From nobody Thu Dec 3 03:10:20 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B752B3A0115 for ; Thu, 3 Dec 2020 03:10:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.108 X-Spam-Level: X-Spam-Status: No, score=-2.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=um.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4-zc5dsouvd for ; Thu, 3 Dec 2020 03:10:15 -0800 (PST) Received: from mx01.puc.rediris.es (outbound4mad.lav.puc.rediris.es [130.206.19.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA0C23A00D9 for ; Thu, 3 Dec 2020 03:10:14 -0800 (PST) Received: from xenon43.um.es (xenon43.um.es [155.54.212.170]) by mx01.puc.rediris.es with ESMTP id 0B3BACwr026530-0B3BACws026530 for ; Thu, 3 Dec 2020 12:10:13 +0100 Received: from localhost (localhost [127.0.0.1]) by xenon43.um.es (Postfix) with ESMTP id 8C4A420936 for ; Thu, 3 Dec 2020 12:10:12 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon43.um.es Received: from xenon43.um.es ([127.0.0.1]) by localhost (xenon43.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id ayt3W3er_dpX for ; Thu, 3 Dec 2020 12:10:12 +0100 (CET) Received: from [156.35.171.42] (unknown [156.35.171.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: dan.garcia@um.es) by xenon43.um.es (Postfix) with ESMTPSA id 467F420884 for ; Thu, 3 Dec 2020 12:10:11 +0100 (CET) To: ace@ietf.org References: <20201117234700.GR39170@kduck.mit.edu> From: Dan Garcia Message-ID: Date: Thu, 3 Dec 2020 12:10:11 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A660BF9B57C88F79D2C2305E" Content-Language: es-ES X-FEAS-SPF: spf-result=pass, ip=155.54.212.170, helo=xenon43.um.es, mailFrom=dan.garcia@um.es Authentication-Results: mx01.puc.rediris.es; spf=pass (rediris.es: domain of dan.garcia@um.es designates 155.54.212.170 as permitted sender) smtp.mailfrom=dan.garcia@um.es X-FE-Policy-ID: 2:15:0:SYSTEM DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=um.es; s=DKIM; c=relaxed/relaxed; h=subject:to:references:from:message-id:date:mime-version:content-type; bh=50u0pHHF7x3mD3YeyN6hDKNFi2lLo5orNmmndzg+L0I=; b=LjXIa1y62mgRRyYApIWpIb8BfGtcFWgiiRqXS6ECVM+U96MjrBphzxg5koRrnyZhcx0OcLmIdQc8 sHaxSwScPhhoPVkjmQRV3VAc/eWRqTHHqqs4BOUdvAJUHBYjUyVrgqucHi3370PDFl4Sv1YKBupT VOHUMJaubE3lIxqs+ZFYRoELZDp5KQuNjb3LplG2KhR+Eh0gE5i5Ha4iWS1AceLfCmydOpAmgTqV oeSLyUnFhNMdASk5hr/InchTa2JVIIPNoPIndn4CVy1QpMnKdmzKVr2XLICKzS+xL2BEVkTLoSM/ KsZtfcs5YQFoIbxU15HT5bzLxML9FOAXXrTW3w== Archived-At: Subject: [Ace] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 11:10:19 -0000 This is a multi-part message in MIME format. --------------A660BF9B57C88F79D2C2305E Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Dear all: Regarding the new charter, since ACE is considering the definition of CoAP transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensible Authentication Protocol) over CoAP. In this sense, we proposed this some time ago and we have implementations about this. https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 https://www.mdpi.com/1424-8220/16/3/358 https://www.mdpi.com/1424-8220/17/11/2646 The usage of CoAP can provide a very light and link-layer independent (we even tested in LoRa networks) EAP lower-layer (transport for EAP) suitable for IoT enviroment. We believe this would be really useful since EAP provides flexibility for the authentication and it is a well-known protocol. Therefore, we would like to propose the following modification to the charter: "The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, *as well as a transport for authentication protocols such as EAP*, and standardize them as needed." This modification does not necessarily mean the adoption of our draft. After all, we completely understand that this would happen only if there is an interest in the WG. Nevertheless, we would like to avoid that the charter is a barrier later if there is interest in the WG to work in this transport of EAP over CoAP: Any opinion about this? Best Regards. El 18/11/2020 a las 8:08, Daniel Migault escribió: > Hi, > > Please find the proposed charter we agreed on during the interim > meeting. If you would like to propose any change, please use the > following URL by November 25: > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > Yours, > Daniel > > The Authentication and Authorization for Constrained Environments > (ace) WG has defined a standardized solution framework for > authentication and authorization to enable authorized access to > resources identified by a URI and hosted on a resource server in > constrained environments. > > The access to the resource is mediated by an authorization server, > which is not considered to be constrained. > > > Profiles of this framework for application to security protocols > commonly used in constrained environments, including CoAP+DTLS and > CoAP+OSCORE, have also been standardized.  The Working Group is > charged with maintenance of the framework and existing profiles > thereof, and may undertake work to specify profiles of the framework > for additional secure communications protocols and for additional > support services providing authorized access to crypto keys(that are > not necessarily limited to constrained endpoints, though the focus > remains on deployment in ecosystems with a substantial portion of > constrained devices). > > > In addition to the ongoing maintenance work, the Working Group will > extend the framework as needed for applicability to group > communications, with initial focus on (D)TLS and (Group) OSCORE as the > underlying group communication security protocols. The Working Group > will standardize procedures for requesting and distributing group > keying material using the ACE framework as well as appropriated > management interfaces. > > > The Working Group will standardize a format for expressing > authorization information for a given authenticated principal as > received from an authorization manager. > > > The Working Group will examine how to use Constrained Application > Protocol (CoAP) as a transport medium for certificate enrollment > protocols, such as EST and CMPv2, and standardize as