb24gUmVxdWVzdC4gIFRoaXMgcGFyYW1ldGVyIGlzIGEgQ0JPUiBieXRlDQogICAg ICBzdHJpbmcsIHdoaWNoIGVuY29kZXMgdGhlIHB1YmxpYyBrZXlzIG9mIGFsbCB0aGUgZ3JvdXAg bWVtYmVycw0KICAgICAgcGFpcmVkIHdpdGggdGhlIHJlc3BlY3RpdmUgbWVtYmVyIGlkZW50aWZp ZXJzLiAgVGhlIGRlZmF1bHQNCiAgICAgIGVuY29kaW5nIGZvciBwdWJsaWMga2V5cyBpcyBDT1NF IEtleXMsIHNvIHRoZSBkZWZhdWx0IGVuY29kaW5nIGZvcg0KICAgICAgJ3B1Yl9rZXlzJyBpcyBh IENCT1IgYnl0ZSBzdHJpbmcgd3JhcHBpbmcgYSBDT1NFX0tleVNldCAoc2VlDQogICAgICBbUkZD ODE1Ml0pLCB3aGljaCBjb250YWlucyB0aGUgcHVibGljIGtleXMgb2YgYWxsIHRoZSBtZW1iZXJz IG9mDQogICAgICB0aGUgZ3JvdXAuLiAgSW4gcGFydGljdWxhciwgZWFjaCBDT1NFIEtleSBpbiB0 aGUgQ09TRV9LZXlTZXQNCiAgICAgIGluY2x1ZGVzIHRoZSBpZGVudGlmaWVyIG9mIHRoZSBjb3Jy ZXNwb25kaW5nIGdyb3VwIG1lbWJlciBhcyB2YWx1ZQ0KICAgICAgb2YgaXRzICdraWQnIGtleSBw YXJhbWV0ZXIuICBBbHRlcm5hdGl2ZSBzcGVjaWZpYyBlbmNvZGluZ3Mgb2YNCg0KDQoNCg0KUGFs b21iaW5pICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAg ICAgW1BhZ2UgMTRdDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91 cCBDb21tdW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCiAgICAgIHRoaXMgcGFyYW1ldGVy IE1BWSBiZSBkZWZpbmVkIGluIGFwcGxpY2F0aW9ucyBvZiB0aGlzDQogICAgICBzcGVjaWZpY2F0 aW9uLg0KDQogICBvICAnZ3JvdXBfcG9saWNpZXMnLCB3aXRoIHZhbHVlIGEgQ0JPUiBtYXAsIHdo b3NlIGVudHJpZXMgc3BlY2lmeSBob3cNCiAgICAgIHRoZSBncm91cCBoYW5kbGVzIHNwZWNpZmlj IG1hbmFnZW1lbnQgYXNwZWN0cy4gIFRoZXNlIGluY2x1ZGUsIGZvcg0KICAgICAgaW5zdGFuY2Us IGFwcHJvYWNoZXMgdG8gYWNoaWV2ZSBzeW5jaHJvbml6YXRpb24gb2Ygc2VxdWVuY2UNCiAgICAg IG51bWJlcnMgYW1vbmcgZ3JvdXAgbWVtYmVycy4gIFRoZSBlbGVtZW50cyBvZiB0aGlzIGZpZWxk IGFyZQ0KICAgICAgcmVnaXN0ZXJlZCBpbiB0aGUgIkFDRSBHcm91cGNvbW0gUG9saWN5IiBSZWdp c3RyeS4gIFRoaXMNCiAgICAgIHNwZWNpZmljYXRpb24gZGVmaW5lcyB0aGUgdHdvIGVsZW1lbnRz ICJTZXF1ZW5jZSBOdW1iZXINCiAgICAgIFN5bmNocm9uaXphdGlvbiBNZXRob2QiIGFuZCAiS2V5 IFVwZGF0ZSBDaGVjayBJbnRlcnZhbCIsIHdoaWNoIGFyZQ0KICAgICAgc3VtbWFyaXplZCBpbiBG aWd1cmUgNi4gIEFwcGxpY2F0aW9uIHByb2ZpbGVzIHRoYXQgYnVpbGQgb24gdGhpcw0KICAgICAg ZG9jdW1lbnQgTVVTVCBzcGVjaWZ5IHRoZSBleGFjdCBjb250ZW50IGZvcm1hdCBvZiBpbmNsdWRl ZCBtYXANCiAgICAgIGVudHJpZXMuDQoNCistLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tKy0tLS0t LS0tLS18LS0tLS0tLS0tLS0tLS0tLS0tLS18LS0tLS0tLS0tLS0tKw0KfCAgICAgIE5hbWUgICAg ICAgfCBDQk9SICB8ICAgQ0JPUiAgIHwgICAgRGVzY3JpcHRpb24gICAgIHwgUmVmZXJlbmNlICB8 DQp8ICAgICAgICAgICAgICAgICB8IGxhYmVsIHwgICB0eXBlICAgfCAgICAgICAgICAgICAgICAg ICAgfCAgICAgICAgICAgIHwNCnwtLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tKy0tLS0tLS0tLS18 LS0tLS0tLS0tLS0tLS0tLS0tLS18LS0tLS0tLS0tLS0tfA0KfCBTZXF1ZW5jZSBOdW1iZXIgfCBU QkQxICB8IHRzdHIvaW50IHwgTWV0aG9kIGZvciBhIHJlLSAgIHwgW1t0aGlzICAgICB8DQp8IFN5 bmNocm9uaXphdGlvbiB8ICAgICAgIHwgICAgICAgICAgfCBjaXBpZW50IG5vZGUgdG8gICAgfCBk b2N1bWVudF1dIHwNCnwgTWV0aG9kICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICB8IHN5bmNo cm9uaXplIHdpdGggICB8ICAgICAgICAgICAgfA0KfCAgICAgICAgICAgICAgICAgfCAgICAgICB8 ICAgICAgICAgIHwgc2VxdWVuY2UgbnVtYmVycyAgIHwgICAgICAgICAgICB8DQp8ICAgICAgICAg ICAgICAgICB8ICAgICAgIHwgICAgICAgICAgfCBvZiBhIHNlbmRlciBub2RlLiAgfCAgICAgICAg ICAgIHwNCnwgICAgICAgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICB8IEl0cyB2YWx1ZSBp cyB0YWtlbiB8ICAgICAgICAgICAgfA0KfCAgICAgICAgICAgICAgICAgfCAgICAgICB8ICAgICAg ICAgIHwgZnJvbSB0aGUgJ1ZhbHVlJyAgIHwgICAgICAgICAgICB8DQp8ICAgICAgICAgICAgICAg ICB8ICAgICAgIHwgICAgICAgICAgfCBjb2x1bW4gb2YgdGhlICAgICAgfCAgICAgICAgICAgIHwN CnwgICAgICAgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICB8IFNlcXVlbmNlIE51bWJlciAg ICB8ICAgICAgICAgICAgfA0KfCAgICAgICAgICAgICAgICAgfCAgICAgICB8ICAgICAgICAgIHwg U3luY2hyb25pemF0aW9uICAgIHwgICAgICAgICAgICB8DQp8ICAgICAgICAgICAgICAgICB8ICAg ICAgIHwgICAgICAgICAgfCBNZXRob2QgcmVnaXN0cnkgICAgfCAgICAgICAgICAgIHwNCnwgICAg ICAgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICB8ICAg ICAgICAgICAgfA0KfCBLZXkgVXBkYXRlICAgICAgfCBUQkQyICB8ICAgaW50ICAgIHwgUG9sbGlu ZyBpbnRlcnZhbCAgIHwgW1t0aGlzICAgICB8DQp8IENoZWNrIEludGVydmFsICB8ICAgICAgIHwg ICAgICAgICAgfCBpbiBzZWNvbmRzLCB0byAgICAgfCBkb2N1bWVudF1dIHwNCnwgICAgICAgICAg ICAgICAgIHwgICAgICAgfCAgICAgICAgICB8IGNoZWNrIGZvciBuZXcgICAgICB8ICAgICAgICAg ICAgfA0KfCAgICAgICAgICAgICAgICAgfCAgICAgICB8ICAgICAgICAgIHwga2V5aW5nIG1hdGVy aWFsIGF0IHwgICAgICAgICAgICB8DQp8ICAgICAgICAgICAgICAgICB8ICAgICAgIHwgICAgICAg ICAgfCB0aGUgS0RDICAgICAgICAgICAgfCAgICAgICAgICAgIHwNCistLS0tLS0tLS0tLS0tLS0t LSstLS0tLS0tKy0tLS0tLS0tLS18LS0tLS0tLS0tLS0tLS0tLS0tLS18LS0tLS0tLS0tLS0tKw0K DQogICAgICAgICAgICAgICAgICAgICBGaWd1cmUgNjogQUNFIEdyb3VwY29tbSBQb2xpY2llcw0K DQogICBvICAnbWd0X2tleV9tYXRlcmlhbCcsIGVuY29kZWQgYXMgYSBDQk9SIGJ5dGUgc3RyaW5n IGFuZCBjb250YWluaW5nDQogICAgICB0aGUgYWRtaW5pc3RyYXRpdmUga2V5aW5nIG1hdGVyaWFs IHRvIHBhcnRpY2lwYXRlIGluIHRoZSBncm91cA0KICAgICAgcmVrZXlpbmcgcGVyZm9ybWVkIGJ5 IHRoZSBLREMuICBUaGUgZXhhY3QgZm9ybWF0IGFuZCBjb250ZW50DQogICAgICBkZXBlbmQgb24g dGhlIHNwZWNpZmljIHJla2V5aW5nIHNjaGVtZSB1c2VkIGluIHRoZSBncm91cCwgd2hpY2gNCiAg ICAgIG1heSBiZSBzcGVjaWZpZWQgaW4gdGhlIGFwcGxpY2F0aW9uIHByb2ZpbGUuDQoNCiAgIFNw ZWNpZmljIGFwcGxpY2F0aW9uIHByb2ZpbGVzIHRoYXQgYnVpbGQgb24gdGhpcyBkb2N1bWVudCBu ZWVkIHRvDQogICBzcGVjaWZ5IGhvdyBleGFjdGx5IHRoZSBrZXlpbmcgbWF0ZXJpYWwgaXMgdXNl ZCB0byBwcm90ZWN0IHRoZSBncm91cA0KICAgY29tbXVuaWNhdGlvbi4NCg0KDQoNClBhbG9tYmlu aSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQ YWdlIDE1XQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29t bXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQo1LiAgUmVtb3ZhbCBvZiBhIE5vZGUgZnJv bSB0aGUgR3JvdXANCg0KICAgVGhpcyBzZWN0aW9uIGRlc2NyaWJlcyBhdCBhIGhpZ2ggbGV2ZWwg aG93IGEgbm9kZSBjYW4gYmUgcmVtb3ZlZCBmcm9tDQogICB0aGUgZ3JvdXAuDQoNCiAgIElmIHRo ZSBhcHBsaWNhdGlvbiByZXF1aXJlcyBmb3J3YXJkIHNlY3VyaXR5LCB0aGUgS0RDIFNIQUxMIGdl bmVyYXRlDQogICBuZXcgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIGFuZCBzZWN1cmVseSBkaXN0cmli dXRlIGl0IHRvIGFsbCB0aGUNCiAgIGN1cnJlbnQgZ3JvdXAgbWVtYmVycyBidXQgdGhlIGxlYXZp bmcgbm9kZSwgdXNpbmcgdGhlIG1lc3NhZ2UgZm9ybWF0DQogICBkZWZpbmVkIGluIFNlY3Rpb24g NC4yLiAgQXBwbGljYXRpb24gcHJvZmlsZXMgbWF5IGRlZmluZSBhbHRlcm5hdGl2ZQ0KICAgbWVz c2FnZSBmb3JtYXRzLg0KDQo1LjEuICBFeHBpcmVkIEF1dGhvcml6YXRpb24NCg0KICAgSWYgdGhl IEFTIHByb3ZpZGVzIFRva2VuIGludHJvc3BlY3Rpb24gKHNlZSBTZWN0aW9uIDUuNyBvZg0KICAg W0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0pLCB0aGUgS0RDIGNhbiBvcHRpb25hbGx5IHVzZSBh bmQgY2hlY2sNCiAgIHdoZXRoZXI6DQoNCiAgIG8gIHRoZSBub2RlIGlzIG5vdCBhdXRob3JpemVk IGFueW1vcmU7DQoNCiAgIG8gIHRoZSBhY2Nlc3MgdG9rZW4gaXMgc3RpbGwgdmFsaWQsIHVwb24g aXRzIGV4cGlyYXRpb24uDQoNCiAgIEVpdGhlciBjYXNlLCBvbmNlIGF3YXJlIHRoYXQgYSBub2Rl IGlzIG5vdCBhdXRob3JpemVkIGFueW1vcmUsIHRoZQ0KICAgS0RDIGhhcyB0byByZW1vdmUgdGhl IHVuYXV0aG9yaXplZCBub2RlIGZyb20gdGhlIGxpc3Qgb2YgZ3JvdXANCiAgIG1lbWJlcnMsIGlm IHRoZSBLREMga2VlcHMgdHJhY2sgb2YgdGhhdC4NCg0KNS4yLiAgUmVxdWVzdCB0byBMZWF2ZSB0 aGUgR3JvdXANCg0KICAgQSBub2RlIGNhbiBhY3RpdmVseSByZXF1ZXN0IHRvIGxlYXZlIHRoZSBn cm91cC4gIEluIHRoaXMgY2FzZSwgdGhlDQogICBDbGllbnQgY2FuIHNlbmQgYSByZXF1ZXN0IGZv cm1hdHRlZCBhcyBmb2xsb3dzIHRvIHRoZSBLREMsIHRvIGFiYW5kb24NCiAgIHRoZSBncm91cC4g IFRoZSBjbGllbnQgTVVTVCB1c2UgdGhlIHByb3RlY3RlZCBjaGFubmVsIGVzdGFibGlzaGVkDQog ICB3aXRoIEFDRSwgbWVudGlvbmVkIGluIFNlY3Rpb24gNC4NCg0KICAgVG8gcmVxdWVzdCB0byBs ZWF2ZSBhIGdyb3VwLCB0aGUgY2xpZW50IE1VU1Qgc2VuZCBhIENvQVAgUE9TVCByZXF1ZXN0DQog ICB0byB0aGUgZW5kcG9pbnQgaW4gdGhlIEtEQyBhc3NvY2lhdGVkIHRvIHRoZSBncm91cCB0byBs ZWF2ZSAoc2FtZQ0KICAgZW5kcG9pbnQgdXNlZCBpbiBTZWN0aW9uIDQuMSBmb3IgS2V5IERpc3Ry aWJ1dGlvbiByZXF1ZXN0cykuICBUaGUNCiAgIHBheWxvYWQgb2YgdGhpcyBMZWF2ZSBSZXF1ZXN0 IGlzIGEgQ0JPUiBtYXAgd2hpY2ggTVVTVCBjb250YWluOg0KDQogICBvICAndHlwZScsIGVuY29k ZWQgYXMgYSBDQk9SIGludCwgd2l0aCB2YWx1ZSAyICgibGVhdmUiKS4NCg0KICAgbyAgJ3Njb3Bl Jywgd2l0aCB2YWx1ZSB0aGUgc3BlY2lmaWMgcmVzb3VyY2UgdGhhdCB0aGUgQ2xpZW50IGlzDQog ICAgICBhdXRob3JpemVkIHRvIGFjY2VzcyAoaS5lLiBncm91cCBvciB0b3BpYyBpZGVudGlmaWVy KSBhbmQgd2FudHMgdG8NCiAgICAgIGxlYXZlLCBlbmNvZGVkIGFzIGluIFNlY3Rpb24gMy4xLiAg VGhlICdyb2xlJyBmaWVsZCBpcyBvbWl0dGVkLi4NCg0KICAgTm90ZSB0aGF0IHRoZSAncm9sZScg ZmllbGQgaXMgb21pdHRlZCBzaW5jZSBzdWNoIGEgcmVxdWVzdCBzaG91bGQNCiAgIG9ubHkgYmUg dXNlZCB0byBsZWF2ZSBhIGdyb3VwIGFsdG9nZXRoZXIuICBJZiB0aGUgbGVhdmluZyBub2RlIHdh bnRzDQogICB0byBiZSBwYXJ0IG9mIGEgZ3JvdXAgd2l0aCBmZXdlciByb2xlcywgaXQgZG9lcyBu b3QgbmVlZCB0bw0KICAgY29tbXVuaWNhdGUgdGhhdCB0byB0aGUgS0RDLCBhbmQgY2FuIHNpbXBs eSBzdG9wIGFjdGluZyBhY2NvcmRpbmcgdG8NCiAgIHN1Y2ggcm9sZXMuDQoNCg0KDQpQYWxvbWJp bmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICBb UGFnZSAxNl0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENv bW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgSWYgdGhlIExlYXZlIFJlcXVlc3Qg aXMgc3VjaCB0aGF0IHRoZSBLREMgY2Fubm90IGV4dHJhY3QgYWxsIHRoZQ0KICAgbmVjZXNzYXJ5 IGluZm9ybWF0aW9uIHRvIHVuZGVyc3RhbmQgYW5kIHByb2Nlc3MgaXQgY29ycmVjdGx5IChlLmcu IG5vDQogICAnc2NvcGUnIGZpZWxkIHByZXNlbnQpLCB0aGUgS0RDIE1VU1QgcmVzcG9uZCB3aXRo IGEgNC4wMCAoQmFkDQogICBSZXF1ZXN0KSBlcnJvciBtZXNzYWdlLiAgT3RoZXJ3aXNlLCB0aGUg S0RDIE1VU1QgcmVtb3ZlIHRoZSBsZWF2aW5nDQogICBub2RlIGZyb20gdGhlIGxpc3Qgb2YgZ3Jv dXAgbWVtYmVycywgaWYgdGhlIEtEQyBrZWVwcyB0cmFjayBvZiB0aGF0Lg0KDQogICBOb3RlIHRo YXQsIGFmdGVyIGhhdmluZyBsZWZ0IHRoZSBncm91cCwgYSBub2RlIG1heSB3aXNoIHRvIGpvaW4g aXQNCiAgIGFnYWluLiAgVGhlbiwgYXMgbG9uZyBhcyB0aGUgbm9kZSBpcyBzdGlsbCBhdXRob3Jp emVkIHRvIGpvaW4gdGhlDQogICBncm91cCwgaS5lLiBpdCBoYXMgYSBzdGlsbCB2YWxpZCBhY2Nl c3MgdG9rZW4sIGl0IGNhbiByZS1yZXF1ZXN0IHRvDQogICBqb2luIHRoZSBncm91cCBkaXJlY3Rs eSB0byB0aGUgS0RDIHdpdGhvdXQgbmVlZGluZyB0byByZXRyaWV2ZSBhIG5ldw0KICAgYWNjZXNz IHRva2VuIGZyb20gdGhlIEFTLiAgVGhpcyBtZWFucyB0aGF0IHRoZSBLREMgbmVlZHMgdG8ga2Vl cA0KICAgdHJhY2sgb2Ygbm9kZXMgd2l0aCB2YWxpZCBhY2Nlc3MgdG9rZW5zLCBiZWZvcmUgZGVs ZXRpbmcgYWxsDQogICBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbGVhdmluZyBub2RlLg0KDQo2LiAg UmV0cmlldmFsIG9mIE5ldyBvciBVcGRhdGVkIEtleWluZyBNYXRlcmlhbA0KDQogICBBIG5vZGUg c3RvcHMgdXNpbmcgdGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCB1cG9uIGl0cyBleHBpcmF0aW9u LA0KICAgYWNjb3JkaW5nIHRvIHRoZSAnZXhwJyBwYXJhbWV0ZXIgc3BlY2lmaWVkIGluIHRoZSBy ZXRhaW5lZCBDT1NFIEtleS4NCiAgIFRoZW4sIGlmIGl0IHdhbnRzIHRvIGNvbnRpbnVlIHBhcnRp Y2lwYXRpbmcgaW4gdGhlIGdyb3VwDQogICBjb21tdW5pY2F0aW9uLCB0aGUgbm9kZSBoYXMgdG8g cmVxdWVzdCBuZXcgdXBkYXRlZCBrZXlpbmcgbWF0ZXJpYWwgdG8NCiAgIHRoZSBLREMuICBJbiB0 aGlzIGNhc2UsIGFuZCBkZXBlbmRpbmcgb24gd2hhdCBwYXJ0IG9mIHRoZSBrZXlpbmcNCiAgIG1h dGVyaWFsIGlzIGV4cGlyZWQsIHRoZSBjbGllbnQgbWF5IG5lZWQgdG8gY29tbXVuaWNhdGUgdG8g dGhlIEtEQw0KICAgaXRzIG5lZWQgZm9yIHRoYXQgcGFydCB0byBiZSByZW5ld2VkOiBmb3IgZXhh bXBsZSwgaWYgdGhlIENsaWVudCB1c2VzDQogICBhbiBpbmRpdmlkdWFsIGtleSB0byBwcm90ZWN0 IG91dGdvaW5nIHRyYWZmaWMgYW5kIGhhcyB0byByZW5ldyBpdCwNCiAgIHRoZSBub2RlIG1heSBy ZXF1ZXN0IGEgbmV3IG9uZSwgb3IgbmV3IGlucHV0IG1hdGVyaWFsIHRvIGRlcml2ZSBpdCwNCiAg IHdpdGhvdXQgcmVuZXdpbmcgdGhlIHdob2xlIGdyb3VwIGtleWluZyBtYXRlcmlhbC4NCg0KICAg VGhlIENsaWVudCBtYXkgcGVyZm9ybSB0aGUgc2FtZSByZXF1ZXN0IHRvIHRoZSBLREMgYWxzbyB1 cG9uDQogICByZWNlaXZpbmcgbWVzc2FnZXMgZnJvbSBvdGhlciBncm91cCBtZW1iZXJzIHdpdGhv dXQgYmVpbmcgYWJsZSB0bw0KICAgcmV0cmlldmUgdGhlIG1hdGVyaWFsIHRvIGNvcnJlY3RseSBk ZWNyeXB0IHRoZW0uICBUaGlzIG1heSBiZSBkdWUgdG8NCiAgIGEgcHJldmlvdXMgdXBkYXRlIG9m IHRoZSBncm91cCBrZXlpbmcgbWF0ZXJpYWwgKHJla2V5aW5nKSB0cmlnZ2VyZWQNCiAgIGJ5IHRo ZSBLREMsIHRoYXQgdGhlIENsaWVudCB3YXMgbm90IGFibGUgdG8gcmVjZWl2ZSBvciBkZWNyeXB0 Lg0KDQogICBOb3RlIHRoYXQgcG9saWNpZXMgY2FuIGJlIHNldCB1cCBzbyB0aGF0IHRoZSBDbGll bnQgc2VuZHMgYSByZXF1ZXN0DQogICB0byB0aGUgS0RDIG9ubHkgYWZ0ZXIgYSBnaXZlbiBudW1i ZXIgb2YgdW5zdWNjZXNzZnVsbHkgZGVjcnlwdGVkDQogICBpbmNvbWluZyBtZXNzYWdlcy4gIEl0 IGlzIGFwcGxpY2F0aW9uIGRlcGVuZGVudCBhbmQgcGVydGFpbmluZyB0byB0aGUNCiAgIHBhcnRp Y3VsYXIgbWVzc2FnZSBleGNoYW5nZSAoZS5nLiAgW0ktRC5pZXRmLWNvcmUtb3Njb3JlLWdyb3Vw Y29tbV0pDQogICB0byBzZXQgdXAgcG9saWNpZXMgdGhhdCBpbnN0cnVjdCBjbGllbnRzIHRvIHJl dGFpbiB1bnN1Y2Nlc3NmdWxseQ0KICAgZGVjcnlwdGVkIG1lc3NhZ2VzIGFuZCBmb3IgaG93IGxv bmcsIHNvIHRoYXQgdGhleSBjYW4gYmUgZGVjcnlwdGVkDQogICBhZnRlciBnZXR0aW5nIHVwZGF0 ZWQga2V5aW5nIG1hdGVyaWFsLCByYXRoZXIgdGhhbiBqdXN0IGNvbnNpZGVyZWQNCiAgIG5vbiB2 YWxpZCBtZXNzYWdlcyB0byBkaXNjYXJkIHJpZ2h0IGF3YXkuDQoNCiAgIFRoZSBzYW1lIHJlcXVl c3QgY291bGQgYWxzbyBiZSBzZW50IGJ5IHRoZSBjbGllbnQgd2l0aG91dCBiZWluZw0KICAgdHJp Z2dlcmVkIGJ5IGEgZmFpbGVkIGRlY3J5cHRpb24gb2YgYSBtZXNzYWdlLCBpZiB0aGUgY2xpZW50 IHdhbnRzIHRvDQogICBjb25maXJtIHRoYXQgaXQgaGFzIHRoZSBsYXRlc3QgZ3JvdXAga2V5aW5n IG1hdGVyaWFsLiAgSWYgdGhhdCBpcyB0aGUNCiAgIGNhc2UsIHRoZSBjbGllbnQgd2lsbCByZWNl aXZlIGZyb20gdGhlIEtEQyB0aGUgc2FtZSBncm91cCBrZXlpbmcNCiAgIG1hdGVyaWFsIGl0IGhh cyBpbiBtZW1vcnkuDQoNCg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEph bnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDE3XQ0KDQpJbnRlcm5ldC1EcmFmdCAg S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkN Cg0KDQogICBOb3RlIHRoYXQgdGhlIGRpZmZlcmVuY2UgYmV0d2VlbiB0aGUga2V5aW5nIG1hdGVy aWFsIHJlbmV3YWwgcmVxdWVzdA0KICAgYW5kIHRoZSBrZXlpbmcgbWF0ZXJpYWwgdXBkYXRlIHJl cXVlc3QgaXMgdGhhdCB0aGUgZmlyc3Qgb25lIHRyaWdnZXJzDQogICB0aGUgS0RDIHRvIHByb2R1 Y2UgbmV3IGtleWluZyBtYXRlcmlhbCBmb3IgdGhhdCBub2RlLCB3aGlsZSB0aGUNCiAgIHNlY29u ZCBvbmUgb25seSB0cmlnZ2VycyBkaXN0cmlidXRpb24gKHRoZSByZW5ld2FsIG1pZ2h0IGhhdmUN CiAgIGhhcHBlbmVkIGluZGVwZW5kZW50bHksIGJlY2F1c2Ugb2YgZXhwaXJhdGlvbikuICBPbmNl IGEgbm9kZSByZWNlaXZlcw0KICAgbmV3IGluZGl2aWR1YWwga2V5aW5nIG1hdGVyaWFsLCBvdGhl ciBncm91cCBtZW1iZXJzIG1heSBuZWVkIHRvIHVzZQ0KICAgdGhlIHVwZGF0ZSBrZXlpbmcgbWF0 ZXJpYWwgcmVxdWVzdCB0byByZXRyaWV2ZSBpdC4NCg0KICAgQWx0ZXJuYXRpdmVseSwgdGhlIHJl LWRpc3RyaWJ1dGlvbiBvZiBrZXlpbmcgbWF0ZXJpYWwgY2FuIGJlDQogICBpbml0aWF0ZWQgYnkg dGhlIEtEQywgd2hpY2ggZS5nLjoNCg0KICAgbyAgQ2FuIG1haW50YWluIGFuIE9ic2VydmFibGUg cmVzb3VyY2UgdG8gc2VuZCBub3RpZmljYXRpb25zIHRvDQogICAgICBDbGllbnRzIHdoZW4gdGhl IGtleWluZyBtYXRlcmlhbCBpcyB1cGRhdGVkLiAgU3VjaCBhIG5vdGlmaWNhdGlvbg0KICAgICAg d291bGQgaGF2ZSB0aGUgc2FtZSBwYXlsb2FkIGFzIHRoZSBLZXkgUmUtRGlzdHJpYnV0aW9uIFJl c3BvbnNlDQogICAgICBkZWZpbmVkIGluIFNlY3Rpb24gNi4yLg0KDQogICBvICBDYW4gc2VuZCB0 aGUgcGF5bG9hZCBvZiB0aGUgS2V5IFJlLURpc3RyaWJ1dGlvbiBSZXNwb25zZSBhcyBvbmUgb3IN CiAgICAgIG11bHRpcGxlIG11bHRpY2FzdCByZXF1ZXN0cyB0byB0aGUgbWVtYmVycyBvZiB0aGUg Z3JvdXAsIHVzaW5nDQogICAgICBzZWN1cmUgcmVrZXlpbmcgc2NoZW1lcyBzdWNoIGFzIFtSRkMy MDkzXVtSRkMyMDk0XVtSRkMyNjI3XS4NCg0KICAgbyAgQ2FuIHNlbmQgdW5pY2FzdCByZXF1ZXN0 cyB0byBlYWNoIENsaWVudCBvdmVyIGEgc2VjdXJlIGNoYW5uZWwsDQogICAgICB3aXRoIHRoZSBL ZXkgUmUtRGlzdHJpYnV0aW9uIFJlc3BvbnNlIGFzIHBheWxvYWQuDQoNCiAgIG8gIENhbiBhY3Qg YXMgYSBwdWJsaXNoZXIgaW4gYSBwdWItc3ViIHNjZW5hcmlvLCBhbmQgdXBkYXRlIHRoZQ0KICAg ICAga2V5aW5nIG1hdGVyaWFsIGJ5IHB1Ymxpc2hpbmcgb24gYSBzcGVjaWZpYyB0b3BpYyBvbiBh IGJyb2tlciwNCiAgICAgIHdoaWNoIGFsbCB0aGUgbWVtYmVycyBvZiB0aGUgZ3JvdXAgYXJlIHN1 YnNjcmliZWQgdG8uDQoNCiAgIE5vdGUgdGhhdCB0aGVzZSBtZXRob2RzIG9mIEtEQy1pbml0aWF0 ZWQga2V5IHJlLWRpc3RyaWJ1dGlvbiBoYXZlDQogICBkaWZmZXJlbnQgc2VjdXJpdHkgcHJvcGVy dGllcyBhbmQgcmVxdWlyZSBkaWZmZXJlbnQgc2VjdXJpdHkNCiAgIGFzc29jaWF0aW9ucy4NCg0K Ni4xLiAgS2V5IFJlLURpc3RyaWJ1dGlvbiBSZXF1ZXN0DQoNCiAgIFRvIHJlcXVlc3QgYSByZS1k aXN0cmlidXRpb24gb2Yga2V5aW5nIG1hdGVyaWFsLCB0aGUgQ2xpZW50IHNlbmRzIGENCiAgIHNo b3J0ZW5lZCBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgdG8gdGhlIEtEQyAoU2VjdGlvbiA0LjEp LA0KICAgZm9ybWF0dGVkIGFzIGZvbGxvd3MuICBUaGUgcGF5bG9hZCBNVVNUIGNvbnRhaW4gdGhl IGZvbGxvd2luZyBmaWVsZHM6DQoNCiAgIG8gICd0eXBlJywgZW5jb2RlZCBhcyBhIENCT1IgaW50 LCB3aXRoIHZhbHVlIDMgKCJ1cGRhdGUga2V5IikgaWYgdGhlDQogICAgICByZXF1ZXN0IGlzIGlu dGVuZGVkIHRvIHJldHJpZXZlIHVwZGF0ZWQgZ3JvdXAga2V5aW5nIG1hdGVyaWFsLCBhbmQNCiAg ICAgIDQgKCJuZXciKSBpZiB0aGUgcmVxdWVzdCBpcyBpbnRlbmRlZCBmb3IgdGhlIEtEQyB0byBw cm9kdWNlIGFuZA0KICAgICAgcHJvdmlkZSBuZXcgaW5kaXZpZHVhbCBrZXlpbmcgbWF0ZXJpYWwg Zm9yIHRoZSBDbGllbnQuDQoNCiAgIG8gICdzY29wZScsIHdoaWNoIGNvbnRhaW5zIG9ubHkgdGhl IGlkZW50aWZpZXIgb2YgdGhlIHNwZWNpZmljIGdyb3VwDQogICAgICBvciB0b3BpYywgZW5jb2Rl ZCBhcyBpbiBTZWN0aW9uIDMuMS4gIFRoYXQgaXMsIHRoZSByb2xlIGZpZWxkIGlzDQogICAgICBu b3QgcHJlc2VudC4NCg0KDQoNCg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVz IEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDE4XQ0KDQpJbnRlcm5ldC1EcmFm dCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIw MTkNCg0KDQo2LjIuICBLZXkgUmUtRGlzdHJpYnV0aW9uIFJlc3BvbnNlDQoNCiAgIFRoZSBLREMg cmVjZWl2aW5nIGEgS2V5IFJlLURpc3RyaWJ1dGlvbiBSZXF1ZXN0IE1VU1QgY2hlY2sgdGhhdCBp dCBpcw0KICAgc3RvcmluZyBhIHZhbGlkIGFjY2VzcyB0b2tlbiBmcm9tIHRoYXQgY2xpZW50IGZv ciB0aGF0IHNjb3BlLg0KDQogICBJZiB0aGF0IGlzIG5vdCB0aGUgY2FzZSwgaS5lLiBpdCBkb2Vz IG5vdCBzdG9yZSB0aGUgdG9rZW4gb3IgdGhlDQogICB0b2tlbiBpcyBub3QgdmFsaWQgZm9yIHRo YXQgY2xpZW50IGZvciB0aGUgc2NvcGUgcmVxdWVzdGVkLCB0aGUgS0RDDQogICBNVVNUIHJlc3Bv bmQgd2l0aCBhIDQuMDEgKFVuYXV0aG9yaXplZCkgZXJyb3IgbWVzc2FnZS4gIEFuYWxvZ291c2x5 DQogICB0byBTZWN0aW9uIDQuMiwgaWYgdGhlIEtleSBSZS1EaXN0cmlidXRpb24gUmVxdWVzdCBp cyBub3QgZm9ybWF0dGVkDQogICBjb3JyZWN0bHkgKGUuZy4gbm8gJ3Njb3BlJyBmaWVsZCBwcmVz ZW50LCBvciB1bmtub3duIGZpZWxkcyBwcmVzZW50KSwNCiAgIHRoZSBLREMgTVVTVCByZXNwb25k IHdpdGggYSA0LjAwIChCYWQgUmVxdWVzdCkgZXJyb3IgbWVzc2FnZS4NCg0KICAgT3RoZXJ3aXNl LCB0aGUgS0RDIHJlcGxpZXMgdG8gdGhlIENsaWVudCB3aXRoIGEgS2V5IERpc3RyaWJ1dGlvbg0K ICAgUmVzcG9uc2UsIHdoaWNoIE1VU1QgaW5jbHVkZSB0aGUgJ2t0eScsICdrZXknIGFuZCAnZXhw JyBwYXJhbWV0ZXJzDQogICBzcGVjaWZpZWQgaW4gU2VjdGlvbiA0LjIuICBUaGUgS2V5IERpc3Ry aWJ1dGlvbiBSZXNwb25zZSBNQVkgYWxzbw0KICAgaW5jbHVkZSB0aGUgJ3Byb2ZpbGUnLCAnZ3Jv dXBfcG9saWNpZXMnIGFuZCAnbWd0X2tleV9tYXRlcmlhbCcNCiAgIHBhcmFtZXRlcnMgc3BlY2lm aWVkIGluIFNlY3Rpb24gNC4yLg0KDQogICBOb3RlIHRoYXQgdGhpcyByZXNwb25zZSBtaWdodCBz aW1wbHkgcmUtcHJvdmlkZSB0aGUgc2FtZSBrZXlpbmcNCiAgIG1hdGVyaWFsIGN1cnJlbnRseSBv d25lZCBieSB0aGUgQ2xpZW50LCBpZiBpdCBoYXMgbm90IGJlZW4gcmVuZXdlZC4NCg0KNy4gIFJl dHJpZXZhbCBvZiBQdWJsaWMgS2V5cyBmb3IgR3JvdXAgTWVtYmVycw0KDQogICBJbiBjYXNlIHRo ZSBLREMgbWFpbnRhaW5zIHRoZSBwdWJsaWMga2V5cyBvZiBncm91cCBtZW1iZXJzLCBhIG5vZGUg aW4NCiAgIHRoZSBncm91cCBjYW4gY29udGFjdCB0aGUgS0RDIHRvIHJlcXVlc3QgcHVibGljIGtl eXMgb2YgZWl0aGVyIGFsbA0KICAgZ3JvdXAgbWVtYmVycyBvciBhIHNwZWNpZmllZCBzdWJzZXQs IHVzaW5nIHRoZSBtZXNzYWdlcyBkZWZpbmVkDQogICBiZWxvdy4NCg0KICAgRmlndXJlIDcgZ2l2 ZXMgYW4gb3ZlcnZpZXcgb2YgdGhlIGV4Y2hhbmdlIGRlc2NyaWJlZCBhYm92ZS4NCg0KICAgICAg ICAgICAgQ2xpZW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLREMN CiAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwNCiAgICAgICAgICAgICAgIHwtLS0tIFB1YmxpYyBLZXkgUmVxdWVzdDogUE9TVCAvZ3Jv dXAtaWQgLS0tPnwNCiAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwNCiAgICAgICAgICAgICAgIHw8LS0tIFB1YmxpYyBLZXkgUmVzcG9u c2U6IDIuMDEgKENyZWF0ZWQpIC0tLXwNCiAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwNCg0KICAgICAgICAgICBGaWd1cmUgNzogTWVz c2FnZSBGbG93IG9mIFB1YmxpYyBLZXkgUmVxdWVzdC1SZXNwb25zZQ0KDQogICBOb3RlIHRoYXQg dGhlc2UgbWVzc2FnZXMgY2FuIGJlIGNvbWJpbmVkIHdpdGggdGhlIEtleSBSZS1EaXN0cmlidXRp b24NCiAgIG1lc3NhZ2VzIGluIFNlY3Rpb24gNiwgdG8gcmVxdWVzdCBhdCB0aGUgc2FtZSB0aW1l IHRoZSBrZXlpbmcNCiAgIG1hdGVyaWFsIGFuZCB0aGUgcHVibGljIGtleXMuICBJbiB0aGlzIGNh c2UsIGVpdGhlciBhIG5ldyBlbmRwb2ludCBhdA0KICAgdGhlIEtEQyBtYXkgYmUgdXNlZCwgb3Ig YWRkaXRpb25hbCBpbmZvcm1hdGlvbiBuZWVkcyB0byBiZSBzZW50IGluDQogICB0aGUgcmVxdWVz dCBwYXlsb2FkLCB0byBkaXN0aW5ndWlzaCB0aGVzZSBjb21iaW5lZCBtZXNzYWdlcyBmcm9tIHRo ZQ0KICAgUHVibGljIEtleSBtZXNzYWdlcyBkZXNjcmliZWQgYmVsb3csIHNpbmNlIHRoZXkgd291 bGQgYmUgaWRlbnRpY2FsDQogICBvdGhlcndpc2UuDQoNCjxtZ2x0Pg0KSSBhbSB3b25kZXJpbmcg d2h5IHB1YmxpYyBrZXkgaXMgbmVlZGVkIGluIGEgY29udGV4dCBvZiBncm91cA0KY29tbXVuaWNh dGlvbi4gSSBkbyBub3QgZXhwZWN0IGdyb3VwIG1lbWJlcnMgYnV0IG9ubHkgYnkgdGhlIFJTLg0K DQpJdCBpcyB1bmNsZWFyIHRvIG1lIGhvdyB0aGUNCjwvbWdsdD4NCg0KRlA6IFB1YmxpYyBrZXlz IGFyZSBuZWVkZWQgZm9yIHNvdXJjZSBhdXRoZW50aWNhdGlvbiBpbiBncm91cCBjb21tdW5pY2F0 aW9uLiBUaGUgc2VudGVuY2Ugd2FzIG5vdCBvdmVyLCBzbyBwbGVhc2UgbGV0IHVzIGtub3cgaWYg eW91IGhhdmUgbW9yZSBpbnB1dCBvbiB3aGF0IHdhcyB5b3VyIGlkZWEgKGlmIHlvdSByZW1lbWJl cikuDQoNCg0KDQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIw MjAgICAgICAgICAgICAgICBbUGFnZSAxOV0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNp b25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KNy4xLiAg UHVibGljIEtleSBSZXF1ZXN0DQoNCiAgIFRvIHJlcXVlc3QgcHVibGljIGtleXMsIHRoZSBDbGll bnQgc2VuZHMgYSBzaG9ydGVuZWQgS2V5IERpc3RyaWJ1dGlvbg0KICAgUmVxdWVzdCB0byB0aGUg S0RDIChTZWN0aW9uIDQuMSksIGZvcm1hdHRlZCBhcyBmb2xsb3dzLiAgVGhlIHBheWxvYWQNCiAg IG9mIHRoaXMgcmVxdWVzdCBNVVNUIGNvbnRhaW4gdGhlIGZvbGxvd2luZyBmaWVsZHM6DQoNCiAg IG8gICd0eXBlJywgZW5jb2RlZCBhcyBhIENCT1IgaW50LCB3aXRoIHZhbHVlIDUgKCJwdWIga2V5 cyIpLg0KDQogICBvICAnZ2V0X3B1Yl9rZXlzJywgd2hpY2ggaGFzIGFzIHZhbHVlIGEgQ0JPUiBh cnJheSBpbmNsdWRpbmcgZWl0aGVyOg0KDQogICAgICAqICBubyBlbGVtZW50cywgaS5lLiBhbiBl bXB0eSBhcnJheSwgaW4gb3JkZXIgdG8gcmVxdWVzdCB0aGUNCiAgICAgICAgIHB1YmxpYyBrZXkg b2YgYWxsIGN1cnJlbnQgZ3JvdXAgbWVtYmVyczsgb3INCg0KICAgICAgKiAgTiBlbGVtZW50cywg ZWFjaCBvZiB3aGljaCBpcyB0aGUgaWRlbnRpZmllciBvZiBhIGdyb3VwIG1lbWJlcg0KICAgICAg ICAgZW5jb2RlZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcsIGluIG9yZGVyIHRvIHJlcXVlc3QgdGhl IHB1YmxpYw0KICAgICAgICAga2V5IG9mIHRoZSBzcGVjaWZpZWQgbm9kZXMuDQoNCiAgIG8gICdz Y29wZScsIHdoaWNoIGNvbnRhaW5zIG9ubHkgdGhlIGlkZW50aWZpZXIgb2YgdGhlIHNwZWNpZmlj IGdyb3VwDQogICAgICBvciB0b3BpYywgZW5jb2RlZCBhcyBpbiBTZWN0aW9uIDMuMS4gIFRoYXQg aXMsIHRoZSByb2xlIGZpZWxkIGlzDQogICAgICBub3QgcHJlc2VudC4NCg0KNy4yLiAgUHVibGlj IEtleSBSZXNwb25zZQ0KDQogICBUaGUgS0RDIHJlcGxpZXMgdG8gdGhlIENsaWVudCB3aXRoIGEg S2V5IERpc3RyaWJ1dGlvbiBSZXNwb25zZQ0KICAgY29udGFpbmluZyBvbmx5IHRoZSAncHViX2tl eXMnIHBhcmFtZXRlciwgYXMgc3BlY2lmaWVkIGluDQogICBTZWN0aW9uIDQuMi4gIFRoZSBwYXls b2FkIG9mIHRoaXMgcmVzcG9uc2UgY29udGFpbnMgdGhlIGZvbGxvd2luZw0KICAgZmllbGQ6DQoN CiAgIG8gICdwdWJfa2V5cycsIHdoaWNoIGNvbnRhaW5zIGVpdGhlcjoNCg0KICAgICAgKiAgdGhl IHB1YmxpYyBrZXlzIG9mIGFsbCB0aGUgbWVtYmVycyBvZiB0aGUgZ3JvdXAsIGlmIHRoZQ0KICAg ICAgICAgJ2dldF9wdWJfa2V5cycgcGFyYW1ldGVyIG9mIHRoZSBQdWJsaWMgS2V5IHJlcXVlc3Qg d2FzIGFuIGVtcHR5DQogICAgICAgICBhcnJheTsgb3INCg0KICAgICAgKiAgdGhlIHB1YmxpYyBr ZXlzIG9mIHRoZSBncm91cCBtZW1iZXJzIHdpdGggdGhlIGlkZW50aWZpZXJzDQogICAgICAgICBz cGVjaWZpZWQgaW4gdGhlICdnZXRfcHViX2tleXMnIHBhcmFtZXRlciBvZiB0aGUgUHVibGljIEtl eQ0KICAgICAgICAgcmVxdWVzdC4NCg0KICAgVGhlIEtEQyBtYXkgZW5mb3JjZSBvbmUgb2YgdGhl IGZvbGxvd2luZyBwb2xpY2llcywgaW4gb3JkZXIgdG8gaGFuZGxlDQogICBwb3NzaWJsZSBpZGVu dGlmaWVycyB0aGF0IGFyZSBpbmNsdWRlZCBpbiB0aGUgJ2dldF9wdWJfa2V5cycNCiAgIHBhcmFt ZXRlciBvZiB0aGUgUHVibGljIEtleSByZXF1ZXN0IGJ1dCBhcmUgbm90IGFzc29jaWF0ZWQgdG8g YW55DQogICBjdXJyZW50IGdyb3VwIG1lbWJlci4NCg0KICAgbyAgVGhlIEtEQyBzaWxlbnRseSBp Z25vcmVzIHRob3NlIGlkZW50aWZpZXJzLg0KDQogICBvICBUaGUgS0RDIHJldGFpbnMgcHVibGlj IGtleXMgb2YgZ3JvdXAgbWVtYmVycyBmb3IgYSBnaXZlbiBhbW91bnQgb2YNCiAgICAgIHRpbWUg YWZ0ZXIgdGhlaXIgbGVhdmluZywgYmVmb3JlIGRpc2NhcmRpbmcgdGhlbS4gIEFzIGxvbmcgYXMg c3VjaA0KDQoNCg0KDQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYs IDIwMjAgICAgICAgICAgICAgICBbUGFnZSAyMF0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92 aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAg ICAgcHVibGljIGtleXMgYXJlIHJldGFpbmVkLCB0aGUgS0RDIHByb3ZpZGVzIHRoZW0gdG8gYSBy ZXF1ZXN0aW5nDQogICAgICBDbGllbnQuDQoNCiAgIEVpdGhlciBjYXNlLCBhIG5vZGUgdGhhdCBo YXMgbGVmdCB0aGUgZ3JvdXAgc2hvdWxkIG5vdCBleHBlY3QgYW55IG9mDQogICBpdHMgb3V0Z29p bmcgbWVzc2FnZXMgdG8gYmUgc3VjY2Vzc2Z1bGx5IHByb2Nlc3NlZCwgaWYgcmVjZWl2ZWQgYWZ0 ZXINCiAgIGl0cyBsZWF2aW5nLCBkdWUgdG8gYSBwb3NzaWJsZSBncm91cCByZWtleWluZyBvY2N1 cnJlZCBiZWZvcmUgdGhlDQogICBtZXNzYWdlIHJlY2VwdGlvbi4NCg0KOC4gIEFDRSBHcm91cGNv bW0gUGFyYW1ldGVycw0KDQogICBUaGlzIHNwZWNpZmljYXRpb24gZGVmaW5lcyBhIG51bWJlciBv ZiBmaWVsZHMgdXNlZCBkdXJpbmcgdGhlIG1lc3NhZ2UNCiAgIGV4Y2hhbmdlLiAgVGhlIHRhYmxl IGJlbG93IHN1bW1hcml6ZXMgdGhlbSwgYW5kIHNwZWNpZmllcyB0aGUgQ0JPUg0KICAga2V5IHRv IHVzZSBpbnN0ZWFkIG9mIHRoZSBmdWxsIGRlc2NyaXB0aXZlIG5hbWUuDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KUGFsb21iaW5pICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAg ICAgICAgICAgICAgW1BhZ2UgMjFdDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5n IGZvciBHcm91cCBDb21tdW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCiAgICstLS0tLS0t LS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgTmFtZSAgICAgICAgIHwg Q0JPUiBLZXkgfCBDQk9SIFR5cGUgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0t Ky0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgc2NvcGUgICAgICAgIHwgICBUQkQgICAgfCBhcnJheSAg ICAgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsN CiAgIHwgZ2V0X3B1Yl9rZXlzIHwgICBUQkQgICAgfCBhcnJheSAgICAgICAgIHwNCiAgICstLS0t LS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgY2xpZW50X2NyZWQg IHwgICBUQkQgICAgfCBieXRlIHN0cmluZyAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgY2xpZW50X2NyZWRfIHwgICBUQkQgICAgfCBieXRl IHN0cmluZyAgIHwNCiAgIHwgdmVyaWZ5ICAgICAgIHwgICAgICAgICAgfCAgICAgICAgICAgICAg IHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwg cHViX2tleXNfICAgIHwgICBUQkQgICAgfCBhcnJheSAgICAgICAgIHwNCiAgIHwgcmVwb3MgICAg ICAgIHwgICAgICAgICAgfCAgICAgICAgICAgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwga3R5ICAgICAgICAgIHwgICBUQkQgICAgfCBp bnQgLyBieXRlICAgIHwNCiAgIHwgICAgICAgICAgICAgIHwgICAgICAgICAgfCBzdHJpbmcgICAg ICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAg IHwga2V5ICAgICAgICAgIHwgICBUQkQgICAgfCBzZWUgIkFDRSAgICAgIHwNCiAgIHwgICAgICAg ICAgICAgIHwgICAgICAgICAgfCBHcm91cGNvbW0gICAgIHwNCiAgIHwgICAgICAgICAgICAgIHwg ICAgICAgICAgfCBLZXkiIFJlZ2lzdHJ5IHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0t Ky0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgcHJvZmlsZSAgICAgIHwgICBUQkQgICAgfCBpbnQgICAg ICAgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsN CiAgIHwgZXhwICAgICAgICAgIHwgICBUQkQgICAgfCBpbnQgLyBmbG9hdCAgIHwNCiAgICstLS0t LS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgcHViX2tleXMgICAg IHwgICBUQkQgICAgfCBieXRlIHN0cmluZyAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgZ3JvdXBfICAgICAgIHwgICBUQkQgICAgfCBtYXAg ICAgICAgICAgIHwNCiAgIHwgcG9saWNpZXMgICAgIHwgICAgICAgICAgfCAgICAgICAgICAgICAg IHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwg bWd0X2tleV8gICAgIHwgICBUQkQgICAgfCBieXRlIHN0cmluZyAgIHwNCiAgIHwgbWF0ZXJpYWwg ICAgIHwgICAgICAgICAgfCAgICAgICAgICAgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsNCiAgIHwgdHlwZSAgICAgICAgIHwgICBUQkQgICAgfCBp bnQgICAgICAgICAgIHwNCiAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tKy0tLS0tLS0tLS0t LS0tLSsNCg0KOS4gIEFDRSBHcm91cGNvbW0gUmVxdWVzdCBUeXBlDQoNCiAgIFRoaXMgc3BlY2lm aWNhdGlvbiBkZWZpbmVzIGEgbnVtYmVyIG9mIHR5cGVzIG9mIHJlcXVlc3RzLiAgVGhlIHRhYmxl DQogICBiZWxvdyBzdW1tYXJpemVzIHRoZW0uDQoNCg0KDQoNCg0KDQoNCg0KDQoNClBhbG9tYmlu aSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQ YWdlIDIyXQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29t bXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQogICArLS0tLS0tLS0tLS0tLS0tLS0tKy0t LS0tLS0tLS0rDQogICB8ICAgICBOYW1lICAgICAgICAgfCAgVmFsdWUgICB8DQogICArLS0tLS0t LS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0rDQogICB8IGtleSBkaXN0cmlidXRpb24gfCAgICAxICAg ICB8DQogICArLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0rDQogICB8IGxlYXZlICAgICAg ICAgICAgfCAgICAyICAgICB8DQogICArLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0rDQog ICB8IHVwZGF0ZSBrZXkgICAgICAgfCAgICAzICAgICB8DQogICArLS0tLS0tLS0tLS0tLS0tLS0t Ky0tLS0tLS0tLS0rDQogICB8IG5ldyAgICAgICAgICAgICAgfCAgICA0ICAgICB8DQogICArLS0t LS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0rDQogICB8IHB1YiBrZXlzICAgICAgICAgfCAgICA1 ICAgICB8DQogICArLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0rDQoNCjEwLiAgU2VjdXJp dHkgQ29uc2lkZXJhdGlvbnMNCg0KICAgV2hlbiBhIENsaWVudCByZWNlaXZlcyBhIG1lc3NhZ2Ug ZnJvbSBhIHNlbmRlciBmb3IgdGhlIGZpcnN0IHRpbWUsIGl0DQogICBuZWVkcyB0byBoYXZlIGEg bWVjaGFuaXNtIGluIHBsYWNlIHRvIGF2b2lkIHJlcGxheSwgZS5nLg0KICAgQXBwZW5kaXggQi4y IG9mIFtJLUQuaWV0Zi1jb3JlLW9iamVjdC1zZWN1cml0eV0uDQoNCiAgIFRoZSBLREMgbXVzdCBy ZW5ldyB0aGUgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIHVwb24gaXRzIGV4cGlyYXRpb24uDQoNCiAg IFRoZSBLREMgc2hvdWxkIHJlbmV3IHRoZSBrZXlpbmcgbWF0ZXJpYWwgdXBvbiBncm91cCBtZW1i ZXJzaGlwDQogICBjaGFuZ2UsIGFuZCBzaG91bGQgcHJvdmlkZSBpdCB0byB0aGUgY3VycmVudCBn cm91cCBtZW1iZXJzIHRocm91Z2gNCiAgIHRoZSByZWtleWluZyBzY2hlbWUgdXNlZCBpbiB0aGUg Z3JvdXAuDQoNCiAgIFRoZSBLREMgbWF5IGVuZm9yY2UgYSByZWtleWluZyBwb2xpY3kgdGhhdCB0 YWtlcyBpbnRvIGFjY291bnQgdGhlDQogICBvdmVyYWxsIHRpbWUgcmVxdWlyZWQgdG8gcmVrZXkg dGhlIGdyb3VwLCBhcyB3ZWxsIGFzIHRoZSBleHBlY3RlZA0KICAgcmF0ZSBvZiBjaGFuZ2VzIGlu IHRoZSBncm91cCBtZW1iZXJzaGlwLg0KDQogICBUaGF0IGlzLCB0aGUgS0RDIG1heSBub3QgcmVr ZXkgdGhlIGdyb3VwIGF0IGV2ZXJ5IG1lbWJlcnNoaXAgY2hhbmdlLA0KICAgZm9yIGluc3RhbmNl IGlmIG1lbWJlcnMnIGpvaW5pbmcgYW5kIGxlYXZpbmcgb2NjdXIgZnJlcXVlbnRseSBhbmQNCiAg IHBlcmZvcm1pbmcgYSBncm91cCByZWtleWluZyB0YWtlcyB0b28gbG9uZy4gIEluc3RlYWQsIHRo ZSBLREMgbWF5DQogICByZWtleSB0aGUgZ3JvdXAgYWZ0ZXIgYSBtaW51bSBudW1iZXIgb2YgZ3Jv dXAgbWVtYmVycyBoYXZlIGpvaW5lZCBvcg0KICAgbGVmdCB3aXRoaW4gYSBnaXZlbiB0aW1lIGlu dGVydmFsLCBvciBkdXJpbmcgcHJlZGljdGFibGUgbmV0d29yaw0KICAgaW5hY3Rpdml0eSBwZXJp b2RzLg0KDQogICBIb3dldmVyLCB0aGlzIHdvdWxkIHJlc3VsdCBpbiB0aGUgS0RDIG5vdCBjb25z dGFudGx5IHByZXNlcnZpbmcNCiAgIGJhY2t3YXJkIGFuZCBmb3J3YXJkIHNlY3VyaXR5LiAgSW4g ZmFjdCwgbmV3bHkgam9pbmluZyBncm91cCBtZW1iZXJzDQogICBjb3VsZCBiZSBhYmxlIHRvIGFj Y2VzcyB0aGUga2V5aW5nIG1hdGVyaWFsIHVzZWQgYmVmb3JlIHRoZWlyDQogICBqb2luaW5nLCBh bmQgdGh1cyBjb3VsZCBhY2Nlc3MgcGFzdCBncm91cCBjb21tdW5pY2F0aW9ucy4gIEFsc28sDQog ICB1bnRpbCB0aGUgS0RDIHBlcmZvcm1zIGEgZ3JvdXAgcmVrZXlpbmcsIHRoZSBuZXdseSBsZWF2 aW5nIG5vZGVzDQogICB3b3VsZCBzdGlsbCBiZSBhYmxlIHRvIGFjY2VzcyB1cGNvbWluZyBncm91 cCBjb21tdW5pY2F0aW9ucyB0aGF0IGFyZQ0KICAgcHJvdGVjdGVkIHdpdGggdGhlIGtleWluZyBt YXRlcmlhbCB0aGF0IGhhcyBub3QgeWV0IGJlZW4gdXBkYXRlZC4NCg0KDQoNCg0KDQoNCg0KUGFs b21iaW5pICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAg ICAgW1BhZ2UgMjNdDQoNCkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91 cCBDb21tdW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0KDQoNCjEwLjEuICBVcGRhdGUgb2YgS2V5 aW5nIE1hdGVyaWFsDQoNCiAgIEEgZ3JvdXAgbWVtYmVyIGNhbiByZWNlaXZlIGEgbWVzc2FnZSBz aG9ydGx5IGFmdGVyIHRoZSBncm91cCBoYXMgYmVlbg0KICAgcmVrZXllZCwgYW5kIG5ldyBrZXlp bmcgbWF0ZXJpYWwgaGFzIGJlZW4gZGlzdHJpYnV0ZWQgYnkgdGhlIEtEQy4gIEluDQogICB0aGUg Zm9sbG93aW5nIHR3byBjYXNlcywgdGhpcyBtYXkgcmVzdWx0IGluIG1pc2FsaWduZWQga2V5aW5n DQogICBtYXRlcmlhbCBiZXR3ZWVuIHRoZSBncm91cCBtZW1iZXJzLg0KDQogICBJbiB0aGUgZmly c3QgY2FzZSwgdGhlIHNlbmRlciBwcm90ZWN0cyBhIG1lc3NhZ2UgdXNpbmcgdGhlIG9sZCBrZXlp bmcNCiAgIG1hdGVyaWFsLiAgSG93ZXZlciwgdGhlIHJlY2lwaWVudCByZWNlaXZlcyB0aGUgbWVz c2FnZSBhZnRlciBoYXZpbmcNCiAgIHJlY2VpdmVkIHRoZSBuZXcga2V5aW5nIG1hdGVyaWFsLCBo ZW5jZSBub3QgYmVpbmcgYWJsZSB0byBjb3JyZWN0bHkNCiAgIHByb2Nlc3MgaXQuICBBIHBvc3Np YmxlIHdheSB0byBhbWVsaW9yYXRlIHRoaXMgaXNzdWUgaXMgdG8gcHJlc2VydmUNCiAgIHRoZSBv bGQsIHJlY2VudCwga2V5aW5nIG1hdGVyaWFsIGZvciBhIG1heGltdW0gYW1vdW50IG9mIHRpbWUg ZGVmaW5lZA0KICAgYnkgdGhlIGFwcGxpY2F0aW9uLiAgQnkgZG9pbmcgc28sIHRoZSByZWNpcGll bnQgY2FuIHN0aWxsIHRyeSB0bw0KICAgcHJvY2VzcyB0aGUgcmVjZWl2ZWQgbWVzc2FnZSB1c2lu ZyB0aGUgb2xkIHJldGFpbmVkIGtleWluZyBtYXRlcmlhbA0KICAgYXMgc2Vjb25kIGF0dGVtcHQu ICBOb3RlIHRoYXQgYSBmb3JtZXIgKGNvbXByb21pc2VkKSBncm91cCBtZW1iZXIgY2FuDQogICB0 YWtlIGFkdmFudGFnZSBvZiB0aGlzIGJ5IHNlbmRpbmcgbWVzc2FnZXMgcHJvdGVjdGVkIHdpdGgg dGhlIG9sZA0KICAgcmV0YWluZWQga2V5aW5nIG1hdGVyaWFsLiAgVGhlcmVmb3JlLCBhIGNvbnNl cnZhdGl2ZSBhcHBsaWNhdGlvbg0KICAgcG9saWN5IHNob3VsZCBub3QgYWRtaXQgdGhlIHN0b3Jh Z2Ugb2Ygb2xkIGtleWluZyBtYXRlcmlhbC4NCg0KICAgSW4gdGhlIHNlY29uZCBjYXNlLCB0aGUg c2VuZGVyIHByb3RlY3RzIGEgbWVzc2FnZSB1c2luZyB0aGUgbmV3DQogICBrZXlpbmcgbWF0ZXJp YWwsIGJ1dCB0aGUgcmVjaXBpZW50IHJlY2VpdmVzIHRoYXQgcmVxdWVzdCBiZWZvcmUNCiAgIGhh dmluZyByZWNlaXZlZCB0aGUgbmV3IGtleWluZyBtYXRlcmlhbC4gIFRoZXJlZm9yZSwgdGhlIHJl Y2lwaWVudA0KICAgd291bGQgbm90IGJlIGFibGUgdG8gY29ycmVjdGx5IHByb2Nlc3MgdGhlIHJl cXVlc3QgYW5kIGhlbmNlIGRpc2NhcmRzDQogICBpdC4gIElmIHRoZSByZWNpcGllbnQgcmVjZWl2 ZXMgdGhlIG5ldyBrZXlpbmcgbWF0ZXJpYWwgc2hvcnRseSBhZnRlcg0KICAgdGhhdCBhbmQgdGhl IHNlbmRlciBlbmRwb2ludCB1c2VzIENvQVAgcmV0cmFuc21pc3Npb25zLCB0aGUgZm9ybWVyDQog ICB3aWxsIHN0aWxsIGJlIGFibGUgdG8gcmVjZWl2ZSBhbmQgY29ycmVjdGx5IHByb2Nlc3MgdGhl IG1lc3NhZ2UuICBJbg0KICAgYW55IGNhc2UsIHRoZSByZWNpcGllbnQgc2hvdWxkIGFjdGl2ZWx5 IGFzayB0aGUgS0RDIGZvciBhbiB1cGRhdGVkDQogICBrZXlpbmcgbWF0ZXJpYWwgYWNjb3JkaW5n IHRvIGFuIGFwcGxpY2F0aW9uLWRlZmluZWQgcG9saWN5LCBmb3INCiAgIGluc3RhbmNlIGFmdGVy IGEgZ2l2ZW4gbnVtYmVyIG9mIHVuc3VjY2Vzc2Z1bGx5IGRlY3J5cHRlZCBpbmNvbWluZw0KICAg bWVzc2FnZXMuDQoNCjEwLjIuICBCbG9jay1XaXNlIENvbnNpZGVyYXRpb25zDQoNCiAgIElmIHRo ZSBibG9jay13aXNlIG9wdGlvbnMgW1JGQzc5NTldIGFyZSB1c2VkLCBhbmQgdGhlIGtleWluZyBt YXRlcmlhbA0KICAgaXMgdXBkYXRlZCBpbiB0aGUgbWlkZGxlIG9mIGEgYmxvY2std2lzZSB0cmFu c2ZlciwgdGhlIHNlbmRlciBvZiB0aGUNCiAgIGJsb2NrcyBqdXN0IGNoYW5nZXMgdGhlIGtleWlu ZyBtYXRlcmlhbCB0byB0aGUgdXBkYXRlZCBvbmUgYW5kDQogICBjb250aW51ZXMgdGhlIHRyYW5z ZmVyLiAgQXMgbG9uZyBhcyBib3RoIHNpZGVzIGdldCB0aGUgbmV3IGtleWluZw0KICAgbWF0ZXJp YWwsIHVwZGF0aW5nIHRoZSBrZXlpbmcgbWF0ZXJpYWwgaW4gdGhlIG1pZGRsZSBvZiBhIHRyYW5z ZmVyDQogICB3aWxsIG5vdCBjYXVzZSBhbnkgaXNzdWUuICBPdGhlcndpc2UsIHRoZSBzZW5kZXIg d2lsbCBoYXZlIHRvDQogICB0cmFuc21pdCB0aGUgbWVzc2FnZSBhZ2Fpbiwgd2hlbiByZWNlaXZp bmcgYW4gZXJyb3IgbWVzc2FnZSBmcm9tIHRoZQ0KICAgcmVjaXBpZW50Lg0KDQogICBDb21wYXJl ZCB0byBhIHNjZW5hcmlvIHdoZXJlIHRoZSB0cmFuc2ZlciBkb2VzIG5vdCB1c2UgYmxvY2std2lz ZSwNCiAgIGRlcGVuZGluZyBvbiBob3cgZmFzdCB0aGUga2V5aW5nIG1hdGVyaWFsIGlzIGNoYW5n ZWQsIHRoZSBub2RlcyBtaWdodA0KICAgY29uc3VtZSBhIGxhcmdlciBhbW91bnQgb2YgdGhlIG5l dHdvcmsgcmVzZW5kaW5nIHRoZSBibG9ja3MgYWdhaW4gYW5kDQogICBhZ2Fpbiwgd2hpY2ggbWln aHQgYmUgcHJvYmxlbWF0aWMuDQoNCg0KDQoNCg0KUGFsb21iaW5pICYgVGlsb2NhICAgICAgIEV4 cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgW1BhZ2UgMjRdDQoNCkludGVybmV0 LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uICAgICAgIEp1 bHkgMjAxOQ0KDQoNCjExLiAgSUFOQSBDb25zaWRlcmF0aW9ucw0KDQogICBUaGlzIGRvY3VtZW50 IGhhcyB0aGUgZm9sbG93aW5nIGFjdGlvbnMgZm9yIElBTkEuDQoNCjExLjEuICBBQ0UgQXV0aG9y aXphdGlvbiBTZXJ2ZXIgUmVxdWVzdCBDcmVhdGlvbiBIaW50cyBSZWdpc3RyeQ0KDQogICBJQU5B IGlzIGFza2VkIHRvIHJlZ2lzdGVyIHRoZSBmb2xsb3dpbmcgZW50cmllcyBpbiB0aGUgIkFDRQ0K ICAgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgUmVxdWVzdCBDcmVhdGlvbiBIaW50cyIgUmVnaXN0cnkg ZGVmaW5lZCBpbg0KICAgU2VjdGlvbiA4LjEgb2YgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0u DQoNCiAgIG8gIE5hbWU6IHNpZ25faW5mbw0KDQogICBvICBDQk9SIEtleTogVEJEIChyYW5nZSAt MjU2IHRvIDI1NSkNCg0KICAgbyAgVmFsdWUgVHlwZTogYW55DQoNCiAgIG8gIFJlZmVyZW5jZTog W1tUaGlzIHNwZWNpZmljYXRpb25dXQ0KDQogICBvICBOYW1lOiBwdWJfa2V5X2VuYw0KDQogICBv ICBDQk9SIEtleTogVEJEIChyYW5nZSAtMjU2IHRvIDI1NSkNCg0KICAgbyAgVmFsdWUgVHlwZTog aW50ZWdlcg0KDQogICBvICBSZWZlcmVuY2U6IFtbVGhpcyBzcGVjaWZpY2F0aW9uXV0NCg0KMTEu Mi4gIEFDRSBQdWJsaWMgS2V5IEVuY29kaW5nIFJlZ2lzdHJ5DQoNCiAgIFRoaXMgc3BlY2lmaWNh dGlvbiBlc3RhYmxpc2hlcyB0aGUgIkFDRSBQdWJsaWMgS2V5IEVuY29kaW5nIiBJQU5BDQogICBS ZWdpc3RyeS4gIFRoZSBSZWdpc3RyeSBoYXMgYmVlbiBjcmVhdGVkIHRvIHVzZSB0aGUgIkV4cGVy dCBSZXZpZXcNCiAgIFJlcXVpcmVkIiByZWdpc3RyYXRpb24gcHJvY2VkdXJlIFtSRkM4MTI2XS4g IEV4cGVydCByZXZpZXcgZ3VpZGVsaW5lcw0KICAgYXJlIHByb3ZpZGVkIGluIFNlY3Rpb24gMTEu OS4gIEl0IHNob3VsZCBiZSBub3RlZCB0aGF0LCBpbiBhZGRpdGlvbg0KICAgdG8gdGhlIGV4cGVy dCByZXZpZXcsIHNvbWUgcG9ydGlvbnMgb2YgdGhlIFJlZ2lzdHJ5IHJlcXVpcmUgYQ0KICAgc3Bl Y2lmaWNhdGlvbiwgcG90ZW50aWFsbHkgYSBTdGFuZGFyZHMgVHJhY2sgUkZDLCBiZSBzdXBwbGll ZCBhcw0KICAgd2VsbC4NCg0KICAgVGhlIGNvbHVtbnMgb2YgdGhpcyBSZWdpc3RyeSBhcmU6DQoN CiAgIG8gIE5hbWU6IFRoaXMgaXMgYSBkZXNjcmlwdGl2ZSBuYW1lIHRoYXQgZW5hYmxlcyBlYXNp ZXIgcmVmZXJlbmNlIHRvDQogICAgICB0aGUgaXRlbS4gIFRoZSBuYW1lIE1VU1QgYmUgdW5pcXVl LiAgSXQgaXMgbm90IHVzZWQgaW4gdGhlDQogICAgICBlbmNvZGluZy4NCg0KICAgbyAgVmFsdWU6 IFRoZSB2YWx1ZSB0byBiZSB1c2VkIHRvIGlkZW50aWZ5IHRoaXMgcHVibGljIGtleSBlbmNvZGlu Zy4NCiAgICAgIFRoaXMgdmFsdWUgTVVTVCBiZSB1bmlxdWUuICBUaGUgdmFsdWUgY2FuIGJlIGEg cG9zaXRpdmUgb3IgYQ0KICAgICAgbmVnYXRpdmUgaW50ZWdlci4gIEludGVnZXIgdmFsdWVzIGJl dHdlZW4gMCBhbmQgMjU1IGFyZSBkZXNpZ25hdGVkDQogICAgICBhcyBTdGFuZGFyZHMgVHJhY2sg RG9jdW1lbnQgcmVxdWlyZWQuICBJbnRlZ2VyIHZhbHVlcyBmcm9tIDI1NiB0bw0KICAgICAgNjU1 MzUgYXJlIGRlc2lnbmF0ZWQgYXMgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZC4gIEludGVnZXIgdmFs dWVzIG9mDQoNCg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkg NiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDI1XQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFBy b3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQog ICAgICBncmVhdGVyIHRoYW4gNjU1MzUgYXJlIGRlc2lnbmF0ZWQgYXMgZXhwZXJ0IHJldmlldy4g IEludGVnZXINCiAgICAgIHZhbHVlcyBsZXNzIHRoYW4gLTY1NTM2IGFyZSBtYXJrZWQgYXMgcHJp dmF0ZSB1c2UuDQoNCiAgIG8gIERlc2NyaXB0aW9uOiBUaGlzIGZpZWxkIGNvbnRhaW5zIGEgYnJp ZWYgZGVzY3JpcHRpb24gZm9yIHRoaXMNCiAgICAgIHB1YmxpYyBrZXkgZW5jb2RpbmcuDQoNCiAg IG8gIFJlZmVyZW5jZTogVGhpcyBmaWVsZCBjb250YWlucyBhIHBvaW50ZXIgdG8gdGhlIHB1Ymxp Yw0KICAgICAgc3BlY2lmaWNhdGlvbiBwcm92aWRpbmcgdGhlIHB1YmxpYyBrZXkgZW5jb2Rpbmcs IGlmIG9uZSBleGlzdHMuDQoNCiAgIFRoZSB2YWx1ZSAwIGlzIHRvIGJlIG1hcmtlZCBhcyAiUmVz ZXJ2ZWQiLi4NCg0KMTEuMy4gIEFDRSBHcm91cGNvbW0gUGFyYW1ldGVycyBSZWdpc3RyeQ0KDQog ICBUaGlzIHNwZWNpZmljYXRpb24gZXN0YWJsaXNoZXMgdGhlICJBQ0UgR3JvdXBjb21tIFBhcmFt ZXRlcnMiIElBTkENCiAgIFJlZ2lzdHJ5LiAgVGhlIFJlZ2lzdHJ5IGhhcyBiZWVuIGNyZWF0ZWQg dG8gdXNlIHRoZSAiRXhwZXJ0IFJldmlldw0KICAgUmVxdWlyZWQiIHJlZ2lzdHJhdGlvbiBwcm9j ZWR1cmUgW1JGQzgxMjZdLiAgRXhwZXJ0IHJldmlldyBndWlkZWxpbmVzDQogICBhcmUgcHJvdmlk ZWQgaW4gU2VjdGlvbiAxMS45Lg0KDQogICBUaGUgY29sdW1ucyBvZiB0aGlzIFJlZ2lzdHJ5IGFy ZToNCg0KICAgbyAgTmFtZTogVGhpcyBpcyBhIGRlc2NyaXB0aXZlIG5hbWUgdGhhdCBlbmFibGVz IGVhc2llciByZWZlcmVuY2UgdG8NCiAgICAgIHRoZSBpdGVtLiAgVGhlIG5hbWUgTVVTVCBiZSB1 bmlxdWUuLiAgSXQgaXMgbm90IHVzZWQgaW4gdGhlDQogICAgICBlbmNvZGluZy4NCg0KICAgbyAg Q0JPUiBLZXk6IFRoaXMgaXMgdGhlIHZhbHVlIHVzZWQgYXMgQ0JPUiBrZXkgb2YgdGhlIGl0ZW0u ICBUaGVzZQ0KICAgICAgdmFsdWVzIE1VU1QgYmUgdW5pcXVlLiAgVGhlIHZhbHVlIGNhbiBiZSBh IHBvc2l0aXZlIGludGVnZXIsIGENCiAgICAgIG5lZ2F0aXZlIGludGVnZXIsIG9yIGEgc3RyaW5n Lg0KDQogICBvICBDQk9SIFR5cGU6IFRoaXMgY29udGFpbnMgdGhlIENCT1IgdHlwZSBvZiB0aGUg aXRlbSwgb3IgYSBwb2ludGVyDQogICAgICB0byB0aGUgcmVnaXN0cnkgdGhhdCBkZWZpbmVzIGl0 cyB0eXBlLCB3aGVuIHRoYXQgZGVwZW5kcyBvbg0KICAgICAgYW5vdGhlciBpdGVtLg0KDQogICBv ICBSZWZlcmVuY2U6IFRoaXMgY29udGFpbnMgYSBwb2ludGVyIHRvIHRoZSBwdWJsaWMgc3BlY2lm aWNhdGlvbiBmb3INCiAgICAgIHRoZSBmb3JtYXQgb2YgdGhlIGl0ZW0sIGlmIG9uZSBleGlzdHMu DQoNCiAgIFRoaXMgUmVnaXN0cnkgaGFzIGJlZW4gaW5pdGlhbGx5IHBvcHVsYXRlZCBieSB0aGUg dmFsdWVzIGluDQogICBTZWN0aW9uIDguICBUaGUgc3BlY2lmaWNhdGlvbiBjb2x1bW4gZm9yIGFs bCBvZiB0aGVzZSBlbnRyaWVzIHdpbGwgYmUNCiAgIHRoaXMgZG9jdW1lbnQuDQoNCjExLjQuICBB Y2UgR3JvdXBjb21tIFJlcXVlc3QgVHlwZSBSZWdpc3RyeQ0KDQogICBUaGlzIHNwZWNpZmljYXRp b24gZXN0YWJsaXNoZXMgdGhlICJBQ0UgR3JvdXBjb21tIFJlcXVlc3QgVHlwZSIgSUFOQQ0KICAg UmVnaXN0cnkuICBUaGUgUmVnaXN0cnkgaGFzIGJlZW4gY3JlYXRlZCB0byB1c2UgdGhlICJFeHBl cnQgUmV2aWV3DQogICBSZXF1aXJlZCIgcmVnaXN0cmF0aW9uIHByb2NlZHVyZSBbUkZDODEyNl0u ICBFeHBlcnQgcmV2aWV3IGd1aWRlbGluZXMNCiAgIGFyZSBwcm92aWRlZCBpbiBTZWN0aW9uIDEx LjkuDQoNCiAgIFRoZSBjb2x1bW5zIG9mIHRoaXMgUmVnaXN0cnkgYXJlOg0KDQoNCg0KDQpQYWxv bWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAg ICBbUGFnZSAyNl0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3Vw IENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgbyAgTmFtZTogVGhpcyBpcyBh IGRlc2NyaXB0aXZlIG5hbWUgdGhhdCBlbmFibGVzIGVhc2llciByZWZlcmVuY2UgdG8NCiAgICAg IHRoZSBpdGVtLiAgVGhlIG5hbWUgTVVTVCBiZSB1bmlxdWUuICBJdCBpcyBub3QgdXNlZCBpbiB0 aGUNCiAgICAgIGVuY29kaW5nLg0KDQogICBvICBWYWx1ZTogVGhpcyBpcyB0aGUgdmFsdWUgdXNl ZCB0byBpZGVudGlmeSB0aGUgcmVxdWVzdC4gIFRoZXNlDQogICAgICB2YWx1ZXMgTVVTVCBiZSB1 bmlxdWUuICBUaGUgdmFsdWUgbXVzdCBiZSBhIHBvc2l0aXZlIGludGVnZXIuDQoNCiAgIG8gIFJl ZmVyZW5jZTogVGhpcyBjb250YWlucyBhIHBvaW50ZXIgdG8gdGhlIHB1YmxpYyBzcGVjaWZpY2F0 aW9uIGZvcg0KICAgICAgdGhlIGZvcm1hdCBvZiB0aGUgaXRlbSwgaWYgb25lIGV4aXN0cy4NCg0K ICAgVGhpcyBSZWdpc3RyeSBoYXMgYmVlbiBpbml0aWFsbHkgcG9wdWxhdGVkIGJ5IHRoZSB2YWx1 ZXMgaW4NCiAgIFNlY3Rpb24gOS4gIFRoZSByZWZlcmVuY2UgY29sdW1uIGZvciBhbGwgb2YgdGhl c2UgZW50cmllcyB3aWxsIGJlDQogICB0aGlzIGRvY3VtZW50LiAgVGhlIHZhbHVlIDAgaXMgdG8g YmUgbWFya2VkIGFzICJSZXNlcnZlZCIuDQoNCjExLjUuICBBQ0UgR3JvdXBjb21tIEtleSBSZWdp c3RyeQ0KDQogICBUaGlzIHNwZWNpZmljYXRpb24gZXN0YWJsaXNoZXMgdGhlICJBQ0UgR3JvdXBj b21tIEtleSIgSUFOQSBSZWdpc3RyeS4NCiAgIFRoZSBSZWdpc3RyeSBoYXMgYmVlbiBjcmVhdGVk IHRvIHVzZSB0aGUgIkV4cGVydCBSZXZpZXcgUmVxdWlyZWQiDQogICByZWdpc3RyYXRpb24gcHJv Y2VkdXJlIFtSRkM4MTI2XS4gIEV4cGVydCByZXZpZXcgZ3VpZGVsaW5lcyBhcmUNCiAgIHByb3Zp ZGVkIGluIFNlY3Rpb24gMTEuOS4NCg0KICAgVGhlIGNvbHVtbnMgb2YgdGhpcyBSZWdpc3RyeSBh cmU6DQoNCiAgIG8gIE5hbWU6IFRoaXMgaXMgYSBkZXNjcmlwdGl2ZSBuYW1lIHRoYXQgZW5hYmxl cyBlYXNpZXIgcmVmZXJlbmNlIHRvDQogICAgICB0aGUgaXRlbS4gIFRoZSBuYW1lIE1VU1QgYmUg dW5pcXVlLiAgSXQgaXMgbm90IHVzZWQgaW4gdGhlDQogICAgICBlbmNvZGluZy4NCg0KICAgbyAg S2V5IFR5cGUgVmFsdWU6IFRoaXMgaXMgdGhlIHZhbHVlIHVzZWQgdG8gaWRlbnRpZnkgdGhlIGtl eWluZw0KICAgICAgbWF0ZXJpYWwuICBUaGVzZSB2YWx1ZXMgTVVTVCBiZSB1bmlxdWUuICBUaGUg dmFsdWUgY2FuIGJlIGENCiAgICAgIHBvc2l0aXZlIGludGVnZXIsIGEgbmVnYXRpdmUgaW50ZWdl ciwgb3IgYSBzdHJpbmcuDQoNCiAgIG8gIFByb2ZpbGU6IFRoaXMgZmllbGQgbWF5IGNvbnRhaW4g b25lIG9yIG1vcmUgZGVzY3JpcHRpdmUgc3RyaW5ncyBvZg0KICAgICAgYXBwbGljYXRpb24gcHJv ZmlsZXMgdG8gYmUgdXNlZCB3aXRoIHRoaXMgaXRlbS4gIFRoZSB2YWx1ZXMgc2hvdWxkDQogICAg ICBiZSB0YWtlbiBmcm9tIHRoZSBOYW1lIGNvbHVtbiBvZiB0aGUgIkFDRSBHcm91cGNvbW0gUHJv ZmlsZSINCiAgICAgIFJlZ2lzdHJ5Lg0KDQogICBvICBEZXNjcmlwdGlvbjogVGhpcyBmaWVsZCBj b250YWlucyBhIGJyaWVmIGRlc2NyaXB0aW9uIG9mIHRoZSBrZXlpbmcNCiAgICAgIG1hdGVyaWFs Lg0KDQogICBvICBSZWZlcmVuY2VzOiBUaGlzIGNvbnRhaW5zIGEgcG9pbnRlciB0byB0aGUgcHVi bGljIHNwZWNpZmljYXRpb24NCiAgICAgIGZvciB0aGUgZm9ybWF0IG9mIHRoZSBrZXlpbmcgbWF0 ZXJpYWwsIGlmIG9uZSBleGlzdHMuDQoNCiAgIFRoaXMgUmVnaXN0cnkgaGFzIGJlZW4gaW5pdGlh bGx5IHBvcHVsYXRlZCBieSB0aGUgdmFsdWVzIGluIEZpZ3VyZSA1Lg0KICAgVGhlIHNwZWNpZmlj YXRpb24gY29sdW1uIGZvciBhbGwgb2YgdGhlc2UgZW50cmllcyB3aWxsIGJlIHRoaXMNCiAgIGRv Y3VtZW50Lg0KDQoNCg0KDQoNCg0KUGFsb21iaW5pICYgVGlsb2NhICAgICAgIEV4cGlyZXMgSmFu dWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgW1BhZ2UgMjddDQoNCkludGVybmV0LURyYWZ0ICBL ZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uICAgICAgIEp1bHkgMjAxOQ0K DQoNCjExLjYuICBBQ0UgR3JvdXBjb21tIFByb2ZpbGUgUmVnaXN0cnkNCg0KICAgVGhpcyBzcGVj aWZpY2F0aW9uIGVzdGFibGlzaGVzIHRoZSAiQUNFIEdyb3VwY29tbSBQcm9maWxlIiBJQU5BDQog ICBSZWdpc3RyeS4gIFRoZSBSZWdpc3RyeSBoYXMgYmVlbiBjcmVhdGVkIHRvIHVzZSB0aGUgIkV4 cGVydCBSZXZpZXcNCiAgIFJlcXVpcmVkIiByZWdpc3RyYXRpb24gcHJvY2VkdXJlIFtSRkM4MTI2 XS4gIEV4cGVydCByZXZpZXcgZ3VpZGVsaW5lcw0KICAgYXJlIHByb3ZpZGVkIGluIFNlY3Rpb24g MTEuOS4gIEl0IHNob3VsZCBiZSBub3RlZCB0aGF0LCBpbiBhZGRpdGlvbg0KICAgdG8gdGhlIGV4 cGVydCByZXZpZXcsIHNvbWUgcG9ydGlvbnMgb2YgdGhlIFJlZ2lzdHJ5IHJlcXVpcmUgYQ0KICAg c3BlY2lmaWNhdGlvbiwgcG90ZW50aWFsbHkgYSBTdGFuZGFyZHMgVHJhY2sgUkZDLCBiZSBzdXBw bGllZCBhcw0KICAgd2VsbC4NCg0KICAgVGhlIGNvbHVtbnMgb2YgdGhpcyBSZWdpc3RyeSBhcmU6 DQoNCiAgIG8gIE5hbWU6IFRoZSBuYW1lIG9mIHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlLCB0byBi ZSB1c2VkIGFzIHZhbHVlIG9mDQogICAgICB0aGUgcHJvZmlsZSBhdHRyaWJ1dGUuDQoNCiAgIG8g IERlc2NyaXB0aW9uOiBUZXh0IGdpdmluZyBhbiBvdmVydmlldyBvZiB0aGUgYXBwbGljYXRpb24g cHJvZmlsZQ0KICAgICAgYW5kIHRoZSBjb250ZXh0IGl0IGlzIGRldmVsb3BlZCBmb3IuDQoNCiAg IG8gIENCT1IgVmFsdWU6IENCT1IgYWJicmV2aWF0aW9uIGZvciB0aGUgbmFtZSBvZiB0aGlzIGFw cGxpY2F0aW9uDQogICAgICBwcm9maWxlLiAgRGlmZmVyZW50IHJhbmdlcyBvZiB2YWx1ZXMgdXNl IGRpZmZlcmVudCByZWdpc3RyYXRpb24NCiAgICAgIHBvbGljaWVzIFtSRkM4MTI2XS4gIEludGVn ZXIgdmFsdWVzIGZyb20gLTI1NiB0byAyNTUgYXJlDQogICAgICBkZXNpZ25hdGVkIGFzIFN0YW5k YXJkcyBBY3Rpb24uICBJbnRlZ2VyIHZhbHVlcyBmcm9tIC02NTUzNiB0bw0KICAgICAgLTI1NyBh bmQgZnJvbSAyNTYgdG8gNjU1MzUgYXJlIGRlc2lnbmF0ZWQgYXMgU3BlY2lmaWNhdGlvbg0KICAg ICAgUmVxdWlyZWQuICBJbnRlZ2VyIHZhbHVlcyBncmVhdGVyIHRoYW4gNjU1MzUgYXJlIGRlc2ln bmF0ZWQgYXMNCiAgICAgIEV4cGVydCBSZXZpZXcuICBJbnRlZ2VyIHZhbHVlcyBsZXNzIHRoYW4g LTY1NTM2IGFyZSBtYXJrZWQgYXMNCiAgICAgIFByaXZhdGUgVXNlLg0KDQogICBvICBSZWZlcmVu Y2U6IFRoaXMgY29udGFpbnMgYSBwb2ludGVyIHRvIHRoZSBwdWJsaWMgc3BlY2lmaWNhdGlvbiBv Zg0KICAgICAgdGhlIGFiYnJldmlhdGlvbiBmb3IgdGhpcyBhcHBsaWNhdGlvbiBwcm9maWxlLCBp ZiBvbmUgZXhpc3RzLg0KDQoxMS43LiAgQUNFIEdyb3VwY29tbSBQb2xpY3kgUmVnaXN0cnkNCg0K ICAgVGhpcyBzcGVjaWZpY2F0aW9uIGVzdGFibGlzaGVzIHRoZSAiQUNFIEdyb3VwY29tbSBQb2xp Y3kiIElBTkENCiAgIFJlZ2lzdHJ5LiAgVGhlIFJlZ2lzdHJ5IGhhcyBiZWVuIGNyZWF0ZWQgdG8g dXNlIHRoZSAiRXhwZXJ0IFJldmlldw0KICAgUmVxdWlyZWQiIHJlZ2lzdHJhdGlvbiBwcm9jZWR1 cmUgW1JGQzgxMjZdLiAgRXhwZXJ0IHJldmlldyBndWlkZWxpbmVzDQogICBhcmUgcHJvdmlkZWQg aW4gU2VjdGlvbiAxMS45LiAgSXQgc2hvdWxkIGJlIG5vdGVkIHRoYXQsIGluIGFkZGl0aW9uDQog ICB0byB0aGUgZXhwZXJ0IHJldmlldywgc29tZSBwb3J0aW9ucyBvZiB0aGUgUmVnaXN0cnkgcmVx dWlyZSBhDQogICBzcGVjaWZpY2F0aW9uLCBwb3RlbnRpYWxseSBhIFN0YW5kYXJkcyBUcmFjayBS RkMsIGJlIHN1cHBsaWVkIGFzDQogICB3ZWxsLg0KDQogICBUaGUgY29sdW1ucyBvZiB0aGlzIFJl Z2lzdHJ5IGFyZToNCg0KICAgbyAgTmFtZTogVGhlIG5hbWUgb2YgdGhlIGdyb3VwIGNvbW11bmlj YXRpb24gcG9saWN5Lg0KDQogICBvICBDQk9SIGxhYmVsOiBUaGUgdmFsdWUgdG8gYmUgdXNlZCB0 byBpZGVudGlmeSB0aGlzIGdyb3VwDQogICAgICBjb21tdW5pY2F0aW9uIHBvbGljeS4gIEtleSBt YXAgbGFiZWxzIE1VU1QgYmUgdW5pcXVlLiAgVGhlIGxhYmVsDQogICAgICBjYW4gYmUgYSBwb3Np dGl2ZSBpbnRlZ2VyLCBhIG5lZ2F0aXZlIGludGVnZXIgb3IgYSBzdHJpbmcuDQogICAgICBJbnRl Z2VyIHZhbHVlcyBiZXR3ZWVuIDAgYW5kIDI1NSBhbmQgc3RyaW5ncyBvZiBsZW5ndGggMSBhcmUN Cg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAg ICAgICAgICAgICAgIFtQYWdlIDI4XQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmlu ZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQogICAgICBkZXNp Z25hdGVkIGFzIFN0YW5kYXJkcyBUcmFjayBEb2N1bWVudCByZXF1aXJlZC4gIEludGVnZXIgdmFs dWVzDQogICAgICBmcm9tIDI1NiB0byA2NTUzNSBhbmQgc3RyaW5ncyBvZiBsZW5ndGggMiBhcmUg ZGVzaWduYXRlZCBhcw0KICAgICAgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZC4gIEludGVnZXIgdmFs dWVzIG9mIGdyZWF0ZXIgdGhhbiA2NTUzNSBhbmQNCiAgICAgIHN0cmluZ3Mgb2YgbGVuZ3RoIGdy ZWF0ZXIgdGhhbiAyIGFyZSBkZXNpZ25hdGVkIGFzIGV4cGVydCByZXZpZXcuDQogICAgICBJbnRl Z2VyIHZhbHVlcyBsZXNzIHRoYW4gLTY1NTM2IGFyZSBtYXJrZWQgYXMgcHJpdmF0ZSB1c2UuDQoN CiAgIG8gIENCT1IgdHlwZTogdGhlIENCT1IgdHlwZSB1c2VkIHRvIGVuY29kZSB0aGUgdmFsdWUg b2YgdGhpcyBncm91cA0KICAgICAgY29tbXVuaWNhdGlvbiBwb2xpY3kuDQoNCiAgIG8gIERlc2Ny aXB0aW9uOiBUaGlzIGZpZWxkIGNvbnRhaW5zIGEgYnJpZWYgZGVzY3JpcHRpb24gZm9yIHRoaXMN CiAgICAgIGdyb3VwIGNvbW11bmljYXRpb24gcG9saWN5Lg0KDQogICBvICBSZWZlcmVuY2U6IFRo aXMgZmllbGQgY29udGFpbnMgYSBwb2ludGVyIHRvIHRoZSBwdWJsaWMNCiAgICAgIHNwZWNpZmlj YXRpb24gcHJvdmlkaW5nIHRoZSBmb3JtYXQgb2YgdGhlIGdyb3VwIGNvbW11bmljYXRpb24NCiAg ICAgIHBvbGljeSwgaWYgb25lIGV4aXN0cy4NCg0KICAgVGhpcyByZWdpc3RyeSB3aWxsIGJlIGlu aXRpYWxseSBwb3B1bGF0ZWQgYnkgdGhlIHZhbHVlcyBpbiBGaWd1cmUgNi4NCg0KMTEuOC4gIFNl cXVlbmNlIE51bWJlciBTeW5jaHJvbml6YXRpb24gTWV0aG9kIFJlZ2lzdHJ5DQoNCiAgIFRoaXMg c3BlY2lmaWNhdGlvbiBlc3RhYmxpc2hlcyB0aGUgIlNlcXVlbmNlIE51bWJlciBTeW5jaHJvbml6 YXRpb24NCiAgIE1ldGhvZCIgSUFOQSBSZWdpc3RyeS4gIFRoZSBSZWdpc3RyeSBoYXMgYmVlbiBj cmVhdGVkIHRvIHVzZSB0aGUNCiAgICJFeHBlcnQgUmV2aWV3IFJlcXVpcmVkIiByZWdpc3RyYXRp b24gcHJvY2VkdXJlIFtSRkM4MTI2XS4gIEV4cGVydA0KICAgcmV2aWV3IGd1aWRlbGluZXMgYXJl IHByb3ZpZGVkIGluIFNlY3Rpb24gMTEuOS4gIEl0IHNob3VsZCBiZSBub3RlZA0KICAgdGhhdCwg aW4gYWRkaXRpb24gdG8gdGhlIGV4cGVydCByZXZpZXcsIHNvbWUgcG9ydGlvbnMgb2YgdGhlIFJl Z2lzdHJ5DQogICByZXF1aXJlIGEgc3BlY2lmaWNhdGlvbiwgcG90ZW50aWFsbHkgYSBTdGFuZGFy ZHMgVHJhY2sgUkZDLCBiZQ0KICAgc3VwcGxpZWQgYXMgd2VsbC4NCg0KICAgVGhlIGNvbHVtbnMg b2YgdGhpcyBSZWdpc3RyeSBhcmU6DQoNCiAgIG8gIE5hbWU6IFRoZSBuYW1lIG9mIHRoZSBzZXF1 ZW5jZSBudW1iZXIgc3luY2hyb25pemF0aW9uIG1ldGhvZC4NCg0KICAgbyAgVmFsdWU6IFRoZSB2 YWx1ZSB0byBiZSB1c2VkIHRvIGlkZW50aWZ5IHRoaXMgc2VxdWVuY2UgbnVtYmVyDQogICAgICBz eW5jaHJvbml6YXRpb24gbWV0aG9kLg0KDQogICBvICBEZXNjcmlwdGlvbjogVGhpcyBmaWVsZCBj b250YWlucyBhIGJyaWVmIGRlc2NyaXB0aW9uIGZvciB0aGlzDQogICAgICBzZXF1ZW5jZSBudW1i ZXIgc3luY2hyb25pemF0aW9uIG1ldGhvZC4NCg0KICAgbyAgUmVmZXJlbmNlOiBUaGlzIGZpZWxk IGNvbnRhaW5zIGEgcG9pbnRlciB0byB0aGUgcHVibGljDQogICAgICBzcGVjaWZpY2F0aW9uIGRl c2NyaWJpbmcgdGhlIHNlcXVlbmNlIG51bWJlciBzeW5jaHJvbml6YXRpb24NCiAgICAgIG1ldGhv ZC4NCg0KMTEuOS4gIEV4cGVydCBSZXZpZXcgSW5zdHJ1Y3Rpb25zDQoNCiAgIFRoZSBJQU5BIFJl Z2lzdHJpZXMgZXN0YWJsaXNoZWQgaW4gdGhpcyBkb2N1bWVudCBhcmUgZGVmaW5lZCBhcw0KICAg ZXhwZXJ0IHJldmlldy4gIFRoaXMgc2VjdGlvbiBnaXZlcyBzb21lIGdlbmVyYWwgZ3VpZGVsaW5l cyBmb3Igd2hhdA0KICAgdGhlIGV4cGVydHMgc2hvdWxkIGJlIGxvb2tpbmcgZm9yLCBidXQgdGhl eSBhcmUgYmVpbmcgZGVzaWduYXRlZCBhcw0KICAgZXhwZXJ0cyBmb3IgYSByZWFzb24gc28gdGhl eSBzaG91bGQgYmUgZ2l2ZW4gc3Vic3RhbnRpYWwgbGF0aXR1ZGUuDQoNCg0KDQpQYWxvbWJpbmkg JiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICBbUGFn ZSAyOV0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11 bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgRXhwZXJ0IHJldmlld2VycyBzaG91bGQg dGFrZSBpbnRvIGNvbnNpZGVyYXRpb24gdGhlIGZvbGxvd2luZyBwb2ludHM6DQoNCiAgIG8gIFBv aW50IHNxdWF0dGluZyBzaG91bGQgYmUgZGlzY291cmFnZWQuICBSZXZpZXdlcnMgYXJlIGVuY291 cmFnZWQNCiAgICAgIHRvIGdldCBzdWZmaWNpZW50IGluZm9ybWF0aW9uIGZvciByZWdpc3RyYXRp b24gcmVxdWVzdHMgdG8gZW5zdXJlDQogICAgICB0aGF0IHRoZSB1c2FnZSBpcyBub3QgZ29pbmcg dG8gZHVwbGljYXRlIG9uZSB0aGF0IGlzIGFscmVhZHkNCiAgICAgIHJlZ2lzdGVyZWQgYW5kIHRo YXQgdGhlIHBvaW50IGlzIGxpa2VseSB0byBiZSB1c2VkIGluIGRlcGxveW1lbnRzLg0KICAgICAg VGhlIHpvbmVzIHRhZ2dlZCBhcyBwcml2YXRlIHVzZSBhcmUgaW50ZW5kZWQgZm9yIHRlc3Rpbmcg cHVycG9zZXMNCiAgICAgIGFuZCBjbG9zZWQgZW52aXJvbm1lbnRzLCBjb2RlIHBvaW50cyBpbiBv dGhlciByYW5nZXMgc2hvdWxkIG5vdCBiZQ0KICAgICAgYXNzaWduZWQgZm9yIHRlc3RpbmcuDQoN CiAgIG8gIFNwZWNpZmljYXRpb25zIGFyZSByZXF1aXJlZCBmb3IgdGhlIHN0YW5kYXJkcyB0cmFj ayByYW5nZSBvZiBwb2ludA0KICAgICAgYXNzaWdubWVudC4gIFNwZWNpZmljYXRpb25zIHNob3Vs ZCBleGlzdCBmb3Igc3BlY2lmaWNhdGlvbg0KICAgICAgcmVxdWlyZWQgcmFuZ2VzLCBidXQgZWFy bHkgYXNzaWdubWVudCBiZWZvcmUgYSBzcGVjaWZpY2F0aW9uIGlzDQogICAgICBhdmFpbGFibGUg aXMgY29uc2lkZXJlZCB0byBiZSBwZXJtaXNzaWJsZS4gIFNwZWNpZmljYXRpb25zIGFyZQ0KICAg ICAgbmVlZGVkIGZvciB0aGUgZmlyc3QtY29tZSwgZmlyc3Qtc2VydmUgcmFuZ2UgaWYgdGhleSBh cmUgZXhwZWN0ZWQNCiAgICAgIHRvIGJlIHVzZWQgb3V0c2lkZSBvZiBjbG9zZWQgZW52aXJvbm1l bnRzIGluIGFuIGludGVyb3BlcmFibGUgd2F5Lg0KICAgICAgV2hlbiBzcGVjaWZpY2F0aW9ucyBh cmUgbm90IHByb3ZpZGVkLCB0aGUgZGVzY3JpcHRpb24gcHJvdmlkZWQNCiAgICAgIG5lZWRzIHRv IGhhdmUgc3VmZmljaWVudCBpbmZvcm1hdGlvbiB0byBpZGVudGlmeSB3aGF0IHRoZSBwb2ludCBp cw0KICAgICAgYmVpbmcgdXNlZCBmb3IuDQoNCiAgIG8gIEV4cGVydHMgc2hvdWxkIHRha2UgaW50 byBhY2NvdW50IHRoZSBleHBlY3RlZCB1c2FnZSBvZiBmaWVsZHMgd2hlbg0KICAgICAgYXBwcm92 aW5nIHBvaW50IGFzc2lnbm1lbnQuICBUaGUgZmFjdCB0aGF0IHRoZXJlIGlzIGEgcmFuZ2UgZm9y DQogICAgICBzdGFuZGFyZHMgdHJhY2sgZG9jdW1lbnRzIGRvZXMgbm90IG1lYW4gdGhhdCBhIHN0 YW5kYXJkcyB0cmFjaw0KICAgICAgZG9jdW1lbnQgY2Fubm90IGhhdmUgcG9pbnRzIGFzc2lnbmVk IG91dHNpZGUgb2YgdGhhdCByYW5nZS4gIFRoZQ0KICAgICAgbGVuZ3RoIG9mIHRoZSBlbmNvZGVk IHZhbHVlIHNob3VsZCBiZSB3ZWlnaGVkIGFnYWluc3QgaG93IG1hbnkNCiAgICAgIGNvZGUgcG9p bnRzIG9mIHRoYXQgbGVuZ3RoIGFyZSBsZWZ0LCB0aGUgc2l6ZSBvZiBkZXZpY2UgaXQgd2lsbCBi ZQ0KICAgICAgdXNlZCBvbiwgYW5kIHRoZSBudW1iZXIgb2YgY29kZSBwb2ludHMgbGVmdCB0aGF0 IGVuY29kZSB0byB0aGF0DQogICAgICBzaXplLg0KDQoxMi4gIFJlZmVyZW5jZXMNCg0KMTIuMS4g IE5vcm1hdGl2ZSBSZWZlcmVuY2VzDQoNCiAgIFtJLUQuLmlldGYtYWNlLW9hdXRoLWF1dGh6XQ0K ICAgICAgICAgICAgICBTZWl0eiwgTC4sIFNlbGFuZGVyLCBHLiwgV2FobHN0cm9lbSwgRS4sIEVy ZHRtYW4sIFMuLCBhbmQNCiAgICAgICAgICAgICAgSC4gVHNjaG9mZW5pZywgIkF1dGhlbnRpY2F0 aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvcg0KICAgICAgICAgICAgICBDb25zdHJhaW5lZCBFbnZp cm9ubWVudHMgKEFDRSkgdXNpbmcgdGhlIE9BdXRoIDIuMA0KICAgICAgICAgICAgICBGcmFtZXdv cmsgKEFDRS1PQXV0aCkiLCBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNA0KICAgICAgICAg ICAgICAod29yayBpbiBwcm9ncmVzcyksIE1hcmNoIDIwMTkuDQoNCiAgIFtJLUQuaWV0Zi1hY2Ut b2F1dGgtcGFyYW1zXQ0KICAgICAgICAgICAgICBTZWl0eiwgTC4sICJBZGRpdGlvbmFsIE9BdXRo IFBhcmFtZXRlcnMgZm9yIEF1dGhvcml6YXRpb24NCiAgICAgICAgICAgICAgaW4gQ29uc3RyYWlu ZWQgRW52aXJvbm1lbnRzIChBQ0UpIiwgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtDQogICAgICAgICAg ICAgIHBhcmFtcy0wNSAod29yayBpbiBwcm9ncmVzcyksIE1hcmNoIDIwMTkuDQoNCg0KDQoNCg0K DQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAgICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAg ICAgICAgICAgIFtQYWdlIDMwXQ0KDQpJbnRlcm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBm b3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAgICBKdWx5IDIwMTkNCg0KDQogICBbSS1ELmlldGYt Y29yZS1vc2NvcmUtZ3JvdXBjb21tXQ0KICAgICAgICAgICAgICBUaWxvY2EsIE0uLCBTZWxhbmRl ciwgRy4sIFBhbG9tYmluaSwgRi4sIGFuZCBKLiBQYXJrLA0KICAgICAgICAgICAgICAiR3JvdXAg T1NDT1JFIC0gU2VjdXJlIEdyb3VwIENvbW11bmljYXRpb24gZm9yIENvQVAiLA0KICAgICAgICAg ICAgICBkcmFmdC1pZXRmLWNvcmUtb3Njb3JlLWdyb3VwY29tbS0wNSAod29yayBpbiBwcm9ncmVz cyksDQogICAgICAgICAgICAgIEp1bHkgMjAxOS4NCg0KICAgW1JGQzIxMTldICBCcmFkbmVyLCBT LiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8gSW5kaWNhdGUNCiAgICAgICAgICAgICAg UmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwNCiAgICAgICAgICAgICAgRE9J IDEwLjE3NDg3L1JGQzIxMTksIE1hcmNoIDE5OTcsDQogICAgICAgICAgICAgIDxodHRwczovL3d3 dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzIxMTk8aHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNv bS91cmw/az1lOTMzMWUxYy1iNWU3MTJlZC1lOTMzNWU4Ny04NjQ2ODViMjA4NWMtYzVkNGZhYmUx YWVlMjgzMyZxPTEmdT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZy ZmMyMTE5Pj4uDQoNCiAgIFtSRkM3MDQ5XSAgQm9ybWFubiwgQy4gYW5kIFAuIEhvZmZtYW4sICJD b25jaXNlIEJpbmFyeSBPYmplY3QNCiAgICAgICAgICAgICAgUmVwcmVzZW50YXRpb24gKENCT1Ip IiwgUkZDIDcwNDksIERPSSAxMC4xNzQ4Ny9SRkM3MDQ5LA0KICAgICAgICAgICAgICBPY3RvYmVy IDIwMTMsIDxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzcwNDk8aHR0cHM6Ly9w cm90ZWN0Mi5maXJlZXllLmNvbS91cmw/az05MzZhNTcwYS1jZmJlNWJmYi05MzZhMTc5MS04NjQ2 ODViMjA4NWMtMGQ5OTUwNGYyYjU0NzRjNSZxPTEmdT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRp dG9yLm9yZyUyRmluZm8lMkZyZmM3MDQ5Pj4uDQoNCiAgIFtSRkM4MTI2XSAgQ290dG9uLCBNLiwg TGVpYmEsIEIuLCBhbmQgVC4gTmFydGVuLCAiR3VpZGVsaW5lcyBmb3INCiAgICAgICAgICAgICAg V3JpdGluZyBhbiBJQU5BIENvbnNpZGVyYXRpb25zIFNlY3Rpb24gaW4gUkZDcyIsIEJDUCAyNiwN CiAgICAgICAgICAgICAgUkZDIDgxMjYsIERPSSAxMC4xNzQ4Ny9SRkM4MTI2LCBKdW5lIDIwMTcs DQogICAgICAgICAgICAgIDxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzgxMjY8 aHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS91cmw/az0wZDNjZmZlMC01MWU4ZjMxMS0wZDNj YmY3Yi04NjQ2ODViMjA4NWMtMmM0NWJmODBiZWIwMWQ3YSZxPTEmdT1odHRwcyUzQSUyRiUyRnd3 dy5yZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZyZmM4MTI2Pj4uDQoNCiAgIFtSRkM4MTUyXSAgU2No YWFkLCBKLiwgIkNCT1IgT2JqZWN0IFNpZ25pbmcgYW5kIEVuY3J5cHRpb24gKENPU0UpIiwNCiAg ICAgICAgICAgICAgUkZDIDgxNTIsIERPSSAxMC4xNzQ4Ny9SRkM4MTUyLCBKdWx5IDIwMTcsDQog ICAgICAgICAgICAgIDxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzgxNTI8aHR0 cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS91cmw/az0xZjIwNjgyMC00M2Y0NjRkMS0xZjIwMjhi Yi04NjQ2ODViMjA4NWMtNzIyODMxMWEwMDQ0ZWNkOCZxPTEmdT1odHRwcyUzQSUyRiUyRnd3dy5y ZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZyZmM4MTUyPj4uDQoNCjEyLjIuICBJbmZvcm1hdGl2ZSBS ZWZlcmVuY2VzDQoNCiAgIFtJLUQuZGlqay1jb3JlLWdyb3VwY29tbS1iaXNdDQogICAgICAgICAg ICAgIERpamssIEUuLCBXYW5nLCBDLiwgYW5kIE0uIFRpbG9jYSwgIkdyb3VwIENvbW11bmljYXRp b24NCiAgICAgICAgICAgICAgZm9yIHRoZSBDb25zdHJhaW5lZCBBcHBsaWNhdGlvbiBQcm90b2Nv bCAoQ29BUCkiLCBkcmFmdC0NCiAgICAgICAgICAgICAgZGlqay1jb3JlLWdyb3VwY29tbS1iaXMt MDAgKHdvcmsgaW4gcHJvZ3Jlc3MpLCBNYXJjaCAyMDE5Lg0KDQogICBbSS1ELmlldGYtYWNlLWR0 bHMtYXV0aG9yaXplXQ0KICAgICAgICAgICAgICBHZXJkZXMsIFMuLCBCZXJnbWFubiwgTy4sIEJv cm1hbm4sIEMuLCBTZWxhbmRlciwgRy4sIGFuZA0KICAgICAgICAgICAgICBMLiBTZWl0eiwgIkRh dGFncmFtIFRyYW5zcG9ydCBMYXllciBTZWN1cml0eSAoRFRMUykNCiAgICAgICAgICAgICAgUHJv ZmlsZSBmb3IgQXV0aGVudGljYXRpb24gYW5kIEF1dGhvcml6YXRpb24gZm9yDQogICAgICAgICAg ICAgIENvbnN0cmFpbmVkIEVudmlyb25tZW50cyAoQUNFKSIsIGRyYWZ0LWlldGYtYWNlLWR0bHMt DQogICAgICAgICAgICAgIGF1dGhvcml6ZS0wOCAod29yayBpbiBwcm9ncmVzcyksIEFwcmlsIDIw MTkuDQoNCiAgIFtJLUQuaWV0Zi1hY2UtbXF0dC10bHMtcHJvZmlsZV0NCiAgICAgICAgICAgICAg U2VuZ3VsLCBDLiwgS2lyYnksIEEuLCBhbmQgUC4gRnJlbWFudGxlLCAiTVFUVC1UTFMgcHJvZmls ZQ0KICAgICAgICAgICAgICBvZiBBQ0UiLCBkcmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxl LTAwICh3b3JrIGluDQogICAgICAgICAgICAgIHByb2dyZXNzKSwgTWF5IDIwMTkuDQoNCiAgIFtJ LUQuaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGVdDQogICAgICAgICAgICAgIFBhbG9tYmluaSwgRi4s IFNlaXR6LCBMLiwgU2VsYW5kZXIsIEcuLCBhbmQgTS4gR3VubmFyc3NvbiwNCiAgICAgICAgICAg ICAgIk9TQ09SRSBwcm9maWxlIG9mIHRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlv bg0KICAgICAgICAgICAgICBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIEZyYW1ld29yayIs IGRyYWZ0LWlldGYtYWNlLQ0KICAgICAgICAgICAgICBvc2NvcmUtcHJvZmlsZS0wNyAod29yayBp biBwcm9ncmVzcyksIEZlYnJ1YXJ5IDIwMTkuDQoNCg0KDQpQYWxvbWJpbmkgJiBUaWxvY2EgICAg ICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAgICBbUGFnZSAzMV0NCg0KSW50 ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gICAg ICAgSnVseSAyMDE5DQoNCg0KICAgW0ktRC5pZXRmLWNvcmUtY29hcC1wdWJzdWJdDQogICAgICAg ICAgICAgIEtvc3RlciwgTS4sIEtlcmFuZW4sIEEuLCBhbmQgSi4gSmltZW5leiwgIlB1Ymxpc2gt DQogICAgICAgICAgICAgIFN1YnNjcmliZSBCcm9rZXIgZm9yIHRoZSBDb25zdHJhaW5lZCBBcHBs aWNhdGlvbiBQcm90b2NvbA0KICAgICAgICAgICAgICAoQ29BUCkiLCBkcmFmdC1pZXRmLWNvcmUt Y29hcC1wdWJzdWItMDggKHdvcmsgaW4NCiAgICAgICAgICAgICAgcHJvZ3Jlc3MpLCBNYXJjaCAy MDE5Lg0KDQogICBbSS1ELmlldGYtY29yZS1vYmplY3Qtc2VjdXJpdHldDQogICAgICAgICAgICAg IFNlbGFuZGVyLCBHLiwgTWF0dHNzb24sIEouLCBQYWxvbWJpbmksIEYuLCBhbmQgTC4gU2VpdHos DQogICAgICAgICAgICAgICJPYmplY3QgU2VjdXJpdHkgZm9yIENvbnN0cmFpbmVkIFJFU1RmdWwg RW52aXJvbm1lbnRzDQogICAgICAgICAgICAgIChPU0NPUkUpIiwgZHJhZnQtaWV0Zi1jb3JlLW9i amVjdC1zZWN1cml0eS0xNiAod29yayBpbg0KICAgICAgICAgICAgICBwcm9ncmVzcyksIE1hcmNo IDIwMTkuDQoNCiAgIFtSRkMyMDkzXSAgSGFybmV5LCBILiBhbmQgQy4gTXVja2VuaGlybiwgIkdy b3VwIEtleSBNYW5hZ2VtZW50DQogICAgICAgICAgICAgIFByb3RvY29sIChHS01QKSBTcGVjaWZp Y2F0aW9uIiwgUkZDIDIwOTMsDQogICAgICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkMyMDkzLCBK dWx5IDE5OTcsDQogICAgICAgICAgICAgIDxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZv L3JmYzIwOTM8aHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS91cmw/az1iZGNmMDNmOS1lMTFi MGYwOC1iZGNmNDM2Mi04NjQ2ODViMjA4NWMtNjhlZTQ1OGQwMzUxZjEwOCZxPTEmdT1odHRwcyUz QSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZyZmMyMDkzPj4uDQoNCiAgIFtSRkMy MDk0XSAgSGFybmV5LCBILiBhbmQgQy4gTXVja2VuaGlybiwgIkdyb3VwIEtleSBNYW5hZ2VtZW50 DQogICAgICAgICAgICAgIFByb3RvY29sIChHS01QKSBBcmNoaXRlY3R1cmUiLCBSRkMgMjA5NCwN CiAgICAgICAgICAgICAgRE9JIDEwLjE3NDg3L1JGQzIwOTQsIEp1bHkgMTk5NywNCiAgICAgICAg ICAgICAgPGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMjA5NDxodHRwczovL3By b3RlY3QyLmZpcmVleWUuY29tL3VybD9rPWY5ZjZhMDYxLWE1MjJhYzkwLWY5ZjZlMGZhLTg2NDY4 NWIyMDg1Yy1iOGRjNjIwN2E1M2MzOGMzJnE9MSZ1PWh0dHBzJTNBJTJGJTJGd3d3LnJmYy1lZGl0 b3Iub3JnJTJGaW5mbyUyRnJmYzIwOTQ+Pi4NCg0KICAgW1JGQzI2MjddICBXYWxsbmVyLCBELiwg SGFyZGVyLCBFLiwgYW5kIFIuIEFnZWUsICJLZXkgTWFuYWdlbWVudCBmb3INCiAgICAgICAgICAg ICAgTXVsdGljYXN0OiBJc3N1ZXMgYW5kIEFyY2hpdGVjdHVyZXMiLCBSRkMgMjYyNywNCiAgICAg ICAgICAgICAgRE9JIDEwLjE3NDg3L1JGQzI2MjcsIEp1bmUgMTk5OSwNCiAgICAgICAgICAgICAg PGh0dHBzOi8vd3d3Li5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzI2Mjc8aHR0cHM6Ly9wcm90ZWN0 Mi5maXJlZXllLmNvbS91cmw/az1mNjFhNzUwZC1hYWNlNzlmYy1mNjFhMzU5Ni04NjQ2ODViMjA4 NWMtMmI0OTU0M2FmNGQ5MDA1NSZxPTEmdT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9y ZyUyRmluZm8lMkZyZmMyNjI3Pj4uDQoNCiAgIFtSRkM3MzkwXSAgUmFobWFuLCBBLiwgRWQuIGFu ZCBFLiBEaWprLCBFZC4sICJHcm91cCBDb21tdW5pY2F0aW9uIGZvcg0KICAgICAgICAgICAgICB0 aGUgQ29uc3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9jb2wgKENvQVApIiwgUkZDIDczOTAsDQog ICAgICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkM3MzkwLCBPY3RvYmVyIDIwMTQsDQogICAgICAg ICAgICAgIDxodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzczOTA8aHR0cHM6Ly9w cm90ZWN0Mi5maXJlZXllLmNvbS91cmw/az04YzlhZDFiNi1kMDRlZGQ0Ny04YzlhOTEyZC04NjQ2 ODViMjA4NWMtZjNlNzJhZjE2MDVhNmY4NCZxPTEmdT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRp dG9yLm9yZyUyRmluZm8lMkZyZmM3MzkwPj4uDQoNCiAgIFtSRkM3NTE5XSAgSm9uZXMsIE0uLCBC cmFkbGV5LCBKLiwgYW5kIE4uIFNha2ltdXJhLCAiSlNPTiBXZWIgVG9rZW4NCiAgICAgICAgICAg ICAgKEpXVCkiLCBSRkMgNzUxOSwgRE9JIDEwLjE3NDg3L1JGQzc1MTksIE1heSAyMDE1LA0KICAg ICAgICAgICAgICA8aHR0cHM6Ly93d3cuLnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNzUxOTxodHRw czovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTY2ZjhiMzExLTNhMmNiZmUwLTY2ZjhmMzhh LTg2NDY4NWIyMDg1Yy0xZDFjM2M1NzljZjY1ZWNkJnE9MSZ1PWh0dHBzJTNBJTJGJTJGd3d3LnJm Yy1lZGl0b3Iub3JnJTJGaW5mbyUyRnJmYzc1MTk+Pi4NCg0KICAgW1JGQzc5NTldICBCb3JtYW5u LCBDLiBhbmQgWi4gU2hlbGJ5LCBFZC4sICJCbG9jay1XaXNlIFRyYW5zZmVycyBpbg0KICAgICAg ICAgICAgICB0aGUgQ29uc3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9jb2wgKENvQVApIiwgUkZD IDc5NTksDQogICAgICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkM3OTU5LCBBdWd1c3QgMjAxNiwN CiAgICAgICAgICAgICAgPGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNzk1OTxo dHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPWNkZDBjMjkxLTkxMDRjZTYwLWNkZDA4 MjBhLTg2NDY4NWIyMDg1Yy05MzI4ZmJjNmExMGIzOTZmJnE9MSZ1PWh0dHBzJTNBJTJGJTJGd3d3 LnJmYy1lZGl0b3Iub3JnJTJGaW5mbyUyRnJmYzc5NTk+Pi4NCg0KICAgW1JGQzgyNTldICBCcmF5 LCBULiwgRWQuLCAiVGhlIEphdmFTY3JpcHQgT2JqZWN0IE5vdGF0aW9uIChKU09OKSBEYXRhDQog ICAgICAgICAgICAgIEludGVyY2hhbmdlIEZvcm1hdCIsIFNURCA5MCwgUkZDIDgyNTksDQogICAg ICAgICAgICAgIERPSSAxMC4xNzQ4Ny9SRkM4MjU5LCBEZWNlbWJlciAyMDE3LA0KICAgICAgICAg ICAgICA8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM4MjU5PGh0dHBzOi8vcHJv dGVjdDIuZmlyZWV5ZS5jb20vdXJsP2s9OTBhYTA2NTgtY2M3ZTBhYTktOTBhYTQ2YzMtODY0Njg1 YjIwODVjLTFmYjA4YzJhMGMyNDAwNWEmcT0xJnU9aHR0cHMlM0ElMkYlMkZ3d3cucmZjLWVkaXRv ci5vcmclMkZpbmZvJTJGcmZjODI1OT4+Lg0KDQoNCg0KDQoNCg0KUGFsb21iaW5pICYgVGlsb2Nh ICAgICAgIEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgW1BhZ2UgMzJdDQoN CkludGVybmV0LURyYWZ0ICBLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9u ICAgICAgIEp1bHkgMjAxOQ0KDQoNCkFwcGVuZGl4IEEuICBSZXF1aXJlbWVudHMgb24gQXBwbGlj YXRpb24gUHJvZmlsZXMNCg0KICAgVGhpcyBzZWN0aW9uIGxpc3RzIHRoZSByZXF1aXJlbWVudHMg b24gYXBwbGljYXRpb24gcHJvZmlsZXMgb2YgdGhpcw0KICAgc3BlY2lmaWNhdGlvbixmb3IgdGhl IGNvbnZlbmllbmNlIG9mIGFwcGxpY2F0aW9uIHByb2ZpbGUgZGVzaWduZXJzLg0KDQogICBvICBT cGVjaWZ5IHRoZSBjb21tdW5pY2F0aW9uIHByb3RvY29sIHRoZSBtZW1iZXJzIG9mIHRoZSBncm91 cCBtdXN0DQogICAgICB1c2UgKGUuZy4sIG11bHRpY2FzdCBDb0FQKS4NCg0KICAgbyAgU3BlY2lm eSB0aGUgc2VjdXJpdHkgcHJvdG9jb2wgdGhlIGdyb3VwIG1lbWJlcnMgbXVzdCB1c2UgdG8NCiAg ICAgIHByb3RlY3QgdGhlaXIgY29tbXVuaWNhdGlvbiAoZS5nLiwgZ3JvdXAgT1NDT1JFKS4gIFRo aXMgbXVzdA0KICAgICAgcHJvdmlkZSBlbmNyeXB0aW9uLCBpbnRlZ3JpdHkgYW5kIHJlcGxheSBw cm90ZWN0aW9uLg0KDQogICBvICBTcGVjaWZ5IHRoZSBlbmNvZGluZyBhbmQgdmFsdWUgb2YgdGhl IGlkZW50aWZpZXIgb2YgZ3JvdXAgb3IgdG9waWMNCiAgICAgIGFuZCByb2xlIG9mICdzY29wZScg KHNlZSBTZWN0aW9uIDMuMSkuDQoNCiAgIG8gIFNwZWNpZnkgYW5kIHJlZ2lzdGVyIHRoZSBhcHBs aWNhdGlvbiBwcm9maWxlIGlkZW50aWZpZXIgKHNlZQ0KICAgICAgU2VjdGlvbiA0LjEpLg0KDQog ICBvICBTcGVjaWZ5IHRoZSBhY2NlcHRhYmxlIHZhbHVlcyBvZiAna3R5JyAoc2VlIFNlY3Rpb24g NC4yKS4NCg0KICAgbyAgU3BlY2lmeSB0aGUgZm9ybWF0IGFuZCBjb250ZW50IG9mICdncm91cF9w b2xpY2llcycgZW50cmllcyAoc2VlDQogICAgICBTZWN0aW9uIDQuMikuDQoNCiAgIG8gIE9wdGlv bmFsbHksIHNwZWNpZnkgdGhlIGZvcm1hdCBhbmQgY29udGVudCBvZiAnbWd0X2tleV9tYXRlcmlh bCcNCiAgICAgIChzZWUgU2VjdGlvbiA0LjIpLg0KDQogICBvICBPcHRpb25hbGx5LCBzcGVjaWZ5 IHRyYW5wb3J0IHByb2ZpbGUgb2YgQUNFDQogICAgICBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6 XSB0byB1c2UgYmV0d2VlbiBDbGllbnQgYW5kIEtEQy4NCg0KICAgbyAgT3B0aW9uYWxseSwgc3Bl Y2lmeSB0aGUgZW5jb2Rpbmcgb2YgcHVibGljIGtleXMsIG9mICdjbGllbnRfY3JlZCcsDQogICAg ICBhbmQgb2YgJ3B1Yl9rZXlzJyBpZiBDT1NFX0tleXMgYXJlIG5vdCB1c2VkIChzZWUgU2VjdGlv biA0LjIpLg0KDQogICBvICBPcHRpb25hbGx5LCBzcGVjaWZ5IHRoZSBhY2NlcHRhYmxlIHZhbHVl cyBmb3IgcGFyYW1ldGVycyByZWxhdGVkDQogICAgICB0byBzaWduYXR1cmUgYWxnb3JpdGhtIGFu ZCBzaWduYXR1cmUga2V5czogJ3NpZ25fYWxnJywNCiAgICAgICdzaWduX3BhcmFtZXRlcnMnLCAn c2lnbl9rZXlfcGFyYW1ldGVycycsICdwdWJfa2V5X2VuYycgKHNlZQ0KICAgICAgU2VjdGlvbiAz LjMpLg0KDQogICBvICBPcHRpb25hbGx5LCBzcGVjaWZ5IHRoZSBuZWdvdGlhdGlvbiBvZiBwYXJh bWV0ZXIgdmFsdWVzIGZvcg0KICAgICAgc2lnbmF0dXJlIGFsZ29yaXRobSBhbmQgc2lnbmF0dXJl IGtleXMsIGlmICdzaWduX2luZm8nIGFuZA0KICAgICAgJ3B1Yl9rZXlfZW5jJyBhcmUgbm90IHVz ZWQgKHNlZSBTZWN0aW9uIDMuMykuDQoNCkFwcGVuZGl4IEIuICBEb2N1bWVudCBVcGRhdGVzDQoN CiAgIFJGQyBFRElUT1I6IFBMRUFTRSBSRU1PVkUgVEhJUyBTRUNUSU9OLg0KDQoNCg0KDQoNCg0K DQpQYWxvbWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAg ICAgICAgICBbUGFnZSAzM10NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9y IEdyb3VwIENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KQi4uMS4gIFZlcnNpb24g LTAxIHRvIC0wMg0KDQogICBvICBFZGl0b3JpYWwgZml4ZXMuDQoNCiAgIG8gIERpc3RpbmN0aW9u IGJldHdlZW4gdHJhbnNwb3J0IHByb2ZpbGUgYW5kIGFwcGxpY2F0aW9uIHByb2ZpbGUNCiAgICAg IChTZWN0aW9uIDEuMSkuDQoNCiAgIG8gIE5ldyBwYXJhbWV0ZXJzICdzaWduX2luZm8nIGFuZCAn cHViX2tleV9lbmMnIHRvIG5lZ290aWF0ZQ0KICAgICAgcGFyYW1ldGVyIHZhbHVlcyBmb3Igc2ln bmF0dXJlIGFsZ29yaXRobSBhbmQgc2lnbmF0dXJlIGtleXMNCiAgICAgIChTZWN0aW9uIDMuMyku DQoNCiAgIG8gIE5ldyBwYXJhbWV0ZXIgJ3R5cGUnIHRvIGRpc3Rpbmd1aXNoIGRpZmZlcmVudCBL ZXkgRGlzdHJpYnV0aW9uDQogICAgICBSZXF1ZXN0IG1lc3NhZ2VzIChTZWN0aW9uIDQuMSkuDQoN CiAgIG8gIE5ldyBwYXJhbWV0ZXIgJ2NsaWVudF9jcmVkX3ZlcmlmeScgaW4gdGhlIEtleSBEaXN0 cmlidXRpb24gUmVxdWVzdA0KICAgICAgdG8gY29udmV5IGEgQ2xpZW50IHNpZ25hdHVyZSAoU2Vj dGlvbiA0LjEpLg0KDQogICBvICBFbmNvZGluZyBvZiAncHViX2tleXNfcmVwb3MnIChTZWN0aW9u IDQuMSkuDQoNCiAgIG8gIEVuY29kaW5nIG9mICdtZ3Rfa2V5X21hdGVyaWFsJyAoU2VjdGlvbiA0 LjEpLg0KDQogICBvICBJbXByb3ZlZCBkZXNjcmlwdGlvbiBvbiByZXRyaWV2YWwgb2YgbmV3IG9y IHVwZGF0ZWQga2V5aW5nDQogICAgICBtYXRlcmlhbCAoU2VjdGlvbiA2KS4NCg0KICAgbyAgRW5j b2Rpbmcgb2YgJ2dldF9wdWJfa2V5cycgaW4gUHVibGljIEtleSBSZXF1ZXN0IChTZWN0aW9uIDcu MSkuDQoNCiAgIG8gIEV4dGVuZGVkIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIChTZWN0aW9ucyAx MC4xIGFuZCAxMC4yKS4NCg0KICAgbyAgTmV3ICJBQ0UgUHVibGljIEtleSBFbmNvZGluZyIgSUFO QSBSZWdpc3RyeSAoU2VjdGlvbiAxMS4yKS4NCg0KICAgbyAgTmV3ICJBQ0UgR3JvdXBjb21tIFBh cmFtZXRlcnMiIElBTkEgUmVnaXN0cnkgKFNlY3Rpb24gMTEuMyksDQogICAgICBwb3B1bGF0ZWQg d2l0aCB0aGUgZW50cmllcyBpbiBTZWN0aW9uIDguDQoNCiAgIG8gIE5ldyAiQWNlIEdyb3VwY29t bSBSZXF1ZXN0IFR5cGUiIElBTkEgUmVnaXN0cnkgKFNlY3Rpb24gMTEuNCksDQogICAgICBwb3B1 bGF0ZWQgd2l0aCB0aGUgdmFsdWVzIGluIFNlY3Rpb24gOS4NCg0KICAgbyAgTmV3ICJBQ0UgR3Jv dXBjb21tIFBvbGljeSIgSUFOQSBSZWdpc3RyeSAoU2VjdGlvbiAxMS43KSBwb3B1bGF0ZWQNCiAg ICAgIHdpdGggdHdvIGVudHJpZXMgIlNlcXVlbmNlIE51bWJlciBTeW5jaHJvbml6YXRpb24gTWV0 aG9kIiBhbmQgIktleQ0KICAgICAgVXBkYXRlIENoZWNrIEludGVydmFsIiAoU2VjdGlvbiA0LjIp Lg0KDQogICBvICBJbXByb3ZlZCBsaXN0IG9mIHJlcXVpcmVtZW50cyBmb3IgYXBwbGljYXRpb24g cHJvZmlsZXMNCiAgICAgIChBcHBlbmRpeCBBKS4NCg0KQi4yLiAgVmVyc2lvbiAtMDAgdG8gLTAx DQoNCiAgIG8gIENoYW5nZWQgbmFtZSBvZiAncmVxX2F1ZCcgdG8gJ2F1ZGllbmNlJyBpbiB0aGUg QXV0aG9yaXphdGlvbg0KICAgICAgUmVxdWVzdCAoU2VjdGlvbiAzLjEpLg0KDQoNCg0KDQpQYWxv bWJpbmkgJiBUaWxvY2EgICAgICAgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgICAgICAgICAgICAg ICBbUGFnZSAzNF0NCg0KSW50ZXJuZXQtRHJhZnQgIEtleSBQcm92aXNpb25pbmcgZm9yIEdyb3Vw IENvbW11bmljYXRpb24gICAgICAgSnVseSAyMDE5DQoNCg0KICAgbyAgRGVmaW5lZCBlcnJvciBo YW5kbGluZyBvbiB0aGUgS0RDIChTZWN0aW9ucyA0LjIgYW5kIDYuMikuDQoNCiAgIG8gIFVwZGF0 ZWQgZm9ybWF0IG9mIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlc3BvbnNlIGFzIGEgd2hvbGUNCiAg ICAgIChTZWN0aW9uIDQuMikuDQoNCiAgIG8gIEdlbmVyYWxpemVkIGZvcm1hdCBvZiAncHViX2tl eXMnIGluIHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlc3BvbnNlDQogICAgICAoU2VjdGlvbiA0LjIp Lg0KDQogICBvICBEZWZpbmVkIGZvcm1hdCBmb3IgdGhlIG1lc3NhZ2UgdG8gcmVxdWVzdCBsZWF2 aW5nIHRoZSBncm91cA0KICAgICAgKFNlY3Rpb24gNS4yKS4NCg0KICAgbyAgUmVuZXdhbCBvZiBp bmRpdmlkdWFsIGtleWluZyBtYXRlcmlhbCBhbmQgbWV0aG9kcyBmb3IgZ3JvdXANCiAgICAgIHJl a2V5aW5nIGluaXRpYXRlZCBieSB0aGUgS0RDIChTZWN0aW9uIDYpLg0KDQogICBvICBDQk9SIHR5 cGUgZm9yIG5vZGUgaWRlbnRpZmllcnMgaW4gJ2dldF9wdWJfa2V5cycgKFNlY3Rpb24gNy4xKS4N Cg0KICAgbyAgQWRkZWQgc2VjdGlvbiBvbiBwYXJhbWV0ZXIgaWRlbnRpZmllcnMgYW5kIHRoZWly IENCT1Iga2V5cw0KICAgICAgKFNlY3Rpb24gOCkuDQoNCiAgIG8gIEFkZGVkIHJlcXVlc3QgdHlw ZXMgZm9yIHJlcXVlc3RzIHRvIGEgSm9pbiBSZXNwb25zZSAoU2VjdGlvbiA5KS4NCg0KICAgbyAg RXh0ZW5kZWQgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgKFNlY3Rpb24gMTApLg0KDQogICBvICBO ZXcgSUFOQSByZWdpc3RyaWVzICJBQ0UgR3JvdXBjb21tIEtleSBSZWdpc3RyeSIsICJBQ0UgR3Jv dXBjb21tDQogICAgICBQcm9maWxlIFJlZ2lzdHJ5IiwgIkFDRSBHcm91cGNvbW0gUG9saWN5IFJl Z2lzdHJ5IiBhbmQgIlNlcXVlbmNlDQogICAgICBOdW1iZXIgU3luY2hyb25pemF0aW9uIE1ldGhv ZCBSZWdpc3RyeSIgKFNlY3Rpb24gMTEpLg0KDQogICBvICBBZGRlZCBhcHBlbmRpeCBhYm91dCBy ZXF1aXJlbWVudHMgZm9yIGFwcGxpY2F0aW9uIHByb2ZpbGVzIG9mIEFDRQ0KICAgICAgb24gZ3Jv dXAgY29tbXVuaWNhdGlvbiAoQXBwZW5kaXggQSkuDQoNCkFja25vd2xlZGdtZW50cw0KDQogICBU aGUgZm9sbG93aW5nIGluZGl2aWR1YWxzIHdlcmUgaGVscGZ1bCBpbiBzaGFwaW5nIHRoaXMgZG9j dW1lbnQ6IEJlbg0KICAgS2FkdWssIEpvaG4gTWF0dHNzb24sIEppbSBTY2hhYWQsIEx1ZHdpZyBT ZWl0eiwgR29lcmFuIFNlbGFuZGVyIGFuZA0KICAgUGV0ZXIgdmFuIGRlciBTdG9rLg0KDQogICBU aGUgd29yayBvbiB0aGlzIGRvY3VtZW50IGhhcyBiZWVuIHBhcnRseSBzdXBwb3J0ZWQgYnkgVklO Tk9WQSBhbmQNCiAgIHRoZSBDZWx0aWMtTmV4dCBwcm9qZWN0IENSSVRJU0VDOyBhbmQgYnkgdGhl IEVJVC1EaWdpdGFsIEhpZ2ggSW1wYWN0DQogICBJbml0aWF0aXZlIEFDVElWRS4NCg0KQXV0aG9y cycgQWRkcmVzc2VzDQoNCg0KDQoNCg0KDQoNCg0KDQoNClBhbG9tYmluaSAmIFRpbG9jYSAgICAg ICBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDM1XQ0KDQpJbnRl cm5ldC1EcmFmdCAgS2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAgICAg ICBKdWx5IDIwMTkNCg0KDQogICBGcmFuY2VzY2EgUGFsb21iaW5pDQogICBFcmljc3NvbiBBQg0K ICAgVG9yc2hhbW5zZ2F0YW4gMjMNCiAgIEtpc3RhICBTRS0xNjQ0MCBTdG9ja2hvbG0NCiAgIFN3 ZWRlbg0KDQogICBFbWFpbDogZnJhbmNlc2NhLnBhbG9tYmluaUBlcmljc3Nvbi5jb208bWFpbHRv OmZyYW5jZXNjYS5wYWxvbWJpbmlAZXJpY3Nzb24uY29tPg0KDQoNCiAgIE1hcmNvIFRpbG9jYQ0K ICAgUklTRSBBQg0KICAgSXNhZmpvcmRzZ2F0YW4gMjINCiAgIEtpc3RhICBTRS0xNjQ0MCBTdG9j a2hvbG0NCiAgIFN3ZWRlbg0KDQogICBFbWFpbDogbWFyY28udGlsb2NhQHJpLnNlPG1haWx0bzpt YXJjby50aWxvY2FAcmkuc2U+DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KUGFsb21iaW5pICYgVGlsb2NhICAgICAg IEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICAgICAgICAgICAgICAgW1BhZ2UgMzZdDQoNCg== --_000_894C46A91AE64A6E89D5C79B8C03E4EFericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <819DDB86D3F41E40B15BD49B69280ADB@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHls ZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0 dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4w cHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+ PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkhpIERhbmllbCw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V UyI+VGhhbmsgeW91IGZvciB5b3VyIHJldmlldyEgQXMgeW91IGhhdmUgc2Vlbiwgd2UgaGF2ZSBz dWJtaXR0ZWQgYSBuZXcgdmVyc2lvbiBvZiB0aGUgZG9jdW1lbnQsIHRoYXQgd2UgaG9wZSBhZGRy ZXNzZXMgYWxsIHRoZSBjb21tZW50cyB3ZSBoYXZlIHJlY2VpdmVkLiBJbmxpbmUsIGFuc3dlcnMg dG8geW91ciBjb21tZW50cyBhbmQgcXVlc3Rpb25zLA0KIHByZWZhY2VkIHdpdGgg4oCcRlA64oCd LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj5UaGFua3MsPGJyPg0KRnJhbmNlc2NhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVT Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+QWNlICZsdDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxm IG9mIERhbmllbCBNaWdhdWx0ICZsdDtkYW5pZWwubWlnYXVsdEBlcmljc3Nvbi5jb20mZ3Q7PGJy Pg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIDkgSnVseSAyMDE5IGF0IDE5OjIxPGJyPg0KPGI+VG86 IDwvYj5BY2UgV2cgJmx0O2FjZUBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+W0Fj ZV0gZHJhZnQtaWV0Zi1hY2Uta2V5LWdyb3VwY29tbS0wMjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGksJm5ic3A7IDxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGxlYXNlIGZpbmQgc29tZSBj b21tZW50cyB3aGlsZSByZWFkaW5nIHRoZSBkb2N1bWVudC4gSSBhbHNvIGhhdmUgc29tZSBoaWdo IGxldmVsIHF1ZXN0aW9ucyB0aGF0IEkgbWlnaHQgaGF2ZSBtaXNzZWQgaW4gdGhlIGRyYWZ0IG9y IHRoYXQgYXJlIGRlZmluZWQgc29tZXdoZXJlIGVsc2UuJm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBncm91cCBzZWVtcyB0byBi ZSBkZWZpbmVkIGJ5IGl0cyBncm91cCBtZW1iZXJzIGFuZCBlYWNoIG1lbWJlciBhcmUgcmVnaXN0 ZXJlZCB3aXRoIHJlYWQgb3Igd3JpdGUgYWNjZXNzLiBXaGF0IGlzIHVuY2xlYXIgdG8gbWUgaXMg aG93IHRoZXNlIHByb3BlcnRpZXMgKHJlYWQsIHdyaXRlKSBhZmZlY3QgdGhlIGdyb3VwIGNvbW11 bmljYXRpb24uIEFyZSB0aGVyZSBhbnkgc3BlY2lmaWMgY3J5cHRvZ3JhcGhpYw0KIG1hdGVyaWFs IG9yIGRpZmZlcmVudCBhY2Nlc3MgcG9saWNpZXMgaW1wbGVtZW50ZWQgYnkgdGhlIFJTIGZvciBl YWNoIHJvbGUgPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogWWVzLCB0aGF0IGlzIHVwIHRv IHRoZSBhcHBsaWNhdGlvbiB0byBkZWNpZGUsIHRoZSBzcGVjaWZpY3Mgb2YgdGhhdCBhcmUgc3Bl Y2lmaWVkIGluIHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlcyAoc3VjaCBhcyBhY2Uta2V5LWdyb3Vw Y29tbS1vc2NvcmUgb3IgYWNlLWNvYXAtcHVic3ViLXByb2ZpbGUpPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYW0gbm90IGVudGlyZWx5IGNs ZWFyIGhvdyB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbiBpcyBwcm90ZWN0ZWQuIEluIHBhcnRpY3Vs YXIsIEkgYW0gd29uZGVyaW5nIGlmIHRoZSBzb3VyY2UgaXMgYXV0aGVudGljYXRlZCBvciBpZiB0 aGUga2V5IGlzIHNoYXJlZCBiZXR3ZWVuIHRoZSBkaWZmZXJlbnQgbWVtYmVycyBvZiB0aGUgZ3Jv dXAuIEkgYW0gYWxzbyB3b25kZXJpbmcgaG93IHRoZSBwdWJsaWMga2V5IGFzc29jaWF0ZWQNCiB0 byBlYWNoIGdyb3VwIG1lbWJlciBpcyB1c2VkIGJ5IGFub3RoZXIgbWVtYmVyLiZuYnNwOyAmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RlA6IEFnYWluLCB0aG9z ZSBkZXRhaWxzIGFyZSBzcGVjaWZpZWQgaW4gdGhlIGFwcGxpY2F0aW9uIHByb2ZpbGVzLiBJbiB0 aGUgZ3JvdXAgT1NDT1JFIG9uZSBmb3IgZXhhbXBsZSwgdGhlIHN5bW1ldHJpYyBrZXlpbmcgbWF0 ZXJpYWwgaXMgc2hhcmVkIGFuZCB0aGUgcHVibGljL3ByaXZhdGUga2V5cyBhcmUgdXNlZCB0byBj b3VudGVyc2lnbi4gV2UgdHJpZWQgdG8gYWRkIHNvbWUgc2VudGVuY2VzIGFib3V0IHRoYXQsDQog YW5kIHRoYXQgaXMgYWxzbyByZWZsZWN0ZWQgaW4gdGhlIHVwZGF0ZWQg4oCcUmVxdWlyZW1lbnRz IG9uIEFwcGxpY2F0aW9uIFByb2ZpbGVz4oCdIEFwcGVuZGl4IGluIHRoaXMgZG9jdW1lbnQgKEFw cGVuZGl4IEEpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5QbGVhc2UgZmluZCBzb21lIGNvbW1lbnRzIG9uIHRoZSBkb2N1bWVudHMuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllvdXJzLCZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ RGFuaWVsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCjxicj4NCjxicj4NCjxicj4NCkFDRSBXb3JraW5nIEdyb3VwICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEYuIFBhbG9tYmluaTxicj4NCkludGVybmV0LURy YWZ0ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXJpY3Nz b24gQUI8YnI+DQpJbnRlbmRlZCBzdGF0dXM6IFN0YW5kYXJkcyBUcmFjayAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBNLiBUaWxvY2E8YnI+DQpFeHBpcmVz OiBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBSSVNFIEFCPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtKdWx5IDA1LCAyMDE5PGJyPg0K PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtLZXkg UHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uIHVzaW5nIEFDRTxicj4NCiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 IGRyYWZ0LWlldGYtYWNlLWtleS1ncm91cGNvbW0tMDI8YnI+DQo8YnI+DQpBYnN0cmFjdDxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIGRvY3VtZW50IGRlZmluZXMgbWVzc2FnZSBmb3JtYXRz IGFuZCBwcm9jZWR1cmVzIGZvciByZXF1ZXN0aW5nPGJyPg0KJm5ic3A7ICZuYnNwO2FuZCBkaXN0 cmlidXRpbmcgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIHVzaW5nIHRoZSBBQ0UgZnJhbWV3b3JrLCB0 bzxicj4NCiZuYnNwOyAmbmJzcDtwcm90ZWN0IGNvbW11bmljYXRpb25zIGJldHdlZW4gZ3JvdXAg bWVtYmVycy48YnI+DQo8YnI+DQpTdGF0dXMgb2YgVGhpcyBNZW1vPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO1RoaXMgSW50ZXJuZXQtRHJhZnQgaXMgc3VibWl0dGVkIGluIGZ1bGwgY29uZm9ybWFu Y2Ugd2l0aCB0aGU8YnI+DQombmJzcDsgJm5ic3A7cHJvdmlzaW9ucyBvZiBCQ1AgNzggYW5kIEJD UCA3OS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7SW50ZXJuZXQtRHJhZnRzIGFyZSB3b3JraW5n IGRvY3VtZW50cyBvZiB0aGUgSW50ZXJuZXQgRW5naW5lZXJpbmc8YnI+DQombmJzcDsgJm5ic3A7 VGFzayBGb3JjZSAoSUVURikuJm5ic3A7IE5vdGUgdGhhdCBvdGhlciBncm91cHMgbWF5IGFsc28g ZGlzdHJpYnV0ZTxicj4NCiZuYnNwOyAmbmJzcDt3b3JraW5nIGRvY3VtZW50cyBhcyBJbnRlcm5l dC1EcmFmdHMuJm5ic3A7IFRoZSBsaXN0IG9mIGN1cnJlbnQgSW50ZXJuZXQtPGJyPg0KJm5ic3A7 ICZuYnNwO0RyYWZ0cyBpcyBhdCA8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2RyYWZ0cy9jdXJyZW50LyI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kcmFmdHMvY3Vy cmVudC88L2E+Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtJbnRlcm5ldC1EcmFmdHMgYXJlIGRy YWZ0IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBtb250aHM8YnI+DQombmJz cDsgJm5ic3A7YW5kIG1heSBiZSB1cGRhdGVkLCByZXBsYWNlZCwgb3Igb2Jzb2xldGVkIGJ5IG90 aGVyIGRvY3VtZW50cyBhdCBhbnk8YnI+DQombmJzcDsgJm5ic3A7dGltZS4mbmJzcDsgSXQgaXMg aW5hcHByb3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVyZW5jZTxicj4NCiZu YnNwOyAmbmJzcDttYXRlcmlhbCBvciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAmcXVvdDt3 b3JrIGluIHByb2dyZXNzLiZxdW90Ozxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIEludGVy bmV0LURyYWZ0IHdpbGwgZXhwaXJlIG9uIEphbnVhcnkgNiwgMjAyMC48YnI+DQo8YnI+DQpDb3B5 cmlnaHQgTm90aWNlPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0NvcHlyaWdodCAoYykgMjAxOSBJ RVRGIFRydXN0IGFuZCB0aGUgcGVyc29ucyBpZGVudGlmaWVkIGFzIHRoZTxicj4NCiZuYnNwOyAm bmJzcDtkb2N1bWVudCBhdXRob3JzLiZuYnNwOyBBbGwgcmlnaHRzIHJlc2VydmVkLjxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDtUaGlzIGRvY3VtZW50IGlzIHN1YmplY3QgdG8gQkNQIDc4IGFuZCB0 aGUgSUVURiBUcnVzdCdzIExlZ2FsPGJyPg0KJm5ic3A7ICZuYnNwO1Byb3Zpc2lvbnMgUmVsYXRp bmcgdG8gSUVURiBEb2N1bWVudHM8YnI+DQombmJzcDsgJm5ic3A7KDxhIGhyZWY9Imh0dHBzOi8v dHJ1c3RlZS5pZXRmLm9yZy9saWNlbnNlLWluZm8iPmh0dHBzOi8vdHJ1c3RlZS5pZXRmLm9yZy9s aWNlbnNlLWluZm88L2E+KSBpbiBlZmZlY3Qgb24gdGhlIGRhdGUgb2Y8YnI+DQombmJzcDsgJm5i c3A7cHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudC4mbmJzcDsgUGxlYXNlIHJldmlldyB0aGVz ZSBkb2N1bWVudHM8YnI+DQombmJzcDsgJm5ic3A7Y2FyZWZ1bGx5LCBhcyB0aGV5IGRlc2NyaWJl IHlvdXIgcmlnaHRzIGFuZCByZXN0cmljdGlvbnMgd2l0aCByZXNwZWN0PGJyPg0KJm5ic3A7ICZu YnNwO3RvIHRoaXMgZG9jdW1lbnQuJm5ic3A7IENvZGUgQ29tcG9uZW50cyBleHRyYWN0ZWQgZnJv bSB0aGlzIGRvY3VtZW50IG11c3Q8YnI+DQombmJzcDsgJm5ic3A7aW5jbHVkZSBTaW1wbGlmaWVk IEJTRCBMaWNlbnNlIHRleHQgYXMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNC5lIG9mPGJyPg0KJm5i c3A7ICZuYnNwO3RoZSBUcnVzdCBMZWdhbCBQcm92aXNpb25zIGFuZCBhcmUgcHJvdmlkZWQgd2l0 aG91dCB3YXJyYW50eSBhczxicj4NCiZuYnNwOyAmbmJzcDtkZXNjcmliZWQgaW4gdGhlIFNpbXBs aWZpZWQgQlNEIExpY2Vuc2UuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5p ICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAy MCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 W1BhZ2UgMV08YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9uaW5n IGZvciBHcm91cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAxOTxi cj4NCjxicj4NCjxicj4NClRhYmxlIG9mIENvbnRlbnRzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OzEuJm5ic3A7IEludHJvZHVjdGlvbiAmbmJzcDsuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDsgMzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7MS4x LiZuYnNwOyBUZXJtaW5vbG9neSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gJm5ic3A7IDM8YnI+DQombmJzcDsgJm5ic3A7Mi4mbmJzcDsgT3ZlcnZpZXcgJm5i c3A7LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLi4gLiAm bmJzcDsgNDxicj4NCiZuYnNwOyAmbmJzcDszLiZuYnNwOyBBdXRob3JpemF0aW9uIHRvIEpvaW4g YSBHcm91cCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOyA2PGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDszLjEuJm5ic3A7IEF1dGhvcml6YXRpb24gUmVxdWVzdCAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDsgNzxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7My4yLiZuYnNwOyBBdXRob3JpemF0aW9uIFJlc3BvbnNlICZuYnNwOy4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDsgNzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 My4zLiZuYnNwOyBUb2tlbiBQb3N0ICZuYnNwOy4gLiAuIC4uIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7IDg8YnI+DQombmJzcDsgJm5ic3A7NC4mbmJzcDsgS2V5 IERpc3RyaWJ1dGlvbiAmbmJzcDsuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICZuYnNwOzExPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDs0LjEuJm5ic3A7IEtleSBE aXN0cmlidXRpb24gUmVxdWVzdCAmbmJzcDsuIC4gLiAuIC4gLi4gLiAuIC4gLiAuIC4gLiAuIC4g LiAmbmJzcDsxMjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7NC4yLiZuYnNwOyBLZXkgRGlzdHJp YnV0aW9uIFJlc3BvbnNlIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MTM8 YnI+DQombmJzcDsgJm5ic3A7NS4mbmJzcDsgUmVtb3ZhbCBvZiBhIE5vZGUgZnJvbSB0aGUgR3Jv dXAgJm5ic3A7LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzE2PGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDs1LjEuJm5ic3A7IEV4cGlyZWQgQXV0aG9yaXphdGlvbiAuIC4gLiAuIC4g Li4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MTY8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOzUuMi4mbmJzcDsgUmVxdWVzdCB0byBMZWF2ZSB0aGUgR3JvdXAgJm5ic3A7LiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MTY8YnI+DQombmJzcDsgJm5ic3A7Ni4mbmJzcDsg UmV0cmlldmFsIG9mIE5ldyBvciBVcGRhdGVkIEtleWluZyBNYXRlcmlhbCAuIC4gLiAuIC4gLiAu IC4gLiAmbmJzcDsxNzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Ni4xLiZuYnNwOyBLZXkgUmUt RGlzdHJpYnV0aW9uIFJlcXVlc3QgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7 MTg8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOzYuMi4mbmJzcDsgS2V5IFJlLURpc3RyaWJ1dGlv biBSZXNwb25zZSAmbmJzcDsuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MTk8YnI+ DQombmJzcDsgJm5ic3A7Ny4mbmJzcDsgUmV0cmlldmFsIG9mIFB1YmxpYyBLZXlzIGZvciBHcm91 cCBNZW1iZXJzICZuYnNwOy4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzE5PGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDs3LjEuJm5ic3A7IFB1YmxpYyBLZXkgUmVxdWVzdCAmbmJzcDsuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzIwPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDs3LjIuJm5ic3A7IFB1YmxpYyBLZXkgUmVzcG9uc2UgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAmbmJzcDsyMDxicj4NCiZuYnNwOyAmbmJzcDs4LiZuYnNwOyBBQ0Ug R3JvdXBjb21tIFBhcmFtZXRlcnMgJm5ic3A7LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gJm5ic3A7MjE8YnI+DQombmJzcDsgJm5ic3A7OS4mbmJzcDsgQUNFIEdyb3VwY29tbSBS ZXF1ZXN0IFR5cGUgJm5ic3A7LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNw OzIyPGJyPg0KJm5ic3A7ICZuYnNwOzEwLiBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzIzPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsxMC4xLiZuYnNwOyBVcGRhdGUgb2YgS2V5aW5nIE1hdGVyaWFsICZuYnNwOy4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzI0PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsxMC4yLiZuYnNwOyBCbG9jay1XaXNlIENvbnNpZGVyYXRpb25zICZuYnNwOy4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzI0PGJyPg0KJm5ic3A7ICZuYnNwOzExLiBJQU5BIENv bnNpZGVyYXRpb25zIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZu YnNwOzI1PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsxMS4xLiZuYnNwOyBBQ0UgQXV0aG9yaXph dGlvbiBTZXJ2ZXIgUmVxdWVzdCBDcmVhdGlvbiBIaW50cyBSZWdpc3RyeSAmbmJzcDsyNTxicj4N CiZuYnNwOyAmbmJzcDsgJm5ic3A7MTEuMi4mbmJzcDsgQUNFIFB1YmxpYyBLZXkgRW5jb2Rpbmcg UmVnaXN0cnkgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MjU8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOzExLjMuJm5ic3A7IEFDRSBHcm91cGNvbW0gUGFyYW1ldGVycyBSZWdpc3RyeSAm bmJzcDsuIC4gLiAuIC4gLiAuIC4gLiAuIC4uICZuYnNwOzI2PGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsxMS40LiZuYnNwOyBBY2UgR3JvdXBjb21tIFJlcXVlc3QgVHlwZSBSZWdpc3RyeSAmbmJz cDsuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzI2PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsx MS41LiZuYnNwOyBBQ0UgR3JvdXBjb21tIEtleSBSZWdpc3RyeSAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAmbmJzcDsyNzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7MTEuNi4mbmJzcDsg QUNFIEdyb3VwY29tbSBQcm9maWxlIFJlZ2lzdHJ5IC4gLiAuIC4gLiAuIC4uIC4gLiAuIC4gLiAu ICZuYnNwOzI4PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsxMS43LiZuYnNwOyBBQ0UgR3JvdXBj b21tIFBvbGljeSBSZWdpc3RyeSAmbmJzcDsuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNw OzI4PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsxMS44LiZuYnNwOyBTZXF1ZW5jZSBOdW1iZXIg U3luY2hyb25pemF0aW9uIE1ldGhvZCBSZWdpc3RyeSAmbmJzcDsuIC4gLiAuLiAmbmJzcDsyOTxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7MTEuOS4mbmJzcDsgRXhwZXJ0IFJldmlldyBJbnN0cnVj dGlvbnMgLiAuLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzI5PGJyPg0KJm5ic3A7 ICZuYnNwOzEyLiBSZWZlcmVuY2VzICZuYnNwOy4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gJm5ic3A7MzA8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOzEy LjEuJm5ic3A7IE5vcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuICZuYnNwOzMwPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsxMi4yLiZuYnNwOyBJ bmZvcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAuIC4gLi4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g Jm5ic3A7MzE8YnI+DQombmJzcDsgJm5ic3A7QXBwZW5kaXggQS4mbmJzcDsgUmVxdWlyZW1lbnRz IG9uIEFwcGxpY2F0aW9uIFByb2ZpbGVzIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDszMzxicj4NCiZu YnNwOyAmbmJzcDtBcHBlbmRpeCBCLiZuYnNwOyBEb2N1bWVudCBVcGRhdGVzIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICZuYnNwOzMzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDtCLjEuJm5ic3A7IFZlcnNpb24gLTAxIHRvIC0wMiAmbmJzcDsuIC4gLiAuIC4gLiAuIC4uIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDszNDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Qi4y LiZuYnNwOyBWZXJzaW9uIC0wMCB0byAtMDEgJm5ic3A7LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAmbmJzcDszNDxicj4NCiZuYnNwOyAmbmJzcDtBY2tub3dsZWRnbWVudHMg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDsz NTxicj4NCiZuYnNwOyAmbmJzcDtBdXRob3JzJyBBZGRyZXNzZXMgJm5ic3A7LiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLi4gLiAuIC4gLiAuIC4gLiAuIC4gLiAmbmJzcDszNTxicj4NCjxicj4NCjxi cj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1tQYWdlIDJdPGJyPg0KPGJyPg0K SW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNh dGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQoxLiZu YnNwOyBJbnRyb2R1Y3Rpb248YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBkb2N1bWVudCBl eHBhbmRzIHRoZSBBQ0UgZnJhbWV3b3JrIFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdIHRvPGJy Pg0KJm5ic3A7ICZuYnNwO2RlZmluZSB0aGUgZm9ybWF0IG9mIG1lc3NhZ2VzIHVzZWQgdG8gcmVx dWVzdCwgZGlzdHJpYnV0ZSBhbmQgcmVuZXc8YnI+DQombmJzcDsgJm5ic3A7dGhlIGtleWluZyBt YXRlcmlhbCBpbiBhIGdyb3VwIGNvbW11bmljYXRpb24gc2NlbmFyaW8sIGUuZy4gYmFzZWQgb248 YnI+DQombmJzcDsgJm5ic3A7bXVsdGljYXN0IFtSRkM3MzkwXVtJLUQuZGlqay1jb3JlLWdyb3Vw Y29tbS1iaXNdIG9yIG9uIHB1Ymxpc2hpbmctPGJyPg0KJm5ic3A7ICZuYnNwO3N1YnNjcmliaW5n IFtJLUQuaWV0Zi1jb3JlLWNvYXAtcHVic3ViXS4gPGJyPg0KJmx0O21nbHQmZ3Q7PGJyPg0KPGJy Pg0KVGhpcyBpcyBhIG5pdCB3aGljaCBtYXkgYmUgZHVlIHRvIG15IGVuZ2xpc2guIE15IG15IHJl YWRpbmcgb2YgJnF1b3Q7ZS5nLi48YnI+DQpiYXNlZCBvbiAmcXVvdDsgc2VlbXMgdG8gYmUgbWlz bGVhZGluZyBoZXJlIC0gYXQgbGVhc3QgdG8gbWUuIEkgYW08YnI+DQppbnRlcnByZXRpbmcgdGhl IHRleHQgYXMgNzM5MCBhbmQgdGhlIHR3byBvdGhlciBkcmFmdHMgYXMgZXhhbXBsZXMgdGhhdDxi cj4NCmNvdWxkIHRha2UgYWR2YW50YWdlIG9mIHRoZSBjdXJyZW50IGRvY3VtZW50LiBBcyB0aGVz ZSBkb2N1bWVudCBkbyBub3Q8YnI+DQpzZWVtIHRvIGNvbnNpZGVyIG11bHRpY2FzdCBjb21tdW5p Y2F0aW9uIGluIGdlbmVyYWwgLSA3MzkwIHNlZW0gc2xpbWl0ZWQ8YnI+DQp0byBvbmUtdG8tbWFu eSAtLCB0aGlzIGdpdmVzLCBpbiBteSBvcGluaW9uIGEgZmFsc2UgaW1wcmVzc2lvbiB0aGF0IHRo ZTxicj4NCnNjaGVtZSBkZXNjcmliZSBpbiB0aGlzIGRvY3VtZW50IGlzIG11Y2ggbW9yZSBnZW5l cmFsLiZuYnNwOyBXaGlsZSB3ZSBkbyBub3Q8YnI+DQp3YW50IHRvIHByZXZlbnQgb3RoZXIgcHJv dG9jb2wgdG8gcmUtdXNlIHRoZSBzY2hlbWUgZGVmaW5lZCBoZXJlLCBJPGJyPg0KYmVsaWV2ZSBp dCB3b3VsZCBiZSBzYWZlciB0byByZXN0cmljdCB0aGUgY3VycmVudCBkb2N1bWVudCB0byB0aGVz ZTxicj4NCmxhdGVzdCBkb2N1bWVudCBhcyB0aGV5IHByb3ZpZGUgdGhlIGdyb3VwIGNvbW11bmlj YXRpb24gZnJhbWV3b3JrIHdlIGFyZTxicj4NCnVzaW5nIGhlcmUuIEluIHRoZXNlIHdlcmUgb25s eSBleGFtcGxlcywgSSB3b3VsZCBleHBlY3QgdGhlIGRvY3VtZW50IHRvPGJyPg0KcHJvdmlkZSBh IGRlc2NyaXB0aW9uIGhvdyBhIG1vcmUgZ2VuZXJpYyBmcmFtZXdvcmsuPGJyPg0KPGJyPg0KJmx0 Oy9tZ2x0Jmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogSSBhbSBub3Qgc3VyZSBJIHVu ZGVyc3RhbmQgd2hhdCB5b3UgdGhpbmsgaXMgbWlzbGVhZGluZy4gWWVzLCB5b3VyIGludGVycHJl dGF0aW9uIGlzIGNvcnJlY3QsIENvQVAgZ3JvdXAgY29tbXVuaWNhdGlvbiBhbmQgQ29BUCBwdWJz dWIgYXJlIDIgZXhhbXBsZXMgd2hlcmUgdGhpcyBzcGVjaWZpY2F0aW9uIGNhbiBiZSB1c2VkLCBh bmQgdGhlIG9ubHkgMiZuYnNwOyBjYXNlcyB3ZSBjYW4gdGhpbmsgb2YgcmlnaHQNCiBub3cuIEJ1 dCBhcyB5b3Ugc2F5LCB3ZSBkbyBub3Qgd2FudCB0byBwcmV2ZW50IG90aGVyIGdyb3VwIGNvbW11 bmljYXRpb24gc2NlbmFyaW9zIHRvIHVzZSB0aGlzIHNwZWNpZmljYXRpb24uIFdoYXQgZG8geW91 IHRoaW5rIGlzIG1pc3NpbmcgZm9yIGl0IHRvIGJlIHJldXNlZCBpbiBhbnkgZ2VuZXJhbCBncm91 cCBjb21tdW5pY2F0aW9uIHNjZW5hcmlvPyBGb3IgZXhhbXBsZSwgYXMgbWVudGlvbmVkIGFib3Zl LCB0aGUgYXBwZW5kaXggQSBnaXZlcw0KIGEgbnVtYmVyIG9mIHJlcXVpcmVtZW50cyBvbiB3aGF0 IGFuIGFwcGxpY2F0aW9uIHByb2ZpbGVzIG11c3QgZGVmaW5lLCB0aGF0IGluY2x1ZGVzIHRoZSBn cm91cCBjb21tdW5pY2F0aW9uIHByb3RvY29sIHVzZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48YnI+DQombmJzcDsgJm5ic3A7VGhlIEFDRSBmcmFtZXdvcmsgaXMgYmFz ZWQ8YnI+DQombmJzcDsgJm5ic3A7b24gQ0JPUiBbUkZDNzA0OV0sIHNvIENCT1IgaXMgdGhlIGZv cm1hdCB1c2VkIGluIHRoaXMgc3BlY2lmaWNhdGlvbi48YnI+DQombmJzcDsgJm5ic3A7SG93ZXZl ciwgdXNpbmcgSlNPTiBbUkZDODI1OV0gaW5zdGVhZCBvZiBDQk9SIGlzIHBvc3NpYmxlLCB1c2lu ZyB0aGU8YnI+DQombmJzcDsgJm5ic3A7Y29udmVyc2lvbiBtZXRob2Qgc3BlY2lmaWVkIGluIFNl Y3Rpb25zIDQuMSBhbmQgNC4yIG9mIFtSRkM3MDQ5XS48YnI+DQo8YnI+DQombHQ7bWdsdCZndDs8 YnI+DQpUaGlzIGlzIGEgY29tbWVudCBhbmQgdGhlcmUgaXMgcHJvYmFibHkgYSBjb21tb24gdW5k ZXJzdGFuZGluZyBvZiB0aGU8YnI+DQp0ZXh0IGFib3ZlIEkgYW0gbWlzc2luZy4gTXkgcmVhZGlu ZyBpcyB0aGF0IENCT1IgYW5kIEpTT04gYXJlIHN1cHBvcnRlZCw8YnI+DQptZWFuaW5nIHRoYXQg SSBjb3VsZCBzZW5kIGEgSlNPTiBwYWNrZXQgb3IgYSBDQk9SIHBhY2tldC4gVW5sZXNzIHRoaXMg aXM8YnI+DQpuYXRpdmVseSBzdXBwb3J0ZWQsIGl0IHNlZW1zIHRvIGluZGljYXRlIHRoYXQgdHdv IGZvcm1hdCBhcmUgc3VwcG9ydGVkPGJyPg0KYW5kIEkgd291ZGwgYmUgaW5jbGluZWQgdG8gc2F5 IHdlIHNob3VkbCBtYXliZSBwaWNrIG9uZSBvZiB0aGVtIGZvcjxicj4NCmludGVyLW9wZXJhYmls aXR5LiBJbiB0aGlzIGNhc2UgQ0JPUiBtaWdodCBiZSBhcHByb3ByaWF0ZWQuIDxicj4NCjxicj4N CkkgYW0gcmVhZGluZyB0aGF0IHRoZSBzdXBwb3J0IGZvciBKU09OIGlzIGVhc2lseSBhZGFwdGVk IGZyb20gdGhlPGJyPg0KY3VycmVudCBkb2N1bWVudGF0aW9uLCBidXQgbm90IHNvIG11Y2ggcmVj b21tZW5kZWQuIDxicj4NCiZsdDsvbWdsdCZndDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RlA6 IFllcywgdGhlIHRleHQgaXMgbWVhbnQgdG8gbWVhbjogdGhpcyBzcGVjaWZpY2F0aW9uIHVzZXMg Q0JPUi4gQWRhcHRpbmcgdG8gSlNPTiBpcyBwb3NzaWJsZSAoYnV0IG5vdCBkb25lIGhlcmUpLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwO1Byb2ZpbGVzIHRoYXQgdXNlIGdyb3VwIGNvbW11bmljYXRpb24gY2FuIGJ1aWxkIG9uIHRo aXMgZG9jdW1lbnQgdG88YnI+DQombmJzcDsgJm5ic3A7c3BlY2lmeSB0aGUgc2VsZWN0aW9uIG9m IHRoZSBtZXNzYWdlIHBhcmFtZXRlcnMgZGVmaW5lZCBpbiB0aGlzPGJyPg0KJm5ic3A7ICZuYnNw O2RvY3VtZW50IHRvIHVzZSBhbmQgdGhlaXIgdmFsdWVzLiZuYnNwOyBLbm93biBhcHBsaWNhdGlv bnMgdGhhdCBjYW48YnI+DQombmJzcDsgJm5ic3A7YmVuZWZpdCBmcm9tIHRoaXMgZG9jdW1lbnQg d291bGQgYmUsIGZvciBleGFtcGxlLCB0aG9zZSBhZGRyZXNzaW5nPGJyPg0KJm5ic3A7ICZuYnNw O2dyb3VwIGNvbW11bmljYXRpb24gYmFzZWQgb24gbXVsdGljYXN0PGJyPg0KJm5ic3A7ICZuYnNw O1tSRkM3MzkwXVtJLUQuZGlqay1jb3JlLWdyb3VwY29tbS1iaXNdIG9yIHB1Ymxpc2hpbmcvc3Vi c2NyaWJpbmc8YnI+DQombmJzcDsgJm5ic3A7W0ktRC5pZXRmLWNvcmUtY29hcC1wdWJzdWJdIGlu IEFDRS48YnI+DQo8YnI+DQombHQ7bWdsdCZndDs8YnI+DQpJIHdvdWxkIHN1Z2dlc3QgdG8gbGlt aXQgdGhlIGRvY3VtZW50IHRvIHRoZXNlIGRvY3VtZW50cywgZXNwZWNpYWxseSBpZjxicj4NCndl IGRvIG5vdCBlbnZpc2lvbiBhbnkgb3RoZXIgY2FzZXMgd2hpbGUgd3JpdGluZyB0aGlzIGRvY3Vt ZW50LiA8YnI+DQo8YnI+DQpJIGJlbGlldmUgaXQgd291ZGwgYmUgYWxzbyBpbXBvcnRhbnQgdG8g cmVtaW5kIHNvbWUgY2hhcmFjdGVyaXN0aWNzIG9mPGJyPg0KdGhlc2UgZ3JvdXBzLiBUeXBpY2Fs bHkgaXQgc2VlbXMgdGhlc2UgZ3JvdXBzIGVudmlzaW9uZWQgb25lLXRvLW1hbnk8YnI+DQpjb21t dW5pY2F0aW9uIGFuZCBhcmUgbm90IGhpZ2hseSBkeW5hbWljLiBJIGJlbGlldmUgaXQgd291ZGwg YmUgaGVscGZ1bDxicj4NCnRvIGhhdmUgdGhlIGxpbWl0YXRpb25zIG9yIGNoYXJhY3RlcmlzdGlj cyBvZiB0aGVzZSBncm91cHMsIHNvIGZ1dHVyZTxicj4NCmFwcGxpY2F0aW9uIGNvdWxkIGVhc2ls eSBzZWUgaWYgdGhlIGtleSBtYW5hZ2VtZW50IHByb3Bvc2UgZml0cyB0aGVpcjxicj4NCnJlcXVp cmVtZW50cy4gPGJyPg0KJmx0Oy9tZ2x0Jmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDog V2UgZG8gbm90IGVudmlzaW9uIG9uZS10by1tYW55IG9ubHkgY29tbXVuaWNhdGlvbnMgbm9yIGhh dmUgYW55IHJlcXVpcmVtZW50cyBvbiBkeW5hbWljcy4gQXMgSSBzYWlkLCBJIGRpc2FncmVlIHdp dGggcmVzdHJpY3RpbmcgdGhlIGNvbnRleHQgb2YgdGhpcyBzcGVjaWZpY2F0aW9uLCBhcyBkb2lu ZyBzbyB3b3VsZCBvbmx5IG1ha2UgZnV0dXJlIHNwZWNpZmljYXRpb25zIGhhcmRlci48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtJ ZiB0aGUgYXBwbGljYXRpb24gcmVxdWlyZXMgYmFja3dhcmQgYW5kIGZvcndhcmQgc2VjdXJpdHks IHVwZGF0ZWQ8YnI+DQombmJzcDsgJm5ic3A7a2V5aW5nIG1hdGVyaWFsIGlzIGdlbmVyYXRlZCBh bmQgZGlzdHJpYnV0ZWQgdG8gdGhlIGdyb3VwIG1lbWJlcnM8YnI+DQombmJzcDsgJm5ic3A7KHJl a2V5aW5nKSwgd2hlbiBtZW1iZXJzaGlwIGNoYW5nZXMuJm5ic3A7IEEga2V5IG1hbmFnZW1lbnQg c2NoZW1lPGJyPg0KJm5ic3A7ICZuYnNwO3BlcmZvcm1zIHRoZSBhY3R1YWwgZGlzdHJpYnV0aW9u IG9mIHRoZSB1cGRhdGVkIGtleWluZyBtYXRlcmlhbCB0bzxicj4NCiZuYnNwOyAmbmJzcDt0aGUg Z3JvdXAuJm5ic3A7IEluIHBhcnRpY3VsYXIsIHRoZSBrZXkgbWFuYWdlbWVudCBzY2hlbWUgcmVr ZXlzIHRoZTxicj4NCiZuYnNwOyAmbmJzcDtjdXJyZW50IGdyb3VwIG1lbWJlcnMgd2hlbiBhIG5l dyBub2RlIGpvaW5zIHRoZSBncm91cCwgYW5kIHRoZTxicj4NCiZuYnNwOyAmbmJzcDtyZW1haW5p bmcgZ3JvdXAgbWVtYmVycyB3aGVuIGEgbm9kZSBsZWF2ZXMgdGhlIGdyb3VwLiZuYnNwOyBUaGlz IGRvY3VtZW50PGJyPg0KJm5ic3A7ICZuYnNwO3Byb3ZpZGVzIGEgbWVzc2FnZSBmb3JtYXQgZm9y IGdyb3VwIHJla2V5aW5nIHRoYXQgYWxsb3dzIHRvIGZ1bGZpbGw8YnI+DQombmJzcDsgJm5ic3A7 dGhlc2UgcmVxdWlyZW1lbnRzLiZuYnNwOyBSZWtleWluZyBtZWNoYW5pc21zIGNhbiBiZSBiYXNl ZCBvbiBbUkZDMjA5M10sPGJyPg0KJm5ic3A7ICZuYnNwO1tSRkMyMDk0XSBhbmQgW1JGQzI2Mjdd Ljxicj4NCjxicj4NCiZsdDttZ2x0Jmd0Ozxicj4NClRoZSBsYXRlc3QgcGFyYWdyYXBoIHByb3Zp ZGVzIGEgaGlnaCBsZXZlbCB2aWV3IG9mIGhvdyB0aGUgcHJvdG9jb2w8YnI+DQp3b3Jrcy4gVGhp cyBpcyB2ZXJ5IGhlbHBmdWwsIGJ1dCBtYXliZSBhZGRpdGlvbmFsIHRleHQgLSBvciBhIGRlZGlj YXRlZDxicj4NCnVzZSBjYXNlIHNlY3Rpb24gbWF5IGJlIG5lZWRlZCB0byBwcm92aWRlIHRoZSBm dWxsIGxpZmUgY3ljbGUgb2YgdGhlPGJyPg0Ka2V5cy4gVHlwaWNhbGx5LCBJIGFtIHdvbmRlcmlu ZyBvbmUgYSBncm91cCBrZXlzIGFyZSBtYW5hZ2VkIGF0IHRoZTxicj4NCmluaXRpYWxpemF0aW9u IG9mIHRoZSBncm91cC4gTXkgaW50ZXJwcmV0YXRpb24gb2YgdGhlIHRleHQgaXMgdGhhdCBpZiBJ PGJyPg0KaGF2ZSAxMDAwIGJhdHRlcnkgcG93ZXIgbW90ZXMgaW4gbXkgaG9tZSBhbmQgZWFjaCBv ZiB0aGVtIGpvaW4gdGhlIGdyb3VwPGJyPg0Kb25lIGJ5IG9uZSwgSSB3aWxsIGhhdmUgMTAwMCBr ZXkgdXBkYXRlcy4gSSBiZWxpZXZlIGl0IHdvdWxkIGJlIGdvb2QgdG88YnI+DQpjbGFyaWZ5IHRo aXMuICZuYnNwOyAmbmJzcDs8YnI+DQo8YnI+DQo8YnI+DQombHQ7L21nbHQmZ3Q7PGJyPg0KPGJy Pg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogWW91ciBpbnRlcnBy ZXRhdGlvbiBpcyBjb3JyZWN0LiBIb3cgdGhhdCBpcyBkb25lIHNwZWNpZmljYWxseSBkZXBlbmRz IG9uIHRoZSBtYW5hZ2VtZW50IHNjaGVtZSBtZWNoYW5pc20gdXNlZCwgYW5kIG91dCBvZiBzY29w ZSBvZiB0aGlzIGRvY3VtZW50LiBJIGRvbuKAmXQga25vdyB3aGF0IGVsc2UgdG8gYWRkLCBpZiBJ IHVuZGVyc3RhbmQgY29ycmVjdGx5IHRoZSBmb2xsb3dpbmcgc2VudGVuY2Ugc2hvdWxkDQogY292 ZXIgd2hhdCB5b3Ugc2FpZDogPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDvigJxJbiBwYXJ0aWN1bGFyLCB0aGUga2V5IG1hbmFnZW1lbnQgc2NoZW1lIHJla2V5cyB0 aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBjdXJy ZW50IGdyb3VwIG1lbWJlcnMgd2hlbiBhIG5ldyBub2RlIGpvaW5zIHRoZSBncm91cCwgYW5kIHRo ZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IHJlbWFp bmluZyBncm91cCBtZW1iZXJzIHdoZW4gYSBub2RlIGxlYXZlcyB0aGUgZ3JvdXAu4oCdPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QbGVhc2UgbGV0IG1lIGtub3cgaWYgdGhh dOKAmXMgbm90IHRoZSBjYXNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQoxLjEuJm5i c3A7IFRlcm1pbm9sb2d5PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBrZXkgd29yZHMgJnF1 b3Q7TVVTVCZxdW90OywgJnF1b3Q7TVVTVCBOT1QmcXVvdDssICZxdW90O1JFUVVJUkVEJnF1b3Q7 LCAmcXVvdDtTSEFMTCZxdW90OywgJnF1b3Q7U0hBTEwgTk9UJnF1b3Q7LDxicj4NCiZuYnNwOyAm bmJzcDsmcXVvdDtTSE9VTEQmcXVvdDssICZxdW90O1NIT1VMRCBOT1QmcXVvdDssICZxdW90O1JF Q09NTUVOREVEJnF1b3Q7LCAmcXVvdDtNQVkmcXVvdDssIGFuZCAmcXVvdDtPUFRJT05BTCZxdW90 OyBpbiB0aGlzPGJyPg0KJm5ic3A7ICZuYnNwO2RvY3VtZW50IGFyZSB0byBiZSBpbnRlcnByZXRl ZCBhcyBkZXNjcmliZWQgaW4gW1JGQzIxMTldLiZuYnNwOyBUaGVzZTxicj4NCiZuYnNwOyAmbmJz cDt3b3JkcyBtYXkgYWxzbyBhcHBlYXIgaW4gdGhpcyBkb2N1bWVudCBpbiBsb3dlcmNhc2UsIGFi c2VudCB0aGVpcjxicj4NCiZuYnNwOyAmbmJzcDtub3JtYXRpdmUgbWVhbmluZ3MuPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwO1JlYWRlcnMgYXJlIGV4cGVjdGVkIHRvIGJlIGZhbWlsaWFyIHdpdGgg dGhlIHRlcm1zIGFuZCBjb25jZXB0czxicj4NCiZuYnNwOyAmbmJzcDtkZXNjcmliZWQgaW4gW0kt RC5pZXRmLWFjZS1vYXV0aC1hdXRoel0gYW5kIFtSRkM4MTUyXSwgc3VjaCBhczxicj4NCiZuYnNw OyAmbmJzcDtBdXRob3JpemF0aW9uIFNlcnZlciAoQVMpIGFuZCBSZXNvdXJjZSBTZXJ2ZXIgKFJT KS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBkb2N1bWVudCBhZGRpdGlvbmFsbHkgdXNl cyB0aGUgZm9sbG93aW5nIHRlcm1pbm9sb2d5Ojxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZu YnNwO1RyYW5zcG9ydCBwcm9maWxlLCB0byBpbmRpY2F0ZSBhIHByb2ZpbGUgb2YgQUNFIGFzIHBl cjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFNlY3Rpb24gNS42LjQuMyBvZiBbSS1ELmlldGYt YWNlLW9hdXRoLWF1dGh6XS4mbmJzcDsgVGhhdCBpcywgYTxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IHRyYW5zcG9ydCBwcm9maWxlIHNwZWNpZmllcyB0aGUgY29tbXVuaWNhdGlvbiBwcm90b2Nv bCBhbmQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHBy b3RvY29sIGJldHdlZW4gYW4gQUNFIENsaWVudCBhbmQgUmVzb3VyY2U8YnI+DQo8YnI+DQo8YnI+ DQo8YnI+DQpQYWxvbWJpbmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGly ZXMgSmFudWFyeSA2LCAyMDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDtbUGFnZSAzXTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNw O0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAm bmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgU2Vy dmVyLCBhcyB3ZWxsIGFzIHByb29mLW9mLXBvc3Nlc3Npb24gbWV0aG9kcywgaWYgaXQgc3VwcG9y dHM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBwcm9vZi1vZi1wb3NzZXNzaW9uIGFjY2VzcyB0 b2tlbnMuJm5ic3A7IFRyYW5wb3J0IHByb2ZpbGVzIG9mIEFDRTxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IGluY2x1ZGUsIGZvciBpbnN0YW5jZSwgW0ktRC5pZXRmLWFjZS1vc2NvcmUtcHJvZmls ZV0sPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgW0ktRC5pZXRmLWFjZS1kdGxzLWF1dGhvcml6 ZV0gYW5kIFtJLUQuaWV0Zi1hY2UtbXF0dC10bHMtcHJvZmlsZV0uPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO28gJm5ic3A7QXBwbGljYXRpb24gcHJvZmlsZSwgdG8gaW5kaWNhdGUgYSBwcm9maWxl IG9mIEFDRSB0aGF0IGRlZmluZXMgaG93PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgYXBwbGlj YXRpb25zIGVuZm9yY2UgYW5kIHVzZSBzdXBwb3J0aW5nIHNlY3VyaXR5IHNlcnZpY2VzIHRoZXk8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyByZXF1aXJlLiZuYnNwOyBUaGVzZSBzZXJ2aWNlcyBp bmNsdWRlLCBmb3IgaW5zdGFuY2UsIHByb3Zpc2lvbmluZyw8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyByZXZvY2F0aW9uIGFuZCAocmUtKWRpc3RyaWJ1dGlvbiBvZiBrZXlpbmcgbWF0ZXJpYWwu Jm5ic3A7IEFuPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgYXBwbGljYXRpb24gcHJvZmlsZSBt YXkgZGVmaW5lIHNwZWNpZmljIHByb2NlZHVyZXMgYW5kIG1lc3NhZ2U8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyBmb3JtYXRzLjxicj4NCjxicj4NCjIuJm5ic3A7IE92ZXJ2aWV3PGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JiM0MzstLS0tLS0tLS0tLS0mIzQzOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyYjNDM7LS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wg Jm5ic3A7ICZuYnNwOyBBUyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDtLREMg Jm5ic3A7ICZuYnNwO3w8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsuLS0tLS0tLS0mZ3Q7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLSYjNDM7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IC8gJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyYj NDM7LS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO14gJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgLzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw O3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsvPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7diAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IC8gJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICYjNDM7LS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyYj NDM7LS0tLS0tLS0tLS0tJiM0MzsgJm5ic3A7IC8gJm5ic3A7ICZuYnNwOyAmbmJzcDsmIzQzOy0t LS0tLS0tLS0tLSYjNDM7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wmIzQzOy0tLS0tLS0t LS0tJiM0Mzs8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyBDbGllbnQg Jm5ic3A7IHwmbHQ7LScgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCBEaXNwYXRjaGVyIHwgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7fHwmIzQzOy0tLS0tLS0tLS0tJiM0Mzs8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7fCZsdDstLS0tLS0tLSZndDt8ICZuYnNwOyAmbmJzcDsoUlMpICZuYnNwOyAmbmJzcDt8 Jmx0Oy0tLS0tLS0mZ3Q7fHwgJm5ic3A7IEdyb3VwICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7JiM0MzstLS0tLS0tLS0tLS0mIzQzOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7JiM0MzstLS0tLS0tLS0tLS0mIzQzOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJiM0Mzt8ICZuYnNwO21lbWJlcnMgJm5ic3A7fDxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0mIzQzOzxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEZpZ3VyZSAx OiBLZXkgRGlzdHJpYnV0aW9uIFBhcnRpY2lwYW50czxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtU aGUgZm9sbG93aW5nIHBhcnRpY2lwYW50cyAoc2VlIEZpZ3VyZSAxKSB0YWtlIHBhcnQgaW4gdGhl PGJyPg0KJm5ic3A7ICZuYnNwO2F1dGhvcml6YXRpb24gYW5kIGtleSBkaXN0cmlidXRpb24uPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7Q2xpZW50IChDKTogbm9kZSB0aGF0IHdhbnRz IHRvIGpvaW4gdGhlIGdyb3VwIGNvbW11bmljYXRpb24uJm5ic3A7IEl0PGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgY2FuIHJlcXVlc3Qgd3JpdGUgYW5kL29yIHJlYWQgcmlnaHRzLjxicj4NCiZs dDttZ2x0Jmd0Ozxicj4NCkkgYW0gd29uZGVyaW5nIGlmIG9uZSBjYW4gaGF2ZSB3cml0ZSBhY2Nl c3Mgd2l0aG91dCBoYXZpbmcgcmVhZCBhY2Nlc3MuPGJyPg0KSXQgc2VlbXMgdG8gbWUgLSBidXQg SSBtaWdodCBiZSB3cm9uZyAtIHRoYXQgd3JpdGUgYWNjZXNzIHByb3ZpZGVzIHJlYWQ8YnI+DQph Y2Nlc3MuIElmIHRoYXQgaXMgY29ycmVjdCwgSSBhbSB3b25kZXJpbmcgaWYgd2UgY291bGQgaGF2 ZSByZWFkIG9yPGJyPg0Kd3JpdGUuPGJyPg0KPGJyPg0KVGhlIGZpZ3VyZSBzZWVtcyB0byBnaXZl IHR3byByb2xlcyBvZiB0aGUgQ2xpZW50OiAxKSB0aGUgYWJpbGl0eSB0byBqb2luPGJyPg0KdGhl IGdyb3VwIHdpdGggc29tZSBpbnRlcmFjdGlvbnMgd2l0aCBLREMgYXMgd2VsbCBhcyAyKSB0aGUg YWJpbGl0eSB0bzxicj4NCnNlbmQgbWVzc2FnZSB3aXRoIHNvbWUgaW50ZXJhY3Rpb25zIHdpdGgg dGhlIERpc3BhdGNoZXIuIEkgYW0gd29uZGVyaW5nPGJyPg0KaWYgdGhlcmUgYXJlIGFueSByZWFz b25zIHRoZSBsYXRlc3QgaXMgbm90IG1lbnRpb25lZC4gPGJyPg0KJmx0Oy9tZ2x0Jmd0OzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogVGhhdCByZWFsbHkgZGVwZW5kcyBvbiB0aGUgc3BlY2lm aWMgYXBwbGljYXRpb24gcHJvZmlsZS4gRm9yIGV4YW1wbGUsIGluIGdyb3VwIE9TQ09SRSBhcHBs aWNhdGlvbiBwcm9maWxlLCBvbmUgY2FuIG5vdCBoYXZlIHdyaXRlIGFjY2VzcyB3aXRob3V0IHJl YWQgYWNjZXNzLCBhbmQgdGhhdCBpcyBiZWNhdXNlIG9mIHRoZSB1c2Ugb2Ygc3ltbWV0cmljIGtl eXMgdG8gcHJvdGVjdCB0aGUgY29tbXVuaWNhdGlvbi4NCiBCdXQgSSBjb3VsZCBpbWFnaW5lIHRo YXQgYSBkaWZmZXJlbnQgcHJvZmlsZSBjb3VsZCB1c2Ugc2V2ZXJhbCBzeW1tZXRyaWMga2V5cyBh bmQgbWFrZSB0aGUgcmVhZCB2cyB3cml0ZSB3b3JrLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+VGhlIGxhdGVzdCBpcyBub3QgbWVudGlvbmVkIHNpbmNlIGl0IGlzIG5vdCBw YXJ0IG9mIHRoaXMgZnJhbWV3b3JrLCBidXQgaXMgb25lIG9mIHRoZSByZXF1aXJlbWVudHMgbGlz dGVkIGluIEFwcGVuZGl4IEEgYW5kIHRocm91Z2hvdXQgdGhlIHRleHQgdGhhdCB0aGUgYXBwbGlj YXRpb24gcHJvZmlsZXMgaGF2ZSB0byBkZWZpbmUsIHRvIG1ha2UgZ3JvdXAgY29tbXVuaWNhdGlv biB3b3JrICjigJx3aGF0IGdyb3VwDQogY29tbXVuaWNhdGlvbiBwcm90b2NvbCBpcyB1c2Vk4oCd KS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtvICZuYnNwO0F1dGhvcml6YXRpb24gU2VydmVyIChBUyk6IHNhbWUgYXMgQVMgaW4g dGhlIEFDRSBGcmFtZXdvcms7IGl0PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgZW5mb3JjZXMg YWNjZXNzIHBvbGljaWVzLCBhbmQga25vd3MgaWYgYSBub2RlIGlzIGFsbG93ZWQgdG8gam9pbjxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHRoZSBncm91cCB3aXRoIHdyaXRlIGFuZC9vciByZWFk IHJpZ2h0cy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtLZXkgRGlzdHJpYnV0aW9u IENlbnRlciAoS0RDKTogbWFpbnRhaW5zIHRoZSBrZXlpbmcgbWF0ZXJpYWwgdG88YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBwcm90ZWN0IGdyb3VwIGNvbW11bmljYXRpb25zLCBhbmQgcHJvdmlk ZXMgaXQgdG8gQ2xpZW50czxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGF1dGhvcml6ZWQgdG8g am9pbiB0aGUgZ3JvdXAuJm5ic3A7IER1cmluZyB0aGUgZmlyc3QgcGFydCBvZiB0aGU8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyBleGNoYW5nZSAoU2VjdGlvbiAzKSwgaXQgdGFrZXMgdGhlIHJv bGUgb2YgdGhlIFJTIGluIHRoZSBBQ0U8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBGcmFtZXdv cmsuJm5ic3A7IER1cmluZyB0aGUgc2Vjb25kIHBhcnQgKFNlY3Rpb24gNCksIHdoaWNoIGlzIG5v dCBiYXNlZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IG9uIHRoZSBBQ0UgRnJhbWV3b3JrLCBp dCBkaXN0cmlidXRlcyB0aGUga2V5aW5nIG1hdGVyaWFsLiZuYnNwOyBJbjxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7IGFkZGl0aW9uLCBpdCBwcm92aWRlcyB0aGUgbGF0ZXN0IGtleWluZyBtYXRl cmlhbCB0byBncm91cCBtZW1iZXJzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgd2hlbiByZXF1 ZXN0ZWQuJm5ic3A7IElmIHJlcXVpcmVkIGJ5IHRoZSBhcHBsaWNhdGlvbiwgdGhlIEtEQyByZW5l d3M8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJpbmkgJmFtcDsgVGlsb2NhICZu YnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtbUGFnZSA0XTxicj4NCjxi cj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11 bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgYW5kIHJlLWRpc3RyaWJ1dGVzIHRoZSBrZXlpbmcgbWF0ZXJp YWwgaW4gdGhlIGdyb3VwIHdoZW48YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBtZW1iZXJzaGlw IGNoYW5nZXMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7RGlzcGF0Y2hlcjogZW50 aXR5IHRocm91Z2ggd2hpY2ggdGhlIENsaWVudHMgY29tbXVuaWNhdGUgd2l0aCB0aGU8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyBncm91cCBhbmQgd2hpY2ggZGlzdHJpYnV0ZXMgbWVzc2FnZXMg dG8gdGhlIGdyb3VwIG1lbWJlcnMuLjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4YW1wbGVz IG9mIGRpc3BhdGNoZXJzIGFyZTogdGhlIEJyb2tlciBub2RlIGluIGEgcHViLXN1YiBzZXR0aW5n Ozxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGEgcmVsYXllciBub2RlIGZvciBncm91cCBjb21t dW5pY2F0aW9uIHRoYXQgZGVsaXZlcnMgZ3JvdXA8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBt ZXNzYWdlcyBhcyBtdWx0aXBsZSB1bmljYXN0IG1lc3NhZ2VzIHRvIGFsbCBncm91cCBtZW1iZXJz OyBhbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGltcGxpY2l0IGVudGl0eSBhcyBpbiBhIG11 bHRpY2FzdCBjb21tdW5pY2F0aW9uIHNldHRpbmcsIHdoZXJlPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgbWVzc2FnZXMgYXJlIHRyYW5zbWl0dGVkIHRvIGEgbXVsdGljYXN0IElQIGFkZHJlc3Mg YW5kIGRlbGl2ZXJlZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IG9uIHRoZSB0cmFuc3BvcnQg Y2hhbm5lbC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBkb2N1bWVudCBzcGVjaWZpZXMg dGhlIG1lc3NhZ2UgZmxvd3MgYW5kIGZvcm1hdHMgZm9yOjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtvICZuYnNwO0F1dGhvcml6aW5nIGEgbmV3IG5vZGUgdG8gam9pbiB0aGUgZ3JvdXAgKFNlY3Rp b24gMyksIGFuZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHByb3ZpZGluZyBpdCB3aXRoIHRo ZSBncm91cCBrZXlpbmcgbWF0ZXJpYWwgdG8gY29tbXVuaWNhdGUgd2l0aDxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7IHRoZSBvdGhlciBncm91cCBtZW1iZXJzIChTZWN0aW9uIDQpLjxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1JlbW92aW5nIG9mIGEgY3VycmVudCBtZW1iZXIgZnJv bSB0aGUgZ3JvdXAgKFNlY3Rpb24gNSkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7 UmV0cmlldmluZyBrZXlpbmcgbWF0ZXJpYWwgYXMgYSBjdXJyZW50IGdyb3VwIG1lbWJlciAoU2Vj dGlvbiA2PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgYW5kIFNlY3Rpb24gNykuPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7UmVuZXdpbmcgYW5kIHJlLWRpc3RyaWJ1dGluZyB0aGUg Z3JvdXAga2V5aW5nIG1hdGVyaWFsIChyZWtleWluZyk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyB1cG9uIGEgbWVtYmVyc2hpcCBjaGFuZ2UgaW4gdGhlIGdyb3VwIChTZWN0aW9uIDQuMiBhbmQg U2VjdGlvbiA1KS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7RmlndXJlIDIgcHJvdmlkZXMgYSBo aWdoIGxldmVsIG92ZXJ2aWV3IG9mIHRoZSBtZXNzYWdlIGZsb3cgZm9yIGE8YnI+DQombmJzcDsg Jm5ic3A7bm9kZSBqb2luaW5nIGEgZ3JvdXAgY29tbXVuaWNhdGlvbiBzZXR0aW5nLjxicj4NCjxi cj4NCiZuYnNwOyBDICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7QVMgJm5ic3A7ICZuYnNwOyBLREMgJm5ic3A7IERpc3BhdGNoZXIgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwO0dyb3VwPGJyPg0KJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgTWVtYmVyPGJyPg0KJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBcICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyBBdXRob3Jp emF0aW9uIFJlcXVlc3QgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IHwgRGVmaW5lZCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8 PGJyPg0KJm5ic3A7IHwtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSZndDt8ICZuYnNwOyAm bmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCB8IGluIHRoZSBBQ0Ug Jm5ic3A7ICZuYnNwO3w8YnI+DQombmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDt8IHwgZnJhbWV3b3JrICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8 ICZuYnNwOyAmbmJzcDsgQXV0aG9yaXphdGlvbiBSZXNwb25zZSAmbmJzcDsgfCAmbmJzcDsgJm5i c3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgfCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8Jmx0Oy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwO3wgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8LS0tLS0tLS0tIFRva2VuIFBvc3QgLS0tLS0t LS0tLS0tLS0tLSZndDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgLyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+DQombmJz cDsgfC0tLS0gS2V5IERpc3RyaWJ1dGlvbiBSZXF1ZXN0IC0tLS0tLS0mZ3Q7fCAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+DQombmJzcDsgfCZsdDstLS0gS2V5IERpc3Ry aWJ1dGlvbiBSZXNwb25zZSAtLS0tLS0gfCAtLS0gR3JvdXAgUmVrZXlpbmcgLS0tLS0mZ3Q7fDxi cj4NCiZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7IHw8YnI+DQombmJzcDsgfCZsdDs9PT09PT09PT09PT09PT09PT0gUHJvdGVjdGVkIGNvbW11 bmljYXRpb24gPT09fD09PT09PT09PT09PT09PT0mZ3Q7fDxicj4NCiZuYnNwOyB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRmlndXJlIDI6IE1l c3NhZ2UgRmxvdyBVcG9uIE5ldyBOb2RlJ3MgSm9pbmluZzxicj4NCiZsdDttZ2x0Jmd0Ozxicj4N CiZxdW90O0RlZmluZWQgaW4gdGhlIEFDRSBmcmFtZXdvcmsmcXVvdDsgOiBpdCBpcyB1bmNsZWFy IHRvIG1lIGlmIGl0IGRlc2lnbmF0ZXM8YnI+DQp0aGUgRElzcGF0Y2hlciBvZiB0aGUgQXV0aG9y aXphdGlvbiBhbmQgVG9rZW4gUG9zdCBleGNoYW5nZXMuIEkgdGhpbms8YnI+DQp0aGF0IGlzIHRo ZSBsYXRlc3QuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZQOiBZZXMsIHRoYXTigJlzIHJpZ2h0 LiBXZSBoYXZlIGNoYW5nZWQgdGhlIGZpZ3VyZSB0byB0cnkgdG8gbWFrZSBpdCBjbGVhcmVyLjxi cj4NCjxicj4NCkkgdW5kZXJzdGFuZCB0aGUgRGlzcGF0Y2hlciBpcyBub3QgaW52b2x2ZWQgaW4g dGhlIGRpc3RyaWJ1dGlvbiBvZiB0aGU8YnI+DQprZXlpbmcgbWF0ZXJpYWwsIGJ1dCBvbmx5IHRv IHRoZSBkaXN0cmlidXRpb24gb2YgdGhlIG1lc3NhZ2VzLiBJZiB0aGF0PGJyPg0KaXMgY29ycmVj dCwgaXQgZG9lcyBub3QgYXBwZWFyIGNsZWFybHkgb24gdGhlIGZpZ3VyZSwgbWF5YmUgcGxhY2lu Zzxicj4NCkRpc3BhdGNoZXIgYW5kIEdyb3VwIE1lbWJlcnMgYmVsb3cgdGhlIEdyb3VwIEtleWlu ZyBhcnJvdyB3b3VsZCBjbGFyaWZ5PGJyPg0KdGhpcy4uIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5GUDogT2ssIGRvbmUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+ DQpJIHRoaW5rIFByb3RlY3RlZCBjb21tdW5pY2F0aW9uIGlzIG5vdCBpbiB0aGUgc2NvcGUgb2Yg dGhpcyBkcmFmdCwgc28gaXQ8YnI+DQptaWdodCBzcGVjaWZpZWQgYXMgd2VsbCBhcyBpdCBpcyBi ZWluZyBkb25lIGZvciB0aGUgQUNFIGZyYW1ld29yayAtIGlmPGJyPg0KdGhhdCBpcyBjb3JyZWN0 LiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RlA6IFRoYXQgaXMgY29ycmVjdC4gQW5kIGl0IGlz IHNwZWNpZmllZCBpbiB0aGUgYXBwZW5kaXggQSBhbmQgbm93IGluIHRoZSBtYWluIGJvZHkgb2Yg dGhlIGRvY3VtZW50OjxvOnA+PC9vOnA+PC9wPg0KPHByZT7igJw8c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPiZuYnNwOyZuYnNwOyBTcGVjaWZpYyBhcHBsaWNhdGlvbiBwcm9maWxlcyB0aGF0IGJ1 aWxkIG9uIHRoaXMgZG9jdW1lbnQgTVVTVDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBzcGVjaWZ5 IGhvdyBleGFjdGx5IHRoZSBrZXlpbmcgbWF0ZXJpYWwgaXMgdXNlZCB0byBwcm90ZWN0IHRoZSBn cm91cDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgY29tbXVuaWNhdGlvbjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPuKAnCA8YnI+DQo8YnI+DQpQcm90ZWN0ZWQgY29t bXVuaWNhdGlvbiBpcyB1c3VhbGx5IGludGVycHJldGVkIGFzIGVuZC10by1lbmQgc2VjdXJpdHk8 YnI+DQphbmQgdGhpcyBtYXkgbm90IGJlIGFjaGlldmVkIHdpdGggZ3JvdXAgY29tbXVuaWNhdGlv bi4gTWF5YmUgc2VjdXJlPGJyPg0KZ3JvdXAgY29tbXVuaWNhdGlvbiBtaWdodCBiZSBtb3JlIGFw cHJvcHJpYXRlZC4uIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogT2ssIGRvbmUuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQombHQ7L21nbHQmZ3Q7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkZQOiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNw OyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1tQYWdlIDVdPGJyPg0KPGJyPg0KSW50ZXJu ZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAm bmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7VGhlIGV4Y2hhbmdlIG9mIEF1dGhvcml6YXRpb24gUmVxdWVzdCBhbmQgQXV0aG9yaXphdGlv biBSZXNwb25zZTxicj4NCiZuYnNwOyAmbmJzcDtiZXR3ZWVuIENsaWVudCBhbmQgQVMgTVVTVCBi ZSBzZWN1cmVkLCBhcyBzcGVjaWZpZWQgYnkgdGhlIHRyYW5zcG9ydDxicj4NCiZuYnNwOyAmbmJz cDtwcm9maWxlIG9mIEFDRSB1c2VkIGJldHdlZW4gQ2xpZW50IGFuZCBLREMuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO1RoZSBleGNoYW5nZSBvZiBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgYW5k IEtleSBEaXN0cmlidXRpb248YnI+DQombmJzcDsgJm5ic3A7UmVzcG9uc2UgYmV0d2VlbiBDbGll bnQgYW5kIEtEQyBNVVNUIGJlIHNlY3VyZWQsIGFzIGEgcmVzdWx0IG9mIHRoZTxicj4NCiZuYnNw OyAmbmJzcDt0cmFuc3BvcnQgcHJvZmlsZSBvZiBBQ0UgdXNlZCBiZXR3ZWVuIENsaWVudCBhbmQg S0RDLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtBbGwgZnVydGhlciBjb21tdW5pY2F0aW9ucyBi ZXR3ZWVuIHRoZSBDbGllbnQgYW5kIHRoZSBLREMgTVVTVCBiZTxicj4NCiZuYnNwOyAmbmJzcDtz ZWN1cmVkLCBmb3IgaW5zdGFuY2Ugd2l0aCB0aGUgc2FtZSBzZWN1cml0eSBtZWNoYW5pc20gdXNl ZCBmb3IgdGhlPGJyPg0KJm5ic3A7ICZuYnNwO0tleSBEaXN0cmlidXRpb24gZXhjaGFuZ2UuPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwO0FsbCBjb21tdW5pY2F0aW9ucyBiZXR3ZWVuIGEgQ2xpZW50 IGFuZCB0aGUgb3RoZXIgZ3JvdXAgbWVtYmVycyBNVVNUPGJyPg0KJm5ic3A7ICZuYnNwO2JlIHNl Y3VyZWQgdXNpbmcgdGhlIGtleWluZyBtYXRlcmlhbCBwcm92aWRlZCBpbiBTZWN0aW9uIDQuPGJy Pg0KPGJyPg0KMy4mbmJzcDsgQXV0aG9yaXphdGlvbiB0byBKb2luIGEgR3JvdXA8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7VGhpcyBzZWN0aW9uIGRlc2NyaWJlcyBpbiBkZXRhaWwgdGhlIGZvcm1h dCBvZiBtZXNzYWdlcyBleGNoYW5nZWQgYnk8YnI+DQombmJzcDsgJm5ic3A7dGhlIHBhcnRpY2lw YW50cyB3aGVuIGEgbm9kZSByZXF1ZXN0cyBhY2Nlc3MgdG8gYSBncm91cC4mbmJzcDsgVGhlIGZp cnN0PGJyPg0KJm5ic3A7ICZuYnNwO3BhcnQgb2YgdGhlIGV4Y2hhbmdlIGlzIGJhc2VkIG9uIEFD RSBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7QXMg ZGVmaW5lZCBpbiBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XSwgdGhlIENsaWVudCByZXF1ZXN0 cyBmcm9tPGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBBUyBhbiBhdXRob3JpemF0aW9uIHRvIGpvaW4g dGhlIGdyb3VwIHRocm91Z2ggdGhlIEtEQyAoc2VlPGJyPg0KJm5ic3A7ICZuYnNwO1NlY3Rpb24g My4xKS4mbmJzcDsgSWYgdGhlIHJlcXVlc3QgaXMgYXBwcm92ZWQgYW5kIGF1dGhvcml6YXRpb24g aXM8YnI+DQombmJzcDsgJm5ic3A7Z3JhbnRlZCwgdGhlIEFTIHByb3ZpZGVzIHRoZSBDbGllbnQg d2l0aCBhIHByb29mLW9mLXBvc3Nlc3Npb24gYWNjZXNzPGJyPg0KJm5ic3A7ICZuYnNwO3Rva2Vu IGFuZCBwYXJhbWV0ZXJzIHRvIHNlY3VyZWx5IGNvbW11bmljYXRlIHdpdGggdGhlIEtEQyAoc2Vl PGJyPg0KJm5ic3A7ICZuYnNwO1NlY3Rpb24gMy4yKS4mbmJzcDsgQ29tbXVuaWNhdGlvbnMgYmV0 d2VlbiB0aGUgQ2xpZW50IGFuZCB0aGUgQVMgTVVTVCBiZTxicj4NCiZuYnNwOyAmbmJzcDtzZWN1 cmVkLCBhY2NvcmRpbmcgdG8gdGhlIHRyYW5zcG9ydCBwcm9maWxlIG9mIEFDRSB1c2VkLiZuYnNw OyBUaGU8YnI+DQombmJzcDsgJm5ic3A7Q29udGVudC1Gb3JtYXQgdXNlZCBpbiB0aGUgbWVzc2Fn ZXMgaXMgdGhlIG9uZSBzcGVjaWZpZWQgYnkgdGhlIHVzZWQ8YnI+DQombmJzcDsgJm5ic3A7dHJh bnNwb3J0IHByb2ZpbGUgb2YgQUNFIChlLmcuIGFwcGxpY2F0aW9uL2FjZSYjNDM7Y2JvciBmb3Ig dGhlIGZpcnN0IHR3bzxicj4NCiZuYnNwOyAmbmJzcDttZXNzYWdlcyBhbmQgYXBwbGljYXRpb24v Y3d0IGZvciB0aGUgdGhpcmQgbWVzc2FnZSwgZGVwZW5kaW5nIG9uIHRoZTxicj4NCiZuYnNwOyAm bmJzcDtmb3JtYXQgb2YgdGhlIGFjY2VzcyB0b2tlbikuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O0ZpZ3VyZSAzIGdpdmVzIGFuIG92ZXJ2aWV3IG9mIHRoZSBleGNoYW5nZSBkZXNjcmliZWQgYWJv dmUuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO0NsaWVudCAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtBUyAmbmJzcDtLREM8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgfDxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwtLS0tIEF1dGhvcml6YXRpb24gUmVx dWVzdDogUE9TVCAvdG9rZW4gLS0tLS0tJmd0O3wgJm5ic3A7IHw8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwmbHQ7LS0tIEF1dGhvcml6YXRpb24gUmVzcG9uc2U6IDIu MDEgKENyZWF0ZWQpIC0tLXwgJm5ic3A7IHw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgfCAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7IHwtLS0tLSBQT1NUIFRva2VuOiBQT1NUIC9hdXRoei1pbmZvIC0tLS0tLS0tLS0t LS0tLSZndDt8PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgfDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDtGaWd1cmUgMzogTWVzc2FnZSBGbG93IG9mIEpvaW4gQXV0aG9yaXph dGlvbjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAm YW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1tQ YWdlIDZdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBm b3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+ DQo8YnI+DQo8YnI+DQozLjEuJm5ic3A7IEF1dGhvcml6YXRpb24gUmVxdWVzdDxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtUaGUgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IHNlbnQgZnJvbSB0aGUgQ2xp ZW50IHRvIHRoZSBBUyBpcyBhczxicj4NCiZuYnNwOyAmbmJzcDtkZWZpbmVkIGluIFNlY3Rpb24g NS42LjEgb2YgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0gYW5kIE1VU1Q8YnI+DQombmJzcDsg Jm5ic3A7Y29udGFpbiB0aGUgZm9sbG93aW5nIHBhcmFtZXRlcnM6PGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO28gJm5ic3A7J2dyYW50X3R5cGUnLCB3aXRoIHZhbHVlICZxdW90O2NsaWVudF9jcmVk ZW50aWFscyZxdW90Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7QWRkaXRpb25hbGx5LCB0aGUg QXV0aG9yaXphdGlvbiBSZXF1ZXN0IE1BWSBjb250YWluIHRoZSBmb2xsb3dpbmc8YnI+DQombmJz cDsgJm5ic3A7cGFyYW1ldGVycywgd2hpY2gsIGlmIGluY2x1ZGVkLCBNVVNUIGhhdmUgdGhlIGNv cnJlc3BvbmRpbmcgdmFsdWVzOjxicj4NCjxicj4NCiZsdDttZ2x0Jmd0Ozxicj4NCkkgYmVsaWV2 ZSB0aGUgdmFsdWUgaXMgdW5kZXJzdG9vZCBhcyB0aGUgdmFsdWUgaW4gYSBkaWN0aW9uYXJ5IChr ZXksPGJyPg0KdmFsdWUpIC0gcmF0aGVyIHRoZW4gdGhlIHZhbHVlIG9mIHRoZSB2YWx1ZSBpdHNl bGYuIDxicj4NCjxicj4NCkkgc3VnZ2VzdCB0byBwcm92aWRlIGV4cGxpY2l0bHkgaG93IHRoZSBB UyBiZWhhdmVzIGlmIHRoZSB2YWx1ZSBmb3JtYXQ8YnI+DQppcyBub3QgcmVjb2duaXplZCBvciBp ZiB0aGUgcHJvdmlkZWQgdmFsdWUgaXMgdW5rbm93biB0byB0aGUgQVMuIE1vcmU8YnI+DQpzcGVj aWZpY2FsbHksIGlzIHRoZSBwYXJhbWV0ZXIgaWdub3JlZCBvciB0aGUgZXhjaGFuZ2UgYWJvcnRl ZC4gPGJyPg0KJmx0Oy9tZ2x0Jmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogVGhpcyBz cGVjaWZpYyBmaWVsZCBkaXNhcHBlYXJlZCB3aXRoIHVwZGF0ZXMgZm9sbG93aW5nIEx1ZHdpZ+KA mXMgcmV2aWV3LCBidXQgeW91ciBjb21tZW50cyBzdGlsbCBzdGFuZCBmb3IgYWxsIHRoZSBvdGhl ciBmaWVsZHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgcG9pbnQg YWJvdXQgdmFsdWUgaXMgdmFsaWQsIGFsdGhvdWdoIEkgdGhpbmsgdGhpcyBpcyBjbGVhciBlbm91 Z2ggYW5kIHRyeWluZyB0byBtYWtlIGl0IOKAnG1vcmUgY29ycmVjdOKAnSB3b3VsZCBtYWtlIGl0 IGhhcmRlciB0byByZWFkICh3aXRoIHZhbHVlIG9mIHZhbHVlPykuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyB0aGlzIGlzIHRoZSBBQ0UgZXhjaGFuZ2UsIHRoZSBBQ0Ug cnVsZXMgYXBwbHkgaGVyZS4gSS5lLiBlcnJvciBtZXNzYWdlcyBhcHBseSBpZiB0aGUgcGFyYW1l dGVycyBhcmUgbm90IHJlY29nbml6ZWQgKHNlZQ0KPGEgaHJlZj0iaHR0cHM6Ly9hY2Utd2cuZ2l0 aHViLmlvL2FjZS1vYXV0aC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei5odG1sI2Vycm9yc1Rv a2VuIj4NCmh0dHBzOi8vYWNlLXdnLmdpdGh1Yi5pby9hY2Utb2F1dGgvZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHouaHRtbCNlcnJvcnNUb2tlbjwvYT4gKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J3Njb3BlJywg Y29udGFpbmluZyB0aGUgaWRlbnRpZmllciBvZiB0aGUgc3BlY2lmaWMgZ3JvdXAgKG9yIHRvcGlj PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgaW4gdGhlIGNhc2Ugb2YgcHViLXN1YikgdGhhdCB0 aGUgQ2xpZW50IHdpc2hlcyB0byBhY2Nlc3MsIGFuZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 IG9wdGlvbmFsbHkgdGhlIHJvbGUocykgdGhhdCB0aGUgQ2xpZW50IHdpc2hlcyB0byB0YWtlLiZu YnNwOyBUaGlzIHZhbHVlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgaXMgYSBDQk9SIGFycmF5 IGVuY29kZWQgYXMgYSBieXRlIHN0cmluZywgd2hpY2ggY29udGFpbnM6PGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgKiAmbmJzcDtBcyBmaXJzdCBlbGVtZW50LCB0aGUgaWRlbnRpZmll ciBvZiB0aGUgc3BlY2lmaWMgZ3JvdXAgb3I8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7dG9waWMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgKiAmbmJzcDtP cHRpb25hbGx5LCBhcyBzZWNvbmQgZWxlbWVudCwgdGhlIHJvbGUgKG9yIENCT1IgYXJyYXkgb2Y8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7cm9sZXMpIHRoZSBDbGllbnQg d2lzaGVzIHRvIHRha2UgaW4gdGhlIGdyb3VwLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IFRoZSBlbmNvZGluZyBvZiB0aGUgZ3JvdXAgb3IgdG9waWMgaWRlbnRpZmllciBhbmQgb2Yg dGhlIHJvbGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBpZGVudGlmaWVycyBpcyBhcHBsaWNh dGlvbiBzcGVjaWZpYy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsnYXVkaWVuY2Un LCB3aXRoIGFuIGlkZW50aWZpZXIgb2YgYSBLREMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28g Jm5ic3A7J3JlcV9jbmYnLCBhcyBkZWZpbmVkIGluIFNlY3Rpb24gMy4xIG9mPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgW0ktRC5pZXRmLWFjZS1vYXV0aC1wYXJhbXNdLCBvcHRpb25hbGx5IGNv bnRhaW5pbmcgdGhlIHB1YmxpYyBrZXk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBvciBhIHJl ZmVyZW5jZSB0byB0aGUgcHVibGljIGtleSBvZiB0aGUgQ2xpZW50LCBpZiBpdCB3aXNoZXMgdG88 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBjb21tdW5pY2F0ZSB0aGF0IHRvIHRoZSBBUy48YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtPdGhlciBhZGRpdGlvbmFsIHBhcmFtZXRlcnMg YXMgZGVmaW5lZCBpbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFtJLUQuaWV0Zi1hY2Utb2F1 dGgtYXV0aHpdLCBpZiBuZWNlc3NhcnkuPGJyPg0KPGJyPg0KMy4yLiZuYnNwOyBBdXRob3JpemF0 aW9uIFJlc3BvbnNlPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBBdXRob3JpemF0aW9uIFJl c3BvbnNlIHNlbnQgZnJvbSB0aGUgQVMgdG8gdGhlIENsaWVudCBpcyBhczxicj4NCiZuYnNwOyAm bmJzcDtkZWZpbmVkIGluIFNlY3Rpb24gNS42LjIgb2YgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRo el0gYW5kIE1VU1Q8YnI+DQombmJzcDsgJm5ic3A7Y29udGFpbiB0aGUgZm9sbG93aW5nIHBhcmFt ZXRlcnM6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J2FjY2Vzc190b2tlbicsIGNv bnRhaW5pbmcgdGhlIHByb29mLW9mLXBvc3Nlc3Npb24gYWNjZXNzIHRva2VuLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtvICZuYnNwOydjbmYnIGlmIHN5bW1ldHJpYyBrZXlzIGFyZSB1c2VkLCBu b3QgcHJlc2VudCBpZiBhc3ltbWV0cmljIGtleXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBh cmUgdXNlZC4mbmJzcDsgVGhpcyBwYXJhbWV0ZXIgaXMgZGVmaW5lZCBpbiBTZWN0aW9uIDMuMiBv Zjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFtJLUQuaWV0Zi1hY2Utb2F1dGgtcGFyYW1zXSBh bmQgY29udGFpbnMgdGhlIHN5bW1ldHJpYyBwcm9vZi1vZi08YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyBwb3NzZXNzaW9uIGtleSB0aGF0IHRoZSBDbGllbnQgaXMgc3VwcG9zZWQgdG8gdXNlIHdp dGggdGhlIEtEQy48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJpbmkgJmFtcDsg VGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtbUGFnZSA3 XTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdy b3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J3JzX2NuZicgaWYgYXN5bW1ldHJpYyBrZXlz IGFyZSB1c2VkLCBub3QgcHJlc2VudCBpZiBzeW1tZXRyaWM8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyBrZXlzIGFyZSB1c2VkLiZuYnNwOyBUaGlzIHBhcmFtZXRlciBpcyBhcyBkZWZpbmVkIGlu IFNlY3Rpb24gMy4yIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgW0ktRC5pZXRmLWFjZS1v YXV0aC1wYXJhbXNdIGFuZCBjb250YWlucyBpbmZvcm1hdGlvbiBhYm91dCB0aGU8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBwdWJsaWMga2V5IG9mIHRoZSBLREMuPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO28gJm5ic3A7J2V4cCcsIGNvbnRhaW5zIHRoZSBsaWZldGltZSBpbiBzZWNvbmRzIG9m IHRoZSBhY2Nlc3MgdG9rZW4uJm5ic3A7IFRoaXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBw YXJhbWV0ZXIgTUFZIGJlIG9taXR0ZWQgaWYgdGhlIGFwcGxpY2F0aW9uIGRlZmluZXMgaG93IHRo ZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGV4cGlyYXRpb24gdGltZSBpcyBjb21tdW5pY2F0 ZWQgdG8gdGhlIENsaWVudCB2aWEgb3RoZXIgbWVhbnMsIG9yPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgaWYgaXQgZXN0YWJsaXNoZXMgYSBkZWZhdWx0IHZhbHVlLjxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtBZGRpdGlvbmFsbHksIHRoZSBBdXRob3JpemF0aW9uIFJlc3BvbnNlIE1BWSBjb250 YWluIHRoZSBmb2xsb3dpbmc8YnI+DQombmJzcDsgJm5ic3A7cGFyYW1ldGVycywgd2hpY2gsIGlm IGluY2x1ZGVkLCBNVVNUIGhhdmUgdGhlIGNvcnJlc3BvbmRpbmcgdmFsdWVzOjxicj4NCjxicj4N CiZsdDttZ2x0Jmd0Ozxicj4NClNhbWUgY29tbWVudCBhcyBhYm92ZSByZWdhcmRpbmcgdGhlIE1V U1Qgc3RhdGVtZW50Ljxicj4NCiZsdDsvbWdsdCZndDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ RlA6IEFzIHRoaXMgaXMgc3RpbGwgcGFydCBvZiB0aGUgQUNFIGV4Y2hhbmdlLCB0aGUgYmVoYXZp b3VyIG9mIHRoZSBjbGllbnQgaW4gY2FzZSBvZiBlcnJvciBpcyBkZWZpbmVkIHRoZXJlLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O28gJm5ic3A7J3Njb3BlJywgd2hpY2ggbWlycm9ycyB0aGUgJ3Njb3BlJyBwYXJhbWV0ZXIgaW4g dGhlIEF1dGhvcml6YXRpb248YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBSZXF1ZXN0IChzZWUg U2VjdGlvbiAzLjEpLiZuYnNwOyBJdHMgdmFsdWUgaXMgYSBDQk9SIGFycmF5IGVuY29kZWQgYXMg YTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGJ5dGUgc3RyaW5nLCBjb250YWluaW5nOjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICogJm5ic3A7QXMgZmlyc3QgZWxlbWVudCwgdGhl IGlkZW50aWZpZXIgb2YgdGhlIHNwZWNpZmljIGdyb3VwIG9yIHRvcGljPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3RoZSBDbGllbnQgaXMgYXV0aG9yaXplZCB0byBhY2Nl c3MuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgKiAmbmJzcDtPcHRpb25hbGx5LCBh cyBzZWNvbmQgZWxlbWVudCwgdGhlIHJvbGUgKG9yIENCT1IgYXJyYXkgb2Y8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7cm9sZXMpIHRoZSBDbGllbnQgaXMgYXV0aG9yaXpl ZCB0byB0YWtlIGluIHRoZSBncm91cC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBU aGUgZW5jb2Rpbmcgb2YgdGhlIGdyb3VwIG9yIHRvcGljIGlkZW50aWZpZXIgYW5kIG9mIHRoZSBy b2xlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgaWRlbnRpZmllcnMgaXMgYXBwbGljYXRpb24g c3BlY2lmaWMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7T3RoZXIgYWRkaXRpb25h bCBwYXJhbWV0ZXJzIGFzIGRlZmluZWQgaW48YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBbSS1E LmlldGYtYWNlLW9hdXRoLWF1dGh6XSwgaWYgbmVjZXNzYXJ5Ljxicj4NCjxicj4NCiZuYnNwOyAm bmJzcDtUaGUgYWNjZXNzIHRva2VuIE1VU1QgY29udGFpbiBhbGwgdGhlIHBhcmFtZXRlcnMgZGVm aW5lZCBhYm92ZTxicj4NCiZuYnNwOyAmbmJzcDsoaW5jbHVkaW5nIHRoZSBzYW1lICdzY29wZScg YXMgaW4gdGhpcyBtZXNzYWdlLCBpZiBwcmVzZW50LCBvciB0aGU8YnI+DQombmJzcDsgJm5ic3A7 J3Njb3BlJyBvZiB0aGUgQXV0aG9yaXphdGlvbiBSZXF1ZXN0IG90aGVyd2lzZSksIGFuZCBhZGRp dGlvbmFsbHk8YnI+DQombmJzcDsgJm5ic3A7b3RoZXIgb3B0aW9uYWwgcGFyYW1ldGVycyB0aGF0 IHRoZSB0cmFuc3BvcnQgcHJvZmlsZSBvZiBBQ0UgcmVxdWlyZXMuPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO1doZW4gcmVjZWl2aW5nIGFuIEF1dGhvcml6YXRpb24gUmVxdWVzdCBmcm9tIGEgQ2xp ZW50IHRoYXQgd2FzPGJyPg0KJm5ic3A7ICZuYnNwO3ByZXZpb3VzbHkgYXV0aG9yaXplZCwgYW5k IHdoaWNoIHN0aWxsIG93bnMgYSB2YWxpZCBub24gZXhwaXJlZDxicj4NCiZuYnNwOyAmbmJzcDth Y2Nlc3MgdG9rZW4sIHRoZSBBUyByZXBsaWVzIHdpdGggYW4gQXV0aG9yaXphdGlvbiBSZXNwb25z ZSB3aXRoIGE8YnI+DQombmJzcDsgJm5ic3A7bmV3IGFjY2VzcyB0b2tlbi48YnI+DQo8YnI+DQoz LjMuJm5ic3A7IFRva2VuIFBvc3Q8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIENsaWVudCBz ZW5kcyBhIENvQVAgUE9TVCByZXF1ZXN0IGluY2x1ZGluZyB0aGUgYWNjZXNzIHRva2VuIHRvPGJy Pg0KJm5ic3A7ICZuYnNwO3RoZSBLREMsIGFzIHNwZWNpZmllZCBpbiBTZWN0aW9uIDUuOC4xIG9m IFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdLjxicj4NCiZuYnNwOyAmbmJzcDtJZiB0aGUgc3Bl Y2lmaWMgdHJhbnNwb3J0IHByb2ZpbGUgb2YgQUNFIGRlZmluZXMgaXQsIHRoZSBDbGllbnQgTUFZ PGJyPg0KJm5ic3A7ICZuYnNwO3VzZSBhIGRpZmZlcmVudCBlbmRwb2ludCB0aGFuIC9hdXRoei1p bmZvIGF0IHRoZSBLREMgdG8gcG9zdCB0aGU8YnI+DQombmJzcDsgJm5ic3A7YWNjZXNzIHRva2Vu IHRvLjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBU aWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1tQYWdlIDhd PGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3Jv dXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7T3B0aW9uYWxseSwgdGhlIENsaWVudCBtaWdodCBuZWVkIHRv IHJlcXVlc3QgbmVjZXNzYXJ5IGluZm9ybWF0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO2NvbmNlcm5p bmcgdGhlIHB1YmxpYyBrZXlzIGluIHRoZSBncm91cCwgYXMgd2VsbCBhcyBjb25jZXJuaW5nIHRo ZTxicj4NCiZuYnNwOyAmbmJzcDthbGdvcml0aG0gYW5kIHJlbGF0ZWQgcGFyYW1ldGVycyBmb3Ig Y29tcHV0aW5nIHNpZ25hdHVyZXMgaW4gdGhlPGJyPg0KJm5ic3A7ICZuYnNwO2dyb3VwLiZuYnNw OyBJbiBzdWNoIGEgY2FzZSwgdGhlIGpvaW5pbmcgbm9kZSBNQVkgYXNrIGZvciB0aGF0IGluZm9y bWF0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO3RvIHRoZSBLREMgaW4gdGhpcyBzYW1lIHJlcXVlc3Qu Jm5ic3A7IFRvIHRoaXMgZW5kLCBpdCBzZW5kcyB0aGUgQ29BUCBQT1NUPGJyPg0KJm5ic3A7ICZu YnNwO3JlcXVlc3QgdG8gdGhlIC9hdXRoei1pbmZvIGVuZHBvaW50IHVzaW5nIHRoZSBDb250ZW50 LUZvcm1hdDxicj4NCiZuYnNwOyAmbmJzcDsmcXVvdDthcHBsaWNhdGlvbi9hY2UmIzQzO2Nib3Im cXVvdDsgZGVmaW5lZCBpbiBTZWN0aW9uIDguMTQgb2Y8YnI+DQombmJzcDsgJm5ic3A7W0ktRC5p ZXRmLWFjZS1vYXV0aC1hdXRoel0sIGFuZCBpbmNsdWRlcyBhbHNvIHRoZSBmb2xsb3dpbmc8YnI+ DQombmJzcDsgJm5ic3A7cGFyYW1ldGVyczo8YnI+DQo8YnI+DQombHQ7bWdsdCZndDs8YnI+DQpU aGF0IHRoZSBDbGllbnQgTUFZIGFzayBmb3IgdGhpcyBpbmZvcm1hdGlvbiBzdWdnZXN0cyB0aGF0 IHRoaXMgaXMgbm90PGJyPg0KbmVjZXNzYXJ5LiBJdCB3b3VsZCBtYXliZSB3b3J0aCBpbmRpY2F0 aW5nIHdoZW4gdGhlc2UgaW5mb3JtYXRpb24gYXJlIG5vdDxicj4NCnJlcXVlc3RlZC4gSSBzZWUg dHdvIGNhc2VzIDEpIHdoZW4gcHVibGljIGtleSBpcyBub3QgaW52b2x2ZWQsIGFuZCAyKTxicj4N CndoZW4gdGhpcyBpcyBwcmUtY29uZmlndXJlZCBvciBwcm92aWRlZCBieSBvdGhlciBtZWFucy4g PGJyPg0KPGJyPg0KSSBhbSBub3Qgc3VyZSB0aGVzZSBjYXNlcyBtYWtlIHNlbnNlcywgYnV0IGlu IHRoZSBsYXRlc3QgY2FzZXMsIGl0IHdvdWxkPGJyPg0KYmUgZ29vZCB0byBzcGVjaWZ5IHdoeSB3 ZSBkbyBub3QgZW5kIHVwIGluIGEgZGVhZCBsb2NrLjxicj4NCjxicj4NClB1YmxpYyBrZXkgaXMg YXNzb2NpYXRlZCB3aXRoIGF1dGhlbnRpY2F0aW9uLiBJIHVuZGVyc3RhbmQgdGhhdCB0aGU8YnI+ DQphdXRoZW50aWNhdGlvbiBpcyBuZWNlc3NhcnkgdG8gdGhlIFJTIHJhdGhlciB0aGFuIHRoZSBn cm91cCBtZW1iZXJzLiBJZjxicj4NCnRoYXQgaXMgY29ycmVjdCwgSSBiZWxpZXZlIHRoYXQgc3Bl Y2lmeWluZyB0aGUgZW50aXR5IGFzc29jaWF0ZWQgdG8gdGhlPGJyPg0KcHVibGljIGtleSAtIGhl cmUgdGhlIFJTIC0gd291bGQgYmUgY2xlYXJlci4gPGJyPg0KPGJyPg0KJmx0Oy9tZ2x0Jmd0Ozxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogVGhlIGZpcnN0IHNlbnRlbmNlIGluIHRoZSBwYXJh Z3JhcGggaXMgbWVhbnQgdG8gaW5kaWNhdGUgd2hlbiB0aGVzZSBpbmZvcm1hdGlvbiBhcmUgcmVx dWVzdGVkLiBXZSBkbyB3YW50IHRvIGtlZXAgdGhpcyBhcyBnZW5lcmFsIGFzIHBvc3NpYmxlIGJl Y2F1c2Ugd2UgbWlnaHQgbm90IGtub3cgd2hhdCB0aGUgYXBwbGljYXRpb24gcHJvZmlsZXMgd2ls bCBuZWVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHBvaW50IGlz IHRoYXQgZXZlbiBpZiB0aGlzIGluZm9ybWF0aW9uIGlzIG5vdCBzZW50IGhlcmUgaW4gdGhpcyB0 b2tlbiBQT1NULCBpdCBjYW4gYmUgcmV0cmlldmVkIGluIHRoZSBmb2xsb3dpbmcgZXhjaGFuZ2Uu IEFuZCBhYm91dCB0aGUgcHVibGljIGtleSwgbm8gdGhhdCB3b3VsZCBiZSB0aGUgcHVibGljIGtl eXMgb2YgdGhlIGdyb3VwIG1lbWJlcnMuIFRoaXMgaXMgZ2VuZXJhbCBpbmZvcm1hdGlvbg0KIG9m IGVuY29kaW5nIG9mIHB1YmxpYyBrZXlzLCBub3QgdGhlIHB1YmxpYyBrZXlzIHRoZW1zZWx2ZXMu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7byAmbmJzcDsnc2lnbl9pbmZvJyBkZWZpbmVkIGluIFNlY3Rpb24gMy4zLjEsIGVuY29k aW5nIHRoZSBDQk9SIHNpbXBsZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHZhbHVlIE51bGws IHRvIHJlcXVpcmUgaW5mb3JtYXRpb24gYW5kIHBhcmFtZXRlcnMgb24gdGhlIHNpZ25hdHVyZTxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGFsZ29yaXRobSBhbmQgb24gdGhlIHB1YmxpYyBrZXlz IHVzZWQgaW4gdGhlIGdyb3VwLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwOydwdWJf a2V5X2VuYycgZGVmaW5lZCBpbiBTZWN0aW9uIDMuMy4yLCBlbmNvZGluZyB0aGUgQ0JPUiBzaW1w bGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB2YWx1ZSBOdWxsLCB0byByZXF1aXJlIGluZm9y bWF0aW9uIG9uIHRoZSBleGFjdCBlbmNvZGluZyBvZiBwdWJsaWM8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyBrZXlzIHVzZWQgaW4gdGhlIGdyb3VwLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtU aGUgQ0RETCBub3RhdGlvbiBvZiB0aGUgJ3NpZ25faW5mbycgYW5kICdwdWJfa2V5X2VuYycgcGFy YW1ldGVyczxicj4NCiZuYnNwOyAmbmJzcDtmb3JtYXR0ZWQgYXMgaW4gdGhlIHJlcXVlc3QgaXMg Z2l2ZW4gYmVsb3cuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgc2lnbl9pbmZvX3Jl cSA9IG5pbDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHB1Yl9rZXlfZW5jX3JlcSA9 IG5pbDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtBbHRlcm5hdGl2ZWx5LCB0aGUgam9pbmluZyBu b2RlIG1heSByZXRyaWV2ZSB0aGlzIGluZm9ybWF0aW9uIGJ5PGJyPg0KJm5ic3A7ICZuYnNwO290 aGVyIG1lYW5zLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtBZnRlciBzdWNjZXNzZnVsIHZlcmlm aWNhdGlvbiwgdGhlIENsaWVudCBpcyBhdXRob3JpemVkIHRvIHJlY2VpdmU8YnI+DQombmJzcDsg Jm5ic3A7dGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCBmcm9tIHRoZSBLREMgYW5kIGpvaW4gdGhl IGdyb3VwLiZuYnNwOyBJbjxicj4NCiZuYnNwOyAmbmJzcDtwYXJ0aWN1bGFyLCB0aGUgS0RDIHJl cGxpZXMgdG8gdGhlIENsaWVudCB3aXRoIGEgMi4wMSAoQ3JlYXRlZCk8YnI+DQombmJzcDsgJm5i c3A7cmVzcG9uc2UsIHVzaW5nIENvbnRlbnQtRm9ybWF0ICZxdW90O2FwcGxpY2F0aW9uL2FjZSYj NDM7Y2JvciZxdW90OyBkZWZpbmVkIGluPGJyPg0KJm5ic3A7ICZuYnNwO1NlY3Rpb24gOC4xNCBv ZiBbSS1ELmlldGYtYWNlLW9hdXRoLWF1dGh6XS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhl IHBheWxvYWQgb2YgdGhlIDIuMDEgcmVzcG9uc2UgaXMgYSBDQk9SIG1hcCwgd2hpY2ggTVVTVCBp bmNsdWRlIGE8YnI+DQombmJzcDsgJm5ic3A7bm9uY2UgTiBnZW5lcmF0ZWQgYnkgdGhlIEtEQy4m bmJzcDsgVGhlIENsaWVudCBtYXkgdXNlIHRoaXMgbm9uY2UgZm9yPGJyPg0KJm5ic3A7ICZuYnNw O3Byb3ZpbmcgdGhlIHBvc3Nlc3Npb24gb2YgaXRzIG93biBwcml2YXRlIGtleSAoc2VlIHRoZTxi cj4NCiZuYnNwOyAmbmJzcDsnY2xpZW50X2NyZWRfdmVyaWZ5JyBwYXJhbWV0ZXIgaW4gU2VjdGlv biA0KS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7T3B0aW9uYWxseSwgaWYgdGhleSB3ZXJlIGlu Y2x1ZGVkIGluIHRoZSByZXF1ZXN0LCB0aGUgQVMgTUFZIGluY2x1ZGU8YnI+DQombmJzcDsgJm5i c3A7dGhlICdzaWduX2luZm8nIHBhcmFtZXRlciBhcyB3ZWxsIGFzIHRoZSAncHViX2tleV9lbmMn IHBhcmFtZXRlcjxicj4NCiZuYnNwOyAmbmJzcDtkZWZpbmVkIGluIFNlY3Rpb24gMy4zLjEgYW5k IFNlY3Rpb24gMy4zLjIgb2YgdGhpcyBzcGVjaWZpY2F0aW9uLDxicj4NCiZuYnNwOyAmbmJzcDty ZXNwZWN0aXZlbHkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSAnc2lnbl9pbmZvJyBwYXJh bWV0ZXIgTVVTVCBiZSBwcmVzZW50IGlmIHRoZSBQT1NUIHJlcXVlc3Q8YnI+DQombmJzcDsgJm5i c3A7aW5jbHVkZWQgdGhlICdzaWduX2luZm8nIHBhcmFtZXRlciB3aXRoIHZhbHVlIE51bGwuJm5i c3A7IElmIHByZXNlbnQsIHRoZTxicj4NCiZuYnNwOyAmbmJzcDsnc2lnbl9pbmZvJyBwYXJhbWV0 ZXIgb2YgdGhlIDIuMDEgKENyZWF0ZWQpIHJlc3BvbnNlIGlzIGEgQ0JPUiBhcnJheTxicj4NCiZu YnNwOyAmbmJzcDtmb3JtYXR0ZWQgYXMgZm9sbG93cy48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQ YWxvbWJpbmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFy eSA2LCAyMDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDtbUGFnZSA5XTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92 aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVs eSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7VGhlIGZpcnN0IGVs ZW1lbnQgJ3NpZ25fYWxnJyBpcyBhbiBpbnRlZ2VyIG9yIGEgdGV4dCBzdHJpbmcsPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgaW5kaWNhdGluZyB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB1c2Vk IGluIHRoZSBncm91cC4mbmJzcDsgSXQgaXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyByZXF1 aXJlZCBvZiB0aGUgYXBwbGljYXRpb24gcHJvZmlsZXMgdG8gZGVmaW5lIHNwZWNpZmljIHZhbHVl cyBmb3I8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aGlzIHBhcmFtZXRlci48YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7byAmbmJzcDtUaGUgc2Vjb25kIGVsZW1lbnQgJ3NpZ25fcGFyYW1ldGVy cycgaW5kaWNhdGVzIHRoZSBwYXJhbWV0ZXJzIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg dGhlIHNpZ25hdHVyZSBhbGdvcml0aG0uJm5ic3A7IEl0cyBzdHJ1Y3R1cmUgZGVwZW5kcyBvbiB0 aGUgdmFsdWUgb2Y8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAnc2lnbl9hbGcnLiZuYnNwOyBJ dCBpcyByZXF1aXJlZCBvZiB0aGUgYXBwbGljYXRpb24gcHJvZmlsZXMgdG8gZGVmaW5lPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgc3BlY2lmaWMgdmFsdWVzIGZvciB0aGlzIHBhcmFtZXRlci4m bmJzcDsgSWYgbm8gcGFyYW1ldGVycyBvZiB0aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBz aWduYXR1cmUgYWxnb3JpdGhtIGFyZSBzcGVjaWZpZWQsICdzaWduX3BhcmFtZXRlcnMnIE1VU1Qg YmU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBlbmNvZGluZyB0aGUgQ0JPUiBzaW1wbGUgdmFs dWUgTnVsbC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtUaGUgdGhpcmQgZWxlbWVu dCAnc2lnbl9rZXlfcGFyYW1ldGVycycgaW5kaWNhdGVzIHRoZSBwYXJhbWV0ZXJzPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgb2YgdGhlIGtleSB1c2VkIHdpdGggdGhlIHNpZ25hdHVyZSBhbGdv cml0aG0uJm5ic3A7IEl0cyBzdHJ1Y3R1cmU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBkZXBl bmRzIG9uIHRoZSB2YWx1ZSBvZiAnc2lnbl9hbGcnLiZuYnNwOyBJdCBpcyByZXF1aXJlZCBvZiB0 aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhcHBsaWNhdGlvbiBwcm9maWxlcyB0byBkZWZp bmUgc3BlY2lmaWMgdmFsdWVzIGZvciB0aGlzIHBhcmFtZXRlci48YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyBJZiBubyBwYXJhbWV0ZXJzIG9mIHRoZSBrZXkgdXNlZCB3aXRoIHRoZSBzaWduYXR1 cmUgYWxnb3JpdGhtIGFyZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHNwZWNpZmllZCwgJ3Np Z25fa2V5X3BhcmFtZXRlcnMnIE1VU1QgYmUgZW5jb2RpbmcgdGhlIENCT1Igc2ltcGxlPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgdmFsdWUgTnVsbC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 VGhlICdwdWJfa2V5X2VuYycgcGFyYW1ldGVyIE1VU1QgYmUgcHJlc2VudCBpZiB0aGUgUE9TVCBy ZXF1ZXN0PGJyPg0KJm5ic3A7ICZuYnNwO2luY2x1ZGVkIHRoZSAncHViX2tleV9lbmMnIHBhcmFt ZXRlciB3aXRoIHZhbHVlIE51bGwuJm5ic3A7IElmIHByZXNlbnQsPGJyPg0KJm5ic3A7ICZuYnNw O3RoZSAncHViX2tleV9lbmMnIHBhcmFtZXRlciBvZiB0aGUgMi4wMSAoQ3JlYXRlZCkgcmVzcG9u c2UgaXMgYSBDQk9SPGJyPg0KJm5ic3A7ICZuYnNwO2ludGVnZXIsIGluZGljYXRpbmcgdGhlIGVu Y29kaW5nIG9mIHB1YmxpYyBrZXlzIHVzZWQgaW4gdGhlIGdyb3VwLjxicj4NCiZuYnNwOyAmbmJz cDtUaGUgdmFsdWVzIG9mIHRoaXMgZmllbGQgYXJlIHJlZ2lzdGVyZWQgaW4gdGhlICZxdW90O0FD RSBQdWJsaWMgS2V5PGJyPg0KJm5ic3A7ICZuYnNwO0VuY29kaW5nJnF1b3Q7IFJlZ2lzdHJ5LCBk ZWZpbmVkIGluIFNlY3Rpb24gMTEuMi4mbmJzcDsgSXQgaXMgcmVxdWlyZWQgb2YgdGhlPGJyPg0K Jm5ic3A7ICZuYnNwO2FwcGxpY2F0aW9uIHByb2ZpbGVzIHRvIGRlZmluZSBzcGVjaWZpYyB2YWx1 ZXMgdG8gdXNlIGZvciB0aGlzPGJyPg0KJm5ic3A7ICZuYnNwO3BhcmFtZXRlci48YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7VGhlIENEREwgbm90YXRpb24gb2YgdGhlICdzaWduX2luZm8nIGFuZCAn cHViX2tleV9lbmMnIHBhcmFtZXRlcnM8YnI+DQombmJzcDsgJm5ic3A7Zm9ybWF0dGVkIGFzIGlu IHRoZSByZXNwb25zZSBpcyBnaXZlbiBiZWxvdy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyBzaWduX2luZm9fcmVzID0gWzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBz aWduX2FsZyA6IGludCAvIHRzdHIsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHNp Z25fcGFyYW1ldGVycyA6IGFueSAvIG5pbCw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgc2lnbl9rZXlfcGFyYW1ldGVycyA6IGFueSAvIG5pbDxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IF08YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBwdWJfa2V5X2VuY19yZXMgPSBp bnQ8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7Tm90ZSB0aGF0IHRoZSBDQk9SIG1hcCBzcGVjaWZp ZWQgYXMgcGF5bG9hZCBvZiB0aGUgMi4wMSAoQ3JlYXRlZCk8YnI+DQombmJzcDsgJm5ic3A7cmVz cG9uc2UgbWF5IGluY2x1ZGUgZnVydGhlciBwYXJhbWV0ZXJzLCBlLmcuIGFjY29yZGluZyB0byB0 aGU8YnI+DQombmJzcDsgJm5ic3A7c2lnbmFsbGVkIHRyYW5zcG9ydCBwcm9maWxlIG9mIEFDRS48 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7Tm90ZSB0aGF0IHRoaXMgc3RlcCBjb3VsZCBiZSBtZXJn ZWQgd2l0aCB0aGUgZm9sbG93aW5nIG1lc3NhZ2UgZnJvbTxicj4NCiZuYnNwOyAmbmJzcDt0aGUg Q2xpZW50IHRvIHRoZSBLREMsIG5hbWVseSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QuPGJyPg0K PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJz cDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMTBdPGJyPg0KPGJyPg0KSW50 ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlv biAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQozLjMuMS4g Jm5ic3A7J3NpZ25faW5mbycgUGFyYW1ldGVyPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSAn c2lnbl9pbmZvJyBwYXJhbWV0ZXIgaXMgYW4gT1BUSU9OQUwgcGFyYW1ldGVyIG9mIHRoZSBBUyBS ZXF1ZXN0PGJyPg0KJm5ic3A7ICZuYnNwO0NyZWF0aW9uIEhpbnRzIG1lc3NhZ2UgZGVmaW5lZCBp biBTZWN0aW9uIDUuMS4yLiBvZjxicj4NCiZuYnNwOyAmbmJzcDtbSS1ELmlldGYtYWNlLW9hdXRo LWF1dGh6XS4mbmJzcDsgVGhpcyBwYXJhbWV0ZXIgY29udGFpbnMgaW5mb3JtYXRpb24gYW5kPGJy Pg0KJm5ic3A7ICZuYnNwO3BhcmFtZXRlcnMgYWJvdXQgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0g YW5kIHRoZSBwdWJsaWMga2V5cyB0byBiZTxicj4NCiZuYnNwOyAmbmJzcDt1c2VkIGJldHdlZW4g dGhlIENsaWVudCBhbmQgdGhlIFJTLiZuYnNwOyBJdHMgZXhhY3QgY29udGVudCBpcyBhcHBsaWNh dGlvbjxicj4NCiZuYnNwOyAmbmJzcDtzcGVjaWZpYy48YnI+DQo8YnI+DQozLjMuMi4gJm5ic3A7 J3B1Yl9rZXlfZW5jJyBQYXJhbWV0ZXI8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlICdwdWJf a2V5X2VuYycgcGFyYW1ldGVyIGlzIGFuIE9QVElPTkFMIHBhcmFtZXRlciBvZiB0aGUgQVM8YnI+ DQombmJzcDsgJm5ic3A7UmVxdWVzdCBDcmVhdGlvbiBIaW50cyBtZXNzYWdlIGRlZmluZWQgaW4g U2VjdGlvbiA1LjEuMi4gb2Y8YnI+DQombmJzcDsgJm5ic3A7W0ktRC5pZXRmLWFjZS1vYXV0aC1h dXRoel0uJm5ic3A7IFRoaXMgcGFyYW1ldGVyIGNvbnRhaW5zIGluZm9ybWF0aW9uPGJyPg0KJm5i c3A7ICZuYnNwO2Fib3V0IHRoZSBleGFjdCBlbmNvZGluZyBvZiBwdWJsaWMga2V5cyB0byBiZSB1 c2VkIGJldHdlZW4gdGhlIENsaWVudDxicj4NCiZuYnNwOyAmbmJzcDthbmQgdGhlIFJTLiZuYnNw OyBJdHMgZXhhY3QgY29udGVudCBpcyBhcHBsaWNhdGlvbiBzcGVjaWZpYy48YnI+DQo8YnI+DQo0 LiZuYnNwOyBLZXkgRGlzdHJpYnV0aW9uPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMgc2Vj dGlvbiBkZWZpbmVzIGhvdyB0aGUga2V5aW5nIG1hdGVyaWFsIHVzZWQgZm9yIGdyb3VwPGJyPg0K Jm5ic3A7ICZuYnNwO2NvbW11bmljYXRpb24gaXMgZGlzdHJpYnV0ZWQgZnJvbSB0aGUgS0RDIHRv IHRoZSBDbGllbnQsIHdoZW4gam9pbmluZzxicj4NCiZuYnNwOyAmbmJzcDt0aGUgZ3JvdXAgYXMg YSBuZXcgbWVtYmVyLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtJZiBub3QgcHJldmlvdXNseSBl c3RhYmxpc2hlZCwgdGhlIENsaWVudCBhbmQgdGhlIEtEQyBNVVNUIGZpcnN0PGJyPg0KJm5ic3A7 ICZuYnNwO2VzdGFibGlzaCBhIHBhaXJ3aXNlIHNlY3VyZSBjb21tdW5pY2F0aW9uIGNoYW5uZWwg dXNpbmcgQUNFLiA8YnI+DQo8YnI+DQombHQ7bWdsdCZndDs8YnI+DQpJIGhhdmUgdGhlIGltcHJl c3Npb24gdGhhdCBzdWNoIGFncmVlbWVudCBpcyBwZXJmb3JtZWQgZHVyaW5nIHRoZTxicj4NCnJl Z2lzdHJhdGlvbiByZXF1ZXN0IC8gcmVzb3Buc2Ugd2l0aCB0aGUgQVMuIElzIHRoYXQgY29ycmVj dCBvciBhcmUgd2U8YnI+DQpjb25zaWRlcmluZyBhbm90aGVyIGV4Y2hhbmdlID8gPGJyPg0KJmx0 Oy9tZ2x0Jmd0OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogSSBhbSBub3Qgc3VyZSBJIHVu ZGVyc3RhbmQgdGhpcyBxdWVzdGlvbi4gV2hhdCBhZ3JlZW1lbnQ/IElmIHlvdSBtZWFuIHRoZSBL REMtY2xpZW50IHNlY3VyZSBjaGFubmVsLCB0aGVuIG5vLCB0aGF0IGlzIGRvbmUgaW5kZXBlbmRl bnRseS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NClRo ZTxicj4NCiZuYnNwOyAmbmJzcDtleGNoYW5nZSBvZiBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3Qt UmVzcG9uc2UgTVVTVCBvY2N1ciBvdmVyIHRoYXQ8YnI+DQombmJzcDsgJm5ic3A7c2VjdXJlIGNo YW5uZWwuJm5ic3A7IFRoZSBDbGllbnQgYW5kIHRoZSBLREMgTUFZIHVzZSB0aGF0IHNhbWUgc2Vj dXJlPGJyPg0KJm5ic3A7ICZuYnNwO2NoYW5uZWwgdG8gcHJvdGVjdCBmdXJ0aGVyIHBhaXJ3aXNl IGNvbW11bmljYXRpb25zLCB0aGF0IE1VU1QgYmU8YnI+DQombmJzcDsgJm5ic3A7c2VjdXJlZC4u PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0R1cmluZyB0aGlzIGV4Y2hhbmdlLCB0aGUgQ2xpZW50 IHNlbmRzIGEgcmVxdWVzdCB0byB0aGUgQVMsPGJyPg0KJm5ic3A7ICZuYnNwO3NwZWNpZnlpbmcg dGhlIGdyb3VwIGl0IHdpc2hlcyB0byBqb2luIChzZWUgU2VjdGlvbiA0LjEpLiZuYnNwOyBUaGVu LCB0aGU8YnI+DQombmJzcDsgJm5ic3A7S0RDIHZlcmlmaWVzIHRoZSBhY2Nlc3MgdG9rZW4gYW5k IHRoYXQgdGhlIENsaWVudCBpcyBhdXRob3JpemVkIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2pvaW4g dGhhdCBncm91cDsgaWYgc28sIGl0IHByb3ZpZGVzIHRoZSBDbGllbnQgd2l0aCB0aGUga2V5aW5n PGJyPg0KJm5ic3A7ICZuYnNwO21hdGVyaWFsIHRvIHNlY3VyZWx5IGNvbW11bmljYXRlIHdpdGgg dGhlIG1lbWJlciBvZiB0aGUgZ3JvdXAgKHNlZTxicj4NCiZuYnNwOyAmbmJzcDtTZWN0aW9uIDQu MikuJm5ic3A7IFRoZSBDb250ZW50LUZvcm1hdCB1c2VkIGluIHRoZSBtZXNzYWdlcyBpcyBzZXQg dG88YnI+DQombmJzcDsgJm5ic3A7YXBwbGljYXRpb24vY2Jvci48YnI+DQo8YnI+DQombHQ7bWds dCZndDs8YnI+DQpJIGJlbGlldmUgdGhlIHBhcmFncmFwaCBhYm92ZSBkZXNjcmliZXMgaG93IHRo ZSBzZWN1cmUgY2hhbm5lbCBpczxicj4NCmVzdGFibGlzaGVkIGJldHdlZW4gdGhlIENsaWVudCBh bmQgdGhlIEtEQy4gSWYgdGhhdCBpcyBjb3JyZWN0IHRoYXQgbWF5PGJyPg0KYmUgbWVudGlvbiBl eHBsaWNpdGx5LiBJIHdvdWxkIHN1Z2dlc3QgdG8gcmVwbGFjZSAmcXVvdDtEdXJpbmcgdGhpcyBl eGNoYW5nZSZxdW90Ozxicj4NCmJ5ICZxdW90O0R1cmluZyB0aGUgQXV0aG9yaXphdGlvbiByZXF1 ZXN0L3Jlc3BvbnMgZSBleGNoYW5nZSZxdW90Oy4gPGJyPg0KPGJyPg0KJmx0Oy9tZ2x0Jmd0Ozxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GUDogTm8sIHRoZSBwYXJhZ3JhcGggYWJvdmUgZGVzY3Jp YmVzIGhvdyB0aGUgY2xpZW50IGdldHMgdGhlIGtleWluZyBtYXRlcmlhbCB0byBoYXZlIHNlY3Vy ZSBncm91cCBjb21tdW5pY2F0aW9uLiDigJxUaGlzIGV4Y2hhbmdl4oCdIGRvZXMgbm90IHJlZmVy IHRvIOKAnGF1dGhvcml6YXRpb24gcmVxdWVzdC9yZXNwb25zZSBleGNoYW5nZeKAnSBidXQg4oCc am9pbmluZyB0aGUgZ3JvdXDigJ0gZXhjaGFuZ2UsIGkuZS4g4oCca2V5IGRpc3RyaWJ1dGlvbg0K IHJlcXVlc3QtcmVzcG9uc2UgZXhjaGFuZ2XigJ0uIFRoaXMgaXMgYSBoaWdoIGxldmVsIG92ZXJ2 aWV3IG9mIHdoYXQgaXMgZGVmaW5lZCBiZWxvdy4gV2UgdHJpZWQgdG8gY2xhcmlmeSBpbiBvdXIg dXBkYXRlOiDigJxEdXJpbmcgdGhlIGZpcnN0IGV4Y2hhbmdlICjigJxqb2luaW5n4oCdKSDigKbi gJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtGaWd1cmUgNCBnaXZlcyBhbiBvdmVydmlldyBvZiB0aGUgZXhjaGFuZ2UgZGVzY3Jp YmVkIGFib3ZlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtD bGllbnQgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBLREM8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8LS0tLSBLZXkgRGlz dHJpYnV0aW9uIFJlcXVlc3Q6IFBPU1QgL2dyb3VwLWlkIC0tLSZndDt8PGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCZsdDstLS0gS2V5IERpc3RyaWJ1dGlvbiBS ZXNwb25zZTogMi4wMSAoQ3JlYXRlZCkgLS0tfDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 RmlndXJlIDQ6IE1lc3NhZ2UgRmxvdyBvZiBLZXkgRGlzdHJpYnV0aW9uIHRvIGEgTmV3IEdyb3Vw IE1lbWJlcjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5i c3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDExXTxicj4NCjxicj4NCklu dGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRp b24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO1RoZSBzYW1lIHNldCBvZiBtZXNzYWdlIGNhbiBhbHNvIGJlIHVzZWQgZm9yIHRoZSBm b2xsb3dpbmcgY2FzZXMsPGJyPg0KJm5ic3A7ICZuYnNwO3doZW4gdGhlIENsaWVudCBpcyBhbHJl YWR5IGEgZ3JvdXAgbWVtYmVyOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1RoZSBD bGllbnQgd2lzaGVzIHRvIChyZS0pZ2V0IHRoZSBjdXJyZW50IGtleWluZyBtYXRlcmlhbCwgZm9y PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgY2FzZXMgc3VjaCBhcyBleHBpcmF0aW9uLCBsb3Nz IG9yIHN1c3BlY3RlZCBtaXNtYXRjaCwgZHVlIHRvIGUuZy48YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyByZWJvb3Qgb3IgbWlzc2VkIGdyb3VwIHJla2V5aW5nLiZuYnNwOyBUaGlzIGlzIGZ1cnRo ZXIgZGlzY3Vzc2VkIGluPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgU2VjdGlvbiA2Ljxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1RoZSBDbGllbnQgd2lzaGVzIHRvIChyZS0pZ2V0 IHRoZSBwdWJsaWMga2V5cyBvZiBvdGhlciBncm91cDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 IG1lbWJlcnMsIGUuZy4gaWYgaXQgaXMgYXdhcmUgb2YgbmV3IG5vZGVzIGpvaW5pbmcgdGhlIGdy b3VwIGFmdGVyPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgaXRzZWxmLiZuYnNwOyBUaGlzIGlz IGZ1cnRoZXIgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 QWRkaXRpb25hbGx5LCB0aGUgZm9ybWF0IG9mIHRoZSBwYXlsb2FkIG9mIHRoZSBLZXkgRGlzdHJp YnV0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO1Jlc3BvbnNlIChTZWN0aW9uIDQuMikgY2FuIGJlIHJl dXNlZCBmb3IgbWVzc2FnZXMgc2VudCBieSB0aGUgS0RDIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2Rp c3RyaWJ1dGUgdXBkYXRlZCBncm91cCBrZXlpbmcgbWF0ZXJpYWwsIGluIGNhc2Ugb2YgYSBuZXcg bm9kZTxicj4NCiZuYnNwOyAmbmJzcDtqb2luaW5nIHRoZSBncm91cCBvciBvZiBhIGN1cnJlbnQg bWVtYmVyIGxlYXZpbmcgdGhlIGdyb3VwLiZuYnNwOyBUaGUga2V5PGJyPg0KJm5ic3A7ICZuYnNw O21hbmFnZW1lbnQgc2NoZW1lIHVzZWQgdG8gc2VuZCBzdWNoIG1lc3NhZ2VzIGNvdWxkIHJlbHkg b24sIGUuZy4sPGJyPg0KJm5ic3A7ICZuYnNwO211bHRpY2FzdCBpbiBjYXNlIG9mIGEgbmV3IG5v ZGUgam9pbmluZyBvciB1bmljYXN0IGluIGNhc2Ugb2YgYSBub2RlPGJyPg0KJm5ic3A7ICZuYnNw O2xlYXZpbmcgdGhlIGdyb3VwLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtOb3RlIHRoYXQgcHJv b2Ytb2YtcG9zc2Vzc2lvbiB0byBiaW5kIHRoZSBhY2Nlc3MgdG9rZW4gdG8gdGhlIENsaWVudDxi cj4NCiZuYnNwOyAmbmJzcDtpcyBwZXJmb3JtZWQgYnkgdXNpbmcgdGhlIHByb29mLW9mLXBvc3Nl c3Npb24ga2V5IGJvdW5kIHRvIHRoZSBhY2Nlc3M8YnI+DQombmJzcDsgJm5ic3A7dG9rZW4gZm9y IGVzdGFibGlzaGluZyBzZWN1cmUgY29tbXVuaWNhdGlvbiBiZXR3ZWVuIHRoZSBDbGllbnQgYW5k PGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBLREMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0lmIHRo ZSBhcHBsaWNhdGlvbiByZXF1aXJlcyBiYWNrd2FyZCBzZWN1cml0eSwgdGhlIEtEQyBTSEFMTCBn ZW5lcmF0ZTxicj4NCiZuYnNwOyAmbmJzcDtuZXcgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIGFuZCBz ZWN1cmVseSBkaXN0cmlidXRlIGl0IHRvIGFsbCB0aGU8YnI+DQombmJzcDsgJm5ic3A7Y3VycmVu dCBncm91cCBtZW1iZXJzLCB1c2luZyB0aGUgbWVzc2FnZSBmb3JtYXQgZGVmaW5lZCBpbiB0aGlz PGJyPg0KJm5ic3A7ICZuYnNwO3NlY3Rpb24uJm5ic3A7IEFwcGxpY2F0aW9uIHByb2ZpbGVzIG1h eSBkZWZpbmUgYWx0ZXJuYXRpdmUgbWVzc2FnZTxicj4NCiZuYnNwOyAmbmJzcDtmb3JtYXRzLjxi cj4NCjxicj4NCiZsdDttZ2x0Jmd0Ozxicj4NCkkgYW0gd29uZGVyaW5nIHdoeSBTSEFMTCBpcyBp bnRyb2R1Y2VkIGhlcmUgYXMgTVVTVCBoYXMgYmVlbiB1c2VkPGJyPg0KdGhyb3VnaG91dCB0aGUg ZG9jdW1lbnQuLiBJIGRvIG5vdCBzZWUgYW55IGRpZmZlcmVuY2UgYmV0d2VlbiBTSEFMTCBhbmQ8 YnI+DQpNVVNULCBzbyBpZiB0aGF0IGlzIGNvcnJlY3QsIEkgd291bGQgcmVjb21tZW5kIHRvIHVz ZSBNVVNUIHRocm91Z2hvdXQ8YnI+DQp0aGUgZG9jdW1lbnQuIDxicj4NCiZsdDsvbWdsdCZndDs8 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZQOiBTSEFM TCBhbmQgTVVTVCBhcmUgc3lub255bXMsIHdoaWNoIGlzIHdoeSB3ZSBkaWQgbm90IHBheSBtdWNo IGF0dGVudGlvbiB0byB3aGF0IHdhcyBiZWluZyB1c2VkLiBCdXQgd2Ugd2VudCBhaGVhZCBhbmQg Y2hhbmdlIHRvIE1VU1QgaWYgeW91IHRoaW5rIGl04oCZcyBiZXR0ZXIvbW9yZSBjb25zaXN0ZW50 LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KNC4xLiZuYnNwOyBL ZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3Q8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIENsaWVu dCBzZW5kcyBhIEtleSBEaXN0cmlidXRpb24gUmVxdWVzdCB0byB0aGUgS0RDLiZuYnNwOyBUaGlz PGJyPg0KJm5ic3A7ICZuYnNwO2NvcnJlc3BvbmRzIHRvIGEgQ29BUCBQT1NUIHJlcXVlc3QgdG8g dGhlIGVuZHBvaW50IGluIHRoZSBLREM8YnI+DQombmJzcDsgJm5ic3A7YXNzb2NpYXRlZCB0byB0 aGUgZ3JvdXAgdG8gam9pbi4mbmJzcDsgVGhlIGVuZHBvaW50IGluIHRoZSBLREMgaXM8YnI+DQom bmJzcDsgJm5ic3A7YXNzb2NpYXRlZCB0byB0aGUgJ3Njb3BlJyB2YWx1ZSBvZiB0aGUgQXV0aG9y aXphdGlvbiBSZXF1ZXN0Lzxicj4NCiZuYnNwOyAmbmJzcDtSZXNwb25zZS4mbmJzcDsgVGhlIHBh eWxvYWQgb2YgdGhpcyByZXF1ZXN0IGlzIGEgQ0JPUiBtYXAgd2hpY2ggTVVTVDxicj4NCiZuYnNw OyAmbmJzcDtjb250YWluIHRoZSBmb2xsb3dpbmcgZmllbGRzOjxicj4NCjxicj4NCiZuYnNwOyAm bmJzcDtvICZuYnNwOyd0eXBlJywgZW5jb2RlZCBhcyBhIENCT1IgaW50LCB3aXRoIHZhbHVlIDEg KCZxdW90O2tleSBkaXN0cmlidXRpb24mcXVvdDspLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtB ZGRpdGlvbmFsbHksIHRoZSBDQk9SIG1hcCBpbiB0aGUgcGF5bG9hZCBNQVkgY29udGFpbiB0aGUg Zm9sbG93aW5nPGJyPg0KJm5ic3A7ICZuYnNwO2ZpZWxkcywgd2hpY2gsIGlmIGluY2x1ZGVkLCBN VVNUIGhhdmUgdGhlIGNvcnJlc3BvbmRpbmcgdmFsdWVzOjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtvICZuYnNwOydzY29wZScsIHdpdGggdmFsdWUgdGhlIHNwZWNpZmljIHJlc291cmNlIHRoYXQg dGhlIENsaWVudCBpczxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGF1dGhvcml6ZWQgdG8gYWNj ZXNzIChpLmUuIGdyb3VwIG9yIHRvcGljIGlkZW50aWZpZXIpIGFuZCByb2xlKHMpLDxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IGVuY29kZWQgYXMgaW4gU2VjdGlvbiAzLjEuPGJyPg0KPGJyPg0K PGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBF eHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMTJdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7 S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZu YnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsnZ2V0 X3B1Yl9rZXlzJywgaWYgdGhlIENsaWVudCB3aXNoZXMgdG8gcmVjZWl2ZSB0aGUgcHVibGljIGtl eXMgb2Y8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aGUgb3RoZXIgbm9kZXMgaW4gdGhlIGdy b3VwIGZyb20gdGhlIEtEQy4mbmJzcDsgVGhlIHZhbHVlIGlzIGFuIGVtcHR5PGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgQ0JPUiBhcnJheS4mbmJzcDsgVGhpcyBwYXJhbWV0ZXIgbWF5IGJlIHBy ZXNlbnQgaWYgdGhlIEtEQyBzdG9yZXMgdGhlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcHVi bGljIGtleXMgb2YgdGhlIG5vZGVzIGluIHRoZSBncm91cCBhbmQgZGlzdHJpYnV0ZXMgdGhlbSB0 byB0aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBDbGllbnQ7IGl0IGlzIHVzZWxlc3MgdG8g aGF2ZSBoZXJlIGlmIHRoZSBzZXQgb2YgcHVibGljIGtleXMgb2Y8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyB0aGUgbWVtYmVycyBvZiB0aGUgZ3JvdXAgaXMga25vd24gaW4gYW5vdGhlciB3YXks IGUuZy4gaXQgd2FzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcHJvdmlkZWQgYnkgdGhlIEFT Ljxicj4NCjxicj4NCiZsdDttZ2x0Jmd0Ozxicj4NCkZvciBsYXJnZSBncm91cHMsIHRoZXJlIG1p Z2h0IGJlIGEgbmVlZCB0byBsaW1pdCB0aGUgc2l6ZSBvZiB0aGU8YnI+DQpyZXNwb25zZSBhbmQg c28gdG8gZW5hYmxlIHRoYXQgdGhlIGJhdGNoIG9mIGtleXMgYmUgcmV0cmlldmVkIGluPGJyPg0K bXVsdGlwbGUgZXhjaGFuZ2VzIG9yIHZpYSBhbm90aGVyIHJlZGlyZWN0aW9uIG1lY2hhbmlzbS48 YnI+DQombHQ7L21nbHQmZ3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZQOiBHb29kIHBvaW50 LiBBbHRob3VnaCBzb21lIGNvbW11bmljYXRpb24gcHJvdG9jb2xzIGhhdmUgd2F5cyBvZiDigJxz cGxpdHRpbmcgdGhlIG1lc3NhZ2XigJ0gaWYgdG9vIGJpZyAoc2VlIEJsb2Nrd2lzZSBmb3IgQ29B UCksIHdlIGhhdmUgbm93IGFkZGVkIGEgd2F5IHRvIHJldHJpZXZlIGtleXMgYmFzZWQgb24gaWRl bnRpZmllcnMuIEluIHByYWN0aWNlLCBhIG5vZGUgbWF5IG5vdCBhc2sgZm9yIGFsbCBrZXlzDQog YW5kIG9ubHkgYXNrIGZvciB0aGUga2V5cyBpdCBuZWVkcyB3aGVuIGl0IG5lZWRzIHRoZW0uPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7byAmbmJzcDsnY2xpZW50X2NyZWQnLCB3aXRoIHZhbHVlIHRoZSBwdWJsaWMga2V5IG9yIGNl cnRpZmljYXRlIG9mIHRoZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IENsaWVudCwgZW5jb2Rl ZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcuJm5ic3A7IElmIHRoZSBLREMgaXMgbWFuYWdpbmc8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyAoY29sbGVjdGluZyBmcm9tL2Rpc3RyaWJ1dGluZyB0byB0 aGUgQ2xpZW50KSB0aGUgcHVibGljIGtleXMgb2Y8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0 aGUgZ3JvdXAgbWVtYmVycywgdGhpcyBmaWVsZCBjb250YWlucyB0aGUgcHVibGljIGtleSBvZiB0 aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBDbGllbnQuJm5ic3A7IFRoZSBkZWZhdWx0IGVu Y29kaW5nIGZvciBwdWJsaWMga2V5cyBpcyBDT1NFIEtleXMuPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgQWx0ZXJuYXRpdmUgc3BlY2lmaWMgZW5jb2RpbmdzIG9mIHRoaXMgcGFyYW1ldGVyIE1B WSBiZSBkZWZpbmVkIGluPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgYXBwbGljYXRpb25zIG9m IHRoaXMgc3BlY2lmaWNhdGlvbi48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsnY2xp ZW50X2NyZWRfdmVyaWZ5JywgZW5jb2RlZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcuJm5ic3A7IFRo aXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBwYXJhbWV0ZXIgY29udGFpbnMgYSBzaWduYXR1 cmUgY29tcHV0ZWQgYnkgdGhlIENsaWVudCBvdmVyIHRoZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IG5vbmNlIE4gcmVjZWl2ZWQgZnJvbSB0aGUgS0RDIGluIHRoZSAyLjAxIChDcmVhdGVkKSBy ZXNwb25zZSB0bzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHRoZSB0b2tlbiBQT1NUIHJlcXVl c3QgKHNlZSBTZWN0aW9uIDMuMykuJm5ic3A7IFRoZSBDbGllbnQgY29tcHV0ZXMgdGhlPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgc2lnbmF0dXJlIGJ5IHVzaW5nIGl0cyBvd24gcHJpdmF0ZSBr ZXksIHdob3NlIGNvcnJlc3BvbmRpbmcgcHVibGljPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg a2V5IGlzIGVpdGhlciBkaXJlY3RseSBzcGVjaWZpZWQgaW4gdGhlICdjbGllbnRfY3JlZCcgcGFy YW1ldGVyIG9yPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgaW5jbHVkZWQgaW4gdGhlIGNlcnRp ZmljYXRlIHNwZWNpZmllZCBpbiB0aGUgJ2NsaWVudF9jcmVkJzxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IHBhcmFtZXRlci4mbmJzcDsgVGhpcyBwYXJhbWV0ZXIgTVVTVCBiZSBwcmVzZW50IGlm IHRoZSAnY2xpZW50X2NyZWQnPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcGFyYW1ldGVyIGlz IHByZXNlbnQuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J3B1Yl9rZXlzX3JlcG9z JywgY2FuIGJlIHByZXNlbnQgaWYgYSBjZXJ0aWZpY2F0ZSBpcyBwcmVzZW50IGluPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgdGhlICdjbGllbnRfY3JlZCcgZmllbGQsIHdpdGggdmFsdWUgYSBs aXN0IG9mIHB1YmxpYyBrZXk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyByZXBvc2l0b3JpZXMg c3RvcmluZyB0aGUgY2VydGlmaWNhdGUgb2YgdGhlIENsaWVudC4mbmJzcDsgVGhpczxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IHBhcmFtZXRlciBpcyBlbmNvZGVkIGFzIGEgQ0JPUiBhcnJheSBv ZiBDQk9SIHRleHQgc3RyaW5ncywgZWFjaCBvZjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHdo aWNoIHNwZWNpZmllcyB0aGUgVVJJIG9mIGEga2V5IHJlcG9zaXRvcnkuPGJyPg0KPGJyPg0KNC4y LiZuYnNwOyBLZXkgRGlzdHJpYnV0aW9uIFJlc3BvbnNlPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O1RoZSBLREMgdmVyaWZpZXMgdGhhdCB0aGUgJ3Njb3BlJyByZWNlaXZlZCBpbiB0aGUgS2V5IERp c3RyaWJ1dGlvbjxicj4NCiZuYnNwOyAmbmJzcDtSZXF1ZXN0LCBpZiBwcmVzZW50LCBpcyBhIHN1 YnNldCBvZiB0aGUgJ3Njb3BlJyBzdG9yZWQgaW4gdGhlIGFjY2Vzczxicj4NCiZuYnNwOyAmbmJz cDt0b2tlbiBhc3NvY2lhdGVkIHRvIHRoaXMgY2xpZW50LiZuYnNwOyBJZiB2ZXJpZmljYXRpb24g ZmFpbHMsIHRoZSBLREMgTVVTVDxicj4NCiZuYnNwOyAmbmJzcDtyZXNwb25kIHdpdGggYSA0LjAx IChVbmF1dGhvcml6ZWQpIGVycm9yIG1lc3NhZ2UuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0lm IHRoZSBLZXkgRGlzdHJpYnV0aW9uIFJlcXVlc3QgaXMgbm90IGZvcm1hdHRlZCBjb3JyZWN0bHkg KGUuZy4gbm88YnI+DQombmJzcDsgJm5ic3A7J3Njb3BlJyBmaWVsZCBwcmVzZW50IHdoaWxlIGV4 cGVjdGVkLCBvciB1bmtub3duIGZpZWxkcyBwcmVzZW50KSwgdGhlPGJyPg0KJm5ic3A7ICZuYnNw O0tEQyBNVVNUIHJlc3BvbmQgd2l0aCA0LjAwIChCYWQgUmVxdWVzdCkgZXJyb3IgbWVzc2FnZS48 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7SWYgdmVyaWZpY2F0aW9uIHN1Y2NlZWRzLCB0aGUgS0RD IHNlbmRzIGEgS2V5IERpc3RyaWJ1dGlvbiBzdWNjZXNzPGJyPg0KJm5ic3A7ICZuYnNwO1Jlc3Bv bnNlIHRvIHRoZSBDbGllbnQuJm5ic3A7IFRoZSBLZXkgRGlzdHJpYnV0aW9uIHN1Y2Nlc3MgUmVz cG9uc2U8YnI+DQombmJzcDsgJm5ic3A7Y29ycmVzcG9uZHMgdG8gYSAyLjAxIENyZWF0ZWQgbWVz c2FnZS4mbmJzcDsgVGhlIHBheWxvYWQgb2YgdGhpcyByZXNwb25zZTxicj4NCiZuYnNwOyAmbmJz cDtpcyBhIENCT1IgbWFwLCB3aGljaCBNVVNUIGNvbnRhaW46PGJyPg0KPGJyPg0KPGJyPg0KPGJy Pg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBp cmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgW1BhZ2UgMTNdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5 IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNw OyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsna3R5Jywg aWRlbnRpZnlpbmcgdGhlIGtleSB0eXBlIG9mIHRoZSAna2V5JyBwYXJhbWV0ZXIuJm5ic3A7IFRo ZSBzZXQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBvZiB2YWx1ZXMgY2FuIGJlIGZvdW5kIGlu IHRoZSAmcXVvdDtLZXkgVHlwZSZxdW90OyBjb2x1bW4gb2YgdGhlICZxdW90O0FDRTxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IEdyb3VwY29tbSBLZXkmcXVvdDsgUmVnaXN0cnkuJm5ic3A7IElt cGxlbWVudGF0aW9ucyBNVVNUIHZlcmlmeSB0aGF0IHRoZSBrZXk8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyB0eXBlIG1hdGNoZXMgdGhlIGFwcGxpY2F0aW9uIHByb2ZpbGUgYmVpbmcgdXNlZCwg aWYgcHJlc2VudCwgYXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyByZWdpc3RlcmVkIGluIHRo ZSAmcXVvdDtBQ0UgR3JvdXBjb21tIEtleSZxdW90OyByZWdpc3RyeS48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7byAmbmJzcDsna2V5JywgY29udGFpbmluZyB0aGUga2V5aW5nIG1hdGVyaWFsIGZv ciB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbiw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBvciBp bmZvcm1hdGlvbiByZXF1aXJlZCB0byBkZXJpdmUgaXQuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O1RoZSBleGFjdCBmb3JtYXQgb2YgdGhlICdrZXknIHZhbHVlIE1VU1QgYmUgZGVmaW5lZCBpbiBh cHBsaWNhdGlvbnM8YnI+DQombmJzcDsgJm5ic3A7b2YgdGhpcyBzcGVjaWZpY2F0aW9uLiZuYnNw OyBBZGRpdGlvbmFsbHksIGRvY3VtZW50cyBzcGVjaWZ5aW5nIHRoZSBrZXk8YnI+DQombmJzcDsg Jm5ic3A7Zm9ybWF0IE1VU1QgcmVnaXN0ZXIgaXQgaW4gdGhlICZxdW90O0FDRSBHcm91cGNvbW0g S2V5JnF1b3Q7IHJlZ2lzdHJ5LDxicj4NCiZuYnNwOyAmbmJzcDtpbmNsdWRpbmcgaXRzIG5hbWUs IHR5cGUgYW5kIGFwcGxpY2F0aW9uIHByb2ZpbGUgdG8gYmUgdXNlZCB3aXRoLCBhczxicj4NCiZu YnNwOyAmbmJzcDtkZWZpbmVkIGluIHRoZSAmcXVvdDtBQ0UgR3JvdXBjb21tIEtleSZxdW90OyBy ZWdpc3RyeSwgZGVmaW5lZCBpbiBTZWN0aW9uIDExLjUuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0t LSYjNDM7LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDt8IE5hbWUgJm5ic3A7ICZuYnNwOyB8IEtleSBUeXBlIFZhbHVlIHwgUHJvZmlsZSB8IERl c2NyaXB0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0tLS0tLS0t LSYjNDM7LS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tJiM0Mzs8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwO3wgUmVzZXJ2ZWQgfCAwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwg VGhpcyB2YWx1ZSBpcyByZXNlcnZlZCAmbmJzcDt8PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsm IzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLSYjNDM7LS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7RmlndXJlIDU6IEtleSBUeXBlIFZhbHVlczxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtPcHRpb25hbGx5LCB0aGUgS2V5IERpc3RyaWJ1dGlvbiBSZXNwb25zZSBNQVkgY29u dGFpbiB0aGUgZm9sbG93aW5nPGJyPg0KJm5ic3A7ICZuYnNwO3BhcmFtZXRlcnMsIHdoaWNoLCBp ZiBpbmNsdWRlZCwgTVVTVCBoYXZlIHRoZSBjb3JyZXNwb25kaW5nIHZhbHVlczo8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7byAmbmJzcDsncHJvZmlsZScsIHdpdGggdmFsdWUgYSBDQk9SIGludGVn ZXIgdGhhdCBNVVNUIGJlIHVzZWQgdG8gdW5pcXVlbHk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyBpZGVudGlmeSB0aGUgYXBwbGljYXRpb24gcHJvZmlsZSBmb3IgZ3JvdXAgY29tbXVuaWNhdGlv bi4mbmJzcDsgVGhlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgdmFsdWUgTVVTVCBiZSByZWdp c3RlcmVkIGluIHRoZSAmcXVvdDtBQ0UgR3JvdXBjb21tIFByb2ZpbGUmcXVvdDsgUmVnaXN0cnku PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J2V4cCcsIHdpdGggdmFsdWUgdGhlIGV4 cGlyYXRpb24gdGltZSBvZiB0aGUga2V5aW5nIG1hdGVyaWFsIGZvcjxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7IHRoZSBncm91cCBjb21tdW5pY2F0aW9uLCBlbmNvZGVkIGFzIGEgQ0JPUiB1bnNp Z25lZCBpbnRlZ2VyIG9yPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgZmxvYXRpbmctcG9pbnQg bnVtYmVyLiZuYnNwOyBUaGlzIGZpZWxkIGNvbnRhaW5zIGEgbnVtZXJpYyB2YWx1ZTxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IHJlcHJlc2VudGluZyB0aGUgbnVtYmVyIG9mIHNlY29uZHMgZnJv bSAxOTcwLTAxLTAxVDAwOjAwOjAwWiBVVEM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB1bnRp bCB0aGUgc3BlY2lmaWVkIFVUQyBkYXRlL3RpbWUsIGlnbm9yaW5nIGxlYXAgc2Vjb25kcyw8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhbmFsb2dvdXMgdG8gd2hhdCBzcGVjaWZpZWQgaW4gU2Vj dGlvbiAyIG9mIFtSRkM3NTE5XS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsncHVi X2tleXMnLCBtYXkgb25seSBiZSBwcmVzZW50IGlmICdnZXRfcHViX2tleXMnIHdhcyBwcmVzZW50 IGluPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIEtleSBEaXN0cmlidXRpb24gUmVxdWVz dC4mbmJzcDsgVGhpcyBwYXJhbWV0ZXIgaXMgYSBDQk9SIGJ5dGU8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyBzdHJpbmcsIHdoaWNoIGVuY29kZXMgdGhlIHB1YmxpYyBrZXlzIG9mIGFsbCB0aGUg Z3JvdXAgbWVtYmVyczxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHBhaXJlZCB3aXRoIHRoZSBy ZXNwZWN0aXZlIG1lbWJlciBpZGVudGlmaWVycy4mbmJzcDsgVGhlIGRlZmF1bHQ8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBlbmNvZGluZyBmb3IgcHVibGljIGtleXMgaXMgQ09TRSBLZXlzLCBz byB0aGUgZGVmYXVsdCBlbmNvZGluZyBmb3I8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAncHVi X2tleXMnIGlzIGEgQ0JPUiBieXRlIHN0cmluZyB3cmFwcGluZyBhIENPU0VfS2V5U2V0IChzZWU8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBbUkZDODE1Ml0pLCB3aGljaCBjb250YWlucyB0aGUg cHVibGljIGtleXMgb2YgYWxsIHRoZSBtZW1iZXJzIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsgdGhlIGdyb3VwLi4mbmJzcDsgSW4gcGFydGljdWxhciwgZWFjaCBDT1NFIEtleSBpbiB0aGUg Q09TRV9LZXlTZXQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBpbmNsdWRlcyB0aGUgaWRlbnRp ZmllciBvZiB0aGUgY29ycmVzcG9uZGluZyBncm91cCBtZW1iZXIgYXMgdmFsdWU8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBvZiBpdHMgJ2tpZCcga2V5IHBhcmFtZXRlci4mbmJzcDsgQWx0ZXJu YXRpdmUgc3BlY2lmaWMgZW5jb2RpbmdzIG9mPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0K UGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVh cnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgW1BhZ2UgMTRdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lv bmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIw MTk8YnI+DQo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aGlzIHBhcmFtZXRlciBN QVkgYmUgZGVmaW5lZCBpbiBhcHBsaWNhdGlvbnMgb2YgdGhpczxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IHNwZWNpZmljYXRpb24uPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J2dy b3VwX3BvbGljaWVzJywgd2l0aCB2YWx1ZSBhIENCT1IgbWFwLCB3aG9zZSBlbnRyaWVzIHNwZWNp ZnkgaG93PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIGdyb3VwIGhhbmRsZXMgc3BlY2lm aWMgbWFuYWdlbWVudCBhc3BlY3RzLiZuYnNwOyBUaGVzZSBpbmNsdWRlLCBmb3I8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBpbnN0YW5jZSwgYXBwcm9hY2hlcyB0byBhY2hpZXZlIHN5bmNocm9u aXphdGlvbiBvZiBzZXF1ZW5jZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IG51bWJlcnMgYW1v bmcgZ3JvdXAgbWVtYmVycy4mbmJzcDsgVGhlIGVsZW1lbnRzIG9mIHRoaXMgZmllbGQgYXJlPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcmVnaXN0ZXJlZCBpbiB0aGUgJnF1b3Q7QUNFIEdyb3Vw Y29tbSBQb2xpY3kmcXVvdDsgUmVnaXN0cnkuJm5ic3A7IFRoaXM8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyBzcGVjaWZpY2F0aW9uIGRlZmluZXMgdGhlIHR3byBlbGVtZW50cyAmcXVvdDtTZXF1 ZW5jZSBOdW1iZXI8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBTeW5jaHJvbml6YXRpb24gTWV0 aG9kJnF1b3Q7IGFuZCAmcXVvdDtLZXkgVXBkYXRlIENoZWNrIEludGVydmFsJnF1b3Q7LCB3aGlj aCBhcmU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBzdW1tYXJpemVkIGluIEZpZ3VyZSA2LiZu YnNwOyBBcHBsaWNhdGlvbiBwcm9maWxlcyB0aGF0IGJ1aWxkIG9uIHRoaXM8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyBkb2N1bWVudCBNVVNUIHNwZWNpZnkgdGhlIGV4YWN0IGNvbnRlbnQgZm9y bWF0IG9mIGluY2x1ZGVkIG1hcDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGVudHJpZXMuPGJy Pg0KPGJyPg0KJiM0MzstLS0tLS0tLS0tLS0tLS0tLSYjNDM7LS0tLS0tLSYjNDM7LS0tLS0tLS0t LXwtLS0tLS0tLS0tLS0tLS0tLS0tLXwtLS0tLS0tLS0tLS0mIzQzOzxicj4NCnwgJm5ic3A7ICZu YnNwOyAmbmJzcDtOYW1lICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgQ0JPUiAmbmJzcDt8ICZuYnNw OyBDQk9SICZuYnNwOyB8ICZuYnNwOyAmbmJzcDtEZXNjcmlwdGlvbiAmbmJzcDsgJm5ic3A7IHwg UmVmZXJlbmNlICZuYnNwO3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCBsYWJlbCB8ICZuYnNwOyB0eXBlICZuYnNwOyB8ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJy Pg0KfC0tLS0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tJiM0MzstLS0tLS0tLS0tfC0tLS0tLS0t LS0tLS0tLS0tLS0tfC0tLS0tLS0tLS0tLXw8YnI+DQp8IFNlcXVlbmNlIE51bWJlciB8IFRCRDEg Jm5ic3A7fCB0c3RyL2ludCB8IE1ldGhvZCBmb3IgYSByZS0gJm5ic3A7IHwgW1t0aGlzICZuYnNw OyAmbmJzcDsgfDxicj4NCnwgU3luY2hyb25pemF0aW9uIHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsg fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBjaXBpZW50IG5vZGUgdG8gJm5i c3A7ICZuYnNwO3wgZG9jdW1lbnRdXSB8PGJyPg0KfCBNZXRob2QgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7fCBzeW5jaHJvbml6ZSB3aXRoICZuYnNwOyB8ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCnwgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5i c3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgc2VxdWVuY2UgbnVtYmVy cyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+ DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDt8IG9mIGEgc2VuZGVyIG5vZGUuICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBJdHMgdmFsdWUgaXMgdGFrZW4gfCAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IGZyb20gdGhlICdW YWx1ZScgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8 PGJyPg0KfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7fCBjb2x1bW4gb2YgdGhlICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IFNlcXVlbmNlIE51bWJl ciAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw O3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDt8IFN5bmNocm9uaXphdGlvbiAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNw OyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IE1ldGhvZCByZWdpc3RyeSAm bmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8 YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDt8PGJyPg0KfCBLZXkgVXBkYXRlICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBUQkQyICZu YnNwO3wgJm5ic3A7IGludCAmbmJzcDsgJm5ic3A7fCBQb2xsaW5nIGludGVydmFsICZuYnNwOyB8 IFtbdGhpcyAmbmJzcDsgJm5ic3A7IHw8YnI+DQp8IENoZWNrIEludGVydmFsICZuYnNwO3wgJm5i c3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBp biBzZWNvbmRzLCB0byAmbmJzcDsgJm5ic3A7IHwgZG9jdW1lbnRdXSB8PGJyPg0KfCAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBjaGVj ayBmb3IgbmV3ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IGtleWluZyBtYXRlcmlhbCBhdCB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCnwgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgdGhlIEtEQyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KJiM0MzstLS0tLS0tLS0tLS0tLS0tLSYjNDM7 LS0tLS0tLSYjNDM7LS0tLS0tLS0tLXwtLS0tLS0tLS0tLS0tLS0tLS0tLXwtLS0tLS0tLS0tLS0m IzQzOzxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtGaWd1cmUgNjogQUNFIEdyb3VwY29t bSBQb2xpY2llczxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwOydtZ3Rfa2V5X21hdGVy aWFsJywgZW5jb2RlZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcgYW5kIGNvbnRhaW5pbmc8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyB0aGUgYWRtaW5pc3RyYXRpdmUga2V5aW5nIG1hdGVyaWFsIHRv IHBhcnRpY2lwYXRlIGluIHRoZSBncm91cDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHJla2V5 aW5nIHBlcmZvcm1lZCBieSB0aGUgS0RDLiZuYnNwOyBUaGUgZXhhY3QgZm9ybWF0IGFuZCBjb250 ZW50PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgZGVwZW5kIG9uIHRoZSBzcGVjaWZpYyByZWtl eWluZyBzY2hlbWUgdXNlZCBpbiB0aGUgZ3JvdXAsIHdoaWNoPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgbWF5IGJlIHNwZWNpZmllZCBpbiB0aGUgYXBwbGljYXRpb24gcHJvZmlsZS48YnI+DQo8 YnI+DQombmJzcDsgJm5ic3A7U3BlY2lmaWMgYXBwbGljYXRpb24gcHJvZmlsZXMgdGhhdCBidWls ZCBvbiB0aGlzIGRvY3VtZW50IG5lZWQgdG88YnI+DQombmJzcDsgJm5ic3A7c3BlY2lmeSBob3cg ZXhhY3RseSB0aGUga2V5aW5nIG1hdGVyaWFsIGlzIHVzZWQgdG8gcHJvdGVjdCB0aGUgZ3JvdXA8 YnI+DQombmJzcDsgJm5ic3A7Y29tbXVuaWNhdGlvbi48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQ YWxvbWJpbmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFy eSA2LCAyMDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyBbUGFnZSAxNV08YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9u aW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAx OTxicj4NCjxicj4NCjxicj4NCjUuJm5ic3A7IFJlbW92YWwgb2YgYSBOb2RlIGZyb20gdGhlIEdy b3VwPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMgc2VjdGlvbiBkZXNjcmliZXMgYXQgYSBo aWdoIGxldmVsIGhvdyBhIG5vZGUgY2FuIGJlIHJlbW92ZWQgZnJvbTxicj4NCiZuYnNwOyAmbmJz cDt0aGUgZ3JvdXAuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0lmIHRoZSBhcHBsaWNhdGlvbiBy ZXF1aXJlcyBmb3J3YXJkIHNlY3VyaXR5LCB0aGUgS0RDIFNIQUxMIGdlbmVyYXRlPGJyPg0KJm5i c3A7ICZuYnNwO25ldyBncm91cCBrZXlpbmcgbWF0ZXJpYWwgYW5kIHNlY3VyZWx5IGRpc3RyaWJ1 dGUgaXQgdG8gYWxsIHRoZTxicj4NCiZuYnNwOyAmbmJzcDtjdXJyZW50IGdyb3VwIG1lbWJlcnMg YnV0IHRoZSBsZWF2aW5nIG5vZGUsIHVzaW5nIHRoZSBtZXNzYWdlIGZvcm1hdDxicj4NCiZuYnNw OyAmbmJzcDtkZWZpbmVkIGluIFNlY3Rpb24gNC4yLiZuYnNwOyBBcHBsaWNhdGlvbiBwcm9maWxl cyBtYXkgZGVmaW5lIGFsdGVybmF0aXZlPGJyPg0KJm5ic3A7ICZuYnNwO21lc3NhZ2UgZm9ybWF0 cy48YnI+DQo8YnI+DQo1LjEuJm5ic3A7IEV4cGlyZWQgQXV0aG9yaXphdGlvbjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtJZiB0aGUgQVMgcHJvdmlkZXMgVG9rZW4gaW50cm9zcGVjdGlvbiAoc2Vl IFNlY3Rpb24gNS43IG9mPGJyPg0KJm5ic3A7ICZuYnNwO1tJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0 aHpdKSwgdGhlIEtEQyBjYW4gb3B0aW9uYWxseSB1c2UgYW5kIGNoZWNrPGJyPg0KJm5ic3A7ICZu YnNwO3doZXRoZXI6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7dGhlIG5vZGUgaXMg bm90IGF1dGhvcml6ZWQgYW55bW9yZTs8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDt0 aGUgYWNjZXNzIHRva2VuIGlzIHN0aWxsIHZhbGlkLCB1cG9uIGl0cyBleHBpcmF0aW9uLjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtFaXRoZXIgY2FzZSwgb25jZSBhd2FyZSB0aGF0IGEgbm9kZSBp cyBub3QgYXV0aG9yaXplZCBhbnltb3JlLCB0aGU8YnI+DQombmJzcDsgJm5ic3A7S0RDIGhhcyB0 byByZW1vdmUgdGhlIHVuYXV0aG9yaXplZCBub2RlIGZyb20gdGhlIGxpc3Qgb2YgZ3JvdXA8YnI+ DQombmJzcDsgJm5ic3A7bWVtYmVycywgaWYgdGhlIEtEQyBrZWVwcyB0cmFjayBvZiB0aGF0Ljxi cj4NCjxicj4NCjUuMi4mbmJzcDsgUmVxdWVzdCB0byBMZWF2ZSB0aGUgR3JvdXA8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7QSBub2RlIGNhbiBhY3RpdmVseSByZXF1ZXN0IHRvIGxlYXZlIHRoZSBn cm91cC4mbmJzcDsgSW4gdGhpcyBjYXNlLCB0aGU8YnI+DQombmJzcDsgJm5ic3A7Q2xpZW50IGNh biBzZW5kIGEgcmVxdWVzdCBmb3JtYXR0ZWQgYXMgZm9sbG93cyB0byB0aGUgS0RDLCB0byBhYmFu ZG9uPGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBncm91cC4mbmJzcDsgVGhlIGNsaWVudCBNVVNUIHVz ZSB0aGUgcHJvdGVjdGVkIGNoYW5uZWwgZXN0YWJsaXNoZWQ8YnI+DQombmJzcDsgJm5ic3A7d2l0 aCBBQ0UsIG1lbnRpb25lZCBpbiBTZWN0aW9uIDQuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1Rv IHJlcXVlc3QgdG8gbGVhdmUgYSBncm91cCwgdGhlIGNsaWVudCBNVVNUIHNlbmQgYSBDb0FQIFBP U1QgcmVxdWVzdDxicj4NCiZuYnNwOyAmbmJzcDt0byB0aGUgZW5kcG9pbnQgaW4gdGhlIEtEQyBh c3NvY2lhdGVkIHRvIHRoZSBncm91cCB0byBsZWF2ZSAoc2FtZTxicj4NCiZuYnNwOyAmbmJzcDtl bmRwb2ludCB1c2VkIGluIFNlY3Rpb24gNC4xIGZvciBLZXkgRGlzdHJpYnV0aW9uIHJlcXVlc3Rz KS4mbmJzcDsgVGhlPGJyPg0KJm5ic3A7ICZuYnNwO3BheWxvYWQgb2YgdGhpcyBMZWF2ZSBSZXF1 ZXN0IGlzIGEgQ0JPUiBtYXAgd2hpY2ggTVVTVCBjb250YWluOjxicj4NCjxicj4NCiZuYnNwOyAm bmJzcDtvICZuYnNwOyd0eXBlJywgZW5jb2RlZCBhcyBhIENCT1IgaW50LCB3aXRoIHZhbHVlIDIg KCZxdW90O2xlYXZlJnF1b3Q7KS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsnc2Nv cGUnLCB3aXRoIHZhbHVlIHRoZSBzcGVjaWZpYyByZXNvdXJjZSB0aGF0IHRoZSBDbGllbnQgaXM8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhdXRob3JpemVkIHRvIGFjY2VzcyAoaS5lLiBncm91 cCBvciB0b3BpYyBpZGVudGlmaWVyKSBhbmQgd2FudHMgdG88YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyBsZWF2ZSwgZW5jb2RlZCBhcyBpbiBTZWN0aW9uIDMuMS4mbmJzcDsgVGhlICdyb2xlJyBm aWVsZCBpcyBvbWl0dGVkLi48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7Tm90ZSB0aGF0IHRoZSAn cm9sZScgZmllbGQgaXMgb21pdHRlZCBzaW5jZSBzdWNoIGEgcmVxdWVzdCBzaG91bGQ8YnI+DQom bmJzcDsgJm5ic3A7b25seSBiZSB1c2VkIHRvIGxlYXZlIGEgZ3JvdXAgYWx0b2dldGhlci4mbmJz cDsgSWYgdGhlIGxlYXZpbmcgbm9kZSB3YW50czxicj4NCiZuYnNwOyAmbmJzcDt0byBiZSBwYXJ0 IG9mIGEgZ3JvdXAgd2l0aCBmZXdlciByb2xlcywgaXQgZG9lcyBub3QgbmVlZCB0bzxicj4NCiZu YnNwOyAmbmJzcDtjb21tdW5pY2F0ZSB0aGF0IHRvIHRoZSBLREMsIGFuZCBjYW4gc2ltcGx5IHN0 b3AgYWN0aW5nIGFjY29yZGluZyB0bzxicj4NCiZuYnNwOyAmbmJzcDtzdWNoIHJvbGVzLjxicj4N Cjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAm bmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDE2XTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0 ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZu YnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0lmIHRo ZSBMZWF2ZSBSZXF1ZXN0IGlzIHN1Y2ggdGhhdCB0aGUgS0RDIGNhbm5vdCBleHRyYWN0IGFsbCB0 aGU8YnI+DQombmJzcDsgJm5ic3A7bmVjZXNzYXJ5IGluZm9ybWF0aW9uIHRvIHVuZGVyc3RhbmQg YW5kIHByb2Nlc3MgaXQgY29ycmVjdGx5IChlLmcuIG5vPGJyPg0KJm5ic3A7ICZuYnNwOydzY29w ZScgZmllbGQgcHJlc2VudCksIHRoZSBLREMgTVVTVCByZXNwb25kIHdpdGggYSA0LjAwIChCYWQ8 YnI+DQombmJzcDsgJm5ic3A7UmVxdWVzdCkgZXJyb3IgbWVzc2FnZS4mbmJzcDsgT3RoZXJ3aXNl LCB0aGUgS0RDIE1VU1QgcmVtb3ZlIHRoZSBsZWF2aW5nPGJyPg0KJm5ic3A7ICZuYnNwO25vZGUg ZnJvbSB0aGUgbGlzdCBvZiBncm91cCBtZW1iZXJzLCBpZiB0aGUgS0RDIGtlZXBzIHRyYWNrIG9m IHRoYXQuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO05vdGUgdGhhdCwgYWZ0ZXIgaGF2aW5nIGxl ZnQgdGhlIGdyb3VwLCBhIG5vZGUgbWF5IHdpc2ggdG8gam9pbiBpdDxicj4NCiZuYnNwOyAmbmJz cDthZ2Fpbi4mbmJzcDsgVGhlbiwgYXMgbG9uZyBhcyB0aGUgbm9kZSBpcyBzdGlsbCBhdXRob3Jp emVkIHRvIGpvaW4gdGhlPGJyPg0KJm5ic3A7ICZuYnNwO2dyb3VwLCBpLmUuIGl0IGhhcyBhIHN0 aWxsIHZhbGlkIGFjY2VzcyB0b2tlbiwgaXQgY2FuIHJlLXJlcXVlc3QgdG88YnI+DQombmJzcDsg Jm5ic3A7am9pbiB0aGUgZ3JvdXAgZGlyZWN0bHkgdG8gdGhlIEtEQyB3aXRob3V0IG5lZWRpbmcg dG8gcmV0cmlldmUgYSBuZXc8YnI+DQombmJzcDsgJm5ic3A7YWNjZXNzIHRva2VuIGZyb20gdGhl IEFTLiZuYnNwOyBUaGlzIG1lYW5zIHRoYXQgdGhlIEtEQyBuZWVkcyB0byBrZWVwPGJyPg0KJm5i c3A7ICZuYnNwO3RyYWNrIG9mIG5vZGVzIHdpdGggdmFsaWQgYWNjZXNzIHRva2VucywgYmVmb3Jl IGRlbGV0aW5nIGFsbDxicj4NCiZuYnNwOyAmbmJzcDtpbmZvcm1hdGlvbiBhYm91dCB0aGUgbGVh dmluZyBub2RlLjxicj4NCjxicj4NCjYuJm5ic3A7IFJldHJpZXZhbCBvZiBOZXcgb3IgVXBkYXRl ZCBLZXlpbmcgTWF0ZXJpYWw8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7QSBub2RlIHN0b3BzIHVz aW5nIHRoZSBncm91cCBrZXlpbmcgbWF0ZXJpYWwgdXBvbiBpdHMgZXhwaXJhdGlvbiw8YnI+DQom bmJzcDsgJm5ic3A7YWNjb3JkaW5nIHRvIHRoZSAnZXhwJyBwYXJhbWV0ZXIgc3BlY2lmaWVkIGlu IHRoZSByZXRhaW5lZCBDT1NFIEtleS48YnI+DQombmJzcDsgJm5ic3A7VGhlbiwgaWYgaXQgd2Fu dHMgdG8gY29udGludWUgcGFydGljaXBhdGluZyBpbiB0aGUgZ3JvdXA8YnI+DQombmJzcDsgJm5i c3A7Y29tbXVuaWNhdGlvbiwgdGhlIG5vZGUgaGFzIHRvIHJlcXVlc3QgbmV3IHVwZGF0ZWQga2V5 aW5nIG1hdGVyaWFsIHRvPGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBLREMuJm5ic3A7IEluIHRoaXMg Y2FzZSwgYW5kIGRlcGVuZGluZyBvbiB3aGF0IHBhcnQgb2YgdGhlIGtleWluZzxicj4NCiZuYnNw OyAmbmJzcDttYXRlcmlhbCBpcyBleHBpcmVkLCB0aGUgY2xpZW50IG1heSBuZWVkIHRvIGNvbW11 bmljYXRlIHRvIHRoZSBLREM8YnI+DQombmJzcDsgJm5ic3A7aXRzIG5lZWQgZm9yIHRoYXQgcGFy dCB0byBiZSByZW5ld2VkOiBmb3IgZXhhbXBsZSwgaWYgdGhlIENsaWVudCB1c2VzPGJyPg0KJm5i c3A7ICZuYnNwO2FuIGluZGl2aWR1YWwga2V5IHRvIHByb3RlY3Qgb3V0Z29pbmcgdHJhZmZpYyBh bmQgaGFzIHRvIHJlbmV3IGl0LDxicj4NCiZuYnNwOyAmbmJzcDt0aGUgbm9kZSBtYXkgcmVxdWVz dCBhIG5ldyBvbmUsIG9yIG5ldyBpbnB1dCBtYXRlcmlhbCB0byBkZXJpdmUgaXQsPGJyPg0KJm5i c3A7ICZuYnNwO3dpdGhvdXQgcmVuZXdpbmcgdGhlIHdob2xlIGdyb3VwIGtleWluZyBtYXRlcmlh bC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIENsaWVudCBtYXkgcGVyZm9ybSB0aGUgc2Ft ZSByZXF1ZXN0IHRvIHRoZSBLREMgYWxzbyB1cG9uPGJyPg0KJm5ic3A7ICZuYnNwO3JlY2Vpdmlu ZyBtZXNzYWdlcyBmcm9tIG90aGVyIGdyb3VwIG1lbWJlcnMgd2l0aG91dCBiZWluZyBhYmxlIHRv PGJyPg0KJm5ic3A7ICZuYnNwO3JldHJpZXZlIHRoZSBtYXRlcmlhbCB0byBjb3JyZWN0bHkgZGVj cnlwdCB0aGVtLiZuYnNwOyBUaGlzIG1heSBiZSBkdWUgdG88YnI+DQombmJzcDsgJm5ic3A7YSBw cmV2aW91cyB1cGRhdGUgb2YgdGhlIGdyb3VwIGtleWluZyBtYXRlcmlhbCAocmVrZXlpbmcpIHRy aWdnZXJlZDxicj4NCiZuYnNwOyAmbmJzcDtieSB0aGUgS0RDLCB0aGF0IHRoZSBDbGllbnQgd2Fz IG5vdCBhYmxlIHRvIHJlY2VpdmUgb3IgZGVjcnlwdC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 Tm90ZSB0aGF0IHBvbGljaWVzIGNhbiBiZSBzZXQgdXAgc28gdGhhdCB0aGUgQ2xpZW50IHNlbmRz IGEgcmVxdWVzdDxicj4NCiZuYnNwOyAmbmJzcDt0byB0aGUgS0RDIG9ubHkgYWZ0ZXIgYSBnaXZl biBudW1iZXIgb2YgdW5zdWNjZXNzZnVsbHkgZGVjcnlwdGVkPGJyPg0KJm5ic3A7ICZuYnNwO2lu Y29taW5nIG1lc3NhZ2VzLiZuYnNwOyBJdCBpcyBhcHBsaWNhdGlvbiBkZXBlbmRlbnQgYW5kIHBl cnRhaW5pbmcgdG8gdGhlPGJyPg0KJm5ic3A7ICZuYnNwO3BhcnRpY3VsYXIgbWVzc2FnZSBleGNo YW5nZSAoZS5nLiAmbmJzcDtbSS1ELmlldGYtY29yZS1vc2NvcmUtZ3JvdXBjb21tXSk8YnI+DQom bmJzcDsgJm5ic3A7dG8gc2V0IHVwIHBvbGljaWVzIHRoYXQgaW5zdHJ1Y3QgY2xpZW50cyB0byBy ZXRhaW4gdW5zdWNjZXNzZnVsbHk8YnI+DQombmJzcDsgJm5ic3A7ZGVjcnlwdGVkIG1lc3NhZ2Vz IGFuZCBmb3IgaG93IGxvbmcsIHNvIHRoYXQgdGhleSBjYW4gYmUgZGVjcnlwdGVkPGJyPg0KJm5i c3A7ICZuYnNwO2FmdGVyIGdldHRpbmcgdXBkYXRlZCBrZXlpbmcgbWF0ZXJpYWwsIHJhdGhlciB0 aGFuIGp1c3QgY29uc2lkZXJlZDxicj4NCiZuYnNwOyAmbmJzcDtub24gdmFsaWQgbWVzc2FnZXMg dG8gZGlzY2FyZCByaWdodCBhd2F5Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgc2FtZSBy ZXF1ZXN0IGNvdWxkIGFsc28gYmUgc2VudCBieSB0aGUgY2xpZW50IHdpdGhvdXQgYmVpbmc8YnI+ DQombmJzcDsgJm5ic3A7dHJpZ2dlcmVkIGJ5IGEgZmFpbGVkIGRlY3J5cHRpb24gb2YgYSBtZXNz YWdlLCBpZiB0aGUgY2xpZW50IHdhbnRzIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2NvbmZpcm0gdGhh dCBpdCBoYXMgdGhlIGxhdGVzdCBncm91cCBrZXlpbmcgbWF0ZXJpYWwuJm5ic3A7IElmIHRoYXQg aXMgdGhlPGJyPg0KJm5ic3A7ICZuYnNwO2Nhc2UsIHRoZSBjbGllbnQgd2lsbCByZWNlaXZlIGZy b20gdGhlIEtEQyB0aGUgc2FtZSBncm91cCBrZXlpbmc8YnI+DQombmJzcDsgJm5ic3A7bWF0ZXJp YWwgaXQgaGFzIGluIG1lbW9yeS48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJp bmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAy MDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBbUGFn ZSAxN108YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9uaW5nIGZv ciBHcm91cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAxOTxicj4N Cjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtOb3RlIHRoYXQgdGhlIGRpZmZlcmVuY2UgYmV0d2Vl biB0aGUga2V5aW5nIG1hdGVyaWFsIHJlbmV3YWwgcmVxdWVzdDxicj4NCiZuYnNwOyAmbmJzcDth bmQgdGhlIGtleWluZyBtYXRlcmlhbCB1cGRhdGUgcmVxdWVzdCBpcyB0aGF0IHRoZSBmaXJzdCBv bmUgdHJpZ2dlcnM8YnI+DQombmJzcDsgJm5ic3A7dGhlIEtEQyB0byBwcm9kdWNlIG5ldyBrZXlp bmcgbWF0ZXJpYWwgZm9yIHRoYXQgbm9kZSwgd2hpbGUgdGhlPGJyPg0KJm5ic3A7ICZuYnNwO3Nl Y29uZCBvbmUgb25seSB0cmlnZ2VycyBkaXN0cmlidXRpb24gKHRoZSByZW5ld2FsIG1pZ2h0IGhh dmU8YnI+DQombmJzcDsgJm5ic3A7aGFwcGVuZWQgaW5kZXBlbmRlbnRseSwgYmVjYXVzZSBvZiBl eHBpcmF0aW9uKS4mbmJzcDsgT25jZSBhIG5vZGUgcmVjZWl2ZXM8YnI+DQombmJzcDsgJm5ic3A7 bmV3IGluZGl2aWR1YWwga2V5aW5nIG1hdGVyaWFsLCBvdGhlciBncm91cCBtZW1iZXJzIG1heSBu ZWVkIHRvIHVzZTxicj4NCiZuYnNwOyAmbmJzcDt0aGUgdXBkYXRlIGtleWluZyBtYXRlcmlhbCBy ZXF1ZXN0IHRvIHJldHJpZXZlIGl0Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtBbHRlcm5hdGl2 ZWx5LCB0aGUgcmUtZGlzdHJpYnV0aW9uIG9mIGtleWluZyBtYXRlcmlhbCBjYW4gYmU8YnI+DQom bmJzcDsgJm5ic3A7aW5pdGlhdGVkIGJ5IHRoZSBLREMsIHdoaWNoIGUuZy46PGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO28gJm5ic3A7Q2FuIG1haW50YWluIGFuIE9ic2VydmFibGUgcmVzb3VyY2Ug dG8gc2VuZCBub3RpZmljYXRpb25zIHRvPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgQ2xpZW50 cyB3aGVuIHRoZSBrZXlpbmcgbWF0ZXJpYWwgaXMgdXBkYXRlZC4mbmJzcDsgU3VjaCBhIG5vdGlm aWNhdGlvbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHdvdWxkIGhhdmUgdGhlIHNhbWUgcGF5 bG9hZCBhcyB0aGUgS2V5IFJlLURpc3RyaWJ1dGlvbiBSZXNwb25zZTxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7IGRlZmluZWQgaW4gU2VjdGlvbiA2LjIuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O28gJm5ic3A7Q2FuIHNlbmQgdGhlIHBheWxvYWQgb2YgdGhlIEtleSBSZS1EaXN0cmlidXRpb24g UmVzcG9uc2UgYXMgb25lIG9yPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgbXVsdGlwbGUgbXVs dGljYXN0IHJlcXVlc3RzIHRvIHRoZSBtZW1iZXJzIG9mIHRoZSBncm91cCwgdXNpbmc8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyBzZWN1cmUgcmVrZXlpbmcgc2NoZW1lcyBzdWNoIGFzIFtSRkMy MDkzXVtSRkMyMDk0XVtSRkMyNjI3XS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtD YW4gc2VuZCB1bmljYXN0IHJlcXVlc3RzIHRvIGVhY2ggQ2xpZW50IG92ZXIgYSBzZWN1cmUgY2hh bm5lbCw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB3aXRoIHRoZSBLZXkgUmUtRGlzdHJpYnV0 aW9uIFJlc3BvbnNlIGFzIHBheWxvYWQuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7 Q2FuIGFjdCBhcyBhIHB1Ymxpc2hlciBpbiBhIHB1Yi1zdWIgc2NlbmFyaW8sIGFuZCB1cGRhdGUg dGhlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsga2V5aW5nIG1hdGVyaWFsIGJ5IHB1Ymxpc2hp bmcgb24gYSBzcGVjaWZpYyB0b3BpYyBvbiBhIGJyb2tlciw8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyB3aGljaCBhbGwgdGhlIG1lbWJlcnMgb2YgdGhlIGdyb3VwIGFyZSBzdWJzY3JpYmVkIHRv Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtOb3RlIHRoYXQgdGhlc2UgbWV0aG9kcyBvZiBLREMt aW5pdGlhdGVkIGtleSByZS1kaXN0cmlidXRpb24gaGF2ZTxicj4NCiZuYnNwOyAmbmJzcDtkaWZm ZXJlbnQgc2VjdXJpdHkgcHJvcGVydGllcyBhbmQgcmVxdWlyZSBkaWZmZXJlbnQgc2VjdXJpdHk8 YnI+DQombmJzcDsgJm5ic3A7YXNzb2NpYXRpb25zLjxicj4NCjxicj4NCjYuMS4mbmJzcDsgS2V5 IFJlLURpc3RyaWJ1dGlvbiBSZXF1ZXN0PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RvIHJlcXVl c3QgYSByZS1kaXN0cmlidXRpb24gb2Yga2V5aW5nIG1hdGVyaWFsLCB0aGUgQ2xpZW50IHNlbmRz IGE8YnI+DQombmJzcDsgJm5ic3A7c2hvcnRlbmVkIEtleSBEaXN0cmlidXRpb24gUmVxdWVzdCB0 byB0aGUgS0RDIChTZWN0aW9uIDQuMSksPGJyPg0KJm5ic3A7ICZuYnNwO2Zvcm1hdHRlZCBhcyBm b2xsb3dzLiZuYnNwOyBUaGUgcGF5bG9hZCBNVVNUIGNvbnRhaW4gdGhlIGZvbGxvd2luZyBmaWVs ZHM6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7J3R5cGUnLCBlbmNvZGVkIGFzIGEg Q0JPUiBpbnQsIHdpdGggdmFsdWUgMyAoJnF1b3Q7dXBkYXRlIGtleSZxdW90OykgaWYgdGhlPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcmVxdWVzdCBpcyBpbnRlbmRlZCB0byByZXRyaWV2ZSB1 cGRhdGVkIGdyb3VwIGtleWluZyBtYXRlcmlhbCwgYW5kPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsgNCAoJnF1b3Q7bmV3JnF1b3Q7KSBpZiB0aGUgcmVxdWVzdCBpcyBpbnRlbmRlZCBmb3IgdGhl IEtEQyB0byBwcm9kdWNlIGFuZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHByb3ZpZGUgbmV3 IGluZGl2aWR1YWwga2V5aW5nIG1hdGVyaWFsIGZvciB0aGUgQ2xpZW50Ljxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDtvICZuYnNwOydzY29wZScsIHdoaWNoIGNvbnRhaW5zIG9ubHkgdGhlIGlkZW50 aWZpZXIgb2YgdGhlIHNwZWNpZmljIGdyb3VwPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgb3Ig dG9waWMsIGVuY29kZWQgYXMgaW4gU2VjdGlvbiAzLjEuJm5ic3A7IFRoYXQgaXMsIHRoZSByb2xl IGZpZWxkIGlzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgbm90IHByZXNlbnQuPGJyPg0KPGJy Pg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAm bmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMThdPGJyPg0KPGJyPg0K SW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNh dGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQo2LjIu Jm5ic3A7IEtleSBSZS1EaXN0cmlidXRpb24gUmVzcG9uc2U8YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7VGhlIEtEQyByZWNlaXZpbmcgYSBLZXkgUmUtRGlzdHJpYnV0aW9uIFJlcXVlc3QgTVVTVCBj aGVjayB0aGF0IGl0IGlzPGJyPg0KJm5ic3A7ICZuYnNwO3N0b3JpbmcgYSB2YWxpZCBhY2Nlc3Mg dG9rZW4gZnJvbSB0aGF0IGNsaWVudCBmb3IgdGhhdCBzY29wZS48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7SWYgdGhhdCBpcyBub3QgdGhlIGNhc2UsIGkuZS4gaXQgZG9lcyBub3Qgc3RvcmUgdGhl IHRva2VuIG9yIHRoZTxicj4NCiZuYnNwOyAmbmJzcDt0b2tlbiBpcyBub3QgdmFsaWQgZm9yIHRo YXQgY2xpZW50IGZvciB0aGUgc2NvcGUgcmVxdWVzdGVkLCB0aGUgS0RDPGJyPg0KJm5ic3A7ICZu YnNwO01VU1QgcmVzcG9uZCB3aXRoIGEgNC4wMSAoVW5hdXRob3JpemVkKSBlcnJvciBtZXNzYWdl LiZuYnNwOyBBbmFsb2dvdXNseTxicj4NCiZuYnNwOyAmbmJzcDt0byBTZWN0aW9uIDQuMiwgaWYg dGhlIEtleSBSZS1EaXN0cmlidXRpb24gUmVxdWVzdCBpcyBub3QgZm9ybWF0dGVkPGJyPg0KJm5i c3A7ICZuYnNwO2NvcnJlY3RseSAoZS5nLiBubyAnc2NvcGUnIGZpZWxkIHByZXNlbnQsIG9yIHVu a25vd24gZmllbGRzIHByZXNlbnQpLDxicj4NCiZuYnNwOyAmbmJzcDt0aGUgS0RDIE1VU1QgcmVz cG9uZCB3aXRoIGEgNC4wMCAoQmFkIFJlcXVlc3QpIGVycm9yIG1lc3NhZ2UuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO090aGVyd2lzZSwgdGhlIEtEQyByZXBsaWVzIHRvIHRoZSBDbGllbnQgd2l0 aCBhIEtleSBEaXN0cmlidXRpb248YnI+DQombmJzcDsgJm5ic3A7UmVzcG9uc2UsIHdoaWNoIE1V U1QgaW5jbHVkZSB0aGUgJ2t0eScsICdrZXknIGFuZCAnZXhwJyBwYXJhbWV0ZXJzPGJyPg0KJm5i c3A7ICZuYnNwO3NwZWNpZmllZCBpbiBTZWN0aW9uIDQuMi4mbmJzcDsgVGhlIEtleSBEaXN0cmli dXRpb24gUmVzcG9uc2UgTUFZIGFsc288YnI+DQombmJzcDsgJm5ic3A7aW5jbHVkZSB0aGUgJ3By b2ZpbGUnLCAnZ3JvdXBfcG9saWNpZXMnIGFuZCAnbWd0X2tleV9tYXRlcmlhbCc8YnI+DQombmJz cDsgJm5ic3A7cGFyYW1ldGVycyBzcGVjaWZpZWQgaW4gU2VjdGlvbiA0LjIuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO05vdGUgdGhhdCB0aGlzIHJlc3BvbnNlIG1pZ2h0IHNpbXBseSByZS1wcm92 aWRlIHRoZSBzYW1lIGtleWluZzxicj4NCiZuYnNwOyAmbmJzcDttYXRlcmlhbCBjdXJyZW50bHkg b3duZWQgYnkgdGhlIENsaWVudCwgaWYgaXQgaGFzIG5vdCBiZWVuIHJlbmV3ZWQuPGJyPg0KPGJy Pg0KNy4mbmJzcDsgUmV0cmlldmFsIG9mIFB1YmxpYyBLZXlzIGZvciBHcm91cCBNZW1iZXJzPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwO0luIGNhc2UgdGhlIEtEQyBtYWludGFpbnMgdGhlIHB1Ymxp YyBrZXlzIG9mIGdyb3VwIG1lbWJlcnMsIGEgbm9kZSBpbjxicj4NCiZuYnNwOyAmbmJzcDt0aGUg Z3JvdXAgY2FuIGNvbnRhY3QgdGhlIEtEQyB0byByZXF1ZXN0IHB1YmxpYyBrZXlzIG9mIGVpdGhl ciBhbGw8YnI+DQombmJzcDsgJm5ic3A7Z3JvdXAgbWVtYmVycyBvciBhIHNwZWNpZmllZCBzdWJz ZXQsIHVzaW5nIHRoZSBtZXNzYWdlcyBkZWZpbmVkPGJyPg0KJm5ic3A7ICZuYnNwO2JlbG93Ljxi cj4NCjxicj4NCiZuYnNwOyAmbmJzcDtGaWd1cmUgNyBnaXZlcyBhbiBvdmVydmlldyBvZiB0aGUg ZXhjaGFuZ2UgZGVzY3JpYmVkIGFib3ZlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IENsaWVudCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEtE Qzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fC0tLS0g UHVibGljIEtleSBSZXF1ZXN0OiBQT1NUIC9ncm91cC1pZCAtLS0mZ3Q7fDxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCZsdDstLS0gUHVibGljIEtleSBS ZXNwb25zZTogMi4wMSAoQ3JlYXRlZCkgLS0tfDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO3w8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwO0ZpZ3VyZSA3OiBNZXNzYWdlIEZsb3cgb2YgUHVibGljIEtleSBSZXF1ZXN0 LVJlc3BvbnNlPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO05vdGUgdGhhdCB0aGVzZSBtZXNzYWdl cyBjYW4gYmUgY29tYmluZWQgd2l0aCB0aGUgS2V5IFJlLURpc3RyaWJ1dGlvbjxicj4NCiZuYnNw OyAmbmJzcDttZXNzYWdlcyBpbiBTZWN0aW9uIDYsIHRvIHJlcXVlc3QgYXQgdGhlIHNhbWUgdGlt ZSB0aGUga2V5aW5nPGJyPg0KJm5ic3A7ICZuYnNwO21hdGVyaWFsIGFuZCB0aGUgcHVibGljIGtl eXMuJm5ic3A7IEluIHRoaXMgY2FzZSwgZWl0aGVyIGEgbmV3IGVuZHBvaW50IGF0PGJyPg0KJm5i c3A7ICZuYnNwO3RoZSBLREMgbWF5IGJlIHVzZWQsIG9yIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24g bmVlZHMgdG8gYmUgc2VudCBpbjxicj4NCiZuYnNwOyAmbmJzcDt0aGUgcmVxdWVzdCBwYXlsb2Fk LCB0byBkaXN0aW5ndWlzaCB0aGVzZSBjb21iaW5lZCBtZXNzYWdlcyBmcm9tIHRoZTxicj4NCiZu YnNwOyAmbmJzcDtQdWJsaWMgS2V5IG1lc3NhZ2VzIGRlc2NyaWJlZCBiZWxvdywgc2luY2UgdGhl eSB3b3VsZCBiZSBpZGVudGljYWw8YnI+DQombmJzcDsgJm5ic3A7b3RoZXJ3aXNlLjxicj4NCjxi cj4NCiZsdDttZ2x0Jmd0Ozxicj4NCkkgYW0gd29uZGVyaW5nIHdoeSBwdWJsaWMga2V5IGlzIG5l ZWRlZCBpbiBhIGNvbnRleHQgb2YgZ3JvdXA8YnI+DQpjb21tdW5pY2F0aW9uLiBJIGRvIG5vdCBl eHBlY3QgZ3JvdXAgbWVtYmVycyBidXQgb25seSBieSB0aGUgUlMuIDxicj4NCjxicj4NCkl0IGlz IHVuY2xlYXIgdG8gbWUgaG93IHRoZSA8YnI+DQombHQ7L21nbHQmZ3Q7PGJyPg0KPGJyPg0KRlA6 IFB1YmxpYyBrZXlzIGFyZSBuZWVkZWQgZm9yIHNvdXJjZSBhdXRoZW50aWNhdGlvbiBpbiBncm91 cCBjb21tdW5pY2F0aW9uLiBUaGUgc2VudGVuY2Ugd2FzIG5vdCBvdmVyLCBzbyBwbGVhc2UgbGV0 IHVzIGtub3cgaWYgeW91IGhhdmUgbW9yZSBpbnB1dCBvbiB3aGF0IHdhcyB5b3VyIGlkZWEgKGlm IHlvdSByZW1lbWJlcikuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRp bG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMTldPGJyPg0K PGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29t bXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+ DQo3LjEuJm5ic3A7IFB1YmxpYyBLZXkgUmVxdWVzdDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtU byByZXF1ZXN0IHB1YmxpYyBrZXlzLCB0aGUgQ2xpZW50IHNlbmRzIGEgc2hvcnRlbmVkIEtleSBE aXN0cmlidXRpb248YnI+DQombmJzcDsgJm5ic3A7UmVxdWVzdCB0byB0aGUgS0RDIChTZWN0aW9u IDQuMSksIGZvcm1hdHRlZCBhcyBmb2xsb3dzLiZuYnNwOyBUaGUgcGF5bG9hZDxicj4NCiZuYnNw OyAmbmJzcDtvZiB0aGlzIHJlcXVlc3QgTVVTVCBjb250YWluIHRoZSBmb2xsb3dpbmcgZmllbGRz Ojxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwOyd0eXBlJywgZW5jb2RlZCBhcyBhIENC T1IgaW50LCB3aXRoIHZhbHVlIDUgKCZxdW90O3B1YiBrZXlzJnF1b3Q7KS48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7byAmbmJzcDsnZ2V0X3B1Yl9rZXlzJywgd2hpY2ggaGFzIGFzIHZhbHVlIGEg Q0JPUiBhcnJheSBpbmNsdWRpbmcgZWl0aGVyOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7ICogJm5ic3A7bm8gZWxlbWVudHMsIGkuZS4gYW4gZW1wdHkgYXJyYXksIGluIG9yZGVyIHRv IHJlcXVlc3QgdGhlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3B1Ymxp YyBrZXkgb2YgYWxsIGN1cnJlbnQgZ3JvdXAgbWVtYmVyczsgb3I8YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAqICZuYnNwO04gZWxlbWVudHMsIGVhY2ggb2Ygd2hpY2ggaXMgdGhlIGlk ZW50aWZpZXIgb2YgYSBncm91cCBtZW1iZXI8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ZW5jb2RlZCBhcyBhIENCT1IgYnl0ZSBzdHJpbmcsIGluIG9yZGVyIHRvIHJlcXVl c3QgdGhlIHB1YmxpYzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtrZXkg b2YgdGhlIHNwZWNpZmllZCBub2Rlcy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsn c2NvcGUnLCB3aGljaCBjb250YWlucyBvbmx5IHRoZSBpZGVudGlmaWVyIG9mIHRoZSBzcGVjaWZp YyBncm91cDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IG9yIHRvcGljLCBlbmNvZGVkIGFzIGlu IFNlY3Rpb24gMy4xLiZuYnNwOyBUaGF0IGlzLCB0aGUgcm9sZSBmaWVsZCBpczxicj4NCiZuYnNw OyAmbmJzcDsgJm5ic3A7IG5vdCBwcmVzZW50Ljxicj4NCjxicj4NCjcuMi4mbmJzcDsgUHVibGlj IEtleSBSZXNwb25zZTxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgS0RDIHJlcGxpZXMgdG8g dGhlIENsaWVudCB3aXRoIGEgS2V5IERpc3RyaWJ1dGlvbiBSZXNwb25zZTxicj4NCiZuYnNwOyAm bmJzcDtjb250YWluaW5nIG9ubHkgdGhlICdwdWJfa2V5cycgcGFyYW1ldGVyLCBhcyBzcGVjaWZp ZWQgaW48YnI+DQombmJzcDsgJm5ic3A7U2VjdGlvbiA0LjIuJm5ic3A7IFRoZSBwYXlsb2FkIG9m IHRoaXMgcmVzcG9uc2UgY29udGFpbnMgdGhlIGZvbGxvd2luZzxicj4NCiZuYnNwOyAmbmJzcDtm aWVsZDo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDsncHViX2tleXMnLCB3aGljaCBj b250YWlucyBlaXRoZXI6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgKiAmbmJzcDt0 aGUgcHVibGljIGtleXMgb2YgYWxsIHRoZSBtZW1iZXJzIG9mIHRoZSBncm91cCwgaWYgdGhlPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOydnZXRfcHViX2tleXMnIHBhcmFt ZXRlciBvZiB0aGUgUHVibGljIEtleSByZXF1ZXN0IHdhcyBhbiBlbXB0eTxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDthcnJheTsgb3I8YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyAqICZuYnNwO3RoZSBwdWJsaWMga2V5cyBvZiB0aGUgZ3JvdXAgbWVtYmVycyB3 aXRoIHRoZSBpZGVudGlmaWVyczxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDtzcGVjaWZpZWQgaW4gdGhlICdnZXRfcHViX2tleXMnIHBhcmFtZXRlciBvZiB0aGUgUHVibGlj IEtleTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtyZXF1ZXN0Ljxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgS0RDIG1heSBlbmZvcmNlIG9uZSBvZiB0aGUgZm9sbG93 aW5nIHBvbGljaWVzLCBpbiBvcmRlciB0byBoYW5kbGU8YnI+DQombmJzcDsgJm5ic3A7cG9zc2li bGUgaWRlbnRpZmllcnMgdGhhdCBhcmUgaW5jbHVkZWQgaW4gdGhlICdnZXRfcHViX2tleXMnPGJy Pg0KJm5ic3A7ICZuYnNwO3BhcmFtZXRlciBvZiB0aGUgUHVibGljIEtleSByZXF1ZXN0IGJ1dCBh cmUgbm90IGFzc29jaWF0ZWQgdG8gYW55PGJyPg0KJm5ic3A7ICZuYnNwO2N1cnJlbnQgZ3JvdXAg bWVtYmVyLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1RoZSBLREMgc2lsZW50bHkg aWdub3JlcyB0aG9zZSBpZGVudGlmaWVycy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJz cDtUaGUgS0RDIHJldGFpbnMgcHVibGljIGtleXMgb2YgZ3JvdXAgbWVtYmVycyBmb3IgYSBnaXZl biBhbW91bnQgb2Y8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aW1lIGFmdGVyIHRoZWlyIGxl YXZpbmcsIGJlZm9yZSBkaXNjYXJkaW5nIHRoZW0uJm5ic3A7IEFzIGxvbmcgYXMgc3VjaDxicj4N Cjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZu YnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDIwXTxicj4NCjxicj4NCkludGVybmV0 LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5i c3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgcHVibGljIGtleXMgYXJlIHJldGFpbmVkLCB0aGUgS0RDIHByb3ZpZGVzIHRoZW0g dG8gYSByZXF1ZXN0aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgQ2xpZW50Ljxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDtFaXRoZXIgY2FzZSwgYSBub2RlIHRoYXQgaGFzIGxlZnQgdGhlIGdy b3VwIHNob3VsZCBub3QgZXhwZWN0IGFueSBvZjxicj4NCiZuYnNwOyAmbmJzcDtpdHMgb3V0Z29p bmcgbWVzc2FnZXMgdG8gYmUgc3VjY2Vzc2Z1bGx5IHByb2Nlc3NlZCwgaWYgcmVjZWl2ZWQgYWZ0 ZXI8YnI+DQombmJzcDsgJm5ic3A7aXRzIGxlYXZpbmcsIGR1ZSB0byBhIHBvc3NpYmxlIGdyb3Vw IHJla2V5aW5nIG9jY3VycmVkIGJlZm9yZSB0aGU8YnI+DQombmJzcDsgJm5ic3A7bWVzc2FnZSBy ZWNlcHRpb24uPGJyPg0KPGJyPg0KOC4mbmJzcDsgQUNFIEdyb3VwY29tbSBQYXJhbWV0ZXJzPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMgc3BlY2lmaWNhdGlvbiBkZWZpbmVzIGEgbnVtYmVy IG9mIGZpZWxkcyB1c2VkIGR1cmluZyB0aGUgbWVzc2FnZTxicj4NCiZuYnNwOyAmbmJzcDtleGNo YW5nZS4mbmJzcDsgVGhlIHRhYmxlIGJlbG93IHN1bW1hcml6ZXMgdGhlbSwgYW5kIHNwZWNpZmll cyB0aGUgQ0JPUjxicj4NCiZuYnNwOyAmbmJzcDtrZXkgdG8gdXNlIGluc3RlYWQgb2YgdGhlIGZ1 bGwgZGVzY3JpcHRpdmUgbmFtZS48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8 YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+ DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8 YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+ DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJpbmkgJmFtcDsgVGlsb2NhICZuYnNwOyAm bmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBbUGFnZSAyMV08YnI+DQo8YnI+DQpJbnRlcm5l dC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uICZu YnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAxOTxicj4NCjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0m IzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8IE5hbWUgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 IHwgQ0JPUiBLZXkgfCBDQk9SIFR5cGUgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNw OyYjNDM7LS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0tLSYj NDM7PGJyPg0KJm5ic3A7ICZuYnNwO3wgc2NvcGUgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 fCAmbmJzcDsgVEJEICZuYnNwOyAmbmJzcDt8IGFycmF5ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0t LS0mIzQzOy0tLS0tLS0tLS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNwO3wgZ2V0X3B1Yl9r ZXlzIHwgJm5ic3A7IFRCRCAmbmJzcDsgJm5ic3A7fCBhcnJheSAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0MzstLS0t LS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8IGNsaWVu dF9jcmVkICZuYnNwO3wgJm5ic3A7IFRCRCAmbmJzcDsgJm5ic3A7fCBieXRlIHN0cmluZyAmbmJz cDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0t JiM0MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8IGNsaWVudF9jcmVk XyB8ICZuYnNwOyBUQkQgJm5ic3A7ICZuYnNwO3wgYnl0ZSBzdHJpbmcgJm5ic3A7IHw8YnI+DQom bmJzcDsgJm5ic3A7fCB2ZXJpZnkgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0 MzstLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8 IHB1Yl9rZXlzXyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgVEJEICZuYnNwOyAmbmJzcDt8IGFycmF5 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwO3wgcmVwb3Mg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg fDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0 MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8IGt0eSAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgVEJEICZuYnNwOyAmbmJzcDt8IGludCAv IGJ5dGUgJm5ic3A7ICZuYnNwO3w8YnI+DQombmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDt8IHN0cmluZyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KJm5i c3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0t LS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNwO3wga2V5ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyBUQkQgJm5ic3A7ICZuYnNwO3wgc2VlICZxdW90O0FDRSAm bmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQombmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDt8IEdyb3VwY29tbSAmbmJzcDsgJm5ic3A7IHw8YnI+DQombmJzcDsgJm5ic3A7 fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IEtleSZxdW90OyBSZWdpc3RyeSB8PGJyPg0K Jm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0t LS0tLS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNwO3wgcHJvZmlsZSAmbmJzcDsgJm5ic3A7 ICZuYnNwO3wgJm5ic3A7IFRCRCAmbmJzcDsgJm5ic3A7fCBpbnQgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0m IzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNw O3wgZXhwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyBUQkQgJm5i c3A7ICZuYnNwO3wgaW50IC8gZmxvYXQgJm5ic3A7IHw8YnI+DQombmJzcDsgJm5ic3A7JiM0Mzst LS0tLS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0tLS0tLS0tJiM0Mzs8YnI+ DQombmJzcDsgJm5ic3A7fCBwdWJfa2V5cyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7IFRCRCAmbmJz cDsgJm5ic3A7fCBieXRlIHN0cmluZyAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0t LS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4N CiZuYnNwOyAmbmJzcDt8IGdyb3VwXyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyBUQkQg Jm5ic3A7ICZuYnNwO3wgbWFwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfDxi cj4NCiZuYnNwOyAmbmJzcDt8IHBvbGljaWVzICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tJiM0 MzstLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8 IG1ndF9rZXlfICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgVEJEICZuYnNwOyAmbmJzcDt8IGJ5dGUg c3RyaW5nICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwO3wgbWF0ZXJpYWwgJm5ic3A7ICZuYnNw OyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwOyYjNDM7 LS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0tLSYjNDM7PGJy Pg0KJm5ic3A7ICZuYnNwO3wgdHlwZSAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJz cDsgVEJEICZuYnNwOyAmbmJzcDt8IGludCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7IHw8YnI+DQombmJzcDsgJm5ic3A7JiM0MzstLS0tLS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0t LSYjNDM7LS0tLS0tLS0tLS0tLS0tJiM0Mzs8YnI+DQo8YnI+DQo5LiZuYnNwOyBBQ0UgR3JvdXBj b21tIFJlcXVlc3QgVHlwZTxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIHNwZWNpZmljYXRp b24gZGVmaW5lcyBhIG51bWJlciBvZiB0eXBlcyBvZiByZXF1ZXN0cy4mbmJzcDsgVGhlIHRhYmxl PGJyPg0KJm5ic3A7ICZuYnNwO2JlbG93IHN1bW1hcml6ZXMgdGhlbS48YnI+DQo8YnI+DQo8YnI+ DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJp bmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAy MDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBbUGFn ZSAyMl08YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9uaW5nIGZv ciBHcm91cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAxOTxicj4N Cjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7LS0t LS0tLS0tLSYjNDM7PGJyPg0KJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOyBOYW1lICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwO1ZhbHVlICZuYnNwOyB8PGJyPg0KJm5ic3A7 ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0Mzs8YnI+DQom bmJzcDsgJm5ic3A7fCBrZXkgZGlzdHJpYnV0aW9uIHwgJm5ic3A7ICZuYnNwOzEgJm5ic3A7ICZu YnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0tLS0tJiM0MzstLS0t LS0tLS0tJiM0Mzs8YnI+DQombmJzcDsgJm5ic3A7fCBsZWF2ZSAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZuYnNwOzIgJm5ic3A7ICZuYnNwOyB8PGJy Pg0KJm5ic3A7ICZuYnNwOyYjNDM7LS0tLS0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0 Mzs8YnI+DQombmJzcDsgJm5ic3A7fCB1cGRhdGUga2V5ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwg Jm5ic3A7ICZuYnNwOzMgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJm5ic3A7ICZuYnNwOyYjNDM7LS0t LS0tLS0tLS0tLS0tLS0tJiM0MzstLS0tLS0tLS0tJiM0Mzs8YnI+DQombmJzcDsgJm5ic3A7fCBu ZXcgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCAmbmJz cDsgJm5ic3A7NCAmbmJzcDsgJm5ic3A7IHw8YnI+DQombmJzcDsgJm5ic3A7JiM0MzstLS0tLS0t LS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0mIzQzOzxicj4NCiZuYnNwOyAmbmJzcDt8IHB1YiBr ZXlzICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDs1ICZuYnNwOyAm bmJzcDsgfDxicj4NCiZuYnNwOyAmbmJzcDsmIzQzOy0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7LS0t LS0tLS0tLSYjNDM7PGJyPg0KPGJyPg0KMTAuJm5ic3A7IFNlY3VyaXR5IENvbnNpZGVyYXRpb25z PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1doZW4gYSBDbGllbnQgcmVjZWl2ZXMgYSBtZXNzYWdl IGZyb20gYSBzZW5kZXIgZm9yIHRoZSBmaXJzdCB0aW1lLCBpdDxicj4NCiZuYnNwOyAmbmJzcDtu ZWVkcyB0byBoYXZlIGEgbWVjaGFuaXNtIGluIHBsYWNlIHRvIGF2b2lkIHJlcGxheSwgZS5nLjxi cj4NCiZuYnNwOyAmbmJzcDtBcHBlbmRpeCBCLjIgb2YgW0ktRC5pZXRmLWNvcmUtb2JqZWN0LXNl Y3VyaXR5XS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIEtEQyBtdXN0IHJlbmV3IHRoZSBn cm91cCBrZXlpbmcgbWF0ZXJpYWwgdXBvbiBpdHMgZXhwaXJhdGlvbi48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7VGhlIEtEQyBzaG91bGQgcmVuZXcgdGhlIGtleWluZyBtYXRlcmlhbCB1cG9uIGdy b3VwIG1lbWJlcnNoaXA8YnI+DQombmJzcDsgJm5ic3A7Y2hhbmdlLCBhbmQgc2hvdWxkIHByb3Zp ZGUgaXQgdG8gdGhlIGN1cnJlbnQgZ3JvdXAgbWVtYmVycyB0aHJvdWdoPGJyPg0KJm5ic3A7ICZu YnNwO3RoZSByZWtleWluZyBzY2hlbWUgdXNlZCBpbiB0aGUgZ3JvdXAuPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO1RoZSBLREMgbWF5IGVuZm9yY2UgYSByZWtleWluZyBwb2xpY3kgdGhhdCB0YWtl cyBpbnRvIGFjY291bnQgdGhlPGJyPg0KJm5ic3A7ICZuYnNwO292ZXJhbGwgdGltZSByZXF1aXJl ZCB0byByZWtleSB0aGUgZ3JvdXAsIGFzIHdlbGwgYXMgdGhlIGV4cGVjdGVkPGJyPg0KJm5ic3A7 ICZuYnNwO3JhdGUgb2YgY2hhbmdlcyBpbiB0aGUgZ3JvdXAgbWVtYmVyc2hpcC48YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7VGhhdCBpcywgdGhlIEtEQyBtYXkgbm90IHJla2V5IHRoZSBncm91cCBh dCBldmVyeSBtZW1iZXJzaGlwIGNoYW5nZSw8YnI+DQombmJzcDsgJm5ic3A7Zm9yIGluc3RhbmNl IGlmIG1lbWJlcnMnIGpvaW5pbmcgYW5kIGxlYXZpbmcgb2NjdXIgZnJlcXVlbnRseSBhbmQ8YnI+ DQombmJzcDsgJm5ic3A7cGVyZm9ybWluZyBhIGdyb3VwIHJla2V5aW5nIHRha2VzIHRvbyBsb25n LiZuYnNwOyBJbnN0ZWFkLCB0aGUgS0RDIG1heTxicj4NCiZuYnNwOyAmbmJzcDtyZWtleSB0aGUg Z3JvdXAgYWZ0ZXIgYSBtaW51bSBudW1iZXIgb2YgZ3JvdXAgbWVtYmVycyBoYXZlIGpvaW5lZCBv cjxicj4NCiZuYnNwOyAmbmJzcDtsZWZ0IHdpdGhpbiBhIGdpdmVuIHRpbWUgaW50ZXJ2YWwsIG9y IGR1cmluZyBwcmVkaWN0YWJsZSBuZXR3b3JrPGJyPg0KJm5ic3A7ICZuYnNwO2luYWN0aXZpdHkg cGVyaW9kcy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7SG93ZXZlciwgdGhpcyB3b3VsZCByZXN1 bHQgaW4gdGhlIEtEQyBub3QgY29uc3RhbnRseSBwcmVzZXJ2aW5nPGJyPg0KJm5ic3A7ICZuYnNw O2JhY2t3YXJkIGFuZCBmb3J3YXJkIHNlY3VyaXR5LiZuYnNwOyBJbiBmYWN0LCBuZXdseSBqb2lu aW5nIGdyb3VwIG1lbWJlcnM8YnI+DQombmJzcDsgJm5ic3A7Y291bGQgYmUgYWJsZSB0byBhY2Nl c3MgdGhlIGtleWluZyBtYXRlcmlhbCB1c2VkIGJlZm9yZSB0aGVpcjxicj4NCiZuYnNwOyAmbmJz cDtqb2luaW5nLCBhbmQgdGh1cyBjb3VsZCBhY2Nlc3MgcGFzdCBncm91cCBjb21tdW5pY2F0aW9u cy4mbmJzcDsgQWxzbyw8YnI+DQombmJzcDsgJm5ic3A7dW50aWwgdGhlIEtEQyBwZXJmb3JtcyBh IGdyb3VwIHJla2V5aW5nLCB0aGUgbmV3bHkgbGVhdmluZyBub2Rlczxicj4NCiZuYnNwOyAmbmJz cDt3b3VsZCBzdGlsbCBiZSBhYmxlIHRvIGFjY2VzcyB1cGNvbWluZyBncm91cCBjb21tdW5pY2F0 aW9ucyB0aGF0IGFyZTxicj4NCiZuYnNwOyAmbmJzcDtwcm90ZWN0ZWQgd2l0aCB0aGUga2V5aW5n IG1hdGVyaWFsIHRoYXQgaGFzIG5vdCB5ZXQgYmVlbiB1cGRhdGVkLjxicj4NCjxicj4NCjxicj4N Cjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5i c3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDIzXTxicj4NCjxicj4NCklu dGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRp b24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KMTAuMS4m bmJzcDsgVXBkYXRlIG9mIEtleWluZyBNYXRlcmlhbDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtB IGdyb3VwIG1lbWJlciBjYW4gcmVjZWl2ZSBhIG1lc3NhZ2Ugc2hvcnRseSBhZnRlciB0aGUgZ3Jv dXAgaGFzIGJlZW48YnI+DQombmJzcDsgJm5ic3A7cmVrZXllZCwgYW5kIG5ldyBrZXlpbmcgbWF0 ZXJpYWwgaGFzIGJlZW4gZGlzdHJpYnV0ZWQgYnkgdGhlIEtEQy4mbmJzcDsgSW48YnI+DQombmJz cDsgJm5ic3A7dGhlIGZvbGxvd2luZyB0d28gY2FzZXMsIHRoaXMgbWF5IHJlc3VsdCBpbiBtaXNh bGlnbmVkIGtleWluZzxicj4NCiZuYnNwOyAmbmJzcDttYXRlcmlhbCBiZXR3ZWVuIHRoZSBncm91 cCBtZW1iZXJzLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtJbiB0aGUgZmlyc3QgY2FzZSwgdGhl IHNlbmRlciBwcm90ZWN0cyBhIG1lc3NhZ2UgdXNpbmcgdGhlIG9sZCBrZXlpbmc8YnI+DQombmJz cDsgJm5ic3A7bWF0ZXJpYWwuJm5ic3A7IEhvd2V2ZXIsIHRoZSByZWNpcGllbnQgcmVjZWl2ZXMg dGhlIG1lc3NhZ2UgYWZ0ZXIgaGF2aW5nPGJyPg0KJm5ic3A7ICZuYnNwO3JlY2VpdmVkIHRoZSBu ZXcga2V5aW5nIG1hdGVyaWFsLCBoZW5jZSBub3QgYmVpbmcgYWJsZSB0byBjb3JyZWN0bHk8YnI+ DQombmJzcDsgJm5ic3A7cHJvY2VzcyBpdC4mbmJzcDsgQSBwb3NzaWJsZSB3YXkgdG8gYW1lbGlv cmF0ZSB0aGlzIGlzc3VlIGlzIHRvIHByZXNlcnZlPGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBvbGQs IHJlY2VudCwga2V5aW5nIG1hdGVyaWFsIGZvciBhIG1heGltdW0gYW1vdW50IG9mIHRpbWUgZGVm aW5lZDxicj4NCiZuYnNwOyAmbmJzcDtieSB0aGUgYXBwbGljYXRpb24uJm5ic3A7IEJ5IGRvaW5n IHNvLCB0aGUgcmVjaXBpZW50IGNhbiBzdGlsbCB0cnkgdG88YnI+DQombmJzcDsgJm5ic3A7cHJv Y2VzcyB0aGUgcmVjZWl2ZWQgbWVzc2FnZSB1c2luZyB0aGUgb2xkIHJldGFpbmVkIGtleWluZyBt YXRlcmlhbDxicj4NCiZuYnNwOyAmbmJzcDthcyBzZWNvbmQgYXR0ZW1wdC4mbmJzcDsgTm90ZSB0 aGF0IGEgZm9ybWVyIChjb21wcm9taXNlZCkgZ3JvdXAgbWVtYmVyIGNhbjxicj4NCiZuYnNwOyAm bmJzcDt0YWtlIGFkdmFudGFnZSBvZiB0aGlzIGJ5IHNlbmRpbmcgbWVzc2FnZXMgcHJvdGVjdGVk IHdpdGggdGhlIG9sZDxicj4NCiZuYnNwOyAmbmJzcDtyZXRhaW5lZCBrZXlpbmcgbWF0ZXJpYWwu Jm5ic3A7IFRoZXJlZm9yZSwgYSBjb25zZXJ2YXRpdmUgYXBwbGljYXRpb248YnI+DQombmJzcDsg Jm5ic3A7cG9saWN5IHNob3VsZCBub3QgYWRtaXQgdGhlIHN0b3JhZ2Ugb2Ygb2xkIGtleWluZyBt YXRlcmlhbC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7SW4gdGhlIHNlY29uZCBjYXNlLCB0aGUg c2VuZGVyIHByb3RlY3RzIGEgbWVzc2FnZSB1c2luZyB0aGUgbmV3PGJyPg0KJm5ic3A7ICZuYnNw O2tleWluZyBtYXRlcmlhbCwgYnV0IHRoZSByZWNpcGllbnQgcmVjZWl2ZXMgdGhhdCByZXF1ZXN0 IGJlZm9yZTxicj4NCiZuYnNwOyAmbmJzcDtoYXZpbmcgcmVjZWl2ZWQgdGhlIG5ldyBrZXlpbmcg bWF0ZXJpYWwuJm5ic3A7IFRoZXJlZm9yZSwgdGhlIHJlY2lwaWVudDxicj4NCiZuYnNwOyAmbmJz cDt3b3VsZCBub3QgYmUgYWJsZSB0byBjb3JyZWN0bHkgcHJvY2VzcyB0aGUgcmVxdWVzdCBhbmQg aGVuY2UgZGlzY2FyZHM8YnI+DQombmJzcDsgJm5ic3A7aXQuJm5ic3A7IElmIHRoZSByZWNpcGll bnQgcmVjZWl2ZXMgdGhlIG5ldyBrZXlpbmcgbWF0ZXJpYWwgc2hvcnRseSBhZnRlcjxicj4NCiZu YnNwOyAmbmJzcDt0aGF0IGFuZCB0aGUgc2VuZGVyIGVuZHBvaW50IHVzZXMgQ29BUCByZXRyYW5z bWlzc2lvbnMsIHRoZSBmb3JtZXI8YnI+DQombmJzcDsgJm5ic3A7d2lsbCBzdGlsbCBiZSBhYmxl IHRvIHJlY2VpdmUgYW5kIGNvcnJlY3RseSBwcm9jZXNzIHRoZSBtZXNzYWdlLiZuYnNwOyBJbjxi cj4NCiZuYnNwOyAmbmJzcDthbnkgY2FzZSwgdGhlIHJlY2lwaWVudCBzaG91bGQgYWN0aXZlbHkg YXNrIHRoZSBLREMgZm9yIGFuIHVwZGF0ZWQ8YnI+DQombmJzcDsgJm5ic3A7a2V5aW5nIG1hdGVy aWFsIGFjY29yZGluZyB0byBhbiBhcHBsaWNhdGlvbi1kZWZpbmVkIHBvbGljeSwgZm9yPGJyPg0K Jm5ic3A7ICZuYnNwO2luc3RhbmNlIGFmdGVyIGEgZ2l2ZW4gbnVtYmVyIG9mIHVuc3VjY2Vzc2Z1 bGx5IGRlY3J5cHRlZCBpbmNvbWluZzxicj4NCiZuYnNwOyAmbmJzcDttZXNzYWdlcy48YnI+DQo8 YnI+DQoxMC4yLiZuYnNwOyBCbG9jay1XaXNlIENvbnNpZGVyYXRpb25zPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO0lmIHRoZSBibG9jay13aXNlIG9wdGlvbnMgW1JGQzc5NTldIGFyZSB1c2VkLCBh bmQgdGhlIGtleWluZyBtYXRlcmlhbDxicj4NCiZuYnNwOyAmbmJzcDtpcyB1cGRhdGVkIGluIHRo ZSBtaWRkbGUgb2YgYSBibG9jay13aXNlIHRyYW5zZmVyLCB0aGUgc2VuZGVyIG9mIHRoZTxicj4N CiZuYnNwOyAmbmJzcDtibG9ja3MganVzdCBjaGFuZ2VzIHRoZSBrZXlpbmcgbWF0ZXJpYWwgdG8g dGhlIHVwZGF0ZWQgb25lIGFuZDxicj4NCiZuYnNwOyAmbmJzcDtjb250aW51ZXMgdGhlIHRyYW5z ZmVyLiZuYnNwOyBBcyBsb25nIGFzIGJvdGggc2lkZXMgZ2V0IHRoZSBuZXcga2V5aW5nPGJyPg0K Jm5ic3A7ICZuYnNwO21hdGVyaWFsLCB1cGRhdGluZyB0aGUga2V5aW5nIG1hdGVyaWFsIGluIHRo ZSBtaWRkbGUgb2YgYSB0cmFuc2Zlcjxicj4NCiZuYnNwOyAmbmJzcDt3aWxsIG5vdCBjYXVzZSBh bnkgaXNzdWUuJm5ic3A7IE90aGVyd2lzZSwgdGhlIHNlbmRlciB3aWxsIGhhdmUgdG88YnI+DQom bmJzcDsgJm5ic3A7dHJhbnNtaXQgdGhlIG1lc3NhZ2UgYWdhaW4sIHdoZW4gcmVjZWl2aW5nIGFu IGVycm9yIG1lc3NhZ2UgZnJvbSB0aGU8YnI+DQombmJzcDsgJm5ic3A7cmVjaXBpZW50Ljxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtDb21wYXJlZCB0byBhIHNjZW5hcmlvIHdoZXJlIHRoZSB0cmFu c2ZlciBkb2VzIG5vdCB1c2UgYmxvY2std2lzZSw8YnI+DQombmJzcDsgJm5ic3A7ZGVwZW5kaW5n IG9uIGhvdyBmYXN0IHRoZSBrZXlpbmcgbWF0ZXJpYWwgaXMgY2hhbmdlZCwgdGhlIG5vZGVzIG1p Z2h0PGJyPg0KJm5ic3A7ICZuYnNwO2NvbnN1bWUgYSBsYXJnZXIgYW1vdW50IG9mIHRoZSBuZXR3 b3JrIHJlc2VuZGluZyB0aGUgYmxvY2tzIGFnYWluIGFuZDxicj4NCiZuYnNwOyAmbmJzcDthZ2Fp biwgd2hpY2ggbWlnaHQgYmUgcHJvYmxlbWF0aWMuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJy Pg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBp cmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgW1BhZ2UgMjRdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5 IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNw OyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQoxMS4mbmJzcDsgSUFOQSBDb25zaWRlcmF0aW9u czxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIGRvY3VtZW50IGhhcyB0aGUgZm9sbG93aW5n IGFjdGlvbnMgZm9yIElBTkEuPGJyPg0KPGJyPg0KMTEuMS4mbmJzcDsgQUNFIEF1dGhvcml6YXRp b24gU2VydmVyIFJlcXVlc3QgQ3JlYXRpb24gSGludHMgUmVnaXN0cnk8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7SUFOQSBpcyBhc2tlZCB0byByZWdpc3RlciB0aGUgZm9sbG93aW5nIGVudHJpZXMg aW4gdGhlICZxdW90O0FDRTxicj4NCiZuYnNwOyAmbmJzcDtBdXRob3JpemF0aW9uIFNlcnZlciBS ZXF1ZXN0IENyZWF0aW9uIEhpbnRzJnF1b3Q7IFJlZ2lzdHJ5IGRlZmluZWQgaW48YnI+DQombmJz cDsgJm5ic3A7U2VjdGlvbiA4LjEgb2YgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0uPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7TmFtZTogc2lnbl9pbmZvPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO28gJm5ic3A7Q0JPUiBLZXk6IFRCRCAocmFuZ2UgLTI1NiB0byAyNTUpPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7VmFsdWUgVHlwZTogYW55PGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO28gJm5ic3A7UmVmZXJlbmNlOiBbW1RoaXMgc3BlY2lmaWNhdGlvbl1dPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7TmFtZTogcHViX2tleV9lbmM8YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7byAmbmJzcDtDQk9SIEtleTogVEJEIChyYW5nZSAtMjU2IHRvIDI1NSk8YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtWYWx1ZSBUeXBlOiBpbnRlZ2VyPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7UmVmZXJlbmNlOiBbW1RoaXMgc3BlY2lmaWNhdGlvbl1d PGJyPg0KPGJyPg0KMTEuMi4mbmJzcDsgQUNFIFB1YmxpYyBLZXkgRW5jb2RpbmcgUmVnaXN0cnk8 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBzcGVjaWZpY2F0aW9uIGVzdGFibGlzaGVzIHRo ZSAmcXVvdDtBQ0UgUHVibGljIEtleSBFbmNvZGluZyZxdW90OyBJQU5BPGJyPg0KJm5ic3A7ICZu YnNwO1JlZ2lzdHJ5LiZuYnNwOyBUaGUgUmVnaXN0cnkgaGFzIGJlZW4gY3JlYXRlZCB0byB1c2Ug dGhlICZxdW90O0V4cGVydCBSZXZpZXc8YnI+DQombmJzcDsgJm5ic3A7UmVxdWlyZWQmcXVvdDsg cmVnaXN0cmF0aW9uIHByb2NlZHVyZSBbUkZDODEyNl0uJm5ic3A7IEV4cGVydCByZXZpZXcgZ3Vp ZGVsaW5lczxicj4NCiZuYnNwOyAmbmJzcDthcmUgcHJvdmlkZWQgaW4gU2VjdGlvbiAxMS45LiZu YnNwOyBJdCBzaG91bGQgYmUgbm90ZWQgdGhhdCwgaW4gYWRkaXRpb248YnI+DQombmJzcDsgJm5i c3A7dG8gdGhlIGV4cGVydCByZXZpZXcsIHNvbWUgcG9ydGlvbnMgb2YgdGhlIFJlZ2lzdHJ5IHJl cXVpcmUgYTxicj4NCiZuYnNwOyAmbmJzcDtzcGVjaWZpY2F0aW9uLCBwb3RlbnRpYWxseSBhIFN0 YW5kYXJkcyBUcmFjayBSRkMsIGJlIHN1cHBsaWVkIGFzPGJyPg0KJm5ic3A7ICZuYnNwO3dlbGwu PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBjb2x1bW5zIG9mIHRoaXMgUmVnaXN0cnkgYXJl Ojxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO05hbWU6IFRoaXMgaXMgYSBkZXNjcmlw dGl2ZSBuYW1lIHRoYXQgZW5hYmxlcyBlYXNpZXIgcmVmZXJlbmNlIHRvPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgdGhlIGl0ZW0uJm5ic3A7IFRoZSBuYW1lIE1VU1QgYmUgdW5pcXVlLiZuYnNw OyBJdCBpcyBub3QgdXNlZCBpbiB0aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBlbmNvZGlu Zy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtWYWx1ZTogVGhlIHZhbHVlIHRvIGJl IHVzZWQgdG8gaWRlbnRpZnkgdGhpcyBwdWJsaWMga2V5IGVuY29kaW5nLjxicj4NCiZuYnNwOyAm bmJzcDsgJm5ic3A7IFRoaXMgdmFsdWUgTVVTVCBiZSB1bmlxdWUuJm5ic3A7IFRoZSB2YWx1ZSBj YW4gYmUgYSBwb3NpdGl2ZSBvciBhPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgbmVnYXRpdmUg aW50ZWdlci4mbmJzcDsgSW50ZWdlciB2YWx1ZXMgYmV0d2VlbiAwIGFuZCAyNTUgYXJlIGRlc2ln bmF0ZWQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhcyBTdGFuZGFyZHMgVHJhY2sgRG9jdW1l bnQgcmVxdWlyZWQuJm5ic3A7IEludGVnZXIgdmFsdWVzIGZyb20gMjU2IHRvPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgNjU1MzUgYXJlIGRlc2lnbmF0ZWQgYXMgU3BlY2lmaWNhdGlvbiBSZXF1 aXJlZC4mbmJzcDsgSW50ZWdlciB2YWx1ZXMgb2Y8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+ DQpQYWxvbWJpbmkgJmFtcDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFu dWFyeSA2LCAyMDIwICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyBbUGFnZSAyNV08YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlz aW9uaW5nIGZvciBHcm91cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkg MjAxOTxicj4NCjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGdyZWF0ZXIgdGhhbiA2 NTUzNSBhcmUgZGVzaWduYXRlZCBhcyBleHBlcnQgcmV2aWV3LiZuYnNwOyBJbnRlZ2VyPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgdmFsdWVzIGxlc3MgdGhhbiAtNjU1MzYgYXJlIG1hcmtlZCBh cyBwcml2YXRlIHVzZS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtEZXNjcmlwdGlv bjogVGhpcyBmaWVsZCBjb250YWlucyBhIGJyaWVmIGRlc2NyaXB0aW9uIGZvciB0aGlzPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgcHVibGljIGtleSBlbmNvZGluZy48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7byAmbmJzcDtSZWZlcmVuY2U6IFRoaXMgZmllbGQgY29udGFpbnMgYSBwb2ludGVy IHRvIHRoZSBwdWJsaWM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBzcGVjaWZpY2F0aW9uIHBy b3ZpZGluZyB0aGUgcHVibGljIGtleSBlbmNvZGluZywgaWYgb25lIGV4aXN0cy48YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7VGhlIHZhbHVlIDAgaXMgdG8gYmUgbWFya2VkIGFzICZxdW90O1Jlc2Vy dmVkJnF1b3Q7Li48YnI+DQo8YnI+DQoxMS4zLiZuYnNwOyBBQ0UgR3JvdXBjb21tIFBhcmFtZXRl cnMgUmVnaXN0cnk8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBzcGVjaWZpY2F0aW9uIGVz dGFibGlzaGVzIHRoZSAmcXVvdDtBQ0UgR3JvdXBjb21tIFBhcmFtZXRlcnMmcXVvdDsgSUFOQTxi cj4NCiZuYnNwOyAmbmJzcDtSZWdpc3RyeS4mbmJzcDsgVGhlIFJlZ2lzdHJ5IGhhcyBiZWVuIGNy ZWF0ZWQgdG8gdXNlIHRoZSAmcXVvdDtFeHBlcnQgUmV2aWV3PGJyPg0KJm5ic3A7ICZuYnNwO1Jl cXVpcmVkJnF1b3Q7IHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUgW1JGQzgxMjZdLiZuYnNwOyBFeHBl cnQgcmV2aWV3IGd1aWRlbGluZXM8YnI+DQombmJzcDsgJm5ic3A7YXJlIHByb3ZpZGVkIGluIFNl Y3Rpb24gMTEuOS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIGNvbHVtbnMgb2YgdGhpcyBS ZWdpc3RyeSBhcmU6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7TmFtZTogVGhpcyBp cyBhIGRlc2NyaXB0aXZlIG5hbWUgdGhhdCBlbmFibGVzIGVhc2llciByZWZlcmVuY2UgdG88YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aGUgaXRlbS4mbmJzcDsgVGhlIG5hbWUgTVVTVCBiZSB1 bmlxdWUuLiZuYnNwOyBJdCBpcyBub3QgdXNlZCBpbiB0aGU8YnI+DQombmJzcDsgJm5ic3A7ICZu YnNwOyBlbmNvZGluZy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtDQk9SIEtleTog VGhpcyBpcyB0aGUgdmFsdWUgdXNlZCBhcyBDQk9SIGtleSBvZiB0aGUgaXRlbS4mbmJzcDsgVGhl c2U8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB2YWx1ZXMgTVVTVCBiZSB1bmlxdWUuJm5ic3A7 IFRoZSB2YWx1ZSBjYW4gYmUgYSBwb3NpdGl2ZSBpbnRlZ2VyLCBhPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgbmVnYXRpdmUgaW50ZWdlciwgb3IgYSBzdHJpbmcuPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwO28gJm5ic3A7Q0JPUiBUeXBlOiBUaGlzIGNvbnRhaW5zIHRoZSBDQk9SIHR5cGUgb2Yg dGhlIGl0ZW0sIG9yIGEgcG9pbnRlcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHRvIHRoZSBy ZWdpc3RyeSB0aGF0IGRlZmluZXMgaXRzIHR5cGUsIHdoZW4gdGhhdCBkZXBlbmRzIG9uPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgYW5vdGhlciBpdGVtLjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtvICZuYnNwO1JlZmVyZW5jZTogVGhpcyBjb250YWlucyBhIHBvaW50ZXIgdG8gdGhlIHB1Ymxp YyBzcGVjaWZpY2F0aW9uIGZvcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHRoZSBmb3JtYXQg b2YgdGhlIGl0ZW0sIGlmIG9uZSBleGlzdHMuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMg UmVnaXN0cnkgaGFzIGJlZW4gaW5pdGlhbGx5IHBvcHVsYXRlZCBieSB0aGUgdmFsdWVzIGluPGJy Pg0KJm5ic3A7ICZuYnNwO1NlY3Rpb24gOC4mbmJzcDsgVGhlIHNwZWNpZmljYXRpb24gY29sdW1u IGZvciBhbGwgb2YgdGhlc2UgZW50cmllcyB3aWxsIGJlPGJyPg0KJm5ic3A7ICZuYnNwO3RoaXMg ZG9jdW1lbnQuPGJyPg0KPGJyPg0KMTEuNC4mbmJzcDsgQWNlIEdyb3VwY29tbSBSZXF1ZXN0IFR5 cGUgUmVnaXN0cnk8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBzcGVjaWZpY2F0aW9uIGVz dGFibGlzaGVzIHRoZSAmcXVvdDtBQ0UgR3JvdXBjb21tIFJlcXVlc3QgVHlwZSZxdW90OyBJQU5B PGJyPg0KJm5ic3A7ICZuYnNwO1JlZ2lzdHJ5LiZuYnNwOyBUaGUgUmVnaXN0cnkgaGFzIGJlZW4g Y3JlYXRlZCB0byB1c2UgdGhlICZxdW90O0V4cGVydCBSZXZpZXc8YnI+DQombmJzcDsgJm5ic3A7 UmVxdWlyZWQmcXVvdDsgcmVnaXN0cmF0aW9uIHByb2NlZHVyZSBbUkZDODEyNl0uJm5ic3A7IEV4 cGVydCByZXZpZXcgZ3VpZGVsaW5lczxicj4NCiZuYnNwOyAmbmJzcDthcmUgcHJvdmlkZWQgaW4g U2VjdGlvbiAxMS45Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgY29sdW1ucyBvZiB0aGlz IFJlZ2lzdHJ5IGFyZTo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpQYWxvbWJpbmkgJmFt cDsgVGlsb2NhICZuYnNwOyAmbmJzcDsgJm5ic3A7IEV4cGlyZXMgSmFudWFyeSA2LCAyMDIwICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBbUGFnZSAyNl08 YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdCAmbmJzcDtLZXkgUHJvdmlzaW9uaW5nIGZvciBHcm91 cCBDb21tdW5pY2F0aW9uICZuYnNwOyAmbmJzcDsgJm5ic3A7IEp1bHkgMjAxOTxicj4NCjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO05hbWU6IFRoaXMgaXMgYSBkZXNjcmlwdGl2ZSBu YW1lIHRoYXQgZW5hYmxlcyBlYXNpZXIgcmVmZXJlbmNlIHRvPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgdGhlIGl0ZW0uJm5ic3A7IFRoZSBuYW1lIE1VU1QgYmUgdW5pcXVlLiZuYnNwOyBJdCBp cyBub3QgdXNlZCBpbiB0aGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBlbmNvZGluZy48YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtWYWx1ZTogVGhpcyBpcyB0aGUgdmFsdWUgdXNl ZCB0byBpZGVudGlmeSB0aGUgcmVxdWVzdC4mbmJzcDsgVGhlc2U8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyB2YWx1ZXMgTVVTVCBiZSB1bmlxdWUuJm5ic3A7IFRoZSB2YWx1ZSBtdXN0IGJlIGEg cG9zaXRpdmUgaW50ZWdlci48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtSZWZlcmVu Y2U6IFRoaXMgY29udGFpbnMgYSBwb2ludGVyIHRvIHRoZSBwdWJsaWMgc3BlY2lmaWNhdGlvbiBm b3I8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0aGUgZm9ybWF0IG9mIHRoZSBpdGVtLCBpZiBv bmUgZXhpc3RzLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIFJlZ2lzdHJ5IGhhcyBiZWVu IGluaXRpYWxseSBwb3B1bGF0ZWQgYnkgdGhlIHZhbHVlcyBpbjxicj4NCiZuYnNwOyAmbmJzcDtT ZWN0aW9uIDkuJm5ic3A7IFRoZSByZWZlcmVuY2UgY29sdW1uIGZvciBhbGwgb2YgdGhlc2UgZW50 cmllcyB3aWxsIGJlPGJyPg0KJm5ic3A7ICZuYnNwO3RoaXMgZG9jdW1lbnQuJm5ic3A7IFRoZSB2 YWx1ZSAwIGlzIHRvIGJlIG1hcmtlZCBhcyAmcXVvdDtSZXNlcnZlZCZxdW90Oy48YnI+DQo8YnI+ DQoxMS41LiZuYnNwOyBBQ0UgR3JvdXBjb21tIEtleSBSZWdpc3RyeTxicj4NCjxicj4NCiZuYnNw OyAmbmJzcDtUaGlzIHNwZWNpZmljYXRpb24gZXN0YWJsaXNoZXMgdGhlICZxdW90O0FDRSBHcm91 cGNvbW0gS2V5JnF1b3Q7IElBTkEgUmVnaXN0cnkuPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBSZWdp c3RyeSBoYXMgYmVlbiBjcmVhdGVkIHRvIHVzZSB0aGUgJnF1b3Q7RXhwZXJ0IFJldmlldyBSZXF1 aXJlZCZxdW90Ozxicj4NCiZuYnNwOyAmbmJzcDtyZWdpc3RyYXRpb24gcHJvY2VkdXJlIFtSRkM4 MTI2XS4mbmJzcDsgRXhwZXJ0IHJldmlldyBndWlkZWxpbmVzIGFyZTxicj4NCiZuYnNwOyAmbmJz cDtwcm92aWRlZCBpbiBTZWN0aW9uIDExLjkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBj b2x1bW5zIG9mIHRoaXMgUmVnaXN0cnkgYXJlOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZu YnNwO05hbWU6IFRoaXMgaXMgYSBkZXNjcmlwdGl2ZSBuYW1lIHRoYXQgZW5hYmxlcyBlYXNpZXIg cmVmZXJlbmNlIHRvPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIGl0ZW0uJm5ic3A7IFRo ZSBuYW1lIE1VU1QgYmUgdW5pcXVlLiZuYnNwOyBJdCBpcyBub3QgdXNlZCBpbiB0aGU8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyBlbmNvZGluZy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAm bmJzcDtLZXkgVHlwZSBWYWx1ZTogVGhpcyBpcyB0aGUgdmFsdWUgdXNlZCB0byBpZGVudGlmeSB0 aGUga2V5aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgbWF0ZXJpYWwuJm5ic3A7IFRoZXNl IHZhbHVlcyBNVVNUIGJlIHVuaXF1ZS4mbmJzcDsgVGhlIHZhbHVlIGNhbiBiZSBhPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgcG9zaXRpdmUgaW50ZWdlciwgYSBuZWdhdGl2ZSBpbnRlZ2VyLCBv ciBhIHN0cmluZy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtQcm9maWxlOiBUaGlz IGZpZWxkIG1heSBjb250YWluIG9uZSBvciBtb3JlIGRlc2NyaXB0aXZlIHN0cmluZ3Mgb2Y8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhcHBsaWNhdGlvbiBwcm9maWxlcyB0byBiZSB1c2VkIHdp dGggdGhpcyBpdGVtLiZuYnNwOyBUaGUgdmFsdWVzIHNob3VsZDxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IGJlIHRha2VuIGZyb20gdGhlIE5hbWUgY29sdW1uIG9mIHRoZSAmcXVvdDtBQ0UgR3Jv dXBjb21tIFByb2ZpbGUmcXVvdDs8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBSZWdpc3RyeS48 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtEZXNjcmlwdGlvbjogVGhpcyBmaWVsZCBj b250YWlucyBhIGJyaWVmIGRlc2NyaXB0aW9uIG9mIHRoZSBrZXlpbmc8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyBtYXRlcmlhbC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtSZWZl cmVuY2VzOiBUaGlzIGNvbnRhaW5zIGEgcG9pbnRlciB0byB0aGUgcHVibGljIHNwZWNpZmljYXRp b248YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBmb3IgdGhlIGZvcm1hdCBvZiB0aGUga2V5aW5n IG1hdGVyaWFsLCBpZiBvbmUgZXhpc3RzLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGlzIFJl Z2lzdHJ5IGhhcyBiZWVuIGluaXRpYWxseSBwb3B1bGF0ZWQgYnkgdGhlIHZhbHVlcyBpbiBGaWd1 cmUgNS48YnI+DQombmJzcDsgJm5ic3A7VGhlIHNwZWNpZmljYXRpb24gY29sdW1uIGZvciBhbGwg b2YgdGhlc2UgZW50cmllcyB3aWxsIGJlIHRoaXM8YnI+DQombmJzcDsgJm5ic3A7ZG9jdW1lbnQu PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7 IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMjddPGJy Pg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAg Q29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8 YnI+DQoxMS42LiZuYnNwOyBBQ0UgR3JvdXBjb21tIFByb2ZpbGUgUmVnaXN0cnk8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7VGhpcyBzcGVjaWZpY2F0aW9uIGVzdGFibGlzaGVzIHRoZSAmcXVvdDtB Q0UgR3JvdXBjb21tIFByb2ZpbGUmcXVvdDsgSUFOQTxicj4NCiZuYnNwOyAmbmJzcDtSZWdpc3Ry eS4mbmJzcDsgVGhlIFJlZ2lzdHJ5IGhhcyBiZWVuIGNyZWF0ZWQgdG8gdXNlIHRoZSAmcXVvdDtF eHBlcnQgUmV2aWV3PGJyPg0KJm5ic3A7ICZuYnNwO1JlcXVpcmVkJnF1b3Q7IHJlZ2lzdHJhdGlv biBwcm9jZWR1cmUgW1JGQzgxMjZdLiZuYnNwOyBFeHBlcnQgcmV2aWV3IGd1aWRlbGluZXM8YnI+ DQombmJzcDsgJm5ic3A7YXJlIHByb3ZpZGVkIGluIFNlY3Rpb24gMTEuOS4mbmJzcDsgSXQgc2hv dWxkIGJlIG5vdGVkIHRoYXQsIGluIGFkZGl0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO3RvIHRoZSBl eHBlcnQgcmV2aWV3LCBzb21lIHBvcnRpb25zIG9mIHRoZSBSZWdpc3RyeSByZXF1aXJlIGE8YnI+ DQombmJzcDsgJm5ic3A7c3BlY2lmaWNhdGlvbiwgcG90ZW50aWFsbHkgYSBTdGFuZGFyZHMgVHJh Y2sgUkZDLCBiZSBzdXBwbGllZCBhczxicj4NCiZuYnNwOyAmbmJzcDt3ZWxsLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtUaGUgY29sdW1ucyBvZiB0aGlzIFJlZ2lzdHJ5IGFyZTo8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7byAmbmJzcDtOYW1lOiBUaGUgbmFtZSBvZiB0aGUgYXBwbGljYXRpb24g cHJvZmlsZSwgdG8gYmUgdXNlZCBhcyB2YWx1ZSBvZjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 IHRoZSBwcm9maWxlIGF0dHJpYnV0ZS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtE ZXNjcmlwdGlvbjogVGV4dCBnaXZpbmcgYW4gb3ZlcnZpZXcgb2YgdGhlIGFwcGxpY2F0aW9uIHBy b2ZpbGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhbmQgdGhlIGNvbnRleHQgaXQgaXMgZGV2 ZWxvcGVkIGZvci48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtDQk9SIFZhbHVlOiBD Qk9SIGFiYnJldmlhdGlvbiBmb3IgdGhlIG5hbWUgb2YgdGhpcyBhcHBsaWNhdGlvbjxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IHByb2ZpbGUuJm5ic3A7IERpZmZlcmVudCByYW5nZXMgb2YgdmFs dWVzIHVzZSBkaWZmZXJlbnQgcmVnaXN0cmF0aW9uPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg cG9saWNpZXMgW1JGQzgxMjZdLiZuYnNwOyBJbnRlZ2VyIHZhbHVlcyBmcm9tIC0yNTYgdG8gMjU1 IGFyZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGRlc2lnbmF0ZWQgYXMgU3RhbmRhcmRzIEFj dGlvbi4mbmJzcDsgSW50ZWdlciB2YWx1ZXMgZnJvbSAtNjU1MzYgdG88YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyAtMjU3IGFuZCBmcm9tIDI1NiB0byA2NTUzNSBhcmUgZGVzaWduYXRlZCBhcyBT cGVjaWZpY2F0aW9uPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgUmVxdWlyZWQuJm5ic3A7IElu dGVnZXIgdmFsdWVzIGdyZWF0ZXIgdGhhbiA2NTUzNSBhcmUgZGVzaWduYXRlZCBhczxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IEV4cGVydCBSZXZpZXcuJm5ic3A7IEludGVnZXIgdmFsdWVzIGxl c3MgdGhhbiAtNjU1MzYgYXJlIG1hcmtlZCBhczxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFBy aXZhdGUgVXNlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1JlZmVyZW5jZTogVGhp cyBjb250YWlucyBhIHBvaW50ZXIgdG8gdGhlIHB1YmxpYyBzcGVjaWZpY2F0aW9uIG9mPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIGFiYnJldmlhdGlvbiBmb3IgdGhpcyBhcHBsaWNhdGlv biBwcm9maWxlLCBpZiBvbmUgZXhpc3RzLjxicj4NCjxicj4NCjExLjcuJm5ic3A7IEFDRSBHcm91 cGNvbW0gUG9saWN5IFJlZ2lzdHJ5PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMgc3BlY2lm aWNhdGlvbiBlc3RhYmxpc2hlcyB0aGUgJnF1b3Q7QUNFIEdyb3VwY29tbSBQb2xpY3kmcXVvdDsg SUFOQTxicj4NCiZuYnNwOyAmbmJzcDtSZWdpc3RyeS4mbmJzcDsgVGhlIFJlZ2lzdHJ5IGhhcyBi ZWVuIGNyZWF0ZWQgdG8gdXNlIHRoZSAmcXVvdDtFeHBlcnQgUmV2aWV3PGJyPg0KJm5ic3A7ICZu YnNwO1JlcXVpcmVkJnF1b3Q7IHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUgW1JGQzgxMjZdLiZuYnNw OyBFeHBlcnQgcmV2aWV3IGd1aWRlbGluZXM8YnI+DQombmJzcDsgJm5ic3A7YXJlIHByb3ZpZGVk IGluIFNlY3Rpb24gMTEuOS4mbmJzcDsgSXQgc2hvdWxkIGJlIG5vdGVkIHRoYXQsIGluIGFkZGl0 aW9uPGJyPg0KJm5ic3A7ICZuYnNwO3RvIHRoZSBleHBlcnQgcmV2aWV3LCBzb21lIHBvcnRpb25z IG9mIHRoZSBSZWdpc3RyeSByZXF1aXJlIGE8YnI+DQombmJzcDsgJm5ic3A7c3BlY2lmaWNhdGlv biwgcG90ZW50aWFsbHkgYSBTdGFuZGFyZHMgVHJhY2sgUkZDLCBiZSBzdXBwbGllZCBhczxicj4N CiZuYnNwOyAmbmJzcDt3ZWxsLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgY29sdW1ucyBv ZiB0aGlzIFJlZ2lzdHJ5IGFyZTo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtOYW1l OiBUaGUgbmFtZSBvZiB0aGUgZ3JvdXAgY29tbXVuaWNhdGlvbiBwb2xpY3kuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO28gJm5ic3A7Q0JPUiBsYWJlbDogVGhlIHZhbHVlIHRvIGJlIHVzZWQgdG8g aWRlbnRpZnkgdGhpcyBncm91cDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGNvbW11bmljYXRp b24gcG9saWN5LiZuYnNwOyBLZXkgbWFwIGxhYmVscyBNVVNUIGJlIHVuaXF1ZS4mbmJzcDsgVGhl IGxhYmVsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgY2FuIGJlIGEgcG9zaXRpdmUgaW50ZWdl ciwgYSBuZWdhdGl2ZSBpbnRlZ2VyIG9yIGEgc3RyaW5nLjxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IEludGVnZXIgdmFsdWVzIGJldHdlZW4gMCBhbmQgMjU1IGFuZCBzdHJpbmdzIG9mIGxlbmd0 aCAxIGFyZTxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5i c3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDI4XTxicj4NCjxicj4NCklu dGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRp b24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgZGVzaWduYXRlZCBhcyBTdGFuZGFyZHMgVHJhY2sgRG9jdW1lbnQgcmVx dWlyZWQuJm5ic3A7IEludGVnZXIgdmFsdWVzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgZnJv bSAyNTYgdG8gNjU1MzUgYW5kIHN0cmluZ3Mgb2YgbGVuZ3RoIDIgYXJlIGRlc2lnbmF0ZWQgYXM8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkLiZuYnNwOyBJ bnRlZ2VyIHZhbHVlcyBvZiBncmVhdGVyIHRoYW4gNjU1MzUgYW5kPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgc3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRlciB0aGFuIDIgYXJlIGRlc2lnbmF0ZWQg YXMgZXhwZXJ0IHJldmlldy48YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBJbnRlZ2VyIHZhbHVl cyBsZXNzIHRoYW4gLTY1NTM2IGFyZSBtYXJrZWQgYXMgcHJpdmF0ZSB1c2UuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO28gJm5ic3A7Q0JPUiB0eXBlOiB0aGUgQ0JPUiB0eXBlIHVzZWQgdG8gZW5j b2RlIHRoZSB2YWx1ZSBvZiB0aGlzIGdyb3VwPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgY29t bXVuaWNhdGlvbiBwb2xpY3kuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7RGVzY3Jp cHRpb246IFRoaXMgZmllbGQgY29udGFpbnMgYSBicmllZiBkZXNjcmlwdGlvbiBmb3IgdGhpczxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGdyb3VwIGNvbW11bmljYXRpb24gcG9saWN5Ljxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1JlZmVyZW5jZTogVGhpcyBmaWVsZCBjb250YWlu cyBhIHBvaW50ZXIgdG8gdGhlIHB1YmxpYzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHNwZWNp ZmljYXRpb24gcHJvdmlkaW5nIHRoZSBmb3JtYXQgb2YgdGhlIGdyb3VwIGNvbW11bmljYXRpb248 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBwb2xpY3ksIGlmIG9uZSBleGlzdHMuPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwO1RoaXMgcmVnaXN0cnkgd2lsbCBiZSBpbml0aWFsbHkgcG9wdWxhdGVk IGJ5IHRoZSB2YWx1ZXMgaW4gRmlndXJlIDYuPGJyPg0KPGJyPg0KMTEuOC4mbmJzcDsgU2VxdWVu Y2UgTnVtYmVyIFN5bmNocm9uaXphdGlvbiBNZXRob2QgUmVnaXN0cnk8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7VGhpcyBzcGVjaWZpY2F0aW9uIGVzdGFibGlzaGVzIHRoZSAmcXVvdDtTZXF1ZW5j ZSBOdW1iZXIgU3luY2hyb25pemF0aW9uPGJyPg0KJm5ic3A7ICZuYnNwO01ldGhvZCZxdW90OyBJ QU5BIFJlZ2lzdHJ5LiZuYnNwOyBUaGUgUmVnaXN0cnkgaGFzIGJlZW4gY3JlYXRlZCB0byB1c2Ug dGhlPGJyPg0KJm5ic3A7ICZuYnNwOyZxdW90O0V4cGVydCBSZXZpZXcgUmVxdWlyZWQmcXVvdDsg cmVnaXN0cmF0aW9uIHByb2NlZHVyZSBbUkZDODEyNl0uJm5ic3A7IEV4cGVydDxicj4NCiZuYnNw OyAmbmJzcDtyZXZpZXcgZ3VpZGVsaW5lcyBhcmUgcHJvdmlkZWQgaW4gU2VjdGlvbiAxMS45LiZu YnNwOyBJdCBzaG91bGQgYmUgbm90ZWQ8YnI+DQombmJzcDsgJm5ic3A7dGhhdCwgaW4gYWRkaXRp b24gdG8gdGhlIGV4cGVydCByZXZpZXcsIHNvbWUgcG9ydGlvbnMgb2YgdGhlIFJlZ2lzdHJ5PGJy Pg0KJm5ic3A7ICZuYnNwO3JlcXVpcmUgYSBzcGVjaWZpY2F0aW9uLCBwb3RlbnRpYWxseSBhIFN0 YW5kYXJkcyBUcmFjayBSRkMsIGJlPGJyPg0KJm5ic3A7ICZuYnNwO3N1cHBsaWVkIGFzIHdlbGwu PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoZSBjb2x1bW5zIG9mIHRoaXMgUmVnaXN0cnkgYXJl Ojxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO05hbWU6IFRoZSBuYW1lIG9mIHRoZSBz ZXF1ZW5jZSBudW1iZXIgc3luY2hyb25pemF0aW9uIG1ldGhvZC48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7byAmbmJzcDtWYWx1ZTogVGhlIHZhbHVlIHRvIGJlIHVzZWQgdG8gaWRlbnRpZnkgdGhp cyBzZXF1ZW5jZSBudW1iZXI8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBzeW5jaHJvbml6YXRp b24gbWV0aG9kLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO0Rlc2NyaXB0aW9uOiBU aGlzIGZpZWxkIGNvbnRhaW5zIGEgYnJpZWYgZGVzY3JpcHRpb24gZm9yIHRoaXM8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyBzZXF1ZW5jZSBudW1iZXIgc3luY2hyb25pemF0aW9uIG1ldGhvZC48 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtSZWZlcmVuY2U6IFRoaXMgZmllbGQgY29u dGFpbnMgYSBwb2ludGVyIHRvIHRoZSBwdWJsaWM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBz cGVjaWZpY2F0aW9uIGRlc2NyaWJpbmcgdGhlIHNlcXVlbmNlIG51bWJlciBzeW5jaHJvbml6YXRp b248YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBtZXRob2QuPGJyPg0KPGJyPg0KMTEuOS4mbmJz cDsgRXhwZXJ0IFJldmlldyBJbnN0cnVjdGlvbnM8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhl IElBTkEgUmVnaXN0cmllcyBlc3RhYmxpc2hlZCBpbiB0aGlzIGRvY3VtZW50IGFyZSBkZWZpbmVk IGFzPGJyPg0KJm5ic3A7ICZuYnNwO2V4cGVydCByZXZpZXcuJm5ic3A7IFRoaXMgc2VjdGlvbiBn aXZlcyBzb21lIGdlbmVyYWwgZ3VpZGVsaW5lcyBmb3Igd2hhdDxicj4NCiZuYnNwOyAmbmJzcDt0 aGUgZXhwZXJ0cyBzaG91bGQgYmUgbG9va2luZyBmb3IsIGJ1dCB0aGV5IGFyZSBiZWluZyBkZXNp Z25hdGVkIGFzPGJyPg0KJm5ic3A7ICZuYnNwO2V4cGVydHMgZm9yIGEgcmVhc29uIHNvIHRoZXkg c2hvdWxkIGJlIGdpdmVuIHN1YnN0YW50aWFsIGxhdGl0dWRlLjxicj4NCjxicj4NCjxicj4NCjxi cj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBK YW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IFtQYWdlIDI5XTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92 aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVs eSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0V4cGVydCByZXZpZXdlcnMgc2hv dWxkIHRha2UgaW50byBjb25zaWRlcmF0aW9uIHRoZSBmb2xsb3dpbmcgcG9pbnRzOjxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1BvaW50IHNxdWF0dGluZyBzaG91bGQgYmUgZGlzY291 cmFnZWQuJm5ic3A7IFJldmlld2VycyBhcmUgZW5jb3VyYWdlZDxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IHRvIGdldCBzdWZmaWNpZW50IGluZm9ybWF0aW9uIGZvciByZWdpc3RyYXRpb24gcmVx dWVzdHMgdG8gZW5zdXJlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhhdCB0aGUgdXNhZ2Ug aXMgbm90IGdvaW5nIHRvIGR1cGxpY2F0ZSBvbmUgdGhhdCBpcyBhbHJlYWR5PGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgcmVnaXN0ZXJlZCBhbmQgdGhhdCB0aGUgcG9pbnQgaXMgbGlrZWx5IHRv IGJlIHVzZWQgaW4gZGVwbG95bWVudHMuPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgVGhlIHpv bmVzIHRhZ2dlZCBhcyBwcml2YXRlIHVzZSBhcmUgaW50ZW5kZWQgZm9yIHRlc3RpbmcgcHVycG9z ZXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhbmQgY2xvc2VkIGVudmlyb25tZW50cywgY29k ZSBwb2ludHMgaW4gb3RoZXIgcmFuZ2VzIHNob3VsZCBub3QgYmU8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyBhc3NpZ25lZCBmb3IgdGVzdGluZy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAm bmJzcDtTcGVjaWZpY2F0aW9ucyBhcmUgcmVxdWlyZWQgZm9yIHRoZSBzdGFuZGFyZHMgdHJhY2sg cmFuZ2Ugb2YgcG9pbnQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhc3NpZ25tZW50LiZuYnNw OyBTcGVjaWZpY2F0aW9ucyBzaG91bGQgZXhpc3QgZm9yIHNwZWNpZmljYXRpb248YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyByZXF1aXJlZCByYW5nZXMsIGJ1dCBlYXJseSBhc3NpZ25tZW50IGJl Zm9yZSBhIHNwZWNpZmljYXRpb24gaXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBhdmFpbGFi bGUgaXMgY29uc2lkZXJlZCB0byBiZSBwZXJtaXNzaWJsZS4mbmJzcDsgU3BlY2lmaWNhdGlvbnMg YXJlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgbmVlZGVkIGZvciB0aGUgZmlyc3QtY29tZSwg Zmlyc3Qtc2VydmUgcmFuZ2UgaWYgdGhleSBhcmUgZXhwZWN0ZWQ8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyB0byBiZSB1c2VkIG91dHNpZGUgb2YgY2xvc2VkIGVudmlyb25tZW50cyBpbiBhbiBp bnRlcm9wZXJhYmxlIHdheS48YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBXaGVuIHNwZWNpZmlj YXRpb25zIGFyZSBub3QgcHJvdmlkZWQsIHRoZSBkZXNjcmlwdGlvbiBwcm92aWRlZDxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7IG5lZWRzIHRvIGhhdmUgc3VmZmljaWVudCBpbmZvcm1hdGlvbiB0 byBpZGVudGlmeSB3aGF0IHRoZSBwb2ludCBpczxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGJl aW5nIHVzZWQgZm9yLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO0V4cGVydHMgc2hv dWxkIHRha2UgaW50byBhY2NvdW50IHRoZSBleHBlY3RlZCB1c2FnZSBvZiBmaWVsZHMgd2hlbjxi cj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGFwcHJvdmluZyBwb2ludCBhc3NpZ25tZW50LiZuYnNw OyBUaGUgZmFjdCB0aGF0IHRoZXJlIGlzIGEgcmFuZ2UgZm9yPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgc3RhbmRhcmRzIHRyYWNrIGRvY3VtZW50cyBkb2VzIG5vdCBtZWFuIHRoYXQgYSBzdGFu ZGFyZHMgdHJhY2s8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBkb2N1bWVudCBjYW5ub3QgaGF2 ZSBwb2ludHMgYXNzaWduZWQgb3V0c2lkZSBvZiB0aGF0IHJhbmdlLiZuYnNwOyBUaGU8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyBsZW5ndGggb2YgdGhlIGVuY29kZWQgdmFsdWUgc2hvdWxkIGJl IHdlaWdoZWQgYWdhaW5zdCBob3cgbWFueTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGNvZGUg cG9pbnRzIG9mIHRoYXQgbGVuZ3RoIGFyZSBsZWZ0LCB0aGUgc2l6ZSBvZiBkZXZpY2UgaXQgd2ls bCBiZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHVzZWQgb24sIGFuZCB0aGUgbnVtYmVyIG9m IGNvZGUgcG9pbnRzIGxlZnQgdGhhdCBlbmNvZGUgdG8gdGhhdDxicj4NCiZuYnNwOyAmbmJzcDsg Jm5ic3A7IHNpemUuPGJyPg0KPGJyPg0KMTIuJm5ic3A7IFJlZmVyZW5jZXM8YnI+DQo8YnI+DQox Mi4xLiZuYnNwOyBOb3JtYXRpdmUgUmVmZXJlbmNlczxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtb SS1ELi5pZXRmLWFjZS1vYXV0aC1hdXRoel08YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgU2VpdHosIEwuLCBTZWxhbmRlciwgRy4sIFdhaGxzdHJv ZW0sIEUuLCBFcmR0bWFuLCBTLiwgYW5kPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEguIFRzY2hvZmVuaWcsICZxdW90O0F1dGhlbnRpY2F0aW9u IGFuZCBBdXRob3JpemF0aW9uIGZvcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgKEFDRSkgdXNpbmcg dGhlIE9BdXRoIDIuMDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBGcmFtZXdvcmsgKEFDRS1PQXV0aCkmcXVvdDssIGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6LTI0PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICh3b3JrIGluIHByb2dyZXNzKSwgTWFyY2ggMjAxOS48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7W0ktRC5pZXRmLWFjZS1vYXV0aC1wYXJhbXNdPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFNlaXR6LCBMLiwgJnF1b3Q7QWRkaXRp b25hbCBPQXV0aCBQYXJhbWV0ZXJzIGZvciBBdXRob3JpemF0aW9uPGJyPg0KJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGluIENvbnN0cmFpbmVkIEVudmly b25tZW50cyAoQUNFKSZxdW90OywgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHBhcmFtcy0wNSAod29yayBp biBwcm9ncmVzcyksIE1hcmNoIDIwMTkuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJy Pg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAmbmJzcDsgJm5ic3A7ICZuYnNw OyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMzBdPGJyPg0KPGJyPg0KSW50ZXJuZXQtRHJhZnQgJm5i c3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNhdGlvbiAmbmJzcDsgJm5ic3A7 ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W0ktRC5pZXRm LWNvcmUtb3Njb3JlLWdyb3VwY29tbV08YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgVGlsb2NhLCBNLiwgU2VsYW5kZXIsIEcuLCBQYWxvbWJpbmks IEYuLCBhbmQgSi4gUGFyayw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJnF1b3Q7R3JvdXAgT1NDT1JFIC0gU2VjdXJlIEdyb3VwIENvbW11bmlj YXRpb24gZm9yIENvQVAmcXVvdDssPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IGRyYWZ0LWlldGYtY29yZS1vc2NvcmUtZ3JvdXBjb21tLTA1ICh3 b3JrIGluIHByb2dyZXNzKSw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5Ljxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtbUkZDMjEx OV0gJm5ic3A7QnJhZG5lciwgUy4sICZxdW90O0tleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8g SW5kaWNhdGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgUmVxdWlyZW1lbnQgTGV2ZWxzJnF1b3Q7LCBCQ1AgMTQsIFJGQyAyMTE5LDxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBET0kgMTAuMTc0 ODcvUkZDMjExOSwgTWFyY2ggMTk5Nyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5 ZS5jb20vdXJsP2s9ZTkzMzFlMWMtYjVlNzEyZWQtZTkzMzVlODctODY0Njg1YjIwODVjLWM1ZDRm YWJlMWFlZTI4MzMmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9y ZyUyRmluZm8lMkZyZmMyMTE5Ij5odHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzIx MTk8L2E+Jmd0Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzcwNDldICZuYnNwO0Jvcm1h bm4sIEMuIGFuZCBQLiBIb2ZmbWFuLCAmcXVvdDtDb25jaXNlIEJpbmFyeSBPYmplY3Q8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgUmVwcmVzZW50 YXRpb24gKENCT1IpJnF1b3Q7LCBSRkMgNzA0OSwgRE9JIDEwLjE3NDg3L1JGQzcwNDksPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IE9jdG9iZXIg MjAxMywgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdXJsP2s9OTM2 YTU3MGEtY2ZiZTViZmItOTM2YTE3OTEtODY0Njg1YjIwODVjLTBkOTk1MDRmMmI1NDc0YzUmYW1w O3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZyZmM3 MDQ5Ij5odHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzcwNDk8L2E+Jmd0Oy48YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzgxMjZdICZuYnNwO0NvdHRvbiwgTS4sIExlaWJhLCBC LiwgYW5kIFQuIE5hcnRlbiwgJnF1b3Q7R3VpZGVsaW5lcyBmb3I8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgV3JpdGluZyBhbiBJQU5BIENvbnNp ZGVyYXRpb25zIFNlY3Rpb24gaW4gUkZDcyZxdW90OywgQkNQIDI2LDxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBSRkMgODEyNiwgRE9JIDEwLjE3 NDg3L1JGQzgxMjYsIEp1bmUgMjAxNyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5 ZS5jb20vdXJsP2s9MGQzY2ZmZTAtNTFlOGYzMTEtMGQzY2JmN2ItODY0Njg1YjIwODVjLTJjNDVi ZjgwYmViMDFkN2EmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9yLm9y ZyUyRmluZm8lMkZyZmM4MTI2Ij5odHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzgx MjY8L2E+Jmd0Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzgxNTJdICZuYnNwO1NjaGFh ZCwgSi4sICZxdW90O0NCT1IgT2JqZWN0IFNpZ25pbmcgYW5kIEVuY3J5cHRpb24gKENPU0UpJnF1 b3Q7LDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyBSRkMgODE1MiwgRE9JIDEwLjE3NDg3L1JGQzgxNTIsIEp1bHkgMjAxNyw8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0 dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdXJsP2s9MWYyMDY4MjAtNDNmNDY0ZDEtMWYyMDI4 YmItODY0Njg1YjIwODVjLTcyMjgzMTFhMDA0NGVjZDgmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUy RiUyRnd3dy5yZmMtZWRpdG9yLm9yZyUyRmluZm8lMkZyZmM4MTUyIj5odHRwczovL3d3dy5yZmMt ZWRpdG9yLm9yZy9pbmZvL3JmYzgxNTI8L2E+Jmd0Oy48YnI+DQo8YnI+DQoxMi4yLiZuYnNwOyBJ bmZvcm1hdGl2ZSBSZWZlcmVuY2VzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1tJLUQuZGlqay1j b3JlLWdyb3VwY29tbS1iaXNdPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IERpamssIEUuLCBXYW5nLCBDLiwgYW5kIE0uIFRpbG9jYSwgJnF1b3Q7 R3JvdXAgQ29tbXVuaWNhdGlvbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyBmb3IgdGhlIENvbnN0cmFpbmVkIEFwcGxpY2F0aW9uIFByb3RvY29s IChDb0FQKSZxdW90OywgZHJhZnQtPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IGRpamstY29yZS1ncm91cGNvbW0tYmlzLTAwICh3b3JrIGluIHBy b2dyZXNzKSwgTWFyY2ggMjAxOS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W0ktRC5pZXRmLWFj ZS1kdGxzLWF1dGhvcml6ZV08YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgR2VyZGVzLCBTLiwgQmVyZ21hbm4sIE8uLCBCb3JtYW5uLCBDLiwgU2Vs YW5kZXIsIEcuLCBhbmQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgTC4gU2VpdHosICZxdW90O0RhdGFncmFtIFRyYW5zcG9ydCBMYXllciBTZWN1 cml0eSAoRFRMUyk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgUHJvZmlsZSBmb3IgQXV0aGVudGljYXRpb24gYW5kIEF1dGhvcml6YXRpb24gZm9y PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IENv bnN0cmFpbmVkIEVudmlyb25tZW50cyAoQUNFKSZxdW90OywgZHJhZnQtaWV0Zi1hY2UtZHRscy08 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgYXV0 aG9yaXplLTA4ICh3b3JrIGluIHByb2dyZXNzKSwgQXByaWwgMjAxOS48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7W0ktRC5pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxlXTxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBTZW5ndWwsIEMuLCBLaXJieSwg QS4sIGFuZCBQLiBGcmVtYW50bGUsICZxdW90O01RVFQtVExTIHByb2ZpbGU8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgb2YgQUNFJnF1b3Q7LCBk cmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxlLTAwICh3b3JrIGluPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHByb2dyZXNzKSwgTWF5IDIw MTkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1tJLUQuaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGVd PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFBh bG9tYmluaSwgRi4sIFNlaXR6LCBMLiwgU2VsYW5kZXIsIEcuLCBhbmQgTS4gR3VubmFyc3Nvbiw8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1 b3Q7T1NDT1JFIHByb2ZpbGUgb2YgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9u PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGZv ciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgRnJhbWV3b3JrJnF1b3Q7LCBkcmFmdC1pZXRmLWFj ZS08YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg b3Njb3JlLXByb2ZpbGUtMDcgKHdvcmsgaW4gcHJvZ3Jlc3MpLCBGZWJydWFyeSAyMDE5Ljxicj4N Cjxicj4NCjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAm bmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdlIDMxXTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0 ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZu YnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1tJLUQu aWV0Zi1jb3JlLWNvYXAtcHVic3ViXTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyBLb3N0ZXIsIE0uLCBLZXJhbmVuLCBBLiwgYW5kIEouIEppbWVu ZXosICZxdW90O1B1Ymxpc2gtPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IFN1YnNjcmliZSBCcm9rZXIgZm9yIHRoZSBDb25zdHJhaW5lZCBBcHBs aWNhdGlvbiBQcm90b2NvbDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAoQ29BUCkmcXVvdDssIGRyYWZ0LWlldGYtY29yZS1jb2FwLXB1YnN1Yi0w OCAod29yayBpbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyBwcm9ncmVzcyksIE1hcmNoIDIwMTkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1tJ LUQuaWV0Zi1jb3JlLW9iamVjdC1zZWN1cml0eV08YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgU2VsYW5kZXIsIEcuLCBNYXR0c3NvbiwgSi4sIFBh bG9tYmluaSwgRi4sIGFuZCBMLiBTZWl0eiw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7T2JqZWN0IFNlY3VyaXR5IGZvciBDb25zdHJh aW5lZCBSRVNUZnVsIEVudmlyb25tZW50czxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAoT1NDT1JFKSZxdW90OywgZHJhZnQtaWV0Zi1jb3JlLW9i amVjdC1zZWN1cml0eS0xNiAod29yayBpbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBwcm9ncmVzcyksIE1hcmNoIDIwMTkuPGJyPg0KPGJyPg0K Jm5ic3A7ICZuYnNwO1tSRkMyMDkzXSAmbmJzcDtIYXJuZXksIEguIGFuZCBDLiBNdWNrZW5oaXJu LCAmcXVvdDtHcm91cCBLZXkgTWFuYWdlbWVudDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBQcm90b2NvbCAoR0tNUCkgU3BlY2lmaWNhdGlvbiZx dW90OywgUkZDIDIwOTMsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7IERPSSAxMC4xNzQ4Ny9SRkMyMDkzLCBKdWx5IDE5OTcsPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZsdDs8YSBocmVmPSJo dHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPWJkY2YwM2Y5LWUxMWIwZjA4LWJkY2Y0 MzYyLTg2NDY4NWIyMDg1Yy02OGVlNDU4ZDAzNTFmMTA4JmFtcDtxPTEmYW1wO3U9aHR0cHMlM0El MkYlMkZ3d3cucmZjLWVkaXRvci5vcmclMkZpbmZvJTJGcmZjMjA5MyI+aHR0cHM6Ly93d3cucmZj LWVkaXRvci5vcmcvaW5mby9yZmMyMDkzPC9hPiZndDsuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O1tSRkMyMDk0XSAmbmJzcDtIYXJuZXksIEguIGFuZCBDLiBNdWNrZW5oaXJuLCAmcXVvdDtHcm91 cCBLZXkgTWFuYWdlbWVudDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyBQcm90b2NvbCAoR0tNUCkgQXJjaGl0ZWN0dXJlJnF1b3Q7LCBSRkMgMjA5 NCw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg RE9JIDEwLjE3NDg3L1JGQzIwOTQsIEp1bHkgMTk5Nyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVj dDIuZmlyZWV5ZS5jb20vdXJsP2s9ZjlmNmEwNjEtYTUyMmFjOTAtZjlmNmUwZmEtODY0Njg1YjIw ODVjLWI4ZGM2MjA3YTUzYzM4YzMmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMt ZWRpdG9yLm9yZyUyRmluZm8lMkZyZmMyMDk0Ij5odHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9p bmZvL3JmYzIwOTQ8L2E+Jmd0Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzI2MjddICZu YnNwO1dhbGxuZXIsIEQuLCBIYXJkZXIsIEUuLCBhbmQgUi4gQWdlZSwgJnF1b3Q7S2V5IE1hbmFn ZW1lbnQgZm9yPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IE11bHRpY2FzdDogSXNzdWVzIGFuZCBBcmNoaXRlY3R1cmVzJnF1b3Q7LCBSRkMgMjYy Nyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg RE9JIDEwLjE3NDg3L1JGQzI2MjcsIEp1bmUgMTk5OSw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVj dDIuZmlyZWV5ZS5jb20vdXJsP2s9ZjYxYTc1MGQtYWFjZTc5ZmMtZjYxYTM1OTYtODY0Njg1YjIw ODVjLTJiNDk1NDNhZjRkOTAwNTUmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMt ZWRpdG9yLm9yZyUyRmluZm8lMkZyZmMyNjI3Ij5odHRwczovL3d3dy4ucmZjLWVkaXRvci5vcmcv aW5mby9yZmMyNjI3PC9hPiZndDsuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1tSRkM3MzkwXSAm bmJzcDtSYWhtYW4sIEEuLCBFZC4gYW5kIEUuIERpamssIEVkLiwgJnF1b3Q7R3JvdXAgQ29tbXVu aWNhdGlvbiBmb3I8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgdGhlIENvbnN0cmFpbmVkIEFwcGxpY2F0aW9uIFByb3RvY29sIChDb0FQKSZxdW90 OywgUkZDIDczOTAsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7IERPSSAxMC4xNzQ4Ny9SRkM3MzkwLCBPY3RvYmVyIDIwMTQsPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZsdDs8YSBocmVmPSJo dHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPThjOWFkMWI2LWQwNGVkZDQ3LThjOWE5 MTJkLTg2NDY4NWIyMDg1Yy1mM2U3MmFmMTYwNWE2Zjg0JmFtcDtxPTEmYW1wO3U9aHR0cHMlM0El MkYlMkZ3d3cucmZjLWVkaXRvci5vcmclMkZpbmZvJTJGcmZjNzM5MCI+aHR0cHM6Ly93d3cucmZj LWVkaXRvci5vcmcvaW5mby9yZmM3MzkwPC9hPiZndDsuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw O1tSRkM3NTE5XSAmbmJzcDtKb25lcywgTS4sIEJyYWRsZXksIEouLCBhbmQgTi4gU2FraW11cmEs ICZxdW90O0pTT04gV2ViIFRva2VuPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IChKV1QpJnF1b3Q7LCBSRkMgNzUxOSwgRE9JIDEwLjE3NDg3L1JG Qzc1MTksIE1heSAyMDE1LDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbHQ7PGEgaHJlZj0iaHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS91 cmw/az02NmY4YjMxMS0zYTJjYmZlMC02NmY4ZjM4YS04NjQ2ODViMjA4NWMtMWQxYzNjNTc5Y2Y2 NWVjZCZhbXA7cT0xJmFtcDt1PWh0dHBzJTNBJTJGJTJGd3d3LnJmYy1lZGl0b3Iub3JnJTJGaW5m byUyRnJmYzc1MTkiPmh0dHBzOi8vd3d3Li5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzc1MTk8L2E+ Jmd0Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzc5NTldICZuYnNwO0Jvcm1hbm4sIEMu IGFuZCBaLiBTaGVsYnksIEVkLiwgJnF1b3Q7QmxvY2stV2lzZSBUcmFuc2ZlcnMgaW48YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIENvbnN0 cmFpbmVkIEFwcGxpY2F0aW9uIFByb3RvY29sIChDb0FQKSZxdW90OywgUkZDIDc5NTksPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IERPSSAxMC4x NzQ4Ny9SRkM3OTU5LCBBdWd1c3QgMjAxNiw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmly ZWV5ZS5jb20vdXJsP2s9Y2RkMGMyOTEtOTEwNGNlNjAtY2RkMDgyMGEtODY0Njg1YjIwODVjLTkz MjhmYmM2YTEwYjM5NmYmYW1wO3E9MSZhbXA7dT1odHRwcyUzQSUyRiUyRnd3dy5yZmMtZWRpdG9y Lm9yZyUyRmluZm8lMkZyZmM3OTU5Ij5odHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3Jm Yzc5NTk8L2E+Jmd0Oy48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7W1JGQzgyNTldICZuYnNwO0Jy YXksIFQuLCBFZC4sICZxdW90O1RoZSBKYXZhU2NyaXB0IE9iamVjdCBOb3RhdGlvbiAoSlNPTikg RGF0YTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyBJbnRlcmNoYW5nZSBGb3JtYXQmcXVvdDssIFNURCA5MCwgUkZDIDgyNTksPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IERPSSAxMC4xNzQ4Ny9S RkM4MjU5LCBEZWNlbWJlciAyMDE3LDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbHQ7PGEgaHJlZj0iaHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXll LmNvbS91cmw/az05MGFhMDY1OC1jYzdlMGFhOS05MGFhNDZjMy04NjQ2ODViMjA4NWMtMWZiMDhj MmEwYzI0MDA1YSZhbXA7cT0xJmFtcDt1PWh0dHBzJTNBJTJGJTJGd3d3LnJmYy1lZGl0b3Iub3Jn JTJGaW5mbyUyRnJmYzgyNTkiPmh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjODI1 OTwvYT4mZ3Q7Ljxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9t YmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYs IDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQ YWdlIDMyXTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcg Zm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJy Pg0KPGJyPg0KPGJyPg0KQXBwZW5kaXggQS4mbmJzcDsgUmVxdWlyZW1lbnRzIG9uIEFwcGxpY2F0 aW9uIFByb2ZpbGVzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMgc2VjdGlvbiBsaXN0cyB0 aGUgcmVxdWlyZW1lbnRzIG9uIGFwcGxpY2F0aW9uIHByb2ZpbGVzIG9mIHRoaXM8YnI+DQombmJz cDsgJm5ic3A7c3BlY2lmaWNhdGlvbixmb3IgdGhlIGNvbnZlbmllbmNlIG9mIGFwcGxpY2F0aW9u IHByb2ZpbGUgZGVzaWduZXJzLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1NwZWNp ZnkgdGhlIGNvbW11bmljYXRpb24gcHJvdG9jb2wgdGhlIG1lbWJlcnMgb2YgdGhlIGdyb3VwIG11 c3Q8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB1c2UgKGUuZy4sIG11bHRpY2FzdCBDb0FQKS48 YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtTcGVjaWZ5IHRoZSBzZWN1cml0eSBwcm90 b2NvbCB0aGUgZ3JvdXAgbWVtYmVycyBtdXN0IHVzZSB0bzxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IHByb3RlY3QgdGhlaXIgY29tbXVuaWNhdGlvbiAoZS5nLiwgZ3JvdXAgT1NDT1JFKS4mbmJz cDsgVGhpcyBtdXN0PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcHJvdmlkZSBlbmNyeXB0aW9u LCBpbnRlZ3JpdHkgYW5kIHJlcGxheSBwcm90ZWN0aW9uLjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtvICZuYnNwO1NwZWNpZnkgdGhlIGVuY29kaW5nIGFuZCB2YWx1ZSBvZiB0aGUgaWRlbnRpZmll ciBvZiBncm91cCBvciB0b3BpYzxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IGFuZCByb2xlIG9m ICdzY29wZScgKHNlZSBTZWN0aW9uIDMuMSkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5i c3A7U3BlY2lmeSBhbmQgcmVnaXN0ZXIgdGhlIGFwcGxpY2F0aW9uIHByb2ZpbGUgaWRlbnRpZmll ciAoc2VlPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgU2VjdGlvbiA0LjEpLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtvICZuYnNwO1NwZWNpZnkgdGhlIGFjY2VwdGFibGUgdmFsdWVzIG9mICdr dHknIChzZWUgU2VjdGlvbiA0LjIpLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1Nw ZWNpZnkgdGhlIGZvcm1hdCBhbmQgY29udGVudCBvZiAnZ3JvdXBfcG9saWNpZXMnIGVudHJpZXMg KHNlZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFNlY3Rpb24gNC4yKS48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7byAmbmJzcDtPcHRpb25hbGx5LCBzcGVjaWZ5IHRoZSBmb3JtYXQgYW5kIGNv bnRlbnQgb2YgJ21ndF9rZXlfbWF0ZXJpYWwnPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgKHNl ZSBTZWN0aW9uIDQuMikuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7T3B0aW9uYWxs eSwgc3BlY2lmeSB0cmFucG9ydCBwcm9maWxlIG9mIEFDRTxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7IFtJLUQuaWV0Zi1hY2Utb2F1dGgtYXV0aHpdIHRvIHVzZSBiZXR3ZWVuIENsaWVudCBhbmQg S0RDLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO09wdGlvbmFsbHksIHNwZWNpZnkg dGhlIGVuY29kaW5nIG9mIHB1YmxpYyBrZXlzLCBvZiAnY2xpZW50X2NyZWQnLDxicj4NCiZuYnNw OyAmbmJzcDsgJm5ic3A7IGFuZCBvZiAncHViX2tleXMnIGlmIENPU0VfS2V5cyBhcmUgbm90IHVz ZWQgKHNlZSBTZWN0aW9uIDQuMikuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7T3B0 aW9uYWxseSwgc3BlY2lmeSB0aGUgYWNjZXB0YWJsZSB2YWx1ZXMgZm9yIHBhcmFtZXRlcnMgcmVs YXRlZDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHRvIHNpZ25hdHVyZSBhbGdvcml0aG0gYW5k IHNpZ25hdHVyZSBrZXlzOiAnc2lnbl9hbGcnLDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICdz aWduX3BhcmFtZXRlcnMnLCAnc2lnbl9rZXlfcGFyYW1ldGVycycsICdwdWJfa2V5X2VuYycgKHNl ZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFNlY3Rpb24gMy4zKS48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7byAmbmJzcDtPcHRpb25hbGx5LCBzcGVjaWZ5IHRoZSBuZWdvdGlhdGlvbiBvZiBw YXJhbWV0ZXIgdmFsdWVzIGZvcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHNpZ25hdHVyZSBh bGdvcml0aG0gYW5kIHNpZ25hdHVyZSBrZXlzLCBpZiAnc2lnbl9pbmZvJyBhbmQ8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyAncHViX2tleV9lbmMnIGFyZSBub3QgdXNlZCAoc2VlIFNlY3Rpb24g My4zKS48YnI+DQo8YnI+DQpBcHBlbmRpeCBCLiZuYnNwOyBEb2N1bWVudCBVcGRhdGVzPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwO1JGQyBFRElUT1I6IFBMRUFTRSBSRU1PVkUgVEhJUyBTRUNUSU9O Ljxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBhbG9tYmlu aSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhwaXJlcyBKYW51YXJ5IDYsIDIw MjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFtQYWdl IDMzXTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNwO0tleSBQcm92aXNpb25pbmcgZm9y IEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAmbmJzcDsgSnVseSAyMDE5PGJyPg0K PGJyPg0KPGJyPg0KQi4uMS4mbmJzcDsgVmVyc2lvbiAtMDEgdG8gLTAyPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwO28gJm5ic3A7RWRpdG9yaWFsIGZpeGVzLjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtvICZuYnNwO0Rpc3RpbmN0aW9uIGJldHdlZW4gdHJhbnNwb3J0IHByb2ZpbGUgYW5kIGFwcGxp Y2F0aW9uIHByb2ZpbGU8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAoU2VjdGlvbiAxLjEpLjxi cj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO05ldyBwYXJhbWV0ZXJzICdzaWduX2luZm8n IGFuZCAncHViX2tleV9lbmMnIHRvIG5lZ290aWF0ZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 IHBhcmFtZXRlciB2YWx1ZXMgZm9yIHNpZ25hdHVyZSBhbGdvcml0aG0gYW5kIHNpZ25hdHVyZSBr ZXlzPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgKFNlY3Rpb24gMy4zKS48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7byAmbmJzcDtOZXcgcGFyYW1ldGVyICd0eXBlJyB0byBkaXN0aW5ndWlzaCBk aWZmZXJlbnQgS2V5IERpc3RyaWJ1dGlvbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFJlcXVl c3QgbWVzc2FnZXMgKFNlY3Rpb24gNC4xKS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJz cDtOZXcgcGFyYW1ldGVyICdjbGllbnRfY3JlZF92ZXJpZnknIGluIHRoZSBLZXkgRGlzdHJpYnV0 aW9uIFJlcXVlc3Q8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB0byBjb252ZXkgYSBDbGllbnQg c2lnbmF0dXJlIChTZWN0aW9uIDQuMSkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7 RW5jb2Rpbmcgb2YgJ3B1Yl9rZXlzX3JlcG9zJyAoU2VjdGlvbiA0LjEpLjxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDtvICZuYnNwO0VuY29kaW5nIG9mICdtZ3Rfa2V5X21hdGVyaWFsJyAoU2VjdGlv biA0LjEpLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO0ltcHJvdmVkIGRlc2NyaXB0 aW9uIG9uIHJldHJpZXZhbCBvZiBuZXcgb3IgdXBkYXRlZCBrZXlpbmc8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyBtYXRlcmlhbCAoU2VjdGlvbiA2KS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 byAmbmJzcDtFbmNvZGluZyBvZiAnZ2V0X3B1Yl9rZXlzJyBpbiBQdWJsaWMgS2V5IFJlcXVlc3Qg KFNlY3Rpb24gNy4xKS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtFeHRlbmRlZCBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucyAoU2VjdGlvbnMgMTAuMSBhbmQgMTAuMikuPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7TmV3ICZxdW90O0FDRSBQdWJsaWMgS2V5IEVuY29kaW5n JnF1b3Q7IElBTkEgUmVnaXN0cnkgKFNlY3Rpb24gMTEuMikuPGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwO28gJm5ic3A7TmV3ICZxdW90O0FDRSBHcm91cGNvbW0gUGFyYW1ldGVycyZxdW90OyBJQU5B IFJlZ2lzdHJ5IChTZWN0aW9uIDExLjMpLDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHBvcHVs YXRlZCB3aXRoIHRoZSBlbnRyaWVzIGluIFNlY3Rpb24gOC48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7byAmbmJzcDtOZXcgJnF1b3Q7QWNlIEdyb3VwY29tbSBSZXF1ZXN0IFR5cGUmcXVvdDsgSUFO QSBSZWdpc3RyeSAoU2VjdGlvbiAxMS40KSw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBwb3B1 bGF0ZWQgd2l0aCB0aGUgdmFsdWVzIGluIFNlY3Rpb24gOS48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7byAmbmJzcDtOZXcgJnF1b3Q7QUNFIEdyb3VwY29tbSBQb2xpY3kmcXVvdDsgSUFOQSBSZWdp c3RyeSAoU2VjdGlvbiAxMS43KSBwb3B1bGF0ZWQ8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyB3 aXRoIHR3byBlbnRyaWVzICZxdW90O1NlcXVlbmNlIE51bWJlciBTeW5jaHJvbml6YXRpb24gTWV0 aG9kJnF1b3Q7IGFuZCAmcXVvdDtLZXk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBVcGRhdGUg Q2hlY2sgSW50ZXJ2YWwmcXVvdDsgKFNlY3Rpb24gNC4yKS48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7byAmbmJzcDtJbXByb3ZlZCBsaXN0IG9mIHJlcXVpcmVtZW50cyBmb3IgYXBwbGljYXRpb24g cHJvZmlsZXM8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAoQXBwZW5kaXggQSkuPGJyPg0KPGJy Pg0KQi4yLiZuYnNwOyBWZXJzaW9uIC0wMCB0byAtMDE8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 byAmbmJzcDtDaGFuZ2VkIG5hbWUgb2YgJ3JlcV9hdWQnIHRvICdhdWRpZW5jZScgaW4gdGhlIEF1 dGhvcml6YXRpb248YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyBSZXF1ZXN0IChTZWN0aW9uIDMu MSkuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUGFsb21iaW5pICZhbXA7IFRpbG9jYSAm bmJzcDsgJm5ic3A7ICZuYnNwOyBFeHBpcmVzIEphbnVhcnkgNiwgMjAyMCAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgW1BhZ2UgMzRdPGJyPg0KPGJyPg0K SW50ZXJuZXQtRHJhZnQgJm5ic3A7S2V5IFByb3Zpc2lvbmluZyBmb3IgR3JvdXAgQ29tbXVuaWNh dGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyBKdWx5IDIwMTk8YnI+DQo8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7byAmbmJzcDtEZWZpbmVkIGVycm9yIGhhbmRsaW5nIG9uIHRoZSBLREMgKFNlY3Rp b25zIDQuMiBhbmQgNi4yKS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtVcGRhdGVk IGZvcm1hdCBvZiB0aGUgS2V5IERpc3RyaWJ1dGlvbiBSZXNwb25zZSBhcyBhIHdob2xlPGJyPg0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgKFNlY3Rpb24gNC4yKS48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7byAmbmJzcDtHZW5lcmFsaXplZCBmb3JtYXQgb2YgJ3B1Yl9rZXlzJyBpbiB0aGUgS2V5IERp c3RyaWJ1dGlvbiBSZXNwb25zZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IChTZWN0aW9uIDQu MikuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7RGVmaW5lZCBmb3JtYXQgZm9yIHRo ZSBtZXNzYWdlIHRvIHJlcXVlc3QgbGVhdmluZyB0aGUgZ3JvdXA8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAoU2VjdGlvbiA1LjIpLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO1Jl bmV3YWwgb2YgaW5kaXZpZHVhbCBrZXlpbmcgbWF0ZXJpYWwgYW5kIG1ldGhvZHMgZm9yIGdyb3Vw PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgcmVrZXlpbmcgaW5pdGlhdGVkIGJ5IHRoZSBLREMg KFNlY3Rpb24gNikuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7Q0JPUiB0eXBlIGZv ciBub2RlIGlkZW50aWZpZXJzIGluICdnZXRfcHViX2tleXMnIChTZWN0aW9uIDcuMSkuPGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7QWRkZWQgc2VjdGlvbiBvbiBwYXJhbWV0ZXIgaWRl bnRpZmllcnMgYW5kIHRoZWlyIENCT1Iga2V5czxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IChT ZWN0aW9uIDgpLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDtvICZuYnNwO0FkZGVkIHJlcXVlc3Qg dHlwZXMgZm9yIHJlcXVlc3RzIHRvIGEgSm9pbiBSZXNwb25zZSAoU2VjdGlvbiA5KS48YnI+DQo8 YnI+DQombmJzcDsgJm5ic3A7byAmbmJzcDtFeHRlbmRlZCBzZWN1cml0eSBjb25zaWRlcmF0aW9u cyAoU2VjdGlvbiAxMCkuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO28gJm5ic3A7TmV3IElBTkEg cmVnaXN0cmllcyAmcXVvdDtBQ0UgR3JvdXBjb21tIEtleSBSZWdpc3RyeSZxdW90OywgJnF1b3Q7 QUNFIEdyb3VwY29tbTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IFByb2ZpbGUgUmVnaXN0cnkm cXVvdDssICZxdW90O0FDRSBHcm91cGNvbW0gUG9saWN5IFJlZ2lzdHJ5JnF1b3Q7IGFuZCAmcXVv dDtTZXF1ZW5jZTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IE51bWJlciBTeW5jaHJvbml6YXRp b24gTWV0aG9kIFJlZ2lzdHJ5JnF1b3Q7IChTZWN0aW9uIDExKS48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7byAmbmJzcDtBZGRlZCBhcHBlbmRpeCBhYm91dCByZXF1aXJlbWVudHMgZm9yIGFwcGxp Y2F0aW9uIHByb2ZpbGVzIG9mIEFDRTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7IG9uIGdyb3Vw IGNvbW11bmljYXRpb24gKEFwcGVuZGl4IEEpLjxicj4NCjxicj4NCkFja25vd2xlZGdtZW50czxi cj4NCjxicj4NCiZuYnNwOyAmbmJzcDtUaGUgZm9sbG93aW5nIGluZGl2aWR1YWxzIHdlcmUgaGVs cGZ1bCBpbiBzaGFwaW5nIHRoaXMgZG9jdW1lbnQ6IEJlbjxicj4NCiZuYnNwOyAmbmJzcDtLYWR1 aywgSm9obiBNYXR0c3NvbiwgSmltIFNjaGFhZCwgTHVkd2lnIFNlaXR6LCBHb2VyYW4gU2VsYW5k ZXIgYW5kPGJyPg0KJm5ic3A7ICZuYnNwO1BldGVyIHZhbiBkZXIgU3Rvay48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7VGhlIHdvcmsgb24gdGhpcyBkb2N1bWVudCBoYXMgYmVlbiBwYXJ0bHkgc3Vw cG9ydGVkIGJ5IFZJTk5PVkEgYW5kPGJyPg0KJm5ic3A7ICZuYnNwO3RoZSBDZWx0aWMtTmV4dCBw cm9qZWN0IENSSVRJU0VDOyBhbmQgYnkgdGhlIEVJVC1EaWdpdGFsIEhpZ2ggSW1wYWN0PGJyPg0K Jm5ic3A7ICZuYnNwO0luaXRpYXRpdmUgQUNUSVZFLjxicj4NCjxicj4NCkF1dGhvcnMnIEFkZHJl c3Nlczxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4N Cjxicj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsg RXhwaXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IFtQYWdlIDM1XTxicj4NCjxicj4NCkludGVybmV0LURyYWZ0ICZuYnNw O0tleSBQcm92aXNpb25pbmcgZm9yIEdyb3VwIENvbW11bmljYXRpb24gJm5ic3A7ICZuYnNwOyAm bmJzcDsgSnVseSAyMDE5PGJyPg0KPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwO0ZyYW5jZXNjYSBQ YWxvbWJpbmk8YnI+DQombmJzcDsgJm5ic3A7RXJpY3Nzb24gQUI8YnI+DQombmJzcDsgJm5ic3A7 VG9yc2hhbW5zZ2F0YW4gMjM8YnI+DQombmJzcDsgJm5ic3A7S2lzdGEgJm5ic3A7U0UtMTY0NDAg U3RvY2tob2xtPGJyPg0KJm5ic3A7ICZuYnNwO1N3ZWRlbjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtFbWFpbDogPGEgaHJlZj0ibWFpbHRvOmZyYW5jZXNjYS5wYWxvbWJpbmlAZXJpY3Nzb24uY29t Ij5mcmFuY2VzY2EucGFsb21iaW5pQGVyaWNzc29uLmNvbTwvYT48YnI+DQo8YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7TWFyY28gVGlsb2NhPGJyPg0KJm5ic3A7ICZuYnNwO1JJU0UgQUI8YnI+DQom bmJzcDsgJm5ic3A7SXNhZmpvcmRzZ2F0YW4gMjI8YnI+DQombmJzcDsgJm5ic3A7S2lzdGEgJm5i c3A7U0UtMTY0NDAgU3RvY2tob2xtPGJyPg0KJm5ic3A7ICZuYnNwO1N3ZWRlbjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDtFbWFpbDogPGEgaHJlZj0ibWFpbHRvOm1hcmNvLnRpbG9jYUByaS5zZSI+ bWFyY28udGlsb2NhQHJpLnNlPC9hPjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4N Cjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxi cj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4N Cjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxi cj4NCjxicj4NClBhbG9tYmluaSAmYW1wOyBUaWxvY2EgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRXhw aXJlcyBKYW51YXJ5IDYsIDIwMjAgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7IFtQYWdlIDM2XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_894C46A91AE64A6E89D5C79B8C03E4EFericssoncom_-- From nobody Wed Nov 6 06:15:53 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1301312087E for ; Wed, 6 Nov 2019 06:15:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.567 X-Spam-Level: X-Spam-Status: No, score=-1.567 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.082, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8hSzLr_Gfmg4 for ; Wed, 6 Nov 2019 06:15:50 -0800 (PST) Received: from mail-ua1-f48.google.com (mail-ua1-f48.google.com [209.85.222.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8521312010C for ; Wed, 6 Nov 2019 06:15:50 -0800 (PST) Received: by mail-ua1-f48.google.com with SMTP id l38so7360153uad.4 for ; Wed, 06 Nov 2019 06:15:50 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oc8+4UDVwg7nmYZD1hafGLbwhjkR1s0iXRapQUcfVjk=; b=Xb0I+q4F1yeS87wEX1j8upx10X3fN2HiRZl8svMk2Sn7qNdIjuZMQ7NhzdLOsbXKfX x/4pLjUXG8LLQ2UqHfN3HMv4Ow4LrK45kbIAcOhxSuqeeIqICN8X8IIxxf89q3Gg3LbR NAZf13B37LlRdG11DoltTjjwnslpEMgpaZmaGdSyEfkoBsYcOYIGKfZ4gyu1WzfL4ina ta7+0Liv2cX5VK2ZUKLdV3mBafDFKUqY7XAP4QPSjLd8IU1qIp2zlqYnK8QOtNx1Qyb5 8Wv4NWcZqE9MCcUDUx1x6M0Eqxm0goX2r2qFEKBOSIknoaWdWzzuAPHyxFzlHpL5nFCl xOqA== X-Gm-Message-State: APjAAAU4h6J2jLUQf/9xt/1g/d7uNwMD0ePQTRd98zDc+o7yf+jlVkNK //eGdulzjl+/9WP9ZM5WOuMKIwlTGsOQzFH7/+07ywXiUB9Sow== X-Google-Smtp-Source: APXvYqx6T+fhebinFpjyJShewHPVN7fkRc+pPgOBMUX0+86Qo0TvYoW34r+VbKjYCvu1mQYO/LNP+OcIxYCuZacizv8= X-Received: by 2002:ab0:55d5:: with SMTP id w21mr1310032uaa.88.1573049749339; Wed, 06 Nov 2019 06:15:49 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Daniel Migault Date: Wed, 6 Nov 2019 09:15:38 -0500 Message-ID: To: Francesca Palombini Cc: Daniel Migault , Ace Wg Content-Type: multipart/alternative; boundary="0000000000008601140596ae2f39" Archived-At: Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 14:15:52 -0000 --0000000000008601140596ae2f39 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, Please find the provisional agenda .Let us know if there are any preferred order or if anything is missing. Yours, Daniel * Welcome, Notewell, Bluesheets, Agenda bashing: 5 min * Current Drafts: * draft-ietf-ace-mqtt-tls-profile (10 min) * draft-tiloca-ace-revoked-token-notification (10 min) * draft-ace-key-groupcomm (15 min) * draft-ietf-ace-key-groupcomm-oscore-03 (10 min) * draft-tiloca-ace-oscore-gm-admin (10 min) * draft-tiloca-ace-group-oscore-profile-01 (15 min) * draft-palombini-ace-coap-pubsub-profile (10 min) On Wed, Nov 6, 2019 at 2:24 AM Francesca Palombini wrote: > Hi Daniel, > > > > You missed my request to present ace-key-groupcomm and > coap-pubsub-profile. I=E2=80=99d need 15 minutes for the first and 10 for= the > second. > > > > Thanks, > > Francesca > > > > *From: *Ace on behalf of Daniel Migault > > *Date: *Tuesday, 5 November 2019 at 22:03 > *To: *Cigdem Sengul > *Cc: *Ace Wg , Daniel Migault 40ericsson.com@dmarc.ietf.org> > *Subject: *Re: [Ace] ACE@IETF106 - agenda items and presentations > > > > Thanks for the feed back, please find the current agneda below: > > > > https://datatracker.ietf.org/doc/agenda-106-ace/ > > > > Yours, > > Daniel > > > > On Tue, Nov 5, 2019 at 6:38 AM Cigdem Sengul > wrote: > > Hello Jim and Daniel, > > > > I would like 10 minutes in the agenda to present the updates we made to > the: > > https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ > > > > I will be presenting remotely. > > > > Thanks, > > --Cigdem > > > > On Thu, Oct 31, 2019 at 6:27 PM Daniel Migault 40ericsson..com@dmarc.ietf.org <40ericsson.com@dmarc.ietf.org>> wrote: > > Hi, > > > > The ACE WG is meeting at the IETF 106 Tuesday November 19 15:20-16:50 . > Please let us know if there are topic you would like to present by > Wednesday November 6. Slides are expected to be uploaded by Sunday > November 17. > > > > Please remember the draft deadline is Monday November 4 > > https://datatracker.ietf.org/meeting/106/important-dates/ > > > > Yours, > > Jim and Daniel > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --0000000000008601140596ae2f39 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

Please find the provisional= =C2=A0agenda .Let us know if there are any preferred=C2=A0order or if anyth= ing is missing.=C2=A0

Yours,=C2=A0
Danie= l

* Welcome, Notewell, Bluesheets, Agenda bashing:= 5 min
* Current Drafts:
=C2=A0 * draft-ietf-ace-mqtt-tls-prof= ile (10 min)
=C2=A0 * draft-tiloca-ace-revoked-token-notification (10 mi= n)
=C2=A0 * draft-ace-key-groupcomm (15 min)
=C2=A0 * draft-ietf-ace-= key-groupcomm-oscore-03 (10 min)
=C2=A0 * draft-tiloca-ace-oscore-gm-adm= in (10 min)
=C2=A0 * draft-tiloca-ace-group-oscore-profile-01 (15 min)=C2=A0 * draft-palombini-ace-coap-pubsub-profile (10 min)
<= br>

On Wed, Nov 6, 2019 at 2:24 AM Francesca Palombini <francesca.p= alombini=3D40ericsson.com@= dmarc.ietf.org> wrote:

Hi Daniel,

=C2=A0

You missed my request to present ace-key-group= comm and coap-pubsub-profile. I=E2=80=99d need 15 minutes for the first and= 10 for the second.

=C2=A0

Thanks,

Francesca

=C2=A0

From: = Ace <ace-bounces@ietf.org> o= n behalf of Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.org&g= t;
Date: Tuesday, 5 November 2019 at 22:03
To: Cigdem Sengul <cigdem.sengul@gmail.com>
Cc: Ace Wg <ace= @ietf.org>, Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.or= g>
Subject: Re: [Ace] ACE@IETF106 - agenda items and presentations

=C2=A0

Thanks for the feed back, please find the current ag= neda below:

=C2=A0

https://datatracker.ietf.org/doc/agenda-106-ace/=

=C2=A0

Yours,=C2=A0

Daniel

=C2=A0

On Tue, Nov 5, 2019 at 6:38 AM Cigdem Sengul <cigdem.sengul@gma= il.com> wrote:

Hello Jim and Daniel,=C2=A0

=C2=A0

I would like 10 minutes in the agenda to present the= updates we made to the:=C2=A0

=C2=A0

I will be presenting remotely.=C2=A0

=C2=A0

Thanks,

--Cigdem=C2=A0

=C2=A0

On Thu, Oct 31, 2019 at 6:27 PM Daniel Migault <d= aniel.migault=3D40ericsson..com@dmarc.ietf.org> wrote:

Hi,

=C2=A0

The ACE WG is meeting at the IE= TF 106 Tuesday November 19 15:20-16:50 . Please let us know if there are to= pic you would like to present by Wednesday November 6. Slides are expected to be uploaded by =C2=A0Sunday November 17. =

=C2=A0

Please remember the draft deadl= ine is Monday November 4

https://datatracke= r.ietf.org/meeting/106/important-dates/

=C2=A0

Yours,

Jim and Daniel

=C2=A0

_______________________________________________
Ace mailing list
Ace@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--0000000000008601140596ae2f39-- From nobody Wed Nov 6 12:46:21 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 419B01200FF for ; Wed, 6 Nov 2019 12:46:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TQ7umuF9r9Wt for ; Wed, 6 Nov 2019 12:46:16 -0800 (PST) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640093.outbound.protection.outlook.com [40.107.64.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79A561200FE for ; Wed, 6 Nov 2019 12:46:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qzs3ijmMz35W9AbfjRiLuPs9EoCRBafL1QgvkRioQ+gjfaWh/FKf//NB4/PIUaxqgyS7NWiRX/r/pZlgva1hP0EoosidO2YF/mMeuUNnTBAMk+5uW/oolLkJJMP8wDgB/T8Xsa/Aq7gDbBo2R65iQiw0cZ5BYB/Yo/vvhzIt+pzGMZASMjBIrKyYS2l3pn1N6Or8sBwq4Ty27NQXjycPs8wHGnqgHt1MEP8FC3mhmMeUUcuhzcWBbYrYsjXtpMv+ZCEZzq2iNFCgUhuyUQGgQZHSqv80R9BHk0xtxn/LLGxTA7cEgVulmERq7ouPF7tA6yW8c2SCmA4hyx7O8lItOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9wqeW2SsydZC0l+awrgIcpVbg+5ASvsuTpmTV+E5EZw=; b=f0j0waRxgPA1YSAb+3nL2tLTAhc8/Es8fgvqcuhuTCJI6MtTsmshC2ohSccjJgz5KjpXQU2G0J+og/oXb2voDNfCb+eK77R2CyGnJCWUupkpnKDJ4ucahruITtknfDAf7zLpCv/61TZZCe+6bliOrcHsW6dkE8fULnzFXsEoYMcNX5/QGzTYY/d3RdqQjhQt9z4z65pHd5N2vv/lkzWXr+TIF7droEbL5+l4tPKznsfcSt2DKL9tLp4L4mMHr/V6uBtsPi0rXFhRSDq35Qe3dtHyVGcaaY7N6SaXYSV03mnpcgRr4v1MUmK8h9XhHq7W2TGzFjXdsdh51ZVFQYfboQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9wqeW2SsydZC0l+awrgIcpVbg+5ASvsuTpmTV+E5EZw=; b=XFlj2aphGrY114zZu8zpjkPkpMA0yHkNb0G6J6uTmxYkDDPkKGzsiG+BnBzu1iIaLsoVNUj0gBtZ3UnlxAespuu+ddvf8h2+SMsmYJQhy1k1qTM3750gq8YwTe6dIlyvuhQqZMIGxY4+rq26EdGSbUxjUnv419MDLx1IgJ/mB8Y= Received: from DM6PR00MB0572.namprd00.prod.outlook.com (20.179.51.15) by DM6PR00MB0602.namprd00.prod.outlook.com (20.179.48.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2459.0; Wed, 6 Nov 2019 20:46:14 +0000 Received: from DM6PR00MB0572.namprd00.prod.outlook.com ([fe80::b4e1:8a58:2eb1:47bd]) by DM6PR00MB0572.namprd00.prod.outlook.com ([fe80::b4e1:8a58:2eb1:47bd%9]) with mapi id 15.20.2470.000; Wed, 6 Nov 2019 20:46:14 +0000 From: Mike Jones To: "ace@ietf.org" Thread-Topic: Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) sent to the RFC Editor Thread-Index: AdWU4PnNllWolbDFT0KN+/ogJy3Utw== Date: Wed, 6 Nov 2019 20:46:14 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=4921961f-3b77-4a8e-915a-00007e9dc23d; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-11-06T20:27:00Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [131.107.159.141] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 5e512605-4546-433a-6f4e-08d762fa5d7c x-ms-traffictypediagnostic: DM6PR00MB0602: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(136003)(396003)(366004)(346002)(39860400002)(189003)(199004)(2501003)(66946007)(5660300002)(2906002)(9686003)(86362001)(7736002)(54896002)(478600001)(316002)(99286004)(606006)(76116006)(71200400001)(71190400001)(6306002)(236005)(55016002)(14444005)(10090500001)(476003)(21615005)(256004)(486006)(2351001)(52536014)(102836004)(6506007)(26005)(790700001)(74316002)(6116002)(6916009)(10290500003)(186003)(66066001)(66476007)(25786009)(6436002)(66556008)(966005)(8990500004)(66574012)(64756008)(66446008)(14454004)(22452003)(5640700003)(81166006)(7696005)(81156014)(8936002)(8676002)(3846002)(1730700003)(33656002)(6606295002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR00MB0602; H:DM6PR00MB0572.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: HcV7yAz9u9SWEwO3q0wtFBNWonymCd4aFhWScsIwQap0nnrEdIQZNiNDOx5nqYUI3xIsfZtj+dsw+gxODjutV02c5t9NsluzFLEjGu1BeFzzDGJx63tpIlC7GBgDy5CHQDhnBOpe+Nuwf6RwOr1onX9q/xq1+ydWKR5LDbeu8EHQRmbAOtV1kihO7ozkzM/WiX68XRvTiS9KQtSbO6lQeQvi7kgobJiIYoLw0yKJIHxPzkeHEp9xpGGsFq8HgysSHIAnzx1SSKSz0JM9wSMj7lIksctEOK1c6GKUkSc7lBdQYCMVB/32BSioFKnpQ4nEDRSOSE6trxnMWyXRHw9KgTkJMamXjuT5c59QMfqWXv+/5ZKttn3tvOOQkq2GP7oCvBYH3QwTwoQ1AYX+GwsLvjUYbxXB0K0bfmg3pXOjsZ9pzAEoZxdlfh58N6bcRBXC x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB05726118DA641630978B2A2EF5790DM6PR00MB0572namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5e512605-4546-433a-6f4e-08d762fa5d7c X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Nov 2019 20:46:14.4327 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nK6ZB3tBH9GMkfWZarc2uxPr3iiwOQAgyAMuYH6gW8gmEmCUcqFkdlk1uq3QUIIyD2aAaDmL/ELHg42/7hF0ow== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0602 Archived-At: Subject: [Ace] Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) sent to the RFC Editor X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Nov 2019 20:46:19 -0000 --_000_DM6PR00MB05726118DA641630978B2A2EF5790DM6PR00MB0572namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I'm pleased to report that the Proof-of-Possession Key Semantics for CBOR W= eb Tokens (CWTs) specification is now technically stable and will shortly b= e an RFC - an Internet standard. Specifically, it has now progressed to th= e RFC Editor queue, meaning that the only remaining step before finalizatio= n is editorial due diligence. Thus, implementations can now utilize the dr= aft specification with confidence that that breaking changes will not occur= as it is finalized. The abstract of the specification is: This specification describes how to declare in a CBOR Web Token (CWT) (whic= h is defined by RFC 8392) that the presenter of the CWT possesses a particu= lar proof-of-possession key. Being able to prove possession of a key is als= o sometimes described as being the holder-of-key. This specification provid= es equivalent functionality to "Proof-of-Possession Key Semantics for JSON = Web Tokens (JWTs)" (RFC 7800) but using Concise Binary Object Representatio= n (CBOR) and CWTs rather than JavaScript Object Notation (JSON) and JSON We= b Tokens (JWTs). Thanks to the ACE working group= for completing this important specification. The specification is available at: * https://tools.ietf.org/html/draft-ietf-ace-cwt-proof-of-possession-11 An HTML-formatted version is also available at: * https://self-issued.info/docs/draft-ietf-ace-cwt-proof-of-possession-= 11.html -- Mike P.S. This note was also posted at https://self-issued.info/?p=3D2025 and a= s @selfissued. --_000_DM6PR00MB05726118DA641630978B2A2EF5790DM6PR00MB0572namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I’m pleased to report that the Proof-of-Posses= sion Key Semantics for CBOR Web Tokens (CWTs) specification is now technica= lly stable and will shortly be an RFC – an Internet standard.  S= pecifically, it has now progressed to the RFC Editor queue, meaning that the only remaining step before finalization is editori= al due diligence.  Thus, implementations can now utilize the draft spe= cification with confidence that that breaking changes will not occur as it = is finalized.

 

The abstract of the specification is:

This specification = describes how to declare in a CBOR Web Token (CWT) (which is defined by RFC= 8392) that the presenter of the CWT possesses a particular proof-of-posses= sion key. Being able to prove possession of a key is also sometimes described as being the holder-of-key. This spec= ification provides equivalent functionality to "Proof-of-Possession Ke= y Semantics for JSON Web Tokens (JWTs)" (RFC 7800) but using Concise B= inary Object Representation (CBOR) and CWTs rather than JavaScript Object Notation (JSON) and JSON Web Tokens (JWTs).<= o:p>

 

Thanks to the ACE working group for completing this important specification.

 

The specification is available at:

 

An HTML-formatted version is also available at:=

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;        -- Mike

 

P.S.  This note was also posted at https://self-issued.info/?p=3D2025 and as @selfissued.

 

--_000_DM6PR00MB05726118DA641630978B2A2EF5790DM6PR00MB0572namp_-- From nobody Thu Nov 7 17:33:26 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E13812004A; Thu, 7 Nov 2019 17:33:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fdiN_zD1bVza; Thu, 7 Nov 2019 17:33:21 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD14A120018; Thu, 7 Nov 2019 17:33:20 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 7 Nov 2019 17:33:14 -0800 From: Jim Schaad To: CC: Date: Thu, 7 Nov 2019 17:33:12 -0800 Message-ID: <036f01d595d4$7daa8430$78ff8c90$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdWVtirQbQgNKFTfQpqJHRwtDOl7Qg== X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Review for draft-ietf-ace-key-groupcomm-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Nov 2019 01:33:24 -0000 This is a review based just on reading through the document. Comments based on trying to implement after some time. After reading this, you have started down the path of being RESTful, but you are definitely not there yet. You need to examine statements like "GET method is safe, meaning that applying it to a resource does not result in a state change of the resource". 1. In section 4 - The new format name is backwards - the "+cbor" goes on the end not the front. If you are defining a CBOR number/JSON name mapping that is unique for this then a new content type would be indicated. 2. In section 4.1.2.2: It I not clear to me why an unauthenticated version of this would be to return the group parameters, assuming that such are public. The assumption of public would come from the fact that it is returned from the POST of the token where it is returned. 3. In section 4.1 - I understand that "gid" in the paths is going to be a group specific identifier. It is not clear to me if "node" in the path is also going to be a per registered node or a single node. This may be left over from what I remember in Montreal. 4. In Section 4.1.2.1 - 'get_pub_keys' - This text appears to imply that the client knows a priori if the KDC is going to store the keys. It implies that if the KDC does not store them, then it might be considered an error to include this key. 5. In Section 4.1.2.1 - 'client_cred' - should this text be altered to reflect the concept of a monitoring node that would never respond? 6. In Section 4.1.2.1 - 'client_cred_verify' - where does N_S come from in the event that the token is used directly to validate in TLS rather than being posted. 7. In Section 4.1.2.1 - 'pub_keys_repos' - It is not clear to me if the URI includes some type of query parameter to map to the certificate rather than just being the URI of the repository itself. 8. In Section 4.1.2.1 - 'num' - Is this field ever allowed to be reset to zero by the KDC? 9. In Section 4.1.2.1 - 'kty' - I would suggest renaming this to 'gkty' to avoid confusion with the same field used for COSE and JOSE keys. 10. In Section 4.1.2.1 - 'mgt_key_material' - I think a better set of requirements is MUST say if it is used, if used then MUST be specified. 11. In section 4.1.3.1 - This seems to be better reflected as a FETCH rather than a POST operation. 12. In Section 4.1.3.1 - I don't understand the requirement for the 'get_pub_keys' value has to be non-empty. Is there any reason not to say that empty equals all? Alternatively it could be a return nothing answer but not an error. 13. In Section 4.1.6.1 - It is not clear how I am identifying the "client" to be removed. Can I do a third party removal? 14. In Section 4.1.6.2 - Is this supposed to return new keying material or the current keying material. 15. In Section 4.3 - I am not sure why I would be observing /ace-group/gid rather than /ace-group/gid/node in order to get updated keying material. I don't know that I would want to get all of the public keys when it rolls over. Alternatively, I would observer /ace-group/gid/ctx-num for the same purpose. 16. Section 4.4 - It seems odd to use GET for the purpose of renewing key material. From nobody Sat Nov 9 19:29:02 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C8AE120227; Sat, 9 Nov 2019 19:29:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iyDqvni1yT5y; Sat, 9 Nov 2019 19:28:57 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7432F1200FB; Sat, 9 Nov 2019 19:28:57 -0800 (PST) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAA3Sqnb006061 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 9 Nov 2019 22:28:54 -0500 Date: Sat, 9 Nov 2019 19:28:51 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: draft-ietf-ace-oauth-authz.all@ietf.org, ace@ietf.org Message-ID: <20191110032851.GW47216@kduck.mit.edu> References: <20190927015154.GY6424@kduck.mit.edu> <696c7ee4-75f9-48ec-8837-ea171137e9f8@ri.se> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <696c7ee4-75f9-48ec-8837-ea171137e9f8@ri.se> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-authz-24 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Nov 2019 03:29:01 -0000 (This is still "in backwards order" (per https://mailarchive.ietf.org/arch/msg/ace/qy9wQX04zkLS3n4BHS0GxKKi1XM) albeit with a much-longer-than-planned delay...) On Tue, Oct 15, 2019 at 04:07:48PM +0200, Ludwig Seitz wrote: > Hello Ben, > > thank you for your thorough review. > > I have taken the liberty to add numbers to your comments in order to > refer to them in a easier way. > > I have fixed 93 your 113 and there are 20 left where I am asking for > clarifications. These are: > > 6.), 12.), 16.), 19.), 34.), 39.), 41.), 45.), 52.), 57.), 58.), 65.), > 66.), 68.), 76.), 78.), 79.), 88.), 99.), 111.) Thank you for the numbering; that should help with keeping track of things. I will try to trim the no-clarification-needed ones from this note. > > Note that 39.) Requires input from OAuth experts. Hannes? > > If you whish to inspect the changes made on other review issues, please > consult the commits here: > https://github.com/ace-wg/ace-oauth/commits/master > > > Detailed comments below. > > /Ludwig > > > > > Hi all, > > > > The length of this review notwithstanding, this document is generally in > > good shape -- there's a bunch of localized items to tighten up, and we > > can flesh out the security considerations some more, but nothing too > > drastic should be needed. > > > > 1.) > > Perhaps the most far-reaching changes needed > > will be to rename the "profile" claim, since that has already been > > allocated to OIDC Core for a very different usage. > > [LS] FIXED. I renamed the "profile" claim and parameters to "ace_profile" > Note that this will require changes in all of the profile drafts as well. Indeed. It would be great if someone (the chairs? Other volunteers are surely welcome) could make a list of changes that affect the profile documents, and make a pass over each in turn to find the affected areas. > > 6.) > > Section 1 > > > > Authorization is the process for granting approval to an entity to > > access a resource [RFC4949]. The authorization task itself can best > > be described as granting access to a requesting client, for a > > resource hosted on a device, the resource server (RS). This exchange > > > > I had to pause for a while after reading this and ponder whether I > > agreed with it. I think that my reticence stems from some friction > > between the most generic abstract definition of "resource" and a more > > specific one used in the web/HTTP world and, to a lesser extent, the > > world of URIs and URNs in general. The resources we are discussing here > > are not always specific named resources, but can also refer to > > attributes or capabilities mediated by a RS; similarly, we may be > > creating/modifying named resources as part of the resource access > > performed by a client in the OAuth model. I don't think it's wise to > > diverge from the RFC 4949 definition just yet, but am still considering > > whether adding some additional clarifying text here is worthwhile. > > [LS] I would argue that this specification is applicable even to the wider > definition of "resource" that you are thinking of. Since OAuth 2.0 leaves Oh, I agree, and was not intending to say otherwise with my comments above. Rather, I was considering that some [other] readers might see the word "resource" and go straight to "web resource named by URI", and wondering if we could reword slightly to avoid that. > the definition of "scope" up to the specific applications, and the ACE > framework does not change this, we can deal with both web/HTTP/CoAP > resources > (named by URIs or URNs) and any other type of resources where the > application > can map the resource in question to a set of scopes. > I am therefore inclined to say that this section is fine, but I'd be glad to > hear the result of your considerations on that matter. I see three potential options so far: (1) no change (2) in the first sentence, s/resource/generic resource/ (3) add a new sentence as the third sentence, similar to "This resource might be a Web or similar resource addressed by URI, but in general can be a more generic or abstract resource provided by the RS". I'm happy to advance the document with any of those three (and probably with other versions, if any arise). > > 12.) > > A refresh token in OAuth 2.0 is a string representing the > > authorization granted to the client by the resource owner. The > > string is usually opaque to the client. The token denotes an > > > > Apparently I'd forgotten that this couldn't be binary. > > [LS] From RFC 6749, section 1.5: "A refresh token is a string ..." > No qualifiers such as "binary" so I interpret this to mean a text-string. > Do you want us to add some clarification? [this is handled in the other thread] > > 16.) > > Section 3.2 > > > > One application of COSE is OSCORE [I-D.ietf-core-object-security], > > which provides end-to-end confidentiality, integrity and replay > > protection, and a secure binding between CoAP request and response > > messages. In OSCORE, the CoAP messages are wrapped in COSE objects > > and sent using CoAP. > > > > This framework RECOMMENDS the use of CoAP as replacement for HTTP for > > use in constrained environments. > > > > Do we have a reason to mention OSCORE if we're not going to make a > > recommendation about its use? > > [LS] We also mention DTLS and TLS without making any recommendation about > which to use. I would suggest to either remove all of it or to add a > sentence > noting that this is an enumeration of some security options, and the choice > depends on the specific application scenario. Adding a sentence feels like a slightly better option to me, though it could easily go either way. > > 19.) > > Section 5 > > > > Credential Provisioning > > For IoT, it cannot be assumed that the client and RS are part of a > > common key infrastructure, so the AS provisions credentials or > > associated information to allow mutual authentication. These > > credentials need to be provided to the parties before or during > > the authentication protocol is executed, and may be re-used for > > subsequent token requests. > > > > nit: either "before or during the execution of the authentication > > protocol" or "before or during the authentication protocol's execution". > > And just to double-check that we mean the authentication protocol of > > provisioning in the last sentence, not the authorization protocol that > > occurs between the client and RS. > > [LS] The whole last sentence was a bit off. I would suggest: > "The resulting security association between client and RS may then be > re-used > by binding these credentials to additional access tokens." Does that > sound better? That definitely reads more coherently, yes. It makes implicit the fact that there is an authentication protocol that gets run, which is probably okay, and I'm not sure whether "additional" is quite in line with the way the previous sentence is formulated. (Maybe it makes more sense in context, which I don't have in front of me right now.) > > 32.) > > Section 5.6.1 > > > > The client sends a POST request to the token endpoint at the AS. The > > profile MUST specify how the communication is protected. The content > > > > In the previous section we said that maybe even other transports than > > coaps or https would be possible; are we limited to those that have POST > > verbs? > > Also, a similar comment as above about what attributes the protection > > entails seems to apply. > > [LS] This will need a major rephrasing of the text. > I see two options here: > > 1.) We rewrite all parts to use a neutral language in general and specify > POST/GET etc. for transports that have these verbs. > > 2.) We state in the beginning that transports that do not use RESTful verbs > should use the best equivalent. > > Option 1. would get a bit cluncky, while option 2. might be a bit confusing > Do you have a specific preference? [this is covered in the other thread, I think] > > 34.) > > o A client MUST be able to use the parameters from > > [I-D.ietf-ace-oauth-params] in an access token request to the > > token endpoint and the AS MUST be able to process these additional > > parameters. > > > > [we might get someone complaining that if support for these is mandatory > > they might as well be in the core document. I don't mind the split, but > > be forewarned.] > > [LS] The split came to pass since some parameters were expected to become > obsolete with some ongoing OAuth work and we wanted to have a document that > was independent from the core that could be overridden. > I'm not sure this still applies, since the main culprit was the "resource" > parameter defined in OAuth-resource-indicators. The remaining "req_cnf" > parameter for requesting specific confirmation claims might become > obsolete if > the OAuth WG takes up their PoP work again. Thanks for the extra background here; it seems like we should leave it as-is for now. > > 37.) > > > > Figure 7 shows a request for a token where a previously communicated > > proof-of-possession key is only referenced. Note that the client > > performs a password based authentication in this example by > > submitting its client_secret (see Section 2.3.1 of [RFC6749]). Note > > > > RFC 6749 says about the bare "client_secret" that "[i]ncluding the > > client credentials in the request-body using the two parameters is NOT > > RECOMMENDED and SHOULD be limited to clients unable to directly utilize > > the HTTP Basic authentication scheme (or other password-based HTTP > > authentication schemes)." I know this is "just an example", so our > > obligations are somewhat weak, but I still think we should note that > > this is not recommended by 6749 (but since there is no CoAP analogue of > > HTTP Basic, it's the only plain-password scheme available). > > [LS] My take is to modify this example and remove the client_secret part. > It feels wrong to use NOT RECOMMENDED stuff, even if it only is an example. Thanks! > > 39.) > > Refresh tokens are typically not stored as securely as proof-of- > > possession keys in requesting clients. Proof-of-possession based > > refresh token requests MUST NOT request different proof-of-possession > > keys or different audiences in token requests. Refresh token > > requests can only use to request access tokens bound to the same > > proof-of-possession key and the same audience as access tokens issued > > in the initial token request. > > > > This is perhaps something of a philosophical question, but if a refresh > > token is only usable at the token endpoint, in some sense its audience > > is definitionally the AS. So there's a little bit of a mismatch in > > treating it as having the audience value that the access tokens issued > > from it will have. I don't know the background for audience-restriced > > refresh tokens in regular OAuth 2.0, though, so hopefully someone can > > educate me. > > [LS] I'm equally confused. I suggest that Hannes or one of the other OAuth > experts give us a hint on that one. [We had some stab at this in the other thread, but additional input might still be in order] > > 40.) > > Section 5.6.2 > > > > Note that the AS decides which token type and profile to use when > > issuing a successful response. It is assumed that the AS has prior > > > > Would it be useful to note that this can be shaped by the "req_cnf" > > contents? > > [LS] I don't think token type would be affected by the requested > confirmation > key format. The selected profile however may well be. A note to this > effect has > been added. I may have been thinking that if "req_cnf" was absent, then we might not get a pop token at all. Thanks for thinking about this some more; I trust your conclusion. > > > > 41.) > > token_type: > > This parameter is OPTIONAL, as opposed to 'required' in [RFC6749]. > > By default implementations of this framework SHOULD assume that > > the token_type is "pop". If a specific use case requires another > > token_type (e.g., "Bearer") to be used then this parameter is > > REQUIRED. > > > > When we are "weakening" the formal requirements of the parent spec like > > this, we should be careful about what happens when someone is trying to > > use the ACE stuff but ends up needing to go over HTTPS like traditional > > OAuth -- do they have to fall back to the OAuth required behavior in > > that case or are we trying to preempt that as well? > > [LS] The use case here is a constrained connection between client and AS > (e.g. due to a constrained client), where we try to save the bytes for > sending a token_type by defining a default. I would guess that a HTTPS based > connection would not have such constraints and would therefore be able > to send > the token_type = "pop" as required by RFC6749. Should we explain this > somewhere > and describe the cases where RFC6749 behaviour is warranted? [this is covered in the other thread] > > 45.) > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > > MUST be used for all error responses, except for invalid_client > > where a response code equivalent to the CoAP code 4.01 > > (Unauthorized) MAY be used under the same conditions as specified > > in Section 5.2 of [RFC6749]. > > > > 6749 has a case where 401 MUST be used, but I think it does not apply to > > us (since WWW-Authenticate would have to have been used). I'm not sure > > whether it makes sense to note that or not, though. > > [LS] The 401 in 6749 is the invalid_client case. For CoAP a 4.01 is also > allowed (MAY) instead of 4.00 if this is warranted. I do not believe further > action is warranted at this point. Do you agree? Yes. (Thank you for thinking about it!) > > 52.) > > Section 5.7.4 > > > > "scope" is showing up with the key 9 a lot; I have mixed feelings about > > having the CBOR map key value be aliased across different contexts (but > > it's probably too late to change without disruption anyway). > > [LS] Scope is used in 4 places: > > I. AS Request Creation Hints > II. /token request and response parameter > III. CWT claim > IV. /introspection response parameter > > I claim that in all 4 cases we expect the same content with the same > formatting and semantics: I. tells the client what to put into II. > which in turn informs the AS about the requested claim value in III. > and IV. is supposed to reflect that claim value. I therefore don't feel > hesitant to use the same abbreviation for all four cases. > Is that acceptable or do you whish us to perform any action on this? [we covered this in the other thread] > > 53.) > > Section 5.8 > > > > In order to facilitate offline processing of access tokens, this > > document uses the "cnf" claim from > > [I-D.ietf-ace-cwt-proof-of-possession] and specifies the "scope" > > claim for JWT- and CWT-encoded tokens. > > > > [looks like draft-ietf-oauth-token-exchange is going to beat us for the > > JWT version of "scope": > > https://www.iana.org/assignments/jwt/jwt.xhtml#claims ] > > [LS] Agree, I will change the whole document to refer to this registration > instead. Life punishes those who come too late. And those reliant on people who come too late, mea culpa. > > 57.) Whoops, trimmed to fast, but that's a fine explanation; thanks. > > 58.) > > Profiles MUST specify whether the authz-info endpoint is protected, > > including whether error responses from this endpoint are protected. > > Note that since the token contains information that allow the client > > and the RS to establish a security context in the first place, mutual > > authentication may not be possible at this point. > > > > We'll need some careful reasoning about this for the security > > considerations, since the authz-info transaction can impact what profile > > the RS thinks is in use. E.g., whether a network attacker could > > cause the client to think that a different (vulnerable) profile is in > > use than the one the RS expects to use. > > [LS] Noted. Do you think the reasoning in section 6.5 needs to be extended? I think we should add some more text, yes. Specifically, we should mention that the authz-info interaction can affect what profile RS will use (e.g., via "ace_profile"), and that profile developers should be conscious of the risk of downgrade attacks that involve other profile types. (Am I reading this right that the client will know what profile to use by the time it is ready to post to the authz-info endpoint and that the response will not change what profile the client uses? Specifically, even if a client supports multiple profiles that use different methods for token transport, a client is not going to try one method/profile and then fall back to a different one if the first one (transiently) fails?) > > 65.) > > specification defines the following approach: The claim "exi" > > ("expires in") can be used, to provide the RS with the lifetime of > > the token in seconds from the time the RS first receives the > > token. This approach is of course vulnerable to malicious clients > > holding back tokens they do not want to expire. Such an attack > > > > It also has suboptimal behavior if the RS loses state (e.g., by > > rebooting), and possibly requires the RS to store indefinitely all > > tokens with an "exi" value. I have mixed feelings about specifying it > > at all, though I concede it probably does have some value. Regardless, > > I think a dedicated subsection in the security considerations is in > > order. > > [LS] We wanted to provide some solution for expiring tokens for RSes > that have > no connectivity and no synchronized clocks. Using the "exp" claim in > such cases > would have pretty unpredictable results. > I have extended section 6.3 in the security considerations to go into > the detail > of "exi", please have a look if this covers the necessary issues. I think we should also say something about the amount of such persistent storage potentially growing without bound, as those counters (or some similar indication) are the only thing that will cause the RS to reject tokens that have been used the requisite number of times. So, RS state requirements grows with the number of 'exi'-bearing tokens that are issued for them. I suppose a bloom filter might be a way out, though... > > 66.) > > Section 5.8.4 > > > > The AS provides the client with key material that the RS uses. This > > can either be a common symmetric pop-key, or an asymmetric key used > > by the RS to authenticate towards the client. Since there is no > > > > Can you walk me through how a symmetric PoP key would be used for mutual > > authentication (i.e., authentication of RS to client)? It's easy/common > > to do the PoP the other way, making the client prove it knows the key > > associated with the token, but the other direction is not always > > possible, depending on the protocol. > > [LS] The reasoning is that if both client and RS perform a > proof-of-possession of > the symmetric PoP key to each other, they can be considered to be mutually > authenticated, under the provision that no other parties (except for the > AS) have > access to said key. My understanding is that e.g. DTLS-PSK provides > this kind of > guarantee. Do you want us to clarify this reasoning in the document? Ah, right, of course. I must have been stuck in some in-band-token-delivery mindset when reading this and was thinking too narrowly. > > 68.) > > o The client performs an introspection of the token. Although this > > is not explicitly forbidden, how exactly a client does > > introspection is not currently specified for OAuth. > > > > I'm pretty sure this is overtaken by events (sorry for my part in > > that!). E.g., draft-ietf-oauth-jwt-introspection-response discusses > > clients doing introspection, and even RFC 7662 itself discusses using a > > client secret to authenticate to the introspection endpoint. I think > > there's another document between those two that's also relevant, but > > can't find it right now > > [LS] I am not so sure. When reading the fine print in both RFC 7662 and > draft-ietf-oauth-jwt-introspection-response, I find that when they mention > the term "client", they refer to the protected resource / RS as being a > client of > the AS introspection endpoint. A client holding an access token and > performing introspection is never explicitly mentioned in both > documents, to my best > knowledge. It seems like we should try to check on this in Singapore, while the usual suspects are easily at hand. > > 69.) > > Section 6 > > > > There could perhaps be some security considerations relating to > > discovery of RSes/resources thereon, but since we don't really talk > > about that much to begin with, it's probably okay to skip the security > > considerations discussion as well. > > [LS] Noted. I opt to skip this for the time being. If it comes up in the > IESG > review we can revisit this issue. Okay. > > 72.) > > A large range of threats can be mitigated by protecting the contents > > of the access token by using a digital signature or a keyed message > > digest (MAC) or an Authenticated Encryption with Associated Data > > > > I won't be surprised if someone asks for examples of that "large range > > of threats", so be prepared to answer... > > [LS] Noted. I take it that no action is required here at this point. Right. > > 76.) > > It is important for the authorization server to include the identity > > of the intended recipient (the audience), typically a single resource > > server (or a list of resource servers), in the token. Using a single > > shared secret with multiple resource servers to simplify key > > management is NOT RECOMMENDED since the benefit from using the proof- > > of-possession concept is significantly reduced. > > > > I think we should word this more clearly with respect to "single shared > > secret" -- is this the credential used by the RS to authenticate itself > > to the client? I'm not even sure if this text is intended to be > > describing a workflow using symmetric or asymmetric keys. > > [LS] I added some clarification. Can you double-check that this makes > more sense? It does, thank you. (Though rereading it does make me wonder whether anyone would be foolish enough to use the same symmetric PoP secret for multiple clients with the same RS...) > > 78.) > > Section 6.1 > > > > I think we should have a little bit more discussion about what attacks > > are possible even when a client hard-codes a list of trustworthy ASes, > > e.g., when a device in one AS's purview is compromised and tries to get > > the client to use a different (possibly also compromised, or maybe just > > buggy) AS than the one that's supposed to be responsible for the device > > in question. In short, yes, spoofing is only possible within that set > > of trusted ASes, but spoofing can still cause problems. > > [LS] I have added some text in section 6.4 Please have a look if this > covers what you were aiming at. That's pretty good, thanks! I'd prefer to also have (in the second sentence of the second paragraph) a mention about what an AS (in the hard-coded list) would do when receiving the incorrect request from the misdirected client, though. (Also, nit, s/ redentials/ credentials/) > > 79.) > > Are there any AS parameters other than URI that might be useful for an > > out-of-band-configured list of valid values? > > [LS] One might want to include the public key or certificate of the AS. > Do you want us to expand this section to include such parameters? I'd consider adding another sentence like "Information used to authenticate the AS, such as a public key or certificate fingerprint, might be provisioned alongside an AS's URI, depending on the deployment scenario". What do you think? > > 88.) > > Section 8.3 > > > > Name The OAuth Error Code name, refers to the name in Section 5.2. > > of [RFC6749], e.g., "invalid_request". > > > > We should refer to the OAuth registry as the authority on names, not the > > immutable RFC. (Similarly for the other mappings registries; I won't > > repeat it each time, though for the later ones we're already doing the > > right thing.) > > [LS] This is interesting. The referenced section (5.2 of RFC6749) is not > mirrored in any IANA registry. I have put the question to the OAuth WG. IIRC, you filed https://www.rfc-editor.org/errata/eid5873 for this and I submitted a registration request at https://mailarchive.ietf.org/arch/msg/oauth-ext-review/4WaM6n6JetFsLI6_T9S8wNVqP74 . It's been more than two weeks, so I should follow up there... > > 97.) > > Section 10.1 > > > > We may get some debate about whether IANA registries are properly > > Normative of Informative references, but we can wait for that to happen > > -- no need to do anything now. > > [LS] Noted. Does the AD have a position on this? I think there's a reasonable argument for keeping them as normative. We probably see them as informative more often (in general), though, probably because people are concerned about having downrefs to something that's not a standards-track RFC (which would happen due to a misunderstanding of the rules surrounding downrefs, IMO). > > 98.) > > Section 10.2 > > > > If we're using RFC 4949 for terminology definitions, I think that makes > > it a normative reference. > > > > If we REQUIRE CBOR when used with CoAP, that also feels like a normative > > reference. > > > > I also think 7519 needs to be normative, since we mandate some of its > > processing rules. > > [LS] RFC 4949 is informational, so it cannot be normative. I would argue > that we are just using it to clarify the meaning of our terminology. It's okay to have a normative reference to an informational document; we just need to call it out in the IETF LC announcement (which the tooling/secretariat should take care of "automagically"). Furthermore, RFC 4949 is already listed at https://datatracker.ietf.org/doc/downref/ as an "acceptable downref", so we don't even have to do that, in this case. > I agree with the other two and have FIXED that. > > > > 99.) > > Appendix A > > > > Proof-of-Possession: > > > > This framework makes use of proof-of-possession tokens, using the > > "cnf" claim [I-D.ietf-ace-cwt-proof-of-possession]. A > > semantically and syntactically identical request and response > > parameter is defined for the token endpoint, to allow requesting > > and stating confirmation keys. This aims at making token theft > > > > nit: the wording here is a little weird in terms of specifying what is > > identical. I'm not sure I have a great suggestion for improvement, > > though; what I'm coming up with is a lot more words. > > [LS] How about: > A request parameter "cnf" and a Response parameter "cnf", both having a > value space semantically and syntactically identical to the "cnf" > claim, are defined for the token endpoint, to allow requesting and > stating confirmation keys. That ... works quite well. Thank you! > > 111.) > > an access token as an opaque string, which it can match to the > > specific client, a targeted audience and a symmetric key. The > > > > So we're handing out a symmetric PoP key for a long-lived token that may > > be used at multiple resources? Isn't that the example we gave earlier > > that lets RSes impersonate the client to each other? > > [LS] Since the doors (RSs) are all part of the same system we assume > that this is not a issue here. I added some explanatory text to clarify > these > assumptions. Do you deem this acceptable? It's good enough for me, yes (and thank you). I can't guarantee that Roman won't want more changes, though :) > > Side note: If we used asymmetric pop keys instead, we would either have > to provision all the doors' keys to the client up-front, or define a whole > new protocol (which we initially tried with the "clientToken" concept, > but later dropped) that provides the client with the RS's public key > during the > token POST or access attempt. That does sound unpleasant... If you want to get a new revision up to make these last few changes during the blackout period, I'm happy to approve a manual posting by the secretariat. (OTOH, since IETF LCs that overlap with the meeting week get extended automatically, it wouldn't necessarily get the document on an IESG telechat any sooner.) Thanks for all the updates and detailed discussion! -Ben From nobody Tue Nov 12 15:06:16 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B0F212008D; Tue, 12 Nov 2019 15:06:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZK2ay0mxsd3Q; Tue, 12 Nov 2019 15:06:12 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7D89120018; Tue, 12 Nov 2019 15:06:08 -0800 (PST) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xACN6152009588 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 12 Nov 2019 18:06:03 -0500 Date: Tue, 12 Nov 2019 15:06:00 -0800 From: Benjamin Kaduk To: "Panos Kampanakis (pkampana)" Cc: Yaron Sheffer , "draft-ietf-ace-coap-est.all@ietf.org" , "ace@ietf.org" Message-ID: <20191112230600.GJ32847@kduck.mit.edu> References: <157097172245.20767.1326966836276837764@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] Secdir last call review of draft-ietf-ace-coap-est-15 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Nov 2019 23:06:14 -0000 Hi Panos, On Wed, Oct 16, 2019 at 03:06:01PM +0000, Panos Kampanakis (pkampana) wrote: > Hi Yaron, > > Thank you for the thorough review and feedback. > > To make sure I don't miss any of your comments over an email thread, I track all your feedback in git issue 152 https://github.com/SanKumar2015/EST-coaps/issues/152 There I tried to address all your comments and question and clarify some points. > > I also pushed minor changes to fix a few of the issues you brought up. The diff of the changes pushed is here https://github.com/SanKumar2015/EST-coaps/commit/86d785f2122596f28674fe8e403d30467c98abfb > > Please review the git issue and let us know if there are pending concerns. Otherwise I am planning to reupload a new iteration next week. Thanks for uploading the -16, and thanks again to Yaron for the very thoughtful review. Sadly, I seem to have not looked at the github diff closely enough/in a timely fashion, so I think we'll need to publish a -17 before I can move this into IESG evaluation. Here's my remaining notes: Section 4 Private keys can be transported as responses to a server-side key generation request as described in Section 4.4 of [RFC7030] and discussed in Section 5.8 of this document. I think that, since Yaron brought it up, we should say "Section 4.4 of [RFC7030] (and subsections)". curve. After the standardization of [RFC7748], support for Curve25519 will likely be required in the future by (D)TLS Profiles for the Internet of Things [RFC7925]. Sorry I missed this before -- "standardization" is a bit of a bugbear (7748 is Informational, not even Standards-Track, let alone full Internet Standard). In a constrained CoAP environment, endpoints can't always afford to establish a DTLS connection for every EST transaction. Authenticating and negotiating DTLS keys requires resources on low- end endpoints and consumes valuable bandwidth. To alleviate this situation, an EST-coaps DTLS connection MAY remain open for sequential EST transactions. For example, an EST csrattrs request that is followed by a simpleenroll request can use the same authenticated DTLS connection. However, when a cacerts request is I think we can also clarify that this "MAY remain open" is changing expectations from RFC 7030, where the expectation was that the TLS connection did not remain open. Section 10.1 the first DTLS exchange. Alternatively, in a case where a /sen request immediately follows a /crts, a client MAY choose to keep the connection authenticated by the Implicit TA open for efficiency reasons (Section 4). A client that interleaves EST-coaps /crts request with other requests in the same DTLS connection SHOULD revalidate the server certificate chain against the updated Explicit TA from the /crts response before proceeding with the subsequent requests. If the server certificate chain does not authenticate against the database, the client SHOULD close the connection without completing the rest of the requests. The updated Explicit TA MUST continue to be used in new DTLS connections. I think Yaron was saying that "even if the optimization of keeping the DTLS connection open is useful in the general case, it is very risky and prone to misimplementation when combined with /crts". So, if I can rephrase the propsal to be that we say something more like "even though in general the DTLS connection can remain open for efficiency (Section 4), after a /crts response, the client MUST close the DTLS connection and establish a new DTLS connection for subsequent EST exchanges", are there reasons that we shouldn't use that behavior? Thanks, Ben From nobody Wed Nov 13 04:55:56 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16A081208C1; Wed, 13 Nov 2019 04:55:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ya3_aB_Que6X; Wed, 13 Nov 2019 04:55:49 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150073.outbound.protection.outlook.com [40.107.15.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19BE71208A9; Wed, 13 Nov 2019 04:55:49 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DlHcX/7GVvRM5nuAxkzYUVD4hU06j85eGUKZfQcKfMJ8jbCbO2Jq85NSeatCOncCVjDapF6P4nZvFvsq/56wCNwS4AFFSPf0upebyJu2Z4666zSO+efRjzz9qXOqmTmwG3zdxGEFM0oXpvBVT2aczkqJUvh9m9cKjIrE+rYgWYZqknfx9IfwMEllibJ2YntkqB3KVK1XrGIkHxCTUT+5nAY84PJg3rG22WG5OH6eLG7Qg74ONVKVzhTwhR4+3P0MWvbhps4L683EASqACPWPL5LQZ/bffd6K2pTD9vXRcwtTOlu3HVhTjd//07BvU9+8TVomWTYSNzWgXuJ6Vp2dZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iDFMi1iL0UZSkJ0CH3eySBLWE+Ip9io1hDyDmmRJNZM=; b=NDa9MjF4isWeADObSlWugXskn2k1rt7QvqiYwe8T+D85UOZJjFo0JKawJM53LdiwitCry37o3ePxFM+AYhE4mWE57Z3j3BpXjZDxfSHzFUrxsSxSm7ClKa+39EQADpOEHC+LJlfgNlXHgHXP1+DK23WDP/m4MIzQ+qXdgHrSq8DIGnnYMwHMxlcjf6I00kCIhsplUn+BGrrxvZ400zwqDpxSS//HRzE5CveUmJifxN731b7s7igLCIHnSi7zQ4ZfrfnEFqK0waPH5dRL3g3b6Fao1+6T6nBnRGK3vkq0QtttG8mKj2ATLfFO3YiQxFaCSk+CKNQV5vO0wNq83hieUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iDFMi1iL0UZSkJ0CH3eySBLWE+Ip9io1hDyDmmRJNZM=; b=UeFa9/9EKP3VUWwZYNUnwjQGPsVug6CV1X3fnqMvdJIdKmSZ/U+E7hKmnJc8X4UXJC7CP8LZg4Xq8QJEvMibmDus4uD8UIh7rTanc2Iy029mlw9xcXnMGu8hihTEskxKGHc2jc48ZO8YqHIbG5zoNqSigT1cc7qtubLYZ3LU1Pw= Received: from VI1P18901CA0023.EURP189.PROD.OUTLOOK.COM (2603:10a6:801::33) by HE1P189MB0505.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:61::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Wed, 13 Nov 2019 12:55:45 +0000 Received: from HE1EUR02FT004.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::206) by VI1P18901CA0023.outlook.office365.com (2603:10a6:801::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.22 via Frontend Transport; Wed, 13 Nov 2019 12:55:45 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT004.mail.protection.outlook.com (10.152.10.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2451.23 via Frontend Transport; Wed, 13 Nov 2019 12:55:45 +0000 Received: from [10.112.134.122] (10.100.0.158) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Wed, 13 Nov 2019 13:55:44 +0100 To: Benjamin Kaduk CC: , References: <20190927015154.GY6424@kduck.mit.edu> <696c7ee4-75f9-48ec-8837-ea171137e9f8@ri.se> <20191110032851.GW47216@kduck.mit.edu> From: Ludwig Seitz Message-ID: Date: Wed, 13 Nov 2019 13:55:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <20191110032851.GW47216@kduck.mit.edu> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms010201090200090102070400" X-Originating-IP: [10.100.0.158] X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(51444003)(43544003)(199004)(189003)(33964004)(26005)(54906003)(446003)(70206006)(16526019)(476003)(356004)(126002)(235185007)(2171002)(86362001)(8936002)(4326008)(7736002)(6916009)(31686004)(53546011)(44832011)(5660300002)(31696002)(336012)(486006)(58126008)(186003)(11346002)(70586007)(22756006)(305945005)(106002)(30864003)(71190400001)(76176011)(40036005)(2906002)(2616005)(386003)(6246003)(498600001)(65806001)(65956001)(36756003)(8676002)(229853002)(22746008)(6306002)(81166006)(16576012)(81156014)(6116002)(3846002)(568964002)(966005)(5024004)(14444005)(16586007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1P189MB0505; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: cd4d73db-724d-4816-aec7-08d76838cc4a X-MS-TrafficTypeDiagnostic: HE1P189MB0505: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-Forefront-PRVS: 0220D4B98D X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QWIvrOP6vwgGfHLrRtpsOGrDd97v+OuEgRe4fqQHpmEqlAg0BmAkCs4PD1vbmJBhve7PFPg236z2wQIhoQM46HUSojylREBEn3bCFU+ZTHNhxKXXo87UQW9YpUUC7j4aLUXP351YDUjvLW8YwGPhihQnAh6/bWhOJx+M6LUJSzw2DHAiEsINKytsXRDfm140IP9G+++NIVhfKve6Ub2kQPG1MzwfQLZBnEzRntzQZjQIYQsZIBjy0B9mWl0mPrKXRWJOfrQUCwF6WI4dRWRMJlqD4/0UnFh19F4tnsAH7XWcFO6OfdwW/57fA44vBMxE/XZ3S6L2dJtjAXKxDviewif1MvlpODvOex9VkZf470VaD1xD2Et6IC09lqhOdlsthePiyHfKr84LFoY6oGwz53rR79y+63LxsSaqqkrxUnnu9Ck2dr2g7zh8rGK2vFM4 X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Nov 2019 12:55:45.0497 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cd4d73db-724d-4816-aec7-08d76838cc4a X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1P189MB0505 Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-authz-24 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Nov 2019 12:55:54 -0000 --------------ms010201090200090102070400 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 10/11/2019 04:28, Benjamin Kaduk wrote: >>> 1.) >>> Perhaps the most far-reaching changes needed >>> will be to rename the "profile" claim, since that has already been >>> allocated to OIDC Core for a very different usage. >> >> [LS] FIXED. I renamed the "profile" claim and parameters to "ace_profi= le" >> Note that this will require changes in all of the profile drafts as we= ll. >=20 > Indeed. It would be great if someone (the chairs? Other volunteers are= > surely welcome) could make a list of changes that affect the profile > documents, and make a pass over each in turn to find the affected areas= =2E >=20 Mostly a search and replace of "profile" with "ace_profile" would be in=20 order, perhaps with a subsequent proof reading that nothing was borked=20 up in the process. I can do this, but sadly not before IETF. >>> 6.) >>> Section 1 >>> >>> Authorization is the process for granting approval to an entity t= o >>> access a resource [RFC4949]. The authorization task itself can b= est >>> be described as granting access to a requesting client, for a >>> resource hosted on a device, the resource server (RS). This exch= ange >>> >>> I had to pause for a while after reading this and ponder whether I >>> agreed with it. I think that my reticence stems from some friction >>> between the most generic abstract definition of "resource" and a more= >>> specific one used in the web/HTTP world and, to a lesser extent, the >>> world of URIs and URNs in general. The resources we are discussing h= ere >>> are not always specific named resources, but can also refer to >>> attributes or capabilities mediated by a RS; similarly, we may be >>> creating/modifying named resources as part of the resource access >>> performed by a client in the OAuth model. I don't think it's wise to= >>> diverge from the RFC 4949 definition just yet, but am still consideri= ng >>> whether adding some additional clarifying text here is worthwhile. >> >> [LS] I would argue that this specification is applicable even to the w= ider >> definition of "resource" that you are thinking of. Since OAuth 2.0 lea= ves >=20 > Oh, I agree, and was not intending to say otherwise with my comments ab= ove. > Rather, I was considering that some [other] readers might see the word > "resource" and go straight to "web resource named by URI", and wonderin= g if > we could reword slightly to avoid that. > >> the definition of "scope" up to the specific applications, and the = ACE >> framework does not change this, we can deal with both web/HTTP/CoAP >> resources >> (named by URIs or URNs) and any other type of resources where the >> application >> can map the resource in question to a set of scopes. >> I am therefore inclined to say that this section is fine, but I'd be g= lad to >> hear the result of your considerations on that matter. >=20 > I see three potential options so far: >=20 > (1) no change > (2) in the first sentence, s/resource/generic resource/ > (3) add a new sentence as the third sentence, similar to "This resource= > might be a Web or similar resource addressed by URI, but in general can= be > a more generic or abstract resource provided by the RS". >=20 > I'm happy to advance the document with any of those three (and probably= > with other versions, if any arise). > I'll go with option 2 which seems to be a fine compromise with minimal=20 text breakage. >=20 >>> 16.) >>> Section 3.2 >>> >>> One application of COSE is OSCORE [I-D.ietf-core-object-security]= , >>> which provides end-to-end confidentiality, integrity and replay >>> protection, and a secure binding between CoAP request and respons= e >>> messages. In OSCORE, the CoAP messages are wrapped in COSE objec= ts >>> and sent using CoAP. >>> >>> This framework RECOMMENDS the use of CoAP as replacement for HTTP= for >>> use in constrained environments. >>> >>> Do we have a reason to mention OSCORE if we're not going to make a >>> recommendation about its use? >> >> [LS] We also mention DTLS and TLS without making any recommendation ab= out >> which to use. I would suggest to either remove all of it or to add a >> sentence >> noting that this is an enumeration of some security options, and the c= hoice >> depends on the specific application scenario. >=20 > Adding a sentence feels like a slightly better option to me, though it > could easily go either way. >=20 Fixed >>> 19.) >>> Section 5 >>> >>> Credential Provisioning >>> For IoT, it cannot be assumed that the client and RS are part = of a >>> common key infrastructure, so the AS provisions credentials or= >>> associated information to allow mutual authentication. These >>> credentials need to be provided to the parties before or durin= g >>> the authentication protocol is executed, and may be re-used fo= r >>> subsequent token requests. >>> >>> nit: either "before or during the execution of the authentication >>> protocol" or "before or during the authentication protocol's executio= n". >>> And just to double-check that we mean the authentication protocol of >>> provisioning in the last sentence, not the authorization protocol tha= t >>> occurs between the client and RS. >> >> [LS] The whole last sentence was a bit off. I would suggest: >> "The resulting security association between client and RS may then be >> re-used >> by binding these credentials to additional access tokens." Does that >> sound better? >=20 > That definitely reads more coherently, yes. It makes implicit the fact= > that there is an authentication protocol that gets run, which is probab= ly > okay, and I'm not sure whether "additional" is quite in line with the w= ay > the previous sentence is formulated. (Maybe it makes more sense in > context, which I don't have in front of me right now.) >=20 You are right that was still off. Fixed that now. >>> 39.) >>> Refresh tokens are typically not stored as securely as proof-of- >>> possession keys in requesting clients. Proof-of-possession based= >>> refresh token requests MUST NOT request different proof-of-posses= sion >>> keys or different audiences in token requests. Refresh token >>> requests can only use to request access tokens bound to the same >>> proof-of-possession key and the same audience as access tokens is= sued >>> in the initial token request. >>> >>> This is perhaps something of a philosophical question, but if a refre= sh >>> token is only usable at the token endpoint, in some sense its audienc= e >>> is definitionally the AS. So there's a little bit of a mismatch in >>> treating it as having the audience value that the access tokens issue= d >>> from it will have. I don't know the background for audience-restrice= d >>> refresh tokens in regular OAuth 2.0, though, so hopefully someone can= >>> educate me. >> >> [LS] I'm equally confused. I suggest that Hannes or one of the other O= Auth >> experts give us a hint on that one. >=20 > [We had some stab at this in the other thread, but additional input mig= ht > still be in order] Let's hear with OAuth people in Singapore. >>> 58.) >>> Profiles MUST specify whether the authz-info endpoint is protecte= d, >>> including whether error responses from this endpoint are protecte= d. >>> Note that since the token contains information that allow the cli= ent >>> and the RS to establish a security context in the first place, mu= tual >>> authentication may not be possible at this point. >>> >>> We'll need some careful reasoning about this for the security >>> considerations, since the authz-info transaction can impact what prof= ile >>> the RS thinks is in use. E.g., whether a network attacker could >>> cause the client to think that a different (vulnerable) profile is in= >>> use than the one the RS expects to use. >> >> [LS] Noted. Do you think the reasoning in section 6.5 needs to be exte= nded? >=20 > I think we should add some more text, yes. > Specifically, we should mention that the authz-info interaction can aff= ect > what profile RS will use (e.g., via "ace_profile"), and that profile > developers should be conscious of the risk of downgrade attacks that > involve other profile types. (Am I reading this right that the client = will > know what profile to use by the time it is ready to post to the authz-i= nfo > endpoint and that the response will not change what profile the client > uses? Specifically, even if a client supports multiple profiles that u= se > different methods for token transport, a client is not going to try one= > method/profile and then fall back to a different one if the first one > (transiently) fails?) >=20 I'm not sure how you would mount such a downgrade attack. The client=20 receives the profile to use either by implicit configuration or=20 explicitly through the "profile" parameter from the AS. If the client does not receive a "profile" parameter and has no implicit = profile configured this is an error. The RS either has the profile pre-configured or receives it via an=20 authenticated "profile" claim in the access token (again if the claim is = missing and no pre-configured profile exists this is an error). Even=20 though the token is sent to authz-info over an insecure channel and the=20 client is not yet authenticated, the access token itself is, and=20 therefore I find it hard to see how an attacker would trick the RS to=20 use a different profile. >>> 65.) >>> specification defines the following approach: The claim "exi" >>> ("expires in") can be used, to provide the RS with the lifetim= e of >>> the token in seconds from the time the RS first receives the >>> token. This approach is of course vulnerable to malicious cli= ents >>> holding back tokens they do not want to expire. Such an attac= k >>> >>> It also has suboptimal behavior if the RS loses state (e.g., by >>> rebooting), and possibly requires the RS to store indefinitely all >>> tokens with an "exi" value. I have mixed feelings about specifying i= t >>> at all, though I concede it probably does have some value. Regardles= s, >>> I think a dedicated subsection in the security considerations is in >>> order. >> >> [LS] We wanted to provide some solution for expiring tokens for RSes >> that have >> no connectivity and no synchronized clocks. Using the "exp" claim in >> such cases >> would have pretty unpredictable results. >> I have extended section 6.3 in the security considerations to go into >> the detail >> of "exi", please have a look if this covers the necessary issues. >=20 > I think we should also say something about the amount of such persisten= t > storage potentially growing without bound, as those counters (or some > similar indication) are the only thing that will cause the RS to reject= > tokens that have been used the requisite number of times. So, RS state= > requirements grows with the number of 'exi'-bearing tokens that are iss= ued > for them. I suppose a bloom filter might be a way out, though... >=20 I don't see why storage requirements would grow more compared to regular = tokens with the "exp" claim. The way exi is intended to be implemented=20 is as follows: 1. C ---Token(exi=3D100)---> RS (internal_clock=3D54645) 2. RS generates a new 'exp' for the token, sets it to 54745 and discards = the exi claim. 3. RS expires token according to internal clock (i.e. at 54745) If you send the RS a lot of tokens it will eventually exhaust its=20 memory, but that would happen with regular exp claims as well if the=20 attacker can craft/obtain enough tokens with sufficiently long lifetime. Note that these would have to be tokens for different clients, since the = framework currently recommends to only store one token per client. The advantage for the attacker with exi is that it could hold back any=20 tokens without having to worry about the expiration, but it would still=20 have to hoard enough tokens for different clients, all applicable to the = RS in order to exhaust the RS's storage. >=20 >>> 68.) >>> o The client performs an introspection of the token. Although t= his >>> is not explicitly forbidden, how exactly a client does >>> introspection is not currently specified for OAuth. >>> >>> I'm pretty sure this is overtaken by events (sorry for my part in >>> that!). E.g., draft-ietf-oauth-jwt-introspection-response discusses >>> clients doing introspection, and even RFC 7662 itself discusses using= a >>> client secret to authenticate to the introspection endpoint. I think= >>> there's another document between those two that's also relevant, but >>> can't find it right now >> >> [LS] I am not so sure. When reading the fine print in both RFC 7662 an= d >> draft-ietf-oauth-jwt-introspection-response, I find that when they men= tion >> the term "client", they refer to the protected resource / RS as being = a >> client of >> the AS introspection endpoint. A client holding an access token and >> performing introspection is never explicitly mentioned in both >> documents, to my best >> knowledge. >=20 > It seems like we should try to check on this in Singapore, while the us= ual > suspects are easily at hand. Yes together with the other OAuth questions. >=20 >>> 78.) >>> Section 6.1 >>> >>> I think we should have a little bit more discussion about what attack= s >>> are possible even when a client hard-codes a list of trustworthy ASes= , >>> e.g., when a device in one AS's purview is compromised and tries to g= et >>> the client to use a different (possibly also compromised, or maybe ju= st >>> buggy) AS than the one that's supposed to be responsible for the devi= ce >>> in question. In short, yes, spoofing is only possible within that se= t >>> of trusted ASes, but spoofing can still cause problems. >> >> [LS] I have added some text in section 6.4 Please have a look if this >> covers what you were aiming at. >=20 > That's pretty good, thanks! > I'd prefer to also have (in the second sentence of the second paragraph= ) a > mention about what an AS (in the hard-coded list) would do when receivi= ng > the incorrect request from the misdirected client, though. > (Also, nit, s/ redentials/ credentials/) >=20 Done and fixed. >>> 79.) >>> Are there any AS parameters other than URI that might be useful for a= n >>> out-of-band-configured list of valid values? >> >> [LS] One might want to include the public key or certificate of the AS= =2E >> Do you want us to expand this section to include such parameters? >=20 > I'd consider adding another sentence like "Information used to authenti= cate > the AS, such as a public key or certificate fingerprint, might be > provisioned alongside an AS's URI, depending on the deployment scenario= ". > What do you think? >=20 Done >>> 88.) >>> Section 8.3 >>> >>> Name The OAuth Error Code name, refers to the name in Section 5.= 2. >>> of [RFC6749], e.g., "invalid_request". >>> >>> We should refer to the OAuth registry as the authority on names, not = the >>> immutable RFC. (Similarly for the other mappings registries; I won't= >>> repeat it each time, though for the later ones we're already doing th= e >>> right thing.) >> >> [LS] This is interesting. The referenced section (5.2 of RFC6749) is n= ot >> mirrored in any IANA registry. I have put the question to the OAuth WG= =2E >=20 > IIRC, you filed https://www.rfc-editor.org/errata/eid5873 for this and = I > submitted a registration request at > https://mailarchive.ietf.org/arch/msg/oauth-ext-review/4WaM6n6JetFsLI6_= T9S8wNVqP74 > . It's been more than two weeks, so I should follow up there... >=20 Ok, I'll wait to hear more. >>> 97.) >>> Section 10.1 >>> >>> We may get some debate about whether IANA registries are properly >>> Normative of Informative references, but we can wait for that to happ= en >>> -- no need to do anything now. >> >> [LS] Noted. Does the AD have a position on this? >=20 > I think there's a reasonable argument for keeping them as normative. W= e > probably see them as informative more often (in general), though, proba= bly > because people are concerned about having downrefs to something that's = not > a standards-track RFC (which would happen due to a misunderstanding of = the > rules surrounding downrefs, IMO). Ok no action taken at this point. >=20 >>> 98.) >>> Section 10.2 >>> >>> If we're using RFC 4949 for terminology definitions, I think that mak= es >>> it a normative reference. >>> >>> If we REQUIRE CBOR when used with CoAP, that also feels like a normat= ive >>> reference. >>> >>> I also think 7519 needs to be normative, since we mandate some of its= >>> processing rules. >> >> [LS] RFC 4949 is informational, so it cannot be normative. I would arg= ue >> that we are just using it to clarify the meaning of our terminology. >=20 > It's okay to have a normative reference to an informational document; w= e > just need to call it out in the IETF LC announcement (which the > tooling/secretariat should take care of "automagically"). > Furthermore, RFC 4949 is already listed at > https://datatracker.ietf.org/doc/downref/ as an "acceptable downref", s= o we > don't even have to do that, in this case. >=20 Ok I made RFC 4949 normative, I didn't know about the "acceptable=20 downref" arrangement with the secretariat. >=20 >=20 > If you want to get a new revision up to make these last few changes dur= ing > the blackout period, I'm happy to approve a manual posting by the > secretariat. (OTOH, since IETF LCs that overlap with the meeting week = get > extended automatically, it wouldn't necessarily get the document on an = IESG > telechat any sooner.) I have made a few changes, but there are still some points to discuss.=20 If you think the updates still warrant a new submission, I can do a=20 submission with manual approval. /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms010201090200090102070400 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTExMzEy NTU0NFowLwYJKoZIhvcNAQkEMSIEIM61GorRHJi+i6ctYH4fJsqRU/wAu1TrQBIwVMHFv+LI MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAEoTIf0C/IL3Zk0US/RwvPHab08V79BnFVP+hvlgZZdS/ iaolQ9+Rs3yqpV34gSUxTktjeXkt8ACHZOGDdHENgD0BU7wYGtIKkvvvUUZqPtNOqWl8qJAd 0eyxMG2Z3ktKrV3MtxUMVt0t7s+6exW4QKebo3zhnDtpu+Sgw6g+77EKx0q3sjJ5AgM4X1/7 cpJbwlOEwMOE6Sl7DVgTlvvfQaRbJ/nyedsucxTeRkdCbfHQ6HwX7rGK8PvfXfFDAFKVP9hn tIqNkr10FHCFYQjj/RnWzWa2a33nEnP4tZhcddqeMYFTr/p+edbpH4dVLYzZqnOxhXVB1tfv W6/0fbOVPQAAAAAAAA== --------------ms010201090200090102070400-- From nobody Sat Nov 16 19:44:51 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E0BB4120837; Sat, 16 Nov 2019 19:44:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.110.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157396228987.10975.10617255933831442954@ietfa.amsl.com> Date: Sat, 16 Nov 2019 19:44:49 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oauth-params-06.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Nov 2019 03:44:50 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Additional OAuth Parameters for Authorization in Constrained Environments (ACE) Author : Ludwig Seitz Filename : draft-ietf-ace-oauth-params-06.txt Pages : 13 Date : 2019-11-16 Abstract: This specification defines new parameters for the OAuth 2.0 token and introspection endpoints when used with the framework for authentication and authorization for constrained environments (ACE). These are used to express the proof-of-possession key the client whishes to use, the proof-of-possession key that the AS has selected, and the key the RS should use to authenticate to the client. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-params/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oauth-params-06 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oauth-params-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oauth-params-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Nov 16 19:45:32 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93074120837; Sat, 16 Nov 2019 19:45:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RCcI_XgjxLlh; Sat, 16 Nov 2019 19:45:27 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30045.outbound.protection.outlook.com [40.107.3.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECECE120046; Sat, 16 Nov 2019 19:45:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nSnlnFfRMoHv/MY6wmKCyrW9om1MtPskTrVU4i5UDGCrOodAjseHD+2TSuOfXXmhwPgGsN3kERG8D3Xi2jvz7W8E1ond5HstIiQw0iqmKNwfz2KeDQOenIQVaFEreDyCgcPATPImqz4TGeArWHR3tPaakNc9VGQXQzObuJnHLYydIjf/7k6FUGx29fQ4noRjZHdcIyxLn8+4N0+YpPd/7cXyCOUetO0O3sgr2bZ//P75NLpKUgeZyxNn1K/n14q6sSf2WdWbpv/gpGqUddFxcCSjSk8BU6NXC8Xchoj87zPQgsWYlWejQkgYoJrHODWHPL1vS3E2WTcLH3M6Pcz1GA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NdM6zW2jwRq9rqwIZPYDGe5Jbw7kBaaPn9Xyn87iRT4=; b=g7VBMUyME7lclKmnpbSNX0NjZH2uNgwa462gOCfjx8XKun2xRQgNs/v/lyzgdQ3ml/dDEvcsCbK1zAsjoVgU5G8+NkJK+J4y18pT8spMMr+lmzn8qSnOtD5idRbZgHRrLJizYPQoQ+K1m+/PNMswgfjh8GXT30B0kdWrNw9AxCkGLm3r08TlD3koou+t0KH4+lJXPRhWcE84jHW0OFc9rx6mlt0hmKrCnF37mT6c+wm11ZVzmoegfbXJ+CAGgk/U4gqXjcovrA5R2nvTkbc5gjul8EzwZB5LoSaDpvOn34eLoFin8Cs808iRu1vB1hYMpjFLhGc0sBOhxIZaYmw/JA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NdM6zW2jwRq9rqwIZPYDGe5Jbw7kBaaPn9Xyn87iRT4=; b=nPxTeSLCe0fEjZDj8Id1/dDLNRUuMuj1d0i1kXBCLlTa+7p0PCTxTdvvzz33XfDKaMKu77L+b6WE9mRERqSTUTSUGAtGsymBkfW9FsuobLkF9n8ruP+mPsR3fa9wXoCi8YtPXIoQDWj+V/rGm0NED7lp1grZ+eTgc4bd4r40Qtc= Received: from AM5P189CA0016.EURP189.PROD.OUTLOOK.COM (2603:10a6:206:15::29) by DB6P18901MB0055.EURP189.PROD.OUTLOOK.COM (2603:10a6:4:22::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.27; Sun, 17 Nov 2019 03:45:23 +0000 Received: from VE1EUR02FT056.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::207) by AM5P189CA0016.outlook.office365.com (2603:10a6:206:15::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23 via Frontend Transport; Sun, 17 Nov 2019 03:45:23 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT056.mail.protection.outlook.com (10.152.13.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2451.23 via Frontend Transport; Sun, 17 Nov 2019 03:45:22 +0000 Received: from [31.133.132.127] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Sun, 17 Nov 2019 04:45:18 +0100 To: Benjamin Kaduk , References: <20191115121419.GG32847@kduck.mit.edu> From: Ludwig Seitz CC: "ace@ietf.org" Message-ID: <5bfa41c5-7339-5443-9691-92c6fa879fe4@ri.se> Date: Sun, 17 Nov 2019 04:45:04 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <20191115121419.GG32847@kduck.mit.edu> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms010404080908090106080906" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-2.sp.se (10.100.0.162) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(346002)(39850400004)(396003)(136003)(376002)(72854002)(199004)(189003)(53754006)(6666004)(386003)(44832011)(86362001)(31686004)(81156014)(8676002)(31696002)(8936002)(6306002)(966005)(568964002)(6246003)(3846002)(229853002)(446003)(2171002)(336012)(6116002)(478600001)(5024004)(14444005)(11346002)(110136005)(186003)(305945005)(70206006)(71190400001)(16526019)(956004)(22756006)(40036005)(2906002)(486006)(36756003)(5660300002)(81166006)(356004)(22746008)(235185007)(4326008)(6706004)(33964004)(65956001)(65806001)(76176011)(26005)(30864003)(16586007)(16576012)(126002)(316002)(53546011)(70586007)(58126008)(2616005)(476003)(7736002)(106002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6P18901MB0055; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8e0b0cc0-abc0-49cd-d2d8-08d76b109324 X-MS-TrafficTypeDiagnostic: DB6P18901MB0055: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-Forefront-PRVS: 02243C58C6 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: afKB7M3gJ6+BHhlagN6ZLhQkvfRZBh7qEXzuZt6r7gRyNq0cLHUX0FJ3ySsGMUhamkdzjvmM45IpzmAO/nisBiL3uYvn9i73CidnhbhNCtVMiVOeCFC3t+REYy3Lv5urj8+ap5+zayDceY4mpBaMXoeYSV3wjrqQ9mU3pha+Rwtc35WkN7NqIq3Evk2fW6+2KEeMaeaqQRr8BkBu9vq5TRD4T1PimeucuPxoQcjRrPdxaAiKNIyrS8xKgVt2ysQChFp5VrTk5Fw0RlgC/+ccVrXWWfM1DTlWEo+zJ6NF27L84OEQynlMql3uUikMaB4dNT0Txet2lW5wFNOYGeJrI1zH2znhj6MxyWya3bXNyiiVHVUmWNnTFoGXnp62Mlms+iqrRTOm0n52/EruqvulsYLdNKHZLVk3MqQceVseXITqKjm0n2QUQFWqujedh/hi/QOyATtYH+l7VWMJIe3cHMZPbNaIkljzt7Mb3GnuKCM= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2019 03:45:22.7826 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8e0b0cc0-abc0-49cd-d2d8-08d76b109324 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P18901MB0055 Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-params-05 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Nov 2019 03:45:31 -0000 --------------ms010404080908090106080906 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 15/11/2019 13:14, Benjamin Kaduk wrote: > Hi all, >=20 > I'm mostly just nitpicking in the following comments; the actual conten= t > here is in good shape. (But some of these are popular things that > directorate reviewers like to complain about, so fixing them preemptive= ly > seems wise.) >=20 > Section 1 >=20 > access tokens. These parameters and claims can also be used in oth= er > contexts, and may need to be updated to align them with ongoing OAu= th > work. Therefore they have been split out into this document, which= > can be used and updated independently of [I-D.ietf-ace-oauth-authz]= =2E >=20 > I expect that we'll get some reviewers who want to wordsmith this last > sentence. It's fine to wait and see what suggestions come in (if any),= > but if you want to try to forestall those, my suggestion would be: >=20 > % Therefore, these parameters and claims have been put into a dedicated= > % document, to facilitate their use and any potential updates in a mann= er > % independent of [I-D.ace-oauth-authz]. >=20 Done. > Section 3.1 >=20 > req_cnf > OPTIONAL. This field contains information about the key the > client would like to bind to the access token for proof-of- > possession. It is RECOMMENDED that an AS reject a request > containing a symmetric key value in the 'req_cnf' field, since t= he > AS is expected to be able to generate better symmetric keys than= a > potentially constrained client. The AS MUST verify that the >=20 > nit: I'd wordsmith this a bit, since the idea is that the AS-generated > key will be better than one generated by a constrained client, but a > non-constrained client can probably do just fine at keygen. So, > I'd consider dropping "potentially", as the rest of the sentence does > not have anything to imply that all clients using this claim are > constrained. >=20 Done. > Payload: > { > "req_cnf" : { > "COSE_Key" : { > "kty" : "EC", > "kid" : h'11', > "crv" : "P-256", > "x" : b64'usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8', > "y" : b64'IBOL+C3BttVivg+lSreASjpkttcsz+1rb7btKLv8EX4' > } > } > } >=20 > Figure 1: Example request for an access token bound to an asymmetri= c > key. >=20 > Shouldn't an access token request have an authorization code? > The other parameters from Section 4.1.3 of RFC 6749 have conditions > attached to their REQUIRED status, but not "code". > In draft-ietf-ace-oauth-authz section 5.6.1. (Client-to-AS Request) we=20 specify that when the "grant_type" parameter is missing, then=20 "client_credentials" is implied, which in turn means that the client=20 does not need an authorization code. Section 4.1.3 of RFC 6749 is about = the authorization code grant, you are looking at the ACE-ified version=20 of Section 4.4 > Section 3.2 >=20 > cnf > REQUIRED if the token type is "pop" and a symmetric key is used.= >=20 > Just to check, this means that if the client includes a symmetric 'cnf'= > key and the AS ignores the prior recommendation to ignore such a > symmetric confirmation key in the request, the AS still has to echo > back the symmetric key that is in use? (There's also potentially some > interesting interactions if we use a 'kid'.) Indeed as the drafts are written right now, that would be the expected AS behaviour. This is not entirely intentional, and my only objection to = changing it at this time is that writing specification text handling=20 interactions we are recommending against (i.e. accepting=20 client-suggested symmetric keys) seems icky. As for 'kid' I'd just expect the AS to echo back the kid, not the actual = key. >=20 > MAY be present for asymmetric proof-of-possession keys. This > field contains the proof-of-possession key that the AS selected > for the token. Values of this parameter follow the syntax of th= e >=20 > And to check here again, the omitted 'cnf' in the response means that h= e > AS accepted the client's requested asymmetric key? (There wouldn't be = a > case where the AS rejects an offered asymmetric key and replaces it wit= h > a new one, right?) Indeed that is correct. Note that there could be cases where an AS=20 rejects an offered asymmetric key and replaces it by another one. This=20 would be if the AS knows that the RS doesn't support this key format, and also knows that the client holds another public key which is=20 actually supported by the RS. >=20 > rs_cnf > OPTIONAL if the token type is "pop" and asymmetric keys are used= =2E > MUST NOT be present otherwise. This field contains information > about the public key used by the RS to authenticate. If this > parameter is absent, either the RS does not use a public key or > the AS assumes that the client already knows the public key of t= he > RS. Values of this parameter follow the syntax of the "cnf" cla= im >=20 > I'd prefer to not word this as "the AS assumes", as that implies that w= e > will end up with a fragile overall system. Can we say something more > along the lines of "when the AS knows that the RS can authenticate > itself to the client without additional information"? (I expect that > less awkward wordings than the above are possible...) > Done. > from section 3.1 of [I-D.ietf-ace-cwt-proof-of-possession]. See= > Section 5 for details on the use of this parameter. >=20 > Also (both here and above), I'd suggest s/details on the use of this > parameter/additional discussion of the usage of this parameter/; we do = not > go into a huge amount of detail in Section 5. Done. >=20 > I don't think the caption for Figure 3 is quite right... Fixed. >=20 > Also, Figures 2 and 3 are using the same "SlAV32hkKG ..." access token > snippet that we changed in the core spec, so we should probably change > it here as well. I changed the one in figure 3 to the same snippet I used which an=20 asymmetric pop key in the core spec. The snippet in figure 2 is still in = the core spec, so I left it here as well. >=20 > Section 3.3 >=20 > In the symmetric-key case this basically degenerates to > Needham-Schroeder (but I also don't expect anyone to use this with > symmetric keys). > However, for asymmetric keys, we might assume that the AS is not > creating a new asymmetric keypair for the RS to use, and instead > referring to one already known to the RS, e.g., just via the public > part. I can't quite decide whether the RS should always blindly trust > the AS in this regard, or might want to have an additional policy layer= > that would allow for "I do not want to use this public key with this > specific client". Any such benefit from that would be subtle, as > presumably the AS has already told the client the same key, and so the > RS is limited to merely not presenting cryptographic evidence to the > client that it holds the private key (as opposed to the client trusting= > the AS as trusted-third-party that the RS has that key). > I guess that suggests that there's no need for additional policy on the= > RS, and we don't need any more text here. >=20 Actually I had asymmetric keys in mind when I created this claim. Since one could imagine protocols using different symmetric keys for=20 client and RS though, so I wouldn't want to restrict this to asymmetric-only. Also: yes, the idea was that the AS just uses the public part of an=20 asymmetric key, of which it knows that the RS has the corresponding=20 private part. Do you want me to make this more explicit? > Section 5 >=20 > o "req_cnf" in the access token request C -> AS, OPTIONAL to > indicate the client's raw public key, or the key-identifier of a= > previously established key between C and RS that the client wish= es > to use for proof-of-possession of the access token. >=20 > There's potentially an interesting question here about whether the AS > has to, can, or shouldn't assign semantics to key identifiers. The par= t > most needed for interoperability is, of course, that the RS knows to ma= p > an incoming kid to an actual key, and the parallel that the client know= s > that the (kid, key, RS) tuple is usable. I don't see a reason why the > AS needs to have semantics to a given kid for interoperability, though > perhaps there will be some scenarios where the AS manages the kid > namespace at a given RS as opposed to the RS doing so. But, on the > other hand, having the AS not give semantics to 'kid' turns the AS into= > a dumb transport, which tends to be the sort of thing that merits > additional analysis. Basically the current expectation is that when the client requests a kid = to be bound to an access token, it "knows what it is doing" i.e. either=20 it has already sent a token using this pop key to the RS previously; or=20 the client and the RS have been commissioned to have this shared key=20 bound to the kid. Do you want me to make this more explicit? >=20 > o "cnf" in the token response AS -> C, OPTIONAL if using an > asymmetric key or a key that the client requested via a key > identifier in the request. REQUIRED if the client didn't specif= y > a "req_cnf" and symmetric keys are used. Used to indicate the >=20 > This seems to make no statement (REQUIRED/OPTIONAL) about this claim fo= r > the case where the client didn't specify a "req_cnf" and asymmetric key= s > are used. This situation, of course, can't happen (at least not > currently), as the absence of "req_cnf" is used as a signal for server > (symmetric) keygen, but I suggest that we only mention "client didn't > specify a 'req_cnf'" so we don't have to keep explaining this to > reviewers. So should I remove the "and symmetric keys are used." part? >=20 > o "rs_cnf" in the token response AS -> C, OPTIONAL to indicate the= > public key of the RS, if it uses one to authenticate to the > client. >=20 > nit(?): I'd consider adding a phrase about "and the binding between key= > and RS identiyt is not established through other means". Done. >=20 > o "rs_cnf" in the introspection response AS -> RS, OPTIONAL, > contains the public key that the RS should use for authenticatin= g > to the client (e.g. if the RS has several different public keys)= =2E >=20 > nit(?): I'd consider adding a phrase about "and there may be ambiguity > as to which key to use" or similar, though I'm failing to come up with = a > non-awkward phrasing. >=20 Done. I'll go with slightly awkward, but more correct. > Note that the COSE_Key structure in a confirmation claim or paramet= er > may contain an "alg" or "key_ops" parameter. If such parameters ar= e > present, a client MUST NOT use a key that is not compatible with th= e > profile or proof-of-possession algorithm according to those >=20 > nit(?): s/not compatible/incompatible/ would avoid a "double 'not'", if= > that's seen as desirable. Fixed. >=20 > Section 6 >=20 > I thought we had set up separate map key namespaces for (e.g.) token > requests, token responses, and introspection responses, so that > attempting to use the same key value for all the uses of these > parameters defined by this document is something of a type error. > E.g., they end up in different registries, as we do in Section 9.2, 9.5= , > and 9.6. >=20 That is correct. I have added separate entries and a column specifying the different uses. I will leave the values to be the same=20 though. > Section 9.1, 9.2, 9.4 >=20 > I note that the distance between "authenticate to the client" and > "authenticate the client" is small enough that I expect it to be a > common misreading, and also that the other descriptions at > https://www.iana.org/assignments/jwt/jwt.xhtml#claims are a bit more > pithy than what we use here. Perhaps, "public key used by RS to > authenticate itself to client"? >=20 Done. > Section 9.5 >=20 > This section registers the following parameter mappings in the "Tok= en > Endpoint CBOR Mappings" registry established in section 8.9. of > [I-D.ietf-ace-oauth-authz]. >=20 > It looks like this has been renamed to the "OAuth Parameters CBOR > Mappings" registry? Correct. Fixed. >=20 > Section 9.6 >=20 > This section registers the following parameter mappings in the > "Introspection Endpoint CBOR Mappings" registry established in > section 8.11. of [I-D.ietf-ace-oauth-authz]. >=20 > Similarly, this has been renamed to "OAuth Token Introspection Response= > CBOR Mappings". >=20 Fixed. > Section 11.1 >=20 > It's not entirely clear that RFC 7252 needs to be a normative reference= ; > we don't do much with CoAP directly in this document. >=20 Agree. I moved it. > Appendix A >=20 > We might want to wordsmith this some if it's to be kept for the final > RFC (depending on what the OAuth work looks like at that point). I'm > not sure that there are any useful changes to make to it right now, > though. It seems the OAuth draft I'm talking about here is not going anywhere=20 fast. We might consider removing this in the final edition. /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms010404080908090106080906 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTExNzAz NDUwNFowLwYJKoZIhvcNAQkEMSIEIF+Yz9CGaIlXb/DlUYLN3EJen/fjD3ll42r1v9ZCp3qR MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEASmiDEmQKEaBDX3CIWoR0G0J4lhmhJ8XJ+gHZABXhVZ6R v640XohTq2thczoj3lWQl8Xl7FWXdjnaUFNJMHsGQpN1Or590sI406r9ekqNLJ2w6AFQtk04 3fM4C5VRWdPX2ZwimVpRuqPrHXHpbMOb1UyEd42n97/gel6YuBb5C5ut8Yb3KbKNyJW2Xlq+ 1CbOiagJ578egf0PbQeBc0cWp8NbewmTJwaTwfZn9RS4u9eoIknPzRMkvLXbj+y/BQmTo/6M dKPg2SuLLy3dP6+y54EmYPQj0cbIER4kk8z6roIZiTTKAsSJw7fyQKDcrMKNTJ+yzWGFXw0t yj/8er1TMwAAAAAAAA== --------------ms010404080908090106080906-- From nobody Sat Nov 16 21:24:57 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7030120086; Sat, 16 Nov 2019 21:24:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I5bJHieCkF_o; Sat, 16 Nov 2019 21:24:48 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 702601201AA; Sat, 16 Nov 2019 21:24:45 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 16 Nov 2019 21:24:41 -0800 From: Jim Schaad To: CC: Date: Sun, 17 Nov 2019 13:24:39 +0800 Message-ID: <002301d59d07$50df48c0$f29dda40$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdWdBwSysGd7jH0USNi08z/aW/koAA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Mail regarding draft-tiloca-ace-revoked-token-notification-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Nov 2019 05:24:50 -0000 Small comment. If you use CBOR to transport a token, then it is easy to hash it because it is always going to be the raw bytes. If you use JSON to transport a token then it will be the raw bytes for a JWT, but it would be a base64url encoded value for a CWT. This means that the hash might not get the correct answer. Jim From nobody Sat Nov 16 22:25:28 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB87E120088; Sat, 16 Nov 2019 22:25:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bV6VoKx4Eva0; Sat, 16 Nov 2019 22:25:23 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FDB312007C; Sat, 16 Nov 2019 22:25:22 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAH6PHGt011189 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 17 Nov 2019 01:25:20 -0500 Date: Sat, 16 Nov 2019 22:25:17 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: draft-ietf-ace-oauth-authz.all@ietf.org, ace@ietf.org Message-ID: <20191117062517.GM32847@mit.edu> References: <20190927015154.GY6424@kduck.mit.edu> <696c7ee4-75f9-48ec-8837-ea171137e9f8@ri.se> <20191110032851.GW47216@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-authz-24 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Nov 2019 06:25:27 -0000 On Wed, Nov 13, 2019 at 01:55:44PM +0100, Ludwig Seitz wrote: > On 10/11/2019 04:28, Benjamin Kaduk wrote: >=20 > >>> 1.) > >>> Perhaps the most far-reaching changes needed > >>> will be to rename the "profile" claim, since that has already been > >>> allocated to OIDC Core for a very different usage. > >> > >> [LS] FIXED. I renamed the "profile" claim and parameters to "ace_profi= le" > >> Note that this will require changes in all of the profile drafts as we= ll. > >=20 > > Indeed. It would be great if someone (the chairs? Other volunteers are > > surely welcome) could make a list of changes that affect the profile > > documents, and make a pass over each in turn to find the affected areas. > >=20 >=20 > Mostly a search and replace of "profile" with "ace_profile" would be in= =20 > order, perhaps with a subsequent proof reading that nothing was borked=20 > up in the process. >=20 > I can do this, but sadly not before IETF. >=20 >=20 > >>> 6.) > >>> Section 1 > >>> > >>> Authorization is the process for granting approval to an entity to > >>> access a resource [RFC4949]. The authorization task itself can b= est > >>> be described as granting access to a requesting client, for a > >>> resource hosted on a device, the resource server (RS). This exch= ange > >>> > >>> I had to pause for a while after reading this and ponder whether I > >>> agreed with it. I think that my reticence stems from some friction > >>> between the most generic abstract definition of "resource" and a more > >>> specific one used in the web/HTTP world and, to a lesser extent, the > >>> world of URIs and URNs in general. The resources we are discussing h= ere > >>> are not always specific named resources, but can also refer to > >>> attributes or capabilities mediated by a RS; similarly, we may be > >>> creating/modifying named resources as part of the resource access > >>> performed by a client in the OAuth model. I don't think it's wise to > >>> diverge from the RFC 4949 definition just yet, but am still consideri= ng > >>> whether adding some additional clarifying text here is worthwhile. > >> > >> [LS] I would argue that this specification is applicable even to the w= ider > >> definition of "resource" that you are thinking of. Since OAuth 2.0 lea= ves > >=20 > > Oh, I agree, and was not intending to say otherwise with my comments ab= ove. > > Rather, I was considering that some [other] readers might see the word > > "resource" and go straight to "web resource named by URI", and wonderin= g if > > we could reword slightly to avoid that. > > >> the definition of "scope" up to the specific applications, and the = ACE > >> framework does not change this, we can deal with both web/HTTP/CoAP > >> resources > >> (named by URIs or URNs) and any other type of resources where the > >> application > >> can map the resource in question to a set of scopes. > >> I am therefore inclined to say that this section is fine, but I'd be g= lad to > >> hear the result of your considerations on that matter. > >=20 > > I see three potential options so far: > >=20 > > (1) no change > > (2) in the first sentence, s/resource/generic resource/ > > (3) add a new sentence as the third sentence, similar to "This resource > > might be a Web or similar resource addressed by URI, but in general can= be > > a more generic or abstract resource provided by the RS". > >=20 > > I'm happy to advance the document with any of those three (and probably > > with other versions, if any arise). > > >=20 > I'll go with option 2 which seems to be a fine compromise with minimal=20 > text breakage. >=20 > >=20 > >>> 16.) > >>> Section 3.2 > >>> > >>> One application of COSE is OSCORE [I-D.ietf-core-object-security], > >>> which provides end-to-end confidentiality, integrity and replay > >>> protection, and a secure binding between CoAP request and response > >>> messages. In OSCORE, the CoAP messages are wrapped in COSE objec= ts > >>> and sent using CoAP. > >>> > >>> This framework RECOMMENDS the use of CoAP as replacement for HTTP= for > >>> use in constrained environments. > >>> > >>> Do we have a reason to mention OSCORE if we're not going to make a > >>> recommendation about its use? > >> > >> [LS] We also mention DTLS and TLS without making any recommendation ab= out > >> which to use. I would suggest to either remove all of it or to add a > >> sentence > >> noting that this is an enumeration of some security options, and the c= hoice > >> depends on the specific application scenario. > >=20 > > Adding a sentence feels like a slightly better option to me, though it > > could easily go either way. > >=20 > Fixed >=20 > >>> 19.) > >>> Section 5 > >>> > >>> Credential Provisioning > >>> For IoT, it cannot be assumed that the client and RS are part = of a > >>> common key infrastructure, so the AS provisions credentials or > >>> associated information to allow mutual authentication. These > >>> credentials need to be provided to the parties before or during > >>> the authentication protocol is executed, and may be re-used for > >>> subsequent token requests. > >>> > >>> nit: either "before or during the execution of the authentication > >>> protocol" or "before or during the authentication protocol's executio= n". > >>> And just to double-check that we mean the authentication protocol of > >>> provisioning in the last sentence, not the authorization protocol that > >>> occurs between the client and RS. > >> > >> [LS] The whole last sentence was a bit off. I would suggest: > >> "The resulting security association between client and RS may then be > >> re-used > >> by binding these credentials to additional access tokens." Does that > >> sound better? > >=20 > > That definitely reads more coherently, yes. It makes implicit the fact > > that there is an authentication protocol that gets run, which is probab= ly > > okay, and I'm not sure whether "additional" is quite in line with the w= ay > > the previous sentence is formulated. (Maybe it makes more sense in > > context, which I don't have in front of me right now.) > >=20 >=20 > You are right that was still off. Fixed that now. >=20 >=20 > >>> 39.) > >>> Refresh tokens are typically not stored as securely as proof-of- > >>> possession keys in requesting clients. Proof-of-possession based > >>> refresh token requests MUST NOT request different proof-of-posses= sion > >>> keys or different audiences in token requests. Refresh token > >>> requests can only use to request access tokens bound to the same > >>> proof-of-possession key and the same audience as access tokens is= sued > >>> in the initial token request. > >>> > >>> This is perhaps something of a philosophical question, but if a refre= sh > >>> token is only usable at the token endpoint, in some sense its audience > >>> is definitionally the AS. So there's a little bit of a mismatch in > >>> treating it as having the audience value that the access tokens issued > >>> from it will have. I don't know the background for audience-restriced > >>> refresh tokens in regular OAuth 2.0, though, so hopefully someone can > >>> educate me. > >> > >> [LS] I'm equally confused. I suggest that Hannes or one of the other O= Auth > >> experts give us a hint on that one. > >=20 > > [We had some stab at this in the other thread, but additional input mig= ht > > still be in order] >=20 >=20 > Let's hear with OAuth people in Singapore. >=20 >=20 > >>> 58.) > >>> Profiles MUST specify whether the authz-info endpoint is protecte= d, > >>> including whether error responses from this endpoint are protecte= d. > >>> Note that since the token contains information that allow the cli= ent > >>> and the RS to establish a security context in the first place, mu= tual > >>> authentication may not be possible at this point. > >>> > >>> We'll need some careful reasoning about this for the security > >>> considerations, since the authz-info transaction can impact what prof= ile > >>> the RS thinks is in use. E.g., whether a network attacker could > >>> cause the client to think that a different (vulnerable) profile is in > >>> use than the one the RS expects to use. > >> > >> [LS] Noted. Do you think the reasoning in section 6.5 needs to be exte= nded? > >=20 > > I think we should add some more text, yes. > > Specifically, we should mention that the authz-info interaction can aff= ect > > what profile RS will use (e.g., via "ace_profile"), and that profile > > developers should be conscious of the risk of downgrade attacks that > > involve other profile types. (Am I reading this right that the client = will > > know what profile to use by the time it is ready to post to the authz-i= nfo > > endpoint and that the response will not change what profile the client > > uses? Specifically, even if a client supports multiple profiles that u= se > > different methods for token transport, a client is not going to try one > > method/profile and then fall back to a different one if the first one > > (transiently) fails?) > >=20 >=20 >=20 > I'm not sure how you would mount such a downgrade attack. The client=20 > receives the profile to use either by implicit configuration or=20 > explicitly through the "profile" parameter from the AS. > If the client does not receive a "profile" parameter and has no implicit= =20 > profile configured this is an error. >=20 > The RS either has the profile pre-configured or receives it via an=20 > authenticated "profile" claim in the access token (again if the claim is= =20 > missing and no pre-configured profile exists this is an error). Even=20 > though the token is sent to authz-info over an insecure channel and the= =20 > client is not yet authenticated, the access token itself is, and=20 > therefore I find it hard to see how an attacker would trick the RS to=20 > use a different profile. The general idea I have in mind is that the attacker can send a different token to authz-info than would be used in normal operation. Maybe it's an old one, or supposed to be for a different client, or something else, but the risk is that the attacker confuses the RS about what token (and thus which profile) to use with a given client. I think we have enough flexibility in how these things are done that the core framework does not provide a solid guarantee that such a mixup can never happen. > >>> 65.) > >>> specification defines the following approach: The claim "exi" > >>> ("expires in") can be used, to provide the RS with the lifetim= e of > >>> the token in seconds from the time the RS first receives the > >>> token. This approach is of course vulnerable to malicious cli= ents > >>> holding back tokens they do not want to expire. Such an attack > >>> > >>> It also has suboptimal behavior if the RS loses state (e.g., by > >>> rebooting), and possibly requires the RS to store indefinitely all > >>> tokens with an "exi" value. I have mixed feelings about specifying it > >>> at all, though I concede it probably does have some value. Regardles= s, > >>> I think a dedicated subsection in the security considerations is in > >>> order. > >> > >> [LS] We wanted to provide some solution for expiring tokens for RSes > >> that have > >> no connectivity and no synchronized clocks. Using the "exp" claim in > >> such cases > >> would have pretty unpredictable results. > >> I have extended section 6.3 in the security considerations to go into > >> the detail > >> of "exi", please have a look if this covers the necessary issues. > >=20 > > I think we should also say something about the amount of such persistent > > storage potentially growing without bound, as those counters (or some > > similar indication) are the only thing that will cause the RS to reject > > tokens that have been used the requisite number of times. So, RS state > > requirements grows with the number of 'exi'-bearing tokens that are iss= ued > > for them. I suppose a bloom filter might be a way out, though... > >=20 >=20 > I don't see why storage requirements would grow more compared to regular= =20 > tokens with the "exp" claim. The way exi is intended to be implemented=20 > is as follows: >=20 > 1. C ---Token(exi=3D100)---> RS (internal_clock=3D54645) > 2. RS generates a new 'exp' for the token, sets it to 54745 and discards= =20 > the exi claim. > 3. RS expires token according to internal clock (i.e. at 54745) >=20 > If you send the RS a lot of tokens it will eventually exhaust its=20 > memory, but that would happen with regular exp claims as well if the=20 > attacker can craft/obtain enough tokens with sufficiently long lifetime. > Note that these would have to be tokens for different clients, since the= =20 > framework currently recommends to only store one token per client. >=20 > The advantage for the attacker with exi is that it could hold back any=20 > tokens without having to worry about the expiration, but it would still= =20 > have to hoard enough tokens for different clients, all applicable to the= =20 > RS in order to exhaust the RS's storage. My point is that a token with "exi" is potentially valid "forever". Suppose I use that token once, and the RS does as you describe above, computing an "exp" for that token. If I post a new token to that RS so it discards the "exi"-ful token, or the expiration timer fires and the RS forgets about that token, then there is nothing to stop me (or an attacker) =66rom replaying that same original "exi"-bearing token. The RS would then see "exi", compute a new derived "exp", and give the token a whole nother validity period. Only if the RS retains some state that it has seen that specific token and used up the "exi" period is this token replay prevented. I don't see a way to reliably retain that state without having some permanent storage dedicated to the state for each "exi" token that has evern been received, over the lifetime of the RS. (A bloom filter or similar solution uses less state, but reduces reliability to some extent.) > >=20 > >>> 68.) > >>> o The client performs an introspection of the token. Although t= his > >>> is not explicitly forbidden, how exactly a client does > >>> introspection is not currently specified for OAuth. > >>> > >>> I'm pretty sure this is overtaken by events (sorry for my part in > >>> that!). E.g., draft-ietf-oauth-jwt-introspection-response discusses > >>> clients doing introspection, and even RFC 7662 itself discusses using= a > >>> client secret to authenticate to the introspection endpoint. I think > >>> there's another document between those two that's also relevant, but > >>> can't find it right now > >> > >> [LS] I am not so sure. When reading the fine print in both RFC 7662 and > >> draft-ietf-oauth-jwt-introspection-response, I find that when they men= tion > >> the term "client", they refer to the protected resource / RS as being a > >> client of > >> the AS introspection endpoint. A client holding an access token and > >> performing introspection is never explicitly mentioned in both > >> documents, to my best > >> knowledge. > >=20 > > It seems like we should try to check on this in Singapore, while the us= ual > > suspects are easily at hand. >=20 > Yes together with the other OAuth questions. >=20 >=20 >=20 > >=20 > >>> 78.) > >>> Section 6.1 > >>> > >>> I think we should have a little bit more discussion about what attacks > >>> are possible even when a client hard-codes a list of trustworthy ASes, > >>> e.g., when a device in one AS's purview is compromised and tries to g= et > >>> the client to use a different (possibly also compromised, or maybe ju= st > >>> buggy) AS than the one that's supposed to be responsible for the devi= ce > >>> in question. In short, yes, spoofing is only possible within that set > >>> of trusted ASes, but spoofing can still cause problems. > >> > >> [LS] I have added some text in section 6.4 Please have a look if this > >> covers what you were aiming at. > >=20 > > That's pretty good, thanks! > > I'd prefer to also have (in the second sentence of the second paragraph= ) a > > mention about what an AS (in the hard-coded list) would do when receivi= ng > > the incorrect request from the misdirected client, though. > > (Also, nit, s/ redentials/ credentials/) > >=20 >=20 > Done and fixed. >=20 > >>> 79.) > >>> Are there any AS parameters other than URI that might be useful for an > >>> out-of-band-configured list of valid values? > >> > >> [LS] One might want to include the public key or certificate of the AS. > >> Do you want us to expand this section to include such parameters? > >=20 > > I'd consider adding another sentence like "Information used to authenti= cate > > the AS, such as a public key or certificate fingerprint, might be > > provisioned alongside an AS's URI, depending on the deployment scenario= ". > > What do you think? > >=20 >=20 > Done >=20 > >>> 88.) > >>> Section 8.3 > >>> > >>> Name The OAuth Error Code name, refers to the name in Section 5.= 2. > >>> of [RFC6749], e.g., "invalid_request". > >>> > >>> We should refer to the OAuth registry as the authority on names, not = the > >>> immutable RFC. (Similarly for the other mappings registries; I won't > >>> repeat it each time, though for the later ones we're already doing the > >>> right thing.) > >> > >> [LS] This is interesting. The referenced section (5.2 of RFC6749) is n= ot > >> mirrored in any IANA registry. I have put the question to the OAuth WG. > >=20 > > IIRC, you filed https://www.rfc-editor.org/errata/eid5873 for this and I > > submitted a registration request at > > https://mailarchive.ietf.org/arch/msg/oauth-ext-review/4WaM6n6JetFsLI6_= T9S8wNVqP74 > > . It's been more than two weeks, so I should follow up there... > >=20 >=20 > Ok, I'll wait to hear more. >=20 > >>> 97.) > >>> Section 10.1 > >>> > >>> We may get some debate about whether IANA registries are properly > >>> Normative of Informative references, but we can wait for that to happ= en > >>> -- no need to do anything now. > >> > >> [LS] Noted. Does the AD have a position on this? > >=20 > > I think there's a reasonable argument for keeping them as normative. We > > probably see them as informative more often (in general), though, proba= bly > > because people are concerned about having downrefs to something that's = not > > a standards-track RFC (which would happen due to a misunderstanding of = the > > rules surrounding downrefs, IMO). >=20 > Ok no action taken at this point. >=20 > >=20 > >>> 98.) > >>> Section 10.2 > >>> > >>> If we're using RFC 4949 for terminology definitions, I think that mak= es > >>> it a normative reference. > >>> > >>> If we REQUIRE CBOR when used with CoAP, that also feels like a normat= ive > >>> reference. > >>> > >>> I also think 7519 needs to be normative, since we mandate some of its > >>> processing rules. > >> > >> [LS] RFC 4949 is informational, so it cannot be normative. I would arg= ue > >> that we are just using it to clarify the meaning of our terminology. > >=20 > > It's okay to have a normative reference to an informational document; we > > just need to call it out in the IETF LC announcement (which the > > tooling/secretariat should take care of "automagically"). > > Furthermore, RFC 4949 is already listed at > > https://datatracker.ietf.org/doc/downref/ as an "acceptable downref", s= o we > > don't even have to do that, in this case. > >=20 >=20 > Ok I made RFC 4949 normative, I didn't know about the "acceptable=20 > downref" arrangement with the secretariat. >=20 >=20 > >=20 > >=20 > > If you want to get a new revision up to make these last few changes dur= ing > > the blackout period, I'm happy to approve a manual posting by the > > secretariat. (OTOH, since IETF LCs that overlap with the meeting week = get > > extended automatically, it wouldn't necessarily get the document on an = IESG > > telechat any sooner.) >=20 > I have made a few changes, but there are still some points to discuss.=20 > If you think the updates still warrant a new submission, I can do a=20 > submission with manual approval. I guess the question is basically moot by now, but waiting to get the last few discussion points settled seems best. Thanks, Ben From nobody Sun Nov 17 18:15:20 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5256E12011F; Sun, 17 Nov 2019 18:15:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UJhy-SG9jR-N; Sun, 17 Nov 2019 18:15:13 -0800 (PST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0627.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::627]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8680120048; Sun, 17 Nov 2019 18:15:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Suo4ElCK7BDsNX2Dbih3sGJOBJJtdXizh5+bouYFN9JC/d1X5g9zIgthtHW3x6Jm34uVWQZQCxwofR20h072lmOs8re0Gv9Hk7cIVFZofh0Msk9pAc6PFIRkTDB4wVrnGcN5ZX4S/lz+N17zR5hTlEJGyhRmCbbFQfITYGyuVJ+iDCb17eiLeGgMDcN5IavUDfJYCGBBxfDrINrJ7vYrNU36q62u369KIKa+4fOvl5Mj83DCAGRtNZz9WoLH44E3sJiPM7QeoB23+FxmHxUMORqzOE/pLbR74R26JmkJJN3A3P4RF+M+rxK0e/xJZkmJc8end5qwhITkZhOEQo4s9g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LLRNYrGokwLwOhiKztDDq8d0TAPZMBvi8+G9OUTLGRQ=; b=e4R8ADn/A1d7z5Wnuup8W5ikgGLZXSIAUtqL1wnT50dfpCwYze2HlpO/Xh3auwHrijkEq9wSUsszVfPZPcG6WzNzqnNuXheX4ajGvBRVpeLQBs+uAizp5zRPPMT1+ek9vLZOBPXpVmsJfv+B7ZY/DDnNr+erDUpleTmSYJs9nQMRM6ibJZ74Obitl+TxIBeRMR90TkH7BH35YT858ClQ8/XAsRRdmzYWRNI3ovPoFfWgzcWZPEnVB749mz/K3gPnBjNSafiTNEGB78AeqDzx/z9MbVpvkZEC1QxGUE7SvOy4+4jHB9eMh7wlVEGmFRszc5SqYM/IIDiVv1i8QHShXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LLRNYrGokwLwOhiKztDDq8d0TAPZMBvi8+G9OUTLGRQ=; b=Hge/KkUz8UWHXoEGvvN+/Qw/QB+N8Yo/x6ktytUyLNilKGgLXNtweF6MTFilXesjr5TL7mxKR5umkAe8rG8e8xi0+Cl7AN4oiLRLBl2WGS8wZOr+JVc6qe3qfvQd42O7rLJiy9ipd+LnBDiXX4GcUunGl7x/Q2TvUPE/tZG+il0= Received: from VI1P189CA0001.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:2a::14) by HE1P189MB0587.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:56::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23; Mon, 18 Nov 2019 02:15:10 +0000 Received: from VE1EUR02FT064.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::208) by VI1P189CA0001.outlook.office365.com (2603:10a6:802:2a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2451.23 via Frontend Transport; Mon, 18 Nov 2019 02:15:10 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT064.mail.protection.outlook.com (10.152.13.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2451.23 via Frontend Transport; Mon, 18 Nov 2019 02:15:09 +0000 Received: from [31.133.157.25] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Mon, 18 Nov 2019 03:15:06 +0100 To: Jim Schaad , CC: References: <002301d59d07$50df48c0$f29dda40$@augustcellars.com> From: Ludwig Seitz Message-ID: <5f2c5fdd-a845-531d-2709-34636e8c3575@ri.se> Date: Mon, 18 Nov 2019 03:14:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <002301d59d07$50df48c0$f29dda40$@augustcellars.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms050007070708070009010503" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(39850400004)(346002)(376002)(189003)(199004)(386003)(31696002)(31686004)(44832011)(22756006)(81156014)(229853002)(6116002)(8676002)(3846002)(336012)(568964002)(6666004)(2906002)(33964004)(186003)(305945005)(16526019)(71190400001)(356004)(6706004)(7736002)(4326008)(76176011)(14444005)(5024004)(86362001)(53546011)(26005)(70206006)(486006)(8936002)(81166006)(70586007)(65956001)(22746008)(65806001)(5660300002)(6246003)(2616005)(446003)(126002)(16586007)(16576012)(956004)(106002)(15650500001)(478600001)(58126008)(110136005)(36756003)(40036005)(476003)(316002)(235185007)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1P189MB0587; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c04b60d2-e3d3-439b-c6d9-08d76bcd233e X-MS-TrafficTypeDiagnostic: HE1P189MB0587: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 0225B0D5BC X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Iz5e0K70d9kpBTHJVGtj/CmZ0LCfP3yM7MhlTx+v7o9BvT4bKESwC9Frbny6ObWGDN7CRtcVweO2p1ZxlR9K0kcU5q4Jy1o7qa4woLBwKWZhck/cVFLY7C1+Z5cQ1HNJAnwfcZTOI0zLw0oxBZLPQXCMjKgrqYwxA/6cXyiq+p+8LFYGpgNlvkSHwIzOZTc0e0SXTOXeey1jqjKI6FTYT2zZRS1rAcFYuPJzrWNhtuHLEpFN92LOpfMlroHf57Jdb7Nt5T0OtaSc4RrUfdjePupGgtYo6nDmBRsWEMxIPNOPg35RqErK6Vbg/eEiAbMw7hDoeU9O3wHLALfvjjPZ86XT/6zd7ebR+aLLEE2app5n02ii8G+RgpZiup0IIhMdNMxCooP//Y5sZm7gpRqS43Ed2dtoDwmxHp3nmd+xrkZy1OLYJejL9sYBxOlNMjmy X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Nov 2019 02:15:09.9258 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c04b60d2-e3d3-439b-c6d9-08d76bcd233e X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1P189MB0587 Archived-At: Subject: Re: [Ace] Mail regarding draft-tiloca-ace-revoked-token-notification-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Nov 2019 02:15:17 -0000 --------------ms050007070708070009010503 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 17/11/2019 06:24, Jim Schaad wrote: > If you use JSON to transport a token > then it will be the raw bytes for a JWT, but it would be a base64url en= coded > value for a CWT. This means that the hash might not get the correct an= swer. The problem here is that the client wouldn't know the format of the=20 token and therefore not be able to retrieve the correct binary=20 representation (I'm assuming both the RS and the AS would know). I think the best solution is to define that the data getting hashed is=20 to be the binary representation of what is in the 'access_token'=20 parameter of the access token response, since that is what everyone (AS, = Client, RS) sees. For a CBOR transport that would just be the byte-string value of=20 'access_token' as is, while for JSON transport this be the binary=20 representation of the String value of 'access_token', which would of=20 course depend on the charset. Side-note: Do we want/need to cater for such a weird corner-case? Who in = their right mind would use JSON in a CoAP message? /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms050007070708070009010503 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTExODAy MTQ0NFowLwYJKoZIhvcNAQkEMSIEIMl8OdhYlw12y1fb/DweMikfp7UsZi50TRDQ5iN6Q34X MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAid/G2HhU+Lufh8+ML/+d3/olqjixzbRZaacSrwou+piq 0DGCQU406BV4wBbHvw36mBmM1w16TsKPke/cY+usZvl7u7gljjBBlUIGDzbvNzyxxKT0IcET nAAEeEkvVVefdSmCv+rqAHDMflXy68ula9332I+PT67Sd9KfqANgkAurwdfZy8PtQM1CUoLR o7yzUGAAyCS+HFyreid/0oM1MBp3awXtPvUk2ezhgLCxKwluBFh172hGgSD5p+kb89NUlKah opF5pAKEHWvRIINq02N5VqfTDSTOxqv17NzW2CaYXKkGNr4WU5afybqts/LQeQK1rBNDwIG4 FbH+GjgR7QAAAAAAAA== --------------ms050007070708070009010503-- From nobody Sun Nov 17 18:23:05 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB74812083E; Sun, 17 Nov 2019 18:23:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i_IUh5KrakPl; Sun, 17 Nov 2019 18:23:02 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F5B4120048; Sun, 17 Nov 2019 18:23:02 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 17 Nov 2019 18:22:56 -0800 From: Jim Schaad To: 'Ludwig Seitz' , CC: References: <002301d59d07$50df48c0$f29dda40$@augustcellars.com> <5f2c5fdd-a845-531d-2709-34636e8c3575@ri.se> In-Reply-To: <5f2c5fdd-a845-531d-2709-34636e8c3575@ri.se> Date: Mon, 18 Nov 2019 10:22:55 +0800 Message-ID: <006801d59db7$17e6df00$47b49d00$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJ6sPGQ2I+EfF6nSBN4YUTZ9azJgAHYad/cpjdIRPA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] Mail regarding draft-tiloca-ace-revoked-token-notification-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Nov 2019 02:23:04 -0000 -----Original Message----- From: Ludwig Seitz =20 Sent: Monday, November 18, 2019 10:15 AM To: Jim Schaad ; = draft-tiloca-ace-revoked-token-notification@ietf.org Cc: ace@ietf.org Subject: Re: Mail regarding = draft-tiloca-ace-revoked-token-notification-00 On 17/11/2019 06:24, Jim Schaad wrote: > If you use JSON to transport a token > then it will be the raw bytes for a JWT, but it would be a base64url = encoded > value for a CWT. This means that the hash might not get the correct = answer. The problem here is that the client wouldn't know the format of the=20 token and therefore not be able to retrieve the correct binary=20 representation (I'm assuming both the RS and the AS would know). I think the best solution is to define that the data getting hashed is=20 to be the binary representation of what is in the 'access_token'=20 parameter of the access token response, since that is what everyone (AS, = Client, RS) sees. For a CBOR transport that would just be the byte-string value of=20 'access_token' as is, while for JSON transport this be the binary=20 representation of the String value of 'access_token', which would of=20 course depend on the charset. Side-note: Do we want/need to cater for such a weird corner-case? Who in = their right mind would use JSON in a CoAP message? [JLS] You have the corner-case above backwards. The question is who = would be using a CWT (or binary token) in a JSON message. I am currently using JWT tokens in a CoAP message right now for my MQTT = work because it was an easier starting point than to get an HTTP server = up and running. Jim /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 From nobody Mon Nov 18 02:23:10 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2214120874 for ; Mon, 18 Nov 2019 02:23:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbhmail.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g24Om51RtpAx for ; Mon, 18 Nov 2019 02:23:06 -0800 (PST) Received: from smtprelay.hostedemail.com (smtprelay0186.hostedemail.com [216.40.44.186]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A099312086E for ; Mon, 18 Nov 2019 02:23:06 -0800 (PST) Received: from filter.hostedemail.com (clb03-v110.bra.tucows.net [216.40.38.60]) by smtprelay05.hostedemail.com (Postfix) with ESMTP id 2E03C1802959A for ; Mon, 18 Nov 2019 10:23:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bbhmail.nl; h= mime-version:content-type:date:from:to:subject:reply-to :message-id; s=key; bh=UjZgOy6rsEg3TXLqOUeYlwrTG3GpRAWf5bklHdUVQ 9I=; b=CrDCoRaOAgVCCWKWrvBBYwKhzpnIxL0DDSn4wWRCK2KutAjHMX4vhGhwT LucP9zjAJ49Wp0jPfc/1w5D4jS6d0IgwjQDqPTP7/uecydiSdrt3VhbzWtn4eMiA ZlB10yaRddUwC1FJWv6s20ORBZHk8/wcLr6mfzFYwZcnxBdZIw= X-Session-Marker: 73746F6B636F6E73406262686D61696C2E6E6C X-Spam-Summary: 50, 0, 0, , d41d8cd98f00b204, stokcons@bbhmail.nl, :, RULES_HIT:1:2:41:72:152:355:379:582:800:962:967:968:973:983:988:989:1152:1189:1208:1221:1260:1263:1313:1314:1345:1381:1431:1436:1437:1516:1517:1518:1575:1588:1589:1592:1594:1605:1617:1730:1776:1792:2106:2198:2199:2525:2553:2561:2564:2682:2685:2692:2829:2859:2892:2901:2911:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3622:3865:3866:3867:3868:3870:3871:3872:3873:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4049:4250:4321:4425:4659:5007:6117:6119:6261:6298:6659:6678:7464:7774:7903:8568:8603:8957:9015:9025:9177:9389:10004:10226:10848:11232:11658:11914:12043:12114:12295:12555:12679:12895:12986:13137:13139:13141:13150:13161:13181:13199:13229:13230:13231:13548:13846:14096:14161:21060:21063:21080:21324:21433:21451:21625:21691:21740:21939:21972:30029:30030:30048:30054:30075:30090, 0, RBL:none, CacheIP:none, Bayesian:0.5, 0.5, 0.5, Netcheck:none, DomainCache:0, MSF:not bulk, SPF:, MSBL:0, DNSBL:none, Custom_ru X-HE-Tag: robin90_551c1adc0de41 X-Filterd-Recvd-Size: 13317 Received: from mail.bbhmail.nl (imap-ext [216.40.42.5]) (Authenticated sender: webmail@stokcons@bbhmail.nl) by omf19.hostedemail.com (Postfix) with ESMTPA for ; Mon, 18 Nov 2019 10:23:04 +0000 (UTC) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_df1919c560713f42cca403f6ba7558ba" Date: Mon, 18 Nov 2019 11:23:04 +0100 From: Peter van der Stok To: Ace Reply-To: consultancy@vanderstok.org User-Agent: Roundcube Webmail/1.4-rc2 Message-ID: X-Sender: stokcons@bbhmail.nl Organization: vanderstok consultancy X-Originating-IP: [5.206.216.229] Archived-At: Subject: [Ace] ace-key-groupcomm-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Nov 2019 10:23:09 -0000 --=_df1919c560713f42cca403f6ba7558ba Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8; format=flowed Hi authors, Many thanks for this document Below my review of the latest version of this document, based on my implementation experience. General point: I find it difficult to understand which secure communication channel is discussed at some points in the document. My suggestion is to name the two secure channels in section 1.1. For example: Management channel: channel secured with OSCORE or DTLS between client and KDC, according to specified transport profile. Group channel: channel secured with OSCORE between group members, according to specified transport profile. Mode detailed text suggestions follow below: Page 3 par 2: s/is in Appendix/is shown in Appendix/ Figure 1: According to text both Dispatcher and KDC can be RS, but only Dispatcher has (RS) added in the figure 1. Page 4, bullet 2: s/join the group/join a given group/ Page 4, bullet 3: s/join the group/join a given group/ Page 4, bullet 3: remove last phrase "If required…. Changes.". It does not add anything, does it? Page 4, bullet 4: what is an "implicit entity"? The phrase provokes more questions than it clarifies. Page 5, bullet 1: remove: "to communicate with group members" (section 4) is sufficient explanation.) Page 5, bullet 2: Shorten to: "Leaving of a node or removal of a node by the KDC (section 5)" Page 5, bullet 3: Do you mean? " retrieval of keying material by a group member" Page 5, line 4 from below: s/between client and KDC/between client and AS/ Page 5, end: suggestion is s/The exchange …and KDC/The joining Request and Joining Response and all further messages between client and KDC are exchanged over the Management channel/ page 6, top: Remove : "All further … exchange." Page 6: s/All communications … section 4/The group members communicate via the group channel using keying material of section 4/ Section 3, par 2, s/join the group through the KDC/join a given group/ Section 3, par 3; reduce to: The first two messages exchanged over the management channel use content-format application/ace+cbor and the third message uses content format application/cwt. Section 3.1, par1: /is as defined/is defined/ Section 3, page 7: The appearance of (REQx) is very surprising; Would be good to announce the function of "(REQx)" at the start of section 3 or end of section 2. Page 6, bullet 4: Not clear what you mean here. Are they optional, superfluous, or a MUST? Section 3.2, par 1: s/is as defined/is defined/ Page 8 The phrase "The access token MUST…. ACE requires" is difficult to parse. In my understanding, the request contains a scope parameter, the token contains a scope parameter and the response contains a scope parameter. Which scope must be a subset of the other? That is not clear. And how can they be a subset; we're talking array. Last par of section 3.2: I understand that the AS always replies with a new access token. Section 3.3: May be it is good to write that the POST exchange is not secured. Page 9: N_S is the value of the {"rsnonce" :value} pair? Page 10: The phrase: "It is required of the application profiles….". Is not clear. Does it mean that all application profiles must be changed to include this parameter? And what if this has not happened? Page 11, section 4: It is good to specify that all exchange between joining node and KDC passes over the management channel. Page 12, line 2: Add: securely communicate "over the group channel"….. Page 12: s/assiciated/associated/ Sec 4.1: please, make clear from the very start that the path names of the resources are example names. Page 13, section 4.1.2.1: Scope does not specify the resource path, but the value of gid Page 14: N_C is the value of the ("cnonce":value} pair? Page 14: I don't understand the paragraph: "The handler verifies … error message." How can the gid be a subset of the "scope"? This occurs at several other occasions in the text. Page 15: should num be monotonically increasing with each new version? Page 16, bullet 1: what are the member identifiers? Page 20, section 4.1.6: It is not clear to me how node is defined. Page 21, section 4.2: Instead of pairwise secure communication channel use the term Management channel. Page 22, paragraph 3: group identifier cannot be equal to the value of the scope; At most it can be equal to the first array element of the scope value. Page 22, section 4.3, paragraph 2: "that the client was not able to receive". The process in which clients receive new keying material without asking for it is not clear to me. Suggest to remove the phrase. Page 23, Text after figure 7: The rekeying process is not clear to me. Is it possible to discuss at least one approach, where the ContextId changes with the Master secret and the salt, every time the group changes composition or the keying material is refreshed. Receiving an unknown contextId means that rekeying took place and new material needs to be fetched. However, is there enough information to know which KDC handles the rekeyed group? The ContextId is unknown, and the receiverId may refer to multiple contexts, while it is not guaranteed that each group has its own resource on the member platform. Greetings, Peter -- Peter van der Stok vanderstok consultancy mailto: consultancy@vanderstok.org, stokcons@bbhmail.nl www: www.vanderstok.org [1] tel NL: +31(0)492474673 F: +33(0)966015248 Links: ------ [1] http://www.vanderstok.org --=_df1919c560713f42cca403f6ba7558ba Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8

Hi authors,

Many thanks for this document

Below my review of the latest version of this document, based on my impl= ementation experience.

General point: I find it difficult to understand which secure communicat= ion channel is discussed at some points in the document. My suggestion is t= o name the two secure channels in section 1.1.

For example:

Management channel: channel secured with OSCORE or DTLS between client a= nd KDC, according to specified transport profile.

Group channel: channel secured with OSCORE between group members, accord= ing to specified transport profile.

Mode detailed text suggestions follow below:

Page 3 par 2: s/is in Appendix/is shown in Appendix/

Figure 1:

According to text both Dispatcher and KDC can be RS, but only Dispatcher= has (RS) added in the figure 1.

Page 4, bullet 2: s/join the group/join a given group/

Page 4, bullet 3: s/join the group/join a given group/

Page 4, bullet 3: remove last phrase “If required…. Changes= =2E”. It does not add anything, does it?

Page 4, bullet 4: what is an “implicit entity”? The phrase p= rovokes more questions than it clarifies.

Page 5, bullet 1: remove: “to communicate with group members&rdquo= ; (section 4) is sufficient explanation.)

Page 5, bullet 2: Shorten to: “Leaving of a node or removal of a n= ode by the KDC (section 5)”

Page 5, bullet 3: Do you mean? “ retrieval of keying material by a= group member”

Page 5, line 4 from below: s/between client and KDC/between client and A= S/

Page 5, end: suggestion is

s/The exchange  …and KDC/The joining Request and Joining Res= ponse and all further messages between client and KDC are exchanged over th= e Management channel/

page 6, top: Remove : “All further … exchange.”

Page 6: s/All communications  … section 4/The group members = communicate via the group channel using keying material of section 4/

Section 3, par 2, s/join the group through the KDC/join a given group/

Section 3, par 3; reduce to:

The first two messages exchanged over the management channel use content= -format application/ace+cbor and the third message uses content format appl= ication/cwt.

Section 3.1, par1: /is as defined/is defined/

Section 3, page 7: The appearance of (REQx) is very surprising; Would be= good to announce the function of “(REQx)” at the start of sect= ion 3 or end of section 2.

Page 6, bullet 4: Not clear what you mean here. Are they optional, super= fluous, or a MUST?

Section 3.2, par 1: s/is as defined/is defined/

Page 8 The phrase “The access token MUST…. ACE requires&rdq= uo; is difficult to parse.

In my understanding, the request contains a scope parameter, the token c= ontains a scope parameter and the response contains a scope parameter. = ; Which scope must be a subset of the other? That is not clear. And how can= they be a subset; we’re talking array.

Last par of section 3.2: I understand that the AS always replies with a = new access token.

Section 3.3: May be it is good to write that the POST exchange is not se= cured.

Page 9: N_S is the value of the {“rsnonce” :value} pair?

Page 10: The phrase: “It is required of the application profiles&h= ellip;.”. Is not clear. Does it mean that all application profiles mu= st be changed to include this parameter? And what if this has not happened?=

Page 11, section 4: It is good to specify that all exchange between join= ing node and KDC passes over the management channel.

Page 12, line 2: Add:  securely communicate “over the group c= hannel”…..

Page 12: s/assiciated/associated/

Sec 4.1: please, make clear from the very start that the path names of t= he resources are example names.

Page 13, section 4.1.2.1: Scope does not specify the resource path, but = the value of gid

Page 14: N_C is the value of the (“cnonce”:value} pair?

Page 14: I don’t understand the paragraph: “The handler veri= fies … error message.” How can the gid be a subset of the &ldq= uo;scope”? This occurs at several other occasions in the text.

Page 15: should num be monotonically increasing with each new version?

Page 16, bullet 1: what are the member identifiers?

Page 20, section 4.1.6: It is not clear to me how node is defined.

Page 21, section 4.2: Instead of pairwise secure communication channel u= se the term Management channel.

Page 22, paragraph 3: group identifier cannot be equal to the value of t= he scope; At most it can be equal to the first array element of the scope v= alue.

Page 22, section 4.3, paragraph 2: “that the client was not able t= o receive”. The process in which clients receive new keying material = without asking for it is not clear to me. Suggest to remove the phrase.

Page 23, Text after figure 7:

The rekeying process is not clear to me. Is it possible to discuss at le= ast one approach, where the ContextId changes with the Master secret and th= e salt, every time the group changes composition or the keying material is = refreshed. Receiving an unknown contextId means that rekeying took place an= d new material needs to be fetched. However, is there enough information to= know which KDC handles the rekeyed group? The ContextId is unknown, and th= e receiverId may refer to multiple contexts, while it is not guaranteed tha= t each group has its own resource on the member platform.

Greetings,

Peter
--
= Peter van der Stok
vanderstok consultancy
mailto: consultancy@vanderstok.org, stokcons@bbhmail.nl
www: www= =2Evanderstok.org
tel NL: +31(0)492474673     = F: +33(0)966015248
--=_df1919c560713f42cca403f6ba7558ba-- From nobody Mon Nov 18 11:06:57 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 187AE120B00; Mon, 18 Nov 2019 11:06:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=HJs5bDlb; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=ETqftQwj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ywRIwi7qURz; Mon, 18 Nov 2019 11:06:53 -0800 (PST) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85731120AC6; Mon, 18 Nov 2019 11:06:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5939; q=dns/txt; s=iport; t=1574104013; x=1575313613; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Il9KvJj4U2TzXau7b0rV6c14my3cJRGtPMCD1ozifcI=; b=HJs5bDlb612iMSrKqgK9s5wE3F9VAE/6JEotYyPw5+8Ms8dPvKw2vpTN F1pdQhmnO96eoMMK1NM5Og2s2aulKGq9idbPx6yiS7SNWsWtiB3wGSOnW AmvsyJ7JylQaqPYK8nMJCGmer4VYxslqpaMrl7URLK+jeFae+BLB1nsvK I=; IronPort-PHdr: =?us-ascii?q?9a23=3Ak7UQcBJZMg0qUtxYU9mcpTVXNCE6p7X5OBIU4Z?= =?us-ascii?q?M7irVIN76u5InmIFeBvKd2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUg?= =?us-ascii?q?Mdz8AfngguGsmAXFX4JfvyZiozNM9DT1RiuXq8NBsdFQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CAAAD36tJd/4gNJK1lDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEBAQEBAREBAQEBAQEBAQEBAYF+gUspJwVsWCAECyqHcAOKb4JeiVi?= =?us-ascii?q?OKIFCgRADVAkBAQEMAQElCAIBAYRAAoIjJDgTAgMLAQEEAQEBAgEFBG2FNwy?= =?us-ascii?q?FUQEBAQEDEigGAQE3AQsEAgEIEQQBAQEeECERHQgCBA4FCBqCNUyCRgMuAQI?= =?us-ascii?q?Mph4CgTiIYIIngn4BAQWBNAGDSA0LghcDBoE2jBUYgUA/gRFGgh4uPoIbRwE?= =?us-ascii?q?BgRsTARIBCRiDQIIsrT8tQQqCKocaih2EM4I+h2iOB4FklwCCE489AgQCBAU?= =?us-ascii?q?CDgEBBYFpIkQjcXAVgydQERSRGgwXg1CKGDt0CoEeincNFwGCGQEB?= X-IronPort-AV: E=Sophos;i="5.68,321,1569283200"; d="scan'208";a="373221449" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 18 Nov 2019 19:06:52 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id xAIJ6qkk001384 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 18 Nov 2019 19:06:52 GMT Received: from xhs-rcd-003.cisco.com (173.37.227.248) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 18 Nov 2019 13:06:52 -0600 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 18 Nov 2019 13:06:50 -0600 Received: from NAM05-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 18 Nov 2019 13:06:50 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E6DEjOR2zjxzAaedm6jjqkYBp+grlN1diHECmUTMjR6Vl4HmWjGKq9MrsdGCkmf2TCSt8FwyvRWej16+a0dFTDskk8CLniHf7l2oD/R9W4SzO8est1WDQqLKNZk61gVTnjEOmodRVQhU476S2NrSLsC1Y2GfzDVOrjqAKJou63JskpPlQeInE+verVO6uTfkVciFWOFlRtBviPZ+SIKhLiUnDf3zPA5v3Dy0lQR/mhyDGySCFlHrSeaYujToes/wwDgXctB312dKcWhhiWYZnbaDUQFy+t78E71Ay9S3ljL0EkCMguXYHIfhsNhIJU/atDk6i9FZjOHPV4stwuBJrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5adEeuhBAhf99a90/ZwK6s+bIL+t/bwUz4NlAFJpQDs=; b=LnWCF48v4F9xRjVYWScf8Oltmu4JR5RsEwdGyTX4Ssb4sVlubJ7/wgOY3lUwBovYVhpP463y8opLhzvHMTXoM89DehqMmbRLg6q2mj2f6G6U4v70WtvoCRcZzihpfwitf7evAgcyn2jFyosu56eXNeum9aOSXGQ05zZe7qavzKG18pIXb1hIMZqerGTawa9n8LCZQFvktMTSlbjdTkgpIFV53bJIv8y1s+/Cv5ePslKj7oBnfwLL9K2GD+gFfkPQ+jXvoNQ8IDIMbvVyx5g13DmvxTGvjjKAcySnmU47wk1GmY8n2nF0d4PeHW0mra/8AFIYEIR5L25VBdhc/RBHVw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5adEeuhBAhf99a90/ZwK6s+bIL+t/bwUz4NlAFJpQDs=; b=ETqftQwjcBVg4U+TKs2UWCnUAmv0dpMaNpOP2KaKHJvE6o00NqFmeizTQqpY3q5oRwqXxZTLYu1Xi5puUNmt2vzFLLboeDEAJvPqGwtlh0cW9I/VdD8Av/zxEvPkd4PGdQ0+LKudkt7sW3VnPwKq5qb0y/DHGn8QB5QFs/0v2Ls= Received: from BN7PR11MB2547.namprd11.prod.outlook.com (52.135.255.146) by BN7PR11MB2819.namprd11.prod.outlook.com (52.135.246.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23; Mon, 18 Nov 2019 19:06:49 +0000 Received: from BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5c82:bb6a:d0f0:b802]) by BN7PR11MB2547.namprd11.prod.outlook.com ([fe80::5c82:bb6a:d0f0:b802%6]) with mapi id 15.20.2451.029; Mon, 18 Nov 2019 19:06:49 +0000 From: "Panos Kampanakis (pkampana)" To: Benjamin Kaduk CC: Yaron Sheffer , "draft-ietf-ace-coap-est.all@ietf.org" , "ace@ietf.org" Thread-Topic: [Ace] Secdir last call review of draft-ietf-ace-coap-est-15 Thread-Index: AQHVgcaC5NivFu6vxkuLEqSa/tiqS6ddYSVAgCr2zQCACSCUsA== Date: Mon, 18 Nov 2019 19:06:49 +0000 Message-ID: References: <157097172245.20767.1326966836276837764@ietfa.amsl.com> <20191112230600.GJ32847@kduck.mit.edu> In-Reply-To: <20191112230600.GJ32847@kduck.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [2001:420:c0c4:1006::94] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fdfd70d1-907a-49f4-d2bf-08d76c5a770f x-ms-traffictypediagnostic: BN7PR11MB2819: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0225B0D5BC x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10009020)(4636009)(346002)(39860400002)(396003)(376002)(366004)(136003)(189003)(199004)(51444003)(13464003)(66446008)(66556008)(86362001)(66476007)(14454004)(14444005)(256004)(71200400001)(64756008)(71190400001)(966005)(66574012)(5660300002)(229853002)(52536014)(81166006)(46003)(478600001)(81156014)(8676002)(74316002)(486006)(305945005)(8936002)(11346002)(446003)(186003)(99286004)(53546011)(6506007)(54906003)(316002)(25786009)(6116002)(102836004)(6916009)(76116006)(7736002)(476003)(4326008)(6436002)(76176011)(6246003)(2171002)(66946007)(7696005)(33656002)(2906002)(55016002)(6306002)(9686003); DIR:OUT; SFP:1101; SCL:1; SRVR:BN7PR11MB2819; H:BN7PR11MB2547.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: yY/jdEC30Lyk1U8oocyDMVyRrzipT52f6zn6ypg+qK53zrRppbTYdWdDoOK5CFQY5vde25iXzlY2/Xih+A66xRumFS9xNZ3JGEjsJHMA/bcHdvQTVUGQMNP4TLZpKox3jXdGodhFQk2iEmtL7E48+pWF6H7P34ohJHNpBLH9NsDIrE48wvuUw4POpL2XfWMKMocjgr8A6qIYTxX0yqRfjqbGEvNTf6IHe3DCmPVoQ43iJ6gC/8oqlDDTWwMM2xeEuSLfG5Y46XxVY0q1UBIn9N/tN9x+G1rYk69qinu3GYSL95pw4LBdE5cPdTBETf5UeaxPoThPLl0d7nyZyrfsIAYnSv//aoSRliX+mT9AC4NMMMeE9FZpLTU295r8M29/JGtKmSQlGLG3GqByif3pw1WwSXi5kxLhZGVckP9Dnr6NXVXWX3r3BpW3bPYgGV4cm9aStxsD279ZrOho/Xy31dK1iNamFVJStF7IVE/Z2QoqhLmBHZkUMqoSLcmOquoItmw5Xs6E0leriNEdRGwHNttVO3806uwVK0zYUwgTtu8BNDtEmh6Y88K2PCtAnK/9 x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fdfd70d1-907a-49f4-d2bf-08d76c5a770f X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Nov 2019 19:06:49.4288 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: csm7tpl0Qgx5hWa2RHFacf3Gj8NxkyJClxUaspdXaTOlTeH9ydQKZ14dmM2hrrGhLskwixBBK6ztz7v9iQcxDg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2819 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.15, xch-aln-005.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [Ace] Secdir last call review of draft-ietf-ace-coap-est-15 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Nov 2019 19:06:56 -0000 Hi Ben, All addressed, except for the last one. The diff is here https://github.com= /SanKumar2015/EST-coaps/commit/53933bb9f93657955555f2302baef2e39709ae05=20 My responses below in Pk>=20 I will wait for your confirmation before I upload version 17. Panos -----Original Message----- From: Benjamin Kaduk =20 Sent: Tuesday, November 12, 2019 6:06 PM To: Panos Kampanakis (pkampana) Cc: Yaron Sheffer ; draft-ietf-ace-coap-est.all@ietf= .org; ace@ietf.org Subject: Re: [Ace] Secdir last call review of draft-ietf-ace-coap-est-15 Hi Panos, On Wed, Oct 16, 2019 at 03:06:01PM +0000, Panos Kampanakis (pkampana) wrote= : > Hi Yaron, >=20 > Thank you for the thorough review and feedback.=20 >=20 > To make sure I don't miss any of your comments over an email thread, I tr= ack all your feedback in git issue 152 https://github.com/SanKumar2015/EST-= coaps/issues/152 There I tried to address all your comments and question an= d clarify some points.=20 >=20 > I also pushed minor changes to fix a few of the issues you brought up.=20 > The diff of the changes pushed is here=20 > https://github.com/SanKumar2015/EST-coaps/commit/86d785f2122596f28674f > e8e403d30467c98abfb >=20 > Please review the git issue and let us know if there are pending concerns= . Otherwise I am planning to reupload a new iteration next week.=20 Thanks for uploading the -16, and thanks again to Yaron for the very though= tful review. Sadly, I seem to have not looked at the github diff closely enough/in a tim= ely fashion, so I think we'll need to publish a -17 before I can move this = into IESG evaluation. Here's my remaining notes: Section 4 Private keys can be transported as responses to a server-side key generation request as described in Section 4.4 of [RFC7030] and discussed in Section 5.8 of this document. I think that, since Yaron brought it up, we should say "Section 4.4 of [RFC= 7030] (and subsections)". PK> Fixed.=20 curve. After the standardization of [RFC7748], support for Curve25519 will likely be required in the future by (D)TLS Profiles for the Internet of Things [RFC7925]. Sorry I missed this before -- "standardization" is a bit of a bugbear (7748= is Informational, not even Standards-Track, let alone full Internet Standa= rd). Pk> Replaced "standardization" with "publication".=20 In a constrained CoAP environment, endpoints can't always afford to establish a DTLS connection for every EST transaction. Authenticating and negotiating DTLS keys requires resources on low- end endpoints and consumes valuable bandwidth. To alleviate this situation, an EST-coaps DTLS connection MAY remain open for sequential EST transactions. For example, an EST csrattrs request that is followed by a simpleenroll request can use the same authenticated DTLS connection. However, when a cacerts request is I think we can also clarify that this "MAY remain open" is changing expecta= tions from RFC 7030, where the expectation was that the TLS connection did = not remain open. Pk> I added " which was not the case in [RFC7030]" Section 10.1 the first DTLS exchange. Alternatively, in a case where a /sen request immediately follows a /crts, a client MAY choose to keep the connection authenticated by the Implicit TA open for efficiency reasons (Section 4). A client that interleaves EST-coaps /crts request with other requests in the same DTLS connection SHOULD revalidate the server certificate chain against the updated Explicit TA from the /crts response before proceeding with the subsequent requests. If the server certificate chain does not authenticate against the database, the client SHOULD close the connection without completing the rest of the requests. The updated Explicit TA MUST continue to be used in new DTLS connections. I think Yaron was saying that "even if the optimization of keeping the DTLS= connection open is useful in the general case, it is very risky and prone = to misimplementation when combined with /crts". So, if I can rephrase the = propsal to be that we say something more like "even though in general the D= TLS connection can remain open for efficiency (Section 4), after a /crts re= sponse, the client MUST close the DTLS connection and establish a new DTLS = connection for subsequent EST exchanges", are there reasons that we shouldn= 't use that behavior? Pk> I am not sure it is worth to add more complexity specific to /crts. We = would be adding more complexity for the client to track if this TLS connect= ion is a cacerts connection then I need to close it, if it is any other con= nection then I can interleave requests. I am not convinced that the risk is= that big either. A malicious user that was authenticated by the Implicit D= B could easily craft a cacerts response that allows him to be authenticated= by the Explict DB. In other words an active attacker would have no problem= s of fooling the Explicit DB if he was allowed in by the Implicit DB. I thi= nk the whole issue here is conceptual. The moment we get a new Trust DB we = need to trust it and not use the old one, but I don't think that keeping th= e connection open for one or two more requests is that risky. Even RFC7030 = allows for it in the event that the client does not have an Implicit DB whe= n it is starting=20 " The client MAY provisionally continue the TLS handshake to completion for the purposes of accessing the /cacerts or /fullcmc method. " I think the language as it is now is pretty clear on what we are trying to = do. And the Security Considerations spells out clearly. Of course, as alway= s, some implementer could make a mistake, but that could happen with RFC703= 0 and any other RFC as well. =20 From nobody Mon Nov 18 21:42:53 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9908120803; Mon, 18 Nov 2019 21:42:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Calkuyhd_jlJ; Mon, 18 Nov 2019 21:42:46 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 917E3120013; Mon, 18 Nov 2019 21:42:46 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAJ5gfWg007179 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Nov 2019 00:42:44 -0500 Date: Mon, 18 Nov 2019 21:42:41 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: draft-ietf-ace-oauth-params.all@ietf.org, "ace@ietf.org" Message-ID: <20191119054241.GD32847@mit.edu> References: <20191115121419.GG32847@kduck.mit.edu> <5bfa41c5-7339-5443-9691-92c6fa879fe4@ri.se> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5bfa41c5-7339-5443-9691-92c6fa879fe4@ri.se> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-params-05 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 05:42:52 -0000 On Sun, Nov 17, 2019 at 04:45:04AM +0100, Ludwig Seitz wrote: > On 15/11/2019 13:14, Benjamin Kaduk wrote: > > Hi all, > > > > I'm mostly just nitpicking in the following comments; the actual content > > here is in good shape. (But some of these are popular things that > > directorate reviewers like to complain about, so fixing them preemptively > > seems wise.) > > > > Section 1 > > > > access tokens. These parameters and claims can also be used in other > > contexts, and may need to be updated to align them with ongoing OAuth > > work. Therefore they have been split out into this document, which > > can be used and updated independently of [I-D.ietf-ace-oauth-authz]. > > > > I expect that we'll get some reviewers who want to wordsmith this last > > sentence. It's fine to wait and see what suggestions come in (if any), > > but if you want to try to forestall those, my suggestion would be: > > > > % Therefore, these parameters and claims have been put into a dedicated > > % document, to facilitate their use and any potential updates in a manner > > % independent of [I-D.ace-oauth-authz]. > > > Done. > > > Section 3.1 > > > > req_cnf > > OPTIONAL. This field contains information about the key the > > client would like to bind to the access token for proof-of- > > possession. It is RECOMMENDED that an AS reject a request > > containing a symmetric key value in the 'req_cnf' field, since the > > AS is expected to be able to generate better symmetric keys than a > > potentially constrained client. The AS MUST verify that the > > > > nit: I'd wordsmith this a bit, since the idea is that the AS-generated > > key will be better than one generated by a constrained client, but a > > non-constrained client can probably do just fine at keygen. So, > > I'd consider dropping "potentially", as the rest of the sentence does > > not have anything to imply that all clients using this claim are > > constrained. > > > Done. > > > Payload: > > { > > "req_cnf" : { > > "COSE_Key" : { > > "kty" : "EC", > > "kid" : h'11', > > "crv" : "P-256", > > "x" : b64'usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8', > > "y" : b64'IBOL+C3BttVivg+lSreASjpkttcsz+1rb7btKLv8EX4' > > } > > } > > } > > > > Figure 1: Example request for an access token bound to an asymmetric > > key. > > > > Shouldn't an access token request have an authorization code? > > The other parameters from Section 4.1.3 of RFC 6749 have conditions > > attached to their REQUIRED status, but not "code". > > > In draft-ietf-ace-oauth-authz section 5.6.1. (Client-to-AS Request) we > specify that when the "grant_type" parameter is missing, then > "client_credentials" is implied, which in turn means that the client > does not need an authorization code. Section 4.1.3 of RFC 6749 is about > the authorization code grant, you are looking at the ACE-ified version > of Section 4.4 Ah, thanks. I remembered that we had a default "grant_type" but was too fast when trying to check the other (sometimes-)required parameters. > > Section 3.2 > > > > cnf > > REQUIRED if the token type is "pop" and a symmetric key is used. > > > > Just to check, this means that if the client includes a symmetric 'cnf' > > key and the AS ignores the prior recommendation to ignore such a > > symmetric confirmation key in the request, the AS still has to echo > > back the symmetric key that is in use? (There's also potentially some > > interesting interactions if we use a 'kid'.) > > Indeed as the drafts are written right now, that would be the expected > AS behaviour. This is not entirely intentional, and my only objection to > changing it at this time is that writing specification text handling > interactions we are recommending against (i.e. accepting > client-suggested symmetric keys) seems icky. > As for 'kid' I'd just expect the AS to echo back the kid, not the actual > key. I don't see any obvious problems from this behavior, so leaving it as-is seems like the right thing to do for now. > > > > MAY be present for asymmetric proof-of-possession keys. This > > field contains the proof-of-possession key that the AS selected > > for the token. Values of this parameter follow the syntax of the > > > > And to check here again, the omitted 'cnf' in the response means that he > > AS accepted the client's requested asymmetric key? (There wouldn't be a > > case where the AS rejects an offered asymmetric key and replaces it with > > a new one, right?) > Indeed that is correct. Note that there could be cases where an AS > rejects an offered asymmetric key and replaces it by another one. This > would be if the AS knows that the RS doesn't support this key format, > and also knows that the client holds another public key which is > actually supported by the RS. Thanks for pointing out that scenario :) > > > > rs_cnf > > OPTIONAL if the token type is "pop" and asymmetric keys are used. > > MUST NOT be present otherwise. This field contains information > > about the public key used by the RS to authenticate. If this > > parameter is absent, either the RS does not use a public key or > > the AS assumes that the client already knows the public key of the > > RS. Values of this parameter follow the syntax of the "cnf" claim > > > > I'd prefer to not word this as "the AS assumes", as that implies that we > > will end up with a fragile overall system. Can we say something more > > along the lines of "when the AS knows that the RS can authenticate > > itself to the client without additional information"? (I expect that > > less awkward wordings than the above are possible...) > > > Done. > > > > from section 3.1 of [I-D.ietf-ace-cwt-proof-of-possession]. See > > Section 5 for details on the use of this parameter. > > > > Also (both here and above), I'd suggest s/details on the use of this > > parameter/additional discussion of the usage of this parameter/; we do not > > go into a huge amount of detail in Section 5. > Done. > > > > > I don't think the caption for Figure 3 is quite right... > Fixed. > > > > > Also, Figures 2 and 3 are using the same "SlAV32hkKG ..." access token > > snippet that we changed in the core spec, so we should probably change > > it here as well. > I changed the one in figure 3 to the same snippet I used which an > asymmetric pop key in the core spec. The snippet in figure 2 is still in > the core spec, so I left it here as well. > > > > > Section 3.3 > > > > In the symmetric-key case this basically degenerates to > > Needham-Schroeder (but I also don't expect anyone to use this with > > symmetric keys). > > However, for asymmetric keys, we might assume that the AS is not > > creating a new asymmetric keypair for the RS to use, and instead > > referring to one already known to the RS, e.g., just via the public > > part. I can't quite decide whether the RS should always blindly trust > > the AS in this regard, or might want to have an additional policy layer > > that would allow for "I do not want to use this public key with this > > specific client". Any such benefit from that would be subtle, as > > presumably the AS has already told the client the same key, and so the > > RS is limited to merely not presenting cryptographic evidence to the > > client that it holds the private key (as opposed to the client trusting > > the AS as trusted-third-party that the RS has that key). > > I guess that suggests that there's no need for additional policy on the > > RS, and we don't need any more text here. > > > Actually I had asymmetric keys in mind when I created this claim. > Since one could imagine protocols using different symmetric keys for > client and RS though, so I wouldn't want to restrict this to > asymmetric-only. > Also: yes, the idea was that the AS just uses the public part of an > asymmetric key, of which it knows that the RS has the corresponding > private part. > Do you want me to make this more explicit? This seems like a case where more text would not provide enough value to justify its presence. I don't think there's really anything to be confused about that requires clarification; there are just some cases where the AS might do something that's a little weird but is not harmful. > > Section 5 > > > > o "req_cnf" in the access token request C -> AS, OPTIONAL to > > indicate the client's raw public key, or the key-identifier of a > > previously established key between C and RS that the client wishes > > to use for proof-of-possession of the access token. > > > > There's potentially an interesting question here about whether the AS > > has to, can, or shouldn't assign semantics to key identifiers. The part > > most needed for interoperability is, of course, that the RS knows to map > > an incoming kid to an actual key, and the parallel that the client knows > > that the (kid, key, RS) tuple is usable. I don't see a reason why the > > AS needs to have semantics to a given kid for interoperability, though > > perhaps there will be some scenarios where the AS manages the kid > > namespace at a given RS as opposed to the RS doing so. But, on the > > other hand, having the AS not give semantics to 'kid' turns the AS into > > a dumb transport, which tends to be the sort of thing that merits > > additional analysis. > > Basically the current expectation is that when the client requests a kid > to be bound to an access token, it "knows what it is doing" i.e. either > it has already sent a token using this pop key to the RS previously; or > the client and the RS have been commissioned to have this shared key > bound to the kid. > Do you want me to make this more explicit? We already say "previously established key between C and RS", so I don't think we need to repeat "the client knows what it's doing". If we were to add text it would be relating to whether or what policy the AS might enforce relating to 'kid'. But, I don't think we have any real thoughts on this matter, so there isn't anything to say at this point. > > > > o "cnf" in the token response AS -> C, OPTIONAL if using an > > asymmetric key or a key that the client requested via a key > > identifier in the request. REQUIRED if the client didn't specify > > a "req_cnf" and symmetric keys are used. Used to indicate the > > > > This seems to make no statement (REQUIRED/OPTIONAL) about this claim for > > the case where the client didn't specify a "req_cnf" and asymmetric keys > > are used. This situation, of course, can't happen (at least not > > currently), as the absence of "req_cnf" is used as a signal for server > > (symmetric) keygen, but I suggest that we only mention "client didn't > > specify a 'req_cnf'" so we don't have to keep explaining this to > > reviewers. > > So should I remove the "and symmetric keys are used." part? Yes, I think that's best. Since that's the only comment left on the -06, I'm happy to just send the -06 out for IETF LC and lump it in with any comments from the last call. > > > > > o "rs_cnf" in the token response AS -> C, OPTIONAL to indicate the > > public key of the RS, if it uses one to authenticate to the > > client. > > > > nit(?): I'd consider adding a phrase about "and the binding between key > > and RS identiyt is not established through other means". > Done. > > > > > o "rs_cnf" in the introspection response AS -> RS, OPTIONAL, > > contains the public key that the RS should use for authenticating > > to the client (e.g. if the RS has several different public keys). > > > > nit(?): I'd consider adding a phrase about "and there may be ambiguity > > as to which key to use" or similar, though I'm failing to come up with a > > non-awkward phrasing. > > > Done. I'll go with slightly awkward, but more correct. > > > > Note that the COSE_Key structure in a confirmation claim or parameter > > may contain an "alg" or "key_ops" parameter. If such parameters are > > present, a client MUST NOT use a key that is not compatible with the > > profile or proof-of-possession algorithm according to those > > > > nit(?): s/not compatible/incompatible/ would avoid a "double 'not'", if > > that's seen as desirable. > Fixed. > > > > > Section 6 > > > > I thought we had set up separate map key namespaces for (e.g.) token > > requests, token responses, and introspection responses, so that > > attempting to use the same key value for all the uses of these > > parameters defined by this document is something of a type error. > > E.g., they end up in different registries, as we do in Section 9.2, 9.5, > > and 9.6. > > > That is correct. I have added separate entries and a column > specifying the different uses. I will leave the values to be the same > though. Great; thank you! > > Section 9.1, 9.2, 9.4 > > > > I note that the distance between "authenticate to the client" and > > "authenticate the client" is small enough that I expect it to be a > > common misreading, and also that the other descriptions at > > https://www.iana.org/assignments/jwt/jwt.xhtml#claims are a bit more > > pithy than what we use here. Perhaps, "public key used by RS to > > authenticate itself to client"? > > > Done. > > > Section 9.5 > > > > This section registers the following parameter mappings in the "Token > > Endpoint CBOR Mappings" registry established in section 8.9. of > > [I-D.ietf-ace-oauth-authz]. > > > > It looks like this has been renamed to the "OAuth Parameters CBOR > > Mappings" registry? > Correct. Fixed. > > > > > Section 9.6 > > > > This section registers the following parameter mappings in the > > "Introspection Endpoint CBOR Mappings" registry established in > > section 8.11. of [I-D.ietf-ace-oauth-authz]. > > > > Similarly, this has been renamed to "OAuth Token Introspection Response > > CBOR Mappings". > > > Fixed. > > > Section 11.1 > > > > It's not entirely clear that RFC 7252 needs to be a normative reference; > > we don't do much with CoAP directly in this document. > > > Agree. I moved it. > > > Appendix A > > > > We might want to wordsmith this some if it's to be kept for the final > > RFC (depending on what the OAuth work looks like at that point). I'm > > not sure that there are any useful changes to make to it right now, > > though. > > It seems the OAuth draft I'm talking about here is not going anywhere > fast. We might consider removing this in the final edition. Sure. Let's plan to revisit that after IETF LC (where hopefully we will not get many comments; I think this one is in good shape). We could also ask the authors here in Singapore what they see its prospects as. Thanks for the updates, Ben From nobody Mon Nov 18 22:22:10 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12628120857; Mon, 18 Nov 2019 22:22:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TL332e2MfWVW; Mon, 18 Nov 2019 22:22:03 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 387D1120855; Mon, 18 Nov 2019 22:22:02 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAJ6LvEm015106 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Nov 2019 01:21:59 -0500 Date: Mon, 18 Nov 2019 22:21:56 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: draft-ietf-ace-oauth-params.all@ietf.org, "ace@ietf.org" Message-ID: <20191119062156.GF32847@mit.edu> References: <20191115121419.GG32847@kduck.mit.edu> <5bfa41c5-7339-5443-9691-92c6fa879fe4@ri.se> <20191119054241.GD32847@mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191119054241.GD32847@mit.edu> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-params-05 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 06:22:09 -0000 One more update on this one: I cancelled the last-call request, because my discussions with Ludwig about the core framework indicated a strong chance that we'll want to tweak how rs_cnf works, and we should of course reflect any change to rs_cnf in this document as well. Further updates (hopefully) in the framework's thread. -Ben On Mon, Nov 18, 2019 at 09:42:41PM -0800, Benjamin Kaduk wrote: > On Sun, Nov 17, 2019 at 04:45:04AM +0100, Ludwig Seitz wrote: > > On 15/11/2019 13:14, Benjamin Kaduk wrote: > > > Hi all, > > > > > > I'm mostly just nitpicking in the following comments; the actual content > > > here is in good shape. (But some of these are popular things that > > > directorate reviewers like to complain about, so fixing them preemptively > > > seems wise.) > > > > > > Section 1 > > > > > > access tokens. These parameters and claims can also be used in other > > > contexts, and may need to be updated to align them with ongoing OAuth > > > work. Therefore they have been split out into this document, which > > > can be used and updated independently of [I-D.ietf-ace-oauth-authz]. > > > > > > I expect that we'll get some reviewers who want to wordsmith this last > > > sentence. It's fine to wait and see what suggestions come in (if any), > > > but if you want to try to forestall those, my suggestion would be: > > > > > > % Therefore, these parameters and claims have been put into a dedicated > > > % document, to facilitate their use and any potential updates in a manner > > > % independent of [I-D.ace-oauth-authz]. > > > > > Done. > > > > > Section 3.1 > > > > > > req_cnf > > > OPTIONAL. This field contains information about the key the > > > client would like to bind to the access token for proof-of- > > > possession. It is RECOMMENDED that an AS reject a request > > > containing a symmetric key value in the 'req_cnf' field, since the > > > AS is expected to be able to generate better symmetric keys than a > > > potentially constrained client. The AS MUST verify that the > > > > > > nit: I'd wordsmith this a bit, since the idea is that the AS-generated > > > key will be better than one generated by a constrained client, but a > > > non-constrained client can probably do just fine at keygen. So, > > > I'd consider dropping "potentially", as the rest of the sentence does > > > not have anything to imply that all clients using this claim are > > > constrained. > > > > > Done. > > > > > Payload: > > > { > > > "req_cnf" : { > > > "COSE_Key" : { > > > "kty" : "EC", > > > "kid" : h'11', > > > "crv" : "P-256", > > > "x" : b64'usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8', > > > "y" : b64'IBOL+C3BttVivg+lSreASjpkttcsz+1rb7btKLv8EX4' > > > } > > > } > > > } > > > > > > Figure 1: Example request for an access token bound to an asymmetric > > > key. > > > > > > Shouldn't an access token request have an authorization code? > > > The other parameters from Section 4.1.3 of RFC 6749 have conditions > > > attached to their REQUIRED status, but not "code". > > > > > In draft-ietf-ace-oauth-authz section 5.6.1. (Client-to-AS Request) we > > specify that when the "grant_type" parameter is missing, then > > "client_credentials" is implied, which in turn means that the client > > does not need an authorization code. Section 4.1.3 of RFC 6749 is about > > the authorization code grant, you are looking at the ACE-ified version > > of Section 4.4 > > Ah, thanks. I remembered that we had a default "grant_type" but was too > fast when trying to check the other (sometimes-)required parameters. > > > > Section 3.2 > > > > > > cnf > > > REQUIRED if the token type is "pop" and a symmetric key is used. > > > > > > Just to check, this means that if the client includes a symmetric 'cnf' > > > key and the AS ignores the prior recommendation to ignore such a > > > symmetric confirmation key in the request, the AS still has to echo > > > back the symmetric key that is in use? (There's also potentially some > > > interesting interactions if we use a 'kid'.) > > > > Indeed as the drafts are written right now, that would be the expected > > AS behaviour. This is not entirely intentional, and my only objection to > > changing it at this time is that writing specification text handling > > interactions we are recommending against (i.e. accepting > > client-suggested symmetric keys) seems icky. > > As for 'kid' I'd just expect the AS to echo back the kid, not the actual > > key. > > I don't see any obvious problems from this behavior, so leaving it as-is > seems like the right thing to do for now. > > > > > > > MAY be present for asymmetric proof-of-possession keys. This > > > field contains the proof-of-possession key that the AS selected > > > for the token. Values of this parameter follow the syntax of the > > > > > > And to check here again, the omitted 'cnf' in the response means that he > > > AS accepted the client's requested asymmetric key? (There wouldn't be a > > > case where the AS rejects an offered asymmetric key and replaces it with > > > a new one, right?) > > Indeed that is correct. Note that there could be cases where an AS > > rejects an offered asymmetric key and replaces it by another one. This > > would be if the AS knows that the RS doesn't support this key format, > > and also knows that the client holds another public key which is > > actually supported by the RS. > > Thanks for pointing out that scenario :) > > > > > > > rs_cnf > > > OPTIONAL if the token type is "pop" and asymmetric keys are used. > > > MUST NOT be present otherwise. This field contains information > > > about the public key used by the RS to authenticate. If this > > > parameter is absent, either the RS does not use a public key or > > > the AS assumes that the client already knows the public key of the > > > RS. Values of this parameter follow the syntax of the "cnf" claim > > > > > > I'd prefer to not word this as "the AS assumes", as that implies that we > > > will end up with a fragile overall system. Can we say something more > > > along the lines of "when the AS knows that the RS can authenticate > > > itself to the client without additional information"? (I expect that > > > less awkward wordings than the above are possible...) > > > > > Done. > > > > > > > from section 3.1 of [I-D.ietf-ace-cwt-proof-of-possession]. See > > > Section 5 for details on the use of this parameter. > > > > > > Also (both here and above), I'd suggest s/details on the use of this > > > parameter/additional discussion of the usage of this parameter/; we do not > > > go into a huge amount of detail in Section 5. > > Done. > > > > > > > > I don't think the caption for Figure 3 is quite right... > > Fixed. > > > > > > > > Also, Figures 2 and 3 are using the same "SlAV32hkKG ..." access token > > > snippet that we changed in the core spec, so we should probably change > > > it here as well. > > I changed the one in figure 3 to the same snippet I used which an > > asymmetric pop key in the core spec. The snippet in figure 2 is still in > > the core spec, so I left it here as well. > > > > > > > > Section 3.3 > > > > > > In the symmetric-key case this basically degenerates to > > > Needham-Schroeder (but I also don't expect anyone to use this with > > > symmetric keys). > > > However, for asymmetric keys, we might assume that the AS is not > > > creating a new asymmetric keypair for the RS to use, and instead > > > referring to one already known to the RS, e.g., just via the public > > > part. I can't quite decide whether the RS should always blindly trust > > > the AS in this regard, or might want to have an additional policy layer > > > that would allow for "I do not want to use this public key with this > > > specific client". Any such benefit from that would be subtle, as > > > presumably the AS has already told the client the same key, and so the > > > RS is limited to merely not presenting cryptographic evidence to the > > > client that it holds the private key (as opposed to the client trusting > > > the AS as trusted-third-party that the RS has that key). > > > I guess that suggests that there's no need for additional policy on the > > > RS, and we don't need any more text here. > > > > > Actually I had asymmetric keys in mind when I created this claim. > > Since one could imagine protocols using different symmetric keys for > > client and RS though, so I wouldn't want to restrict this to > > asymmetric-only. > > Also: yes, the idea was that the AS just uses the public part of an > > asymmetric key, of which it knows that the RS has the corresponding > > private part. > > Do you want me to make this more explicit? > > This seems like a case where more text would not provide enough value to > justify its presence. I don't think there's really anything to be confused > about that requires clarification; there are just some cases where the AS > might do something that's a little weird but is not harmful. > > > > Section 5 > > > > > > o "req_cnf" in the access token request C -> AS, OPTIONAL to > > > indicate the client's raw public key, or the key-identifier of a > > > previously established key between C and RS that the client wishes > > > to use for proof-of-possession of the access token. > > > > > > There's potentially an interesting question here about whether the AS > > > has to, can, or shouldn't assign semantics to key identifiers. The part > > > most needed for interoperability is, of course, that the RS knows to map > > > an incoming kid to an actual key, and the parallel that the client knows > > > that the (kid, key, RS) tuple is usable. I don't see a reason why the > > > AS needs to have semantics to a given kid for interoperability, though > > > perhaps there will be some scenarios where the AS manages the kid > > > namespace at a given RS as opposed to the RS doing so. But, on the > > > other hand, having the AS not give semantics to 'kid' turns the AS into > > > a dumb transport, which tends to be the sort of thing that merits > > > additional analysis. > > > > Basically the current expectation is that when the client requests a kid > > to be bound to an access token, it "knows what it is doing" i.e. either > > it has already sent a token using this pop key to the RS previously; or > > the client and the RS have been commissioned to have this shared key > > bound to the kid. > > Do you want me to make this more explicit? > > We already say "previously established key between C and RS", so I don't > think we need to repeat "the client knows what it's doing". > If we were to add text it would be relating to whether or what policy the > AS might enforce relating to 'kid'. But, I don't think we have any real > thoughts on this matter, so there isn't anything to say at this point. > > > > > > > o "cnf" in the token response AS -> C, OPTIONAL if using an > > > asymmetric key or a key that the client requested via a key > > > identifier in the request. REQUIRED if the client didn't specify > > > a "req_cnf" and symmetric keys are used. Used to indicate the > > > > > > This seems to make no statement (REQUIRED/OPTIONAL) about this claim for > > > the case where the client didn't specify a "req_cnf" and asymmetric keys > > > are used. This situation, of course, can't happen (at least not > > > currently), as the absence of "req_cnf" is used as a signal for server > > > (symmetric) keygen, but I suggest that we only mention "client didn't > > > specify a 'req_cnf'" so we don't have to keep explaining this to > > > reviewers. > > > > So should I remove the "and symmetric keys are used." part? > > Yes, I think that's best. > Since that's the only comment left on the -06, I'm happy to just send the > -06 out for IETF LC and lump it in with any comments from the last call. > > > > > > > > > o "rs_cnf" in the token response AS -> C, OPTIONAL to indicate the > > > public key of the RS, if it uses one to authenticate to the > > > client. > > > > > > nit(?): I'd consider adding a phrase about "and the binding between key > > > and RS identiyt is not established through other means". > > Done. > > > > > > > > o "rs_cnf" in the introspection response AS -> RS, OPTIONAL, > > > contains the public key that the RS should use for authenticating > > > to the client (e.g. if the RS has several different public keys). > > > > > > nit(?): I'd consider adding a phrase about "and there may be ambiguity > > > as to which key to use" or similar, though I'm failing to come up with a > > > non-awkward phrasing. > > > > > Done. I'll go with slightly awkward, but more correct. > > > > > > > Note that the COSE_Key structure in a confirmation claim or parameter > > > may contain an "alg" or "key_ops" parameter. If such parameters are > > > present, a client MUST NOT use a key that is not compatible with the > > > profile or proof-of-possession algorithm according to those > > > > > > nit(?): s/not compatible/incompatible/ would avoid a "double 'not'", if > > > that's seen as desirable. > > Fixed. > > > > > > > > Section 6 > > > > > > I thought we had set up separate map key namespaces for (e.g.) token > > > requests, token responses, and introspection responses, so that > > > attempting to use the same key value for all the uses of these > > > parameters defined by this document is something of a type error. > > > E.g., they end up in different registries, as we do in Section 9.2, 9.5, > > > and 9.6. > > > > > That is correct. I have added separate entries and a column > > specifying the different uses. I will leave the values to be the same > > though. > > Great; thank you! > > > > Section 9.1, 9.2, 9.4 > > > > > > I note that the distance between "authenticate to the client" and > > > "authenticate the client" is small enough that I expect it to be a > > > common misreading, and also that the other descriptions at > > > https://www.iana.org/assignments/jwt/jwt.xhtml#claims are a bit more > > > pithy than what we use here. Perhaps, "public key used by RS to > > > authenticate itself to client"? > > > > > Done. > > > > > Section 9.5 > > > > > > This section registers the following parameter mappings in the "Token > > > Endpoint CBOR Mappings" registry established in section 8.9. of > > > [I-D.ietf-ace-oauth-authz]. > > > > > > It looks like this has been renamed to the "OAuth Parameters CBOR > > > Mappings" registry? > > Correct. Fixed. > > > > > > > > Section 9.6 > > > > > > This section registers the following parameter mappings in the > > > "Introspection Endpoint CBOR Mappings" registry established in > > > section 8.11. of [I-D.ietf-ace-oauth-authz]. > > > > > > Similarly, this has been renamed to "OAuth Token Introspection Response > > > CBOR Mappings". > > > > > Fixed. > > > > > Section 11.1 > > > > > > It's not entirely clear that RFC 7252 needs to be a normative reference; > > > we don't do much with CoAP directly in this document. > > > > > Agree. I moved it. > > > > > Appendix A > > > > > > We might want to wordsmith this some if it's to be kept for the final > > > RFC (depending on what the OAuth work looks like at that point). I'm > > > not sure that there are any useful changes to make to it right now, > > > though. > > > > It seems the OAuth draft I'm talking about here is not going anywhere > > fast. We might consider removing this in the final edition. > > Sure. Let's plan to revisit that after IETF LC (where hopefully we will > not get many comments; I think this one is in good shape). > We could also ask the authors here in Singapore what they see its prospects > as. > > Thanks for the updates, > > Ben From nobody Tue Nov 19 00:44:55 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA8F3120B9F for ; Tue, 19 Nov 2019 00:44:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.405 X-Spam-Level: X-Spam-Status: No, score=-1.405 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.244, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EFjfiF9ToLj8 for ; Tue, 19 Nov 2019 00:44:48 -0800 (PST) Received: from mail-ua1-f43.google.com (mail-ua1-f43.google.com [209.85.222.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCE39120BD1 for ; Tue, 19 Nov 2019 00:44:47 -0800 (PST) Received: by mail-ua1-f43.google.com with SMTP id r22so6245471uam.11 for ; Tue, 19 Nov 2019 00:44:47 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=87MdrIX5enPThHv/zg0H7qeO45n4LFpswMr7VGyBIzY=; b=OmCT3FX8pdnR2YmoNqUraQQdHAqJgZSo7QfzANg3MalrxRIoPwIsfFPflCNy//YgSa MUFUZ9HFxRKGN/xcYeaa1nrfhIKjXeGI+Sia9Y/lcdRuJRUm5Bzx0TXHA5iNaXJPLsYv nZXGnAOH9wvHlwjLnji0iO/6GoFM56aqmqTBJp6MFs2afn5vKZEUzhrFcui2wbMIS6YM nyojJ4yg2ZdPXVDG4Z3zA5GWZtc21Rh1CASbiMNHFoky1eD3FF2d4kHC2goUo/6zBJzk UFM0dYiX8G9Cu66NGzGMtT9qEpVRzsNqCLT7k/fO04UXCw9zX7P5Im5eac2dw+I4qURo zqaA== X-Gm-Message-State: APjAAAWbMK78yvl9bzZc0hvjULgNM/aYHlzqmp/ZZHssGSGCStsPx6y8 mcvoizhhCBv+BaPhQDqEWXFFAYdlsg8Wn5cSG8ZcjetX X-Google-Smtp-Source: APXvYqw82PgWQRUKDLkwGK+3Ku9+fRara5kT1VS1r5dyedQ6mv0u67ihnqQ21oejAWGURaSksKrHihrPzHnGGMAolOU= X-Received: by 2002:ab0:658b:: with SMTP id v11mr19392571uam.119.1574153086507; Tue, 19 Nov 2019 00:44:46 -0800 (PST) MIME-Version: 1.0 From: Daniel Migault Date: Tue, 19 Nov 2019 16:44:35 +0800 Message-ID: To: Ace Wg Content-Type: multipart/alternative; boundary="0000000000008b1e990597af1363" Archived-At: Subject: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 08:44:54 -0000 --0000000000008b1e990597af1363 Content-Type: text/plain; charset="UTF-8" Dear working group, As mentioned during the ACE meeting, this mail starts a call for adoption for draft-palombini-ace-coap-pubsub-profile. Please provide your feed backs by December 4. https://datatracker.ietf.org/doc/draft-palombini-ace-coap-pubsub-profile/ Yours, Daniel --0000000000008b1e990597af1363 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Dear working group,=C2= =A0

As mentioned during th= e ACE meeting, this mail starts a call for adoption for draft-palombini-ace-coap-pubsub-p= rofile. Please provide your feed backs by December 4.
<= div dir=3D"ltr">
<= /span>

Yours= ,
Daniel

--0000000000008b1e990597af1363-- From nobody Tue Nov 19 01:12:31 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4579A120096 for ; Tue, 19 Nov 2019 01:12:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bbhmail.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3aJkfHyiiiuU for ; Tue, 19 Nov 2019 01:12:24 -0800 (PST) Received: from smtprelay.hostedemail.com (smtprelay0047.hostedemail.com [216.40.44.47]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E3901200A3 for ; Tue, 19 Nov 2019 01:12:24 -0800 (PST) Received: from filter.hostedemail.com (clb03-v110.bra.tucows.net [216.40.38.60]) by smtprelay02.hostedemail.com (Postfix) with ESMTP id 898FA3A9B for ; Tue, 19 Nov 2019 09:12:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bbhmail.nl; h= mime-version:content-type:date:from:to:subject:reply-to :message-id; s=key; bh=hPIZVJzknCUEMtoHQJnSqCmHUqT5m0LR/SUNnWemp DA=; b=Y2gQDk8gdkPs2ux1PfZMX/r/Le9YkFMqaQPqqh2ftGjqsLtwc5vbRpsjq nm/xEyWkVSuRZzhgYwtdKAjo77BOPfYn40eRbteWUAiXMtysCihPPQKysuHq2Jlh TrD2Camxe3myjT4A8sbwijAb7j4R/S/EvwEwem/ipRl10umaWY= X-Session-Marker: 73746F6B636F6E73406262686D61696C2E6E6C X-Spam-Summary: 50, 0, 0, , d41d8cd98f00b204, stokcons@bbhmail.nl, :, RULES_HIT:41:72:152:355:379:582:800:962:967:973:983:988:989:1152:1189:1208:1221:1260:1263:1313:1314:1345:1381:1431:1436:1437:1516:1517:1518:1534:1541:1575:1588:1589:1592:1594:1711:1730:1776:1792:2198:2199:2525:2561:2564:2682:2685:2693:2829:2859:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3352:3622:3865:3866:3867:3868:3870:3871:3872:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:4362:4557:4659:5007:6119:6261:6298:6659:7464:7903:8603:9010:9015:9025:9177:10004:10400:10848:11026:11658:11914:12043:12114:12555:12679:12895:12986:13071:13139:13161:13199:13229:13846:14096:14180:14181:14721:21060:21063:21080:21324:21433:21451:21625:21691:21740:30048:30054:30070, 0, RBL:none, CacheIP:none, Bayesian:0.5, 0.5, 0.5, Netcheck:none, DomainCache:0, MSF:not bulk, SPF:, MSBL:0, DNSBL:none, Custom_rules:0:0:0, LFtime:3, LUA_SUMMARY:none X-HE-Tag: hen77_6c2b7e5268700 X-Filterd-Recvd-Size: 4062 Received: from mail.bbhmail.nl (imap-ext [216.40.42.5]) (Authenticated sender: webmail@stokcons@bbhmail.nl) by omf01.hostedemail.com (Postfix) with ESMTPA for ; Tue, 19 Nov 2019 09:12:23 +0000 (UTC) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_7066c21d67827bd53dcce5340c7b1edf" Date: Tue, 19 Nov 2019 10:12:22 +0100 From: Peter van der Stok To: Ace Reply-To: consultancy@vanderstok.org User-Agent: Roundcube Webmail/1.4-rc2 Message-ID: <4ac02bb82ae9a67ad93c4ffe34063f19@bbhmail.nl> X-Sender: stokcons@bbhmail.nl Organization: vanderstok consultancy X-Originating-IP: [5.206.216.229] Archived-At: Subject: [Ace] ace-key-groupcomm-oscore-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 09:12:29 -0000 --=_7066c21d67827bd53dcce5340c7b1edf Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=UTF-8; format=flowed Hi Authors, Having read the document and comparing it with ace-key-groupcomm, I have to agree with Jim that this document repeats in "other" words the same subjects as specified in ace-key-groupcomm. In this form, it is very difficult to find out the differences between the two documents. It would be good if the same terminology was used or their equivalence was pointed out: eg: Client vs joining node Group-manager versus KDC joining request versus joining authorization Secondly, I suggest to make this draft much shorter, and mostly refer to the sections of ace-key-groupcomm and point out the differences. In many cases a list of items that MUST be present, are optional or not present at all will suffice. For example such an enumeration is done under the bullet key on page 15. New parameters can receive more text as is done for cs_alg, cs_params, cs_key_params, and cs_key_enc. Hope this helps, Thanks for all your work, greetings, Peter -- Peter van der Stok vanderstok consultancy mailto: consultancy@vanderstok.org, stokcons@bbhmail.nl www: www.vanderstok.org [1] tel NL: +31(0)492474673 F: +33(0)966015248 Links: ------ [1] http://www.vanderstok.org --=_7066c21d67827bd53dcce5340c7b1edf Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8 Hi Authors,

Having read the document and comparing it with ace-k= ey-groupcomm, I have to agree with Jim that this document repeats in "other= " words the same subjects as specified in ace-key-groupcomm.
In this f= orm, it is very difficult to find out the differences between the two docum= ents.

It would be good if the same terminology was used or their= equivalence was pointed out:
eg: Client vs joining node
Group-ma= nager versus KDC
joining request versus joining authorization
Secondly, I suggest to make this draft much shorter, and mostly refer to= the sections of ace-key-groupcomm and point out the differences. In many c= ases a list of items that MUST be present, are optional or not present at a= ll will suffice. 
For example such an enumeration is done under t= he bullet key on page 15.

New parameters can receive more text a= s is done for cs_alg, cs_params, cs_key_params, and cs_key_enc.

= Hope this helps,
Thanks for all your work,
greetings,

= Peter
--

= Peter van der Stok
vanderstok consultancy
mailto: consultancy@vanderstok.org, stokcons@bbhmail.nl
www: www= =2Evanderstok.org
tel NL: +31(0)492474673     = F: +33(0)966015248
--=_7066c21d67827bd53dcce5340c7b1edf-- From nobody Tue Nov 19 01:15:20 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 41D26120890; Tue, 19 Nov 2019 01:15:18 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 6.110.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <157415491826.21582.9074767452316854710.idtracker@ietfa.amsl.com> Date: Tue, 19 Nov 2019 01:15:18 -0800 Archived-At: Subject: [Ace] The ACE WG has placed draft-palombini-ace-coap-pubsub-profile in state "Call For Adoption By WG Issued" X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 09:15:18 -0000 The ACE WG has placed draft-palombini-ace-coap-pubsub-profile in state Call For Adoption By WG Issued (entered by Jim Schaad) The document is available at https://datatracker.ietf.org/doc/draft-palombini-ace-coap-pubsub-profile/ From nobody Tue Nov 19 15:13:59 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDB6B1208EC; Tue, 19 Nov 2019 15:13:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yt2VF2lgsd5w; Tue, 19 Nov 2019 15:13:56 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E5881208AC; Tue, 19 Nov 2019 15:13:53 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 19 Nov 2019 15:13:46 -0800 From: Jim Schaad To: CC: Date: Wed, 20 Nov 2019 07:13:44 +0800 Message-ID: <01b401d59f2e$ff406560$fdc13020$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdWfJkCd54YEkIoYSoqR2Q9ieECPkw== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] remarks on draft-tiloca-ace-oscore-gm-admin-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Nov 2019 23:13:58 -0000 This is just going to be a high level review on how things are done rather than a detailed review on each line of text. 1. - Go and read that CoRE Pub-Sub update document - you know the one that Klaus and friends have not managed to get written since the model proposal was done way back when. 2. Re-write this to use CoRAL - Yes I know that this makes another dependency on getting it published from the CoRE group, but I don't want to do things multiple times. 3. I think that this document really needs to be able to be used with HTTP/JSON as well as CoAP. If you can get the JSON version of CoRAL from Klaus then this falls out without any work. 4. Are you making it a requirement that the group name be the same as the group identifier assigned by the "group_name" parameter? If so then having some type of title and description would seem to be almost mandatory. 5. There needs to be some parameters around pointing to the correct AS and so forth. The management API may reject because it does not trust the AS. Don't assume that this is a single value for the AS either. 6. You are missing a lot of management detail on the POST to the group node. Some of the things that are missing would be: a) Is the group active or inactive b) How does the server react if you change a the content encryption algorithm, is this a simple re-key operation or is it more complicated c) How does the server react if you change the signature algorithm? This would seem to be a much harder thing to do if the group is not empty or not active as everybody is going to need to re-join. d) Other parameter that are changed may be just as bad as changing the signature algorithm - how the re-key is done jumps immediately to mind. 7. Is there currently any way for a KDC to signal to all of the members that have joined that the key group no longer exists? A DELETE would seem to indicate the need to be able to do this. Jim From nobody Tue Nov 19 16:10:36 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DB8712018B for ; Tue, 19 Nov 2019 16:10:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kv51Epb8O3Gg for ; Tue, 19 Nov 2019 16:10:33 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39D0112008C for ; Tue, 19 Nov 2019 16:10:33 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 19 Nov 2019 16:10:23 -0800 From: Jim Schaad To: CC: 'Benjamin Kaduk' Date: Wed, 20 Nov 2019 08:10:21 +0800 Message-ID: <01bc01d59f36$e82fe140$b88fa3c0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdWfMwvaSrluI+zAS+ONGsRDg3Lxcw== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Clarifications on the pub-sub keying draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2019 00:10:35 -0000 For those people who were on Jabber yesterday during the meeting, I made a characterization of Francesca's Pub-Sub draft which was wrong, and she did not tell me I was an idiot like she should have. When you are doing encrypted pub-sub there are three problems that need to be addressed: 1. Get permissions to talk to the pub-sub server itself. This is currently covered by the MQTT draft and the two ACE profiles currently in last call. In some cases this can also be a NOP. 2. Get the group encryption keys from the Group KDC: This is a completely independent operation from that in step 1. This is the first halve of the pub-sub draft. On jabber I was getting this mixed up with problem 1 and I should have known better. 3. How to encrypt the content: This is the second halve of the pub-sub draft. As noted above, problem 1 is completely separate from problems 2 and 3. It is for this reason that I do not believe that any part of the pub-sub draft needs to be included in the MQTT draft. There might be a forward reference from MQTT to this draft for content encryption processing but that should be all that is needed. Jim From nobody Tue Nov 19 18:25:20 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 002C3120071 for ; Tue, 19 Nov 2019 18:25:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HhZWu2sC1nC5 for ; Tue, 19 Nov 2019 18:25:16 -0800 (PST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50089.outbound.protection.outlook.com [40.107.5.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71976120025 for ; Tue, 19 Nov 2019 18:25:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dt2CvHDoS2tEuf+nxfWpjlKV7PFoZXkApp6ZxHJpnedHmUD7idH46WLjEyceNa4BcUMWdhtl/yNv11D9vz/DgyXwdFraLBrpsUE/JGHu4carBzzJWaavU5aMpB61XvAxmz1pEyyzenM7ikjTmrjiXjY4YBdfYmi7MQSJyRYNQMCAr6n87cJAG/Zs5iPW2te55HJ3W5628579oth8WIIhxB2U1h1Rr8DnUo9SxAQpLrxYPmrXVAx0MdxjRbF3As+LLRYrZT9k+SeX2ZmbfmJIwupPAGY/xVqzOIVl6RBlN8u9Jv3XjOqB/VTfwiO/DW2TWxAZjTnS3lTuAkaqXIYIVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1NBg6jEEEV5O/mcxqNokng8pp4xG/UBGVyuqZXVgI5M=; b=OBwMl/O9Rm11ht4KOwBVgTYfL0YdNlbE52jpmzEULF5zkGfNXXHEUzHAL7Sej3HwZQYcyRAp+FoIm0CEXZXLUkpk0pr2nCfjAVS8vYD8juIsGrmr4Z2dLbGvxyjbWyPMVBOmXJjZ/wep2MlZNK+ghc/j4YgD8Kr/wq/vGsFlXP73GKUcgy6ebAPo2SjbTRQ69IqyKY0vwGhUtBScoanQ6KJz26rnsAkXX49iTcSYeOzCPYONuXcAc41S1S2sGJRk/m708ZJ5LRbCHeu0BbH2hIz8Qarzqug1l95HjJynQ7kb34fyn/bl/Z/ndvHazK99FtOoLxPqL0a9UU3qBu0mlQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1NBg6jEEEV5O/mcxqNokng8pp4xG/UBGVyuqZXVgI5M=; b=SDAuOGjbqgTek6h1RI3bFRa3+tv2HWbaNGKElGI0dUCmenZ/apvtDJgNyCRICqcYtKgEdvrfV1Skkh5Qu2nac3bwt6Sfqn78nQryUWhJwdM2gSCLqwfkYjf9BaQ2vRLmJtmCZlxhVdEG31NKerwsxdaiFoSzZeyypJDq0IIAEoQ= Received: from VI1PR07MB5469.eurprd07.prod.outlook.com (20.178.14.214) by VI1PR07MB5552.eurprd07.prod.outlook.com (20.178.81.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2495.8; Wed, 20 Nov 2019 02:25:11 +0000 Received: from VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76]) by VI1PR07MB5469.eurprd07.prod.outlook.com ([fe80::a8d5:a784:a19:5c76%6]) with mapi id 15.20.2474.015; Wed, 20 Nov 2019 02:25:11 +0000 From: Francesca Palombini To: "consultancy@vanderstok.org" , Ace Thread-Topic: [Ace] ace-key-groupcomm-oscore-03 Thread-Index: AQHVnrmBVu+8Jrh540GepjVAK+4bE6eT3B8A Date: Wed, 20 Nov 2019 02:25:11 +0000 Message-ID: <3CF3939D-6394-4E37-A7E1-37D0EFB4133F@ericsson.com> References: <4ac02bb82ae9a67ad93c4ffe34063f19@bbhmail.nl> In-Reply-To: <4ac02bb82ae9a67ad93c4ffe34063f19@bbhmail.nl> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [2001:67c:370:128:4dfa:772a:a664:d8ac] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 30a1b54e-2458-4ef8-9983-08d76d60de94 x-ms-traffictypediagnostic: VI1PR07MB5552: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 02272225C5 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(136003)(39860400002)(396003)(366004)(129404003)(199004)(189003)(102836004)(6486002)(81166006)(33656002)(8676002)(6436002)(81156014)(8936002)(46003)(6506007)(446003)(6246003)(2906002)(186003)(14454004)(6306002)(54896002)(6512007)(2501003)(236005)(476003)(478600001)(316002)(11346002)(110136005)(99286004)(2616005)(229853002)(91956017)(44832011)(36756003)(486006)(76116006)(66476007)(64756008)(25786009)(66556008)(66446008)(606006)(66946007)(76176011)(71200400001)(256004)(14444005)(86362001)(71190400001)(5660300002)(7736002)(6116002)(574754004); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB5552; H:VI1PR07MB5469.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: rMB6aNUrncKofMom85r9tJG83HokN1Cx87gNSZiRNHrzjmLkCilmqXsTsgG3Ye/l55yJ4RSbSmqJIR0pZPGclVouWEFzc3KiwrI79x1UED5IeGF17Lb41oNs6HJufBv3UbB7Ip02f05BTdbR16Rumhd7kEZRXpxR78VHGsN5uxuGCsMu8qCQidcEyyDhMvRgAbz26HfX9zdxacMxBzvNSh4U/PPhPLWxicpbNJLrRv//PaSIWX2hWXwNlHPvOMa5hynl1ZnB97kb6rwEodiS4MyB4cQ4GgXMqxdufmf/RIlXP/UdRcMUI5cHYwMNexi/JbBtFAYoHC3o53wg+afT4fkGuZ9bqPtbKEWEVLdhkHnE4NS3Eby1KQ6T5qfIrmVF9iuEIQz997N93dsLdwV45tAH+mv9lNXlIwzPdpiE/IqtxRpK+cddLyMb8nc3O5ExJTupfKLH+mF1zJtw/BGDgQCCJeRGGY7l+2q46vKuD5I= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_3CF3939D63944E37A7E137D0EFB4133Fericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 30a1b54e-2458-4ef8-9983-08d76d60de94 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Nov 2019 02:25:11.3793 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: GsFO6x7RJgMXA43xX+xJOn1Pwzg8Z5qZds3h4lWjeSCYL34D/DgBVYFcxfq19klblO89aNmSIQmUjz2h6ecvvqn2aZZ8VeaqCm9FZQVkdrSaDKq3k1g2GrXAN3Odg4xd X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB5552 Archived-At: Subject: Re: [Ace] ace-key-groupcomm-oscore-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2019 02:25:19 -0000 --_000_3CF3939D63944E37A7E137D0EFB4133Fericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUGV0ZXIhDQoNClRoYW5rcyBmb3IgeW91ciBjb21tZW50LiBXZSB3aWxsIGRlZmluaXRlbHkg Z28gYmFjayB0byB0cnkgdG8gc2hvcnRlbiBhbmQgcmVtb3ZlIGR1cGxpY2F0ZSB0ZXh0IGV2ZW4g bW9yZSwgSSBhZ3JlZSB3aXRoIHlvdSB0aGF0IHdlIGNvdWxkIGRvIGJldHRlciB0aGVyZS4NCg0K SSBtaWdodCBjb21lIGJhY2sgd2l0aCBxdWVzdGlvbnMgb24gbW9yZSBwcmVjaXNlIGFkdmljZSBv bmNlIHdlIGdpdmUgaXQgYW5vdGhlciB0cnkuDQpUaGFua3MhDQpGcmFuY2VzY2ENCg0KRnJvbTog QWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFBldGVyIHZhbiBkZXIgU3Rv ayA8c3Rva2NvbnNAYmJobWFpbC5ubD4NCk9yZ2FuaXNhdGlvbjogdmFuZGVyc3RvayBjb25zdWx0 YW5jeQ0KUmVwbHkgdG86ICJjb25zdWx0YW5jeUB2YW5kZXJzdG9rLm9yZyIgPGNvbnN1bHRhbmN5 QHZhbmRlcnN0b2sub3JnPg0KRGF0ZTogVHVlc2RheSwgMTkgTm92ZW1iZXIgMjAxOSBhdCAxNzox Mg0KVG86IEFjZSBXZyA8YWNlQGlldGYub3JnPg0KU3ViamVjdDogW0FjZV0gYWNlLWtleS1ncm91 cGNvbW0tb3Njb3JlLTAzDQoNCkhpIEF1dGhvcnMsDQoNCkhhdmluZyByZWFkIHRoZSBkb2N1bWVu dCBhbmQgY29tcGFyaW5nIGl0IHdpdGggYWNlLWtleS1ncm91cGNvbW0sIEkgaGF2ZSB0byBhZ3Jl ZSB3aXRoIEppbSB0aGF0IHRoaXMgZG9jdW1lbnQgcmVwZWF0cyBpbiAib3RoZXIiIHdvcmRzIHRo ZSBzYW1lIHN1YmplY3RzIGFzIHNwZWNpZmllZCBpbiBhY2Uta2V5LWdyb3VwY29tbS4NCkluIHRo aXMgZm9ybSwgaXQgaXMgdmVyeSBkaWZmaWN1bHQgdG8gZmluZCBvdXQgdGhlIGRpZmZlcmVuY2Vz IGJldHdlZW4gdGhlIHR3byBkb2N1bWVudHMuDQoNCkl0IHdvdWxkIGJlIGdvb2QgaWYgdGhlIHNh bWUgdGVybWlub2xvZ3kgd2FzIHVzZWQgb3IgdGhlaXIgZXF1aXZhbGVuY2Ugd2FzIHBvaW50ZWQg b3V0Og0KZWc6IENsaWVudCB2cyBqb2luaW5nIG5vZGUNCkdyb3VwLW1hbmFnZXIgdmVyc3VzIEtE Qw0Kam9pbmluZyByZXF1ZXN0IHZlcnN1cyBqb2luaW5nIGF1dGhvcml6YXRpb24NCg0KU2Vjb25k bHksIEkgc3VnZ2VzdCB0byBtYWtlIHRoaXMgZHJhZnQgbXVjaCBzaG9ydGVyLCBhbmQgbW9zdGx5 IHJlZmVyIHRvIHRoZSBzZWN0aW9ucyBvZiBhY2Uta2V5LWdyb3VwY29tbSBhbmQgcG9pbnQgb3V0 IHRoZSBkaWZmZXJlbmNlcy4gSW4gbWFueSBjYXNlcyBhIGxpc3Qgb2YgaXRlbXMgdGhhdCBNVVNU IGJlIHByZXNlbnQsIGFyZSBvcHRpb25hbCBvciBub3QgcHJlc2VudCBhdCBhbGwgd2lsbCBzdWZm aWNlLg0KRm9yIGV4YW1wbGUgc3VjaCBhbiBlbnVtZXJhdGlvbiBpcyBkb25lIHVuZGVyIHRoZSBi dWxsZXQga2V5IG9uIHBhZ2UgMTUuDQoNCk5ldyBwYXJhbWV0ZXJzIGNhbiByZWNlaXZlIG1vcmUg dGV4dCBhcyBpcyBkb25lIGZvciBjc19hbGcsIGNzX3BhcmFtcywgY3Nfa2V5X3BhcmFtcywgYW5k IGNzX2tleV9lbmMuDQoNCkhvcGUgdGhpcyBoZWxwcywNClRoYW5rcyBmb3IgYWxsIHlvdXIgd29y aywNCmdyZWV0aW5ncywNCg0KUGV0ZXINCi0tDQpQZXRlciB2YW4gZGVyIFN0b2sNCnZhbmRlcnN0 b2sgY29uc3VsdGFuY3kNCm1haWx0bzogY29uc3VsdGFuY3lAdmFuZGVyc3Rvay5vcmc8bWFpbHRv OmNvbnN1bHRhbmN5QHZhbmRlcnN0b2sub3JnPiwgc3Rva2NvbnNAYmJobWFpbC5ubDxtYWlsdG86 c3Rva2NvbnNAYmJobWFpbC5ubD4NCnd3dzogd3d3LnZhbmRlcnN0b2sub3JnPGh0dHBzOi8vcHJv dGVjdDIuZmlyZWV5ZS5jb20vdjEvdXJsP2s9ZWY3NzBjNzUtYjNhMzA0MzYtZWY3NzRjZWUtODZh MTE1MGJjM2JhLTdiY2MwNjdkMzI3N2U4YTImcT0xJmU9NjExOWQ1NDktNTk2ZC00YTc1LThiNDMt NTdmZjcxZGQ1YmQzJnU9aHR0cCUzQSUyRiUyRnd3dy52YW5kZXJzdG9rLm9yZyUyRj4NCnRlbCBO TDogKzMxKDApNDkyNDc0NjczICAgICBGOiArMzMoMCk5NjYwMTUyNDgNCg== --_000_3CF3939D63944E37A7E137D0EFB4133Fericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <629D962CAC5492439BD656BA338B8863@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIu MHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PkhpIFBldGVyITxicj4NCjxicj4NClRoYW5rcyBmb3IgeW91ciBjb21tZW50LiBXZSB3aWxsIGRl ZmluaXRlbHkgZ28gYmFjayB0byB0cnkgdG8gc2hvcnRlbiBhbmQgcmVtb3ZlIGR1cGxpY2F0ZSB0 ZXh0IGV2ZW4gbW9yZSwgSSBhZ3JlZSB3aXRoIHlvdSB0aGF0IHdlIGNvdWxkIGRvIGJldHRlciB0 aGVyZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUyI+SSBtaWdodCBjb21lIGJhY2sgd2l0aCBxdWVzdGlvbnMgb24gbW9yZSBwcmVj aXNlIGFkdmljZSBvbmNlIHdlIGdpdmUgaXQgYW5vdGhlciB0cnkuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1 YWdlOkVOLVVTIj5UaGFua3MhPGJyPg0KRnJhbmNlc2NhPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+QWNlICZsdDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVo YWxmIG9mIFBldGVyIHZhbiBkZXIgU3RvayAmbHQ7c3Rva2NvbnNAYmJobWFpbC5ubCZndDs8YnI+ DQo8Yj5PcmdhbmlzYXRpb246IDwvYj52YW5kZXJzdG9rIGNvbnN1bHRhbmN5PGJyPg0KPGI+UmVw bHkgdG86IDwvYj4mcXVvdDtjb25zdWx0YW5jeUB2YW5kZXJzdG9rLm9yZyZxdW90OyAmbHQ7Y29u c3VsdGFuY3lAdmFuZGVyc3Rvay5vcmcmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIDE5 IE5vdmVtYmVyIDIwMTkgYXQgMTc6MTI8YnI+DQo8Yj5UbzogPC9iPkFjZSBXZyAmbHQ7YWNlQGll dGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5bQWNlXSBhY2Uta2V5LWdyb3VwY29tbS1v c2NvcmUtMDM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SGkgQXV0aG9ycyw8YnI+DQo8YnI+DQpIYXZpbmcgcmVhZCB0aGUgZG9jdW1lbnQgYW5k IGNvbXBhcmluZyBpdCB3aXRoIGFjZS1rZXktZ3JvdXBjb21tLCBJIGhhdmUgdG8gYWdyZWUgd2l0 aCBKaW0gdGhhdCB0aGlzIGRvY3VtZW50IHJlcGVhdHMgaW4gJnF1b3Q7b3RoZXImcXVvdDsgd29y ZHMgdGhlIHNhbWUgc3ViamVjdHMgYXMgc3BlY2lmaWVkIGluIGFjZS1rZXktZ3JvdXBjb21tLjxi cj4NCkluIHRoaXMgZm9ybSwgaXQgaXMgdmVyeSBkaWZmaWN1bHQgdG8gZmluZCBvdXQgdGhlIGRp ZmZlcmVuY2VzIGJldHdlZW4gdGhlIHR3byBkb2N1bWVudHMuPGJyPg0KPGJyPg0KSXQgd291bGQg YmUgZ29vZCBpZiB0aGUgc2FtZSB0ZXJtaW5vbG9neSB3YXMgdXNlZCBvciB0aGVpciBlcXVpdmFs ZW5jZSB3YXMgcG9pbnRlZCBvdXQ6PGJyPg0KZWc6IENsaWVudCB2cyBqb2luaW5nIG5vZGU8YnI+ DQpHcm91cC1tYW5hZ2VyIHZlcnN1cyBLREM8YnI+DQpqb2luaW5nIHJlcXVlc3QgdmVyc3VzIGpv aW5pbmcgYXV0aG9yaXphdGlvbjxicj4NCjxicj4NClNlY29uZGx5LCBJIHN1Z2dlc3QgdG8gbWFr ZSB0aGlzIGRyYWZ0IG11Y2ggc2hvcnRlciwgYW5kIG1vc3RseSByZWZlciB0byB0aGUgc2VjdGlv bnMgb2YgYWNlLWtleS1ncm91cGNvbW0gYW5kIHBvaW50IG91dCB0aGUgZGlmZmVyZW5jZXMuIElu IG1hbnkgY2FzZXMgYSBsaXN0IG9mIGl0ZW1zIHRoYXQgTVVTVCBiZSBwcmVzZW50LCBhcmUgb3B0 aW9uYWwgb3Igbm90IHByZXNlbnQgYXQgYWxsIHdpbGwgc3VmZmljZS4mbmJzcDs8YnI+DQpGb3Ig ZXhhbXBsZSBzdWNoIGFuIGVudW1lcmF0aW9uIGlzIGRvbmUgdW5kZXIgdGhlIGJ1bGxldCBrZXkg b24gcGFnZSAxNS48YnI+DQo8YnI+DQpOZXcgcGFyYW1ldGVycyBjYW4gcmVjZWl2ZSBtb3JlIHRl eHQgYXMgaXMgZG9uZSBmb3IgY3NfYWxnLCBjc19wYXJhbXMsIGNzX2tleV9wYXJhbXMsIGFuZCBj c19rZXlfZW5jLjxicj4NCjxicj4NCkhvcGUgdGhpcyBoZWxwcyw8YnI+DQpUaGFua3MgZm9yIGFs bCB5b3VyIHdvcmssPGJyPg0KZ3JlZXRpbmdzLDxicj4NCjxicj4NClBldGVyIDxvOnA+PC9vOnA+ PC9wPg0KPGRpdiBpZD0ic2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjEyLjBwdCI+LS0gPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij5QZXRlciB2YW4gZGVyIFN0b2s8YnI+DQp2YW5kZXJzdG9rIGNvbnN1bHRhbmN5PGJyPg0K bWFpbHRvOiA8YSBocmVmPSJtYWlsdG86Y29uc3VsdGFuY3lAdmFuZGVyc3Rvay5vcmciPmNvbnN1 bHRhbmN5QHZhbmRlcnN0b2sub3JnPC9hPiwNCjxhIGhyZWY9Im1haWx0bzpzdG9rY29uc0BiYmht YWlsLm5sIj5zdG9rY29uc0BiYmhtYWlsLm5sPC9hPjxicj4NCnd3dzogPGEgaHJlZj0iaHR0cHM6 Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az1lZjc3MGM3NS1iM2EzMDQzNi1lZjc3NGNl ZS04NmExMTUwYmMzYmEtN2JjYzA2N2QzMjc3ZThhMiZhbXA7cT0xJmFtcDtlPTYxMTlkNTQ5LTU5 NmQtNGE3NS04YjQzLTU3ZmY3MWRkNWJkMyZhbXA7dT1odHRwJTNBJTJGJTJGd3d3LnZhbmRlcnN0 b2sub3JnJTJGIiB0YXJnZXQ9Il9ibGFuayI+DQp3d3cudmFuZGVyc3Rvay5vcmc8L2E+PGJyPg0K dGVsIE5MOiAmIzQzOzMxKDApNDkyNDc0NjczICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO0Y6ICYj NDM7MzMoMCk5NjYwMTUyNDg8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_3CF3939D63944E37A7E137D0EFB4133Fericssoncom_-- From nobody Tue Nov 19 22:02:34 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE9E412080E for ; Tue, 19 Nov 2019 22:02:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hg3xhw-HkoK0 for ; Tue, 19 Nov 2019 22:02:27 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60088.outbound.protection.outlook.com [40.107.6.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50088120802 for ; Tue, 19 Nov 2019 22:02:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cQ9EQfM1V2Lf/hVc/7HpXgqF3t5GLC8+mrBC3AQtVNqccGBGX/VxEeduYEeJ2FRDgiOPuFz2n0wJU3DymbuohojqmqbzLwU9h2UaNAPHJZ/iFeBMXhaRDFGqxGlef4ZLZA3JZbX06EzjBD1Y2AX81kXh4sMf6ghCFQ4lfa7BVqLnrNo1j51leucbN1EEo7MrKhiB3DstWyeog3phB3qb7k3MmstseMucLKNmp42bwTu+0tptedyoDuJJveOe2qihE77987FbW+obQk8CQ9eanA7p1UgzmMEb85Ak745rZD3OPZKt+s51+SbQamHnRKXEx00efLZwg3CUzjFB5zfS9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8LawXleP7qFbdmJRPElB1GsbdCHHuHvW50By9yfXdI8=; b=KFSG85951OZYmQjZ/lyC+6y0plHSdRaQA2kJ8qYwhDcGFcNzBzgeYuaUx8BPi3lRcraJLJ/w/XBu6tcb3zgkr4YI4dCaRGQCVcmiekiko/I+ebqx8PkiImBPKq6VVFZ78E4gd6l8D/euniWu/junQYaqU7G/2ms9I+2mW9ZxfiSZY3rEcC+GS+oCQs+Q/K9zEaa815kLBs/l3JuSg/QPCM9qEYorLBjevDnbTw6K/WrGdfrRsB6kaDqkf0ScuNupOXwvWvLUlSDH/hHB24A7BVGDiYtUK/vc6bcZoxYDRDStH7rN7MjRs6ALI6bcbIazh2/8VTl4GfKx2hXFURUqUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8LawXleP7qFbdmJRPElB1GsbdCHHuHvW50By9yfXdI8=; b=pK/MYq3YWo9VVD/tNMOsURAmSUgyzAWl0FjAS+3vDRvtYPGZdiDRyV/XUROc2jAuv4GOj7OqCm3v+5gjgxwxR8qJdH3brm4AjVUnrvzNkYoNK3QKnsvdMC4EGx9pze5o/XOrQ/S/U4+neXNxVi7QuBBsLHB0k8k5NaQGTu7oaEI= Received: from HE1P18901CA0004.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:8b::14) by AM0P189MB0674.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:19c::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16; Wed, 20 Nov 2019 06:02:24 +0000 Received: from HE1EUR02FT056.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::208) by HE1P18901CA0004.outlook.office365.com (2603:10a6:3:8b::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23 via Frontend Transport; Wed, 20 Nov 2019 06:02:24 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT056.mail.protection.outlook.com (10.152.11.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2474.17 via Frontend Transport; Wed, 20 Nov 2019 06:02:23 +0000 Received: from [10.8.8.12] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Wed, 20 Nov 2019 07:02:22 +0100 To: References: From: Marco Tiloca Openpgp: preference=signencrypt Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: <60c8401b-37ad-7d2a-edc0-64e4a8393417@ri.se> Date: Wed, 20 Nov 2019 14:02:14 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="mUPJVSElBbbYodjrkbSPmHOWWTdzih8gJ" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(346002)(376002)(136003)(39860400002)(189003)(199004)(21480400003)(2351001)(478600001)(966005)(40036005)(22756006)(126002)(486006)(476003)(31696002)(22746008)(70586007)(70206006)(186003)(235185007)(16526019)(336012)(26005)(65956001)(65806001)(7736002)(11346002)(5660300002)(33964004)(76176011)(2616005)(446003)(606006)(86362001)(229853002)(8676002)(81156014)(81166006)(8936002)(6306002)(6246003)(236005)(54896002)(36756003)(6916009)(44832011)(66574012)(53546011)(386003)(6116002)(3846002)(316002)(71190400001)(16576012)(31686004)(6666004)(568964002)(106002)(16586007)(5024004)(58126008)(2906002)(356004)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0P189MB0674; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 60b684a7-aec2-4edf-be91-08d76d7f368e X-MS-TrafficTypeDiagnostic: AM0P189MB0674: X-MS-Exchange-PUrlCount: 3 X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-Forefront-PRVS: 02272225C5 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: gDoGpHKbituM3dwyEEvN0LdEnwoGiIS4eW4US7TpjdUiJKpiwDXjLVCeGd7w/+hRy+37SGjkwGloB16aUE1l+EFbrzeRdqm67vYR3P3BiIxhIPFx9jcqgucwea/wxUS0LPGkiLNxjHVs+NitLdwKD75Lv/ZFatSFJ9wWi+sF7gyzTojHWmdjUgWUnnDV9u89zjEMM63779kEFqTPtkZg1bNOtBT+wCK+SyaG9i3a+A4pzBC2HOpkvJ0VXpYSNCA/82mqM58X8XTI2881OVnLJ0qReacY2tvTAdXS78PyBPgmM2fPktLCliBk6acuLPISRFCr6IlMFzKgCGHrm1RIPtrfVVNpaNs3wqVmm9oGB79W6lCQ3VGp5yYI/tNLcbU+XM6t5di7TI/0mQavWQPE8IdfLNBWkbtAcc3L625ytLQrRTpj+kk84Fd0rLBmaKSFK31P8VCP0WQ3OZ+beKmwtVLVKaODCSnsmHEUDQPt5v8= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Nov 2019 06:02:23.9212 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 60b684a7-aec2-4edf-be91-08d76d7f368e X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P189MB0674 Archived-At: Subject: Re: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2019 06:02:31 -0000 --mUPJVSElBbbYodjrkbSPmHOWWTdzih8gJ Content-Type: multipart/mixed; boundary="pIxpXqwLwlodLiFlGpCzJ9IvMyZxIEnAk"; protected-headers="v1" From: Marco Tiloca To: ace@ietf.org Message-ID: <60c8401b-37ad-7d2a-edc0-64e4a8393417@ri.se> Subject: Re: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile References: In-Reply-To: --pIxpXqwLwlodLiFlGpCzJ9IvMyZxIEnAk Content-Type: multipart/alternative; boundary="------------37F64190067D32F74A6E8293" Content-Language: en-US This is a multi-part message in MIME format. --------------37F64190067D32F74A6E8293 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, I support the adoption of this document and confirm to review future versions. Pub-sub is a relevant group communication setting, and it does need to have both client authorization and secure content exchange ensured. I believe that this document proposes a good way to address both points. Best, /Marco On 11/19/19 4:44 PM, Daniel Migault wrote: > Dear working group,=C2=A0 > > As mentioned during the ACE meeting, this mail starts a call for > adoption for draft-palombini-ace-coap-pubsub-profile. Please provide > your feed backs by December 4. > https://datatracker.ietf.org/doc/draft-palombini-ace-coap-pubsub-profil= e/ > Yours, > Daniel > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --------------37F64190067D32F74A6E8293 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi,

I support the adoption of this document and confirm to review future versions.

Pub-sub is a relevant group communication setting, and it does need to have both client authorization and secure content exchange ensured.

I believe that this document proposes a good way to address both points.

Best,
/Marco

On 11/19/19 4:44 PM, Daniel Migault wrote:
Dear working group,=C2=A0

As mentioned during the ACE meeting, this mail= starts a call for adoption for draft-palombini-ace-coap-pubsub-profile. P= lease provide your feed backs by December 4.
Yours,
Daniel

____________________________=
___________________
Ace mailing list
Ace@ie=
tf.org
https://www.ietf.org/mailman/listinfo/ace


--=20
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistag=C3=A5ngen 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www=
=2Eri.se
--------------37F64190067D32F74A6E8293-- --pIxpXqwLwlodLiFlGpCzJ9IvMyZxIEnAk-- --mUPJVSElBbbYodjrkbSPmHOWWTdzih8gJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl3U1uYACgkQ7iZktA5Y 2kOs+wf/d8Et/Mz8/vSMw7HgEcX2nuhYKCPzBvjxYoY9I003RlfJnoIjKTgujk/A OtWbDL/KRizXpYVAo1+Za9icALWiI5rMVlfYHaQEDHqkftyvr0lZRKZP3YuEH+dg jY65r0UHLBqY23q9oqayLMkq1ixPUirhIbkGLS9jtukmDe0NEh3YlZwSxXMyHXsN nR7ALnCzEzgT0U2R9bew7ylVJQZGywBKFxA6/7MjTMNTJPJo4N5BlEunS8NlBspJ s3+gYd+w6d7SPzrzebQ4HF9j91hi6cmNIJVdJMJ47FNMfJMpXlV+uhNZMg9eUQZx qzm8im3CA9FyytpZN4BXMtHKgZ67Mw== =ps7g -----END PGP SIGNATURE----- --mUPJVSElBbbYodjrkbSPmHOWWTdzih8gJ-- From nobody Tue Nov 19 22:22:35 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 905FA120841; Tue, 19 Nov 2019 22:22:25 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.110.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157423094541.5342.13933559251236268310@ietfa.amsl.com> Date: Tue, 19 Nov 2019 22:22:25 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oauth-authz-26.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2019 06:22:27 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) Authors : Ludwig Seitz Goeran Selander Erik Wahlstroem Samuel Erdtman Hannes Tschofenig Filename : draft-ietf-ace-oauth-authz-26.txt Pages : 87 Date : 2019-11-19 Abstract: This specification defines a framework for authentication and authorization in Internet of Things (IoT) environments called ACE- OAuth. The framework is based on a set of building blocks including OAuth 2.0 and CoAP, thus transforming a well-known and widely used authorization solution into a form suitable for IoT devices. Existing specifications are used where possible, but extensions are added and profiles are defined to better serve the IoT use cases. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-authz/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oauth-authz-26 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oauth-authz-26 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Nov 19 22:44:43 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D68D8120125; Tue, 19 Nov 2019 22:44:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wg9fIoombNhI; Tue, 19 Nov 2019 22:44:38 -0800 (PST) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40040.outbound.protection.outlook.com [40.107.4.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9107412004C; Tue, 19 Nov 2019 22:44:37 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cAC5Qk1dSfQWINjrbrNpnh5LrHUn75Gq+LKdl1rZ9ryGZLyfyCufWCCj+3Y3l1b7Wqsl8AmPtgUFjIVZR/8CJR+OVDQO5odi9/MLipEmEpbKsuz/5+7rUjxW+3eSCk7rhfN7O35Z33cxkzimyZCgqnU3eqwYm2OeGhjRw5T6PdHMyhXWHyMXQwqA3oTLtgDVebpepidOtHPzPY2Ade3fNYvR753k4zaDbdXzsQC1YbA8m0IAKkzPr4BpGWseF5bGYdyAPcq0eHqW3CYri32gDWMOPPMzsN2NWf8GBqOz7Qg0YdQe9i0E4HKxTiyTAqwV0MCwHNCDv5bKkMiUOtvLSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hAuk4TjGKK0gC+65cfP9uXYYZO0Eq6CbpWOyCLh3gb0=; b=Y3ZOjO3xNv3ugwP1biHXvXL8gz+4IAVsAx9qIHyeZhjEKjNPHeV8P04Fj745uk7wVAPrVKrFaEspvvuow9HLv+HxKSQQi1nr0qS9V2yXnOKvX6OmPDrYbtWfz7BE2dtxRoc9/aVeMAoBlaAct42TzD1+JZx6Cr51Ud/e2NorcDOEBE9fbBN048oxFRgq0RW+m+R+rdFSrjHnKk+sVnpfNEIcJlGrVzPN0zRaCA0S5c7Nx7uLCjal0Lc3KUQjxYdj599OpxSkQTcd2r8iNyx0lk1u8DimEBXLGNaDxNQ750TAAHraZLj6jKoZrdDKL4j9ujOXq5e0HEM6j/eEH7iJXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hAuk4TjGKK0gC+65cfP9uXYYZO0Eq6CbpWOyCLh3gb0=; b=nyXjkqArQ9pRIvacwaGmxkdV6ouqygZ4AdGVEQXTConm4y8+QVUCNEoz7R0Ga/HqBZ3/jY1dV3KUsjKpLRRekcKg+eM0ce9L+xdexCZLejcxciMmWd14VELAWaguzgh3LK6IHYG5tiD/gqx06GS9p9i6Y14B/FFDZltR88T3vDc= Received: from HE1P189CA0031.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:53::44) by DB6P18901MB0071.EURP189.PROD.OUTLOOK.COM (2603:10a6:4:26::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23; Wed, 20 Nov 2019 06:44:34 +0000 Received: from VE1EUR02FT049.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::200) by HE1P189CA0031.outlook.office365.com (2603:10a6:7:53::44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16 via Frontend Transport; Wed, 20 Nov 2019 06:44:34 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT049.mail.protection.outlook.com (10.152.12.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2474.17 via Frontend Transport; Wed, 20 Nov 2019 06:44:34 +0000 Received: from [31.133.152.212] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Wed, 20 Nov 2019 07:44:31 +0100 To: Benjamin Kaduk CC: , References: <20190927015154.GY6424@kduck.mit.edu> <696c7ee4-75f9-48ec-8837-ea171137e9f8@ri.se> <20191110032851.GW47216@kduck.mit.edu> <20191117062517.GM32847@mit.edu> From: Ludwig Seitz Message-ID: Date: Wed, 20 Nov 2019 07:44:03 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <20191117062517.GM32847@mit.edu> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms050208010005070001060909" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-2.sp.se (10.100.0.162) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(136003)(376002)(346002)(39860400002)(396003)(199004)(189003)(22746008)(76176011)(53546011)(6116002)(3846002)(30864003)(65956001)(229853002)(2906002)(65806001)(70206006)(106002)(316002)(54906003)(16576012)(40036005)(58126008)(16586007)(22756006)(2171002)(31696002)(86362001)(5660300002)(235185007)(568964002)(31686004)(6246003)(336012)(44832011)(14444005)(5024004)(476003)(33964004)(70586007)(2616005)(6706004)(126002)(6916009)(486006)(956004)(11346002)(71190400001)(186003)(81156014)(81166006)(7736002)(8936002)(6666004)(26005)(305945005)(356004)(8676002)(16526019)(386003)(4326008)(36756003)(446003)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6P18901MB0071; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 89757317-a702-4468-e835-08d76d851ad6 X-MS-TrafficTypeDiagnostic: DB6P18901MB0071: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 02272225C5 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 70kH2rT7Add8qVpuiEZKEPd9pKNyDErv9yMTtcQvdSxq5NYnxij32bPiyxlzpxKR/nO2ZfljbtEkVLhKNhtoFGK+wA/AmB2mQtd9fF86r+fLfv1U1zFJ+RQ56vpb8Wh79dJh5o3j0jutfvBL7oixCdM/uz9NQd2xnsjqk9ySy2fYkkz6XEg44TNoR1FIJ+dHyyo6o7OCEkeSVvsocihtfNryu2vYv5gJ7XUnoexmQe6uWKOJHa3jFDOdEuQZy+91lp4p52ioDT/Ke8USkNsBAMp3uVpitaoL1LdqVtoQU5fE+/HelhzN8PnOhkLueThC/1TtvWXbQVEl3Up1fdGM06ZyxBvQec4OxXpbnAQJQGDqVfqVjjYLbH5qU3TmWHtKkB0kJeDIE+rqb6sO3SD12sOllIf1VAOR9beK+HLDbnfYyqxcPGhiT3cYOMkJUmKb X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Nov 2019 06:44:34.3743 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 89757317-a702-4468-e835-08d76d851ad6 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P18901MB0071 Archived-At: Subject: Re: [Ace] AD review of draft-ietf-ace-oauth-authz-24 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Nov 2019 06:44:42 -0000 --------------ms050208010005070001060909 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hello ACE, I've had a side-meeting with Ben at IETF 106 and we clarified the=20 outstanding issues as follows. I have submitted -26 implementing the=20 resolutions resulting from these clarifications. See below for detailed=20 comments. /Ludwig On 17/11/2019 07:25, Benjamin Kaduk wrote: > On Wed, Nov 13, 2019 at 01:55:44PM +0100, Ludwig Seitz wrote: >> On 10/11/2019 04:28, Benjamin Kaduk wrote: >>>>> 16.) >>>>> Section 3.2 >>>>> >>>>> One application of COSE is OSCORE [I-D.ietf-core-object-securi= ty], >>>>> which provides end-to-end confidentiality, integrity and repla= y >>>>> protection, and a secure binding between CoAP request and resp= onse >>>>> messages. In OSCORE, the CoAP messages are wrapped in COSE ob= jects >>>>> and sent using CoAP. >>>>> >>>>> This framework RECOMMENDS the use of CoAP as replacement for H= TTP for >>>>> use in constrained environments. >>>>> >>>>> Do we have a reason to mention OSCORE if we're not going to make a >>>>> recommendation about its use? >>>> >>>> [LS] We also mention DTLS and TLS without making any recommendation = about >>>> which to use. I would suggest to either remove all of it or to add a= >>>> sentence >>>> noting that this is an enumeration of some security options, and the= choice >>>> depends on the specific application scenario. >>> >>> Adding a sentence feels like a slightly better option to me, though i= t >>> could easily go either way. >>> >> Fixed Note: I thought I had fixed this in -25, but it turned out to only be in = my head. It's now also fixed in the document (i.e. -26). >>>>> 39.) >>>>> Refresh tokens are typically not stored as securely as proof-o= f- >>>>> possession keys in requesting clients. Proof-of-possession ba= sed >>>>> refresh token requests MUST NOT request different proof-of-pos= session >>>>> keys or different audiences in token requests. Refresh token >>>>> requests can only use to request access tokens bound to the sa= me >>>>> proof-of-possession key and the same audience as access tokens= issued >>>>> in the initial token request. >>>>> >>>>> This is perhaps something of a philosophical question, but if a ref= resh >>>>> token is only usable at the token endpoint, in some sense its audie= nce >>>>> is definitionally the AS. So there's a little bit of a mismatch in= >>>>> treating it as having the audience value that the access tokens iss= ued >>>>> from it will have. I don't know the background for audience-restri= ced >>>>> refresh tokens in regular OAuth 2.0, though, so hopefully someone c= an >>>>> educate me. >>>> >>>> [LS] I'm equally confused. I suggest that Hannes or one of the other= OAuth >>>> experts give us a hint on that one. >>> >>> [We had some stab at this in the other thread, but additional input m= ight >>> still be in order] >> >> >> Let's hear with OAuth people in Singapore. >> We discussed that now, the text refers to the audience of the access=20 token, not the refresh token which is just an opaque reference. -> No=20 textual change. >> >>>>> 58.) >>>>> Profiles MUST specify whether the authz-info endpoint is prote= cted, >>>>> including whether error responses from this endpoint are prote= cted. >>>>> Note that since the token contains information that allow the = client >>>>> and the RS to establish a security context in the first place,= mutual >>>>> authentication may not be possible at this point. >>>>> >>>>> We'll need some careful reasoning about this for the security >>>>> considerations, since the authz-info transaction can impact what pr= ofile >>>>> the RS thinks is in use. E.g., whether a network attacker could >>>>> cause the client to think that a different (vulnerable) profile is = in >>>>> use than the one the RS expects to use. >>>> >>>> [LS] Noted. Do you think the reasoning in section 6.5 needs to be ex= tended? >>> >>> I think we should add some more text, yes. >>> Specifically, we should mention that the authz-info interaction can a= ffect >>> what profile RS will use (e.g., via "ace_profile"), and that profile >>> developers should be conscious of the risk of downgrade attacks that >>> involve other profile types. (Am I reading this right that the clien= t will >>> know what profile to use by the time it is ready to post to the authz= -info >>> endpoint and that the response will not change what profile the clien= t >>> uses? Specifically, even if a client supports multiple profiles that= use >>> different methods for token transport, a client is not going to try o= ne >>> method/profile and then fall back to a different one if the first one= >>> (transiently) fails?) >>> >> >> >> I'm not sure how you would mount such a downgrade attack. The client >> receives the profile to use either by implicit configuration or >> explicitly through the "profile" parameter from the AS. >> If the client does not receive a "profile" parameter and has no implic= it >> profile configured this is an error. >> >> The RS either has the profile pre-configured or receives it via an >> authenticated "profile" claim in the access token (again if the claim = is >> missing and no pre-configured profile exists this is an error). Even >> though the token is sent to authz-info over an insecure channel and th= e >> client is not yet authenticated, the access token itself is, and >> therefore I find it hard to see how an attacker would trick the RS to >> use a different profile. >=20 > The general idea I have in mind is that the attacker can send a differe= nt > token to authz-info than would be used in normal operation. Maybe it's= an > old one, or supposed to be for a different client, or something else, b= ut > the risk is that the attacker confuses the RS about what token (and thu= s > which profile) to use with a given client. I think we have enough > flexibility in how these things are done that the core framework does n= ot > provide a solid guarantee that such a mixup can never happen. >=20 I've added some clarifying text in section 6.8 providing a description=20 of the attack and what the RO can do to mitigate it. >>>>> 65.) >>>>> specification defines the following approach: The claim "ex= i" >>>>> ("expires in") can be used, to provide the RS with the life= time of >>>>> the token in seconds from the time the RS first receives th= e >>>>> token. This approach is of course vulnerable to malicious = clients >>>>> holding back tokens they do not want to expire. Such an at= tack >>>>> >>>>> It also has suboptimal behavior if the RS loses state (e.g., by >>>>> rebooting), and possibly requires the RS to store indefinitely all >>>>> tokens with an "exi" value. I have mixed feelings about specifying= it >>>>> at all, though I concede it probably does have some value. Regardl= ess, >>>>> I think a dedicated subsection in the security considerations is in= >>>>> order. >>>> >>>> [LS] We wanted to provide some solution for expiring tokens for RSes= >>>> that have >>>> no connectivity and no synchronized clocks. Using the "exp" claim in= >>>> such cases >>>> would have pretty unpredictable results. >>>> I have extended section 6.3 in the security considerations to go int= o >>>> the detail >>>> of "exi", please have a look if this covers the necessary issues. >>> >>> I think we should also say something about the amount of such persist= ent >>> storage potentially growing without bound, as those counters (or some= >>> similar indication) are the only thing that will cause the RS to reje= ct >>> tokens that have been used the requisite number of times. So, RS sta= te >>> requirements grows with the number of 'exi'-bearing tokens that are i= ssued >>> for them. I suppose a bloom filter might be a way out, though... >>> >> >> I don't see why storage requirements would grow more compared to regul= ar >> tokens with the "exp" claim. The way exi is intended to be implemented= >> is as follows: >> >> 1. C ---Token(exi=3D100)---> RS (internal_clock=3D54645) >> 2. RS generates a new 'exp' for the token, sets it to 54745 and discar= ds >> the exi claim. >> 3. RS expires token according to internal clock (i.e. at 54745) >> >> If you send the RS a lot of tokens it will eventually exhaust its >> memory, but that would happen with regular exp claims as well if the >> attacker can craft/obtain enough tokens with sufficiently long lifetim= e. >> Note that these would have to be tokens for different clients, since t= he >> framework currently recommends to only store one token per client. >> >> The advantage for the attacker with exi is that it could hold back any= >> tokens without having to worry about the expiration, but it would stil= l >> have to hoard enough tokens for different clients, all applicable to t= he >> RS in order to exhaust the RS's storage. >=20 > My point is that a token with "exi" is potentially valid "forever". > Suppose I use that token once, and the RS does as you describe above, > computing an "exp" for that token. If I post a new token to that RS so= it > discards the "exi"-ful token, or the expiration timer fires and the RS > forgets about that token, then there is nothing to stop me (or an attac= ker) > from replaying that same original "exi"-bearing token. The RS would th= en > see "exi", compute a new derived "exp", and give the token a whole noth= er > validity period. >=20 > Only if the RS retains some state that it has seen that specific token = and > used up the "exi" period is this token replay prevented. I don't see a= way > to reliably retain that state without having some permanent storage > dedicated to the state for each "exi" token that has evern been receive= d, > over the lifetime of the RS. (A bloom filter or similar solution uses = less > state, but reduces reliability to some extent.) >=20 I've added text in sections 6.6. and 5.8.3 to address this. >>> >>>>> 68.) >>>>> o The client performs an introspection of the token. Althoug= h this >>>>> is not explicitly forbidden, how exactly a client does >>>>> introspection is not currently specified for OAuth. >>>>> >>>>> I'm pretty sure this is overtaken by events (sorry for my part in >>>>> that!). E.g., draft-ietf-oauth-jwt-introspection-response discusse= s >>>>> clients doing introspection, and even RFC 7662 itself discusses usi= ng a >>>>> client secret to authenticate to the introspection endpoint. I thi= nk >>>>> there's another document between those two that's also relevant, bu= t >>>>> can't find it right now >>>> >>>> [LS] I am not so sure. When reading the fine print in both RFC 7662 = and >>>> draft-ietf-oauth-jwt-introspection-response, I find that when they m= ention >>>> the term "client", they refer to the protected resource / RS as bein= g a >>>> client of >>>> the AS introspection endpoint. A client holding an access token and= >>>> performing introspection is never explicitly mentioned in both >>>> documents, to my best >>>> knowledge. >>> >>> It seems like we should try to check on this in Singapore, while the = usual >>> suspects are easily at hand. >> >> Yes together with the other OAuth questions. We discussed this, OAuth experts disagree whether introspection by=20 clients is implicitly forbidden. It is not explicitly forbidden at=20 least, so the text is still correct. -> No change Background: The OAuth experts arguing for "implicitly forbidden" point=20 to the text saying: "In OAuth 2.0 [RFC6749], the contents of tokens are=20 opaque to clients." (from RFC 7662) and read this as "the client=20 should/must not know the contents of the token and therefore not be=20 allowed to do introspection". /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms050208010005070001060909 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTEyMDA2 NDQwNFowLwYJKoZIhvcNAQkEMSIEIM/xZpZVpjyFIwR+S0zqfqtSTGRKBum7S7BiCM80+dDN MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAjRDF9TepKQpNKpLqXrpo2dDFkcy5miTzL37Ju9E0c3L+ HYWru7kKTSw1vk3TDJ6jVGS6C9/gpq0GjkPBuWyL3Mng6G1XMb4eYiqWSboXQ6LGA+0JC5O5 XrNdBQQnyL9/zL92LLb8k09CZ8e2IKfeThFpfh1X5H8I/i2cpK+tv6RM4ufymQluPPLk4SHL CQIzGHhL0ixFKTIs6W1L83wneqJDK92vehLpwKy9JvvCj/eMkJbM0UfS94AgdPwsKAkqu0E6 oSQz1H9vQZk1dzb9f3bsMscqwAW+Wn2Hc/Zww2uomuatUO503NDMC2u6tQGse0ahD0JGKZb6 bfVC8ePwDgAAAAAAAA== --------------ms050208010005070001060909-- From nobody Wed Nov 20 18:11:56 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CE1F6120077; Wed, 20 Nov 2019 18:11:46 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.110.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <157430230677.769.6413870274615783065@ietfa.amsl.com> Date: Wed, 20 Nov 2019 18:11:46 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 02:11:47 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) Authors : Ludwig Seitz Goeran Selander Erik Wahlstroem Samuel Erdtman Hannes Tschofenig Filename : draft-ietf-ace-oauth-authz-27.txt Pages : 86 Date : 2019-11-20 Abstract: This specification defines a framework for authentication and authorization in Internet of Things (IoT) environments called ACE- OAuth. The framework is based on a set of building blocks including OAuth 2.0 and CoAP, thus transforming a well-known and widely used authorization solution into a form suitable for IoT devices. Existing specifications are used where possible, but extensions are added and profiles are defined to better serve the IoT use cases. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-authz/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-27 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oauth-authz-27 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oauth-authz-27 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Nov 20 18:16:24 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAEDF1208AA for ; Wed, 20 Nov 2019 18:16:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V5WXBBYXZPhp for ; Wed, 20 Nov 2019 18:16:15 -0800 (PST) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00054.outbound.protection.outlook.com [40.107.0.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1AA1120840 for ; Wed, 20 Nov 2019 18:16:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jaRpfGj0Od+qmmL82DeVRoIMe1YJTKBIfuRHry+sbdlIkyF1wTTsgYeDRF4mbJu2hAK6DbB6LlXC5tlgszoiK6Cb4iqD7/YjsIgjZ7NUS2HnkzbFpg3nqY+DO0j669dUdTnoaylTxE8xLpcteeCYbv91PGKPfRMwd7tWqEWb9PWtdAlsvtn87xSPi77uqcux+BuB5mhKz4eE0S2E2JnkHTnozVOrnkBBgIlWVOXosPUQF97BXAfl/oOVxjsx38p6ZNhnZ/4XqmotdZd/HclzqyyM1NYvRrvqONAorNKO3k+wO9Exaj54dp30H5mBDLxVy0XRLqVR4hm5L0RgGmbBsg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JAozlRwO1Dv9FHt6L/h629mYCs8hmUV96vpDrEdOxls=; b=O9eYQYk50Qk34FXhEz0TPzifiWDB4keH6xjhk7LgkM98HDzraLpW+0Cv4RCjC1PtzwcPcXuqa0cy8yTeNy/rcFuruHci2nmWMvy2FtopTsvNFaHW08Lo53zNPO8cFK1vsoyQK2BiSEmq0Pksw0jgbcNiu+/k91bsDo6oae7xJjQkwdjhRMeU9zEPZOiZDeXgDVrHkHN26A8qSBatFS2bnfpuw3V1C2535PxVOuWW0ZmgF1g+zUXKN0cdzkcyrIF5ntxewEmvRkBWpBZKo/TTqbDoD15LWFOJY+nu7eNOZElppuo8WwEC8XUiYZ9w2xeGHF9n+PLD6zaCghKuVaD1/A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JAozlRwO1Dv9FHt6L/h629mYCs8hmUV96vpDrEdOxls=; b=HApGxZz+vof61MBxipYphNzhVpIk8eKHvvpUQK+ZbKX1+Hgmg8j/L+EC9Y/SN+TxfvCz5nwC09XO+XCt5RqX7tgZGyvBfwIRa0OUx2nPx/DOh9RZwCpNPvea4LNNzcXbbrV7evvlm1B8lEGiv7/49DiSOzdShpjNXgu/GnT8lbI= Received: from VI1P18901CA0021.EURP189.PROD.OUTLOOK.COM (2603:10a6:801::31) by DB6P189MB0456.EURP189.PROD.OUTLOOK.COM (2603:10a6:6:31::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.28; Thu, 21 Nov 2019 02:16:12 +0000 Received: from HE1EUR02FT064.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e05::208) by VI1P18901CA0021.outlook.office365.com (2603:10a6:801::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.17 via Frontend Transport; Thu, 21 Nov 2019 02:16:12 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by HE1EUR02FT064.mail.protection.outlook.com (10.152.11.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2474.17 via Frontend Transport; Thu, 21 Nov 2019 02:16:11 +0000 Received: from [31.133.132.127] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Thu, 21 Nov 2019 03:16:09 +0100 To: References: <157430230677.769.6413870274615783065@ietfa.amsl.com> From: Ludwig Seitz Message-ID: Date: Thu, 21 Nov 2019 03:16:03 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <157430230677.769.6413870274615783065@ietfa.amsl.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060206050605050508020602" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(376002)(136003)(396003)(39860400002)(346002)(189003)(199004)(40036005)(486006)(26005)(33964004)(6916009)(6116002)(305945005)(3846002)(5000100001)(70206006)(2351001)(16576012)(58126008)(16586007)(70586007)(478600001)(81166006)(106002)(5660300002)(36756003)(22756006)(316002)(22746008)(8676002)(81156014)(126002)(186003)(16526019)(7736002)(386003)(446003)(86362001)(11346002)(336012)(65806001)(956004)(2616005)(476003)(65956001)(8936002)(31696002)(235185007)(6246003)(568964002)(229853002)(71190400001)(5024004)(356004)(14444005)(6706004)(6666004)(76176011)(31686004)(44832011)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6P189MB0456; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 6dc8a2a7-b945-468a-d8fe-08d76e28c73e X-MS-TrafficTypeDiagnostic: DB6P189MB0456: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-Forefront-PRVS: 0228DDDDD7 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: fQ9RL21GJjGDTY5eNozNvgIySvCzxKKelTBwXwT3tFrlc7yS6vsWyNvezNuRlGS3N+lnzZmsj+MAy2CllAiEyqyJGuOYKTKh1S+xF2YRWadtOtIdTvD3HLHJM1b6+IIrKNfNlyVSjmtHFZxesTwkiVDaX2zdvywnagIcFN1qZgjSxeLk0Gx643M491MrYEkfOrdzQPyNxFPcXcNg1QGNANAhmrMIIZfjxRbISXmwOWKGMgTAeW82tIqKFrbRhyYV9QloTkL1snFQvpyWBIuP3qmmJYvFZafZySTCsuUjl2x1khSupp+E3QaCH2Tr26F/dLLUKxdYfFzXOkkmgVX1sufQMm37lFXKn8mwoGSeCWtj5sPBfGOoBKwWEYmvGSHUeHRMoJN1bnKtakRkyvyVGn9DAfXoz4e0hP9IPxBsvWWIOeRjJlZ8Qm/Z8cjKVuRw X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Nov 2019 02:16:11.6065 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6dc8a2a7-b945-468a-d8fe-08d76e28c73e X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6P189MB0456 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 02:16:22 -0000 --------------ms060206050605050508020602 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hello ACE, turns out -26 didn't cover one of the items in Ben's review, namely the=20 question of using Client introspection to determine token expiration as=20 a lower bound for key expiration. Since the whole issue of Client=20 introspection was contentious between OAuth experts, we decided to=20 remove the text describing that option. This still leaves us with the=20 two other options, so the problem is still covered. /Ludwig --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms060206050605050508020602 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTEyMTAy MTYwM1owLwYJKoZIhvcNAQkEMSIEIAOQfmV4UQBOd5uTHzFDVekHNW1GgAaEcff87rnEEDKR MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAUQcUxESxFJgkqLkdQF5R//2Ro3nl/Ac8H8NOuVXsI+5e 4IKVdi+Ne74TxMeVi2hqyQlSLDOpnOK1wUfvzIp5gJVDBMkUXF+3ATpCxa6bey9Py9zF9k+v DPOhhQX84rXSJguZw6e9M5+e1ePhaQY2PF1vxmhLixfukTgsE4G6Z+A/lMspgMlawaD6e0L/ D2qaJG6KwtdgW8hagtuLnHbZFwtZSlfphoCI6T9A4wtiJH7Zky89nmBQWFdxseI3jzMU+Rl3 Rw38TaxPw2wHGWZk/dgMYLA6xFkdjR3yrdJpj0vll3FSzwBp6kN1vNkJpMq9HIJPWBFm8OWU 1Ah13TGsUwAAAAAAAA== --------------ms060206050605050508020602-- From nobody Wed Nov 20 18:29:20 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B05D1208AA for ; Wed, 20 Nov 2019 18:29:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.405 X-Spam-Level: X-Spam-Status: No, score=-1.405 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.244, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lok0fROy-Nwp for ; Wed, 20 Nov 2019 18:29:17 -0800 (PST) Received: from mail-vs1-f43.google.com (mail-vs1-f43.google.com [209.85.217.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05158120077 for ; Wed, 20 Nov 2019 18:29:17 -0800 (PST) Received: by mail-vs1-f43.google.com with SMTP id b16so1184584vso.10 for ; Wed, 20 Nov 2019 18:29:16 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=6TB9hJqEtcV8+zj98I3xuiZFYIcyb0K0VmP92mqZV8Y=; b=IGNMzHUJa/3QwxR14j5/jRFytb/sgmC1IfrvvONRhwtM58hHHUKjjfZX5r1tjPjv0g rckIYrN71IcuZPlixszF2VxCs1w2T9xbQivprItoEexKneqBi1VZwm7fYUt0E2Flh54E GeHOxrmqigFTMZ1IyVw3+EGknsI4a+7gCG22Dpczh3MUClAgTkyX6n8QAf7ZP6x9CvS0 Vca0OaDZZzUtvCA15/9FOeJw050O0RZe1nn71PDDQkIXWcmuxh5lE1rMAoYOMhaNM8Nt WFqxja3DqDhePY9AgVdzrZ7oSTDeAQ8SXBexCIjHW+5RRHzpb6qktKlrVnWRxRwKULRz vt2A== X-Gm-Message-State: APjAAAURI++60U1AWjGMCeVBRGkp5XYbgWAIjxxNpNKry/DMu4czInuO fkDapCrhylajAC+pTpXQdTvu1Q07dXq+F4UK2yd9ng== X-Google-Smtp-Source: APXvYqy+TuWUC94S5Sj8iabx/7A6Jr6ScdGYekRz6MM/6NQbHaQcPC+fU/PjU1vZBh/96TSYEDVwG27a0x6C1G6rZ/k= X-Received: by 2002:a67:ef84:: with SMTP id r4mr4082387vsp.31.1574303355751; Wed, 20 Nov 2019 18:29:15 -0800 (PST) MIME-Version: 1.0 From: Daniel Migault Date: Thu, 21 Nov 2019 10:29:04 +0800 Message-ID: To: Ace Wg Content-Type: multipart/alternative; boundary="00000000000049d3a20597d210ce" Archived-At: Subject: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 02:29:18 -0000 --00000000000049d3a20597d210ce Content-Type: text/plain; charset="UTF-8" Hi, This only concerns potential clarification of the text. While reviewing mqtt-profile draft I raised an issue regarding the reference for Oauth [RFC6749] while the remaining of the document references draft-ietf-ace-oauth-authz [1]. My reading of draft-ietf-ace-oauth-authz section 5.6.3 . was the same of the one of mqtt-profile coauthors, that is error mandates the use of CBOR. Discussing this with others it seems a mis interpretation of draft-ietf-ace-oauth-authz section 5.6.3 [2]. I believe that is nice this is a mis-interpretation, but I would recommend that the text makes it more explicit the use of JSON is permitted. This seems to me a request to clarify the text. Yours, Daniel [1] """ In the case of an error, the AS returns error responses for HTTP- based interactions as ASCII codes in JSON content, as defined in Section 5.2 of RFC 6749 [RFC6749 ]. """ [2] """ 5.6.3 . Error Response The error responses for CoAP-based interactions with the AS are generally equivalent to the ones for HTTP-based interactions as defined in Section 5.2 of [RFC6749] , with the following exceptions: o When using CBOR the raw payload before being processed by the communication security protocol MUST be encoded as a CBOR map. o A response code equivalent to the CoAP code 4.00 (Bad Request) MUST be used for all error responses, except for invalid_client where a response code equivalent to the CoAP code 4.01 (Unauthorized) MAY be used under the same conditions as specified in Section 5.2 of [RFC6749] . o The Content-Format (for CoAP-based interactions) or media type (for HTTP-based interactions) "application/ace+cbor" MUST be used for the error response. o The parameters "error", "error_description" and "error_uri" MUST be abbreviated using the codes specified in Figure 12, when a CBOR encoding is used. o The error code (i.e., value of the "error" parameter) MUST be abbreviated as specified in Figure 10, when a CBOR encoding is used. /------------------------+-------------\ | Name | CBOR Values | |------------------------+-------------| | invalid_request | 1 | | invalid_client | 2 | | invalid_grant | 3 | | unauthorized_client | 4 | | unsupported_grant_type | 5 | | invalid_scope | 6 | | unsupported_pop_key | 7 | | incompatible_profiles | 8 | \------------------------+-------------/ Figure 10: CBOR abbreviations for common error codes In addition to the error responses defined in OAuth 2.0, the following behavior MUST be implemented by the AS: o If the client submits an asymmetric key in the token request that the RS cannot process, the AS MUST reject that request with a response code equivalent to the CoAP code 4.00 (Bad Request) including the error code "unsupported_pop_key" defined in Figure 10. o If the client and the RS it has requested an access token for do not share a common profile, the AS MUST reject that request with a response code equivalent to the CoAP code 4.00 (Bad Request) including the error code "incompatible_profiles" defined in Figure 10. """ --00000000000049d3a20597d210ce Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0
=
This only concer= ns potential clarification of the text.=C2=A0
= =C2=A0
Whi= le reviewing mqtt-profile draft I raised an issue regarding the reference f= or Oauth [RFC6749] while the remaining of the document references draft-iet= f-ace-oauth-authz [1]. My reading of draft-ietf-ace-oauth-authz section=C2= =A05.6.3.=C2=A0was the same of the one of mqtt= -profile coauthors, that is error mandates the use of CBOR. Discussing this= with others it seems a mis interpretation of=C2=A0 draft-ietf-ace-oauth-au= thz section=C2=A05.6.3=C2= =A0[2].

I believe that is nice this is a mis-interpretation, but I would recomme= nd that the text makes it more explicit the use of JSON is permitted. This = seems to me a request to clarify the text.=C2=A0

Yours,=C2=A0=
Daniel

[1]<= /div>
"""
In the case of an error,= the AS returns error responses for HTTP- based interactions as ASCII codes in JSON content, as defined in Section=C2= =A05.2 of RFC 6749 [RFC6749].
"""=C2=A0
<= div>
[2]
"""

5.6.3.  Error Response


   The error responses for CoAP-based interactions with the AS are
   generally equivalent to the ones for HTTP-based interactions as
   defined in S=
ection=C2=A05.2 of [RFC6749], with the following exceptions:

   o  When using CBOR the raw payload before being processed by the
      communication security protocol MUST be encoded as a CBOR map.

   o  A response code equivalent to the CoAP code 4.00 (Bad Request)
      MUST be used for all error responses, except for invalid_client
      where a response code equivalent to the CoAP code 4.01
      (Unauthorized) MAY be used under the same conditions as specified
      in Sectio=
n=C2=A05.2 of [RFC6749].

   o  The Content-Format (for CoAP-based interactions) or media type
      (for HTTP-based interactions) "application/ace+cbor" MUST b=
e used
      for the error response.

   o  The parameters "error", "error_description" and &=
quot;error_uri" MUST
      be abbreviated using the codes specified in Figure 12, when a CBOR
      encoding is used.

   o  The error code (i.e., value of the "error" parameter) MUST =
be
      abbreviated as specified in Figure 10, when a CBOR encoding is
      used.
           /--------=
----------------+-------------\

           | Name=
                   | CBOR Values |
           |------------------------+-------------|
           | invalid_request        |      1      |
           | invalid_client         |      2      |
           | invalid_grant          |      3      |
           | unauthorized_client    |      4      |
           | unsupported_grant_type |      5      |
           | invalid_scope          |      6      |
           | unsupported_pop_key    |      7      |
           | incompatible_profiles  |      8      |
           \------------------------+-------------/

           Figure 10: CBOR abbreviations for common error codes

   In addition to the error responses defined in OAuth 2.0, the
   following behavior MUST be implemented by the AS:

   o  If the client submits an asymmetric key in the token request that
      the RS cannot process, the AS MUST reject that request with a
      response code equivalent to the CoAP code 4.00 (Bad Request)
      including the error code "unsupported_pop_key" defined in
      Figure 10.

   o  If the client and the RS it has requested an access token for do
      not share a common profile, the AS MUST reject that request with a
      response code equivalent to the CoAP code 4.00 (Bad Request)
      including the error code "incompatible_profiles" defined in
      Figure 10.
"""= ;
--00000000000049d3a20597d210ce-- From nobody Wed Nov 20 18:51:48 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9BDA120928 for ; Wed, 20 Nov 2019 18:51:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b23AAys_tewE for ; Wed, 20 Nov 2019 18:51:41 -0800 (PST) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00086.outbound.protection.outlook.com [40.107.0.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96D1512090F for ; Wed, 20 Nov 2019 18:51:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=COWkTEOV/62fv7c3xxEx15sOu82ynbO7Esldhkp6XHje7yJkgebK3Twac6xnszb5og7GiZfbWuPTv0m8/5pghIDCqYc9HJMUSTvt6DTBwn6NHjE1Z95+2MoZUUTpkCGi3280jdM+kiYXaw2EqZXUeQnI0eLOKOVmNF/bO1Uid4T+vDqNvTPbzR6mGiTC+ETPXeynfHtyUOAe/9tkjiW3p9lIcjW/TPyRPCOs6cop4nLg8zWW7COjvvd4d9pg5E8wkaEqKw0Jp9YT58IRh9dbqtMTIda92bUOiNSsQX/9UeHAwdCv/BAGSUMYPopY+jWsGZrqKPMtZjgzFLzL6yIyxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rHr0H1pqQnbI7SRyQ11raVYHZaU57ZyEAr/gV9/bZCE=; b=ZSiYm2qXEJiB/i9Mi3xUr2JKJU2rIHan0ECx5zPisJ3bvJozhZ1DE0VL5M/lce27qo2dVlCWSMUe0mVKF9E7QspzkRPlzDB9LvHop6A++2Jlk3l/z2QPm1bpD0Dk0M8467Hu1F9POq4Vh9wQH0SrsFybvoGfCnPpOLB7s7oEBXKTSs+RMZv0N56xUgv12qKbonnrJA5uOHjC7Qz+CoBVZB0C6qqINayF1YpnHrOIlgbKA7MAQD8/DlCg/b3czSqU2ZGw5SxryFBgLui9SNGinsr9zA3NIs/C4ux5xuz1fRqec5B/IGDCB7KuV7DwNPxH4TPij2tBG14FNxOkQdIgpw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.218.146.197) smtp.rcpttodomain=ietf.org smtp.mailfrom=ri.se; dmarc=pass (p=none sp=none pct=100) action=none header.from=ri.se; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rHr0H1pqQnbI7SRyQ11raVYHZaU57ZyEAr/gV9/bZCE=; b=bVuGUFHCjwCgAm7Z/CUrLyBfSqonqc/43RwGTlHL4KlTQj/kjHKSfn2wb/8QP2vdj1KgjGTiT0SFGMaVr2bx1b7jdnH81mVFhahRWxp8fMLUTOJLykpVPpVQb1s+3It/8xiWZArt6NyhQ6zeVN3jYK3R3ad0svrcqpyTjuWJJhA= Received: from DB6P18901CA0024.EURP189.PROD.OUTLOOK.COM (2603:10a6:4:16::34) by HE1P18901MB0235.EURP189.PROD.OUTLOOK.COM (2603:10a6:3:96::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.17; Thu, 21 Nov 2019 02:51:37 +0000 Received: from VE1EUR02FT014.eop-EUR02.prod.protection.outlook.com (2a01:111:f400:7e06::203) by DB6P18901CA0024.outlook.office365.com (2603:10a6:4:16::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.16 via Frontend Transport; Thu, 21 Nov 2019 02:51:37 +0000 Authentication-Results: spf=pass (sender IP is 194.218.146.197) smtp.mailfrom=ri.se; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=pass action=none header.from=ri.se; Received-SPF: Pass (protection.outlook.com: domain of ri.se designates 194.218.146.197 as permitted sender) receiver=protection.outlook.com; client-ip=194.218.146.197; helo=mail.ri.se; Received: from mail.ri.se (194.218.146.197) by VE1EUR02FT014.mail.protection.outlook.com (10.152.12.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2474.17 via Frontend Transport; Thu, 21 Nov 2019 02:51:37 +0000 Received: from [31.133.132.127] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1779.2; Thu, 21 Nov 2019 03:51:34 +0100 To: References: From: Ludwig Seitz Message-ID: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> Date: Thu, 21 Nov 2019 03:51:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000004040509000105000602" X-Originating-IP: [10.116.0.226] X-ClientProxiedBy: sp-mail-3.sp.se (10.100.0.163) To sp-mail-2.sp.se (10.100.0.162) X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:194.218.146.197; IPV:NLI; CTRY:SE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(346002)(376002)(39850400004)(136003)(189003)(199004)(65806001)(106002)(58126008)(316002)(16576012)(33964004)(6666004)(336012)(44832011)(76176011)(31686004)(16586007)(386003)(36756003)(6706004)(6306002)(6916009)(486006)(356004)(53546011)(5024004)(71190400001)(14444005)(6246003)(8676002)(81166006)(478600001)(81156014)(8936002)(2906002)(966005)(70586007)(70206006)(7736002)(229853002)(305945005)(22746008)(22756006)(568964002)(2351001)(16526019)(2616005)(126002)(476003)(446003)(956004)(11346002)(186003)(31696002)(26005)(86362001)(40036005)(65956001)(5660300002)(235185007)(3846002)(6116002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1P18901MB0235; H:mail.ri.se; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 712a4a93-bf7a-4199-e6c2-08d76e2dba34 X-MS-TrafficTypeDiagnostic: HE1P18901MB0235: X-MS-Exchange-PUrlCount: 4 X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 0228DDDDD7 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: T2Ys5m5J1Q9e+aoUOh8q94kyqHi3Q6csZ2Cn/Er1auL1phRRNSr+cgT+ZrZAmB/+AmxxsMntMzxRI57a7Pm4lTgRSG5BCYHpQAp8mMs88mWIdkHU8vE7wsw9T+JEe45EwFJ45V9xb9Ss1/eYVax7bg4wkMm4fD6UWMlIwOWoGt6ZajEHoLGLFmNEQr5b+jzNJbV0uMdUUAWWI/ahGVqMe9PuVRkvVnex25PhiclPP14v62S58Ki6UfIoZ3xngEauXn1DUMozcIn/ICg57WcU+e2cfFXkN3ifeJg3dph1rqr3RDpghXQD/Fi6Z7aXUdVuCzM5/TLAPFmPmeVDxZqhMdWVo/lbDSzNVICGQAEDzEd/JiBzPvhYYO102d7FCZowEiozzumuQzjM7b7siBGUsVM5UEXkgUIrxRjbJ0dq3R6P3eCTNC5imMsTrclsXDruux+NjcG6Jf/1fbj8CdSFC29LGWudef81vnfQAnhvhQA= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Nov 2019 02:51:37.2076 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 712a4a93-bf7a-4199-e6c2-08d76e2dba34 X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5a9809cf-0bcb-413a-838a-09ecc40cc9e8; Ip=[194.218.146.197]; Helo=[mail.ri.se] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1P18901MB0235 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 02:51:45 -0000 --------------ms000004040509000105000602 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 21/11/2019 03:29, Daniel Migault wrote: > Hi, >=20 > This only concerns potential clarification of the text. >=20 > While reviewing mqtt-profile draft I raised an issue regarding the=20 > reference for Oauth [RFC6749] while the remaining of the document=20 > references draft-ietf-ace-oauth-authz [1]. My reading of=20 > draft-ietf-ace-oauth-authz section 5.6.3=20 > .=20 > was the same of the one of mqtt-profile coauthors, that is error=20 > mandates the use of CBOR. Discussing this with others it seems a mis=20 > interpretation of=C2=A0 draft-ietf-ace-oauth-authz section 5.6.3=20 > [2]. >=20 > I believe that is nice this is a mis-interpretation, but I would=20 > recommend that the text makes it more explicit the use of JSON is=20 > permitted. This seems to me a request to clarify the text. >=20 > Yours, > Daniel >=20 I would be happy to add more clarification, but I'm currently at a loss=20 of what that would be. Most of the bullets you cited already modify the=20 MUSTs with "...when CBOR is used" or something similar to the same=20 effect. The idea was to express: You can use the vanilla OAuth=20 interactions based on JSON, but if you use CBOR then do it as specified=20 here. I am happy to take suggestions. /Ludwig > [1] > """ >=20 > In the case of an error, the AS returns error responses for HTTP- > based interactions as ASCII codes in JSON content, as defined in > Section=C2=A05.2 of RFC 6749 [RFC6749 ]. >=20 > """ >=20 > [2] > """ >=20 >=20 > 5.6.3 > . > Error Response >=20 >=20 >=20 > The error responses for CoAP-based interactions with the AS are > generally equivalent to the ones for HTTP-based interactions as > defined inSection=C2=A05.2 of [RFC6749] , with the following exceptions: >=20 > o When using CBOR the raw payload before being processed by the > communication security protocol MUST be encoded as a CBOR map. >=20 > o A response code equivalent to the CoAP code 4.00 (Bad Request) > MUST be used for all error responses, except for invalid_client > where a response code equivalent to the CoAP code 4.01 > (Unauthorized) MAY be used under the same conditions as specifie= d > inSection=C2=A05.2 of [RFC6749] . >=20 > o The Content-Format (for CoAP-based interactions) or media type > (for HTTP-based interactions) "application/ace+cbor" MUST be use= d > for the error response. >=20 > o The parameters "error", "error_description" and "error_uri" MUST= > be abbreviated using the codes specified in Figure 12, when a CB= OR > encoding is used. >=20 > o The error code (i.e., value of the "error" parameter) MUST be > abbreviated as specified in Figure 10, when a CBOR encoding is > used. > /------------------------+-------------\ >=20 > | Name | CBOR Values | > |------------------------+-------------| > | invalid_request | 1 | > | invalid_client | 2 | > | invalid_grant | 3 | > | unauthorized_client | 4 | > | unsupported_grant_type | 5 | > | invalid_scope | 6 | > | unsupported_pop_key | 7 | > | incompatible_profiles | 8 | > \------------------------+-------------/ >=20 > Figure 10: CBOR abbreviations for common error codes >=20 > In addition to the error responses defined in OAuth 2.0, the > following behavior MUST be implemented by the AS: >=20 > o If the client submits an asymmetric key in the token request tha= t > the RS cannot process, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "unsupported_pop_key" defined in > Figure 10. >=20 > o If the client and the RS it has requested an access token for do= > not share a common profile, the AS MUST reject that request with= a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "incompatible_profiles" defined in > Figure 10. >=20 > """ >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace >=20 --=20 Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 --------------ms000004040509000105000602 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DT0wggYWMIID/qADAgECAg8BaKlzCTJTye3phLaz/cIwDQYJKoZIhvcNAQELBQAwRzELMAkG A1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBD bGFzcyAyIENBIHYyMB4XDTE5MDIwMTE0MjUxNVoXDTIxMDIwMTE0MjUxNFowgYsxCzAJBgNV BAYTAlNFMS4wLAYDVQQKDCVSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVuIEFC MRUwEwYDVQQDDAxMdWR3aWcgU2VpdHoxEjAQBgNVBAUTCUx1ZHdpZ1NlaTEhMB8GCSqGSIb3 DQEJARYSbHVkd2lnLnNlaXR6QHJpLnNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAlJNmRfcsto5I/yXrBIi9QroZtfAMttc1Eznv5iPCK++eFUArODhITO7k9rtlQX5D8vYF v4vzZex58YWZhvGMzDj9FdpD/PHKOxL/frlrreChuissPWo5M88DmL3V1oyGzvgeRqaafpEi 0/2+gezMFlABm/BXj3/0Fiw5Sxub7essE27EtDK05nAbUB69kfLHBEytbTAuuSb11hC1dpTf itMZkzSFwsBCyPtIv3GRt9xgnOPK4RRpHidv1GLYXNQQ7xEGhFy4qbZ2NSfM+56SSRswvW9P 5n81ZmZ4FWkiJouUIYtZ2ifncBJL4DC2chjsywDEz5No7kYrGxc5oOm1YQIDAQABo4IBuDCC AbQwHwYDVR0jBBgwFoAUnhn/5Q06/gCXFT9p8dxaPKoMlIMwHQYDVR0OBBYEFKZHZ8MZNNP5 tXMPjeFiw01pUWbtMA4GA1UdDwEB/wQEAwIFoDBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEB DDA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEu Y29tL0NQUzAdBgNVHREEFjAUgRJsdWR3aWcuc2VpdHpAcmkuc2UwTQYDVR0fBEYwRDBCoECg PoY8aHR0cDovL2NybC0yLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNz MmNhdjIuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjB+BggrBgEFBQcBAQRy MHAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnRydXN0LnRlbGlhLmNvbTBFBggrBgEFBQcw AoY5aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYWNsYXNzMmNh djIuY2VyMA0GCSqGSIb3DQEBCwUAA4ICAQCk0GOalOCjEJObuBeMg0QREtBP/2ona16npn+T v5R3Vjk5UsQdOaOosgVjADX68C83dyfPiWR4UfNJoTBcM8JLpEXIm+xC4BiDPTPHYvgkhgXt 9VWCRWXOMfT/UPXjiGsbPuNWja1LQzF5KOmM826kHVZItHuDY6kJLE4OZ+apFvVKtSLQJJLA 4MlDVwp5+XsZi4cftcX5HdgLdChodUPKq3XVfALfXM/p81XEFBTYOHNplr3cQytDQjsnCZnS Ic4UpsxrArNxDO9+AKu/s1Fbq494AhHj4oHcg4DIjhHUzbPCLP19Gqp4dflr/V7Ulg3d+4Zh bmSAn1cffrzvvkjVrqMgQOoHQTl2QyO9n/oJ/9CSYRmhFsQMPun9LM/p5l58dTZp53B3LgA6 FFrxnntlZnTPh3bvsMJvUQ+AoiXyQwnkdxUrhoM+gUz36t3JSA8g48h7BhPsnwQ/YrarAhJ8 ifuzykTQmDseWLjJKyFflddy/azAlPQjgSMMWOZCo2s+l+WwPISf33nls2Aec/vvG5auYHS6 pwWuVKuwZTPgJfHanZTNpBM5y0jVBz6tr8AHZypnCONgyUYA4uec3v5oWz4FvLEnlKnMGoK3 OeFGvfHG0tbP25HbdN3AJYP0EUo56wfkBOYsnmn4mEYdk2GHkJNfaQRBJljH0T7TOcmcDjCC Bx8wggUHoAMCAQICEGN8C9eFpb8p2mAtfE16cLEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UE CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTQx MDE2MDgzOTMwWhcNMzIxMDE2MDUwNDAwWjBHMQswCQYDVQQGEwJTRTEUMBIGA1UECgwLVGVs aWFTb25lcmExIjAgBgNVBAMMGVRlbGlhU29uZXJhIENsYXNzIDIgQ0EgdjIwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC0PpW2qcWGnStqfa5DjrUi79Kz2SySUlJ1kiEQ1Pd/ LWbnsEwFYPqOJwAf6ZtEDtQ/9Z1VkVNQ6MkD++keqk7648x0YANgMyiJsWrbd0TKOObtlXdJ pb5qesJ5nOAdVeL3z6lgrkZx+fsUfTV+lLRGRh2+RWzZTjPAvKotY3nAwXCHtwI5v3FKuR10 aJ9+CEOka02KSUzGjcGZwMk2io0DxLELf1gPRvqE9xmn4ioXLqpluozb4Fo9ewydufTLQc3/ I63uPQh8BlLPPIGzWb4iBDq2zbWlbx0KlH/UlUZ7fjzp6N6cAqZ2NnDaCOnnIRfUYeNXFG8/ aiBeFOpEeEpclr5QUwr9HLKL1QiyQtc/wW8acQFoKuGi8myiAch7k7S0rmU5gT05je+OTzWh Oaw7gmDdndYY1mjkPkzpQ+hxyfnwUsAitUq9j0imFOLxKWLH4QNbyuDIMvDyezzJWzMy3XPB LiLSH9CBLVQHRoQ+WW8xD4rnmvQtoGZM72og2iNf4/JCHL1AJYhQtaRjYgm3rhvAP0HhSVAB Z5aHM52ylJHC3JwUyuFm8S9A2ffY9rUTffMLWmDCnX0QAP9bKr6+ACogm4DBUj3ftYodI2TD 6F8+VjSFuCzGDPuCjK+fQ2c3wqziwFl+NgoGI9Vgc6x5+0ocKkiQAIYFaQ3SyGmI6QIDAQAB o4ICFTCCAhEwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVz dC50ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgw BgEB/wIBADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRw czovL3JlcG9zaXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAOBgNVHQ8BAf8EBAMC AQYwgcYGA1UdHwSBvjCBuzBAoD6gPIY6aHR0cDovL2NybC0zLnRydXN0LnRlbGlhc29uZXJh LmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDB3oHWgc4ZxbGRhcDovL2NybC0xLnRydXN0 LnRlbGlhc29uZXJhLmNvbS9jbj1UZWxpYVNvbmVyYSUyMFJvb3QlMjBDQSUyMHYxLG89VGVs aWFTb25lcmE/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwHQYDVR0OBBYEFJ4Z /+UNOv4AlxU/afHcWjyqDJSDMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0G CSqGSIb3DQEBCwUAA4ICAQB5wuZFNXR5ko9cu7PcpIyH8xaoGfpimP2GTg7qVuL92D/idIlj pqMm93WC9mgL/Uy6DExoF8xSLurLaiajoU+VG6ZWg0F7P1AXARNt0RpWI5SphxBQYM2751S8 vC/22k8Vi+qpQVIREqQPVXCIEH7U6eCY9gEVzdq9l1yPoI8n0D2a8V6GCv0RVkmIpa16rNYD tTw4j3Ha56/Ua33C3qeZh1dIfkaU2h4CGHd2Em3v5LLMsEh8dqUeG9yIcCU+8RUgDahNxWMe MGxzrhwk8WBV6xeoQp20p7cSHbSbyHJURC1n+nVrgdh8hbw6WOgFhNA5tCPDZ0oSF+uHfj+b ioZE3AlYdcEqHJA9A9sO58F4/Qg/yp9oYuT0ZpKb4hmzeqDXvk5KRFNfHlhTt35i+qmas9wB 11MXbYd5WwqEhZH6HWO5H7XKJP7olxmEC0W3OKlpKafq1iPsBN5ycRfUrXFss0Ax6vpCq0XA 3LYePpQ44hOU+qrkR1M0a7Eo3++3TpP4cV+FZiO4aZYZ3yZftSRHwWpGiDBdWOdTKR2GJi7Z z/OxacrmwmM1Z+WcigldbG8f3IMnOLK4X0uXjhVeAHrhuttQuM8i+4TNXgsZbmfEKNDQIQPO /lbacsGHWFB/U2y6SXVEkZs2xIciRA0iZNTv7mbIL8SZmf5wpbjDCYHiCjGCAzgwggM0AgEB MFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJhMSIwIAYDVQQDDBlUZWxp YVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIwDQYJYIZIAWUDBAIBBQCg ggGvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTEyMTAy NTEyOVowLwYJKoZIhvcNAQkEMSIEINYK6a28KJP3uXDABiQhmY3+0dab9hTDxBbOge/+C5de MGkGCSsGAQQBgjcQBDFcMFowRzELMAkGA1UEBhMCU0UxFDASBgNVBAoMC1RlbGlhU29uZXJh MSIwIAYDVQQDDBlUZWxpYVNvbmVyYSBDbGFzcyAyIENBIHYyAg8BaKlzCTJTye3phLaz/cIw awYLKoZIhvcNAQkQAgsxXKBaMEcxCzAJBgNVBAYTAlNFMRQwEgYDVQQKDAtUZWxpYVNvbmVy YTEiMCAGA1UEAwwZVGVsaWFTb25lcmEgQ2xhc3MgMiBDQSB2MgIPAWipcwkyU8nt6YS2s/3C MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwDQYJKoZIhvcNAQEBBQAEggEAe5CGIFLLu1gzmzj5ogQcm/eJInv8Jvye8BjP9wGxofvj CFVPqbgfnfdiBwPtQibPy3mqbg33siAfwxUHtHOmFST0T6tTPy+ZyCW9tXjsMl45IfbJf0S1 svt6dbkWboyE+9TfT/zw0ra4GQKWfn731UdmI3+QWejPYkQ83UiBKJdevGtZQiasuMUgJjnN Gu86xoiLeKCm9YTq+p9ncTQnYe4TeRxl/51ROXmywWYVqXHNvHeYttH1CTV/YnfuzQnb+FvK mNe6XGNxj4rb7ZF4Nqez+vWrKuxiiPnQ4wXygfMcUD/FNimpL/LTdgFpTAYI9B5VxDoIg/Gx 2kmFH3pywAAAAAAAAA== --------------ms000004040509000105000602-- From nobody Wed Nov 20 19:06:37 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5466C1207FF for ; Wed, 20 Nov 2019 19:06:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 59XfcPN5IMAN for ; Wed, 20 Nov 2019 19:06:34 -0800 (PST) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680088.outbound.protection.outlook.com [40.107.68.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2EED120071 for ; Wed, 20 Nov 2019 19:06:33 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ncIcJdB76hXOAFCIye2mSc1L2Ys9GLFLufV9ede/9PZEP0DcwAt0izlkD7EcygC8QYCeubg8hLrlWO1hoSE64k6gHm3ZxzcI17M4tFU1V1vEsdRKeIWYYjBF+XRCcwcgCciKHp+DXjKmIXVyuqj/SoBojbMHoPtLJI5JhLJGwD6guQr6uzFMTmyh+mDSTZ/Um4v/sPDI5qHuRdFBCnwv/V4FW2zYFYnySNdxcHTc76JUD1uzm2mr4CiTgW73M2r41YmWAlh4JnhAarVmwFz+ZVj4t4gMoebNav3UU3F1hKOo0cWsSlDeTCyVJBD9YEJDthwF+S5FKh9mOSB21gngeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IAbtJT4lfDvjYwYFXDHpk19yph2ijc3+rjjTPATXHEM=; b=Uwutk9VSNBdsa+1bCRiQ4WlTi9D+KYvafhOkHczm8hk1F9+sWqUxz7FSOc6A8hY2LyxkTHynIZr7U+TYYcUmBTWw6MTth9zFVsw+jUuRSDL3a4fM4nL4JttegUScppVP9FHaE1l0HYp7/vXXW9GDSarzb8yxSmoTCtQsUnCNbzCmZTGF1FHxmsQqlZYc70LHySdwqmDFPU0tqksg4kae1pTsTi38/rpeTdPFhezeJz/wquye10ziWpGDpe5tn3yLLz84PahaQIYkaeVMCXrhxiDdjy/93/fQMWzpgepjF4b5fy9Q+kL2PMWvkv+b32sXufOpkHrp6MP2JIIIbLm/Ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IAbtJT4lfDvjYwYFXDHpk19yph2ijc3+rjjTPATXHEM=; b=eNDWkzrPN7J3/axRuFqtMDpaW9pXeJc793gIQDh01gShZEaqkYgD6H9Mn0tJx+c9A73lH6/82wLWq+E6uFQHrbcP/pqiowBqJmONRTV3QjtWCWBHiQarckfIqurswvjgZogGSKbVVvuOn9rzyTXv75Red2MtUEMhYsfwtzPgeLw= Received: from CH2PR15MB3525.namprd15.prod.outlook.com (52.132.229.213) by CH2PR15MB3718.namprd15.prod.outlook.com (52.132.230.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.23; Thu, 21 Nov 2019 03:06:29 +0000 Received: from CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a]) by CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a%6]) with mapi id 15.20.2451.029; Thu, 21 Nov 2019 03:06:29 +0000 From: Daniel Migault To: Ludwig Seitz , "ace@ietf.org" Thread-Topic: [Ace] comment on draft-ietf-ace-oauth-authz-26 Thread-Index: AQHVoBODTRvmfj9LwkSkMn4vLe0h8aeU7P0AgAADQXA= Date: Thu, 21 Nov 2019 03:06:29 +0000 Message-ID: References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> In-Reply-To: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [2001:67c:370:128:f80e:7045:b913:15c1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a777a269-d05f-4519-1c73-08d76e2fce11 x-ms-traffictypediagnostic: CH2PR15MB3718: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0228DDDDD7 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(136003)(366004)(39860400002)(346002)(396003)(51914003)(13464003)(189003)(199004)(2906002)(6246003)(476003)(55016002)(478600001)(102836004)(86362001)(11346002)(81166006)(8676002)(2501003)(186003)(76116006)(229853002)(66946007)(52536014)(5660300002)(33656002)(6436002)(8936002)(53546011)(316002)(66556008)(64756008)(110136005)(66446008)(66476007)(71200400001)(71190400001)(446003)(966005)(99286004)(46003)(81156014)(74316002)(6116002)(14454004)(6306002)(9686003)(25786009)(14444005)(256004)(6506007)(44832011)(76176011)(486006)(7736002)(305945005)(7696005); DIR:OUT; SFP:1101; SCL:1; SRVR:CH2PR15MB3718; H:CH2PR15MB3525.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 8ZPChH7PaT9DKuVSBod/zDoDG/4XsSM1D0IIrp65RbKiOsdOty/mr28YbdbqIccEBXZX5HtEGH0aD0IKrK+oIAbnxfYdwy9dp2gtsCoiv/JRRvHyKzc9Sa5Mv5BtjBqLlRY4t21YpkD6UjGomsViq4tVX9/xKNCi3PuxGXtLMBS9DHl/btSzqVroHwlBzAzTvlhQhT+E+5YHMosqQszPVCHS0r9v4aBxCKaSK2TEOpjjjErfBou8JIlqgatV33EEIm0bXWWcck7rCt9kXSQPfrCnY4ILosg6aH4BKojqrS93WeG3nBdtABPe7gewDyzFzCeqW9Nc2XPPg1mj8QQvMoSbqKgSDBWg0V2Kfv0Q390Yn3OwwKrUPbXIKj+1s7yKQygemAQnlLxHX2B/tV0gpS+MRH7Ev5eijMjQjPWc/kUdpc6XNWhGQ2oMDUeQaNg0 x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: a777a269-d05f-4519-1c73-08d76e2fce11 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Nov 2019 03:06:29.4451 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: J1IMsH+ujZdoEvRCLP5+RZrkEq3GpC5GhMtX5kUxK1W+0aq9lcvCwOPTgYiSwcI8U4C+5nJN1HkIW2z+5iGj0wGeuBHDjBvn9e5c1iS0EmE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR15MB3718 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 03:06:36 -0000 SGkgTHVkd2lnLCANCg0KVGhhbmtzIGZvciB0aGUgZmVlZCBiYWNrLiBJIHdhcyByYWlzaW5nIHRo ZSBpc3N1ZSBiZWZvcmUgaXQgZ290IGZvcmdvdHRlbi4gLCBhbmQgSSBtdXN0IHNheSBJIGRpZCBu b3QgY2hlY2tlZCB3aGV0aGVyIGl0IGhhZCBiZWVuIGFkZHJlc3NlZCBvciBub3QsIGFzIEkgZGlk IG5vdCByZW1lbWJlciB0aGlzIGhhZCBiZWVuIHJhaXNlZCBmb3IgdGhlIGFjZS1vYXV0aC1hdXRo eiBkb2N1bWVudC4gDQoNCldoYXQgeW91IGFyZSBzYXlpbmcgaXMgdGhhdCB0aGUgZHJhZnQgaGFz IGJlZW4gdXBkYXRlZCBhbHJlYWR5LiBJIHdpbGwgaGF2ZSBhIGNsb3NlciBsb29rIGF0IGl0LCBh bmQgYXNrIG1xdHQtcHJvZmlsZSB0byBjb25maXJtIHRoZSBjdXJyZW50IHRleHQgaXMgZmluZS4g DQoNClRoYW5rcyENCkRhbmllbCANCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206 IEFjZSA8YWNlLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2VpdHoNClNl bnQ6IFRodXJzZGF5LCBOb3ZlbWJlciAyMSwgMjAxOSAxMDo1MSBBTQ0KVG86IGFjZUBpZXRmLm9y Zw0KU3ViamVjdDogUmU6IFtBY2VdIGNvbW1lbnQgb24gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHotMjYNCg0KT24gMjEvMTEvMjAxOSAwMzoyOSwgRGFuaWVsIE1pZ2F1bHQgd3JvdGU6DQo+IEhp LA0KPiANCj4gVGhpcyBvbmx5IGNvbmNlcm5zIHBvdGVudGlhbCBjbGFyaWZpY2F0aW9uIG9mIHRo ZSB0ZXh0Lg0KPiANCj4gV2hpbGUgcmV2aWV3aW5nIG1xdHQtcHJvZmlsZSBkcmFmdCBJIHJhaXNl ZCBhbiBpc3N1ZSByZWdhcmRpbmcgdGhlIA0KPiByZWZlcmVuY2UgZm9yIE9hdXRoIFtSRkM2NzQ5 XSB3aGlsZSB0aGUgcmVtYWluaW5nIG9mIHRoZSBkb2N1bWVudCANCj4gcmVmZXJlbmNlcyBkcmFm dC1pZXRmLWFjZS1vYXV0aC1hdXRoeiBbMV0uIE15IHJlYWRpbmcgb2YgDQo+IGRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6IHNlY3Rpb24gNS42LjMgDQo+IDxodHRwczovL3Rvb2xzLi5pZXRmLm9y Zy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjM+Lg0KPiB3 YXMgdGhlIHNhbWUgb2YgdGhlIG9uZSBvZiBtcXR0LXByb2ZpbGUgY29hdXRob3JzLCB0aGF0IGlz IGVycm9yIA0KPiBtYW5kYXRlcyB0aGUgdXNlIG9mIENCT1IuIERpc2N1c3NpbmcgdGhpcyB3aXRo IG90aGVycyBpdCBzZWVtcyBhIG1pcyANCj4gaW50ZXJwcmV0YXRpb24gb2bCoCBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoeiBzZWN0aW9uIDUuNi4zIA0KPiA8aHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjM+IFsyXS4N Cj4gDQo+IEkgYmVsaWV2ZSB0aGF0IGlzIG5pY2UgdGhpcyBpcyBhIG1pcy1pbnRlcnByZXRhdGlv biwgYnV0IEkgd291bGQgDQo+IHJlY29tbWVuZCB0aGF0IHRoZSB0ZXh0IG1ha2VzIGl0IG1vcmUg ZXhwbGljaXQgdGhlIHVzZSBvZiBKU09OIGlzIA0KPiBwZXJtaXR0ZWQuIFRoaXMgc2VlbXMgdG8g bWUgYSByZXF1ZXN0IHRvIGNsYXJpZnkgdGhlIHRleHQuDQo+IA0KPiBZb3VycywNCj4gRGFuaWVs DQo+IA0KDQpJIHdvdWxkIGJlIGhhcHB5IHRvIGFkZCBtb3JlIGNsYXJpZmljYXRpb24sIGJ1dCBJ J20gY3VycmVudGx5IGF0IGEgbG9zcyBvZiB3aGF0IHRoYXQgd291bGQgYmUuIE1vc3Qgb2YgdGhl IGJ1bGxldHMgeW91IGNpdGVkIGFscmVhZHkgbW9kaWZ5IHRoZSBNVVNUcyB3aXRoICIuLi53aGVu IENCT1IgaXMgdXNlZCIgb3Igc29tZXRoaW5nIHNpbWlsYXIgdG8gdGhlIHNhbWUgZWZmZWN0LiBU aGUgaWRlYSB3YXMgdG8gZXhwcmVzczogWW91IGNhbiB1c2UgdGhlIHZhbmlsbGEgT0F1dGggaW50 ZXJhY3Rpb25zIGJhc2VkIG9uIEpTT04sIGJ1dCBpZiB5b3UgdXNlIENCT1IgdGhlbiBkbyBpdCBh cyBzcGVjaWZpZWQgaGVyZS4NCg0KSSBhbSBoYXBweSB0byB0YWtlIHN1Z2dlc3Rpb25zLg0KDQov THVkd2lnDQoNCj4gWzFdDQo+ICIiIg0KPiANCj4gICAgIEluIHRoZSBjYXNlIG9mIGFuIGVycm9y LCB0aGUgQVMgcmV0dXJucyBlcnJvciByZXNwb25zZXMgZm9yIEhUVFAtDQo+ICAgICBiYXNlZCBp bnRlcmFjdGlvbnMgYXMgQVNDSUkgY29kZXMgaW4gSlNPTiBjb250ZW50LCBhcyBkZWZpbmVkIGlu DQo+ICAgICBTZWN0aW9uwqA1LjIgb2YgUkZDIDY3NDkgIDxodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMj4gIFtSRkM2NzQ5ICA8aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL3JmYzY3NDk+XS4NCj4gDQo+ICIiIg0KPiANCj4gWzJdDQo+ICIiIg0KPiANCj4g DQo+ICAgICAgICAgNS42LjMNCj4gICAgICAgICA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjM+Lg0KPiAgICAgICAg IEVycm9yIFJlc3BvbnNlDQo+IA0KPiANCj4gDQo+ICAgICBUaGUgZXJyb3IgcmVzcG9uc2VzIGZv ciBDb0FQLWJhc2VkIGludGVyYWN0aW9ucyB3aXRoIHRoZSBBUyBhcmUNCj4gICAgIGdlbmVyYWxs eSBlcXVpdmFsZW50IHRvIHRoZSBvbmVzIGZvciBIVFRQLWJhc2VkIGludGVyYWN0aW9ucyBhcw0K PiAgICAgZGVmaW5lZCBpblNlY3Rpb27CoDUuMiBvZiBbUkZDNjc0OV0gIDxodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMj4sIHdpdGggdGhlIGZvbGxvd2luZyBl eGNlcHRpb25zOg0KPiANCj4gICAgIG8gIFdoZW4gdXNpbmcgQ0JPUiB0aGUgcmF3IHBheWxvYWQg YmVmb3JlIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUNCj4gICAgICAgIGNvbW11bmljYXRpb24gc2Vj dXJpdHkgcHJvdG9jb2wgTVVTVCBiZSBlbmNvZGVkIGFzIGEgQ0JPUiBtYXAuDQo+IA0KPiAgICAg byAgQSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAwIChCYWQg UmVxdWVzdCkNCj4gICAgICAgIE1VU1QgYmUgdXNlZCBmb3IgYWxsIGVycm9yIHJlc3BvbnNlcywg ZXhjZXB0IGZvciBpbnZhbGlkX2NsaWVudA0KPiAgICAgICAgd2hlcmUgYSByZXNwb25zZSBjb2Rl IGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAxDQo+ICAgICAgICAoVW5hdXRob3JpemVk KSBNQVkgYmUgdXNlZCB1bmRlciB0aGUgc2FtZSBjb25kaXRpb25zIGFzIHNwZWNpZmllZA0KPiAg ICAgICAgaW5TZWN0aW9uwqA1LjIgb2YgW1JGQzY3NDldICA8aHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjI+Lg0KPiANCj4gICAgIG8gIFRoZSBDb250ZW50LUZv cm1hdCAoZm9yIENvQVAtYmFzZWQgaW50ZXJhY3Rpb25zKSBvciBtZWRpYSB0eXBlDQo+ICAgICAg ICAoZm9yIEhUVFAtYmFzZWQgaW50ZXJhY3Rpb25zKSAiYXBwbGljYXRpb24vYWNlK2Nib3IiIE1V U1QgYmUgdXNlZA0KPiAgICAgICAgZm9yIHRoZSBlcnJvciByZXNwb25zZS4NCj4gDQo+ICAgICBv ICBUaGUgcGFyYW1ldGVycyAiZXJyb3IiLCAiZXJyb3JfZGVzY3JpcHRpb24iIGFuZCAiZXJyb3Jf dXJpIiBNVVNUDQo+ICAgICAgICBiZSBhYmJyZXZpYXRlZCB1c2luZyB0aGUgY29kZXMgc3BlY2lm aWVkIGluIEZpZ3VyZSAxMiwgd2hlbiBhIENCT1INCj4gICAgICAgIGVuY29kaW5nIGlzIHVzZWQu DQo+IA0KPiAgICAgbyAgVGhlIGVycm9yIGNvZGUgKGkuZS4sIHZhbHVlIG9mIHRoZSAiZXJyb3Ii IHBhcmFtZXRlcikgTVVTVCBiZQ0KPiAgICAgICAgYWJicmV2aWF0ZWQgYXMgc3BlY2lmaWVkIGlu IEZpZ3VyZSAxMCwgd2hlbiBhIENCT1IgZW5jb2RpbmcgaXMNCj4gICAgICAgIHVzZWQuDQo+IC8t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLVwNCj4gDQo+ICAgICAgICAgICAg IHwgTmFtZSAgICAgICAgICAgICAgICAgICB8IENCT1IgVmFsdWVzIHwNCj4gICAgICAgICAgICAg fC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tfA0KPiAgICAgICAgICAgICB8 IGludmFsaWRfcmVxdWVzdCAgICAgICAgfCAgICAgIDEgICAgICB8DQo+ICAgICAgICAgICAgIHwg aW52YWxpZF9jbGllbnQgICAgICAgICB8ICAgICAgMiAgICAgIHwNCj4gICAgICAgICAgICAgfCBp bnZhbGlkX2dyYW50ICAgICAgICAgIHwgICAgICAzICAgICAgfA0KPiAgICAgICAgICAgICB8IHVu YXV0aG9yaXplZF9jbGllbnQgICAgfCAgICAgIDQgICAgICB8DQo+ICAgICAgICAgICAgIHwgdW5z dXBwb3J0ZWRfZ3JhbnRfdHlwZSB8ICAgICAgNSAgICAgIHwNCj4gICAgICAgICAgICAgfCBpbnZh bGlkX3Njb3BlICAgICAgICAgIHwgICAgICA2ICAgICAgfA0KPiAgICAgICAgICAgICB8IHVuc3Vw cG9ydGVkX3BvcF9rZXkgICAgfCAgICAgIDcgICAgICB8DQo+ICAgICAgICAgICAgIHwgaW5jb21w YXRpYmxlX3Byb2ZpbGVzICB8ICAgICAgOCAgICAgIHwNCj4gICAgICAgICAgICAgXC0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLw0KPiANCj4gICAgICAgICAgICAgRmlndXJl IDEwOiBDQk9SIGFiYnJldmlhdGlvbnMgZm9yIGNvbW1vbiBlcnJvciBjb2Rlcw0KPiANCj4gICAg IEluIGFkZGl0aW9uIHRvIHRoZSBlcnJvciByZXNwb25zZXMgZGVmaW5lZCBpbiBPQXV0aCAyLjAs IHRoZQ0KPiAgICAgZm9sbG93aW5nIGJlaGF2aW9yIE1VU1QgYmUgaW1wbGVtZW50ZWQgYnkgdGhl IEFTOg0KPiANCj4gICAgIG8gIElmIHRoZSBjbGllbnQgc3VibWl0cyBhbiBhc3ltbWV0cmljIGtl eSBpbiB0aGUgdG9rZW4gcmVxdWVzdCB0aGF0DQo+ICAgICAgICB0aGUgUlMgY2Fubm90IHByb2Nl c3MsIHRoZSBBUyBNVVNUIHJlamVjdCB0aGF0IHJlcXVlc3Qgd2l0aCBhDQo+ICAgICAgICByZXNw b25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAwIChCYWQgUmVxdWVzdCkN Cj4gICAgICAgIGluY2x1ZGluZyB0aGUgZXJyb3IgY29kZSAidW5zdXBwb3J0ZWRfcG9wX2tleSIg ZGVmaW5lZCBpbg0KPiAgICAgICAgRmlndXJlIDEwLg0KPiANCj4gICAgIG8gIElmIHRoZSBjbGll bnQgYW5kIHRoZSBSUyBpdCBoYXMgcmVxdWVzdGVkIGFuIGFjY2VzcyB0b2tlbiBmb3IgZG8NCj4g ICAgICAgIG5vdCBzaGFyZSBhIGNvbW1vbiBwcm9maWxlLCB0aGUgQVMgTVVTVCByZWplY3QgdGhh dCByZXF1ZXN0IHdpdGggYQ0KPiAgICAgICAgcmVzcG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRo ZSBDb0FQIGNvZGUgNC4wMCAoQmFkIFJlcXVlc3QpDQo+ICAgICAgICBpbmNsdWRpbmcgdGhlIGVy cm9yIGNvZGUgImluY29tcGF0aWJsZV9wcm9maWxlcyIgZGVmaW5lZCBpbg0KPiAgICAgICAgRmln dXJlIDEwLg0KPiANCj4gIiIiDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KPiBBY2UgbWFpbGluZyBsaXN0DQo+IEFjZUBpZXRmLm9yZw0KPiBo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZQ0KPiANCg0KDQotLQ0KTHVk d2lnIFNlaXR6LCBQaEQNClNlY3VyaXR5IExhYiwgUklTRQ0KUGhvbmUgKzQ2KDApNzAtMzQ5IDky IDUxDQoNCg== From nobody Wed Nov 20 23:43:45 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F1491202A0 for ; Wed, 20 Nov 2019 23:43:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=curity-io.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bbacuKF4e9gS for ; Wed, 20 Nov 2019 23:43:41 -0800 (PST) Received: from mail-yb1-xb29.google.com (mail-yb1-xb29.google.com [IPv6:2607:f8b0:4864:20::b29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F507120048 for ; Wed, 20 Nov 2019 23:43:41 -0800 (PST) Received: by mail-yb1-xb29.google.com with SMTP id k206so1092321ybb.5 for ; Wed, 20 Nov 2019 23:43:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=curity-io.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=g2HRt6fy+95OLcPfcDnRBVswsBUOZTJ2wDeBUwjSZnE=; b=BQg3KRej4mjrirHgKV3eWIAvFnUgzu8FYCHbTvJ2x8GewtwLExoPAudQb74gzGZFKK 1iw73I2fLRdTGhAEoY882kKMFvLqvptALOJb8b4+v8GrCgSXExmwXU31OyLqK6EPRHht RBYuez8u2Zh+QmYmHLVlM87WEKGhbVl3HrCOq0fxK3jLKDFn39nHWZXnWl9JZ1JG7ENu cTvJL4UHb54K2qNHZKbgyohA2rnYIx+Pa+G/wwMNR13/i/cn+F+FEMvLdJBxKrCGkaVS PHmEgWWV2PpcIvMnTep4WNd7XU/F42myv+JDSLtgskoX4Uuw6xRW7WuHbhXoLZdSCJoD H7gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=g2HRt6fy+95OLcPfcDnRBVswsBUOZTJ2wDeBUwjSZnE=; b=hqaz2kEcppgH5WRTz5BfhrK/lVF8IJ2V2NKzNwmUbgSl1KDR01XqbEPIn/nHOpFjzR y1ZFnxVEtkQSP//466foagg5amJS50sfgvks9eqo4pHXVy2bdame1K8dpeCFyQMXbBDP 21kkqCxnR1kTFF9msmMqyfghlcuMbLs+SXDyBbKu1ABD7SFuu4hX0IDtO4kDUFe93Fl7 2SXpdYjkJ0Pr7+SBRFTE+RJQQA4JBeaqAdf00aBG7xvnucyek9XCm22ZSjFW3AWsY2mp dmdPHFIo0UFuJELcimPenCQg6oHBaPy/pI5rnZ3UsVfOHClw6dfws8r+MudowdFiTfPH xrxg== X-Gm-Message-State: APjAAAWKqLFNj82kmoQ1aSUhiGNTIRq0Qthr8P9rXDzsCVAf72fL9iFO klhrbZdj7u6hVm8fvzFlGs1d2qdjGR9O5MrIr/qqH1rKqJ9zcA== X-Google-Smtp-Source: APXvYqy88z1WIwfDLwJM62or3Lb0GQThF3D7vJLvqPOM00ywN1xSxdTvl6klzCTUjA1iuVZCXG3VO5vtdj1DZXNlUBw= X-Received: by 2002:a25:d00f:: with SMTP id h15mr5373432ybg.70.1574322220240; Wed, 20 Nov 2019 23:43:40 -0800 (PST) MIME-Version: 1.0 From: Travis Spencer Date: Thu, 21 Nov 2019 08:43:29 +0100 Message-ID: To: ace@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [Ace] Review of draft-tiloca-ace-revoked-token-notification-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 07:43:44 -0000 Hi All, I wanted to submit a review of "Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework" (draft-tiloca-ace-revoked-token-notification-00). I am an ACE noob, but hopefully my feedback will be constructive and helpful. If they are not, it could be because of my ignorance of ACE. That said, I am an expert in OAuth, so that is my frame of reference. * The draft mixes casing and has inconsistent use of acronyms like RS, resource server, authorization server, AS, etc. This hangs me up as a reader. I'd appreciate if one was used for all or if none were used. * I recommend an ASCII art be added to the protocol overview. I know that there are some good diagrams in the examples, but an overview figure in that section would be helpful as a reader as comes to terms with what the doc specifies and decide if it's relevant. It would also be helpful if this section ended with a link/reference to the example sections below (e.g., something like =E2=80=9Csee examples in section X for more detailed flows=E2=80=9D). * In my strong opinion, It should not be assumed that the TRL endpoint is at the root of the URL path of the AS. https://example.com/tenant1/trl should be valid; also, https://example.com/my-good-trl should be a valid URI. This should be included in the OAuth metadata (if the AS supports this) or communicated to the client/RS by some undefined method (e.g., documentation). The spec may recommend some URI and the non-normative examples can use whatever URI, but these must not be MTI. * The doc should not make any distinction between an OAuth client and resource server. This makes it very confusing IMHO. Instead, it should consider the caller/client of the TRL endpoint, regardless of what role that caller plays in an OAuth flow. This is similar to how introspection and other OAuth-related APIs are defined. * The TRL endpoint need not be per client/RS. The endpoint only exposes random hashes. Disclosing these to other parties will not pose a security issue (that I can think of). This will allow clients/RSes to collaborate in unforeseen ways that could be useful in certain deployments. This also means that the TRL endpoint will be global and not have a client-specific path segment in the path of the URI. * The TRL endpoint should accept some method for filter based, for example, on client ID. This could be done using a query string argument like "client_id" which can be supplied 0..INF times. This will allow a monitoring client (like a NOC) to subscribed to revocation messages for multiple clients/RSes. If the "client_id" (or whatever) parameter is supplied, the caller of the TRL endpoint should be notified of ALL revoked tokens. * If the idea above is accepted and the AS requires authentication of the TRL endpoint client, then the AS may automatically subscribe the client to notifications for just itself (which the AS knows the identity of the client due to authentication). This implicitly filtering may be beyond the scope of the doc, however, and I think that authentication in general should be dropped. If it remains though, this identification and implicit filter can be done irrespective of authentication scheme used. * I think that the token name term should be changed to token hash, so that it is more intuitively obvious what it is in case the term was skimmed over or missed. * Because the draft is only about non-revoked tokens, the RS/client still has to manage expired token checking. If the list included expired tokens as well, the RS/client could off-load all of this to the AS. This would make the development of the RS/client a lot simpler and push that complexity to the AS. This is keeping in the spirit and aim of OAuth. I've understood from Ludwig and Marco that this does introduce some issues in a CoAP environment, that I know nothing about. So, please take it as a suggestion and see what's best. * Clarify that the hashes in the CBOR array are unordered. CBOR has no set, I've been told, only arrays. Arrays are ordered though, so it should be stated that this ordering is irrelevant, and the subscriber should treat them as a set where the order has no significant meaning. HTH! -- Travis Spencer From nobody Thu Nov 21 01:27:26 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75D4B12084D for ; Thu, 21 Nov 2019 01:27:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k2hdZkeRkQ2e for ; Thu, 21 Nov 2019 01:27:23 -0800 (PST) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 394AA120041 for ; Thu, 21 Nov 2019 01:27:23 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id 14so2945377qtf.5 for ; Thu, 21 Nov 2019 01:27:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bjm17vXbfLc7zXIpMiwMNJZm5+6jxL0xCJPAgrZDZmY=; b=banqT3MeQSOJUCEqcvbW5UwRMzr+ATrDWfHVLKp+/WEciRJkW+K9RHjVtrun4fEjEW QLgbRkaqzbc0fz6xYfd1R+v77g1Wb3zTJtwXZTHEwUWBch+tsYCznGk2mtMz8WBOA/um BsJEY5QRsOoXDggNctRqSKasTRG8lr1pG1wEH3QAMJ/7tL7hhk/BuR3aKMoPQJiH+9qo D95/9kx3ZHkcMyiNd0eBHjJY2kBYSc9e5rpt8dEDJFxF2egEyhpeNMrEiCpgulnnEAWB Wszm+nqfNxPXtO2Srp5ZE2k0V2oUtpN/eFzaO08Ocyrmcp/6fB7uq6jpDw45EvOVlth0 808g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bjm17vXbfLc7zXIpMiwMNJZm5+6jxL0xCJPAgrZDZmY=; b=RMEYWFq/GH08ciOfFr96NH9LM2qTH39vPynUb7BvjRAypKFzB3xkA55SXRGrXJak0A jVQb/gZooRht126Utc+GCmvtgxUYodnrQCHDI0nDcRjejOMt70GnvH5soPyi55YDI8Wy A5fjfBxMS3lnGWgann9E4HTiH0d0V4sitvs+As4v6dHlTWmUUZpR/nefZzkiMZ/0CCV2 45EKDkM5V7JxdPk2tf5rIiWZSxmoOIi4DVVO5he1m5m1GquPqtxQvFUwUHz0Yc/VsZX7 i6hxdvdioaZ0HroFwZ7DQxDcNd8jYQT2B2xmciV67t+XEBweMRiYqgkwa6h4vLKSabnq SOUw== X-Gm-Message-State: APjAAAXZJZuIo4LmhLydSiR4epImvl5mBvds6al++gemR09HgJxRAlld hGJU27YqDnXt4dTxWKojXL0H0k/VzIB0bgXb3cE= X-Google-Smtp-Source: APXvYqy3iG1kiQOuYyQW/d28NqWtCzD61WCDvDkCm7NOPiZWm9b5gNPRDHJxfmLrbiVXyZ90AL5eGHHEL/1APIRnJcc= X-Received: by 2002:aed:33c2:: with SMTP id v60mr2487942qtd.168.1574328442232; Thu, 21 Nov 2019 01:27:22 -0800 (PST) MIME-Version: 1.0 References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> In-Reply-To: From: Cigdem Sengul Date: Thu, 21 Nov 2019 09:27:10 +0000 Message-ID: To: Daniel Migault Cc: Ludwig Seitz , "ace@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008f23f10597d7e719" Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Nov 2019 09:27:25 -0000 --0000000000008f23f10597d7e719 Content-Type: text/plain; charset="UTF-8" Hello, Ludwig, I agree that the current draft describes specifically for when CBOR is used. When CBOR is not used, I have read it as it will act similar to Section 5.2 of [RFC6749] as you have indicated also in the ace-oauth-authz document. Therefore, instead of an indirect reference to RFC6749 by referencing ace-oauth-authz, we used a direct reference to explain what the error response should be. Is this problematic? or confusing? I can reword in mqtt_tls draft something like: "As described in [ace-oauth-authz] the error responses for JSON-based interactions with AS follow RFC6749. When CBOR is used, the interactions MUST implement [ace-oauth-authz]" Would that help? Thanks, --Cigdem On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault wrote: > Hi Ludwig, > > Thanks for the feed back. I was raising the issue before it got forgotten. > , and I must say I did not checked whether it had been addressed or not, as > I did not remember this had been raised for the ace-oauth-authz document. > > What you are saying is that the draft has been updated already. I will > have a closer look at it, and ask mqtt-profile to confirm the current text > is fine. > > Thanks! > Daniel > > -----Original Message----- > From: Ace On Behalf Of Ludwig Seitz > Sent: Thursday, November 21, 2019 10:51 AM > To: ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > On 21/11/2019 03:29, Daniel Migault wrote: > > Hi, > > > > This only concerns potential clarification of the text. > > > > While reviewing mqtt-profile draft I raised an issue regarding the > > reference for Oauth [RFC6749] while the remaining of the document > > references draft-ietf-ace-oauth-authz [1]. My reading of > > draft-ietf-ace-oauth-authz section 5.6.3 > > ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. > > was the same of the one of mqtt-profile coauthors, that is error > > mandates the use of CBOR. Discussing this with others it seems a mis > > interpretation of draft-ietf-ace-oauth-authz section 5.6.3 > > > [2]. > > > > I believe that is nice this is a mis-interpretation, but I would > > recommend that the text makes it more explicit the use of JSON is > > permitted. This seems to me a request to clarify the text. > > > > Yours, > > Daniel > > > > I would be happy to add more clarification, but I'm currently at a loss of > what that would be. Most of the bullets you cited already modify the MUSTs > with "...when CBOR is used" or something similar to the same effect. The > idea was to express: You can use the vanilla OAuth interactions based on > JSON, but if you use CBOR then do it as specified here. > > I am happy to take suggestions. > > /Ludwig > > > [1] > > """ > > > > In the case of an error, the AS returns error responses for HTTP- > > based interactions as ASCII codes in JSON content, as defined in > > Section 5.2 of RFC 6749 < > https://tools.ietf.org/html/rfc6749#section-5.2> [RFC6749 < > https://tools.ietf.org/html/rfc6749>]. > > > > """ > > > > [2] > > """ > > > > > > 5.6.3 > > < > https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. > > Error Response > > > > > > > > The error responses for CoAP-based interactions with the AS are > > generally equivalent to the ones for HTTP-based interactions as > > defined inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>, with the following > exceptions: > > > > o When using CBOR the raw payload before being processed by the > > communication security protocol MUST be encoded as a CBOR map. > > > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > > MUST be used for all error responses, except for invalid_client > > where a response code equivalent to the CoAP code 4.01 > > (Unauthorized) MAY be used under the same conditions as specified > > inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>. > > > > o The Content-Format (for CoAP-based interactions) or media type > > (for HTTP-based interactions) "application/ace+cbor" MUST be used > > for the error response. > > > > o The parameters "error", "error_description" and "error_uri" MUST > > be abbreviated using the codes specified in Figure 12, when a CBOR > > encoding is used. > > > > o The error code (i.e., value of the "error" parameter) MUST be > > abbreviated as specified in Figure 10, when a CBOR encoding is > > used. > > /------------------------+-------------\ > > > > | Name | CBOR Values | > > |------------------------+-------------| > > | invalid_request | 1 | > > | invalid_client | 2 | > > | invalid_grant | 3 | > > | unauthorized_client | 4 | > > | unsupported_grant_type | 5 | > > | invalid_scope | 6 | > > | unsupported_pop_key | 7 | > > | incompatible_profiles | 8 | > > \------------------------+-------------/ > > > > Figure 10: CBOR abbreviations for common error codes > > > > In addition to the error responses defined in OAuth 2.0, the > > following behavior MUST be implemented by the AS: > > > > o If the client submits an asymmetric key in the token request that > > the RS cannot process, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "unsupported_pop_key" defined in > > Figure 10. > > > > o If the client and the RS it has requested an access token for do > > not share a common profile, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "incompatible_profiles" defined in > > Figure 10. > > > > """ > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > -- > Ludwig Seitz, PhD > Security Lab, RISE > Phone +46(0)70-349 92 51 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --0000000000008f23f10597d7e719 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

Ludwig, I agree that the current= draft describes specifically for when CBOR is used.=C2=A0
When C= BOR is not used, I have read it as it will act similar to=C2=A0Section=C2=A05.2 of [RFC6749]= =C2=A0as you have indicated also in the ace-oauth-authz document.

Therefore, instead of an indirect reference to RFC6749 by r= eferencing ace-oauth-authz, we used a direct reference to explain what the = error response should be.=C2=A0

Is this problemati= c? or confusing?

I can reword in mqtt_tls draft so= mething like:
"As described in [ace-oauth-authz] the error r= esponses for JSON-based interactions with AS follow=C2=A0RFC6749. When CBOR= is used, the interactions MUST implement [ace-oauth-authz]"

Would that help?

Thanks,
--Cigdem=C2=A0



On Thu, Nov 21, 2019 at = 3:06 AM Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.org> wrote:
Hi Ludwig,

Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document. =

What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine.

Thanks!
Daniel

-----Original Message-----
From: Ace <ace= -bounces@ietf.org> On Behalf Of Ludwig Seitz
Sent: Thursday, November 21, 2019 10:51 AM
To: ace@ietf.org
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

On 21/11/2019 03:29, Daniel Migault wrote:
> Hi,
>
> This only concerns potential clarification of the text.
>
> While reviewing mqtt-profile draft I raised an issue regarding the > reference for Oauth [RFC6749] while the remaining of the document
> references draft-ietf-ace-oauth-authz [1]. My reading of
> draft-ietf-ace-oauth-authz section 5.6.3
> <ht= tps://tools..ietf.org/html/draft= -ietf-ace-oauth-authz-26#section-5.6.3>.
> was the same of the one of mqtt-profile coauthors, that is error
> mandates the use of CBOR. Discussing this with others it seems a mis <= br> > interpretation of=C2=A0 draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools.ietf.o= rg/html/draft-ietf-ace-oauth-authz-26#section-5.6.3> [2].
>
> I believe that is nice this is a mis-interpretation, but I would
> recommend that the text makes it more explicit the use of JSON is
> permitted. This seems to me a request to clarify the text.
>
> Yours,
> Daniel
>

I would be happy to add more clarification, but I'm currently at a loss= of what that would be. Most of the bullets you cited already modify the MU= STs with "...when CBOR is used" or something similar to the same = effect. The idea was to express: You can use the vanilla OAuth interactions= based on JSON, but if you use CBOR then do it as specified here.

I am happy to take suggestions.

/Ludwig

> [1]
> """
>
>=C2=A0 =C2=A0 =C2=A0In the case of an error, the AS returns error respo= nses for HTTP-
>=C2=A0 =C2=A0 =C2=A0based interactions as ASCII codes in JSON content, = as defined in
>=C2=A0 =C2=A0 =C2=A0Section=C2=A05.2 of RFC 6749=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>=C2=A0 [= RFC6749=C2=A0 <https://tools.ietf.org/html/rfc6749>]. >
> """
>
> [2]
> """
>
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A05.6.3
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#sect= ion-5.6.3>.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Error Response
>
>
>
>=C2=A0 =C2=A0 =C2=A0The error responses for CoAP-based interactions wit= h the AS are
>=C2=A0 =C2=A0 =C2=A0generally equivalent to the ones for HTTP-based int= eractions as
>=C2=A0 =C2=A0 =C2=A0defined inSection=C2=A05.2 of [RFC6749]=C2=A0 <<= a href=3D"https://tools.ietf.org/html/rfc6749#section-5.2" rel=3D"noreferre= r" target=3D"_blank">https://tools.ietf.org/html/rfc6749#section-5.2>= ;, with the following exceptions:
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 When using CBOR the raw payload before bein= g processed by the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 communication security protocol MUST be enc= oded as a CBOR map.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 A response code equivalent to the CoAP code= 4.00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 MUST be used for all error responses, excep= t for invalid_client
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 where a response code equivalent to the CoA= P code 4.01
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (Unauthorized) MAY be used under the same c= onditions as specified
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 inSection=C2=A05.2 of [RFC6749]=C2=A0 <<= a href=3D"https://tools.ietf.org/html/rfc6749#section-5.2" rel=3D"noreferre= r" target=3D"_blank">https://tools.ietf.org/html/rfc6749#section-5.2>= ;.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The Content-Format (for CoAP-based interact= ions) or media type
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (for HTTP-based interactions) "applica= tion/ace+cbor" MUST be used
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 for the error response.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The parameters "error", "err= or_description" and "error_uri" MUST
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 be abbreviated using the codes specified in= Figure 12, when a CBOR
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 encoding is used.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The error code (i.e., value of the "er= ror" parameter) MUST be
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 abbreviated as specified in Figure 10, when= a CBOR encoding is
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 used.
> /------------------------+-------------\
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Name=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| CBOR Values |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|----------------------= --+-------------|
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_request=C2=A0= =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 1=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_client=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 2=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_grant=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 3=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unauthorized_client= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 4=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_grant_typ= e |=C2=A0 =C2=A0 =C2=A0 5=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_scope=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 6=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_pop_key= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 7=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| incompatible_profiles= =C2=A0 |=C2=A0 =C2=A0 =C2=A0 8=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0\----------------------= --+-------------/
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Figure 10: CBOR abbrevi= ations for common error codes
>
>=C2=A0 =C2=A0 =C2=A0In addition to the error responses defined in OAuth= 2.0, the
>=C2=A0 =C2=A0 =C2=A0following behavior MUST be implemented by the AS: >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client submits an asymmetric key in = the token request that
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the RS cannot process, the AS MUST reject t= hat request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "unsupported_= pop_key" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client and the RS it has requested a= n access token for do
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 not share a common profile, the AS MUST rej= ect that request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "incompatible= _profiles" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
> """
>
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace
>


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--0000000000008f23f10597d7e719-- From nobody Thu Nov 21 18:36:21 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A7BB12084A for ; Thu, 21 Nov 2019 18:36:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xz0z5Qf0u6Lp for ; Thu, 21 Nov 2019 18:36:17 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30058.outbound.protection.outlook.com [40.107.3.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C6FF1201E4 for ; Thu, 21 Nov 2019 18:36:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RMiTnVEQwiPs/S5ZnpWYnzlxmUBQVGfIAJ6xZqzihGGHjFc52BhVZrd5SD8uvllLT5SBJe/rum0z0CutWhuFi5z1KaeyGJQxgi+DYS/Oy1Sdyr1VdhRzJk+QclZN/J8q1DrdL1caZzMoD8UwPmoO7F/NeMeKZtmB5FnI4UHn0iSZUqky3IjYnWnL3X7LqFfOmxqM+Hc9Jr1ZsvuS/9bF2gtfg+3HTo0E/FxRDz5Ub0bGsO/XifZ4WhDy+jM3TGJ5ekjLGg1Tt6o6OwPsfn2xzNxCP81y0ODC9YKNE2nmbnfCenGsf0+Zr1DfhoJpIfachP7QAubMRdjXpNCGJ8Y1Qg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/uPqWqhqiyuUYFCrNHMbVxE6XuTu83q2UE6RFDkqNT4=; b=Elk5aFgiHvQeW6f82o1ro7mtKR/KAbhpK4eeHP6XrmsucOsbYUH3IsbNm9u3B9/TwY5PslkC2xwm9pLEcKb041ZKzwZXSQegJI9y7z5a1dc1+6Kgd3dj0z/kWlNQFghbEZ0CVhbl+3bdz0ze9dTy86THTLjBbkUsVgEaymIA1sZB49fGoBcFn0i2VZnJc0HgnJFJu66Rg9WZuwHVh8wnjiH/FwgOlleBU/wmjW0kWVtcG+cbap7xdJ4Zr/qhBI/rT/JHPnbCgxRgxRZLAKKTnNfvQ5OkslIjV+vMGrYCs0fIAsb4QRvP8O8n0+pNKVL/sSEQ1/PWztSMGPCDTqB00g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/uPqWqhqiyuUYFCrNHMbVxE6XuTu83q2UE6RFDkqNT4=; b=on+mLD16xyhj6XMqhLDhyN9wYYGQdHplgrv18Ys7xywQRuR8UKS8Eoc2lTYPLqZRzAcd+7q26usAZzrvaZ6Y3FozN2SyhsqUSaKS1n7+BOV2Nl515kyDvPL6lsOdGPR/qVCpIB6Hv/kQ/oYakWhTL6/3gLaqHpAJ5sKbYKj0EF0= Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com (10.168.98.146) by HE1PR0701MB2234.eurprd07.prod.outlook.com (10.168.36.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.13; Fri, 22 Nov 2019 02:36:14 +0000 Received: from HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::88e5:d23a:73a5:b78e]) by HE1PR0701MB2905.eurprd07.prod.outlook.com ([fe80::88e5:d23a:73a5:b78e%6]) with mapi id 15.20.2495.010; Fri, 22 Nov 2019 02:36:14 +0000 From: Mohit Sethi M To: Daniel Migault , Ace Wg Thread-Topic: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile Thread-Index: AQHVoN2b/eCjIecpKkuKif5nNZN1Sg== Date: Fri, 22 Nov 2019 02:36:14 +0000 Message-ID: <99829e7f-9baf-d708-82b0-9564b0752f65@ericsson.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 authentication-results: spf=none (sender IP is ) smtp.mailfrom=mohit.m.sethi@ericsson.com; x-originating-ip: [31.133.155.133] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c8bfc2d3-4760-405c-abbf-08d76ef4be8b x-ms-traffictypediagnostic: HE1PR0701MB2234: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4502; x-forefront-prvs: 02296943FF x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(39860400002)(366004)(376002)(396003)(346002)(189003)(199004)(236005)(26005)(76176011)(186003)(102836004)(53546011)(6506007)(6306002)(6512007)(54896002)(71190400001)(71200400001)(25786009)(7736002)(8936002)(256004)(66066001)(65806001)(65956001)(31696002)(4744005)(99286004)(31686004)(86362001)(6436002)(66556008)(66446008)(64756008)(66476007)(6486002)(6116002)(3846002)(5660300002)(446003)(11346002)(2616005)(229853002)(2906002)(606006)(966005)(6246003)(478600001)(76116006)(81166006)(8676002)(14454004)(316002)(81156014)(110136005)(36756003)(58126008)(66946007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2234; H:HE1PR0701MB2905.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: DwuiqZVs054B0KEDe9eU5sP5myc0xx5eja9JbPVZZBtHYSIY35cg3RdzNwdd25CqqBD0qj6O3lVynlpJwcBagXGEcSQBuCByTOX9gwxGCBXWVkTMcuhu9cD6CW3Fucy0IO/p1tNdS/JL9/nGlza6TcbsoQKd9eOmrSnUddNNViWvc6aj8Ilo5Ch/jxc84gvyFzL383dTzxLXY8veXWTfVhvLAGfSSsx0xVMmRG58ww3gAb2sEbVNodJj4u9HZZaMtopMBc3Ak3ivkcYSn1Ilu5D18VegvdMovsK3SvVSXba9C22Tcyr+cvkvMrlXaeulfH2SC7Kcx7vCe/swgDWo5jZVMmCuG34XqY6tvVCRpNA/F76iQP/VgxMwF4Le0F7J4NUEnMOqKzt8Wpbxl7J8AtCDmdCvyzYAFuGF6LR6US7ftYNjWBuXrZ1jVtHb6gVRbW5DhYYSVMhfPdhxJ2ycREbWU0oaNgLXRcM6GGQH4T4= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_99829e7f9bafd70882b09564b0752f65ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: c8bfc2d3-4760-405c-abbf-08d76ef4be8b X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Nov 2019 02:36:14.2475 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: iSALc7X+2uvQ22S9E30VyeaBZnTkup0ymsVVoYcmvaFasQd98xjhO/PT95TxE3PMp3USbvPDFCG+X2JHmvPKwqIvNrg8V2s61zbqamELv9s= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2234 Archived-At: Subject: Re: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Nov 2019 02:36:20 -0000 --_000_99829e7f9bafd70882b09564b0752f65ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhbSBpbnRlcmVzdGVkIGluIHdvcmtpbmcgb24gdGhpcyBkcmFmdCBhbmQgSSBzdXBwb3J0IGl0 cyBhZG9wdGlvbiBhcyBhIHdvcmtpbmcgZ3JvdXAgaXRlbS4NCg0KLS1Nb2hpdA0KDQpPbiAxMS8x OS8xOSA0OjQ0IFBNLCBEYW5pZWwgTWlnYXVsdCB3cm90ZToNCkRlYXIgd29ya2luZyBncm91cCwN Cg0KQXMgbWVudGlvbmVkIGR1cmluZyB0aGUgQUNFIG1lZXRpbmcsIHRoaXMgbWFpbCBzdGFydHMg YSBjYWxsIGZvciBhZG9wdGlvbiBmb3IgZHJhZnQtcGFsb21iaW5pLWFjZS1jb2FwLXB1YnN1Yi1w cm9maWxlLiBQbGVhc2UgcHJvdmlkZSB5b3VyIGZlZWQgYmFja3MgYnkgRGVjZW1iZXIgNC4NCmh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBhbG9tYmluaS1hY2UtY29hcC1w dWJzdWItcHJvZmlsZS8NCllvdXJzLA0KRGFuaWVsDQoNCg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGlldGYu b3JnPG1haWx0bzpBY2VAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FjZQ0KDQo= --_000_99829e7f9bafd70882b09564b0752f65ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IiNGRkZG RkYiIHRleHQ9IiMwMDAwMDAiPg0KPHA+SSBhbSBpbnRlcmVzdGVkIGluIHdvcmtpbmcgb24gdGhp cyBkcmFmdCBhbmQgSSBzdXBwb3J0IGl0cyBhZG9wdGlvbiBhcyBhIHdvcmtpbmcgZ3JvdXAgaXRl bS4NCjxicj4NCjwvcD4NCjxwPi0tTW9oaXQ8YnI+DQo8L3A+DQo8ZGl2IGNsYXNzPSJtb3otY2l0 ZS1wcmVmaXgiPk9uIDExLzE5LzE5IDQ6NDQgUE0sIERhbmllbCBNaWdhdWx0IHdyb3RlOjxicj4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOkNBRFp5VGtucDlkPVVK Y1NMN2gyNFphSk9TZlpBVk1SVE81UHFnbnhBTktTdWN0QWhRZ0BtYWlsLmdtYWlsLmNvbSI+DQo8 ZGl2IGRpcj0ibHRyIj4NCjxkaXYgZGlyPSJsdHIiPg0KPGRpdiBkaXI9Imx0ciI+RGVhciB3b3Jr aW5nIGdyb3VwLCZuYnNwOzwvZGl2Pg0KPGRpdiBkaXI9Imx0ciI+PGJyPg0KPC9kaXY+DQo8ZGl2 IGRpcj0ibHRyIj5BcyBtZW50aW9uZWQgZHVyaW5nIHRoZSBBQ0UgbWVldGluZywgdGhpcyBtYWls IHN0YXJ0cyBhIGNhbGwgZm9yIGFkb3B0aW9uIGZvciBkPGZvbnQgY29sb3I9IiMwMDAwMDAiPjxz cGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+cmFmdC1wYWxvbWJpbmktYWNlLWNvYXAt cHVic3ViLXByb2ZpbGUuIFBsZWFzZSBwcm92aWRlIHlvdXIgZmVlZCBiYWNrcyBieSBEZWNlbWJl ciA0Lg0KPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXYgZGlyPSJsdHIiPjxzcGFuIHN0eWxlPSJj b2xvcjpyZ2IoMCwwLDApO3doaXRlLXNwYWNlOnByZS13cmFwIj48L3NwYW4+PC9kaXY+DQo8ZGl2 IGRpcj0ibHRyIj48Zm9udCBjb2xvcj0iIzAwMDAwMCI+PHNwYW4gc3R5bGU9IndoaXRlLXNwYWNl OnByZS13cmFwIj48YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFm dC1wYWxvbWJpbmktYWNlLWNvYXAtcHVic3ViLXByb2ZpbGUvIiBtb3otZG8tbm90LXNlbmQ9InRy dWUiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBhbG9tYmluaS1hY2Ut Y29hcC1wdWJzdWItcHJvZmlsZS88L2E+PC9zcGFuPjwvZm9udD48YnI+DQo8L2Rpdj4NCjxkaXYg ZGlyPSJsdHIiPjxmb250IGNvbG9yPSIjMDAwMDAwIj48c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlLXdyYXAiPjwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGNvbG9yPSIjMDAwMDAw Ij48c3BhbiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPllvdXJzLCA8L3NwYW4+PC9mb250 PjwvZGl2Pg0KPGRpdj48Zm9udCBjb2xvcj0iIzAwMDAwMCI+PHNwYW4gc3R5bGU9IndoaXRlLXNw YWNlOnByZS13cmFwIj5EYW5pZWw8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdiBkaXI9Imx0ciI+ PGZvbnQgY29sb3I9IiMwMDAwMDAiPjxzcGFuIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ PC9zcGFuPjwvZm9udD48L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8YnI+DQo8ZmllbGRzZXQgY2xh c3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0Pg0KPHByZSBjbGFzcz0ibW96LXF1 b3RlLXByZSIgd3JhcD0iIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZp YXRlZCIgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPg0KPGEgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9hY2UiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v YWNlPC9hPg0KPC9wcmU+DQo8L2Jsb2NrcXVvdGU+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_99829e7f9bafd70882b09564b0752f65ericssoncom_-- From nobody Fri Nov 22 06:50:19 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 246C9120874 for ; Fri, 22 Nov 2019 06:50:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F3wCfPuZm-zW for ; Fri, 22 Nov 2019 06:50:15 -0800 (PST) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D46951200DB for ; Fri, 22 Nov 2019 06:50:14 -0800 (PST) Received: by mail-qk1-x730.google.com with SMTP id m125so6467586qkd.8 for ; Fri, 22 Nov 2019 06:50:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vF1wsp1FdQm+A7o0IGugyY6vPWaKxD0ryU9QnzcmlG0=; b=RGnsgqPwBMPcjSbJZQ1eBwD/SC83zAyC9YdoF4xU96ByIZpzwzjnb4PNC3NJYaDqoH DBOSY8DWGYbTuuuTtF7QiMjwo4OKAGPnkCZ4sG1js80lCbHDpqWuKs+NLhKkrVKIovI6 /gPy/j/AF7+2cDsb5Pbt8oKimhJDyyba0pAPYeoSxBZwOXv5huihDFEs3WIQHQJ4ApPR yQit+Ywg2QppOqCJpq46gUM3SSVbxqScqe9pc1cjXE80miJpm3VoujyHIrkve2/iPRJS lihJjfXaG0v2TRh3Ot37IorXtO48v6H13jSF7qChl2dkKqvG8uTbHFfiVvQbRNZ6zYIM FVqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vF1wsp1FdQm+A7o0IGugyY6vPWaKxD0ryU9QnzcmlG0=; b=geMvameQuNHyTLMKn3d9qF2fWNbyXwBx4xoauyjMhGs6YFYqaTETfSRgnLNaNLfFn4 Ac4L/d6Wy+rCkc8yTUwnZluYTXuDWfh/YN+betvLxuB8+F9c180j9+KAbHL3J8XaqLE3 dyiuLz55WVJUybDFWTx1MTAz8ZXGJRBImje7ESZp7aZKFXsi/ZV/JZEwPhrubrXsv+cZ jWtNeZtN2iviUa9FpIDBD+ae1k0UDMeEU5D34zLDfPVV7SgUe/h+KIghQRnbQRIpZU9+ WLq+7WdE2gz5b7CwYdU+BSuanFLL1+a2clfVdfV2+GbalSw2vSTgdDCGStOjuR61jD9g /bkQ== X-Gm-Message-State: APjAAAUYQy5aGCpVNodWE+CEPV8sSfsRme9SrdBq/EncWmn8Da+XlphW lkmLidVME5bQERRF0bmnujqwg2EhklEyUiO4CqEjs1dH X-Google-Smtp-Source: APXvYqxgHnFN41thsQ4P1qJGFH5yvLth5sZjpcfkaC2X6LPSnSIT0fJGlCOACg1fpFKjPR3fSrrrl3k8PE9s3aVoLWQ= X-Received: by 2002:a37:4852:: with SMTP id v79mr13903641qka.293.1574434212965; Fri, 22 Nov 2019 06:50:12 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Cigdem Sengul Date: Fri, 22 Nov 2019 14:50:02 +0000 Message-ID: To: Daniel Migault Cc: Ace Wg Content-Type: multipart/alternative; boundary="000000000000fc739d0597f087b9" Archived-At: Subject: Re: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Nov 2019 14:50:17 -0000 --000000000000fc739d0597f087b9 Content-Type: text/plain; charset="UTF-8" Hello, I support the adoption of this document and will be interested in reviewing it. Kind regards, --Cigdem On Tue, Nov 19, 2019 at 8:45 AM Daniel Migault wrote: > Dear working group, > > As mentioned during the ACE meeting, this mail starts a call for adoption > for draft-palombini-ace-coap-pubsub-profile. Please provide your feed > backs by December 4. > > https://datatracker.ietf.org/doc/draft-palombini-ace-coap-pubsub-profile/ > > Yours, > Daniel > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000fc739d0597f087b9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,
I support the adoption of this document and wil= l be interested in reviewing it.=C2=A0

Kind=C2=A0r= egards,=C2=A0
--Cigdem=C2=A0

On Tue, Nov 19, 2019 at 8:45 AM= Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.org> wrote:
<= div dir=3D"ltr">Dear working group,=C2=A0

<= div dir=3D"ltr">As mentioned during the ACE meeting, this mail starts a cal= l for adoption for draft-palombini-ace-coap-pubsub-profile. Please provide your feed back= s by December 4.

<= span style=3D"white-space:pre-wrap">
Yours,
Daniel=

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--000000000000fc739d0597f087b9-- From nobody Fri Nov 22 22:49:26 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 602911208F4 for ; Fri, 22 Nov 2019 22:49:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.405 X-Spam-Level: X-Spam-Status: No, score=-1.405 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.244, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AysNNCGor7Yi for ; Fri, 22 Nov 2019 22:49:22 -0800 (PST) Received: from mail-ua1-f45.google.com (mail-ua1-f45.google.com [209.85.222.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A750C120840 for ; Fri, 22 Nov 2019 22:49:22 -0800 (PST) Received: by mail-ua1-f45.google.com with SMTP id w10so2865431uar.12 for ; Fri, 22 Nov 2019 22:49:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/mjYNG0c9HQhQCgZbhvspehAVkr9zf4mRdmSQSH5Xvo=; b=W7vwWj3t1OuparawoycofkY9ot9+9JyiZHbQ5k7sYStMPWiqxPGLkqfdIo53JH9TwL gvCWief7l9m+xXqgV03wh64VSVR392lWsrp95Q/dAq/FmVVEoltC0eyl0RFvwjySZNWm sYpadPkdwOLvhJ4e5IUhRtWLJC5pJmhFyuIr8VNAxCTm+F+x2BMqeQDS7odr/OHU/V8C V8GseOCvu2dgRoCrpey1SlaWwV+AGYwmOeZD+XZ8cnrz1uCzB+NneIgOO+k5gkcpsrN5 2CS643D38fZiHdiga7Ni/e67Ev91wLylOtCxYrsamkyQBzXYYtoYDnNQsqpLhgrDB6lt /oNQ== X-Gm-Message-State: APjAAAU3dxEaK9ig/oEDWxkSLHqcGSt9+KfaQ7cscYXunu7BRN+5xiwZ g1fFqs9eegDSynAUEvQI7qKchTAGxXeZtkqcTvp7AP9kSj8= X-Google-Smtp-Source: APXvYqzs+PWBtPY2LjhioAHzT+t9zwWG1SPNhVche45RM1OQKx+wmDN/avwdq0zSx1owahH1hW9KKhXGYsL1z9AacYQ= X-Received: by 2002:ab0:658b:: with SMTP id v11mr11788678uam.119.1574491761604; Fri, 22 Nov 2019 22:49:21 -0800 (PST) MIME-Version: 1.0 References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> In-Reply-To: From: Daniel Migault Date: Sat, 23 Nov 2019 14:49:10 +0800 Message-ID: To: Cigdem Sengul Cc: Daniel Migault , Ludwig Seitz , "ace@ietf.org" Content-Type: multipart/alternative; boundary="00000000000026fdcf0597fdee79" Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Nov 2019 06:49:25 -0000 --00000000000026fdcf0597fdee79 Content-Type: text/plain; charset="UTF-8" Thank you Ludwig and Cigdem, I would effectively prefer to have one reference, i.e ace-oauth-authz. I also reviewed the text from ace-oauth-authz and it seems fine. I also guess the text from Cigdem is better, however, ace-oauth-authz provides exceptions for CBOR and CoAP. OLD "As described in [ace-oauth-authz] the error responses for JSON-based interactions with AS follow RFC6749. When CBOR is used, the interactions MUST implement [ace-oauth-authz]" NEW "As described in [ace-oauth-authz] the error responses for HTTP/JSON-based interactions with AS follow RFC6749. When CBOR or CoAP is used, the interactions MUST implement [ace-oauth-authz]" Yours, Daniel On Thu, Nov 21, 2019 at 5:27 PM Cigdem Sengul wrote: > Hello, > > Ludwig, I agree that the current draft describes specifically for when > CBOR is used. > When CBOR is not used, I have read it as it will act similar to Section 5.2 > of [RFC6749] as you > have indicated also in the ace-oauth-authz document. > > Therefore, instead of an indirect reference to RFC6749 by referencing > ace-oauth-authz, we used a direct reference to explain what the error > response should be. > > Is this problematic? or confusing? > > I can reword in mqtt_tls draft something like: > "As described in [ace-oauth-authz] the error responses for JSON-based > interactions with AS follow RFC6749. When CBOR is used, the interactions > MUST implement [ace-oauth-authz]" > > Would that help? > > Thanks, > --Cigdem > > > > On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault 40ericsson.com@dmarc.ietf.org> wrote: > >> Hi Ludwig, >> >> Thanks for the feed back. I was raising the issue before it got >> forgotten. , and I must say I did not checked whether it had been addressed >> or not, as I did not remember this had been raised for the ace-oauth-authz >> document. >> >> What you are saying is that the draft has been updated already. I will >> have a closer look at it, and ask mqtt-profile to confirm the current text >> is fine. >> >> Thanks! >> Daniel >> >> -----Original Message----- >> From: Ace On Behalf Of Ludwig Seitz >> Sent: Thursday, November 21, 2019 10:51 AM >> To: ace@ietf.org >> Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 >> >> On 21/11/2019 03:29, Daniel Migault wrote: >> > Hi, >> > >> > This only concerns potential clarification of the text. >> > >> > While reviewing mqtt-profile draft I raised an issue regarding the >> > reference for Oauth [RFC6749] while the remaining of the document >> > references draft-ietf-ace-oauth-authz [1]. My reading of >> > draft-ietf-ace-oauth-authz section 5.6.3 >> > > ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. >> > was the same of the one of mqtt-profile coauthors, that is error >> > mandates the use of CBOR. Discussing this with others it seems a mis >> > interpretation of draft-ietf-ace-oauth-authz section 5.6.3 >> > < >> https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3> >> [2]. >> > >> > I believe that is nice this is a mis-interpretation, but I would >> > recommend that the text makes it more explicit the use of JSON is >> > permitted. This seems to me a request to clarify the text. >> > >> > Yours, >> > Daniel >> > >> >> I would be happy to add more clarification, but I'm currently at a loss >> of what that would be. Most of the bullets you cited already modify the >> MUSTs with "...when CBOR is used" or something similar to the same effect. >> The idea was to express: You can use the vanilla OAuth interactions based >> on JSON, but if you use CBOR then do it as specified here. >> >> I am happy to take suggestions. >> >> /Ludwig >> >> > [1] >> > """ >> > >> > In the case of an error, the AS returns error responses for HTTP- >> > based interactions as ASCII codes in JSON content, as defined in >> > Section 5.2 of RFC 6749 < >> https://tools.ietf.org/html/rfc6749#section-5.2> [RFC6749 < >> https://tools.ietf.org/html/rfc6749>]. >> > >> > """ >> > >> > [2] >> > """ >> > >> > >> > 5.6.3 >> > < >> https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. >> > Error Response >> > >> > >> > >> > The error responses for CoAP-based interactions with the AS are >> > generally equivalent to the ones for HTTP-based interactions as >> > defined inSection 5.2 of [RFC6749] < >> https://tools.ietf.org/html/rfc6749#section-5.2>, with the following >> exceptions: >> > >> > o When using CBOR the raw payload before being processed by the >> > communication security protocol MUST be encoded as a CBOR map. >> > >> > o A response code equivalent to the CoAP code 4.00 (Bad Request) >> > MUST be used for all error responses, except for invalid_client >> > where a response code equivalent to the CoAP code 4.01 >> > (Unauthorized) MAY be used under the same conditions as specified >> > inSection 5.2 of [RFC6749] < >> https://tools.ietf.org/html/rfc6749#section-5.2>. >> > >> > o The Content-Format (for CoAP-based interactions) or media type >> > (for HTTP-based interactions) "application/ace+cbor" MUST be used >> > for the error response. >> > >> > o The parameters "error", "error_description" and "error_uri" MUST >> > be abbreviated using the codes specified in Figure 12, when a >> CBOR >> > encoding is used. >> > >> > o The error code (i.e., value of the "error" parameter) MUST be >> > abbreviated as specified in Figure 10, when a CBOR encoding is >> > used. >> > /------------------------+-------------\ >> > >> > | Name | CBOR Values | >> > |------------------------+-------------| >> > | invalid_request | 1 | >> > | invalid_client | 2 | >> > | invalid_grant | 3 | >> > | unauthorized_client | 4 | >> > | unsupported_grant_type | 5 | >> > | invalid_scope | 6 | >> > | unsupported_pop_key | 7 | >> > | incompatible_profiles | 8 | >> > \------------------------+-------------/ >> > >> > Figure 10: CBOR abbreviations for common error codes >> > >> > In addition to the error responses defined in OAuth 2.0, the >> > following behavior MUST be implemented by the AS: >> > >> > o If the client submits an asymmetric key in the token request that >> > the RS cannot process, the AS MUST reject that request with a >> > response code equivalent to the CoAP code 4..00 (Bad Request) >> > including the error code "unsupported_pop_key" defined in >> > Figure 10. >> > >> > o If the client and the RS it has requested an access token for do >> > not share a common profile, the AS MUST reject that request with >> a >> > response code equivalent to the CoAP code 4..00 (Bad Request) >> > including the error code "incompatible_profiles" defined in >> > Figure 10. >> > >> > """ >> > >> > _______________________________________________ >> > Ace mailing list >> > Ace@ietf.org >> > https://www.ietf.org/mailman/listinfo/ace >> > >> >> >> -- >> Ludwig Seitz, PhD >> Security Lab, RISE >> Phone +46(0)70-349 92 51 >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >> > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --00000000000026fdcf0597fdee79 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thank you Ludwig and Cigdem,=C2=A0

= I would effectively prefer to have one reference, i.e ace-oauth-authz. I al= so reviewed the text from=C2=A0ace-oauth-authz and it seems fine. I also gu= ess the text from Cigdem is better, however, ace-oauth-authz provides excep= tions for CBOR and CoAP.=C2=A0

OLD
= "As described in [ace-oauth-authz] the error responses for JSON-based = interactions with AS follow=C2=A0RFC6749. When CBOR is used, the interactio= ns MUST implement [ace-oauth-authz]"

NEW
"As described in [ace-oauth-authz] the err= or responses for HTTP/JSON-based interactions with AS follow=C2=A0RFC6749. = When CBOR or CoAP is used, the interactions MUST implement [ace-oauth-authz= ]"

Yours,=C2=A0
Da= niel

On Thu, Nov 21, 2019 at 5:27 PM Cigdem Sengul <cigdem.sengul@gmail.com> wrote:
Hello,
Ludwig, I agree that the current draft describes specifically = for when CBOR is used.=C2=A0
When CBOR is not used, I have read i= t as it will act similar to=C2=A0Section=C2=A05.2 of [RFC6749]=C2=A0as you have indicated al= so in the ace-oauth-authz document.

Therefore, ins= tead of an indirect reference to RFC6749 by referencing ace-oauth-authz, we= used a direct reference to explain what the error response should be.=C2= =A0

Is this problematic? or confusing?
<= br>
I can reword in mqtt_tls draft something like:
&quo= t;As described in [ace-oauth-authz] the error responses for JSON-based inte= ractions with AS follow=C2=A0RFC6749. When CBOR is used, the interactions M= UST implement [ace-oauth-authz]"

Would that h= elp?

Thanks,
--Cigdem=C2=A0


On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault <d= aniel.migault=3D40ericsson.com@dmarc.ietf.org> wrote:
Hi Ludwig,

Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document. =

What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine.

Thanks!
Daniel

-----Original Message-----
From: Ace <ace= -bounces@ietf.org> On Behalf Of Ludwig Seitz
Sent: Thursday, November 21, 2019 10:51 AM
To: ace@ietf.org
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

On 21/11/2019 03:29, Daniel Migault wrote:
> Hi,
>
> This only concerns potential clarification of the text.
>
> While reviewing mqtt-profile draft I raised an issue regarding the > reference for Oauth [RFC6749] while the remaining of the document
> references draft-ietf-ace-oauth-authz [1]. My reading of
> draft-ietf-ace-oauth-authz section 5.6.3
> <ht= tps://tools..ietf.org/html/draft= -ietf-ace-oauth-authz-26#section-5.6.3>.
> was the same of the one of mqtt-profile coauthors, that is error
> mandates the use of CBOR. Discussing this with others it seems a mis <= br> > interpretation of=C2=A0 draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools.ietf.o= rg/html/draft-ietf-ace-oauth-authz-26#section-5.6.3> [2].
>
> I believe that is nice this is a mis-interpretation, but I would
> recommend that the text makes it more explicit the use of JSON is
> permitted. This seems to me a request to clarify the text.
>
> Yours,
> Daniel
>

I would be happy to add more clarification, but I'm currently at a loss= of what that would be. Most of the bullets you cited already modify the MU= STs with "...when CBOR is used" or something similar to the same = effect. The idea was to express: You can use the vanilla OAuth interactions= based on JSON, but if you use CBOR then do it as specified here.

I am happy to take suggestions.

/Ludwig

> [1]
> """
>
>=C2=A0 =C2=A0 =C2=A0In the case of an error, the AS returns error respo= nses for HTTP-
>=C2=A0 =C2=A0 =C2=A0based interactions as ASCII codes in JSON content, = as defined in
>=C2=A0 =C2=A0 =C2=A0Section=C2=A05.2 of RFC 6749=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>=C2=A0 [= RFC6749=C2=A0 <https://tools.ietf.org/html/rfc6749>]. >
> """
>
> [2]
> """
>
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A05.6.3
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#sect= ion-5.6.3>.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Error Response
>
>
>
>=C2=A0 =C2=A0 =C2=A0The error responses for CoAP-based interactions wit= h the AS are
>=C2=A0 =C2=A0 =C2=A0generally equivalent to the ones for HTTP-based int= eractions as
>=C2=A0 =C2=A0 =C2=A0defined inSection=C2=A05.2 of [RFC6749]=C2=A0 <<= a href=3D"https://tools.ietf.org/html/rfc6749#section-5.2" rel=3D"noreferre= r" target=3D"_blank">https://tools.ietf.org/html/rfc6749#section-5.2>= ;, with the following exceptions:
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 When using CBOR the raw payload before bein= g processed by the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 communication security protocol MUST be enc= oded as a CBOR map.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 A response code equivalent to the CoAP code= 4.00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 MUST be used for all error responses, excep= t for invalid_client
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 where a response code equivalent to the CoA= P code 4.01
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (Unauthorized) MAY be used under the same c= onditions as specified
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 inSection=C2=A05.2 of [RFC6749]=C2=A0 <<= a href=3D"https://tools.ietf.org/html/rfc6749#section-5.2" rel=3D"noreferre= r" target=3D"_blank">https://tools.ietf.org/html/rfc6749#section-5.2>= ;.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The Content-Format (for CoAP-based interact= ions) or media type
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (for HTTP-based interactions) "applica= tion/ace+cbor" MUST be used
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 for the error response.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The parameters "error", "err= or_description" and "error_uri" MUST
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 be abbreviated using the codes specified in= Figure 12, when a CBOR
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 encoding is used.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The error code (i.e., value of the "er= ror" parameter) MUST be
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 abbreviated as specified in Figure 10, when= a CBOR encoding is
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 used.
> /------------------------+-------------\
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Name=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| CBOR Values |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|----------------------= --+-------------|
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_request=C2=A0= =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 1=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_client=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 2=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_grant=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 3=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unauthorized_client= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 4=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_grant_typ= e |=C2=A0 =C2=A0 =C2=A0 5=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_scope=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 6=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_pop_key= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 7=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| incompatible_profiles= =C2=A0 |=C2=A0 =C2=A0 =C2=A0 8=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0\----------------------= --+-------------/
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Figure 10: CBOR abbrevi= ations for common error codes
>
>=C2=A0 =C2=A0 =C2=A0In addition to the error responses defined in OAuth= 2.0, the
>=C2=A0 =C2=A0 =C2=A0following behavior MUST be implemented by the AS: >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client submits an asymmetric key in = the token request that
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the RS cannot process, the AS MUST reject t= hat request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= ..00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "unsupported_= pop_key" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client and the RS it has requested a= n access token for do
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 not share a common profile, the AS MUST rej= ect that request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= ..00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "incompatible= _profiles" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
> """
>
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace
>


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--00000000000026fdcf0597fdee79-- From nobody Sun Nov 24 20:23:59 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A614120236 for ; Sun, 24 Nov 2019 20:23:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ExVEdWKaTRLC for ; Sun, 24 Nov 2019 20:23:54 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D29A120043 for ; Sun, 24 Nov 2019 20:23:53 -0800 (PST) Received: from Jude (50.76.105.153) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 24 Nov 2019 20:23:46 -0800 From: Jim Schaad To: 'Daniel Migault' , 'Cigdem Sengul' CC: , 'Ludwig Seitz' References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> In-Reply-To: Date: Sun, 24 Nov 2019 20:23:43 -0800 Message-ID: <052801d5a348$20fb98b0$62f2ca10$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0529_01D5A305.12DD13A0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQFl92l+Bkqnojk1crPrsm7QvNWKHAOFPtOCAeMal+0B7YJOaAEm5EbHqDa7I6A= Content-Language: en-us X-Originating-IP: [50.76.105.153] Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Nov 2019 04:23:58 -0000 ------=_NextPart_000_0529_01D5A305.12DD13A0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Daniel, =20 I don=E2=80=99t understand why you want to follow a different = specification for the error interactions in this case. I don=E2=80=99t = see any reason not to following [ace-oauth-authz] but using JSON for the = errors. =20 Jim =20 =20 From: Ace On Behalf Of Daniel Migault Sent: Friday, November 22, 2019 10:49 PM To: Cigdem Sengul Cc: ace@ietf.org; Ludwig Seitz ; Daniel Migault = Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 =20 Thank you Ludwig and Cigdem,=20 =20 I would effectively prefer to have one reference, i.e ace-oauth-authz. I = also reviewed the text from ace-oauth-authz and it seems fine. I also = guess the text from Cigdem is better, however, ace-oauth-authz provides = exceptions for CBOR and CoAP.=20 =20 OLD "As described in [ace-oauth-authz] the error responses for JSON-based = interactions with AS follow RFC6749. When CBOR is used, the interactions = MUST implement [ace-oauth-authz]" =20 NEW "As described in [ace-oauth-authz] the error responses for = HTTP/JSON-based interactions with AS follow RFC6749. When CBOR or CoAP = is used, the interactions MUST implement [ace-oauth-authz]" =20 Yours,=20 Daniel =20 On Thu, Nov 21, 2019 at 5:27 PM Cigdem Sengul > wrote: Hello, =20 Ludwig, I agree that the current draft describes specifically for when = CBOR is used.=20 When CBOR is not used, I have read it as it will act similar to = Section 5.2 of = [RFC6749] as you have indicated also in the ace-oauth-authz document. =20 Therefore, instead of an indirect reference to RFC6749 by referencing = ace-oauth-authz, we used a direct reference to explain what the error = response should be.=20 =20 Is this problematic? or confusing? =20 I can reword in mqtt_tls draft something like: "As described in [ace-oauth-authz] the error responses for JSON-based = interactions with AS follow RFC6749. When CBOR is used, the interactions = MUST implement [ace-oauth-authz]" =20 Would that help? =20 Thanks, --Cigdem=20 =20 =20 =20 On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault = > wrote: Hi Ludwig,=20 Thanks for the feed back. I was raising the issue before it got = forgotten. , and I must say I did not checked whether it had been = addressed or not, as I did not remember this had been raised for the = ace-oauth-authz document.=20 What you are saying is that the draft has been updated already. I will = have a closer look at it, and ask mqtt-profile to confirm the current = text is fine.=20 Thanks! Daniel=20 -----Original Message----- From: Ace > On = Behalf Of Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM To: ace@ietf.org =20 Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 On 21/11/2019 03:29, Daniel Migault wrote: > Hi, >=20 > This only concerns potential clarification of the text. >=20 > While reviewing mqtt-profile draft I raised an issue regarding the=20 > reference for Oauth [RFC6749] while the remaining of the document=20 > references draft-ietf-ace-oauth-authz [1]. My reading of=20 > draft-ietf-ace-oauth-authz section 5.6.3=20 > = >. > was the same of the one of mqtt-profile coauthors, that is error=20 > mandates the use of CBOR. Discussing this with others it seems a mis=20 > interpretation of draft-ietf-ace-oauth-authz section 5.6.3=20 > = = [2]. >=20 > I believe that is nice this is a mis-interpretation, but I would=20 > recommend that the text makes it more explicit the use of JSON is=20 > permitted. This seems to me a request to clarify the text. >=20 > Yours, > Daniel >=20 I would be happy to add more clarification, but I'm currently at a loss = of what that would be. Most of the bullets you cited already modify the = MUSTs with "...when CBOR is used" or something similar to the same = effect. The idea was to express: You can use the vanilla OAuth = interactions based on JSON, but if you use CBOR then do it as specified = here. I am happy to take suggestions. /Ludwig > [1] > """ >=20 > In the case of an error, the AS returns error responses for HTTP- > based interactions as ASCII codes in JSON content, as defined in > Section 5.2 of RFC 6749 = [RFC6749 = ]. >=20 > """ >=20 > [2] > """ >=20 >=20 > 5.6.3 > = = . > Error Response >=20 >=20 >=20 > The error responses for CoAP-based interactions with the AS are > generally equivalent to the ones for HTTP-based interactions as > defined inSection 5.2 of [RFC6749] = , with the following = exceptions: >=20 > o When using CBOR the raw payload before being processed by the > communication security protocol MUST be encoded as a CBOR map. >=20 > o A response code equivalent to the CoAP code 4.00 (Bad Request) > MUST be used for all error responses, except for invalid_client > where a response code equivalent to the CoAP code 4.01 > (Unauthorized) MAY be used under the same conditions as = specified > inSection 5.2 of [RFC6749] = . >=20 > o The Content-Format (for CoAP-based interactions) or media type > (for HTTP-based interactions) "application/ace+cbor" MUST be = used > for the error response. >=20 > o The parameters "error", "error_description" and "error_uri" = MUST > be abbreviated using the codes specified in Figure 12, when a = CBOR > encoding is used. >=20 > o The error code (i.e., value of the "error" parameter) MUST be > abbreviated as specified in Figure 10, when a CBOR encoding is > used. > /------------------------+-------------\ >=20 > | Name | CBOR Values | > |------------------------+-------------| > | invalid_request | 1 | > | invalid_client | 2 | > | invalid_grant | 3 | > | unauthorized_client | 4 | > | unsupported_grant_type | 5 | > | invalid_scope | 6 | > | unsupported_pop_key | 7 | > | incompatible_profiles | 8 | > \------------------------+-------------/ >=20 > Figure 10: CBOR abbreviations for common error codes >=20 > In addition to the error responses defined in OAuth 2.0, the > following behavior MUST be implemented by the AS: >=20 > o If the client submits an asymmetric key in the token request = that > the RS cannot process, the AS MUST reject that request with a > response code equivalent to the CoAP code 4...00 (Bad Request) > including the error code "unsupported_pop_key" defined in > Figure 10. >=20 > o If the client and the RS it has requested an access token for = do > not share a common profile, the AS MUST reject that request = with a > response code equivalent to the CoAP code 4...00 (Bad Request) > including the error code "incompatible_profiles" defined in > Figure 10. >=20 > """ >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org =20 > https://www.ietf.org/mailman/listinfo/ace >=20 -- Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 _______________________________________________ Ace mailing list Ace@ietf.org =20 https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Ace mailing list Ace@ietf.org =20 https://www.ietf.org/mailman/listinfo/ace ------=_NextPart_000_0529_01D5A305.12DD13A0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Daniel,

 

I = don=E2=80=99t understand why you want to follow a different = specification for the error interactions in this case.=C2=A0 I = don=E2=80=99t see any reason not to following [ace-oauth-authz] but = using JSON for the errors.

 

Jim

 

 

From: = Ace <ace-bounces@ietf.org> On Behalf Of Daniel = Migault
Sent: Friday, November 22, 2019 10:49 PM
To: = Cigdem Sengul <cigdem.sengul@gmail.com>
Cc: = ace@ietf.org; Ludwig Seitz <ludwig.seitz@ri.se>; Daniel Migault = <daniel.migault=3D40ericsson.com@dmarc.ietf.org>
Subject:= Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

 

Thank you Ludwig and = Cigdem, 

 

I = would effectively prefer to have one reference, i.e ace-oauth-authz. I = also reviewed the text from ace-oauth-authz and it seems fine. I = also guess the text from Cigdem is better, however, ace-oauth-authz = provides exceptions for CBOR and CoAP. 

 

OLD

"As described in [ace-oauth-authz] the error = responses for JSON-based interactions with AS follow RFC6749. When = CBOR is used, the interactions MUST implement = [ace-oauth-authz]"

 

NEW

"As described in [ace-oauth-authz] the error = responses for HTTP/JSON-based interactions with AS follow RFC6749. = When CBOR or CoAP is used, the interactions MUST implement = [ace-oauth-authz]"

 

Yours, 

Daniel

 

On = Thu, Nov 21, 2019 at 5:27 PM Cigdem Sengul <cigdem.sengul@gmail.com> = wrote:

Hello,

 

Ludwig, I agree that the current draft describes = specifically for when CBOR is used. 

When CBOR is not used, I have read it as it will act = similar to Section 5.2 of = [RFC6749] as you have indicated also in the = ace-oauth-authz document.

 

Therefore, instead of an indirect reference to RFC6749 = by referencing ace-oauth-authz, we used a direct reference to explain = what the error response should be. 

 

Is this problematic? or = confusing?

 

I = can reword in mqtt_tls draft something like:

"As described in [ace-oauth-authz] the error = responses for JSON-based interactions with AS follow RFC6749. When = CBOR is used, the interactions MUST implement = [ace-oauth-authz]"

 

Would that help?

 

Thanks,

--Cigdem 

 

 

 

On = Thu, Nov 21, 2019 at 3:06 AM Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.org> = wrote:

Hi = Ludwig,

Thanks for the feed back. I was raising the issue before = it got forgotten. , and I must say I did not checked whether it had been = addressed or not, as I did not remember this had been raised for the = ace-oauth-authz document.

What you are saying is that the draft = has been updated already. I will have a closer look at it, and ask = mqtt-profile to confirm the current text is fine. =

Thanks!
Daniel

-----Original Message-----
From: = Ace <ace-bounces@ietf.org> On Behalf Of Ludwig = Seitz
Sent: Thursday, November 21, 2019 10:51 AM
To: ace@ietf.org
Subject: Re: [Ace] comment on = draft-ietf-ace-oauth-authz-26

On 21/11/2019 03:29, Daniel Migault = wrote:
> Hi,
>
> This only concerns potential = clarification of the text.
>
> While reviewing mqtt-profile = draft I raised an issue regarding the
> reference for Oauth = [RFC6749] while the remaining of the document
> references = draft-ietf-ace-oauth-authz [1]. My reading of
> = draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools..ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6= .3>.
> was the same of the one of mqtt-profile coauthors, = that is error
> mandates the use of CBOR. Discussing this with = others it seems a mis
> interpretation of  = draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-= 26#section-5.6.3> [2].
>
> I believe that is nice = this is a mis-interpretation, but I would
> recommend that the = text makes it more explicit the use of JSON is
> permitted. This = seems to me a request to clarify the text.
>
> = Yours,
> Daniel
>

I would be happy to add more = clarification, but I'm currently at a loss of what that would be. Most = of the bullets you cited already modify the MUSTs with "...when = CBOR is used" or something similar to the same effect. The idea was = to express: You can use the vanilla OAuth interactions based on JSON, = but if you use CBOR then do it as specified here.

I am happy to = take suggestions.

/Ludwig

> [1]
> = """
>
>     In the case of an = error, the AS returns error responses for HTTP-
>    =  based interactions as ASCII codes in JSON content, as defined = in
>     Section 5.2 of RFC 6749  <https://tools.ietf.org/html/rfc6749#section-5.2>=   [RFC6749  <https://tools.ietf.org/html/rfc6749>].
> =
> """
>
> [2]
> = """
>
>
>        =  5.6.3
>         <https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-= 26#section-5.6.3>.
>         Error = Response
>
>
>
>     The error = responses for CoAP-based interactions with the AS are
>  =    generally equivalent to the ones for HTTP-based = interactions as
>     defined inSection 5.2 of = [RFC6749]  <https://tools.ietf.org/html/rfc6749#section-5.2>= , with the following exceptions:
>
>    =  o  When using CBOR the raw payload before being processed by = the
>        communication security protocol = MUST be encoded as a CBOR map.
>
>    =  o  A response code equivalent to the CoAP code 4.00 (Bad = Request)
>        MUST be used for all error = responses, except for invalid_client
>        = where a response code equivalent to the CoAP code 4.01
>  =       (Unauthorized) MAY be used under the same = conditions as specified
>        = inSection 5.2 of [RFC6749]  <https://tools.ietf.org/html/rfc6749#section-5.2>= .
>
>     o  The Content-Format (for = CoAP-based interactions) or media type
>      =   (for HTTP-based interactions) "application/ace+cbor" = MUST be used
>        for the error = response.
>
>     o  The parameters = "error", "error_description" and = "error_uri" MUST
>        be = abbreviated using the codes specified in Figure 12, when a = CBOR
>        encoding is used.
> =
>     o  The error code (i.e., value of the = "error" parameter) MUST be
>        = abbreviated as specified in Figure 10, when a CBOR encoding = is
>        used.
> = /------------------------+-------------\
>
>    =          | Name        =            | CBOR Values |
>  =           =  |------------------------+-------------|
>    =          | invalid_request      =   |      1      |
>  =            | invalid_client    =      |      2      = |
>             | = invalid_grant          |      = 3      |
>            =  | unauthorized_client    |      4  =     |
>             | = unsupported_grant_type |      5      = |
>             | = invalid_scope          |      = 6      |
>            =  | unsupported_pop_key    |      7  =     |
>             | = incompatible_profiles  |      8      = |
>            =  \------------------------+-------------/
>
>  =            Figure 10: CBOR abbreviations = for common error codes
>
>     In addition = to the error responses defined in OAuth 2.0, the
>    =  following behavior MUST be implemented by the AS:
> =
>     o  If the client submits an asymmetric = key in the token request that
>        the RS = cannot process, the AS MUST reject that request with a
>  =       response code equivalent to the CoAP code 4...00 = (Bad Request)
>        including the error = code "unsupported_pop_key" defined in
>    =     Figure 10.
>
>     o  If = the client and the RS it has requested an access token for = do
>        not share a common profile, the AS = MUST reject that request with a
>        = response code equivalent to the CoAP code 4...00 (Bad = Request)
>        including the error code = "incompatible_profiles" defined in
>      =   Figure 10.
>
> """
>
> = _______________________________________________
> Ace mailing = list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace
> =


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone = +46(0)70-349 92 = 51

_______________________________________________
Ace mailing = list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace = mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

------=_NextPart_000_0529_01D5A305.12DD13A0-- From nobody Mon Nov 25 06:41:23 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0305F120918 for ; Mon, 25 Nov 2019 06:41:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GRaZQ5VmfvGA for ; Mon, 25 Nov 2019 06:41:15 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-eopbgr790088.outbound.protection.outlook.com [40.107.79.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A67561209C3 for ; Mon, 25 Nov 2019 06:41:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MYGixlXrFryafL3/wCzkQFNdvLPki3MRwPIhdj6jnwRkTiY1+9E1Vyg9r7k1aWE/DZjk5FM+SFUqoaG5WFSl2Eo6laCWjN4Nr9cuJQD96ZaxtFC7+6RkYXn0nQnBnJe6WOGSe2vCKUZd9HDUuWjtcnZGJCf1OVH/ayFiGsH1vZoEwou6O9R0WAxMNvLkiS9hs1xScIltuGvP+BtKRJm66hFzsuBk0i+rzcV3/ymfV/cR4e/r5kqtwLKII22CueNaU4Fbw01i7OYMfYIgfUgLQ3vn4TqTl0HNsp/6Ee19JENE9ZCHWe/jzkIcSJ/InqCYZOVMh689SKQlVzowCuN/4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XOhd4X7OPXAWmYLroi4R46ulGUC3fhqqoMLQhfkEm+8=; b=CWlLvoO4GK1f7QUYZEw+GwOvJx0qDf9Xpa0bYCzIhnoFwvhQKscws/8MrOO8LTKWpvSajQPnKRgq2lSZav8e5P7oQwfqNUCEWrTJbdco2syexSbTy/CDcpvLvD/A8tGZaC9oNm8gJuPyrfv67G8tRGfVtQgLq2W5uZB3Hhzt6x/avgDqluJKZOg4upGQJaCc3YfLQjrc4zvm5gW/tFKSs3RWGKRmMlfPDKuUnoAADDfp+PhTeTNqQwHPufYHDXlQUV/REPsKWamx/wuFNR+qOmXZzutBjCOuGpcyOnx6h9Lz5vkt1AGzeCu4fTg2LU/Nq12IMpTE17PoosZ/47zoyw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XOhd4X7OPXAWmYLroi4R46ulGUC3fhqqoMLQhfkEm+8=; b=DxZYR6oNglUE3hAxHYSeMTKq5WTIGnXNpXUt8OuahR2AxJP4iLe4BCNuF9uIa5zQMF4lwQaDPEbI9eCU6dEZYj7/jc6frn+8yJaw7WRjtZ2LHkENnFbWQfvFTencu5Wug/1EQWqKDas+J/U2OEWVp8mYsEXovr67z3/z8xrPX5c= Received: from BY5PR15MB3521.namprd15.prod.outlook.com (10.255.245.75) by BY5PR15MB3523.namprd15.prod.outlook.com (52.133.254.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.22; Mon, 25 Nov 2019 14:41:10 +0000 Received: from BY5PR15MB3521.namprd15.prod.outlook.com ([fe80::e950:7249:b996:a13a]) by BY5PR15MB3521.namprd15.prod.outlook.com ([fe80::e950:7249:b996:a13a%7]) with mapi id 15.20.2474.023; Mon, 25 Nov 2019 14:41:10 +0000 From: Daniel Migault To: Jim Schaad , 'Cigdem Sengul' CC: "ace@ietf.org" , 'Ludwig Seitz' Thread-Topic: [Ace] comment on draft-ietf-ace-oauth-authz-26 Thread-Index: AQHVoBODTRvmfj9LwkSkMn4vLe0h8aeU7P0AgAADQXCAAGtOAIAC+IQAgAL8BoCAAKrFIA== Date: Mon, 25 Nov 2019 14:41:10 +0000 Message-ID: References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> <052801d5a348$20fb98b0$62f2ca10$@augustcellars.com> In-Reply-To: <052801d5a348$20fb98b0$62f2ca10$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [192.75.88.130] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f5f97aad-97cc-46ae-8d8a-08d771b583bd x-ms-traffictypediagnostic: BY5PR15MB3523: x-ms-exchange-purlcount: 6 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0232B30BBC x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(136003)(39850400004)(346002)(366004)(51444003)(199004)(189003)(13464003)(51914003)(54906003)(55016002)(6306002)(186003)(54896002)(110136005)(236005)(14444005)(256004)(9686003)(966005)(14454004)(6436002)(8676002)(81166006)(81156014)(7736002)(25786009)(2906002)(74316002)(33656002)(5660300002)(52536014)(7696005)(6246003)(99286004)(76176011)(4326008)(478600001)(8936002)(86362001)(790700001)(9326002)(316002)(3846002)(6116002)(66946007)(66476007)(66556008)(64756008)(66446008)(76116006)(102836004)(26005)(71200400001)(44832011)(71190400001)(66066001)(53546011)(229853002)(6506007)(606006)(11346002)(446003); DIR:OUT; SFP:1101; SCL:1; SRVR:BY5PR15MB3523; H:BY5PR15MB3521.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: VACJleuHgSt/IYB6q07I3ouDVSpflIdBuNAl1dQ/qQsvJRQZIG/D1FlsOFbpuFHphi/QH78wDR0xMuzdfwx25rYesSGU5zwwCtLDJ4d68V9p24ddCoOS9+Oaql5sPhRlGttLMNJ5AGr0mhr0ja9anXA3U0KjveWudf9pcyScpkrbMKSHVAWolhtb04JF4Jv5XxxLwN1pBAvzIFBguqssp+gWuq3As3JA7AAX4P+khZN+czlA7P376YBDufhXW8WstDBs2SYEFdjVV1u/UcRycDW4VdbSNwYQlfH72HY8FFmBagiEMoxVQDZzvp73w7nzJJxnVijSmW9RQ4fnu5yYBJsK9S7jOkC4NxmjvJVMdwQPyEn78r27ljZiSTk+7Ucri9Wo+BHWpcwgXSkWN7j+uPjgzA1h2UPrQvGWaM5q0FrMD6zHSABpE5V+0ejn7KUyBtjofUldgpPwb8Q7duwtJvzCBIMhkBrgvuAwk5j4l08= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BY5PR15MB35214FD50A37B9BC19D26B70E34A0BY5PR15MB3521namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: f5f97aad-97cc-46ae-8d8a-08d771b583bd X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Nov 2019 14:41:10.7832 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QvR2bs8ANxQuknp55fqEYytQANO1fenIKtQYfdOV0e9IbDzRjdbfS+BSIm3eGQ+wjffThhVgRLtHvLHXkvP6E7jvt1DC0WkAZ7vkTF30X2M= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR15MB3523 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Nov 2019 14:41:19 -0000 --_000_BY5PR15MB35214FD50A37B9BC19D26B70E34A0BY5PR15MB3521namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmltLA0KDQpJIHRoaW5rIHRoYXQgd2FzIHRoZSBwb2ludCBJIHdhcyByYWlzaW5nIGFuZCBt eSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQgdGhlIHRleHQgd2UgZm9sbG93IGlzIFthY2Utb2F1dGgt YXV0aHpdLiBBcmUgeW91IHN1Z2dlc3RpbmcgdG8gY29tcGxldGVseSByZW1vdmUgNjc0OSBjb21w bGV0ZWx5LCBvciBpcyB0aGVyZSBhbnkgdGV4dCB5b3Ugd291bGQgcHJlZmVyID8NCg0KWW91cnMs DQpEYW5pZWwNCg0KRnJvbTogSmltIFNjaGFhZCA8aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT4NClNl bnQ6IFN1bmRheSwgTm92ZW1iZXIgMjQsIDIwMTkgMTE6MjQgUE0NClRvOiBEYW5pZWwgTWlnYXVs dCA8ZGFuaWVsLm1pZ2F1bHRAZXJpY3Nzb24uY29tPjsgJ0NpZ2RlbSBTZW5ndWwnIDxjaWdkZW0u c2VuZ3VsQGdtYWlsLmNvbT4NCkNjOiBhY2VAaWV0Zi5vcmc7ICdMdWR3aWcgU2VpdHonIDxsdWR3 aWcuc2VpdHpAcmkuc2U+DQpTdWJqZWN0OiBSRTogW0FjZV0gY29tbWVudCBvbiBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoei0yNg0KDQpEYW5pZWwsDQoNCkkgZG9u4oCZdCB1bmRlcnN0YW5kIHdo eSB5b3Ugd2FudCB0byBmb2xsb3cgYSBkaWZmZXJlbnQgc3BlY2lmaWNhdGlvbiBmb3IgdGhlIGVy cm9yIGludGVyYWN0aW9ucyBpbiB0aGlzIGNhc2UuICBJIGRvbuKAmXQgc2VlIGFueSByZWFzb24g bm90IHRvIGZvbGxvd2luZyBbYWNlLW9hdXRoLWF1dGh6XSBidXQgdXNpbmcgSlNPTiBmb3IgdGhl IGVycm9ycy4NCg0KSmltDQoNCg0KRnJvbTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZzxtYWls dG86YWNlLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgRGFuaWVsIE1pZ2F1bHQNClNl bnQ6IEZyaWRheSwgTm92ZW1iZXIgMjIsIDIwMTkgMTA6NDkgUE0NClRvOiBDaWdkZW0gU2VuZ3Vs IDxjaWdkZW0uc2VuZ3VsQGdtYWlsLmNvbTxtYWlsdG86Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb20+ Pg0KQ2M6IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPjsgTHVkd2lnIFNlaXR6IDxs dWR3aWcuc2VpdHpAcmkuc2U8bWFpbHRvOmx1ZHdpZy5zZWl0ekByaS5zZT4+OyBEYW5pZWwgTWln YXVsdCA8ZGFuaWVsLm1pZ2F1bHQ9NDBlcmljc3Nvbi5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRv OmRhbmllbC5taWdhdWx0PTQwZXJpY3Nzb24uY29tQGRtYXJjLmlldGYub3JnPj4NClN1YmplY3Q6 IFJlOiBbQWNlXSBjb21tZW50IG9uIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2DQoNClRo YW5rIHlvdSBMdWR3aWcgYW5kIENpZ2RlbSwNCg0KSSB3b3VsZCBlZmZlY3RpdmVseSBwcmVmZXIg dG8gaGF2ZSBvbmUgcmVmZXJlbmNlLCBpLmUgYWNlLW9hdXRoLWF1dGh6LiBJIGFsc28gcmV2aWV3 ZWQgdGhlIHRleHQgZnJvbSBhY2Utb2F1dGgtYXV0aHogYW5kIGl0IHNlZW1zIGZpbmUuIEkgYWxz byBndWVzcyB0aGUgdGV4dCBmcm9tIENpZ2RlbSBpcyBiZXR0ZXIsIGhvd2V2ZXIsIGFjZS1vYXV0 aC1hdXRoeiBwcm92aWRlcyBleGNlcHRpb25zIGZvciBDQk9SIGFuZCBDb0FQLg0KDQpPTEQNCiJB cyBkZXNjcmliZWQgaW4gW2FjZS1vYXV0aC1hdXRoel0gdGhlIGVycm9yIHJlc3BvbnNlcyBmb3Ig SlNPTi1iYXNlZCBpbnRlcmFjdGlvbnMgd2l0aCBBUyBmb2xsb3cgUkZDNjc0OS4gV2hlbiBDQk9S IGlzIHVzZWQsIHRoZSBpbnRlcmFjdGlvbnMgTVVTVCBpbXBsZW1lbnQgW2FjZS1vYXV0aC1hdXRo el0iDQoNCk5FVw0KIkFzIGRlc2NyaWJlZCBpbiBbYWNlLW9hdXRoLWF1dGh6XSB0aGUgZXJyb3Ig cmVzcG9uc2VzIGZvciBIVFRQL0pTT04tYmFzZWQgaW50ZXJhY3Rpb25zIHdpdGggQVMgZm9sbG93 IFJGQzY3NDkuIFdoZW4gQ0JPUiBvciBDb0FQIGlzIHVzZWQsIHRoZSBpbnRlcmFjdGlvbnMgTVVT VCBpbXBsZW1lbnQgW2FjZS1vYXV0aC1hdXRoel0iDQoNCllvdXJzLA0KRGFuaWVsDQoNCk9uIFRo dSwgTm92IDIxLCAyMDE5IGF0IDU6MjcgUE0gQ2lnZGVtIFNlbmd1bCA8Y2lnZGVtLnNlbmd1bEBn bWFpbC5jb208bWFpbHRvOmNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPj4gd3JvdGU6DQpIZWxsbywN Cg0KTHVkd2lnLCBJIGFncmVlIHRoYXQgdGhlIGN1cnJlbnQgZHJhZnQgZGVzY3JpYmVzIHNwZWNp ZmljYWxseSBmb3Igd2hlbiBDQk9SIGlzIHVzZWQuDQpXaGVuIENCT1IgaXMgbm90IHVzZWQsIEkg aGF2ZSByZWFkIGl0IGFzIGl0IHdpbGwgYWN0IHNpbWlsYXIgdG8gU2VjdGlvbiA1LjIgb2YgW1JG QzY3NDldPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4yPiBh cyB5b3UgaGF2ZSBpbmRpY2F0ZWQgYWxzbyBpbiB0aGUgYWNlLW9hdXRoLWF1dGh6IGRvY3VtZW50 Lg0KDQpUaGVyZWZvcmUsIGluc3RlYWQgb2YgYW4gaW5kaXJlY3QgcmVmZXJlbmNlIHRvIFJGQzY3 NDkgYnkgcmVmZXJlbmNpbmcgYWNlLW9hdXRoLWF1dGh6LCB3ZSB1c2VkIGEgZGlyZWN0IHJlZmVy ZW5jZSB0byBleHBsYWluIHdoYXQgdGhlIGVycm9yIHJlc3BvbnNlIHNob3VsZCBiZS4NCg0KSXMg dGhpcyBwcm9ibGVtYXRpYz8gb3IgY29uZnVzaW5nPw0KDQpJIGNhbiByZXdvcmQgaW4gbXF0dF90 bHMgZHJhZnQgc29tZXRoaW5nIGxpa2U6DQoiQXMgZGVzY3JpYmVkIGluIFthY2Utb2F1dGgtYXV0 aHpdIHRoZSBlcnJvciByZXNwb25zZXMgZm9yIEpTT04tYmFzZWQgaW50ZXJhY3Rpb25zIHdpdGgg QVMgZm9sbG93IFJGQzY3NDkuIFdoZW4gQ0JPUiBpcyB1c2VkLCB0aGUgaW50ZXJhY3Rpb25zIE1V U1QgaW1wbGVtZW50IFthY2Utb2F1dGgtYXV0aHpdIg0KDQpXb3VsZCB0aGF0IGhlbHA/DQoNClRo YW5rcywNCi0tQ2lnZGVtDQoNCg0KDQpPbiBUaHUsIE5vdiAyMSwgMjAxOSBhdCAzOjA2IEFNIERh bmllbCBNaWdhdWx0IDxkYW5pZWwubWlnYXVsdD00MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9y ZzxtYWlsdG86NDBlcmljc3Nvbi5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkhpIEx1ZHdp ZywNCg0KVGhhbmtzIGZvciB0aGUgZmVlZCBiYWNrLiBJIHdhcyByYWlzaW5nIHRoZSBpc3N1ZSBi ZWZvcmUgaXQgZ290IGZvcmdvdHRlbi4gLCBhbmQgSSBtdXN0IHNheSBJIGRpZCBub3QgY2hlY2tl ZCB3aGV0aGVyIGl0IGhhZCBiZWVuIGFkZHJlc3NlZCBvciBub3QsIGFzIEkgZGlkIG5vdCByZW1l bWJlciB0aGlzIGhhZCBiZWVuIHJhaXNlZCBmb3IgdGhlIGFjZS1vYXV0aC1hdXRoeiBkb2N1bWVu dC4NCg0KV2hhdCB5b3UgYXJlIHNheWluZyBpcyB0aGF0IHRoZSBkcmFmdCBoYXMgYmVlbiB1cGRh dGVkIGFscmVhZHkuIEkgd2lsbCBoYXZlIGEgY2xvc2VyIGxvb2sgYXQgaXQsIGFuZCBhc2sgbXF0 dC1wcm9maWxlIHRvIGNvbmZpcm0gdGhlIGN1cnJlbnQgdGV4dCBpcyBmaW5lLg0KDQpUaGFua3Mh DQpEYW5pZWwNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEFjZSA8YWNlLWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9m IEx1ZHdpZyBTZWl0eg0KU2VudDogVGh1cnNkYXksIE5vdmVtYmVyIDIxLCAyMDE5IDEwOjUxIEFN DQpUbzogYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0Fj ZV0gY29tbWVudCBvbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNg0KDQpPbiAyMS8xMS8y MDE5IDAzOjI5LCBEYW5pZWwgTWlnYXVsdCB3cm90ZToNCj4gSGksDQo+DQo+IFRoaXMgb25seSBj b25jZXJucyBwb3RlbnRpYWwgY2xhcmlmaWNhdGlvbiBvZiB0aGUgdGV4dC4NCj4NCj4gV2hpbGUg cmV2aWV3aW5nIG1xdHQtcHJvZmlsZSBkcmFmdCBJIHJhaXNlZCBhbiBpc3N1ZSByZWdhcmRpbmcg dGhlDQo+IHJlZmVyZW5jZSBmb3IgT2F1dGggW1JGQzY3NDldIHdoaWxlIHRoZSByZW1haW5pbmcg b2YgdGhlIGRvY3VtZW50DQo+IHJlZmVyZW5jZXMgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHog WzFdLiBNeSByZWFkaW5nIG9mDQo+IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IHNlY3Rpb24g NS42LjMNCj4gPGh0dHBzOi8vdG9vbHMuLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb2F1 dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuLjM8aHR0cDovL2lldGYub3JnL2h0bWwvZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMz4+Lg0KPiB3YXMgdGhlIHNhbWUgb2Yg dGhlIG9uZSBvZiBtcXR0LXByb2ZpbGUgY29hdXRob3JzLCB0aGF0IGlzIGVycm9yDQo+IG1hbmRh dGVzIHRoZSB1c2Ugb2YgQ0JPUi4gRGlzY3Vzc2luZyB0aGlzIHdpdGggb3RoZXJzIGl0IHNlZW1z IGEgbWlzDQo+IGludGVycHJldGF0aW9uIG9mICBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiBz ZWN0aW9uIDUuNi4zDQo+IDxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMz4gWzJdLg0KPg0KPiBJIGJlbGlldmUgdGhh dCBpcyBuaWNlIHRoaXMgaXMgYSBtaXMtaW50ZXJwcmV0YXRpb24sIGJ1dCBJIHdvdWxkDQo+IHJl Y29tbWVuZCB0aGF0IHRoZSB0ZXh0IG1ha2VzIGl0IG1vcmUgZXhwbGljaXQgdGhlIHVzZSBvZiBK U09OIGlzDQo+IHBlcm1pdHRlZC4gVGhpcyBzZWVtcyB0byBtZSBhIHJlcXVlc3QgdG8gY2xhcmlm eSB0aGUgdGV4dC4NCj4NCj4gWW91cnMsDQo+IERhbmllbA0KPg0KDQpJIHdvdWxkIGJlIGhhcHB5 IHRvIGFkZCBtb3JlIGNsYXJpZmljYXRpb24sIGJ1dCBJJ20gY3VycmVudGx5IGF0IGEgbG9zcyBv ZiB3aGF0IHRoYXQgd291bGQgYmUuIE1vc3Qgb2YgdGhlIGJ1bGxldHMgeW91IGNpdGVkIGFscmVh ZHkgbW9kaWZ5IHRoZSBNVVNUcyB3aXRoICIuLi53aGVuIENCT1IgaXMgdXNlZCIgb3Igc29tZXRo aW5nIHNpbWlsYXIgdG8gdGhlIHNhbWUgZWZmZWN0LiBUaGUgaWRlYSB3YXMgdG8gZXhwcmVzczog WW91IGNhbiB1c2UgdGhlIHZhbmlsbGEgT0F1dGggaW50ZXJhY3Rpb25zIGJhc2VkIG9uIEpTT04s IGJ1dCBpZiB5b3UgdXNlIENCT1IgdGhlbiBkbyBpdCBhcyBzcGVjaWZpZWQgaGVyZS4NCg0KSSBh bSBoYXBweSB0byB0YWtlIHN1Z2dlc3Rpb25zLg0KDQovTHVkd2lnDQoNCj4gWzFdDQo+ICIiIg0K Pg0KPiAgICAgSW4gdGhlIGNhc2Ugb2YgYW4gZXJyb3IsIHRoZSBBUyByZXR1cm5zIGVycm9yIHJl c3BvbnNlcyBmb3IgSFRUUC0NCj4gICAgIGJhc2VkIGludGVyYWN0aW9ucyBhcyBBU0NJSSBjb2Rl cyBpbiBKU09OIGNvbnRlbnQsIGFzIGRlZmluZWQgaW4NCj4gICAgIFNlY3Rpb24gNS4yIG9mIFJG QyA2NzQ5ICA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjI+ ICBbUkZDNjc0OSAgPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5Pl0uDQo+DQo+ ICIiIg0KPg0KPiBbMl0NCj4gIiIiDQo+DQo+DQo+ICAgICAgICAgNS42LjMNCj4gICAgICAgICA8 aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2 I3NlY3Rpb24tNS42LjM+Lg0KPiAgICAgICAgIEVycm9yIFJlc3BvbnNlDQo+DQo+DQo+DQo+ICAg ICBUaGUgZXJyb3IgcmVzcG9uc2VzIGZvciBDb0FQLWJhc2VkIGludGVyYWN0aW9ucyB3aXRoIHRo ZSBBUyBhcmUNCj4gICAgIGdlbmVyYWxseSBlcXVpdmFsZW50IHRvIHRoZSBvbmVzIGZvciBIVFRQ LWJhc2VkIGludGVyYWN0aW9ucyBhcw0KPiAgICAgZGVmaW5lZCBpblNlY3Rpb24gNS4yIG9mIFtS RkM2NzQ5XSAgPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4y Piwgd2l0aCB0aGUgZm9sbG93aW5nIGV4Y2VwdGlvbnM6DQo+DQo+ICAgICBvICBXaGVuIHVzaW5n IENCT1IgdGhlIHJhdyBwYXlsb2FkIGJlZm9yZSBiZWluZyBwcm9jZXNzZWQgYnkgdGhlDQo+ICAg ICAgICBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHByb3RvY29sIE1VU1QgYmUgZW5jb2RlZCBhcyBh IENCT1IgbWFwLg0KPg0KPiAgICAgbyAgQSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhl IENvQVAgY29kZSA0LjAwIChCYWQgUmVxdWVzdCkNCj4gICAgICAgIE1VU1QgYmUgdXNlZCBmb3Ig YWxsIGVycm9yIHJlc3BvbnNlcywgZXhjZXB0IGZvciBpbnZhbGlkX2NsaWVudA0KPiAgICAgICAg d2hlcmUgYSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAxDQo+ ICAgICAgICAoVW5hdXRob3JpemVkKSBNQVkgYmUgdXNlZCB1bmRlciB0aGUgc2FtZSBjb25kaXRp b25zIGFzIHNwZWNpZmllZA0KPiAgICAgICAgaW5TZWN0aW9uIDUuMiBvZiBbUkZDNjc0OV0gIDxo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMj4uLg0KPg0KPiAg ICAgbyAgVGhlIENvbnRlbnQtRm9ybWF0IChmb3IgQ29BUC1iYXNlZCBpbnRlcmFjdGlvbnMpIG9y IG1lZGlhIHR5cGUNCj4gICAgICAgIChmb3IgSFRUUC1iYXNlZCBpbnRlcmFjdGlvbnMpICJhcHBs aWNhdGlvbi9hY2UrY2JvciIgTVVTVCBiZSB1c2VkDQo+ICAgICAgICBmb3IgdGhlIGVycm9yIHJl c3BvbnNlLg0KPg0KPiAgICAgbyAgVGhlIHBhcmFtZXRlcnMgImVycm9yIiwgImVycm9yX2Rlc2Ny aXB0aW9uIiBhbmQgImVycm9yX3VyaSIgTVVTVA0KPiAgICAgICAgYmUgYWJicmV2aWF0ZWQgdXNp bmcgdGhlIGNvZGVzIHNwZWNpZmllZCBpbiBGaWd1cmUgMTIsIHdoZW4gYSBDQk9SDQo+ICAgICAg ICBlbmNvZGluZyBpcyB1c2VkLg0KPg0KPiAgICAgbyAgVGhlIGVycm9yIGNvZGUgKGkuZS4sIHZh bHVlIG9mIHRoZSAiZXJyb3IiIHBhcmFtZXRlcikgTVVTVCBiZQ0KPiAgICAgICAgYWJicmV2aWF0 ZWQgYXMgc3BlY2lmaWVkIGluIEZpZ3VyZSAxMCwgd2hlbiBhIENCT1IgZW5jb2RpbmcgaXMNCj4g ICAgICAgIHVzZWQuDQo+IC8tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLVwN Cj4NCj4gICAgICAgICAgICAgfCBOYW1lICAgICAgICAgICAgICAgICAgIHwgQ0JPUiBWYWx1ZXMg fA0KPiAgICAgICAgICAgICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS18 DQo+ICAgICAgICAgICAgIHwgaW52YWxpZF9yZXF1ZXN0ICAgICAgICB8ICAgICAgMSAgICAgIHwN Cj4gICAgICAgICAgICAgfCBpbnZhbGlkX2NsaWVudCAgICAgICAgIHwgICAgICAyICAgICAgfA0K PiAgICAgICAgICAgICB8IGludmFsaWRfZ3JhbnQgICAgICAgICAgfCAgICAgIDMgICAgICB8DQo+ ICAgICAgICAgICAgIHwgdW5hdXRob3JpemVkX2NsaWVudCAgICB8ICAgICAgNCAgICAgIHwNCj4g ICAgICAgICAgICAgfCB1bnN1cHBvcnRlZF9ncmFudF90eXBlIHwgICAgICA1ICAgICAgfA0KPiAg ICAgICAgICAgICB8IGludmFsaWRfc2NvcGUgICAgICAgICAgfCAgICAgIDYgICAgICB8DQo+ICAg ICAgICAgICAgIHwgdW5zdXBwb3J0ZWRfcG9wX2tleSAgICB8ICAgICAgNyAgICAgIHwNCj4gICAg ICAgICAgICAgfCBpbmNvbXBhdGlibGVfcHJvZmlsZXMgIHwgICAgICA4ICAgICAgfA0KPiAgICAg ICAgICAgICBcLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0vDQo+DQo+ICAg ICAgICAgICAgIEZpZ3VyZSAxMDogQ0JPUiBhYmJyZXZpYXRpb25zIGZvciBjb21tb24gZXJyb3Ig Y29kZXMNCj4NCj4gICAgIEluIGFkZGl0aW9uIHRvIHRoZSBlcnJvciByZXNwb25zZXMgZGVmaW5l ZCBpbiBPQXV0aCAyLjAsIHRoZQ0KPiAgICAgZm9sbG93aW5nIGJlaGF2aW9yIE1VU1QgYmUgaW1w bGVtZW50ZWQgYnkgdGhlIEFTOg0KPg0KPiAgICAgbyAgSWYgdGhlIGNsaWVudCBzdWJtaXRzIGFu IGFzeW1tZXRyaWMga2V5IGluIHRoZSB0b2tlbiByZXF1ZXN0IHRoYXQNCj4gICAgICAgIHRoZSBS UyBjYW5ub3QgcHJvY2VzcywgdGhlIEFTIE1VU1QgcmVqZWN0IHRoYXQgcmVxdWVzdCB3aXRoIGEN Cj4gICAgICAgIHJlc3BvbnNlIGNvZGUgZXF1aXZhbGVudCB0byB0aGUgQ29BUCBjb2RlIDQuLi4w MCAoQmFkIFJlcXVlc3QpDQo+ICAgICAgICBpbmNsdWRpbmcgdGhlIGVycm9yIGNvZGUgInVuc3Vw cG9ydGVkX3BvcF9rZXkiIGRlZmluZWQgaW4NCj4gICAgICAgIEZpZ3VyZSAxMC4NCj4NCj4gICAg IG8gIElmIHRoZSBjbGllbnQgYW5kIHRoZSBSUyBpdCBoYXMgcmVxdWVzdGVkIGFuIGFjY2VzcyB0 b2tlbiBmb3IgZG8NCj4gICAgICAgIG5vdCBzaGFyZSBhIGNvbW1vbiBwcm9maWxlLCB0aGUgQVMg TVVTVCByZWplY3QgdGhhdCByZXF1ZXN0IHdpdGggYQ0KPiAgICAgICAgcmVzcG9uc2UgY29kZSBl cXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4uLjAwIChCYWQgUmVxdWVzdCkNCj4gICAgICAg IGluY2x1ZGluZyB0aGUgZXJyb3IgY29kZSAiaW5jb21wYXRpYmxlX3Byb2ZpbGVzIiBkZWZpbmVk IGluDQo+ICAgICAgICBGaWd1cmUgMTAuDQo+DQo+ICIiIg0KPg0KPiBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiBBY2UgbWFpbGluZyBsaXN0DQo+IEFj ZUBpZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3JnPg0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2FjZQ0KPg0KDQoNCi0tDQpMdWR3aWcgU2VpdHosIFBoRA0KU2VjdXJp dHkgTGFiLCBSSVNFDQpQaG9uZSArNDYoMCk3MC0zNDkgOTIgNTENCg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBp ZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9hY2UNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQpBY2UgbWFpbGluZyBsaXN0DQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQo= --_000_BY5PR15MB35214FD50A37B9BC19D26B70E34A0BY5PR15MB3521namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXpl OjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAy NiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+ DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5n PSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2Vj dGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgSmltLCA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SSB0aGluayB0aGF0IHdhcyB0aGUgcG9pbnQgSSB3YXMgcmFpc2luZyBhbmQgbXkgdW5k ZXJzdGFuZGluZyBpcyB0aGF0IHRoZSB0ZXh0IHdlIGZvbGxvdyBpcyBbYWNlLW9hdXRoLWF1dGh6 XS4gQXJlIHlvdSBzdWdnZXN0aW5nIHRvIGNvbXBsZXRlbHkgcmVtb3ZlIDY3NDkgY29tcGxldGVs eSwgb3IgaXMgdGhlcmUgYW55IHRleHQgeW91IHdvdWxkIHByZWZlciA/PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPllvdXJzLCA8YnI+DQpEYW5pZWw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBKaW0gU2NoYWFkICZs dDtpZXRmQGF1Z3VzdGNlbGxhcnMuY29tJmd0OyA8YnI+DQo8Yj5TZW50OjwvYj4gU3VuZGF5LCBO b3ZlbWJlciAyNCwgMjAxOSAxMToyNCBQTTxicj4NCjxiPlRvOjwvYj4gRGFuaWVsIE1pZ2F1bHQg Jmx0O2RhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbSZndDs7ICdDaWdkZW0gU2VuZ3VsJyAmbHQ7 Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBhY2VAaWV0Zi5vcmc7 ICdMdWR3aWcgU2VpdHonICZsdDtsdWR3aWcuc2VpdHpAcmkuc2UmZ3Q7PGJyPg0KPGI+U3ViamVj dDo8L2I+IFJFOiBbQWNlXSBjb21tZW50IG9uIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5EYW5pZWwsPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkkgZG9u4oCZdCB1bmRlcnN0YW5kIHdoeSB5b3Ugd2FudCB0byBmb2xs b3cgYSBkaWZmZXJlbnQgc3BlY2lmaWNhdGlvbiBmb3IgdGhlIGVycm9yIGludGVyYWN0aW9ucyBp biB0aGlzIGNhc2UuJm5ic3A7IEkgZG9u4oCZdCBzZWUgYW55IHJlYXNvbiBub3QgdG8gZm9sbG93 aW5nIFthY2Utb2F1dGgtYXV0aHpdIGJ1dCB1c2luZyBKU09OIGZvciB0aGUgZXJyb3JzLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5KaW08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gQWNlICZsdDs8 YSBocmVmPSJtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmciPmFjZS1ib3VuY2VzQGlldGYub3Jn PC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+RGFuaWVsIE1pZ2F1bHQ8YnI+DQo8Yj5TZW50 OjwvYj4gRnJpZGF5LCBOb3ZlbWJlciAyMiwgMjAxOSAxMDo0OSBQTTxicj4NCjxiPlRvOjwvYj4g Q2lnZGVtIFNlbmd1bCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNpZ2RlbS5zZW5ndWxAZ21haWwuY29t Ij5jaWdkZW0uc2VuZ3VsQGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVm PSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+OyBMdWR3aWcgU2VpdHogJmx0 OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAcmkuc2UiPmx1ZHdpZy5zZWl0ekByaS5zZTwv YT4mZ3Q7OyBEYW5pZWwgTWlnYXVsdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRhbmllbC5taWdhdWx0 PTQwZXJpY3Nzb24uY29tQGRtYXJjLmlldGYub3JnIj5kYW5pZWwubWlnYXVsdD00MGVyaWNzc29u LmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQWNl XSBjb21tZW50IG9uIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5r IHlvdSBMdWR3aWcgYW5kIENpZ2RlbSwmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3b3VsZCBlZmZlY3RpdmVseSBwcmVmZXIgdG8g aGF2ZSBvbmUgcmVmZXJlbmNlLCBpLmUgYWNlLW9hdXRoLWF1dGh6LiBJIGFsc28gcmV2aWV3ZWQg dGhlIHRleHQgZnJvbSZuYnNwO2FjZS1vYXV0aC1hdXRoeiBhbmQgaXQgc2VlbXMgZmluZS4gSSBh bHNvIGd1ZXNzIHRoZSB0ZXh0IGZyb20gQ2lnZGVtIGlzIGJldHRlciwgaG93ZXZlciwgYWNlLW9h dXRoLWF1dGh6IHByb3ZpZGVzIGV4Y2VwdGlvbnMgZm9yIENCT1IgYW5kDQogQ29BUC4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T0xE PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+JnF1b3Q7QXMgZGVzY3JpYmVkIGluIFthY2Utb2F1dGgtYXV0aHpdIHRoZSBlcnJvciByZXNw b25zZXMgZm9yIEpTT04tYmFzZWQgaW50ZXJhY3Rpb25zIHdpdGggQVMgZm9sbG93Jm5ic3A7UkZD Njc0OS4gV2hlbiBDQk9SIGlzIHVzZWQsIHRoZSBpbnRlcmFjdGlvbnMgTVVTVCBpbXBsZW1lbnQg W2FjZS1vYXV0aC1hdXRoel0mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5ORVc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mcXVvdDtBcyBkZXNjcmliZWQgaW4g W2FjZS1vYXV0aC1hdXRoel0gdGhlIGVycm9yIHJlc3BvbnNlcyBmb3IgSFRUUC9KU09OLWJhc2Vk IGludGVyYWN0aW9ucyB3aXRoIEFTIGZvbGxvdyZuYnNwO1JGQzY3NDkuIFdoZW4gQ0JPUiBvciBD b0FQIGlzIHVzZWQsIHRoZSBpbnRlcmFjdGlvbnMgTVVTVCBpbXBsZW1lbnQgW2FjZS1vYXV0aC1h dXRoel0mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5Zb3VycywmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRhbmllbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVGh1LCBOb3YgMjEsIDIwMTkgYXQgNToyNyBQTSBDaWdk ZW0gU2VuZ3VsICZsdDs8YSBocmVmPSJtYWlsdG86Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb20iPmNp Z2RlbS5zZW5ndWxAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0ND Q0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlbGxvLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+THVkd2lnLCBJIGFncmVlIHRoYXQgdGhlIGN1cnJlbnQgZHJh ZnQgZGVzY3JpYmVzIHNwZWNpZmljYWxseSBmb3Igd2hlbiBDQk9SIGlzIHVzZWQuJm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGVuIENC T1IgaXMgbm90IHVzZWQsIEkgaGF2ZSByZWFkIGl0IGFzIGl0IHdpbGwgYWN0IHNpbWlsYXIgdG8m bmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9u LTUuMiIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5TZWN0 aW9uJm5ic3A7NS4yIG9mIFtSRkM2NzQ5XTwvc3Bhbj48L2E+Jm5ic3A7YXMgeW91IGhhdmUgaW5k aWNhdGVkIGFsc28gaW4gdGhlDQogYWNlLW9hdXRoLWF1dGh6IGRvY3VtZW50LjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVyZWZvcmUsIGlu c3RlYWQgb2YgYW4gaW5kaXJlY3QgcmVmZXJlbmNlIHRvIFJGQzY3NDkgYnkgcmVmZXJlbmNpbmcg YWNlLW9hdXRoLWF1dGh6LCB3ZSB1c2VkIGEgZGlyZWN0IHJlZmVyZW5jZSB0byBleHBsYWluIHdo YXQgdGhlIGVycm9yIHJlc3BvbnNlIHNob3VsZCBiZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXMgdGhpcyBwcm9ibGVtYXRpYz8g b3IgY29uZnVzaW5nPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIGNhbiByZXdvcmQgaW4gbXF0dF90bHMgZHJhZnQgc29tZXRoaW5nIGxpa2U6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mcXVv dDtBcyBkZXNjcmliZWQgaW4gW2FjZS1vYXV0aC1hdXRoel0gdGhlIGVycm9yIHJlc3BvbnNlcyBm b3IgSlNPTi1iYXNlZCBpbnRlcmFjdGlvbnMgd2l0aCBBUyBmb2xsb3cmbmJzcDtSRkM2NzQ5LiBX aGVuIENCT1IgaXMgdXNlZCwgdGhlIGludGVyYWN0aW9ucyBNVVNUIGltcGxlbWVudCBbYWNlLW9h dXRoLWF1dGh6XSZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Xb3VsZCB0aGF0IGhlbHA/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tQ2lnZGVtJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUaHUsIE5v diAyMSwgMjAxOSBhdCAzOjA2IEFNIERhbmllbCBNaWdhdWx0ICZsdDtkYW5pZWwubWlnYXVsdD08 YSBocmVmPSJtYWlsdG86NDBlcmljc3Nvbi5jb21AZG1hcmMuaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj40MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1s ZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEx1ZHdpZywgPGJyPg0KPGJyPg0KVGhh bmtzIGZvciB0aGUgZmVlZCBiYWNrLiBJIHdhcyByYWlzaW5nIHRoZSBpc3N1ZSBiZWZvcmUgaXQg Z290IGZvcmdvdHRlbi4gLCBhbmQgSSBtdXN0IHNheSBJIGRpZCBub3QgY2hlY2tlZCB3aGV0aGVy IGl0IGhhZCBiZWVuIGFkZHJlc3NlZCBvciBub3QsIGFzIEkgZGlkIG5vdCByZW1lbWJlciB0aGlz IGhhZCBiZWVuIHJhaXNlZCBmb3IgdGhlIGFjZS1vYXV0aC1hdXRoeiBkb2N1bWVudC4NCjxicj4N Cjxicj4NCldoYXQgeW91IGFyZSBzYXlpbmcgaXMgdGhhdCB0aGUgZHJhZnQgaGFzIGJlZW4gdXBk YXRlZCBhbHJlYWR5LiBJIHdpbGwgaGF2ZSBhIGNsb3NlciBsb29rIGF0IGl0LCBhbmQgYXNrIG1x dHQtcHJvZmlsZSB0byBjb25maXJtIHRoZSBjdXJyZW50IHRleHQgaXMgZmluZS4NCjxicj4NCjxi cj4NClRoYW5rcyE8YnI+DQpEYW5pZWwgPGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS08YnI+DQpGcm9tOiBBY2UgJmx0OzxhIGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmFjZS1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgT24gQmVo YWxmIE9mIEx1ZHdpZyBTZWl0ejxicj4NClNlbnQ6IFRodXJzZGF5LCBOb3ZlbWJlciAyMSwgMjAx OSAxMDo1MSBBTTxicj4NClRvOiA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+YWNlQGlldGYub3JnPC9hPjxicj4NClN1YmplY3Q6IFJlOiBbQWNlXSBjb21tZW50 IG9uIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2PGJyPg0KPGJyPg0KT24gMjEvMTEvMjAx OSAwMzoyOSwgRGFuaWVsIE1pZ2F1bHQgd3JvdGU6PGJyPg0KJmd0OyBIaSw8YnI+DQomZ3Q7IDxi cj4NCiZndDsgVGhpcyBvbmx5IGNvbmNlcm5zIHBvdGVudGlhbCBjbGFyaWZpY2F0aW9uIG9mIHRo ZSB0ZXh0Ljxicj4NCiZndDsgPGJyPg0KJmd0OyBXaGlsZSByZXZpZXdpbmcgbXF0dC1wcm9maWxl IGRyYWZ0IEkgcmFpc2VkIGFuIGlzc3VlIHJlZ2FyZGluZyB0aGUgPGJyPg0KJmd0OyByZWZlcmVu Y2UgZm9yIE9hdXRoIFtSRkM2NzQ5XSB3aGlsZSB0aGUgcmVtYWluaW5nIG9mIHRoZSBkb2N1bWVu dCA8YnI+DQomZ3Q7IHJlZmVyZW5jZXMgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogWzFdLiBN eSByZWFkaW5nIG9mIDxicj4NCiZndDsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogc2VjdGlv biA1LjYuMyA8YnI+DQomZ3Q7ICZsdDs8YSBocmVmPSJodHRwczovL3Rvb2xzLiIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vdG9vbHMuPC9hPi48YSBocmVmPSJodHRwOi8vaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNiNzZWN0aW9uLTUuNi4zIiB0YXJnZXQ9Il9ibGFu ayI+aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNiNzZWN0aW9uLTUu Ni4uMzwvYT4mZ3Q7Ljxicj4NCiZndDsgd2FzIHRoZSBzYW1lIG9mIHRoZSBvbmUgb2YgbXF0dC1w cm9maWxlIGNvYXV0aG9ycywgdGhhdCBpcyBlcnJvciA8YnI+DQomZ3Q7IG1hbmRhdGVzIHRoZSB1 c2Ugb2YgQ0JPUi4gRGlzY3Vzc2luZyB0aGlzIHdpdGggb3RoZXJzIGl0IHNlZW1zIGEgbWlzIDxi cj4NCiZndDsgaW50ZXJwcmV0YXRpb24gb2YmbmJzcDsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHogc2VjdGlvbiA1LjYuMyA8YnI+DQomZ3Q7ICZsdDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoei0yNiNzZWN0aW9uLTUuNi4zPC9hPiZndDsgWzJdLjxicj4NCiZndDsgPGJy Pg0KJmd0OyBJIGJlbGlldmUgdGhhdCBpcyBuaWNlIHRoaXMgaXMgYSBtaXMtaW50ZXJwcmV0YXRp b24sIGJ1dCBJIHdvdWxkIDxicj4NCiZndDsgcmVjb21tZW5kIHRoYXQgdGhlIHRleHQgbWFrZXMg aXQgbW9yZSBleHBsaWNpdCB0aGUgdXNlIG9mIEpTT04gaXMgPGJyPg0KJmd0OyBwZXJtaXR0ZWQu IFRoaXMgc2VlbXMgdG8gbWUgYSByZXF1ZXN0IHRvIGNsYXJpZnkgdGhlIHRleHQuPGJyPg0KJmd0 OyA8YnI+DQomZ3Q7IFlvdXJzLDxicj4NCiZndDsgRGFuaWVsPGJyPg0KJmd0OyA8YnI+DQo8YnI+ DQpJIHdvdWxkIGJlIGhhcHB5IHRvIGFkZCBtb3JlIGNsYXJpZmljYXRpb24sIGJ1dCBJJ20gY3Vy cmVudGx5IGF0IGEgbG9zcyBvZiB3aGF0IHRoYXQgd291bGQgYmUuIE1vc3Qgb2YgdGhlIGJ1bGxl dHMgeW91IGNpdGVkIGFscmVhZHkgbW9kaWZ5IHRoZSBNVVNUcyB3aXRoICZxdW90Oy4uLndoZW4g Q0JPUiBpcyB1c2VkJnF1b3Q7IG9yIHNvbWV0aGluZyBzaW1pbGFyIHRvIHRoZSBzYW1lIGVmZmVj dC4gVGhlIGlkZWEgd2FzIHRvIGV4cHJlc3M6IFlvdSBjYW4gdXNlIHRoZQ0KIHZhbmlsbGEgT0F1 dGggaW50ZXJhY3Rpb25zIGJhc2VkIG9uIEpTT04sIGJ1dCBpZiB5b3UgdXNlIENCT1IgdGhlbiBk byBpdCBhcyBzcGVjaWZpZWQgaGVyZS48YnI+DQo8YnI+DQpJIGFtIGhhcHB5IHRvIHRha2Ugc3Vn Z2VzdGlvbnMuPGJyPg0KPGJyPg0KL0x1ZHdpZzxicj4NCjxicj4NCiZndDsgWzFdPGJyPg0KJmd0 OyAmcXVvdDsmcXVvdDsmcXVvdDs8YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwO0luIHRoZSBjYXNlIG9mIGFuIGVycm9yLCB0aGUgQVMgcmV0dXJucyBlcnJvciByZXNwb25z ZXMgZm9yIEhUVFAtPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7YmFzZWQgaW50ZXJhY3Rp b25zIGFzIEFTQ0lJIGNvZGVzIGluIEpTT04gY29udGVudCwgYXMgZGVmaW5lZCBpbjxicj4NCiZn dDsmbmJzcDsgJm5ic3A7ICZuYnNwO1NlY3Rpb24mbmJzcDs1LjIgb2YgUkZDIDY3NDkmbmJzcDsg Jmx0OzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24t NS4yIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkj c2VjdGlvbi01LjI8L2E+Jmd0OyZuYnNwOyBbUkZDNjc0OSZuYnNwOyAmbHQ7PGEgaHJlZj0iaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OTwvYT4mZ3Q7XS48YnI+DQomZ3Q7IDxicj4NCiZn dDsgJnF1b3Q7JnF1b3Q7JnF1b3Q7PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFsyXTxicj4NCiZndDsg JnF1b3Q7JnF1b3Q7JnF1b3Q7PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7NS42LjM8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyZsdDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMyIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoei0yNiNzZWN0aW9uLTUuNi4zPC9hPiZndDsuPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDtFcnJvciBSZXNwb25zZTxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+ DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO1RoZSBlcnJvciByZXNwb25zZXMg Zm9yIENvQVAtYmFzZWQgaW50ZXJhY3Rpb25zIHdpdGggdGhlIEFTIGFyZTxicj4NCiZndDsmbmJz cDsgJm5ic3A7ICZuYnNwO2dlbmVyYWxseSBlcXVpdmFsZW50IHRvIHRoZSBvbmVzIGZvciBIVFRQ LWJhc2VkIGludGVyYWN0aW9ucyBhczxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO2RlZmlu ZWQgaW5TZWN0aW9uJm5ic3A7NS4yIG9mIFtSRkM2NzQ5XSZuYnNwOyAmbHQ7PGEgaHJlZj0iaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjIiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMjwvYT4m Z3Q7LCB3aXRoIHRoZSBmb2xsb3dpbmcgZXhjZXB0aW9uczo8YnI+DQomZ3Q7IDxicj4NCiZndDsm bmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsgV2hlbiB1c2luZyBDQk9SIHRoZSByYXcgcGF5bG9h ZCBiZWZvcmUgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZTxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgY29tbXVuaWNhdGlvbiBzZWN1cml0eSBwcm90b2NvbCBNVVNUIGJlIGVuY29k ZWQgYXMgYSBDQk9SIG1hcC48YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNw O28mbmJzcDsgQSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAw IChCYWQgUmVxdWVzdCk8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IE1VU1Qg YmUgdXNlZCBmb3IgYWxsIGVycm9yIHJlc3BvbnNlcywgZXhjZXB0IGZvciBpbnZhbGlkX2NsaWVu dDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgd2hlcmUgYSByZXNwb25zZSBj b2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAxPGJyPg0KJmd0OyZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAoVW5hdXRob3JpemVkKSBNQVkgYmUgdXNlZCB1bmRlciB0aGUgc2Ft ZSBjb25kaXRpb25zIGFzIHNwZWNpZmllZDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgaW5TZWN0aW9uJm5ic3A7NS4yIG9mIFtSRkM2NzQ5XSZuYnNwOyAmbHQ7PGEgaHJlZj0i aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjIiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMjwv YT4mZ3Q7Li48YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsg VGhlIENvbnRlbnQtRm9ybWF0IChmb3IgQ29BUC1iYXNlZCBpbnRlcmFjdGlvbnMpIG9yIG1lZGlh IHR5cGU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IChmb3IgSFRUUC1iYXNl ZCBpbnRlcmFjdGlvbnMpICZxdW90O2FwcGxpY2F0aW9uL2FjZSYjNDM7Y2JvciZxdW90OyBNVVNU IGJlIHVzZWQ8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGZvciB0aGUgZXJy b3IgcmVzcG9uc2UuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDtvJm5i c3A7IFRoZSBwYXJhbWV0ZXJzICZxdW90O2Vycm9yJnF1b3Q7LCAmcXVvdDtlcnJvcl9kZXNjcmlw dGlvbiZxdW90OyBhbmQgJnF1b3Q7ZXJyb3JfdXJpJnF1b3Q7IE1VU1Q8YnI+DQomZ3Q7Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGJlIGFiYnJldmlhdGVkIHVzaW5nIHRoZSBjb2RlcyBzcGVj aWZpZWQgaW4gRmlndXJlIDEyLCB3aGVuIGEgQ0JPUjxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgZW5jb2RpbmcgaXMgdXNlZC48YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsg Jm5ic3A7ICZuYnNwO28mbmJzcDsgVGhlIGVycm9yIGNvZGUgKGkuZS4sIHZhbHVlIG9mIHRoZSAm cXVvdDtlcnJvciZxdW90OyBwYXJhbWV0ZXIpIE1VU1QgYmU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IGFiYnJldmlhdGVkIGFzIHNwZWNpZmllZCBpbiBGaWd1cmUgMTAsIHdo ZW4gYSBDQk9SIGVuY29kaW5nIGlzPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyB1c2VkLjxicj4NCiZndDsgLy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0t LS0tLVw8YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDt8IE5hbWUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IENCT1IgVmFsdWVzIHw8YnI+DQom Z3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fC0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLSYjNDM7LS0tLS0tLS0tLS0tLXw8YnI+DQomZ3Q7Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBpbnZhbGlkX3JlcXVlc3Qm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCZuYnNwOyAmbmJzcDsgJm5ic3A7IDEmbmJzcDsg Jm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO3wgaW52YWxpZF9jbGllbnQmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7fCZuYnNwOyAmbmJzcDsgJm5ic3A7IDImbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJy Pg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wg aW52YWxpZF9ncmFudCZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCZuYnNwOyAm bmJzcDsgJm5ic3A7IDMmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgdW5hdXRob3JpemVkX2NsaWVu dCZuYnNwOyAmbmJzcDsgfCZuYnNwOyAmbmJzcDsgJm5ic3A7IDQmbmJzcDsgJm5ic3A7ICZuYnNw OyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwO3wgdW5zdXBwb3J0ZWRfZ3JhbnRfdHlwZSB8Jm5ic3A7ICZuYnNwOyAmbmJzcDsgNSZuYnNw OyAmbmJzcDsgJm5ic3A7IHw8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7fCBpbnZhbGlkX3Njb3BlJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyB8Jm5ic3A7ICZuYnNwOyAmbmJzcDsgNiZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8 YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 fCB1bnN1cHBvcnRlZF9wb3Bfa2V5Jm5ic3A7ICZuYnNwOyB8Jm5ic3A7ICZuYnNwOyAmbmJzcDsg NyZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBpbmNvbXBhdGlibGVfcHJvZmlsZXMmbmJzcDsgfCZu YnNwOyAmbmJzcDsgJm5ic3A7IDgmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1wtLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS0vPGJyPg0KJmd0OyA8YnI+DQomZ3Q7Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7RmlndXJlIDEwOiBDQk9S IGFiYnJldmlhdGlvbnMgZm9yIGNvbW1vbiBlcnJvciBjb2Rlczxicj4NCiZndDsgPGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7SW4gYWRkaXRpb24gdG8gdGhlIGVycm9yIHJlc3BvbnNlcyBk ZWZpbmVkIGluIE9BdXRoIDIuMCwgdGhlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7Zm9s bG93aW5nIGJlaGF2aW9yIE1VU1QgYmUgaW1wbGVtZW50ZWQgYnkgdGhlIEFTOjxicj4NCiZndDsg PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7byZuYnNwOyBJZiB0aGUgY2xpZW50IHN1Ym1p dHMgYW4gYXN5bW1ldHJpYyBrZXkgaW4gdGhlIHRva2VuIHJlcXVlc3QgdGhhdDxicj4NCiZndDsm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgdGhlIFJTIGNhbm5vdCBwcm9jZXNzLCB0aGUgQVMg TVVTVCByZWplY3QgdGhhdCByZXF1ZXN0IHdpdGggYTxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgcmVzcG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4u LjAwIChCYWQgUmVxdWVzdCk8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGlu Y2x1ZGluZyB0aGUgZXJyb3IgY29kZSAmcXVvdDt1bnN1cHBvcnRlZF9wb3Bfa2V5JnF1b3Q7IGRl ZmluZWQgaW48YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEZpZ3VyZSAxMC48 YnI+DQomZ3Q7IDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsgSWYgdGhlIGNs aWVudCBhbmQgdGhlIFJTIGl0IGhhcyByZXF1ZXN0ZWQgYW4gYWNjZXNzIHRva2VuIGZvciBkbzxi cj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgbm90IHNoYXJlIGEgY29tbW9uIHBy b2ZpbGUsIHRoZSBBUyBNVVNUIHJlamVjdCB0aGF0IHJlcXVlc3Qgd2l0aCBhPGJyPg0KJmd0OyZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhl IENvQVAgY29kZSA0Li4uMDAgKEJhZCBSZXF1ZXN0KTxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgaW5jbHVkaW5nIHRoZSBlcnJvciBjb2RlICZxdW90O2luY29tcGF0aWJsZV9w cm9maWxlcyZxdW90OyBkZWZpbmVkIGluPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyBGaWd1cmUgMTAuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZxdW90OyZxdW90OyZxdW90Ozxi cj4NCiZndDsgPGJyPg0KJmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzxicj4NCiZndDsgQWNlIG1haWxpbmcgbGlzdDxicj4NCiZndDsgPGEgaHJlZj0i bWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRmLm9yZzwvYT48YnI+ DQomZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9h Y2U8L2E+PGJyPg0KJmd0OyA8YnI+DQo8YnI+DQo8YnI+DQotLTxicj4NCkx1ZHdpZyBTZWl0eiwg UGhEPGJyPg0KU2VjdXJpdHkgTGFiLCBSSVNFPGJyPg0KUGhvbmUgJiM0Mzs0NigwKTcwLTM0OSA5 MiA1MTxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fPGJyPg0KQWNlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBY2VAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UiIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwv cD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpBY2UgbWFpbGluZyBs aXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFj ZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2FjZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_BY5PR15MB35214FD50A37B9BC19D26B70E34A0BY5PR15MB3521namp_-- From nobody Mon Nov 25 15:04:29 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 119331200C4 for ; Mon, 25 Nov 2019 15:04:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SndGVKGsPEVL for ; Mon, 25 Nov 2019 15:04:26 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AF6C12003E for ; Mon, 25 Nov 2019 15:04:16 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAPN4BYB006227 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 25 Nov 2019 18:04:14 -0500 Date: Mon, 25 Nov 2019 15:04:11 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: ace@ietf.org Message-ID: <20191125230411.GN32847@mit.edu> References: <157430230677.769.6413870274615783065@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Nov 2019 23:04:28 -0000 Hi Ludwig, On Thu, Nov 21, 2019 at 03:16:03AM +0100, Ludwig Seitz wrote: > Hello ACE, > > turns out -26 didn't cover one of the items in Ben's review, namely the > question of using Client introspection to determine token expiration as > a lower bound for key expiration. Since the whole issue of Client > introspection was contentious between OAuth experts, we decided to > remove the text describing that option. This still leaves us with the > two other options, so the problem is still covered. Thanks for all the updates! I'm just about ready to push the "request Last Call" button, but wanted to check one thing first: Section 5.6.3 seems to limit the error responses to 4.00 and 4.01, but Section 5.8.2 also talks about 4.03 and 4.05. I noticed because I was checking Section 5.1.1's note about "unauthorized_client" error response against the various options in 5.8.2, to see if we're internally consistent about when we say to send errors vs. AS request creation hints. My recollection is that we can have all three of a response code, error response (e.g., "unauthorized_client"), and (our custom format of) response payload present in the same response, so any potential conflict would be limited to just the response code, but please correct me if I'm wrong about that. Also, a few nits that could be treated as LC comments: There's a stray 'W' in Figure 7 In Section 6.8: s/obsole/obsolete/, and s/profile/ace_profile/ In Section 8.16 we removed the entire "Specifications are required for the standards track range of point assignment[...]" bullet point. I think that only the first two sentences of that bullet point were redundant with RFC 8126, and the last two ("Specifications are needed for the first-come, first-serve range if they are expected [...]") reflected new requirements. Thanks, Ben From nobody Wed Nov 27 00:11:28 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD561207FE for ; Wed, 27 Nov 2019 00:11:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ktvNNNOX63Dc for ; Wed, 27 Nov 2019 00:11:25 -0800 (PST) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80057.outbound.protection.outlook.com [40.107.8.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CB6C120099 for ; Wed, 27 Nov 2019 00:11:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Dgdze/OvroTUqgqc9szg5eOXzYuDsNmi1StUGl06UtxLzAdPgqJ2SpWXcnuTwfK5SZfTpr/cqGzmzCzMnAnXaa/BiHW7Z4qjO62FI0tGt3dM1q7Xs2E+mPgtGEXCFMmdOkwILAKv4SNMh6Yfh+YAmoWk9OfWGnY1V5QB0HRuEqtRes0AmPwaVxrXIr9cPJvh5qdUZZvN+gOemQgxRREgPQsA+oHfHu3VrUCLwOjtDomkJY/UHsiEFaDiyVDbRs/BAIGb2L6Noxt35WIv+Yt7SDBxcoxEDMTjjJKpbXawXLHB+VZfSvqu3/djv3IiKd0df67mF0nLAjcr37l1qz9EOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=F2ay5tdmLBmP1PkG4wyd6ATIAujiHnhf39am7QQ+qmM=; b=BJgaYK3eFvjAlVzvPee3iDMTG9ysoXh2dntJaQfpaN1ONnIcz5kLrlD75FhXm+3snLQF3NK7OZb/jFuqH+pOsN1ACVpBp/cKoB8NM+GRgVJ1q+2fvt/eCegcABQnaqg/L0Fl9DUlAsQg1Z6t4LJsShhIMp0Ncqm+2FLLjQU3fMeAGvXO48hQakvPVEdtV68cW5II/8K19LyKfjQztkq/Z1nDb5tZFwn+5Wp2COHXrV2iTvuebwElJ7HnRRNCg2/wqJ2IHPb/eUdgqca3nHAPtrCXLfsz2mE+/qslKiUTXWAzbYMXF2qo40rLve2ngL3G4XSv8zYfVTEO9wLdeYggIQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=F2ay5tdmLBmP1PkG4wyd6ATIAujiHnhf39am7QQ+qmM=; b=ey5T/bnWxkNoGuZsF9t2lETG2JJQtmgvradIWj9uORGpgyeIeixKYswN8ZezeeiHbwxraIVBL3ROdbkvUE3G6p2n52f9uWP4Rlxta3MbxT24aB5dySsapdLwQEasmHpxDrKfuWSij8PgTBrlM0XPpqO7nerUrOkTdLSnkvvIvyo= Received: from HE1PR07MB4172.eurprd07.prod.outlook.com (20.176.163.140) by HE1PR07MB3514.eurprd07.prod.outlook.com (10.170.241.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2495.8; Wed, 27 Nov 2019 08:11:22 +0000 Received: from HE1PR07MB4172.eurprd07.prod.outlook.com ([fe80::d007:2731:b669:9c13]) by HE1PR07MB4172.eurprd07.prod.outlook.com ([fe80::d007:2731:b669:9c13%3]) with mapi id 15.20.2495.014; Wed, 27 Nov 2019 08:11:22 +0000 From: =?utf-8?B?R8O2cmFuIFNlbGFuZGVy?= To: Ace Wg Thread-Topic: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile Thread-Index: AQHVnrWnb6ayWTDl/0KkmzRhowklvKeex9mA Date: Wed, 27 Nov 2019 08:11:21 +0000 Message-ID: <8C2EEF39-4C57-4BB6-8F26-9EBD392FD920@ericsson.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1e.0.191013 authentication-results: spf=none (sender IP is ) smtp.mailfrom=goran.selander@ericsson.com; x-originating-ip: [213.89.246.8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0fca420e-4f3d-4078-9fe3-08d7731163b9 x-ms-traffictypediagnostic: HE1PR07MB3514: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(376002)(396003)(136003)(39860400002)(366004)(189003)(199004)(478600001)(6916009)(4744005)(6506007)(236005)(85202003)(102836004)(76176011)(966005)(25786009)(14454004)(66066001)(14444005)(99286004)(66574012)(2616005)(11346002)(186003)(5660300002)(6306002)(3846002)(446003)(229853002)(6512007)(6486002)(2906002)(54896002)(53546011)(6116002)(6436002)(76116006)(6246003)(64756008)(26005)(85182001)(8936002)(66946007)(33656002)(66476007)(66446008)(86362001)(256004)(36756003)(8676002)(7736002)(606006)(81156014)(58126008)(66556008)(81166006)(71190400001)(71200400001)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3514; H:HE1PR07MB4172.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: +588xntcmVzZt7JnWy5yf+4QNhn0lPebF3j79vALfzA/kAnOfJqO2/MQZjH5GG5638H3RoZR5o+ZJoeVV945DVzSorrzTQAYKwwzuan1WzfFsYR32kcBXj6Z24LiHtX1KSRJo2NAIoCe0tL3dyCzV+Sdf4+b9b0f4cUOlQBqvBZPzrxzdja2X99YBYNYBvL4J8NftPnHNOf/kz7LjaJ6I45vO58vof6L8PkCCXXMAs9mLxl4+JgKGZjkF4YS+K+HN0n6KURcFMvYdCYHUoJrWqOG/UvT1wDPeFAm3n2pZEeUzRE5M+7lpv+lbv/CpoEK7IDhx9n+T37RIufETmIGJpe8Oj5cLePZxyqUx1iBNaGh6PNeOTxidtaKqJRR6iL9c4IOP7cgeQhJeir/LbC7JYVf7bE7kHz1lmlqmglWg4DW+zm1twkSy1lL7btrbw0drYZtZk913YviMo/dk7T9V2B+GFbI6hOXmwEr8GGTbvQ= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_8C2EEF394C574BB68F269EBD392FD920ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0fca420e-4f3d-4078-9fe3-08d7731163b9 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 08:11:21.9133 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rBSUTmoEYRiWQeWAgWg3fNP/xeF9pu1ki/nrHBanElohJWRXzNJiEZJFQs2xLxCscnOmjCt4zD0WwYr7fSvdXm7ZC2NXL2j5Rinsb6GqfkY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3514 Archived-At: Subject: Re: [Ace] Call for adoption draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 08:11:26 -0000 --_000_8C2EEF394C574BB68F269EBD392FD920ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBzdXBwb3J0IGFkb3B0aW9uLg0KDQoNCg0KRm9yIHB1Yi1zdWIsIHdlIG5lZWQgdG8gc3BlY2lm eSBob3cgdG8gZG8gYXV0aG9yaXphdGlvbiBvZiBwdWJsaXNoaW5nIHRvIGEgYnJva2VyIGFuZCBh dXRob3JpemF0aW9uIG9mIGFjY2VzcyB0byBwdWJsaXNoZWQgY29udGVudC4gV2hhdCBpcyBkZXNj cmliZWQgaW4gdGhpcyBkcmFmdCBpcyBhIGdvb2Qgd2F5IHRvIGRvIHRoYXQgd2l0aCB0aGUgQUNF IGZyYW1ld29yay4NCg0KDQoNCkfDtnJhbg0KDQoNCkZyb206IEFjZSA8YWNlLWJvdW5jZXNAaWV0 Zi5vcmc+IG9uIGJlaGFsZiBvZiBEYW5pZWwgTWlnYXVsdCA8ZGFuaWVsLm1pZ2F1bHQ9NDBlcmlj c3Nvbi5jb21AZG1hcmMuaWV0Zi5vcmc+DQpEYXRlOiBUdWVzZGF5LCAxOSBOb3ZlbWJlciAyMDE5 IGF0IDA5OjQ1DQpUbzogQWNlIFdnIDxhY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbQWNlXSBDYWxs IGZvciBhZG9wdGlvbiBkcmFmdC1wYWxvbWJpbmktYWNlLWNvYXAtcHVic3ViLXByb2ZpbGUNCg0K RGVhciB3b3JraW5nIGdyb3VwLA0KDQpBcyBtZW50aW9uZWQgZHVyaW5nIHRoZSBBQ0UgbWVldGlu ZywgdGhpcyBtYWlsIHN0YXJ0cyBhIGNhbGwgZm9yIGFkb3B0aW9uIGZvciBkcmFmdC1wYWxvbWJp bmktYWNlLWNvYXAtcHVic3ViLXByb2ZpbGUuIFBsZWFzZSBwcm92aWRlIHlvdXIgZmVlZCBiYWNr cyBieSBEZWNlbWJlciA0Lg0KDQoNCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2Ry YWZ0LXBhbG9tYmluaS1hY2UtY29hcC1wdWJzdWItcHJvZmlsZS8NCg0KDQpZb3VycywNCkRhbmll bA0KDQoNCg== --_000_8C2EEF394C574BB68F269EBD392FD920ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <154EA2EBE53F1742969940DE35B34C87@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29QbGFpblRleHQsIGxpLk1zb1BsYWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4 dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQg Q2hhciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUzt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9y OndpbmRvd3RleHQ7fQ0Kc3Bhbi5QbGFpblRleHRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJQbGFp biBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi UGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcwLjg1cHQgNzAuODVwdCA3MC44NXB0IDcw Ljg1cHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iU1YiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj5JIHN1cHBvcnQgYWRvcHRpb24uPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj5Gb3IgcHViLXN1Yiwgd2UgbmVlZCB0byBzcGVjaWZ5IGhvdyB0byBkbyBhdXRob3JpemF0 aW9uIG9mIHB1Ymxpc2hpbmcgdG8gYSBicm9rZXIgYW5kIGF1dGhvcml6YXRpb24gb2YgYWNjZXNz IHRvIHB1Ymxpc2hlZCBjb250ZW50LiBXaGF0IGlzIGRlc2NyaWJlZCBpbiB0aGlzIGRyYWZ0IGlz IGEgZ29vZCB3YXkgdG8gZG8gdGhhdCB3aXRoIHRoZSBBQ0UgZnJhbWV3b3JrLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+R8O2cmFuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtw YWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9y OmJsYWNrIj5Gcm9tOg0KPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpibGFjayI+QWNlICZsdDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9m IERhbmllbCBNaWdhdWx0ICZsdDtkYW5pZWwubWlnYXVsdD00MGVyaWNzc29uLmNvbUBkbWFyYy5p ZXRmLm9yZyZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgMTkgTm92ZW1iZXIgMjAxOSBh dCAwOTo0NTxicj4NCjxiPlRvOiA8L2I+QWNlIFdnICZsdDthY2VAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDogPC9iPltBY2VdIENhbGwgZm9yIGFkb3B0aW9uIGRyYWZ0LXBhbG9tYmluaS1h Y2UtY29hcC1wdWJzdWItcHJvZmlsZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5EZWFyIHdvcmtpbmcgZ3JvdXAs Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PkFzIG1lbnRpb25lZCBkdXJpbmcgdGhlIEFDRSBtZWV0aW5nLCB0aGlzIG1haWwgc3RhcnRzIGEg Y2FsbCBmb3IgYWRvcHRpb24gZm9yIGQ8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPnJhZnQtcGFs b21iaW5pLWFjZS1jb2FwLXB1YnN1Yi1wcm9maWxlLiBQbGVhc2UgcHJvdmlkZSB5b3VyIGZlZWQg YmFja3MgYnkgRGVjZW1iZXIgNC4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+PGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwczovL2RhdGF0cmFj a2VyLmlldGYub3JnL2RvYy9kcmFmdC1wYWxvbWJpbmktYWNlLWNvYXAtcHVic3ViLXByb2ZpbGUv Ij5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wYWxvbWJpbmktYWNlLWNv YXAtcHVic3ViLXByb2ZpbGUvPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+PGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Zb3VycywgPC9zcGFuPg0KPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkRhbmllbDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGJyPg0KPGJyPg0K PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_8C2EEF394C574BB68F269EBD392FD920ericssoncom_-- From nobody Wed Nov 27 05:36:11 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 308781200A4 for ; Wed, 27 Nov 2019 05:36:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YG2um7aJyZtA for ; Wed, 27 Nov 2019 05:36:07 -0800 (PST) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00084.outbound.protection.outlook.com [40.107.0.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 875961200A1 for ; Wed, 27 Nov 2019 05:36:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CfhgGk1A+Z3YVnl/iVSGjkv/08zBvFyDwna4X7vJew0EDgFxUJkbDwOQmaL9T5phJHrVML+kl4yIKXHx59HFIeIADIBDKmOzc8REWv/HJ8i2qajniET52S5nY8J5+FsK7tewcwt/t/yL/X46R51vnk8oRVaSdAqnvo9RHa4yPPkJHHi6Fqiiz4qHSwAp6f0cuylkT9Rv1jBlCyHFNEwsRCQkeZt2hT/L3Xhc5ZLt2hhvE5398zmDcPHdFMTkwhSigtZSm0Ivr0kbgvfKZNjrwMflk60l4qkk3/KBky8AqsLbq6l504lVgxaOkXmixnpJJcjBDECFY+jTLEZ3UvVg5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=faqQY70rcQM1GfCL9dRIaEJtaBv8cYnyA42+Yl6TPoY=; b=apH2lOVsAaypfkmF9WL8Q9rd63ApBAPwJV7BIXIRcz3rhjPIcwej4tyAe4nj0BMM+ZneygYXKcPum7/mc5+3sVOpiZmM2uwDXxOm+CpHUfiL9saMD8ij4r7Pzyo5nAuUWyLbnBzwLniX1/ryEYgf8lXJ7XGJtQepiCbXxj+Vi5OPl5fqwNFisVdJKgSXqA69rH9Etj2iAVcdlt8orbODkSiXyObcax5PCBS5BfkHWj3DjGmIsc/yC4V/GZrpWzUF8LTOSBMbda/yi0165acBQloECi12J5IpSub34VYGUGmIHxsBNPSqW2GRzUeWhtuAnTtOll9na2RXKFMAJxXnmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=faqQY70rcQM1GfCL9dRIaEJtaBv8cYnyA42+Yl6TPoY=; b=LYL9Rbyo/EU0db83Mgk//2iqZBoL65NHP5QVBhdbUoKC3Vma28GB8hjJyRbiJ4R2gyJI6eCMjcvAP0HK4V63y07HR6VZv31TjjjTaL73pABddu/JSY0IaXHL7zqEQ2MjrhsLNUpvwcGrVjtekeViqUPKZjm2ob11fYHfEbM2lN8= Received: from VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM (10.141.34.8) by VI1P18901MB0144.EURP189.PROD.OUTLOOK.COM (10.173.84.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.17; Wed, 27 Nov 2019 13:36:04 +0000 Received: from VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM ([fe80::8da1:8674:901a:a0be]) by VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM ([fe80::8da1:8674:901a:a0be%6]) with mapi id 15.20.2474.023; Wed, 27 Nov 2019 13:36:04 +0000 From: Ludwig Seitz To: Cigdem Sengul , Daniel Migault CC: "ace@ietf.org" Thread-Topic: [Ace] comment on draft-ietf-ace-oauth-authz-26 Thread-Index: AQHVoBOH3NTo2EbHjUC07djbvcWa/KeU7P0A///zboCAAGpdAIAJw9kb Date: Wed, 27 Nov 2019 13:36:04 +0000 Message-ID: References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ludwig.seitz@ri.se; x-originating-ip: [194.218.146.227] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 74c87156-3744-4c16-ee13-08d7733ec001 x-ms-traffictypediagnostic: VI1P18901MB0144: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(396003)(346002)(136003)(39860400002)(366004)(51914003)(13464003)(189003)(199004)(6116002)(2906002)(91956017)(26005)(229853002)(7696005)(76116006)(44832011)(71200400001)(71190400001)(14454004)(6246003)(76176011)(102836004)(11346002)(446003)(99286004)(66066001)(81166006)(81156014)(53546011)(64756008)(4326008)(186003)(66556008)(66476007)(8676002)(6306002)(66946007)(9686003)(33656002)(86362001)(6506007)(6436002)(66446008)(256004)(14444005)(305945005)(7736002)(8936002)(3846002)(966005)(5660300002)(55016002)(110136005)(316002)(478600001)(74316002)(52536014)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P18901MB0144; H:VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ri.se does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Ws/tcaGAQxM2rHuuYp8l5Okkt11S9XbRU8LtRGmeuuwkXiSKq+TW1/697AQIZIbhY0j8/zIH/mrSeBCapFyPjjmjvPqqhXVvWDVu141GXDPaoXJMam8xVkKz0MVvD4OU4rH91kiwtDKu13s3G055e843Z2dusbL4MKd9z1enMvVyZuZ7tuwKV19ZL8kFn1V3kPHl6tYsBluBWVm/aHaR7aAOhvUqBS54Q6hePuzpsDfbiVTkxrAIYKaUvvX7LHdrvJcK6FZ7CoKUpbDraM6XiIZYW3s+5W2QLiiOIctq8qAwAZbdIrz4vBBMytSXhF1gk2y5JBMruwZ2F27ppCj14ZVazCL+0Z3qGzCXRp5+C/COSG8vUSotvID6R1h+toBWeMqNSAmF6NGXomVRrewsrGjhW+csFcTgrMX0PltRt32xVDN5S0HbOrMKSg25elMww5zZdhPCOFFaH03Rj/fG+V0AuYISo9kR5vi9h/+FBsI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: 74c87156-3744-4c16-ee13-08d7733ec001 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 13:36:04.1637 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: U45pkGPo44Kr5H0JLdRzYTtNTVMOPagTgpTbdsds/qHjM1yYKmZ5h1oa7OvxEis6aOXwNlCXePZw6w71chq7Lw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P18901MB0144 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 13:36:10 -0000 If you are using JSON-based interactions, I believe that the most straightf= orward way is to refer to RFC6749 for the error messages as you currently d= o. I don't find this confusing or problematic, but YMMV. /Ludwig ________________________________________ From: Cigdem Sengul Sent: Thursday, November 21, 2019 10:27 AM To: Daniel Migault Cc: Ludwig Seitz; ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 Hello, Ludwig, I agree that the current draft describes specifically for when CBOR= is used. When CBOR is not used, I have read it as it will act similar to Section 5.2= of [RFC6749] as you have = indicated also in the ace-oauth-authz document. Therefore, instead of an indirect reference to RFC6749 by referencing ace-o= auth-authz, we used a direct reference to explain what the error response s= hould be. Is this problematic? or confusing? I can reword in mqtt_tls draft something like: "As described in [ace-oauth-authz] the error responses for JSON-based inter= actions with AS follow RFC6749. When CBOR is used, the interactions MUST im= plement [ace-oauth-authz]" Would that help? Thanks, --Cigdem On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault > wrote: Hi Ludwig, Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document. What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine. Thanks! Daniel -----Original Message----- From: Ace > On Behalf Of = Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM To: ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 On 21/11/2019 03:29, Daniel Migault wrote: > Hi, > > This only concerns potential clarification of the text. > > While reviewing mqtt-profile draft I raised an issue regarding the > reference for Oauth [RFC6749] while the remaining of the document > references draft-ietf-ace-oauth-authz [1]. My reading of > draft-ietf-ace-oauth-authz section 5.6.3 > >. > was the same of the one of mqtt-profile coauthors, that is error > mandates the use of CBOR. Discussing this with others it seems a mis > interpretation of draft-ietf-ace-oauth-authz section 5.6.3 > = [2]. > > I believe that is nice this is a mis-interpretation, but I would > recommend that the text makes it more explicit the use of JSON is > permitted. This seems to me a request to clarify the text. > > Yours, > Daniel > I would be happy to add more clarification, but I'm currently at a loss of = what that would be. Most of the bullets you cited already modify the MUSTs = with "...when CBOR is used" or something similar to the same effect. The id= ea was to express: You can use the vanilla OAuth interactions based on JSON= , but if you use CBOR then do it as specified here. I am happy to take suggestions. /Ludwig > [1] > """ > > In the case of an error, the AS returns error responses for HTTP- > based interactions as ASCII codes in JSON content, as defined in > Section 5.2 of RFC 6749 [RFC6749 ]. > > """ > > [2] > """ > > > 5.6.3 > . > Error Response > > > > The error responses for CoAP-based interactions with the AS are > generally equivalent to the ones for HTTP-based interactions as > defined inSection 5.2 of [RFC6749] , with the following exceptions: > > o When using CBOR the raw payload before being processed by the > communication security protocol MUST be encoded as a CBOR map. > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > MUST be used for all error responses, except for invalid_client > where a response code equivalent to the CoAP code 4.01 > (Unauthorized) MAY be used under the same conditions as specified > inSection 5.2 of [RFC6749] . > > o The Content-Format (for CoAP-based interactions) or media type > (for HTTP-based interactions) "application/ace+cbor" MUST be used > for the error response. > > o The parameters "error", "error_description" and "error_uri" MUST > be abbreviated using the codes specified in Figure 12, when a CBOR > encoding is used. > > o The error code (i.e., value of the "error" parameter) MUST be > abbreviated as specified in Figure 10, when a CBOR encoding is > used. > /------------------------+-------------\ > > | Name | CBOR Values | > |------------------------+-------------| > | invalid_request | 1 | > | invalid_client | 2 | > | invalid_grant | 3 | > | unauthorized_client | 4 | > | unsupported_grant_type | 5 | > | invalid_scope | 6 | > | unsupported_pop_key | 7 | > | incompatible_profiles | 8 | > \------------------------+-------------/ > > Figure 10: CBOR abbreviations for common error codes > > In addition to the error responses defined in OAuth 2.0, the > following behavior MUST be implemented by the AS: > > o If the client submits an asymmetric key in the token request that > the RS cannot process, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "unsupported_pop_key" defined in > Figure 10. > > o If the client and the RS it has requested an access token for do > not share a common profile, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "incompatible_profiles" defined in > Figure 10. > > """ > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > -- Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Wed Nov 27 07:00:39 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66B8C1209A1 for ; Wed, 27 Nov 2019 07:00:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxPBHCiBOkO5 for ; Wed, 27 Nov 2019 07:00:35 -0800 (PST) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2CA6120964 for ; Wed, 27 Nov 2019 07:00:34 -0800 (PST) Received: by mail-qt1-x829.google.com with SMTP id z22so4779810qto.7 for ; Wed, 27 Nov 2019 07:00:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jBSWjBQmqG5zqjcH4TTrkTQ6MB8ic8hdNR4D50LnUfA=; b=SUYZDSY7ozdvC0polPnop8tNEWd4mJRbEwdQCCVF5yjxWHFN+QKMM0/I15RxfeIArF DJ14pu7uUagihi+8YaeW9Hcq6vM/ZGMLsaHzt4oygJxRCh23erz4UDYFvOOWLpWsTIJW ejQykhM8sMPr5rD4WTqJdQ0rHpWVrc8BHJeXoweJSKc6ygAQeWv6sQOm8QUNuKYUDKth RtTSVk8pTuA3qfaBsrTwmA10xjFEUP8SQkMEfxrQSzBaN4O3/zEVFMMSwyQLLsdBKpRH gzLUjVXqYcrguMMb8k9ETHEVN2CxYgtwOJ5nUHBzvfVrZwAuSFbCLGVVFfZo+1lUjw5o INyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jBSWjBQmqG5zqjcH4TTrkTQ6MB8ic8hdNR4D50LnUfA=; b=HRSmJBQ27wCEuYxwGGIgtumAmAFZzcY4zMFVo00ic0SEflajaTfX/eaCM9MweyMPUZ ELQgKgq7uloRTibBkRpv1/y+TVS5gZfMVmrr5yid8m5zqS8qlXrpBzuY/2oi9XWyV87n fe+MLXW1nByceNtKhrUDuM7XaRToQefNiF69NUjXkSz2T07ZQ1gKfD8nfYnkQWSr8vrs jimsQwqvVX4qa7gIe7Eikb9BO+gwRSMU1H0gWpLyvR/i8JfHUZEKoOwueasZuRRyMx14 ajdChjI4kcVAWDZW35ahwjkh6pC3ofTsHsg4vG5/68x8uO2euI15pKpJ+Rn/q9mZqyy+ 0u6w== X-Gm-Message-State: APjAAAWvi9kqwZ2qXeuVtw6Swu8o5u5enZmVXHQYgzSzZmKme9a7ZUhe 2OolyigvfxRSY8o9EWxg3opax7Ny0sGku8mtIrBr6R/y X-Google-Smtp-Source: APXvYqxYoFmI8hahW9DQORrUcDObQuLitVU8qMpPds0FXqw1Z81gKunplk6yJW/9XwY9YYmCw5E1gSysVNpS+J6E60U= X-Received: by 2002:ac8:2aee:: with SMTP id c43mr28469035qta.201.1574866833709; Wed, 27 Nov 2019 07:00:33 -0800 (PST) MIME-Version: 1.0 References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> In-Reply-To: From: Cigdem Sengul Date: Wed, 27 Nov 2019 15:00:16 +0000 Message-ID: To: Ludwig Seitz Cc: Daniel Migault , "ace@ietf.org" Content-Type: multipart/alternative; boundary="000000000000311e48059855424b" Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 15:00:37 -0000 --000000000000311e48059855424b Content-Type: text/plain; charset="UTF-8" Thanks Ludwig, I was thinking my suggested wording won't pose a problem either. I refer to CBOR as even if we describe everything based on JSON, CBOR is stated as an option. --Cigdem On Wed, Nov 27, 2019 at 1:36 PM Ludwig Seitz wrote: > If you are using JSON-based interactions, I believe that the most > straightforward way is to refer to RFC6749 for the error messages as you > currently do. I don't find this confusing or problematic, but YMMV. > > /Ludwig > > ________________________________________ > From: Cigdem Sengul > Sent: Thursday, November 21, 2019 10:27 AM > To: Daniel Migault > Cc: Ludwig Seitz; ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > Hello, > > Ludwig, I agree that the current draft describes specifically for when > CBOR is used. > When CBOR is not used, I have read it as it will act similar to Section > 5.2 of [RFC6749] as you > have indicated also in the ace-oauth-authz document. > > Therefore, instead of an indirect reference to RFC6749 by referencing > ace-oauth-authz, we used a direct reference to explain what the error > response should be. > > Is this problematic? or confusing? > > I can reword in mqtt_tls draft something like: > "As described in [ace-oauth-authz] the error responses for JSON-based > interactions with AS follow RFC6749. When CBOR is used, the interactions > MUST implement [ace-oauth-authz]" > > Would that help? > > Thanks, > --Cigdem > > > > On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault 40ericsson.com@dmarc.ietf.org> > wrote: > Hi Ludwig, > > Thanks for the feed back. I was raising the issue before it got forgotten. > , and I must say I did not checked whether it had been addressed or not, as > I did not remember this had been raised for the ace-oauth-authz document. > > What you are saying is that the draft has been updated already. I will > have a closer look at it, and ask mqtt-profile to confirm the current text > is fine. > > Thanks! > Daniel > > -----Original Message----- > From: Ace > On Behalf > Of Ludwig Seitz > Sent: Thursday, November 21, 2019 10:51 AM > To: ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > On 21/11/2019 03:29, Daniel Migault wrote: > > Hi, > > > > This only concerns potential clarification of the text. > > > > While reviewing mqtt-profile draft I raised an issue regarding the > > reference for Oauth [RFC6749] while the remaining of the document > > references draft-ietf-ace-oauth-authz [1]. My reading of > > draft-ietf-ace-oauth-authz section 5.6.3 > > ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3< > http://ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>>. > > was the same of the one of mqtt-profile coauthors, that is error > > mandates the use of CBOR. Discussing this with others it seems a mis > > interpretation of draft-ietf-ace-oauth-authz section 5.6.3 > > > [2]. > > > > I believe that is nice this is a mis-interpretation, but I would > > recommend that the text makes it more explicit the use of JSON is > > permitted. This seems to me a request to clarify the text. > > > > Yours, > > Daniel > > > > I would be happy to add more clarification, but I'm currently at a loss of > what that would be. Most of the bullets you cited already modify the MUSTs > with "...when CBOR is used" or something similar to the same effect. The > idea was to express: You can use the vanilla OAuth interactions based on > JSON, but if you use CBOR then do it as specified here. > > I am happy to take suggestions. > > /Ludwig > > > [1] > > """ > > > > In the case of an error, the AS returns error responses for HTTP- > > based interactions as ASCII codes in JSON content, as defined in > > Section 5.2 of RFC 6749 < > https://tools.ietf.org/html/rfc6749#section-5.2> [RFC6749 < > https://tools.ietf.org/html/rfc6749>]. > > > > """ > > > > [2] > > """ > > > > > > 5.6.3 > > < > https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. > > Error Response > > > > > > > > The error responses for CoAP-based interactions with the AS are > > generally equivalent to the ones for HTTP-based interactions as > > defined inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>, with the following > exceptions: > > > > o When using CBOR the raw payload before being processed by the > > communication security protocol MUST be encoded as a CBOR map. > > > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > > MUST be used for all error responses, except for invalid_client > > where a response code equivalent to the CoAP code 4.01 > > (Unauthorized) MAY be used under the same conditions as specified > > inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>. > > > > o The Content-Format (for CoAP-based interactions) or media type > > (for HTTP-based interactions) "application/ace+cbor" MUST be used > > for the error response. > > > > o The parameters "error", "error_description" and "error_uri" MUST > > be abbreviated using the codes specified in Figure 12, when a CBOR > > encoding is used. > > > > o The error code (i.e., value of the "error" parameter) MUST be > > abbreviated as specified in Figure 10, when a CBOR encoding is > > used. > > /------------------------+-------------\ > > > > | Name | CBOR Values | > > |------------------------+-------------| > > | invalid_request | 1 | > > | invalid_client | 2 | > > | invalid_grant | 3 | > > | unauthorized_client | 4 | > > | unsupported_grant_type | 5 | > > | invalid_scope | 6 | > > | unsupported_pop_key | 7 | > > | incompatible_profiles | 8 | > > \------------------------+-------------/ > > > > Figure 10: CBOR abbreviations for common error codes > > > > In addition to the error responses defined in OAuth 2.0, the > > following behavior MUST be implemented by the AS: > > > > o If the client submits an asymmetric key in the token request that > > the RS cannot process, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "unsupported_pop_key" defined in > > Figure 10. > > > > o If the client and the RS it has requested an access token for do > > not share a common profile, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "incompatible_profiles" defined in > > Figure 10. > > > > """ > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > -- > Ludwig Seitz, PhD > Security Lab, RISE > Phone +46(0)70-349 92 51 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000311e48059855424b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks Ludwig,=C2=A0
I was thinking my suggested wordi= ng won't pose a problem either.=C2=A0

I refer = to CBOR as even if we describe everything based on JSON,=C2=A0 CBOR is stat= ed as an option.=C2=A0

--Cigdem=C2=A0
<= br>
On Wed,= Nov 27, 2019 at 1:36 PM Ludwig Seitz <ludwig.seitz@ri.se> wrote:
If you are using JSON-based interactions, I believe = that the most straightforward way is to refer to RFC6749 for the error mess= ages as you currently do. I don't find this confusing or problematic, b= ut YMMV.

/Ludwig

________________________________________
From: Cigdem Sengul <cigdem.sengul@gmail.com>
Sent: Thursday, November 21, 2019 10:27 AM
To: Daniel Migault
Cc: Ludwig Seitz; ace@iet= f.org
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

Hello,

Ludwig, I agree that the current draft describes specifically for when CBOR= is used.
When CBOR is not used, I have read it as it will act similar to Section 5.2= of [RFC6749]<https://tools.ietf.org/html/rfc6749#= section-5.2> as you have indicated also in the ace-oauth-authz docum= ent.

Therefore, instead of an indirect reference to RFC6749 by referencing ace-o= auth-authz, we used a direct reference to explain what the error response s= hould be.

Is this problematic? or confusing?

I can reword in mqtt_tls draft something like:
"As described in [ace-oauth-authz] the error responses for JSON-based = interactions with AS follow RFC6749. When CBOR is used, the interactions MU= ST implement [ace-oauth-authz]"

Would that help?

Thanks,
--Cigdem



On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault <daniel.migault=3D40ericsson.com@= dmarc.ietf.org<mailto:40ericsson.com@dmarc.ietf.org>> wrote:
Hi Ludwig,

Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document.<= br>
What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine.

Thanks!
Daniel

-----Original Message-----
From: Ace <ace= -bounces@ietf.org<mailto:ace-bounces@ietf.org>> On Behalf Of Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM
To: ace@ietf.org<m= ailto:ace@ietf.org>= ;
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

On 21/11/2019 03:29, Daniel Migault wrote:
> Hi,
>
> This only concerns potential clarification of the text.
>
> While reviewing mqtt-profile draft I raised an issue regarding the
> reference for Oauth [RFC6749] while the remaining of the document
> references draft-ietf-ace-oauth-authz [1]. My reading of
> draft-ietf-ace-oauth-authz section 5.6.3
> <ht= tps://tools..ietf.org/html/draft= -ietf-ace-oauth-authz-26#section-5.6.3<http://ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.= 3>>.
> was the same of the one of mqtt-profile coauthors, that is error
> mandates the use of CBOR. Discussing this with others it seems a mis > interpretation of=C2=A0 draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools.ietf.o= rg/html/draft-ietf-ace-oauth-authz-26#section-5.6.3> [2].
>
> I believe that is nice this is a mis-interpretation, but I would
> recommend that the text makes it more explicit the use of JSON is
> permitted. This seems to me a request to clarify the text.
>
> Yours,
> Daniel
>

I would be happy to add more clarification, but I'm currently at a loss= of what that would be. Most of the bullets you cited already modify the MU= STs with "...when CBOR is used" or something similar to the same = effect. The idea was to express: You can use the vanilla OAuth interactions= based on JSON, but if you use CBOR then do it as specified here.

I am happy to take suggestions.

/Ludwig

> [1]
> """
>
>=C2=A0 =C2=A0 =C2=A0In the case of an error, the AS returns error respo= nses for HTTP-
>=C2=A0 =C2=A0 =C2=A0based interactions as ASCII codes in JSON content, = as defined in
>=C2=A0 =C2=A0 =C2=A0Section 5.2 of RFC 6749=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>=C2=A0 [RFC6749= =C2=A0 <https://tools.ietf.org/html/rfc6749>].
>
> """
>
> [2]
> """
>
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A05.6.3
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#sect= ion-5.6.3>.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Error Response
>
>
>
>=C2=A0 =C2=A0 =C2=A0The error responses for CoAP-based interactions wit= h the AS are
>=C2=A0 =C2=A0 =C2=A0generally equivalent to the ones for HTTP-based int= eractions as
>=C2=A0 =C2=A0 =C2=A0defined inSection 5.2 of [RFC6749]=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>, wi= th the following exceptions:
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 When using CBOR the raw payload before bein= g processed by the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 communication security protocol MUST be enc= oded as a CBOR map.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 A response code equivalent to the CoAP code= 4.00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 MUST be used for all error responses, excep= t for invalid_client
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 where a response code equivalent to the CoA= P code 4.01
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (Unauthorized) MAY be used under the same c= onditions as specified
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 inSection 5.2 of [RFC6749]=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>. >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The Content-Format (for CoAP-based interact= ions) or media type
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (for HTTP-based interactions) "applica= tion/ace+cbor" MUST be used
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 for the error response.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The parameters "error", "err= or_description" and "error_uri" MUST
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 be abbreviated using the codes specified in= Figure 12, when a CBOR
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 encoding is used.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The error code (i.e., value of the "er= ror" parameter) MUST be
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 abbreviated as specified in Figure 10, when= a CBOR encoding is
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 used.
> /------------------------+-------------\
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Name=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| CBOR Values |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|----------------------= --+-------------|
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_request=C2=A0= =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 1=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_client=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 2=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_grant=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 3=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unauthorized_client= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 4=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_grant_typ= e |=C2=A0 =C2=A0 =C2=A0 5=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_scope=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 6=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_pop_key= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 7=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| incompatible_profiles= =C2=A0 |=C2=A0 =C2=A0 =C2=A0 8=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0\----------------------= --+-------------/
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Figure 10: CBOR abbrevi= ations for common error codes
>
>=C2=A0 =C2=A0 =C2=A0In addition to the error responses defined in OAuth= 2.0, the
>=C2=A0 =C2=A0 =C2=A0following behavior MUST be implemented by the AS: >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client submits an asymmetric key in = the token request that
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the RS cannot process, the AS MUST reject t= hat request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "unsupported_= pop_key" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client and the RS it has requested a= n access token for do
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 not share a common profile, the AS MUST rej= ect that request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "incompatible= _profiles" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
> """
>
> _______________________________________________
> Ace mailing list
> Ace@ietf.org<= mailto:Ace@ietf.org&g= t;
> https://www.ietf.org/mailman/listinfo/ace
>


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
Ace mailing list
Ace@ietf.org<mailt= o:Ace@ietf.org> https://www.ietf.org/mailman/listinfo/ace
--000000000000311e48059855424b-- From nobody Wed Nov 27 07:31:24 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56F521209BA for ; Wed, 27 Nov 2019 07:31:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0k2jx8kDHWz7 for ; Wed, 27 Nov 2019 07:31:20 -0800 (PST) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80079.outbound.protection.outlook.com [40.107.8.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F38A21209B8 for ; Wed, 27 Nov 2019 07:31:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dm7RDs9HD0YhcbXwlsk5MRo+s9pUtBilK9x9AbQkKUkmyIiywqsJJVOFGKxOBnTjLXffeBOLuiGzTGv0vUtw8stzzaaDNJ3ISGQuBt3VaHpyj//IETnv0nbugxacXVnYanuM4uRenCStUsw9zS4Q2ZvpgXF2ifPjqp24zIWbHuPEW3b/+UzUHRuPLiwFSHbSxmfaq2F0ngBuvMqMxwG67R4KcMg8BXWcoNG6mLt4Y0pW3ye2cnHozo4iU5kFHWU+wZ6lhM9MdVZTC9Q8s5PJNkD1eHNd0mq5eBvW7FPCjkS44jF9SyWUr4I3rcJbvj7f+N0XGq2/fX9v7qykpLAkDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pN7oBfu9LrnYBAbPB4nFmUpIs8uGTjgEkGUJEAafWtM=; b=lo5Ugx5JTxxYtNMZy1CeF28A+DBzePDR5iyjYry/XJnKtLKIeRiEWw8KQ5n05MaWMAhWNOgeqxyoZ5N2AC2NYOUCA5bsYIETQw7p/mhx7e3es1te7pXvzNzf+XBMEYlsklCF6j/bCpZPtgQ2h7CIJCNVU2rXHILtXyW+fovNBkjoTi8Qbj6GvbK7y3KmuqRMnZ9VDVPpbHrwBgc3/p7Ww0L1nBjWKJLWB7+w/Gj09j1q/H5KP7Dp9VQJRbl/3V2kynghFOGtsNMEpYemsh1m9RhdIge9CBrBzJX0B8K5/MIRTeSK8iGZSd4peachBZWHrxXDVcqvqP8TTcW+SmvlYA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pN7oBfu9LrnYBAbPB4nFmUpIs8uGTjgEkGUJEAafWtM=; b=Y/mnFb7GOP5NqTHSK8eqgCXwCc/YGY0z0HIOpGX/b+EW7+bcdmATj4OX9/YE2iUS7tOwAsPGjX6RNsXO+PCG/TxScQz6K4z0YoZPl+MBSBGvzUfOymh2rpxq1RCxd77d7X8IKg4J8dEwnrr+TlS3OaT1ty4VB0K8GJZY0Ca2/24= Received: from VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM (10.141.34.8) by VI1P18901MB0669.EURP189.PROD.OUTLOOK.COM (10.186.156.72) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2495.18; Wed, 27 Nov 2019 15:31:17 +0000 Received: from VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM ([fe80::8da1:8674:901a:a0be]) by VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM ([fe80::8da1:8674:901a:a0be%6]) with mapi id 15.20.2474.023; Wed, 27 Nov 2019 15:31:17 +0000 From: Ludwig Seitz To: Benjamin Kaduk CC: "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt Thread-Index: AQHVoBElPUIGAYRh+0eeV2SOgOBnCaeU4xyAgAeVSoCAAqDw+w== Date: Wed, 27 Nov 2019 15:31:16 +0000 Message-ID: References: <157430230677.769.6413870274615783065@ietfa.amsl.com> , <20191125230411.GN32847@mit.edu> In-Reply-To: <20191125230411.GN32847@mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ludwig.seitz@ri.se; x-originating-ip: [194.218.146.227] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4b40ec58-9285-4ba7-392f-08d7734ed857 x-ms-traffictypediagnostic: VI1P18901MB0669: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(366004)(346002)(136003)(396003)(376002)(189003)(199004)(51444003)(53546011)(6506007)(8936002)(81156014)(81166006)(14454004)(91956017)(478600001)(76116006)(8676002)(4326008)(7696005)(33656002)(7736002)(6916009)(316002)(6116002)(6246003)(9686003)(66066001)(3846002)(305945005)(2171002)(26005)(6436002)(2906002)(102836004)(186003)(5660300002)(86362001)(25786009)(229853002)(44832011)(76176011)(64756008)(66556008)(66476007)(11346002)(71190400001)(446003)(71200400001)(14444005)(99286004)(66946007)(55016002)(74316002)(52536014)(256004)(66446008); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P18901MB0669; H:VI1P18901MB0750.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ri.se does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 2fX73fp3xLRL0IhH5LZKtzSzxWiFNuTzhFN7CGTZU7BcB4uH4zCp2rWx9gX8E6iELR4KF74GBPedq7f6dorM2BHBDpu6rsW/whg+5kTffscDj4MzXCq4DNGHcFamq6vVoGN5dicOi7TiNveHkHY4HW3zACRMcftkbOv/s6IO5gXRiwo+gRbcu8Fgzi8zsXJ2lmiPay1TmyK8pSvIAn3BseHWKuf9Ls5fHvgKHIRo/d6aAzh0wS3dVQTcgC2SZR/+DB2Eh+ftzLvece0rivKCe2EN6A82bXYHp7GZMxwlBQEs3fdCaZHmLm0pzkiY46hyEZDwQW0am+2GoVlwzRPE2Xep2LTTExhVWHevzvni88ID6UQbslQQNpfeZ4r5pL94JvG0+Mdaysdmpt8ZtA8uQLuoevfv1ZVRiExUZvbCcX3sY1Ss7YVFZvY0Ubp50FQP x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: 4b40ec58-9285-4ba7-392f-08d7734ed857 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 15:31:16.9875 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: zAWMok3zYTGTStSdf6O00J7M/1WhjykkawRKMfJmNokxk33TYN5P0LKq7esCtXr/cRzHzUorcXGzTn3pfhrZEA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P18901MB0669 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 15:31:23 -0000 Hi Ben,=0A= =0A= replies inline.=0A= =0A= /Ludwig=0A= ________________________________________=0A= From: Benjamin Kaduk =0A= Sent: Tuesday, November 26, 2019 12:04 AM=0A= To: Ludwig Seitz=0A= Cc: ace@ietf.org=0A= Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt=0A= =0A= Hi Ludwig,=0A= =0A= On Thu, Nov 21, 2019 at 03:16:03AM +0100, Ludwig Seitz wrote:=0A= > Hello ACE,=0A= >=0A= > turns out -26 didn't cover one of the items in Ben's review, namely the= =0A= > question of using Client introspection to determine token expiration as= =0A= > a lower bound for key expiration. Since the whole issue of Client=0A= > introspection was contentious between OAuth experts, we decided to=0A= > remove the text describing that option. This still leaves us with the=0A= > two other options, so the problem is still covered.=0A= =0A= Thanks for all the updates! I'm just about ready to push the "request Last= =0A= Call" button, but wanted to check one thing first:=0A= =0A= Section 5.6.3 seems to limit the error responses to 4.00 and 4.01, but=0A= Section 5.8.2 also talks about 4.03 and 4.05. I noticed because I was=0A= checking Section 5.1.1's note about "unauthorized_client" error response ag= ainst the=0A= various options in 5.8.2, to see if we're internally consistent about when= =0A= we say to send errors vs. AS request creation hints. My recollection is=0A= that we can have all three of a response code, error response (e.g.,=0A= "unauthorized_client"), and (our custom format of) response payload present= =0A= in the same response, so any potential conflict would be limited to just=0A= the response code, but please correct me if I'm wrong about that.=0A= =0A= [LS] Section 5.6.3 describes the interaction with the token endpoint at the= AS. There we mirrored the behaviour of OAuth error responses.=0A= Section 5.8.2 describes the interaction with the newly defined authz-info e= ndpoint at the RS. We decided that this warranted more detailed error respo= nses, so that a client gets some hint on what went wrong when an access tok= en is rejected by the RS.=0A= This is why we have added the 4.03 and 4.05 messages.=0A= Section 5.1.1 describes an access request to a resource at the RS (other th= an the authz-info endpoint) and has yet another different error behaviour.= =0A= For the token endpoint (5.6.3), the response code is part of the HTTP/CoAP = header, while the "error" parameter (with values such as e.g. "unauthorized= _client") is part of the payload in certain error responses (which may also= contain "error_description" and "error_uri"), this is just mirroring behav= iour of OAuth.=0A= For the authz-info endpoint (5.8.2) no such parameters are specified in the= document (i.e. it just uses the response codes).=0A= Does this clarify the issue?=0A= =0A= Also, a few nits that could be treated as LC comments:=0A= =0A= There's a stray 'W' in Figure 7=0A= =0A= In Section 6.8: s/obsole/obsolete/, and s/profile/ace_profile/=0A= =0A= In Section 8.16 we removed the entire "Specifications are required for the= =0A= standards track range of point assignment[...]" bullet point. I think that= =0A= only the first two sentences of that bullet point were redundant with RFC= =0A= 8126, and the last two ("Specifications are needed for the first-come,=0A= first-serve range if they are expected [...]") reflected new requirements.= =0A= =0A= [LS] Does the " LC comments" part mean I should wait with updating the draf= t?=0A= =0A= /Ludwig=0A= From nobody Wed Nov 27 08:03:28 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B494120B94 for ; Wed, 27 Nov 2019 08:03:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lTKSVeW9gOLf for ; Wed, 27 Nov 2019 08:03:23 -0800 (PST) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680060.outbound.protection.outlook.com [40.107.68.60]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87279120B73 for ; Wed, 27 Nov 2019 08:03:21 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TSbAJweq9IQ/QRul9z05UPgh4Y4n47tkgoBYE1AoyNEC0lSBeFUw/3favtFtMHgm6bQHExA9kzUerx0q9H+0ki4cqa9woICiA8sebTbeWguvPnlcVlcaQf4nklZ/4NhG4XJtBugAWiRO2eQncrkTwFeNkLQa5Q00XifVbTBumMU4rAdUuNMbEk0wEVeWevblf0dGp3JDAO+B3HAxV1rVOgvtkzuyP4hZ2Q5cYb5Lh08blohx0moASWQP9f6hPu8RouY3aVIM4qR0nw4tVMjdgBKe1IW3aBlt+fWNdNXO7yECPFk8HuwD9iFqPZHS6ZQM3xpZIGux2LJekSJsgbb/Zg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S0CCQM9O5PBrsgSRd8aMt4BTQ7C2A3B3UteKZ/UEil0=; b=UXtEcnMKRULkdwaZ8tFVD/UKz1aQZe2iA9oJU5MIcPLWuufXC7fx8s5uDrI76VHXSfxXO39liaGCSg1TzW/Qq0j5nZyxUw4frI1KykJSWy2DevTfbLO7HEJr4epvT0kvIptG+OaWdRh7Q268eJKZ1nJApI8kEfDRODTdhD9N47ze+wy2oBU0RUVt5q303WKcqrVTNoZPdIQbpwQlmw4m0UmwiLauDbv44rZ0OvS17N++w0FXn/vuoaOXHIcaAv3JSY+dL5PGotaZokTJPr/vlYtpSlI/yWjE94zBRo/6rgzRGjDexf+NV28SuHhEgwDkz9khHB1kw2BuuKyIJNJOSQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S0CCQM9O5PBrsgSRd8aMt4BTQ7C2A3B3UteKZ/UEil0=; b=Wd7xJlj0epZw7YhnTkrovLaoxoP7YUXNcx3jvQbOn6pBc4kHBlbV23BoTfPS9gR2AhHNfjvLIh3MjRoMbl7yVwGmn+cHETjSlsergHqG2uneoDajknJWqAzTauIIb/h+imyX0XNOvJOIVbGh9oiyfUwP4yG6+O6ZVlbUdAkMHL0= Received: from CH2PR15MB3525.namprd15.prod.outlook.com (52.132.229.213) by CH2PR15MB3720.namprd15.prod.outlook.com (52.132.230.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.19; Wed, 27 Nov 2019 16:03:18 +0000 Received: from CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a]) by CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a%6]) with mapi id 15.20.2474.023; Wed, 27 Nov 2019 16:03:18 +0000 From: Daniel Migault To: Ludwig Seitz , Cigdem Sengul CC: "ace@ietf.org" Thread-Topic: [Ace] comment on draft-ietf-ace-oauth-authz-26 Thread-Index: AQHVoBODTRvmfj9LwkSkMn4vLe0h8aeU7P0AgAADQXCAAGtOAIAJs4cAgAAlMEA= Date: Wed, 27 Nov 2019 16:03:18 +0000 Message-ID: References: <93a0ac2d-6d00-ad7b-677c-4c44b77f91e0@ri.se> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [96.22.2.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 09ee6125-6f29-4d96-1e63-08d7735351c6 x-ms-traffictypediagnostic: CH2PR15MB3720: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(136003)(346002)(366004)(376002)(189003)(199004)(13464003)(51914003)(6436002)(66066001)(52536014)(102836004)(66446008)(6116002)(9686003)(3846002)(478600001)(305945005)(64756008)(53546011)(6306002)(229853002)(966005)(7736002)(66556008)(26005)(71200400001)(71190400001)(76116006)(44832011)(81166006)(6506007)(66476007)(186003)(74316002)(14444005)(6246003)(33656002)(256004)(8936002)(5660300002)(4326008)(55016002)(316002)(25786009)(11346002)(66946007)(446003)(8676002)(2906002)(7696005)(76176011)(81156014)(86362001)(14454004)(110136005)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:CH2PR15MB3720; H:CH2PR15MB3525.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: DFRcaxcLB5REcMPPRo6XtQiDKD1OBMnoCAGh0vLtVKnMvCf0VlE10JoUA3rGgXn2FnrTjjKaC3fqr47dJ/EkbZv7eOXRrpSA8BQhcu6sxGX/z7zAR3PKiseTfvjkFA93vOlr2sYtvqgm/VMKMMd63C46aaAfEaiu3eeNpCnWkB6UJWKt8XmMZVHaq1h45PdFz0N8L5NwpI5SkexIZh2obZLDj1rSmB1ROqLgfIi57gk0ckPtLE2TD1bW2Z1cg9LeqNH+kipO4hM80TFHGblDjCl18HsWuTyZsO+5tVbUcqY1CynkW1bcuyKe4IHCa/LuFIs/WQ1WMD2lCo19y+NKpEnUabOe4Hj5EiqCR0pXry/KQUZokqinOyLx845NUkyG8Mz99lZy0mTb1WiIp/gooTLHpdg5kU/U7PC4FEwkJAE4OFnzMsPgG/Aj7f3v+IgN+MUMdNZm6RRbxCKPEPOsGmn+GK+VefO6vqYtMY2jBgY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09ee6125-6f29-4d96-1e63-08d7735351c6 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 16:03:18.6223 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: VoSL25Ah4/x85ZShtWuW6U1DQmr5YesApBBXrOqgh09IId8138njH9pPIdGXwcRxzBrdr5pn+RKMxB6wrYUQAXVONi7hJt/r7DuxfpOyyKU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR15MB3720 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 16:03:26 -0000 Hi,=20 Just for clarification, as the one starting the thread, I believe that it i= s clear that draft-ietf-ace-oauth-authz-26 has no issue and can be moved f= orward.=20 Yours,=20 Daniel =20 -----Original Message----- From: Ludwig Seitz =20 Sent: Wednesday, November 27, 2019 8:36 AM To: Cigdem Sengul ; Daniel Migault Cc: ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 If you are using JSON-based interactions, I believe that the most straightf= orward way is to refer to RFC6749 for the error messages as you currently d= o. I don't find this confusing or problematic, but YMMV. /Ludwig ________________________________________ From: Cigdem Sengul Sent: Thursday, November 21, 2019 10:27 AM To: Daniel Migault Cc: Ludwig Seitz; ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 Hello, Ludwig, I agree that the current draft describes specifically for when CBOR= is used. When CBOR is not used, I have read it as it will act similar to Section 5.2= of [RFC6749] as you have = indicated also in the ace-oauth-authz document. Therefore, instead of an indirect reference to RFC6749 by referencing ace-o= auth-authz, we used a direct reference to explain what the error response s= hould be. Is this problematic? or confusing? I can reword in mqtt_tls draft something like: "As described in [ace-oauth-authz] the error responses for JSON-based inter= actions with AS follow RFC6749. When CBOR is used, the interactions MUST im= plement [ace-oauth-authz]" Would that help? Thanks, --Cigdem On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault > wrote: Hi Ludwig, Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document. What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine. Thanks! Daniel -----Original Message----- From: Ace > On Behalf Of = Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM To: ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 On 21/11/2019 03:29, Daniel Migault wrote: > Hi, > > This only concerns potential clarification of the text. > > While reviewing mqtt-profile draft I raised an issue regarding the=20 > reference for Oauth [RFC6749] while the remaining of the document=20 > references draft-ietf-ace-oauth-authz [1]. My reading of=20 > draft-ietf-ace-oauth-authz section 5.6.3=20 > >. > was the same of the one of mqtt-profile coauthors, that is error=20 > mandates the use of CBOR. Discussing this with others it seems a mis=20 > interpretation of draft-ietf-ace-oauth-authz section 5.6.3=20 > = [2]. > > I believe that is nice this is a mis-interpretation, but I would=20 > recommend that the text makes it more explicit the use of JSON is=20 > permitted. This seems to me a request to clarify the text. > > Yours, > Daniel > I would be happy to add more clarification, but I'm currently at a loss of = what that would be. Most of the bullets you cited already modify the MUSTs = with "...when CBOR is used" or something similar to the same effect. The id= ea was to express: You can use the vanilla OAuth interactions based on JSON= , but if you use CBOR then do it as specified here. I am happy to take suggestions. /Ludwig > [1] > """ > > In the case of an error, the AS returns error responses for HTTP- > based interactions as ASCII codes in JSON content, as defined in > Section 5.2 of RFC 6749 [RFC6749 ]. > > """ > > [2] > """ > > > 5.6.3 > . > Error Response > > > > The error responses for CoAP-based interactions with the AS are > generally equivalent to the ones for HTTP-based interactions as > defined inSection 5.2 of [RFC6749] , with the following exceptions: > > o When using CBOR the raw payload before being processed by the > communication security protocol MUST be encoded as a CBOR map. > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > MUST be used for all error responses, except for invalid_client > where a response code equivalent to the CoAP code 4.01 > (Unauthorized) MAY be used under the same conditions as specified > inSection 5.2 of [RFC6749] . > > o The Content-Format (for CoAP-based interactions) or media type > (for HTTP-based interactions) "application/ace+cbor" MUST be used > for the error response. > > o The parameters "error", "error_description" and "error_uri" MUST > be abbreviated using the codes specified in Figure 12, when a CBOR > encoding is used. > > o The error code (i.e., value of the "error" parameter) MUST be > abbreviated as specified in Figure 10, when a CBOR encoding is > used. > /------------------------+-------------\ > > | Name | CBOR Values | > |------------------------+-------------| > | invalid_request | 1 | > | invalid_client | 2 | > | invalid_grant | 3 | > | unauthorized_client | 4 | > | unsupported_grant_type | 5 | > | invalid_scope | 6 | > | unsupported_pop_key | 7 | > | incompatible_profiles | 8 | > \------------------------+-------------/ > > Figure 10: CBOR abbreviations for common error codes > > In addition to the error responses defined in OAuth 2.0, the > following behavior MUST be implemented by the AS: > > o If the client submits an asymmetric key in the token request that > the RS cannot process, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "unsupported_pop_key" defined in > Figure 10. > > o If the client and the RS it has requested an access token for do > not share a common profile, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "incompatible_profiles" defined in > Figure 10. > > """ > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > -- Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Wed Nov 27 08:10:52 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42A0E1209EA for ; Wed, 27 Nov 2019 08:10:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wj96Nsl0dYXK for ; Wed, 27 Nov 2019 08:10:49 -0800 (PST) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700050.outbound.protection.outlook.com [40.107.70.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8EFC120880 for ; Wed, 27 Nov 2019 08:10:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=en3Zwc66T0RiZj+tP8VXW4KoQzRf+w43zgh7wXJ6nYe71sth6tNKdRk2tZzM+X/UTNKuThCaz5s5tllqgEn/Zk56xfcWh8zLtQeT352fiMxUVxe5e5O1FYQiLY+bYY1DKu5zyxbd8TGYuutPlGDkXc+Cg5BJyt73GasLFZKnPbu52okDKY2IiN1xvAqZpaVNzkRrf3irm6fHwNPJJtb19qYpt1U4iBZrN5fMVplCGPGFemD9R+so8Aq8UpRiKD+PjNe/vNNhxWi6tlIKZ97NcIXGb/LxE2VaZ7bGC3zwE9IsaNqb7TODdTP1MVZvwCVZqmCIWK9niubHXVyC89FINA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T9BW/mrDUyNbKi3b7EL93300joc1oobx0Cm941y3i5A=; b=jfMnJasUu1qkaL3hPPXMM4ZSP/7P00Yesw0eDf7bT+cWGOy6NO2OuY0RM2P06YnxNYprT6WqMbNj3oqN0FtJiJIC+hGDc+xpaV7Ijndn1Kjt51i8/Ta75vCxt23nEPtshOhx0NMocuTPGqqQQGh/YyLdogqeET5R8GBeFutYxwSHlN90WFMVjGI67ow1Ta7BNTNZITdLTHSeTXxaviQHyNBhSA741hwJCAD1mAfAxvpJtGY2gN7mYeQyP/JkpbUcADfxAZ1Is4cRUKYS642B03RVVsXBjlysjAh56Pr3KEdLvl1s/v+gWubUh5vtC/tDepZCtm6yf1TVAnrbaIjdBA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T9BW/mrDUyNbKi3b7EL93300joc1oobx0Cm941y3i5A=; b=CrPZcCVfqhR8aplEcdSPrXFNUbVP/xY5NGsU52n3eiQHPnTj7bJadLifxfGLbenTGTvjHfIHlWV0VxzUplDbcwPXfTcAOc4LASPjBbHN3QlwKOc7ouXoc8GJLKhzo1NmvnTroooMg1sKnBZi887I479gqiaCw07c6G9Ykhsq7yU= Received: from CH2PR15MB3525.namprd15.prod.outlook.com (52.132.229.213) by CH2PR15MB3736.namprd15.prod.outlook.com (52.132.228.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2495.18; Wed, 27 Nov 2019 16:10:47 +0000 Received: from CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a]) by CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a%6]) with mapi id 15.20.2474.023; Wed, 27 Nov 2019 16:10:47 +0000 From: Daniel Migault To: Ludwig Seitz , Cigdem Sengul CC: "ace@ietf.org" Thread-Topic: [Ace] comment on draft-ietf-ace-mqtt-tls-profile Thread-Index: AdWlPG23pK78XDx2Rp+h3xjzCNBnvA== Date: Wed, 27 Nov 2019 16:10:47 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [96.22.2.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 999754a6-e3b0-4216-1eb6-08d773545d2b x-ms-traffictypediagnostic: CH2PR15MB3736: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(366004)(346002)(39860400002)(396003)(136003)(189003)(199004)(51914003)(13464003)(6306002)(66066001)(81156014)(81166006)(102836004)(14454004)(305945005)(316002)(478600001)(14444005)(966005)(7736002)(8676002)(9686003)(26005)(66556008)(66476007)(2906002)(66946007)(256004)(3846002)(71190400001)(76116006)(6436002)(55016002)(74316002)(44832011)(6116002)(53546011)(6506007)(64756008)(71200400001)(6246003)(8936002)(52536014)(33656002)(4326008)(66446008)(229853002)(99286004)(86362001)(110136005)(7696005)(25786009)(186003)(5660300002); DIR:OUT; SFP:1101; SCL:1; SRVR:CH2PR15MB3736; H:CH2PR15MB3525.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: l/Z+hfa7owGSVf7TNHLGiyAfjdxK+TFaSVykjUUqZxP5ovNxAsvTTd9R8bqOqi5yhmu228lflim3mg80yRhVj7OkC01uqEGxGguYbwCqYnKrSxma5JAoD5ip4rykqVgtIbcGzFG03St2YsVe86i6VeJ1TuVCUceQLkHcj+3IVojbGCFKjnYPHrTlGxrTMbsnBN2rFoTBrNc1PLW5eIoCPdW+FxYEvmBjcuBMjn3lxBAKdIDOE9TkQ0zx7ecD5qzEntc4IlE6iZNx7CjqGaWlWT+h6hcibdNh8P2isO6XAGyvQpp0Zt7U7Qiyej7eVUVZaEBOHa6DYUBFzErxAzMmphswHh0B+m3Hi0zSnXYD+2SvZrwQndSNkavAEkQlQ7m2+H1DqBF1bzqise5gC10AAFQa81CEGLdDEIGjwi3p1APKPjJvYra9JDxP/HPg8bgRlYA8JS/bEfiPtQhhahbcMKlCXZV5AazcpZ5QHd4BH14= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 999754a6-e3b0-4216-1eb6-08d773545d2b X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 16:10:47.1729 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ePT+eNosfiIlpy5SerDsUHuqU5aRh4pbfIa/01O4coD4F6ZslYGR1HZ2yhHZSTxlNsdNw/YMU3B5JNZp8FZkxC6SzL10sL0TJFZbQ/U5HQo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR15MB3736 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 16:10:51 -0000 Hi,=20 Changing the thread name.=20 If I were using CoAP/JSON, I think 6749 and ace-oauth-authz may have differ= ent error 4.00/4.01.=20 My interpretation is that I would recommend ace-oauth-authz would result in= implementation sending 4.00 and 4.01 while 6749 would always send 4.00. As= a result, I would rather recommend ace-oauth-authz. Am I missing something= ? Yours,=20 Daniel -----Original Message----- From: Daniel Migault=20 Sent: Wednesday, November 27, 2019 11:03 AM To: Ludwig Seitz ; Cigdem Sengul Cc: ace@ietf.org Subject: RE: [Ace] comment on draft-ietf-ace-oauth-authz-26 Hi,=20 Just for clarification, as the one starting the thread, I believe that it i= s clear that draft-ietf-ace-oauth-authz-26 has no issue and can be moved f= orward.=20 Yours, Daniel =20 -----Original Message----- From: Ludwig Seitz Sent: Wednesday, November 27, 2019 8:36 AM To: Cigdem Sengul ; Daniel Migault Cc: ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 If you are using JSON-based interactions, I believe that the most straightf= orward way is to refer to RFC6749 for the error messages as you currently d= o. I don't find this confusing or problematic, but YMMV. /Ludwig ________________________________________ From: Cigdem Sengul Sent: Thursday, November 21, 2019 10:27 AM To: Daniel Migault Cc: Ludwig Seitz; ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 Hello, Ludwig, I agree that the current draft describes specifically for when CBOR= is used. When CBOR is not used, I have read it as it will act similar to Section 5.2= of [RFC6749] as you have = indicated also in the ace-oauth-authz document. Therefore, instead of an indirect reference to RFC6749 by referencing ace-o= auth-authz, we used a direct reference to explain what the error response s= hould be. Is this problematic? or confusing? I can reword in mqtt_tls draft something like: "As described in [ace-oauth-authz] the error responses for JSON-based inter= actions with AS follow RFC6749. When CBOR is used, the interactions MUST im= plement [ace-oauth-authz]" Would that help? Thanks, --Cigdem On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault > wrote: Hi Ludwig, Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document. What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine. Thanks! Daniel -----Original Message----- From: Ace > On Behalf Of = Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM To: ace@ietf.org Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 On 21/11/2019 03:29, Daniel Migault wrote: > Hi, > > This only concerns potential clarification of the text. > > While reviewing mqtt-profile draft I raised an issue regarding the=20 > reference for Oauth [RFC6749] while the remaining of the document=20 > references draft-ietf-ace-oauth-authz [1]. My reading of=20 > draft-ietf-ace-oauth-authz section 5.6.3=20 > >. > was the same of the one of mqtt-profile coauthors, that is error=20 > mandates the use of CBOR. Discussing this with others it seems a mis=20 > interpretation of draft-ietf-ace-oauth-authz section 5.6.3=20 > = [2]. > > I believe that is nice this is a mis-interpretation, but I would=20 > recommend that the text makes it more explicit the use of JSON is=20 > permitted. This seems to me a request to clarify the text. > > Yours, > Daniel > I would be happy to add more clarification, but I'm currently at a loss of = what that would be. Most of the bullets you cited already modify the MUSTs = with "...when CBOR is used" or something similar to the same effect. The id= ea was to express: You can use the vanilla OAuth interactions based on JSON= , but if you use CBOR then do it as specified here. I am happy to take suggestions. /Ludwig > [1] > """ > > In the case of an error, the AS returns error responses for HTTP- > based interactions as ASCII codes in JSON content, as defined in > Section 5.2 of RFC 6749 [RFC6749 ]. > > """ > > [2] > """ > > > 5.6.3 > . > Error Response > > > > The error responses for CoAP-based interactions with the AS are > generally equivalent to the ones for HTTP-based interactions as > defined inSection 5.2 of [RFC6749] , with the following exceptions: > > o When using CBOR the raw payload before being processed by the > communication security protocol MUST be encoded as a CBOR map. > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > MUST be used for all error responses, except for invalid_client > where a response code equivalent to the CoAP code 4.01 > (Unauthorized) MAY be used under the same conditions as specified > inSection 5.2 of [RFC6749] . > > o The Content-Format (for CoAP-based interactions) or media type > (for HTTP-based interactions) "application/ace+cbor" MUST be used > for the error response. > > o The parameters "error", "error_description" and "error_uri" MUST > be abbreviated using the codes specified in Figure 12, when a CBOR > encoding is used. > > o The error code (i.e., value of the "error" parameter) MUST be > abbreviated as specified in Figure 10, when a CBOR encoding is > used. > /------------------------+-------------\ > > | Name | CBOR Values | > |------------------------+-------------| > | invalid_request | 1 | > | invalid_client | 2 | > | invalid_grant | 3 | > | unauthorized_client | 4 | > | unsupported_grant_type | 5 | > | invalid_scope | 6 | > | unsupported_pop_key | 7 | > | incompatible_profiles | 8 | > \------------------------+-------------/ > > Figure 10: CBOR abbreviations for common error codes > > In addition to the error responses defined in OAuth 2.0, the > following behavior MUST be implemented by the AS: > > o If the client submits an asymmetric key in the token request that > the RS cannot process, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "unsupported_pop_key" defined in > Figure 10. > > o If the client and the RS it has requested an access token for do > not share a common profile, the AS MUST reject that request with a > response code equivalent to the CoAP code 4.00 (Bad Request) > including the error code "incompatible_profiles" defined in > Figure 10. > > """ > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > -- Ludwig Seitz, PhD Security Lab, RISE Phone +46(0)70-349 92 51 _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Wed Nov 27 08:20:12 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E68C1201AA for ; Wed, 27 Nov 2019 08:20:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 65RGKyY6GKO6 for ; Wed, 27 Nov 2019 08:20:08 -0800 (PST) Received: from mail-qt1-x841.google.com (mail-qt1-x841.google.com [IPv6:2607:f8b0:4864:20::841]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B18BC12082B for ; Wed, 27 Nov 2019 08:20:07 -0800 (PST) Received: by mail-qt1-x841.google.com with SMTP id 59so20381890qtg.8 for ; Wed, 27 Nov 2019 08:20:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/nTMlhXVz9sVPLE6JvAgs/8+XNzso0I0/tWbkG8jK8I=; b=HcTBoHBufBzJpr+9TSavCRlsbfbtE0ZXaP+9VWDJ+vNSxzaf8p/dVXeiAbwWtIhAv8 YRI2yZogKNJsttmJhXTjsEvqcwsFukHzI1GnXbt6pDnt67jwqRS8bUK6p7itr+SSriml cO7ycREv13uBIEsaIvVtz4FofCmf5y5tTCAxVlOMT9soIJyAUI6LOGkwTYJekteE9kCu sZck9AQKMB+rY7tF/jn4GrZatPvOmj4JIhgZFc8N+puvRu2iR3V6Q8OooL/MYnmRbeML 7GaUddmim0jC6eOrdrYYxSJDcglbhr7BY9Owsj6M5WD68qu9biiRLLWhzkPlI7PIMQip h7IQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/nTMlhXVz9sVPLE6JvAgs/8+XNzso0I0/tWbkG8jK8I=; b=l4kzzpLEZ78AJ3SykUk/L46DsArTcbAUg75uPDqjc0ve6YCY57RNgNLory1aSUMVDT NpDrxvAnY06vWMlFs6YlBCc2WI/1qPOykJjxr//czXB4V6YiQkXDPSyehZGatg/oihsE af+FSvXVy4FIYMRjWlT1Jj00R4RkeNJLZXGBSAEqW3uaqCz5BqaEJYifgukEr0/oEZz9 T44+pSwSTnCmQa8hRsoiBkDyltcKr+ShMnZFPgOhCBmKyw6jnU+Ywmcz8noVUsC59LFe JdKzCfGNNL9ijm8zVvUVyP7EQetUDOjkJNnTyVQm9p9BUbzkdnnKhD9uG5/dEOu5rSmS tTpw== X-Gm-Message-State: APjAAAXgLPEas0NDep3FQmd1QFz6tQ5hwhq826uEH1EP6yCEqi1C4Oba JuKctucNTVJooSpGtQPoTAxCqc7RZkoSBWjec/0= X-Google-Smtp-Source: APXvYqzL1LI6zPtPMKhp7pPQcGr+1MFNwrOY6IRGyp+JmFk+rfJ/MZyuwjU7IsGlpa95fq83oB1gzhLUCd+QaDF1QDs= X-Received: by 2002:aed:2047:: with SMTP id 65mr24646206qta.78.1574871606683; Wed, 27 Nov 2019 08:20:06 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Cigdem Sengul Date: Wed, 27 Nov 2019 16:19:54 +0000 Message-ID: To: Daniel Migault Cc: Ludwig Seitz , "ace@ietf.org" Content-Type: multipart/alternative; boundary="000000000000aeeefd0598565efd" Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 16:20:11 -0000 --000000000000aeeefd0598565efd Content-Type: text/plain; charset="UTF-8" Hello Daniel, I am interpreting them as they are saying the same thing. Am I reading the following correctly? RFC 6749 defines the conditions under 401 can be returned: The authorization server responds with an HTTP 400 (Bad Request) status code (unless specified otherwise) invalid_client Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code and include the "WWW-Authenticate" response header field matching the authentication scheme used by the client. ietf-ace-oauth-authz says it follows the same conditions for 4.01 defined in RFC6749. A response code equivalent to the CoAP code 4.00 (Bad Request) MUST be used for all error responses, except for invalid_client where a response code equivalent to the CoAP code 4.01 (Unauthorized) MAY be used under the same conditions as specified in Section 5.2 of [RFC6749] . Thanks, --Cigdem On Wed, Nov 27, 2019 at 4:10 PM Daniel Migault wrote: > Hi, > > Changing the thread name. > > If I were using CoAP/JSON, I think 6749 and ace-oauth-authz may have > different error 4.00/4.01. > > My interpretation is that I would recommend ace-oauth-authz would result > in implementation sending 4.00 and 4.01 while 6749 would always send 4.00. > As a result, I would rather recommend ace-oauth-authz. Am I missing > something ? > > Yours, > Daniel > > -----Original Message----- > From: Daniel Migault > Sent: Wednesday, November 27, 2019 11:03 AM > To: Ludwig Seitz ; Cigdem Sengul < > cigdem.sengul@gmail.com> > Cc: ace@ietf.org > Subject: RE: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > Hi, > > Just for clarification, as the one starting the thread, I believe that it > is clear that draft-ietf-ace-oauth-authz-26 has no issue and can be moved > forward. > > Yours, > Daniel > > > > -----Original Message----- > From: Ludwig Seitz > Sent: Wednesday, November 27, 2019 8:36 AM > To: Cigdem Sengul ; Daniel Migault < > daniel.migault@ericsson.com> > Cc: ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > If you are using JSON-based interactions, I believe that the most > straightforward way is to refer to RFC6749 for the error messages as you > currently do. I don't find this confusing or problematic, but YMMV. > > /Ludwig > > ________________________________________ > From: Cigdem Sengul > Sent: Thursday, November 21, 2019 10:27 AM > To: Daniel Migault > Cc: Ludwig Seitz; ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > Hello, > > Ludwig, I agree that the current draft describes specifically for when > CBOR is used. > When CBOR is not used, I have read it as it will act similar to Section > 5.2 of [RFC6749] as you > have indicated also in the ace-oauth-authz document. > > Therefore, instead of an indirect reference to RFC6749 by referencing > ace-oauth-authz, we used a direct reference to explain what the error > response should be. > > Is this problematic? or confusing? > > I can reword in mqtt_tls draft something like: > "As described in [ace-oauth-authz] the error responses for JSON-based > interactions with AS follow RFC6749. When CBOR is used, the interactions > MUST implement [ace-oauth-authz]" > > Would that help? > > Thanks, > --Cigdem > > > > On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault 40ericsson..com@dmarc.ietf.org> > wrote: > Hi Ludwig, > > Thanks for the feed back. I was raising the issue before it got forgotten. > , and I must say I did not checked whether it had been addressed or not, as > I did not remember this had been raised for the ace-oauth-authz document. > > What you are saying is that the draft has been updated already. I will > have a closer look at it, and ask mqtt-profile to confirm the current text > is fine. > > Thanks! > Daniel > > -----Original Message----- > From: Ace > On Behalf > Of Ludwig Seitz > Sent: Thursday, November 21, 2019 10:51 AM > To: ace@ietf.org > Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26 > > On 21/11/2019 03:29, Daniel Migault wrote: > > Hi, > > > > This only concerns potential clarification of the text. > > > > While reviewing mqtt-profile draft I raised an issue regarding the > > reference for Oauth [RFC6749] while the remaining of the document > > references draft-ietf-ace-oauth-authz [1]. My reading of > > draft-ietf-ace-oauth-authz section 5.6.3 > > ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3< > http://ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>>. > > was the same of the one of mqtt-profile coauthors, that is error > > mandates the use of CBOR. Discussing this with others it seems a mis > > interpretation of draft-ietf-ace-oauth-authz section 5.6.3 > > > [2]. > > > > I believe that is nice this is a mis-interpretation, but I would > > recommend that the text makes it more explicit the use of JSON is > > permitted. This seems to me a request to clarify the text. > > > > Yours, > > Daniel > > > > I would be happy to add more clarification, but I'm currently at a loss of > what that would be. Most of the bullets you cited already modify the MUSTs > with "...when CBOR is used" or something similar to the same effect. The > idea was to express: You can use the vanilla OAuth interactions based on > JSON, but if you use CBOR then do it as specified here. > > I am happy to take suggestions. > > /Ludwig > > > [1] > > """ > > > > In the case of an error, the AS returns error responses for HTTP- > > based interactions as ASCII codes in JSON content, as defined in > > Section 5.2 of RFC 6749 < > https://tools.ietf.org/html/rfc6749#section-5.2> [RFC6749 < > https://tools.ietf.org/html/rfc6749>]. > > > > """ > > > > [2] > > """ > > > > > > 5.6.3 > > < > https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.3>. > > Error Response > > > > > > > > The error responses for CoAP-based interactions with the AS are > > generally equivalent to the ones for HTTP-based interactions as > > defined inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>, with the following > exceptions: > > > > o When using CBOR the raw payload before being processed by the > > communication security protocol MUST be encoded as a CBOR map. > > > > o A response code equivalent to the CoAP code 4.00 (Bad Request) > > MUST be used for all error responses, except for invalid_client > > where a response code equivalent to the CoAP code 4.01 > > (Unauthorized) MAY be used under the same conditions as specified > > inSection 5.2 of [RFC6749] < > https://tools.ietf.org/html/rfc6749#section-5.2>. > > > > o The Content-Format (for CoAP-based interactions) or media type > > (for HTTP-based interactions) "application/ace+cbor" MUST be used > > for the error response. > > > > o The parameters "error", "error_description" and "error_uri" MUST > > be abbreviated using the codes specified in Figure 12, when a CBOR > > encoding is used. > > > > o The error code (i.e., value of the "error" parameter) MUST be > > abbreviated as specified in Figure 10, when a CBOR encoding is > > used. > > /------------------------+-------------\ > > > > | Name | CBOR Values | > > |------------------------+-------------| > > | invalid_request | 1 | > > | invalid_client | 2 | > > | invalid_grant | 3 | > > | unauthorized_client | 4 | > > | unsupported_grant_type | 5 | > > | invalid_scope | 6 | > > | unsupported_pop_key | 7 | > > | incompatible_profiles | 8 | > > \------------------------+-------------/ > > > > Figure 10: CBOR abbreviations for common error codes > > > > In addition to the error responses defined in OAuth 2.0, the > > following behavior MUST be implemented by the AS: > > > > o If the client submits an asymmetric key in the token request that > > the RS cannot process, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "unsupported_pop_key" defined in > > Figure 10. > > > > o If the client and the RS it has requested an access token for do > > not share a common profile, the AS MUST reject that request with a > > response code equivalent to the CoAP code 4.00 (Bad Request) > > including the error code "incompatible_profiles" defined in > > Figure 10. > > > > """ > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > > > -- > Ludwig Seitz, PhD > Security Lab, RISE > Phone +46(0)70-349 92 51 > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000aeeefd0598565efd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Daniel,

I am interpreting them as= they are saying the same thing. Am I reading the following correctly?

RFC 6749 defines the conditions under 401 can be retur= ned:
The auth=
orization server responds with an HTTP 400 (Bad Request)
   status code (unless specified otherwise)
invalid_client
               Client authentication failed (e.g., unknown client, no
               client authentication included, or unsupported
               authentication method).  The authorization server MAY
               return an HTTP 401 (Unauthorized) status code to indicate
               which HTTP authentication schemes are supported.  If the
               client attempted to authenticate via the "Authorization=
"
               request header field, the authorization server MUST
               respond with an HTTP 401 (Unauthorized) status code and
               include the "WWW-Authenticate" response header fie=
ld
               matching the authentication scheme used by the client.
=


ietf-ace-oauth-authz says it follows =
the same conditions for 4.01 defined in RFC6749.
A response code equivalent to the CoAP code 4.00 (Bad =
Request)
      MUST be used for all error responses, except for invalid_client
      where a response code equivalent to the CoAP code 4.01
      (Unauthorized) MAY be used under the same conditions as specified
      in Sectio=
n=C2=A05.2 of [RFC6749].

Thanks,
--Cigdem

On Wed, Nov 27, 2019 at 4:10 PM Dani= el Migault <daniel.migaul= t@ericsson.com> wrote:
Hi,

Changing the thread name.

If I were using CoAP/JSON, I think 6749 and ace-oauth-authz may have differ= ent error 4.00/4.01.

My interpretation is that I would recommend ace-oauth-authz would result in= implementation sending 4.00 and 4.01 while 6749 would always send 4.00. As= a result, I would rather recommend ace-oauth-authz. Am I missing something= ?

Yours,
Daniel

-----Original Message-----
From: Daniel Migault
Sent: Wednesday, November 27, 2019 11:03 AM
To: Ludwig Seitz <ludwig.seitz@ri.se>; Cigdem Sengul <cigdem.sengul@gmail.com>
Cc: ace@ietf.org
Subject: RE: [Ace] comment on draft-ietf-ace-oauth-authz-26

Hi,

Just for clarification, as the one starting the thread, I believe that it i= s clear that=C2=A0 draft-ietf-ace-oauth-authz-26 has no issue and can be mo= ved forward.

Yours,
Daniel



-----Original Message-----
From: Ludwig Seitz <ludwig.seitz@ri.se>
Sent: Wednesday, November 27, 2019 8:36 AM
To: Cigdem Sengul <cigdem.sengul@gmail.com>; Daniel Migault <daniel.migault@ericsson.c= om>
Cc: ace@ietf.org
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

If you are using JSON-based interactions, I believe that the most straightf= orward way is to refer to RFC6749 for the error messages as you currently d= o. I don't find this confusing or problematic, but YMMV.

/Ludwig

________________________________________
From: Cigdem Sengul <cigdem.sengul@gmail.com>
Sent: Thursday, November 21, 2019 10:27 AM
To: Daniel Migault
Cc: Ludwig Seitz; ace@iet= f.org
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

Hello,

Ludwig, I agree that the current draft describes specifically for when CBOR= is used.
When CBOR is not used, I have read it as it will act similar to Section 5.2= of [RFC6749]<https://tools.ietf.org/html/rfc6749#= section-5.2> as you have indicated also in the ace-oauth-authz docum= ent.

Therefore, instead of an indirect reference to RFC6749 by referencing ace-o= auth-authz, we used a direct reference to explain what the error response s= hould be.

Is this problematic? or confusing?

I can reword in mqtt_tls draft something like:
"As described in [ace-oauth-authz] the error responses for JSON-based = interactions with AS follow RFC6749. When CBOR is used, the interactions MU= ST implement [ace-oauth-authz]"

Would that help?

Thanks,
--Cigdem



On Thu, Nov 21, 2019 at 3:06 AM Daniel Migault <daniel.migault=3D40ericsson..co= m@dmarc.ietf.org<mailto:40ericsson.com@dmarc.ietf.org>> wrote:
Hi Ludwig,

Thanks for the feed back. I was raising the issue before it got forgotten. = , and I must say I did not checked whether it had been addressed or not, as= I did not remember this had been raised for the ace-oauth-authz document.<= br>
What you are saying is that the draft has been updated already. I will have= a closer look at it, and ask mqtt-profile to confirm the current text is f= ine.

Thanks!
Daniel

-----Original Message-----
From: Ace <ace= -bounces@ietf.org<mailto:ace-bounces@ietf.org>> On Behalf Of Ludwig Seitz Sent: Thursday, November 21, 2019 10:51 AM
To: ace@ietf.org<m= ailto:ace@ietf.org>= ;
Subject: Re: [Ace] comment on draft-ietf-ace-oauth-authz-26

On 21/11/2019 03:29, Daniel Migault wrote:
> Hi,
>
> This only concerns potential clarification of the text.
>
> While reviewing mqtt-profile draft I raised an issue regarding the > reference for Oauth [RFC6749] while the remaining of the document
> references draft-ietf-ace-oauth-authz [1]. My reading of
> draft-ietf-ace-oauth-authz section 5.6.3
> <ht= tps://tools..ietf.org/html/draft= -ietf-ace-oauth-authz-26#section-5.6.3<http://ietf.org/html/draft-ietf-ace-oauth-authz-26#section-5.6.= 3>>.
> was the same of the one of mqtt-profile coauthors, that is error
> mandates the use of CBOR. Discussing this with others it seems a mis <= br> > interpretation of=C2=A0 draft-ietf-ace-oauth-authz section 5.6.3
> <https://tools.ietf.o= rg/html/draft-ietf-ace-oauth-authz-26#section-5.6.3> [2].
>
> I believe that is nice this is a mis-interpretation, but I would
> recommend that the text makes it more explicit the use of JSON is
> permitted. This seems to me a request to clarify the text.
>
> Yours,
> Daniel
>

I would be happy to add more clarification, but I'm currently at a loss= of what that would be. Most of the bullets you cited already modify the MU= STs with "...when CBOR is used" or something similar to the same = effect. The idea was to express: You can use the vanilla OAuth interactions= based on JSON, but if you use CBOR then do it as specified here.

I am happy to take suggestions.

/Ludwig

> [1]
> """
>
>=C2=A0 =C2=A0 =C2=A0In the case of an error, the AS returns error respo= nses for HTTP-
>=C2=A0 =C2=A0 =C2=A0based interactions as ASCII codes in JSON content, = as defined in
>=C2=A0 =C2=A0 =C2=A0Section 5.2 of RFC 6749=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>=C2=A0 [RFC6749= =C2=A0 <https://tools.ietf.org/html/rfc6749>].
>
> """
>
> [2]
> """
>
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A05.6.3
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-26#sect= ion-5.6.3>.
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Error Response
>
>
>
>=C2=A0 =C2=A0 =C2=A0The error responses for CoAP-based interactions wit= h the AS are
>=C2=A0 =C2=A0 =C2=A0generally equivalent to the ones for HTTP-based int= eractions as
>=C2=A0 =C2=A0 =C2=A0defined inSection 5.2 of [RFC6749]=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>, wi= th the following exceptions:
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 When using CBOR the raw payload before bein= g processed by the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 communication security protocol MUST be enc= oded as a CBOR map.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 A response code equivalent to the CoAP code= 4.00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 MUST be used for all error responses, excep= t for invalid_client
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 where a response code equivalent to the CoA= P code 4.01
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (Unauthorized) MAY be used under the same c= onditions as specified
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 inSection 5.2 of [RFC6749]=C2=A0 <https://tools.ietf.org/html/rfc6749#section-5.2>. >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The Content-Format (for CoAP-based interact= ions) or media type
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (for HTTP-based interactions) "applica= tion/ace+cbor" MUST be used
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 for the error response.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The parameters "error", "err= or_description" and "error_uri" MUST
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 be abbreviated using the codes specified in= Figure 12, when a CBOR
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 encoding is used.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 The error code (i.e., value of the "er= ror" parameter) MUST be
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 abbreviated as specified in Figure 10, when= a CBOR encoding is
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 used.
> /------------------------+-------------\
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Name=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| CBOR Values |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|----------------------= --+-------------|
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_request=C2=A0= =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 1=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_client=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 2=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_grant=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 3=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unauthorized_client= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 4=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_grant_typ= e |=C2=A0 =C2=A0 =C2=A0 5=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| invalid_scope=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 6=C2=A0 =C2=A0 =C2=A0 | >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| unsupported_pop_key= =C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 7=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| incompatible_profiles= =C2=A0 |=C2=A0 =C2=A0 =C2=A0 8=C2=A0 =C2=A0 =C2=A0 |
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0\----------------------= --+-------------/
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Figure 10: CBOR abbrevi= ations for common error codes
>
>=C2=A0 =C2=A0 =C2=A0In addition to the error responses defined in OAuth= 2.0, the
>=C2=A0 =C2=A0 =C2=A0following behavior MUST be implemented by the AS: >
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client submits an asymmetric key in = the token request that
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 the RS cannot process, the AS MUST reject t= hat request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "unsupported_= pop_key" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
>=C2=A0 =C2=A0 =C2=A0o=C2=A0 If the client and the RS it has requested a= n access token for do
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 not share a common profile, the AS MUST rej= ect that request with a
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 response code equivalent to the CoAP code 4= .00 (Bad Request)
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 including the error code "incompatible= _profiles" defined in
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 Figure 10.
>
> """
>
> _______________________________________________
> Ace mailing list
> Ace@ietf.org<= mailto:Ace@ietf.org&g= t;
> https://www.ietf.org/mailman/listinfo/ace
>


--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
Ace mailing list
Ace@ietf.org<mailt= o:Ace@ietf.org> https://www.ietf.org/mailman/listinfo/ace
--000000000000aeeefd0598565efd-- From nobody Wed Nov 27 08:32:57 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 482791209EF for ; Wed, 27 Nov 2019 08:32:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nExWXoSdgkwR for ; Wed, 27 Nov 2019 08:32:53 -0800 (PST) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700040.outbound.protection.outlook.com [40.107.70.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18EF6120974 for ; Wed, 27 Nov 2019 08:32:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XJUovSI8hAl3HFNlYuQy+iIogktMdNLFZV31U+JRHNrHRrHYdeV2O1Mzywd8M6HnhOXnHU2ulPOvFvv2fUVm8JDxXDBv1Y20ppG4c7JLrzzNN08vL/u2cOyM1OgkDnkfZPyv5ZlsQLVi19Qa1j3nmUc32IQ1yiFURx+0r4P1p5dRF9uOZjMrqJHiNUSSzDZzovZnlbKFUKFepOa3XJm/xd8SoxqCvGmwF1GOzTdnEL3AmC+6wwvfAam6VC5m4a91/i4stLuU7JH/ZPsx0Cj0Ofskz6QgFvVjNYNO+Ay83zR45R5oYbA4V/e6nxwi+Yb4NDVZRPtNQ2AccmR5muxshA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zn8YgKsW0cPYQnGHJutbc1qnqgtwJ+ageEBbX34pVxE=; b=d2ocoskZSg4sXjamd4L4eunNx19cI9G6qlwxpFstKY+DCxSEefa6TFWzXVUMNbu4fu6o8LA8jTJfgHKrF+OO54jZ++Hgz5Wmg7OALTJ3co7gzjIavVHBaImDA45fvHRtKtdVPLgRvJYkGA+hgIx7goA35hKqbEJ4FjZ8JjOm8nOonnmNdXDS2HWJZxZNrTEHtW7AABKMeNLiJV+W+Yuab9WwH8aNRaJ/uoPpQ6K1BgrKpZ+inuqG83EZkMXyjo9/nnXFLBa9s3Ooe+/zLwoIH2/oF1jOYOAWhLfL60HJ6myA3+I9BMMfJkunRAyMeq0D4GaMlybb0r7zsw+/0OcqKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zn8YgKsW0cPYQnGHJutbc1qnqgtwJ+ageEBbX34pVxE=; b=tWNJY5UW2kgRlrA1nlpBLuuLNxnoYSrbu/yPe9E+8gSfqctuE63a4Dye/uE3cF39f3NUN5XQNSFItps9/glo3+B4YG8xhWhCSLlU8ITnIn5FlWu7NdON1ly6SIGGV6kO5wPELsDKC4j67Qz4BhPBsjT5DMt6NNhX84QNRi5OInA= Received: from CH2PR15MB3525.namprd15.prod.outlook.com (52.132.229.213) by CH2PR15MB3640.namprd15.prod.outlook.com (52.132.228.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.21; Wed, 27 Nov 2019 16:32:51 +0000 Received: from CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a]) by CH2PR15MB3525.namprd15.prod.outlook.com ([fe80::2c0a:15a6:920c:77a%6]) with mapi id 15.20.2474.023; Wed, 27 Nov 2019 16:32:51 +0000 From: Daniel Migault To: Cigdem Sengul CC: Ludwig Seitz , "ace@ietf.org" Thread-Topic: [Ace] comment on draft-ietf-ace-mqtt-tls-profile Thread-Index: AdWlPG23pK78XDx2Rp+h3xjzCNBnvAAAhLMAAABkbSA= Date: Wed, 27 Nov 2019 16:32:50 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [96.22.2.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c90fc41c-c832-46ff-a721-08d773577256 x-ms-traffictypediagnostic: CH2PR15MB3640: x-ms-exchange-purlcount: 6 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(346002)(376002)(136003)(366004)(39860400002)(189003)(199004)(13464003)(51914003)(8676002)(52536014)(64756008)(66446008)(76116006)(14444005)(102836004)(7696005)(25786009)(790700001)(9686003)(33656002)(6916009)(316002)(236005)(99286004)(6116002)(256004)(2906002)(71200400001)(71190400001)(446003)(44832011)(26005)(7736002)(76176011)(11346002)(81166006)(74316002)(86362001)(229853002)(6306002)(478600001)(6506007)(54896002)(66066001)(5660300002)(8936002)(54906003)(6436002)(6246003)(966005)(14454004)(81156014)(66946007)(3846002)(55016002)(606006)(53546011)(66556008)(66476007)(186003)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:CH2PR15MB3640; H:CH2PR15MB3525.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: QoM3i/XWr+7R+I64nEKQQCQiSOiiKVwseWCaCJpYZqgoMvunKYdhsS/ukFLh9DqjqEUt2ctVIeqmvsH9ZNRReccDhXL4Mc583tYrmA6do9DYxbXJWj3+NicjueiKibkFSau3XfMjrhLAECDIlxLqGjs+2zxV720y0fo6aLGfVOYfxp73Yf1F7i5sZO/Xk2Kpw8Leib/DgHW6HHowuUEHRBtoxrAUAiRROFL9SB94hf5eYG1GpN8fIyMug151mPG/7iol290xVvo5LGMqbdKKvr+1bGL1Fvt7vkd04sIHp2Ny5c0m0tfzHmj77uKzQbDuSpfgZ8tWEenzqLOzcp+m+f6DwDxhXCgh1RvzL6J/XlL3fh4dfGXHhwTGl+Y+z+bw1vLW3/TmDGxPI1Wx5oVTJQuP/h76TlDEMVKFNoFnuNqgDMFLGiHaBAEyGRDCEI1jpJJmpMFHX43rIaBcbsa3rrETOqOUgOgKBKidmD6iypc= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR15MB3525A28BC3CDE46C51B7ADD5E3440CH2PR15MB3525namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: c90fc41c-c832-46ff-a721-08d773577256 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Nov 2019 16:32:50.9987 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1yQmLTXripwTEjg0TKNVUOLcmcZ4IbtBVPMa2r4R+3gvV6pvTtySLahoe4VWqzGe+BMzFebS7JVFK8/SHzD66q8MnzUv6L3SLpn7EfJTZ1c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR15MB3640 Archived-At: Subject: Re: [Ace] comment on draft-ietf-ace-mqtt-tls-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Nov 2019 16:32:56 -0000 --_000_CH2PR15MB3525A28BC3CDE46C51B7ADD5E3440CH2PR15MB3525namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzLCBJIHByb2JhYmx5IHJlYWQgdG8gcXVpY2tseSwgc28gdGhleSBhcmUg4oCcY2xlYXJs eeKAnSBlcXVpdmFsZW50LiBJIGFtIGZpbmUgd2l0aCB0aGUgdGV4dCB5b3UgcHJvcG9zZWQsIHRo YXQgaXMgb25seSBzcGVjaWZ5aW5nIENCT1IuDQoNClRoYW5rcyENCllvdXJzLA0KRGFuaWVsDQoN Cg0KRnJvbTogQ2lnZGVtIFNlbmd1bCA8Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb20+DQpTZW50OiBX ZWRuZXNkYXksIE5vdmVtYmVyIDI3LCAyMDE5IDExOjIwIEFNDQpUbzogRGFuaWVsIE1pZ2F1bHQg PGRhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbT4NCkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZy5z ZWl0ekByaS5zZT47IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtBY2VdIGNvbW1lbnQgb24g ZHJhZnQtaWV0Zi1hY2UtbXF0dC10bHMtcHJvZmlsZQ0KDQpIZWxsbyBEYW5pZWwsDQoNCkkgYW0g aW50ZXJwcmV0aW5nIHRoZW0gYXMgdGhleSBhcmUgc2F5aW5nIHRoZSBzYW1lIHRoaW5nLiBBbSBJ IHJlYWRpbmcgdGhlIGZvbGxvd2luZyBjb3JyZWN0bHk/DQoNClJGQyA2NzQ5IGRlZmluZXMgdGhl IGNvbmRpdGlvbnMgdW5kZXIgNDAxIGNhbiBiZSByZXR1cm5lZDoNCg0KVGhlIGF1dGhvcml6YXRp b24gc2VydmVyIHJlc3BvbmRzIHdpdGggYW4gSFRUUCA0MDAgKEJhZCBSZXF1ZXN0KQ0KDQogICBz dGF0dXMgY29kZSAodW5sZXNzIHNwZWNpZmllZCBvdGhlcndpc2UpDQoNCmludmFsaWRfY2xpZW50 DQoNCiAgICAgICAgICAgICAgIENsaWVudCBhdXRoZW50aWNhdGlvbiBmYWlsZWQgKGUuZy4sIHVu a25vd24gY2xpZW50LCBubw0KDQogICAgICAgICAgICAgICBjbGllbnQgYXV0aGVudGljYXRpb24g aW5jbHVkZWQsIG9yIHVuc3VwcG9ydGVkDQoNCiAgICAgICAgICAgICAgIGF1dGhlbnRpY2F0aW9u IG1ldGhvZCkuICBUaGUgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgTUFZDQoNCiAgICAgICAgICAgICAg IHJldHVybiBhbiBIVFRQIDQwMSAoVW5hdXRob3JpemVkKSBzdGF0dXMgY29kZSB0byBpbmRpY2F0 ZQ0KDQogICAgICAgICAgICAgICB3aGljaCBIVFRQIGF1dGhlbnRpY2F0aW9uIHNjaGVtZXMgYXJl IHN1cHBvcnRlZC4gIElmIHRoZQ0KDQogICAgICAgICAgICAgICBjbGllbnQgYXR0ZW1wdGVkIHRv IGF1dGhlbnRpY2F0ZSB2aWEgdGhlICJBdXRob3JpemF0aW9uIg0KDQogICAgICAgICAgICAgICBy ZXF1ZXN0IGhlYWRlciBmaWVsZCwgdGhlIGF1dGhvcml6YXRpb24gc2VydmVyIE1VU1QNCg0KICAg ICAgICAgICAgICAgcmVzcG9uZCB3aXRoIGFuIEhUVFAgNDAxIChVbmF1dGhvcml6ZWQpIHN0YXR1 cyBjb2RlIGFuZA0KDQogICAgICAgICAgICAgICBpbmNsdWRlIHRoZSAiV1dXLUF1dGhlbnRpY2F0 ZSIgcmVzcG9uc2UgaGVhZGVyIGZpZWxkDQoNCiAgICAgICAgICAgICAgIG1hdGNoaW5nIHRoZSBh dXRoZW50aWNhdGlvbiBzY2hlbWUgdXNlZCBieSB0aGUgY2xpZW50Lg0KDQoNCg0KaWV0Zi1hY2Ut b2F1dGgtYXV0aHogc2F5cyBpdCBmb2xsb3dzIHRoZSBzYW1lIGNvbmRpdGlvbnMgZm9yIDQuMDEg ZGVmaW5lZCBpbiBSRkM2NzQ5Lg0KDQpBIHJlc3BvbnNlIGNvZGUgZXF1aXZhbGVudCB0byB0aGUg Q29BUCBjb2RlIDQuMDAgKEJhZCBSZXF1ZXN0KQ0KDQogICAgICBNVVNUIGJlIHVzZWQgZm9yIGFs bCBlcnJvciByZXNwb25zZXMsIGV4Y2VwdCBmb3IgaW52YWxpZF9jbGllbnQNCg0KICAgICAgd2hl cmUgYSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAxDQoNCiAg ICAgIChVbmF1dGhvcml6ZWQpIE1BWSBiZSB1c2VkIHVuZGVyIHRoZSBzYW1lIGNvbmRpdGlvbnMg YXMgc3BlY2lmaWVkDQoNCiAgICAgIGluIFNlY3Rpb24gNS4yIG9mIFtSRkM2NzQ5XTxodHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMj4uDQoNCg0KDQpUaGFua3Ms DQoNCi0tQ2lnZGVtDQoNCk9uIFdlZCwgTm92IDI3LCAyMDE5IGF0IDQ6MTAgUE0gRGFuaWVsIE1p Z2F1bHQgPGRhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbTxtYWlsdG86ZGFuaWVsLm1pZ2F1bHRA ZXJpY3Nzb24uY29tPj4gd3JvdGU6DQpIaSwNCg0KQ2hhbmdpbmcgdGhlIHRocmVhZCBuYW1lLg0K DQpJZiBJIHdlcmUgdXNpbmcgQ29BUC9KU09OLCBJIHRoaW5rIDY3NDkgYW5kIGFjZS1vYXV0aC1h dXRoeiBtYXkgaGF2ZSBkaWZmZXJlbnQgZXJyb3IgNC4wMC80LjAxLg0KDQpNeSBpbnRlcnByZXRh dGlvbiBpcyB0aGF0IEkgd291bGQgcmVjb21tZW5kIGFjZS1vYXV0aC1hdXRoeiB3b3VsZCByZXN1 bHQgaW4gaW1wbGVtZW50YXRpb24gc2VuZGluZyA0LjAwIGFuZCA0LjAxIHdoaWxlIDY3NDkgd291 bGQgYWx3YXlzIHNlbmQgNC4wMC4gQXMgYSByZXN1bHQsIEkgd291bGQgcmF0aGVyIHJlY29tbWVu ZCBhY2Utb2F1dGgtYXV0aHouIEFtIEkgbWlzc2luZyBzb21ldGhpbmcgPw0KDQpZb3VycywNCkRh bmllbA0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogRGFuaWVsIE1pZ2F1bHQN ClNlbnQ6IFdlZG5lc2RheSwgTm92ZW1iZXIgMjcsIDIwMTkgMTE6MDMgQU0NClRvOiBMdWR3aWcg U2VpdHogPGx1ZHdpZy5zZWl0ekByaS5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QHJpLnNlPj47IENp Z2RlbSBTZW5ndWwgPGNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPG1haWx0bzpjaWdkZW0uc2VuZ3Vs QGdtYWlsLmNvbT4+DQpDYzogYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJq ZWN0OiBSRTogW0FjZV0gY29tbWVudCBvbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNg0K DQpIaSwNCg0KSnVzdCBmb3IgY2xhcmlmaWNhdGlvbiwgYXMgdGhlIG9uZSBzdGFydGluZyB0aGUg dGhyZWFkLCBJIGJlbGlldmUgdGhhdCBpdCBpcyBjbGVhciB0aGF0ICBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoei0yNiBoYXMgbm8gaXNzdWUgYW5kIGNhbiBiZSBtb3ZlZCBmb3J3YXJkLg0KDQpZ b3VycywNCkRhbmllbA0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEx1 ZHdpZyBTZWl0eiA8bHVkd2lnLnNlaXR6QHJpLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAcmkuc2U+ Pg0KU2VudDogV2VkbmVzZGF5LCBOb3ZlbWJlciAyNywgMjAxOSA4OjM2IEFNDQpUbzogQ2lnZGVt IFNlbmd1bCA8Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb208bWFpbHRvOmNpZ2RlbS5zZW5ndWxAZ21h aWwuY29tPj47IERhbmllbCBNaWdhdWx0IDxkYW5pZWwubWlnYXVsdEBlcmljc3Nvbi5jb208bWFp bHRvOmRhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbT4+DQpDYzogYWNlQGlldGYub3JnPG1haWx0 bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0FjZV0gY29tbWVudCBvbiBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoei0yNg0KDQpJZiB5b3UgYXJlIHVzaW5nIEpTT04tYmFzZWQgaW50ZXJh Y3Rpb25zLCBJIGJlbGlldmUgdGhhdCB0aGUgbW9zdCBzdHJhaWdodGZvcndhcmQgd2F5IGlzIHRv IHJlZmVyIHRvIFJGQzY3NDkgZm9yIHRoZSBlcnJvciBtZXNzYWdlcyBhcyB5b3UgY3VycmVudGx5 IGRvLiBJIGRvbid0IGZpbmQgdGhpcyBjb25mdXNpbmcgb3IgcHJvYmxlbWF0aWMsIGJ1dCBZTU1W Lg0KDQovTHVkd2lnDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N CkZyb206IENpZ2RlbSBTZW5ndWwgPGNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPG1haWx0bzpjaWdk ZW0uc2VuZ3VsQGdtYWlsLmNvbT4+DQpTZW50OiBUaHVyc2RheSwgTm92ZW1iZXIgMjEsIDIwMTkg MTA6MjcgQU0NClRvOiBEYW5pZWwgTWlnYXVsdA0KQ2M6IEx1ZHdpZyBTZWl0ejsgYWNlQGlldGYu b3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0FjZV0gY29tbWVudCBvbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNg0KDQpIZWxsbywNCg0KTHVkd2lnLCBJIGFncmVl IHRoYXQgdGhlIGN1cnJlbnQgZHJhZnQgZGVzY3JpYmVzIHNwZWNpZmljYWxseSBmb3Igd2hlbiBD Qk9SIGlzIHVzZWQuDQpXaGVuIENCT1IgaXMgbm90IHVzZWQsIEkgaGF2ZSByZWFkIGl0IGFzIGl0 IHdpbGwgYWN0IHNpbWlsYXIgdG8gU2VjdGlvbiA1LjIgb2YgW1JGQzY3NDldPGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4yPiBhcyB5b3UgaGF2ZSBpbmRpY2F0 ZWQgYWxzbyBpbiB0aGUgYWNlLW9hdXRoLWF1dGh6IGRvY3VtZW50Lg0KDQpUaGVyZWZvcmUsIGlu c3RlYWQgb2YgYW4gaW5kaXJlY3QgcmVmZXJlbmNlIHRvIFJGQzY3NDkgYnkgcmVmZXJlbmNpbmcg YWNlLW9hdXRoLWF1dGh6LCB3ZSB1c2VkIGEgZGlyZWN0IHJlZmVyZW5jZSB0byBleHBsYWluIHdo YXQgdGhlIGVycm9yIHJlc3BvbnNlIHNob3VsZCBiZS4NCg0KSXMgdGhpcyBwcm9ibGVtYXRpYz8g b3IgY29uZnVzaW5nPw0KDQpJIGNhbiByZXdvcmQgaW4gbXF0dF90bHMgZHJhZnQgc29tZXRoaW5n IGxpa2U6DQoiQXMgZGVzY3JpYmVkIGluIFthY2Utb2F1dGgtYXV0aHpdIHRoZSBlcnJvciByZXNw b25zZXMgZm9yIEpTT04tYmFzZWQgaW50ZXJhY3Rpb25zIHdpdGggQVMgZm9sbG93IFJGQzY3NDku IFdoZW4gQ0JPUiBpcyB1c2VkLCB0aGUgaW50ZXJhY3Rpb25zIE1VU1QgaW1wbGVtZW50IFthY2Ut b2F1dGgtYXV0aHpdIg0KDQpXb3VsZCB0aGF0IGhlbHA/DQoNClRoYW5rcywNCi0tQ2lnZGVtDQoN Cg0KDQpPbiBUaHUsIE5vdiAyMSwgMjAxOSBhdCAzOjA2IEFNIERhbmllbCBNaWdhdWx0IDxkYW5p ZWwubWlnYXVsdD00MGVyaWNzc29uLi5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwZXJpY3Nz b24uLmNvbUBkbWFyYy5pZXRmLm9yZz48bWFpbHRvOjQwZXJpY3Nzb24uY29tQGRtYXJjLmlldGYu b3JnPG1haWx0bzo0MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZz4+PiB3cm90ZToNCkhpIEx1 ZHdpZywNCg0KVGhhbmtzIGZvciB0aGUgZmVlZCBiYWNrLiBJIHdhcyByYWlzaW5nIHRoZSBpc3N1 ZSBiZWZvcmUgaXQgZ290IGZvcmdvdHRlbi4gLCBhbmQgSSBtdXN0IHNheSBJIGRpZCBub3QgY2hl Y2tlZCB3aGV0aGVyIGl0IGhhZCBiZWVuIGFkZHJlc3NlZCBvciBub3QsIGFzIEkgZGlkIG5vdCBy ZW1lbWJlciB0aGlzIGhhZCBiZWVuIHJhaXNlZCBmb3IgdGhlIGFjZS1vYXV0aC1hdXRoeiBkb2N1 bWVudC4NCg0KV2hhdCB5b3UgYXJlIHNheWluZyBpcyB0aGF0IHRoZSBkcmFmdCBoYXMgYmVlbiB1 cGRhdGVkIGFscmVhZHkuIEkgd2lsbCBoYXZlIGEgY2xvc2VyIGxvb2sgYXQgaXQsIGFuZCBhc2sg bXF0dC1wcm9maWxlIHRvIGNvbmZpcm0gdGhlIGN1cnJlbnQgdGV4dCBpcyBmaW5lLg0KDQpUaGFu a3MhDQpEYW5pZWwNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEFjZSA8YWNl LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPjxtYWlsdG86YWNl LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4+IE9uIEJlaGFs ZiBPZiBMdWR3aWcgU2VpdHoNClNlbnQ6IFRodXJzZGF5LCBOb3ZlbWJlciAyMSwgMjAxOSAxMDo1 MSBBTQ0KVG86IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPjxtYWlsdG86YWNlQGll dGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtBY2VdIGNvbW1lbnQg b24gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHotMjYNCg0KT24gMjEvMTEvMjAxOSAwMzoyOSwg RGFuaWVsIE1pZ2F1bHQgd3JvdGU6DQo+IEhpLA0KPg0KPiBUaGlzIG9ubHkgY29uY2VybnMgcG90 ZW50aWFsIGNsYXJpZmljYXRpb24gb2YgdGhlIHRleHQuDQo+DQo+IFdoaWxlIHJldmlld2luZyBt cXR0LXByb2ZpbGUgZHJhZnQgSSByYWlzZWQgYW4gaXNzdWUgcmVnYXJkaW5nIHRoZQ0KPiByZWZl cmVuY2UgZm9yIE9hdXRoIFtSRkM2NzQ5XSB3aGlsZSB0aGUgcmVtYWluaW5nIG9mIHRoZSBkb2N1 bWVudA0KPiByZWZlcmVuY2VzIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IFsxXS4gTXkgcmVh ZGluZyBvZg0KPiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiBzZWN0aW9uIDUuNi4zDQo+IDxo dHRwczovL3Rvb2xzLi5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2 I3NlY3Rpb24tNS42LjM8aHR0cDovL2lldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHotMjYjc2VjdGlvbi01LjYuMz48aHR0cDovL2lldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMz4+Lg0KPiB3YXMgdGhlIHNhbWUgb2YgdGhl IG9uZSBvZiBtcXR0LXByb2ZpbGUgY29hdXRob3JzLCB0aGF0IGlzIGVycm9yDQo+IG1hbmRhdGVz IHRoZSB1c2Ugb2YgQ0JPUi4gRGlzY3Vzc2luZyB0aGlzIHdpdGggb3RoZXJzIGl0IHNlZW1zIGEg bWlzDQo+IGludGVycHJldGF0aW9uIG9mICBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiBzZWN0 aW9uIDUuNi4zDQo+IDxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHotMjYjc2VjdGlvbi01LjYuMz4gWzJdLg0KPg0KPiBJIGJlbGlldmUgdGhhdCBp cyBuaWNlIHRoaXMgaXMgYSBtaXMtaW50ZXJwcmV0YXRpb24sIGJ1dCBJIHdvdWxkDQo+IHJlY29t bWVuZCB0aGF0IHRoZSB0ZXh0IG1ha2VzIGl0IG1vcmUgZXhwbGljaXQgdGhlIHVzZSBvZiBKU09O IGlzDQo+IHBlcm1pdHRlZC4gVGhpcyBzZWVtcyB0byBtZSBhIHJlcXVlc3QgdG8gY2xhcmlmeSB0 aGUgdGV4dC4NCj4NCj4gWW91cnMsDQo+IERhbmllbA0KPg0KDQpJIHdvdWxkIGJlIGhhcHB5IHRv IGFkZCBtb3JlIGNsYXJpZmljYXRpb24sIGJ1dCBJJ20gY3VycmVudGx5IGF0IGEgbG9zcyBvZiB3 aGF0IHRoYXQgd291bGQgYmUuIE1vc3Qgb2YgdGhlIGJ1bGxldHMgeW91IGNpdGVkIGFscmVhZHkg bW9kaWZ5IHRoZSBNVVNUcyB3aXRoICIuLi53aGVuIENCT1IgaXMgdXNlZCIgb3Igc29tZXRoaW5n IHNpbWlsYXIgdG8gdGhlIHNhbWUgZWZmZWN0LiBUaGUgaWRlYSB3YXMgdG8gZXhwcmVzczogWW91 IGNhbiB1c2UgdGhlIHZhbmlsbGEgT0F1dGggaW50ZXJhY3Rpb25zIGJhc2VkIG9uIEpTT04sIGJ1 dCBpZiB5b3UgdXNlIENCT1IgdGhlbiBkbyBpdCBhcyBzcGVjaWZpZWQgaGVyZS4NCg0KSSBhbSBo YXBweSB0byB0YWtlIHN1Z2dlc3Rpb25zLg0KDQovTHVkd2lnDQoNCj4gWzFdDQo+ICIiIg0KPg0K PiAgICAgSW4gdGhlIGNhc2Ugb2YgYW4gZXJyb3IsIHRoZSBBUyByZXR1cm5zIGVycm9yIHJlc3Bv bnNlcyBmb3IgSFRUUC0NCj4gICAgIGJhc2VkIGludGVyYWN0aW9ucyBhcyBBU0NJSSBjb2RlcyBp biBKU09OIGNvbnRlbnQsIGFzIGRlZmluZWQgaW4NCj4gICAgIFNlY3Rpb24gNS4yIG9mIFJGQyA2 NzQ5ICA8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjI+ICBb UkZDNjc0OSAgPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5Pl0uDQo+DQo+ICIi Ig0KPg0KPiBbMl0NCj4gIiIiDQo+DQo+DQo+ICAgICAgICAgNS42LjMNCj4gICAgICAgICA8aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3Nl Y3Rpb24tNS42LjM+Lg0KPiAgICAgICAgIEVycm9yIFJlc3BvbnNlDQo+DQo+DQo+DQo+ICAgICBU aGUgZXJyb3IgcmVzcG9uc2VzIGZvciBDb0FQLWJhc2VkIGludGVyYWN0aW9ucyB3aXRoIHRoZSBB UyBhcmUNCj4gICAgIGdlbmVyYWxseSBlcXVpdmFsZW50IHRvIHRoZSBvbmVzIGZvciBIVFRQLWJh c2VkIGludGVyYWN0aW9ucyBhcw0KPiAgICAgZGVmaW5lZCBpblNlY3Rpb24gNS4yIG9mIFtSRkM2 NzQ5XSAgPGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4yPiwg d2l0aCB0aGUgZm9sbG93aW5nIGV4Y2VwdGlvbnM6DQo+DQo+ICAgICBvICBXaGVuIHVzaW5nIENC T1IgdGhlIHJhdyBwYXlsb2FkIGJlZm9yZSBiZWluZyBwcm9jZXNzZWQgYnkgdGhlDQo+ICAgICAg ICBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHByb3RvY29sIE1VU1QgYmUgZW5jb2RlZCBhcyBhIENC T1IgbWFwLg0KPg0KPiAgICAgbyAgQSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENv QVAgY29kZSA0LjAwIChCYWQgUmVxdWVzdCkNCj4gICAgICAgIE1VU1QgYmUgdXNlZCBmb3IgYWxs IGVycm9yIHJlc3BvbnNlcywgZXhjZXB0IGZvciBpbnZhbGlkX2NsaWVudA0KPiAgICAgICAgd2hl cmUgYSByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAxDQo+ICAg ICAgICAoVW5hdXRob3JpemVkKSBNQVkgYmUgdXNlZCB1bmRlciB0aGUgc2FtZSBjb25kaXRpb25z IGFzIHNwZWNpZmllZA0KPiAgICAgICAgaW5TZWN0aW9uIDUuMiBvZiBbUkZDNjc0OV0gIDxodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMj4uDQo+DQo+ICAgICBv ICBUaGUgQ29udGVudC1Gb3JtYXQgKGZvciBDb0FQLWJhc2VkIGludGVyYWN0aW9ucykgb3IgbWVk aWEgdHlwZQ0KPiAgICAgICAgKGZvciBIVFRQLWJhc2VkIGludGVyYWN0aW9ucykgImFwcGxpY2F0 aW9uL2FjZStjYm9yIiBNVVNUIGJlIHVzZWQNCj4gICAgICAgIGZvciB0aGUgZXJyb3IgcmVzcG9u c2UuDQo+DQo+ICAgICBvICBUaGUgcGFyYW1ldGVycyAiZXJyb3IiLCAiZXJyb3JfZGVzY3JpcHRp b24iIGFuZCAiZXJyb3JfdXJpIiBNVVNUDQo+ICAgICAgICBiZSBhYmJyZXZpYXRlZCB1c2luZyB0 aGUgY29kZXMgc3BlY2lmaWVkIGluIEZpZ3VyZSAxMiwgd2hlbiBhIENCT1INCj4gICAgICAgIGVu Y29kaW5nIGlzIHVzZWQuDQo+DQo+ICAgICBvICBUaGUgZXJyb3IgY29kZSAoaS5lLiwgdmFsdWUg b2YgdGhlICJlcnJvciIgcGFyYW1ldGVyKSBNVVNUIGJlDQo+ICAgICAgICBhYmJyZXZpYXRlZCBh cyBzcGVjaWZpZWQgaW4gRmlndXJlIDEwLCB3aGVuIGEgQ0JPUiBlbmNvZGluZyBpcw0KPiAgICAg ICAgdXNlZC4NCj4gLy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tXA0KPg0K PiAgICAgICAgICAgICB8IE5hbWUgICAgICAgICAgICAgICAgICAgfCBDQk9SIFZhbHVlcyB8DQo+ ICAgICAgICAgICAgIHwtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLXwNCj4g ICAgICAgICAgICAgfCBpbnZhbGlkX3JlcXVlc3QgICAgICAgIHwgICAgICAxICAgICAgfA0KPiAg ICAgICAgICAgICB8IGludmFsaWRfY2xpZW50ICAgICAgICAgfCAgICAgIDIgICAgICB8DQo+ICAg ICAgICAgICAgIHwgaW52YWxpZF9ncmFudCAgICAgICAgICB8ICAgICAgMyAgICAgIHwNCj4gICAg ICAgICAgICAgfCB1bmF1dGhvcml6ZWRfY2xpZW50ICAgIHwgICAgICA0ICAgICAgfA0KPiAgICAg ICAgICAgICB8IHVuc3VwcG9ydGVkX2dyYW50X3R5cGUgfCAgICAgIDUgICAgICB8DQo+ICAgICAg ICAgICAgIHwgaW52YWxpZF9zY29wZSAgICAgICAgICB8ICAgICAgNiAgICAgIHwNCj4gICAgICAg ICAgICAgfCB1bnN1cHBvcnRlZF9wb3Bfa2V5ICAgIHwgICAgICA3ICAgICAgfA0KPiAgICAgICAg ICAgICB8IGluY29tcGF0aWJsZV9wcm9maWxlcyAgfCAgICAgIDggICAgICB8DQo+ICAgICAgICAg ICAgIFwtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS8NCj4NCj4gICAgICAg ICAgICAgRmlndXJlIDEwOiBDQk9SIGFiYnJldmlhdGlvbnMgZm9yIGNvbW1vbiBlcnJvciBjb2Rl cw0KPg0KPiAgICAgSW4gYWRkaXRpb24gdG8gdGhlIGVycm9yIHJlc3BvbnNlcyBkZWZpbmVkIGlu IE9BdXRoIDIuMCwgdGhlDQo+ICAgICBmb2xsb3dpbmcgYmVoYXZpb3IgTVVTVCBiZSBpbXBsZW1l bnRlZCBieSB0aGUgQVM6DQo+DQo+ICAgICBvICBJZiB0aGUgY2xpZW50IHN1Ym1pdHMgYW4gYXN5 bW1ldHJpYyBrZXkgaW4gdGhlIHRva2VuIHJlcXVlc3QgdGhhdA0KPiAgICAgICAgdGhlIFJTIGNh bm5vdCBwcm9jZXNzLCB0aGUgQVMgTVVTVCByZWplY3QgdGhhdCByZXF1ZXN0IHdpdGggYQ0KPiAg ICAgICAgcmVzcG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4wMCAoQmFk IFJlcXVlc3QpDQo+ICAgICAgICBpbmNsdWRpbmcgdGhlIGVycm9yIGNvZGUgInVuc3VwcG9ydGVk X3BvcF9rZXkiIGRlZmluZWQgaW4NCj4gICAgICAgIEZpZ3VyZSAxMC4NCj4NCj4gICAgIG8gIElm IHRoZSBjbGllbnQgYW5kIHRoZSBSUyBpdCBoYXMgcmVxdWVzdGVkIGFuIGFjY2VzcyB0b2tlbiBm b3IgZG8NCj4gICAgICAgIG5vdCBzaGFyZSBhIGNvbW1vbiBwcm9maWxlLCB0aGUgQVMgTVVTVCBy ZWplY3QgdGhhdCByZXF1ZXN0IHdpdGggYQ0KPiAgICAgICAgcmVzcG9uc2UgY29kZSBlcXVpdmFs ZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4wMCAoQmFkIFJlcXVlc3QpDQo+ICAgICAgICBpbmNsdWRp bmcgdGhlIGVycm9yIGNvZGUgImluY29tcGF0aWJsZV9wcm9maWxlcyIgZGVmaW5lZCBpbg0KPiAg ICAgICAgRmlndXJlIDEwLg0KPg0KPiAiIiINCj4NCj4gX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCj4gQWNlIG1haWxpbmcgbGlzdA0KPiBBY2VAaWV0Zi5v cmc8bWFpbHRvOkFjZUBpZXRmLm9yZz48bWFpbHRvOkFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGll dGYub3JnPj4NCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCj4N Cg0KDQotLQ0KTHVkd2lnIFNlaXR6LCBQaEQNClNlY3VyaXR5IExhYiwgUklTRQ0KUGhvbmUgKzQ2 KDApNzAtMzQ5IDkyIDUxDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpBY2UgbWFpbGluZyBsaXN0DQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRm Lm9yZz48bWFpbHRvOkFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3JnPj4NCmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQo= --_000_CH2PR15MB3525A28BC3CDE46C51B7ADD5E3440CH2PR15MB3525namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxp Lm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsN Cgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uSFRNTFByZWZvcm1h dHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQi Ow0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGlu IDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVs dHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2Vu ZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoYW5rcywgSSBwcm9iYWJseSByZWFkIHRvIHF1aWNrbHksIHNvIHRoZXkgYXJlIOKAnGNsZWFy bHnigJ0gZXF1aXZhbGVudC4gSSBhbSBmaW5lIHdpdGggdGhlIHRleHQgeW91IHByb3Bvc2VkLCB0 aGF0IGlzIG9ubHkgc3BlY2lmeWluZyBDQk9SLg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRo YW5rcyE8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllvdXJzLCA8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRhbmllbDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206 PC9iPiBDaWdkZW0gU2VuZ3VsICZsdDtjaWdkZW0uc2VuZ3VsQGdtYWlsLmNvbSZndDsgPGJyPg0K PGI+U2VudDo8L2I+IFdlZG5lc2RheSwgTm92ZW1iZXIgMjcsIDIwMTkgMTE6MjAgQU08YnI+DQo8 Yj5Ubzo8L2I+IERhbmllbCBNaWdhdWx0ICZsdDtkYW5pZWwubWlnYXVsdEBlcmljc3Nvbi5jb20m Z3Q7PGJyPg0KPGI+Q2M6PC9iPiBMdWR3aWcgU2VpdHogJmx0O2x1ZHdpZy5zZWl0ekByaS5zZSZn dDs7IGFjZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0FjZV0gY29tbWVudCBv biBkcmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxlPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IZWxsbyBEYW5pZWwsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIGFtIGludGVycHJldGluZyB0aGVtIGFzIHRoZXkgYXJlIHNheWluZyB0aGUg c2FtZSB0aGluZy4gQW0gSSByZWFkaW5nIHRoZSBmb2xsb3dpbmcgY29ycmVjdGx5PzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SRkMgNjc0OSBk ZWZpbmVzIHRoZSBjb25kaXRpb25zIHVuZGVyIDQwMSBjYW4gYmUgcmV0dXJuZWQ6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6cGFnZSI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGUgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgcmVzcG9uZHMg d2l0aCBhbiBIVFRQIDQwMCAoQmFkIFJlcXVlc3QpPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IHN0YXR1cyBjb2RlICh1 bmxlc3Mgc3BlY2lmaWVkIG90aGVyd2lzZSk8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUg c3R5bGU9ImJyZWFrLWJlZm9yZTpwYWdlIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPmludmFs aWRfY2xpZW50PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IENsaWVudCBhdXRoZW50aWNhdGlv biBmYWlsZWQgKGUuZy4sIHVua25vd24gY2xpZW50LCBubzxvOnA+PC9vOnA+PC9zcGFuPjwvcHJl Pg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBjbGllbnQgYXV0aGVudGljYXRpb24gaW5jbHVkZWQsIG9yIHVuc3VwcG9ydGVkPG86cD48 L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGF1dGhlbnRpY2F0aW9uIG1ldGhvZCkuJm5ic3A7IFRoZSBh dXRob3JpemF0aW9uIHNlcnZlciBNQVk8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgcmV0dXJu IGFuIEhUVFAgNDAxIChVbmF1dGhvcml6ZWQpIHN0YXR1cyBjb2RlIHRvIGluZGljYXRlPG86cD48 L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHdoaWNoIEhUVFAgYXV0aGVudGljYXRpb24gc2NoZW1lcyBh cmUgc3VwcG9ydGVkLiZuYnNwOyBJZiB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgY2xp ZW50IGF0dGVtcHRlZCB0byBhdXRoZW50aWNhdGUgdmlhIHRoZSAmcXVvdDtBdXRob3JpemF0aW9u JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHJlcXVlc3QgaGVhZGVyIGZpZWxkLCB0 aGUgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgTVVTVDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBy ZXNwb25kIHdpdGggYW4gSFRUUCA0MDEgKFVuYXV0aG9yaXplZCkgc3RhdHVzIGNvZGUgYW5kPG86 cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGluY2x1ZGUgdGhlICZxdW90O1dXVy1BdXRoZW50aWNh dGUmcXVvdDsgcmVzcG9uc2UgaGVhZGVyIGZpZWxkPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IG1hdGNoaW5nIHRoZSBhdXRoZW50aWNhdGlvbiBzY2hlbWUgdXNlZCBieSB0aGUgY2xpZW50Ljxv OnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOnBhZ2UiPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6cGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPmlldGYtYWNlLW9hdXRoLWF1 dGh6IHNheXMgaXQgZm9sbG93cyB0aGUgc2FtZSBjb25kaXRpb25zIGZvciA0LjAxIGRlZmluZWQg aW4gUkZDNjc0OS48L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwv c3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTpwYWdlIj48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPkEgcmVzcG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUg NC4wMCAoQmFkIFJlcXVlc3QpPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE1VU1QgYmUg dXNlZCBmb3IgYWxsIGVycm9yIHJlc3BvbnNlcywgZXhjZXB0IGZvciBpbnZhbGlkX2NsaWVudDxv OnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB3aGVyZSBhIHJlc3BvbnNlIGNvZGUgZXF1aXZh bGVudCB0byB0aGUgQ29BUCBjb2RlIDQuMDE8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg KFVuYXV0aG9yaXplZCkgTUFZIGJlIHVzZWQgdW5kZXIgdGhlIHNhbWUgY29uZGl0aW9ucyBhcyBz cGVjaWZpZWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgaW4gPGEgaHJlZj0iaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjIiPlNlY3Rpb24mbmJzcDs1 LjIgb2YgW1JGQzY3NDldPC9hPi48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9 ImJyZWFrLWJlZm9yZTpwYWdlIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOnBhZ2UiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+VGhhbmtzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy ZSBzdHlsZT0iYnJlYWstYmVmb3JlOnBhZ2UiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+LS1D aWdkZW0gPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIFdlZCwgTm92IDI3LCAyMDE5IGF0IDQ6MTAgUE0gRGFuaWVsIE1pZ2F1 bHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkYW5pZWwubWlnYXVsdEBlcmljc3Nvbi5jb20iPmRhbmll bC5taWdhdWx0QGVyaWNzc29uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGksIDxicj4NCjxicj4NCkNo YW5naW5nIHRoZSB0aHJlYWQgbmFtZS4gPGJyPg0KPGJyPg0KSWYgSSB3ZXJlIHVzaW5nIENvQVAv SlNPTiwgSSB0aGluayA2NzQ5IGFuZCBhY2Utb2F1dGgtYXV0aHogbWF5IGhhdmUgZGlmZmVyZW50 IGVycm9yIDQuMDAvNC4wMS4NCjxicj4NCjxicj4NCk15IGludGVycHJldGF0aW9uIGlzIHRoYXQg SSB3b3VsZCByZWNvbW1lbmQgYWNlLW9hdXRoLWF1dGh6IHdvdWxkIHJlc3VsdCBpbiBpbXBsZW1l bnRhdGlvbiBzZW5kaW5nIDQuMDAgYW5kIDQuMDEgd2hpbGUgNjc0OSB3b3VsZCBhbHdheXMgc2Vu ZCA0LjAwLiBBcyBhIHJlc3VsdCwgSSB3b3VsZCByYXRoZXIgcmVjb21tZW5kIGFjZS1vYXV0aC1h dXRoei4gQW0gSSBtaXNzaW5nIHNvbWV0aGluZyA/PGJyPg0KPGJyPg0KWW91cnMsIDxicj4NCkRh bmllbDxicj4NCjxicj4NCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyPg0KRnJvbTogRGFu aWVsIE1pZ2F1bHQgPGJyPg0KU2VudDogV2VkbmVzZGF5LCBOb3ZlbWJlciAyNywgMjAxOSAxMTow MyBBTTxicj4NClRvOiBMdWR3aWcgU2VpdHogJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2Vp dHpAcmkuc2UiIHRhcmdldD0iX2JsYW5rIj5sdWR3aWcuc2VpdHpAcmkuc2U8L2E+Jmd0OzsgQ2ln ZGVtIFNlbmd1bCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNpZ2RlbS5zZW5ndWxAZ21haWwuY29tIiB0 YXJnZXQ9Il9ibGFuayI+Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb208L2E+Jmd0Ozxicj4NCkNjOiA8 YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlQGlldGYub3Jn PC9hPjxicj4NClN1YmplY3Q6IFJFOiBbQWNlXSBjb21tZW50IG9uIGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6LTI2PGJyPg0KPGJyPg0KSGksIDxicj4NCjxicj4NCkp1c3QgZm9yIGNsYXJpZmlj YXRpb24sIGFzIHRoZSBvbmUgc3RhcnRpbmcgdGhlIHRocmVhZCwgSSBiZWxpZXZlIHRoYXQgaXQg aXMgY2xlYXIgdGhhdCZuYnNwOyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNiBoYXMgbm8g aXNzdWUgYW5kIGNhbiBiZSBtb3ZlZCBmb3J3YXJkLg0KPGJyPg0KPGJyPg0KWW91cnMsPGJyPg0K RGFuaWVsPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08 YnI+DQpGcm9tOiBMdWR3aWcgU2VpdHogJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpA cmkuc2UiIHRhcmdldD0iX2JsYW5rIj5sdWR3aWcuc2VpdHpAcmkuc2U8L2E+Jmd0Ozxicj4NClNl bnQ6IFdlZG5lc2RheSwgTm92ZW1iZXIgMjcsIDIwMTkgODozNiBBTTxicj4NClRvOiBDaWdkZW0g U2VuZ3VsICZsdDs8YSBocmVmPSJtYWlsdG86Y2lnZGVtLnNlbmd1bEBnbWFpbC5jb20iIHRhcmdl dD0iX2JsYW5rIj5jaWdkZW0uc2VuZ3VsQGdtYWlsLmNvbTwvYT4mZ3Q7OyBEYW5pZWwgTWlnYXVs dCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmRhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbTwvYT4mZ3Q7PGJyPg0KQ2M6IDxh IGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8 L2E+PGJyPg0KU3ViamVjdDogUmU6IFtBY2VdIGNvbW1lbnQgb24gZHJhZnQtaWV0Zi1hY2Utb2F1 dGgtYXV0aHotMjY8YnI+DQo8YnI+DQpJZiB5b3UgYXJlIHVzaW5nIEpTT04tYmFzZWQgaW50ZXJh Y3Rpb25zLCBJIGJlbGlldmUgdGhhdCB0aGUgbW9zdCBzdHJhaWdodGZvcndhcmQgd2F5IGlzIHRv IHJlZmVyIHRvIFJGQzY3NDkgZm9yIHRoZSBlcnJvciBtZXNzYWdlcyBhcyB5b3UgY3VycmVudGx5 IGRvLiBJIGRvbid0IGZpbmQgdGhpcyBjb25mdXNpbmcgb3IgcHJvYmxlbWF0aWMsIGJ1dCBZTU1W Ljxicj4NCjxicj4NCi9MdWR3aWc8YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KRnJvbTogQ2lnZGVtIFNlbmd1bCAmbHQ7PGEgaHJlZj0ibWFp bHRvOmNpZ2RlbS5zZW5ndWxAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+Y2lnZGVtLnNlbmd1 bEBnbWFpbC5jb208L2E+Jmd0Ozxicj4NClNlbnQ6IFRodXJzZGF5LCBOb3ZlbWJlciAyMSwgMjAx OSAxMDoyNyBBTTxicj4NClRvOiBEYW5pZWwgTWlnYXVsdDxicj4NCkNjOiBMdWR3aWcgU2VpdHo7 IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5v cmc8L2E+PGJyPg0KU3ViamVjdDogUmU6IFtBY2VdIGNvbW1lbnQgb24gZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHotMjY8YnI+DQo8YnI+DQpIZWxsbyw8YnI+DQo8YnI+DQpMdWR3aWcsIEkgYWdy ZWUgdGhhdCB0aGUgY3VycmVudCBkcmFmdCBkZXNjcmliZXMgc3BlY2lmaWNhbGx5IGZvciB3aGVu IENCT1IgaXMgdXNlZC48YnI+DQpXaGVuIENCT1IgaXMgbm90IHVzZWQsIEkgaGF2ZSByZWFkIGl0 IGFzIGl0IHdpbGwgYWN0IHNpbWlsYXIgdG8gU2VjdGlvbiA1LjIgb2YgW1JGQzY3NDldJmx0Ozxh IGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4yIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlv bi01LjI8L2E+Jmd0OyBhcyB5b3UgaGF2ZSBpbmRpY2F0ZWQgYWxzbyBpbiB0aGUgYWNlLW9hdXRo LWF1dGh6DQogZG9jdW1lbnQuPGJyPg0KPGJyPg0KVGhlcmVmb3JlLCBpbnN0ZWFkIG9mIGFuIGlu ZGlyZWN0IHJlZmVyZW5jZSB0byBSRkM2NzQ5IGJ5IHJlZmVyZW5jaW5nIGFjZS1vYXV0aC1hdXRo eiwgd2UgdXNlZCBhIGRpcmVjdCByZWZlcmVuY2UgdG8gZXhwbGFpbiB3aGF0IHRoZSBlcnJvciBy ZXNwb25zZSBzaG91bGQgYmUuPGJyPg0KPGJyPg0KSXMgdGhpcyBwcm9ibGVtYXRpYz8gb3IgY29u ZnVzaW5nPzxicj4NCjxicj4NCkkgY2FuIHJld29yZCBpbiBtcXR0X3RscyBkcmFmdCBzb21ldGhp bmcgbGlrZTo8YnI+DQomcXVvdDtBcyBkZXNjcmliZWQgaW4gW2FjZS1vYXV0aC1hdXRoel0gdGhl IGVycm9yIHJlc3BvbnNlcyBmb3IgSlNPTi1iYXNlZCBpbnRlcmFjdGlvbnMgd2l0aCBBUyBmb2xs b3cgUkZDNjc0OS4gV2hlbiBDQk9SIGlzIHVzZWQsIHRoZSBpbnRlcmFjdGlvbnMgTVVTVCBpbXBs ZW1lbnQgW2FjZS1vYXV0aC1hdXRoel0mcXVvdDs8YnI+DQo8YnI+DQpXb3VsZCB0aGF0IGhlbHA/ PGJyPg0KPGJyPg0KVGhhbmtzLDxicj4NCi0tQ2lnZGVtPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0K T24gVGh1LCBOb3YgMjEsIDIwMTkgYXQgMzowNiBBTSBEYW5pZWwgTWlnYXVsdCAmbHQ7ZGFuaWVs Lm1pZ2F1bHQ9PGEgaHJlZj0ibWFpbHRvOjQwZXJpY3Nzb24uLmNvbUBkbWFyYy5pZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPjQwZXJpY3Nzb24uLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mbHQ7bWFp bHRvOjxhIGhyZWY9Im1haWx0bzo0MGVyaWNzc29uLmNvbUBkbWFyYy5pZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPjQwZXJpY3Nzb24uY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDsmZ3Q7DQogd3Jv dGU6PGJyPg0KSGkgTHVkd2lnLDxicj4NCjxicj4NClRoYW5rcyBmb3IgdGhlIGZlZWQgYmFjay4g SSB3YXMgcmFpc2luZyB0aGUgaXNzdWUgYmVmb3JlIGl0IGdvdCBmb3Jnb3R0ZW4uICwgYW5kIEkg bXVzdCBzYXkgSSBkaWQgbm90IGNoZWNrZWQgd2hldGhlciBpdCBoYWQgYmVlbiBhZGRyZXNzZWQg b3Igbm90LCBhcyBJIGRpZCBub3QgcmVtZW1iZXIgdGhpcyBoYWQgYmVlbiByYWlzZWQgZm9yIHRo ZSBhY2Utb2F1dGgtYXV0aHogZG9jdW1lbnQuPGJyPg0KPGJyPg0KV2hhdCB5b3UgYXJlIHNheWlu ZyBpcyB0aGF0IHRoZSBkcmFmdCBoYXMgYmVlbiB1cGRhdGVkIGFscmVhZHkuIEkgd2lsbCBoYXZl IGEgY2xvc2VyIGxvb2sgYXQgaXQsIGFuZCBhc2sgbXF0dC1wcm9maWxlIHRvIGNvbmZpcm0gdGhl IGN1cnJlbnQgdGV4dCBpcyBmaW5lLjxicj4NCjxicj4NClRoYW5rcyE8YnI+DQpEYW5pZWw8YnI+ DQo8YnI+DQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxicj4NCkZyb206IEFjZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlLWJv dW5jZXNAaWV0Zi5vcmc8L2E+Jmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86YWNlLWJvdW5jZXNA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2UtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7Jmd0 OyBPbiBCZWhhbGYgT2YgTHVkd2lnIFNlaXR6PGJyPg0KU2VudDogVGh1cnNkYXksIE5vdmVtYmVy IDIxLCAyMDE5IDEwOjUxIEFNPGJyPg0KVG86IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8L2E+Jmx0O21haWx0bzo8YSBocmVmPSJtYWls dG86YWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlQGlldGYub3JnPC9hPiZndDs8YnI+ DQpTdWJqZWN0OiBSZTogW0FjZV0gY29tbWVudCBvbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRo ei0yNjxicj4NCjxicj4NCk9uIDIxLzExLzIwMTkgMDM6MjksIERhbmllbCBNaWdhdWx0IHdyb3Rl Ojxicj4NCiZndDsgSGksPGJyPg0KJmd0Ozxicj4NCiZndDsgVGhpcyBvbmx5IGNvbmNlcm5zIHBv dGVudGlhbCBjbGFyaWZpY2F0aW9uIG9mIHRoZSB0ZXh0Ljxicj4NCiZndDs8YnI+DQomZ3Q7IFdo aWxlIHJldmlld2luZyBtcXR0LXByb2ZpbGUgZHJhZnQgSSByYWlzZWQgYW4gaXNzdWUgcmVnYXJk aW5nIHRoZSA8YnI+DQomZ3Q7IHJlZmVyZW5jZSBmb3IgT2F1dGggW1JGQzY3NDldIHdoaWxlIHRo ZSByZW1haW5pbmcgb2YgdGhlIGRvY3VtZW50IDxicj4NCiZndDsgcmVmZXJlbmNlcyBkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoeiBbMV0uIE15IHJlYWRpbmcgb2YgPGJyPg0KJmd0OyBkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoeiBzZWN0aW9uIDUuNi4zIDxicj4NCiZndDsgJmx0OzxhIGhyZWY9 Imh0dHBzOi8vdG9vbHMuIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy48L2E+LjxhIGhy ZWY9Imh0dHA6Ly9pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3Nl Y3Rpb24tNS42LjMiIHRhcmdldD0iX2JsYW5rIj5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjM8L2E+Jmx0OzxhIGhyZWY9Imh0dHA6Ly9pZXRm Lm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjMiIHRh cmdldD0iX2JsYW5rIj5odHRwOi8vaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoei0yNiNzZWN0aW9uLTUuNi4zPC9hPiZndDsmZ3Q7Ljxicj4NCiZndDsgd2FzIHRoZSBzYW1l IG9mIHRoZSBvbmUgb2YgbXF0dC1wcm9maWxlIGNvYXV0aG9ycywgdGhhdCBpcyBlcnJvciA8YnI+ DQomZ3Q7IG1hbmRhdGVzIHRoZSB1c2Ugb2YgQ0JPUi4gRGlzY3Vzc2luZyB0aGlzIHdpdGggb3Ro ZXJzIGl0IHNlZW1zIGEgbWlzIDxicj4NCiZndDsgaW50ZXJwcmV0YXRpb24gb2YmbmJzcDsgZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogc2VjdGlvbiA1LjYuMyA8YnI+DQomZ3Q7ICZsdDs8YSBo cmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHotMjYjc2VjdGlvbi01LjYuMyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNiNzZWN0aW9uLTUuNi4zPC9hPiZn dDsgWzJdLjxicj4NCiZndDs8YnI+DQomZ3Q7IEkgYmVsaWV2ZSB0aGF0IGlzIG5pY2UgdGhpcyBp cyBhIG1pcy1pbnRlcnByZXRhdGlvbiwgYnV0IEkgd291bGQgPGJyPg0KJmd0OyByZWNvbW1lbmQg dGhhdCB0aGUgdGV4dCBtYWtlcyBpdCBtb3JlIGV4cGxpY2l0IHRoZSB1c2Ugb2YgSlNPTiBpcyA8 YnI+DQomZ3Q7IHBlcm1pdHRlZC4gVGhpcyBzZWVtcyB0byBtZSBhIHJlcXVlc3QgdG8gY2xhcmlm eSB0aGUgdGV4dC48YnI+DQomZ3Q7PGJyPg0KJmd0OyBZb3Vycyw8YnI+DQomZ3Q7IERhbmllbDxi cj4NCiZndDs8YnI+DQo8YnI+DQpJIHdvdWxkIGJlIGhhcHB5IHRvIGFkZCBtb3JlIGNsYXJpZmlj YXRpb24sIGJ1dCBJJ20gY3VycmVudGx5IGF0IGEgbG9zcyBvZiB3aGF0IHRoYXQgd291bGQgYmUu IE1vc3Qgb2YgdGhlIGJ1bGxldHMgeW91IGNpdGVkIGFscmVhZHkgbW9kaWZ5IHRoZSBNVVNUcyB3 aXRoICZxdW90Oy4uLndoZW4gQ0JPUiBpcyB1c2VkJnF1b3Q7IG9yIHNvbWV0aGluZyBzaW1pbGFy IHRvIHRoZSBzYW1lIGVmZmVjdC4gVGhlIGlkZWEgd2FzIHRvIGV4cHJlc3M6IFlvdSBjYW4gdXNl IHRoZQ0KIHZhbmlsbGEgT0F1dGggaW50ZXJhY3Rpb25zIGJhc2VkIG9uIEpTT04sIGJ1dCBpZiB5 b3UgdXNlIENCT1IgdGhlbiBkbyBpdCBhcyBzcGVjaWZpZWQgaGVyZS48YnI+DQo8YnI+DQpJIGFt IGhhcHB5IHRvIHRha2Ugc3VnZ2VzdGlvbnMuPGJyPg0KPGJyPg0KL0x1ZHdpZzxicj4NCjxicj4N CiZndDsgWzFdPGJyPg0KJmd0OyAmcXVvdDsmcXVvdDsmcXVvdDs8YnI+DQomZ3Q7PGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7SW4gdGhlIGNhc2Ugb2YgYW4gZXJyb3IsIHRoZSBBUyByZXR1 cm5zIGVycm9yIHJlc3BvbnNlcyBmb3IgSFRUUC08YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJz cDtiYXNlZCBpbnRlcmFjdGlvbnMgYXMgQVNDSUkgY29kZXMgaW4gSlNPTiBjb250ZW50LCBhcyBk ZWZpbmVkIGluPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7U2VjdGlvbiA1LjIgb2YgUkZD IDY3NDkmbmJzcDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2 NzQ5I3NlY3Rpb24tNS4yIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL3JmYzY3NDkjc2VjdGlvbi01LjI8L2E+Jmd0OyZuYnNwOyBbUkZDNjc0OSZuYnNwOyAmbHQ7 PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OTwvYT4mZ3Q7XS48YnI+DQom Z3Q7PGJyPg0KJmd0OyAmcXVvdDsmcXVvdDsmcXVvdDs8YnI+DQomZ3Q7PGJyPg0KJmd0OyBbMl08 YnI+DQomZ3Q7ICZxdW90OyZxdW90OyZxdW90Ozxicj4NCiZndDs8YnI+DQomZ3Q7PGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDs1LjYuMzxicj4NCiZndDsmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Jmx0OzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yNiNzZWN0aW9uLTUuNi4zIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6LTI2I3NlY3Rpb24tNS42LjM8L2E+Jmd0Oy48YnI+DQomZ3Q7Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO0Vycm9yIFJlc3BvbnNlPGJyPg0KJmd0Ozxicj4NCiZn dDs8YnI+DQomZ3Q7PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7VGhlIGVycm9yIHJlc3Bv bnNlcyBmb3IgQ29BUC1iYXNlZCBpbnRlcmFjdGlvbnMgd2l0aCB0aGUgQVMgYXJlPGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7Z2VuZXJhbGx5IGVxdWl2YWxlbnQgdG8gdGhlIG9uZXMgZm9y IEhUVFAtYmFzZWQgaW50ZXJhY3Rpb25zIGFzPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7 ZGVmaW5lZCBpblNlY3Rpb24gNS4yIG9mIFtSRkM2NzQ5XSZuYnNwOyAmbHQ7PGEgaHJlZj0iaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY3NDkjc2VjdGlvbi01LjIiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMjwvYT4m Z3Q7LCB3aXRoIHRoZSBmb2xsb3dpbmcgZXhjZXB0aW9uczo8YnI+DQomZ3Q7PGJyPg0KJmd0OyZu YnNwOyAmbmJzcDsgJm5ic3A7byZuYnNwOyBXaGVuIHVzaW5nIENCT1IgdGhlIHJhdyBwYXlsb2Fk IGJlZm9yZSBiZWluZyBwcm9jZXNzZWQgYnkgdGhlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHByb3RvY29sIE1VU1QgYmUgZW5jb2Rl ZCBhcyBhIENCT1IgbWFwLjxicj4NCiZndDs8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDtv Jm5ic3A7IEEgcmVzcG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4wMCAo QmFkIFJlcXVlc3QpPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBNVVNUIGJl IHVzZWQgZm9yIGFsbCBlcnJvciByZXNwb25zZXMsIGV4Y2VwdCBmb3IgaW52YWxpZF9jbGllbnQ8 YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHdoZXJlIGEgcmVzcG9uc2UgY29k ZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4wMTxicj4NCiZndDsmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgKFVuYXV0aG9yaXplZCkgTUFZIGJlIHVzZWQgdW5kZXIgdGhlIHNhbWUg Y29uZGl0aW9ucyBhcyBzcGVjaWZpZWQ8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7IGluU2VjdGlvbiA1LjIgb2YgW1JGQzY3NDldJm5ic3A7ICZsdDs8YSBocmVmPSJodHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjc0OSNzZWN0aW9uLTUuMiIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM2NzQ5I3NlY3Rpb24tNS4yPC9hPiZndDsu PGJyPg0KJmd0Ozxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsgVGhlIENvbnRl bnQtRm9ybWF0IChmb3IgQ29BUC1iYXNlZCBpbnRlcmFjdGlvbnMpIG9yIG1lZGlhIHR5cGU8YnI+ DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IChmb3IgSFRUUC1iYXNlZCBpbnRlcmFj dGlvbnMpICZxdW90O2FwcGxpY2F0aW9uL2FjZSYjNDM7Y2JvciZxdW90OyBNVVNUIGJlIHVzZWQ8 YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGZvciB0aGUgZXJyb3IgcmVzcG9u c2UuPGJyPg0KJmd0Ozxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsgVGhlIHBh cmFtZXRlcnMgJnF1b3Q7ZXJyb3ImcXVvdDssICZxdW90O2Vycm9yX2Rlc2NyaXB0aW9uJnF1b3Q7 IGFuZCAmcXVvdDtlcnJvcl91cmkmcXVvdDsgTVVTVDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgYmUgYWJicmV2aWF0ZWQgdXNpbmcgdGhlIGNvZGVzIHNwZWNpZmllZCBpbiBG aWd1cmUgMTIsIHdoZW4gYSBDQk9SPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyBlbmNvZGluZyBpcyB1c2VkLjxicj4NCiZndDs8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJz cDtvJm5ic3A7IFRoZSBlcnJvciBjb2RlIChpLmUuLCB2YWx1ZSBvZiB0aGUgJnF1b3Q7ZXJyb3Im cXVvdDsgcGFyYW1ldGVyKSBNVVNUIGJlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyBhYmJyZXZpYXRlZCBhcyBzcGVjaWZpZWQgaW4gRmlndXJlIDEwLCB3aGVuIGEgQ0JPUiBl bmNvZGluZyBpczxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgdXNlZC48YnI+ DQomZ3Q7IC8tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0mIzQzOy0tLS0tLS0tLS0tLS1cPGJyPg0K Jmd0Ozxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDt8IE5hbWUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8IENCT1IgVmFsdWVzIHw8YnI+DQomZ3Q7Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fC0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLSYjNDM7LS0tLS0tLS0tLS0tLXw8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCBpbnZhbGlkX3JlcXVlc3QmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfCZuYnNwOyAmbmJzcDsgJm5ic3A7IDEmbmJzcDsgJm5ic3A7ICZuYnNw OyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwO3wgaW52YWxpZF9jbGllbnQmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCZu YnNwOyAmbmJzcDsgJm5ic3A7IDImbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgaW52YWxpZF9ncmFu dCZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCZuYnNwOyAmbmJzcDsgJm5ic3A7 IDMmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgdW5hdXRob3JpemVkX2NsaWVudCZuYnNwOyAmbmJz cDsgfCZuYnNwOyAmbmJzcDsgJm5ic3A7IDQmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3wgdW5zdXBw b3J0ZWRfZ3JhbnRfdHlwZSB8Jm5ic3A7ICZuYnNwOyAmbmJzcDsgNSZuYnNwOyAmbmJzcDsgJm5i c3A7IHw8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7fCBpbnZhbGlkX3Njb3BlJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8 Jm5ic3A7ICZuYnNwOyAmbmJzcDsgNiZuYnNwOyAmbmJzcDsgJm5ic3A7IHw8YnI+DQomZ3Q7Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fCB1bnN1cHBvcnRl ZF9wb3Bfa2V5Jm5ic3A7ICZuYnNwOyB8Jm5ic3A7ICZuYnNwOyAmbmJzcDsgNyZuYnNwOyAmbmJz cDsgJm5ic3A7IHw8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7fCBpbmNvbXBhdGlibGVfcHJvZmlsZXMmbmJzcDsgfCZuYnNwOyAmbmJzcDsg Jm5ic3A7IDgmbmJzcDsgJm5ic3A7ICZuYnNwOyB8PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1wtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0m IzQzOy0tLS0tLS0tLS0tLS0vPGJyPg0KJmd0Ozxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtGaWd1cmUgMTA6IENCT1IgYWJicmV2aWF0aW9u cyBmb3IgY29tbW9uIGVycm9yIGNvZGVzPGJyPg0KJmd0Ozxicj4NCiZndDsmbmJzcDsgJm5ic3A7 ICZuYnNwO0luIGFkZGl0aW9uIHRvIHRoZSBlcnJvciByZXNwb25zZXMgZGVmaW5lZCBpbiBPQXV0 aCAyLjAsIHRoZTxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwO2ZvbGxvd2luZyBiZWhhdmlv ciBNVVNUIGJlIGltcGxlbWVudGVkIGJ5IHRoZSBBUzo8YnI+DQomZ3Q7PGJyPg0KJmd0OyZuYnNw OyAmbmJzcDsgJm5ic3A7byZuYnNwOyBJZiB0aGUgY2xpZW50IHN1Ym1pdHMgYW4gYXN5bW1ldHJp YyBrZXkgaW4gdGhlIHRva2VuIHJlcXVlc3QgdGhhdDxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgdGhlIFJTIGNhbm5vdCBwcm9jZXNzLCB0aGUgQVMgTVVTVCByZWplY3QgdGhh dCByZXF1ZXN0IHdpdGggYTxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgcmVz cG9uc2UgY29kZSBlcXVpdmFsZW50IHRvIHRoZSBDb0FQIGNvZGUgNC4wMCAoQmFkIFJlcXVlc3Qp PGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBpbmNsdWRpbmcgdGhlIGVycm9y IGNvZGUgJnF1b3Q7dW5zdXBwb3J0ZWRfcG9wX2tleSZxdW90OyBkZWZpbmVkIGluPGJyPg0KJmd0 OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBGaWd1cmUgMTAuPGJyPg0KJmd0Ozxicj4NCiZn dDsmbmJzcDsgJm5ic3A7ICZuYnNwO28mbmJzcDsgSWYgdGhlIGNsaWVudCBhbmQgdGhlIFJTIGl0 IGhhcyByZXF1ZXN0ZWQgYW4gYWNjZXNzIHRva2VuIGZvciBkbzxicj4NCiZndDsmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgbm90IHNoYXJlIGEgY29tbW9uIHByb2ZpbGUsIHRoZSBBUyBNVVNU IHJlamVjdCB0aGF0IHJlcXVlc3Qgd2l0aCBhPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyByZXNwb25zZSBjb2RlIGVxdWl2YWxlbnQgdG8gdGhlIENvQVAgY29kZSA0LjAwIChC YWQgUmVxdWVzdCk8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGluY2x1ZGlu ZyB0aGUgZXJyb3IgY29kZSAmcXVvdDtpbmNvbXBhdGlibGVfcHJvZmlsZXMmcXVvdDsgZGVmaW5l ZCBpbjxicj4NCiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRmlndXJlIDEwLjxicj4N CiZndDs8YnI+DQomZ3Q7ICZxdW90OyZxdW90OyZxdW90Ozxicj4NCiZndDs8YnI+DQomZ3Q7IF9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyBB Y2UgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyA8YSBocmVmPSJtYWlsdG86QWNlQGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+QWNlQGlldGYub3JnPC9hPiZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRv OkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0K Jmd0OyA8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZSIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl PC9hPjxicj4NCiZndDs8YnI+DQo8YnI+DQo8YnI+DQotLTxicj4NCkx1ZHdpZyBTZWl0eiwgUGhE PGJyPg0KU2VjdXJpdHkgTGFiLCBSSVNFPGJyPg0KUGhvbmUgJiM0Mzs0NigwKTcwLTM0OSA5MiA1 MTxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fPGJyPg0KQWNlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBY2VAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+Jmx0O21haWx0bzo8YSBocmVmPSJt YWlsdG86QWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+QWNlQGlldGYub3JnPC9hPiZndDs8 YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZSIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9k eT4NCjwvaHRtbD4NCg== --_000_CH2PR15MB3525A28BC3CDE46C51B7ADD5E3440CH2PR15MB3525namp_-- From nobody Thu Nov 28 22:30:08 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD2EC120013 for ; Thu, 28 Nov 2019 22:30:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C72j_cxotZKc for ; Thu, 28 Nov 2019 22:30:05 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6A8812000F for ; Thu, 28 Nov 2019 22:30:04 -0800 (PST) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id xAT6U0ju008214 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 29 Nov 2019 01:30:02 -0500 Date: Thu, 28 Nov 2019 22:29:59 -0800 From: Benjamin Kaduk To: Ludwig Seitz Cc: "ace@ietf.org" Message-ID: <20191129062959.GW32847@mit.edu> References: <157430230677.769.6413870274615783065@ietfa.amsl.com> <20191125230411.GN32847@mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Nov 2019 06:30:07 -0000 On Wed, Nov 27, 2019 at 03:31:16PM +0000, Ludwig Seitz wrote: > Hi Ben, > > replies inline. > > /Ludwig > ________________________________________ > From: Benjamin Kaduk > Sent: Tuesday, November 26, 2019 12:04 AM > To: Ludwig Seitz > Cc: ace@ietf.org > Subject: Re: [Ace] I-D Action: draft-ietf-ace-oauth-authz-27.txt > > Hi Ludwig, > > On Thu, Nov 21, 2019 at 03:16:03AM +0100, Ludwig Seitz wrote: > > Hello ACE, > > > > turns out -26 didn't cover one of the items in Ben's review, namely the > > question of using Client introspection to determine token expiration as > > a lower bound for key expiration. Since the whole issue of Client > > introspection was contentious between OAuth experts, we decided to > > remove the text describing that option. This still leaves us with the > > two other options, so the problem is still covered. > > Thanks for all the updates! I'm just about ready to push the "request Last > Call" button, but wanted to check one thing first: > > Section 5.6.3 seems to limit the error responses to 4.00 and 4.01, but > Section 5.8.2 also talks about 4.03 and 4.05. I noticed because I was > checking Section 5.1.1's note about "unauthorized_client" error response against the > various options in 5.8.2, to see if we're internally consistent about when > we say to send errors vs. AS request creation hints. My recollection is > that we can have all three of a response code, error response (e.g., > "unauthorized_client"), and (our custom format of) response payload present > in the same response, so any potential conflict would be limited to just > the response code, but please correct me if I'm wrong about that. > > [LS] Section 5.6.3 describes the interaction with the token endpoint at the AS. There we mirrored the behaviour of OAuth error responses. > Section 5.8.2 describes the interaction with the newly defined authz-info endpoint at the RS. We decided that this warranted more detailed error responses, so that a client gets some hint on what went wrong when an access token is rejected by the RS. > This is why we have added the 4.03 and 4.05 messages. > Section 5.1.1 describes an access request to a resource at the RS (other than the authz-info endpoint) and has yet another different error behaviour. > For the token endpoint (5.6.3), the response code is part of the HTTP/CoAP header, while the "error" parameter (with values such as e.g. "unauthorized_client") is part of the payload in certain error responses (which may also contain "error_description" and "error_uri"), this is just mirroring behaviour of OAuth. > For the authz-info endpoint (5.8.2) no such parameters are specified in the document (i.e. it just uses the response codes). > Does this clarify the issue? It does; thanks for putting the pieces into the proper context for me. > Also, a few nits that could be treated as LC comments: > > There's a stray 'W' in Figure 7 > > In Section 6.8: s/obsole/obsolete/, and s/profile/ace_profile/ > > In Section 8.16 we removed the entire "Specifications are required for the > standards track range of point assignment[...]" bullet point. I think that > only the first two sentences of that bullet point were redundant with RFC > 8126, and the last two ("Specifications are needed for the first-come, > first-serve range if they are expected [...]") reflected new requirements. > > [LS] Does the " LC comments" part mean I should wait with updating the draft? It means you're free to wait, yes. (If you want to update anyway that's also fine.) -Ben From nobody Fri Nov 29 08:01:16 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB9F112094B for ; Fri, 29 Nov 2019 08:01:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uOWef9Iad7oa for ; Fri, 29 Nov 2019 08:01:11 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0626.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe46::626]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41364120949 for ; Fri, 29 Nov 2019 08:01:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kFtoU3H96pDN5NckBHrtovV0gp0OuPXhZFGJyEbR1JNhfl1LOkvYIHUZQE3dvznwqdjE5+gNlJr5PxQL6sQabbFo6oVMgS6+l9/4FvTaBZYnKGkBTxzUZay+nicTMAs4iBOmnJfD/VF+rodLAoX7lHbp0GkZJY8oC4Bk+GHyjkwT8uFwPSipw6AfM83GPmHo5tTOCgrd/5+emiwXDICXlg+ZNyps0WQ9T8qPD5w+UmtDxgvPcXbrfbFpSskoZoD5hiRezcXG3QXJOILRWyRtFdn37D579G8uPozcCPXrS18UOt6eacaBt7CYCFD9fnW2YBRwWfPKxo+YLi/b/DH6lw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AiLpny6k65JOrJ3KSvrYEwdelaIKZN4NMDiaRP62x7k=; b=ZpReo54zFxymF1KP1b/B2XkJuK8+jk9MOmZaEeZbS4U+LKpfoH4NCsoaMHqv7+FOayUkh3BySYwp6YmbgcikAOYtS5ZYQaIB0VG6/kvJEjx2J4pApGi+MGzZR9sXPpJFP1Tt2dvkoMzoMBjwbGmrQI5AkukfAUWID3XtrlT5V5IyMjKwdCQvkW6udDgQv5BTNTHrNOMO+u+C84C33rz3f1YirU2sOqGP50pMC7vUzMENw0jrDoYJGbktNSl4XW6GHuycdllSYV1naw5TRLz97xv4lu0QvPus3VGrlCrNRFWc9mfmhVPGpTzaN1uXF7gkRPf5ouOHyitjfoLJoH1ixA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AiLpny6k65JOrJ3KSvrYEwdelaIKZN4NMDiaRP62x7k=; b=YV+YeeuiBtcJOq4gBfFZdKJSv99/DSlxYQhuBOLyvJi7ZhZ4CuuhPOCNGxVg1XnL1866chudA6G75mZ6RmfjmmAoWsb6YMxC1MthcT5kMe+2Dl0zPppwWJCaZmkeGVNaJIBKlp0AvFMhxVvYY1sdtvuUwqctinhwCJMer0oSvFw= Received: from SN6PR15MB2302.namprd15.prod.outlook.com (52.132.124.11) by SN6PR15MB2206.namprd15.prod.outlook.com (52.135.64.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2495.18; Fri, 29 Nov 2019 16:01:09 +0000 Received: from SN6PR15MB2302.namprd15.prod.outlook.com ([fe80::7114:a811:dc75:5e88]) by SN6PR15MB2302.namprd15.prod.outlook.com ([fe80::7114:a811:dc75:5e88%7]) with mapi id 15.20.2495.014; Fri, 29 Nov 2019 16:01:09 +0000 From: Daniel Migault To: "ace@ietf.org" Thread-Topic: Minutes of IETF106 Thread-Index: AdWmzeGYWDcrA8ItTKyCctQIen1XMw== Date: Fri, 29 Nov 2019 16:01:09 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [96.22.11.129] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a545034c-f7d9-4f2b-fd7e-08d774e5597a x-ms-traffictypediagnostic: SN6PR15MB2206: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0236114672 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(366004)(39860400002)(396003)(376002)(136003)(199004)(189003)(790700001)(6436002)(316002)(26005)(6306002)(6116002)(3846002)(54896002)(33656002)(52536014)(2906002)(25786009)(55016002)(9686003)(236005)(966005)(2351001)(86362001)(44832011)(6916009)(5640700003)(5660300002)(8676002)(7736002)(74316002)(81166006)(8936002)(1730700003)(478600001)(606006)(81156014)(9326002)(66476007)(64756008)(6506007)(66066001)(102836004)(186003)(66446008)(7696005)(2501003)(76116006)(66556008)(558084003)(14454004)(66946007)(7116003)(71200400001)(256004)(99286004)(71190400001); DIR:OUT; SFP:1101; SCL:1; SRVR:SN6PR15MB2206; H:SN6PR15MB2302.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: CRTHtunyNfg3SMy4GvtsC/TLHrpW3ZEDGV3suEs8ai/dZQnZHwA2jocp34aM+JIf/Ap0D1o2jzevFsc3wfUTMWZByxFT8/tqFtMZtuxla0V7KRjq8cNO/f1I9MU3NBZaqovNaGwRjAZoynC0WcPYKXLx0XqfBFylq6NZKwVm1/Rhb6NIBfdJNUwx3iAk2JQzijZ9swBGF1/eiP7zkUkv1NKkllVzQ9HarBABHzE9SCGGTuB+QN/cgdIiZ5bb32F7RiEBm0Ce6AvAL3V+vrPk4hG+WqpFVeFJ0ZPg3VgDUDZ2bhm0ob/FqCbTInTVkUG29kCTLFii/9ACsCrWswIJSosqOA7obZVc7sZ5HqHHuSfc4SSWPlV2hxpuNUCaOA+q714u5YWP42+xX6jkERwYcagxAPVMpBcFWOnfZ43dwzqdNCDntckFjHNTwTHNe1FaqSO3ic3JVlDIsGS55+Xd4NM8x17HfABGoZTq2rfdSQs= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_SN6PR15MB23021ABB92341909DBFA47CFE3460SN6PR15MB2302namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: a545034c-f7d9-4f2b-fd7e-08d774e5597a X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Nov 2019 16:01:09.2060 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: lVWgrBNApxXp+mnonW4dKUUSWBNbnWMfpGzJFua4ySNZLWFsziJYdZtL0sM5GEEP+PSNDmPS41k94lDHhuW8CCmO5ImA7u8OGhdYszxdQrE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR15MB2206 Archived-At: Subject: [Ace] Minutes of IETF106 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Nov 2019 16:01:14 -0000 --_000_SN6PR15MB23021ABB92341909DBFA47CFE3460SN6PR15MB2302namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, The minutes of the ACE meeting at IETF 106 have been uploaded. If you have = any comments, please feel free to raise any issue. We would like to thank t= hose that volunteered to take the minutes, that is Jim, Ludwig and Ryo. https://datatracker.ietf.org/doc/minutes-106-ace/ Yours, Jim and Daniel --_000_SN6PR15MB23021ABB92341909DBFA47CFE3460SN6PR15MB2302namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,


The minutes of the ACE meeting at IETF 106 have been uploaded. If you have = any comments, please feel free to raise any issue. We would like to thank t= hose that volunteered to take the minutes, that is Jim, Ludwig and Ryo.

 

https://datatracker.ietf.org/doc/minutes-106-ace/<= /p>

 

Yours,

Jim and Daniel

--_000_SN6PR15MB23021ABB92341909DBFA47CFE3460SN6PR15MB2302namp_-- From nobody Fri Nov 29 08:12:04 2019 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 134A112098B for ; Fri, 29 Nov 2019 08:12:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id obKbaxrHc1GO for ; Fri, 29 Nov 2019 08:11:58 -0800 (PST) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56F9F12098C for ; Fri, 29 Nov 2019 08:11:58 -0800 (PST) Received: by mail-qt1-x82c.google.com with SMTP id z22so12086552qto.7 for ; Fri, 29 Nov 2019 08:11:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=Ca2ZQ4fgt4flDlKHH+d60m43uJi2TsYGAtX7xCS15XI=; b=L86+TDcTmaO51ake/1ELp+7OeAfmtLvj1GOxGVBsD/p8mIlwpe7kHWmjfC0sxhwQCz 36ds5tqc2uUPzc0bGttAJlgzrBQe/FJ/T/KKn8kbkLGaXw5ZaLiqbVLqwQ2rwLna1UjL DB1b8+hKu2ldAHXHLb2+KxUdtDsbUCkrq4GmMx0x5KvJwA07ilzYZ0S6zipQQyk/1Usk ltqYsE3vYZkKOH8XKOfdgaG14qjzh/9gbelvjPa5LjGq7ideMskBvQMMkcU5eK8h5G2V vO5z6stvDfZ6/lYo/hkXD/v/JiWJbAFZ449ora8Wr1mMNx5Y61IRnFzIRJ5BX1QY2WNx U3cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=Ca2ZQ4fgt4flDlKHH+d60m43uJi2TsYGAtX7xCS15XI=; b=M+tNjmaLrQEKpRCLdzZ7SyNXUyFKyLN6AQaooCr7naJ7hxLeGl0SJcUh55+kBOQbYe g7WVMVBEpAC1uJs7THfS6aSrsiZ9e46I631gIDPrJvw0WPk5TmqwP9GZHJJp48UPlS5Z BkxQMU5xSmMtVNIHUdjlGdXLtJXPFix1VMmnW5tdtTUBl32vvtn9UgbV6aEkiNZ0t2fv QyNH5q+8gc6cvd/8QVqrTsQLkrT6zpHNLyZDayHnQCiVN3X6FrBMpk+2m1tsrAQsyDWH NmWkLlFKQKV6L/q8bovcID4SJLeFweptDFxqYfLyyqW34aSaZVIvbWWVZORc6BiIjTcM QOFQ== X-Gm-Message-State: APjAAAWjXviU6ozsQ9WR51stVNHK5PknfmeUaBXhyTQvg0kAwqPNn9vI LU5laWiDaVTnGH0ObPZo7Nn8H9y8oNnH6nd2harN0wfBCEsFlw== X-Google-Smtp-Source: APXvYqy/YzT48Igz8WUNbJ2ZuYHYQfvsuAzTi9TOkc/qNdTupdsoClW9ZdabXnjOuwSFqGqUq+tD6afzI+8jAFrqcQc= X-Received: by 2002:aed:2047:: with SMTP id 65mr35829573qta.78.1575043916940; Fri, 29 Nov 2019 08:11:56 -0800 (PST) MIME-Version: 1.0 From: Cigdem Sengul Date: Fri, 29 Nov 2019 16:11:45 +0000 Message-ID: To: Ace Wg Content-Type: multipart/alternative; boundary="0000000000002ccfac05987e7d99" Archived-At: Subject: [Ace] Review for draft-palombini-ace-coap-pubsub-profile X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Nov 2019 16:12:02 -0000 --0000000000002ccfac05987e7d99 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, As I remotely promised in the WG meeting in Singapore, here is my review of the pubsub-coap document. When reviewing the document, I have kept two things in mind: how the document reads now, and whether it can easily be extended to include MQTT as well. I=E2=80=99ve understood including MQTT is in scope for this docum= ent in the workgroup meeting in Singapore. I would be happy to help, if you need me to, for MQTT-specific contributions to this draft. Doing this would allow the mqtt_tls profile to progress independently of this document by stating that content protection is out of scope for mqtt_tls profile and referring to this document for a solution. I want to repeat my support for the adoption of this profile, as it addresses a significant problem for publishers to constrain the content of their publications to only their subscribers. It does handle the multiple publishers to a single topic case well (allowing subscribers to learn about all the publishers to a specific topic). In the following, I list a few things reading the draft made me think, especially in its applicability to MQTT: (1) What is planned to make this document a generic pubsub solution? Will there a generic architecture section, and specific descriptions for each of the protocols? For instance, if an MQTT client implements this, the client would talk to AS1 to get a token based on the way we describe in the mqtt-tls profile, and then get keying material for topics from AS2. I expect the MQTT client would use a different profile name like mqtt_tls_app to signal to AS1 that it is supporting the application layer security. This is because the draft hints that there should be a policy agreement between AS1 and AS2: =E2=80=9CNote that AS1 and AS2 might either = be co-resident or be 2 separate physical entities, in which case access control policies must be exchanged between AS1 and AS2, so that they agree on rights fo joining nodes about specific topics.=E2=80=9D (2) If we keep AS1 as the mqtt-tls profile AS, then for consistency sake, the MQTT client would expect to talk to HTTPS to AS2, but the coap-pubsub draft describes these, expectedly, in CoAP. Will there be support for HTTPS= ? (3) In the mqtt_tls profile, the AS grants tokens that identify both =E2=80=9Cpublish=E2=80=9D and =E2=80=9Csubscribe=E2=80=9D rights and the to= pics by adding scopes in the format, e.g. =E2=80=9Cpublish_topic1=E2=80=9D =E2=80=9Csubscribe_topic2/#= =E2=80=9D. This format allows representing all publish/subscribe permissions concisely for the client which may be acting both as a publisher and a subscriber. In the coap-pubsub, this is separated between AS1 and AS2. =E2=80=9CAS1 hos= ts the policies about the Broker: what endpoints are allowed to Publish on the Broker.=E2=80=9D =E2=80=9CThe AS2 hosts the policies about the topic: what = endpoints are allowed to access what topic. =E2=80=9C The coap-pubsub also permits that AS1 can host policies about what endpoints are allowed to Subscribe to the Broker. However, wouldn=E2=80=99t this separation between AS1 and AS2 have the foll= owing issue: Publisher P, having the permission to publish to topic1 and hence, successfully getting an access token from AS1, then goes ahead and sends a PUBLISH on topic 2, which it doesn=E2=80=99t have a right to publish. Wouldn't the broker would pass this message to subscribers, and the subscribers would discard the message because the publisher does not belong to their =E2=80=9Cpublishers list=E2=80=9D (subscribers have all the public= keys of all publishers). Have I missed something, does the draft protect against this at the broker? Differently, with the current way mqtt_tls scopes are described, AS1 would need to know not only who can publish or subscribe, but also the policies on topics. (4) That brings me to another point regarding this note in coap-pubsub profile. The profile says: =E2=80=9CHow the policies are exchanged [between= AS1 and AS2] is out of scope for this specification.=E2=80=9D I wonder whether the = token the client gets from AS1 should also be usable towards AS2, and AS2 is replaced with an RS for retrieving the keying material for topics (more on this later), i.e., AS2 does not need to host/manage/coordinate policies with AS1. (5) Regarding groups and group memberships, it seems like for the draft group =3D a single topic. In MQTT, topics can have level separators and multi-level (#) and single-level (+) wildcards. Similarly, CoAP would also have hierarchies. Consider the case when a PUBLISHER is allowed to publish to sport/tennis/player1/# but not sport/tennis/player2/#. The players' directory may have sub-levels like =E2=80=9Crankings=E2=80=9D. And a subscriber has permissions to get content from sport/tennis/#. It seems like sport/tennis/player1 would be a group, and sport/tennis/player2 be another group. And, the subscriber needs to be in two groups. This is fine, I believe, according to this document. In MQTT token scopes, we also accepted that a publisher represents its PUBLISH rights with topic filters (note a PUBLISH message cannot be sent to a filter, but the topic filters are useful in summarising permissions). Let=E2=80=99s assume there is a publisher with scope =E2=80=9Cpublish_sport/tennis/+/rankings=E2=80=9C? Then being a part of all groups (player 1 and player2) is too general as this publisher cannot publish to everything but only to =E2=80=9Crankings= =E2=80=9D. Another approach could be each publisher creating its group. This way the number of groups scales with the number of publishers (and the COSE keys is per publisher). So, the subscriber still asks permissions for and subscribes to topic filters. There needs to be a solution that maps the topics to a publisher list... AS1 (see my earlier discussion on who keeps the policy information) knows who has the right to publish to these topics in their policy database and has the public key information for them. AS2 hosts the COSE key for this publisher. Putting all this information together, when a message is received, the subscriber would use the publisher's public key to verify the publisher signature (the draft already supports this), then locate the symmetric key it received from the AS2 for this publisher to decrypt the message. Would there be any problems with this approach? Nits: Figure 2: Negociation -> Negotiation Kind regards, --Cigdem --0000000000002ccfac05987e7d99 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hello,=C2=A0<= /p>


As I remotely promised in the = WG meeting in Singapore, here is my review of the pubsub-coap document.=C2=A0


When reviewing the document, I= have kept two things in mind: how the document reads now, and whether it c= an easily be extended to include MQTT as well.=C2=A0 I=E2=80=99ve understood including MQTT is in s= cope for this document in the workgroup meeting in Singapore. I would be ha= ppy to help, if you need me to, for MQTT-specific contributions to this dra= ft.=C2=A0 Doing this=C2= =A0would allow the mqtt_tls profile to progress independently of this docum= ent by stating that content protection is out of scope for mqtt_tls profile= and referring to this document for a solution.=C2=A0


I want to repeat my support fo= r the adoption of this profile, as it addresses a significant problem for p= ublishers to constrain the content of their publications to only their subs= cribers. It does handle the multiple publishers to a single topic case well= (allowing subscribers to learn about all the publishers to a specific topi= c).=C2=A0


In the following, I list a few= things reading the draft made me think, especially in its applicability to= MQTT:

(1) What is planned to make th= is document a generic pubsub solution? Will there a generic architecture se= ction, and specific descriptions for each of the protocols?=C2=A0=C2=A0

For instance, if an MQTT clien= t implements this,=C2=A0= =C2=A0the client would talk to AS1 to get a token based on the way we descr= ibe in the mqtt-tls profile, and then get keying material for topics from A= S2.=C2=A0=C2=A0

I expect the=C2=A0MQTT client would use a different profile= name like mqtt_tls_app to signal to AS1 that it is supporting the applicat= ion layer security. This is because the draft hints that there should be a = policy agreement between AS1 and AS2: =E2=80=9CNote that AS1 and AS2 might = either be co-resident or be 2 separate physical entities, in which case acc= ess control policies must be exchanged between AS1 and AS2, so that they ag= ree on rights fo=C2=A0 j= oining nodes about specific topics.=E2=80=9D=C2=A0


(2) If we keep AS1 as the mqtt= -tls profile AS, then for consistency sake, the MQTT client would expect to= talk to HTTPS to AS2, but the coap-pubsub draft describes these, expectedl= y, in CoAP. Will there be support for HTTPS?


(3) In the mqtt_tls profile, t= he AS grants tokens that identify both =E2=80=9Cpublish=E2=80=9D and =E2=80= =9Csubscribe=E2=80=9D rights and the topics by adding scopes in the format,= e.g. =E2=80=9Cpublish_topic1=E2=80=9D =E2=80=9Csubscribe_topic2/#=E2=80=9D= .=C2=A0 This format allows representing all publish/subscribe pe= rmissions concisely for the client which may be acting both as a publisher = and a subscriber.=C2=A0

In the coap-pubsub, this is se= parated between AS1 and AS2. =E2=80=9CAS1 hosts the policies about the Brok= er: what endpoints are allowed to Publish on the Broker.=E2=80=9D =E2=80=9C= The AS2 hosts the policies about the topic: what endpoints are allowed to a= ccess what topic. =E2=80=9C

The coap-pubsub also permits t= hat AS1 can host policies about what endpoints are allowed to Subscribe to = the Broker.


However, wouldn=E2=80=99t this= separation between AS1 and AS2 have the following issue: Publisher P, havi= ng the permission to publish to topic1 and hence, successfully getting an a= ccess token from AS1, then goes ahead and sends a PUBLISH on topic 2, which= it doesn=E2=80=99t have a right to publish.=C2=A0

Wouldn't the broker would = pass this message to subscribers, and the subscribers would discard the mes= sage because the publisher does not belong to their =E2=80=9Cpublishers lis= t=E2=80=9D (subscribers have all the public keys of all publishers). Have I= missed something, does the draft protect against this at the broker?=C2=A0


Differently, with the current = way mqtt_tls scopes are described, AS1 would need to know not only who can = publish or subscribe, but also the policies on topics.=C2=A0


(4) That brings me to another = point regarding this note in coap-pubsub profile. The profile says: =E2=80= =9CHow the policies are exchanged [between AS1 and AS2] is out of scope for= this specification.=E2=80=9D I wonder whether the token the client gets fr= om AS1 should also be usable towards AS2, and AS2 is replaced with an RS fo= r retrieving the keying material for topics (more on this later), i.e., AS2= does not need to host/manage/coordinate policies with AS1.=C2=A0


(5) Regarding groups and group= memberships, it seems like for the draft group =3D a single topic.=C2=A0


In MQTT, topics can have level= separators and multi-level (#) and single-level (+) wildcards.=C2=A0 Similarly, CoAP would also h= ave hierarchies.=C2=A0


Consider the case wh= en a PUBLISHER is allowed to publish to sport/tennis/player1/# but not spor= t/tennis/player2/#.=C2=A0=C2=A0= The players' directory may have sub-levels like =E2=80=9Cranki= ngs=E2=80=9D.=C2=A0

= And a subscriber has permissions to get content from sport/tennis/#.=C2=A0<= /p>

It seems like sport/tennis/pla= yer1 would be a group, and sport/tennis/player2 be another group.

And, the subscriber needs to b= e in two groups.=C2=A0This is f= ine, I believe, according to this document.


In MQTT token scopes, we also = accepted that a publisher represents its PUBLISH rights with topic filters = (note a PUBLISH message cannot be sent to a filter, but the topic filters a= re useful in summarising permissions).=C2=A0

Let=E2=80=99s assume there is = a publisher with scope =E2=80=9Cpublish_sport/tennis/+/rankings=E2=80=9C?

Then being a part of all group= s (player 1 and player2) is too general as this publisher cannot publish to= everything but only to =E2=80=9Crankings=E2=80=9D.=C2=A0


Another approach could be each publisher creating its group. This way= the number of groups scales with the number of publishers (and the COSE ke= ys is per publisher).=C2=A0

So, the subscriber stil= l asks permissions for and subscribes to topic filters.=C2=A0

There needs to be a solution that maps the topics to a publisher= list...

AS1=C2=A0 (see my earlier discussion on wh= o keeps the policy information) knows who has the right to publish to these= topics in their policy database and has the public key information for the= m. AS2 hosts the COSE key for this publisher.=C2=A0


Putting all this information together,=C2=A0 = when a message is receiv= ed, the subscriber would use the publisher's public key to verify the p= ublisher signature (the draft already supports this),=C2=A0then loca= te the symmetric key it received from the AS2 for this publisher to decrypt= the message.=C2=A0

=C2=A0

Would there be any problems wi= th this approach?


Nits:

Figure 2: Negociation -> Ne= gotiation


Kind regards,

--Cigdem=C2=A0

--0000000000002ccfac05987e7d99-- From nobody Fri Nov 29 19:58:11 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D246120104; Fri, 29 Nov 2019 19:58:06 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.111.0 Auto-Submitted: auto-generated Precedence: bulk Sender: CC: ace-chairs@ietf.org, draft-ietf-ace-oauth-params@ietf.org, ietf@augustcellars.com, Jim Schaad , kaduk@mit.edu, ace@ietf.org Content-Transfer-Encoding: 7bit Reply-To: last-call@ietf.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <157508628656.4818.6888153621608232411.idtracker@ietfa.amsl.com> Date: Fri, 29 Nov 2019 19:58:06 -0800 Archived-At: Subject: [Ace] Last Call: (Additional OAuth Parameters for Authorization in Constrained Environments (ACE)) to Proposed Standard X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Nov 2019 03:58:07 -0000 The IESG has received a request from the Authentication and Authorization for Constrained Environments WG (ace) to consider the following document: - 'Additional OAuth Parameters for Authorization in Constrained Environments (ACE)' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the last-call@ietf.org mailing lists by 2019-12-13. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This specification defines new parameters for the OAuth 2.0 token and introspection endpoints when used with the framework for authentication and authorization for constrained environments (ACE). These are used to express the proof-of-possession key the client whishes to use, the proof-of-possession key that the AS has selected, and the key the RS should use to authenticate to the client. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-params/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-params/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Fri Nov 29 19:58:57 2019 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 91A961200E6; Fri, 29 Nov 2019 19:58:55 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.111.0 Auto-Submitted: auto-generated Precedence: bulk Sender: CC: ace-chairs@ietf.org, ietf@augustcellars.com, draft-ietf-ace-oauth-authz@ietf.org, Jim Schaad , kaduk@mit.edu, ace@ietf.org Content-Transfer-Encoding: 7bit Reply-To: last-call@ietf.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <157508633558.4770.2650171127149010963.idtracker@ietfa.amsl.com> Date: Fri, 29 Nov 2019 19:58:55 -0800 Archived-At: Subject: [Ace] Last Call: (Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth)) to Proposed Standard X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Nov 2019 03:58:56 -0000 The IESG has received a request from the Authentication and Authorization for Constrained Environments WG (ace) to consider the following document: - 'Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth)' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the last-call@ietf.org mailing lists by 2019-12-13. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This specification defines a framework for authentication and authorization in Internet of Things (IoT) environments called ACE- OAuth. The framework is based on a set of building blocks including OAuth 2.0 and CoAP, thus transforming a well-known and widely used authorization solution into a form suitable for IoT devices. Existing specifications are used where possible, but extensions are added and profiles are defined to better serve the IoT use cases. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-authz/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-ace-oauth-authz/ballot/ The following IPR Declarations may be related to this I-D: https://datatracker.ietf.org/ipr/3123/ The document contains these normative downward references. See RFC 3967 for additional information: rfc4949: Internet Security Glossary, Version 2 (Informational - Independent Submission Editor stream)