needed. > > > > On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: > > Thanks for updating the draft charter at [1], Daniel! > > I note that Michael raised the question of whether some other > group might > also be interested in working on CMP-over-coap, so the IESG will > be sure to > discuss that if CMP is still in the draft ACE charter when it goes > to the > IESG for review. > > -Ben > > On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > > Thank you all for the feed backs. For the purpose of driving the > charter > > discussion at the IETf 109, I have added the comments into the > proposed > > text [1]. > > > > My current understanding is that it seems beneficial to add > CMPv2 over CoAP > > in the charter. I am happy to be contradicted. > > * I have not seen a clear cut to do one or the other. > > * EST and CMPv2 are two protocols that can be used for > enrollment or cert > > management while addressing different cases / needs / situations > -- maybe > > we can clarify that point. I can see leveraging the existing CMP > > infrastructure, but it seems that is not the only one. > > * I am not convinced that not having CMP over CoAP will not > prevent its > > deployment and as such I prefer to have it standardized - this > might be a > > personal thought. > > * Adding any piece of work require cycles, but it seems to me > that CPM will > > not have a major impact on the WG progress. The work will > probably include > > other WG such a LAMPS. > > > > Yours, > > Daniel > > > > [1] > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > > wrote: > > > > > Hi Goran, > > > > > > I added the text to the charter we will discuss later. > > > > > > Yours, > > > Daniel > > > > > > On Fri, Nov 13, 2020 at 10:26 AM Göran Selander < > > > goran.selander@ericsson.com > > wrote: > > > > > >> Hi Daniel, > > >> > > >> > > >> > > >> Here’s another input to the charter. > > >> > > >> > > >> > > >> The current group key management solutions addresses the > problem of > > >> authorized access to group keys and public keys of group members. > > >> > > >> > > >> > > >> A related problem is authorized access of public keys of > other devices > > >> not necessarily part of a security group, in the sense of > sharing a > > >> symmetric key used to protect group messages. > > >> > > >> > > >> > > >> Authorized access to raw public keys serves an important > function in > > >> constrained settings where public key certificates may not be > feasible due > > >> to the incurred overhead, e.g. for when authenticating using > EDHOC > > >> (draft-ietf-lake-edhoc). > > >> > > >> This functionality is thus a subset of what is already > supported, but > > >> since the current solution is geared towards groups a > different solution > > >> may be needed (although it is probably possible to reuse > parts from the > > >> existing schemes for provisioning and requesting public keys). > > >> > > >> > > >> > > >> With this in mind, I propose the following change (highlighted in > > >> boldface below): > > >> > > >> > > >> > > >> OLD > > >> > > >> The Working Group is charged with maintenance of the > framework and > > >> existing profiles thereof, and may undertake work to specify > profiles of > > >> the framework for additional secure communications protocols > (that are not > > >> necessarily limited to constrained endpoints, though the > focus remains on > > >> deployment ecosystems with a substantial portion of > constrained devices). > > >> > > >> > > >> > > >> NEW > > >> > > >> The Working Group is charged with maintenance of the > framework and > > >> existing profiles thereof, and may undertake work to specify > profiles of > > >> the framework for additional secure communications protocols > *and **for > > >> additional **support services **providing* *authorized access > to crypto* *keys > > >> *(that are not necessarily limited to constrained endpoints, > though the > > >> focus remains on deployment ecosystems with a substantial > portion of > > >> constrained devices). > > >> > > >> > > >> > > >> Göran > > >> > > >> > > >> > > >> > > >> > > >> > > >> > > >> On 2020-10-15, 19:50, "Ace" > wrote: > > >> > > >> Hi, > > >> > > >> I would like to start the charter discussion. Here is a draft > of a > > >> proposed charter [1]. > > >> > > >> > > >> > > >> It seems to be that additional discussion is needed with > regard to the > > >> last paragraph related certificate management. In particular > the discussion > > >> might revive a discussion that happened in 2017 [2] - when I > was not > > >> co-chair of ACE -and considered other expired work such as > [3]. Please make > > >> this discussion constructive on this thread. > > >> > > >> > > >> > > >> The fundamental question is whether we need certificate > management at > > >> this stage. If the answer is yes, and we have multiple > proposals, it would > > >> be good to clarify the position of the different proposals > and evaluate > > >> whether a selection is needed or not before validating the > charter. > > >> > > >> > > >> > > >> Please provide your inputs on the mailing list before October > 30. Of > > >> course for minor edits, you may suggest them directly on the > google doc. > > >> > > >> > > >> > > >> Yours, > > >> > > >> Daniel > > >> > > >> > > >> > > >> [1] > > >> > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > >> < > > >> > https://protect2.fireeye.com/v1/url?k=4f3d9c3b-118c475b-4f3ddca0-86e2237f51fb-627e48b069462d70&q=1&e=6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing > > > > >> > > >> > > >> [2] > > >> > https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/ > > > >> > > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > > > >> > > >> > > >> > > >> -- > > >> > > >> Daniel Migault > > >> > > >> > > >> > > >> Ericsson > > >> > > > > > > > > > -- > > > Daniel Migault > > > Ericsson > > > > > > > > > -- > > Daniel Migault > > Ericsson > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > > > > -- > Daniel Migault > Ericsson > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --------------A660BF9B57C88F79D2C2305E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+DQogIDxoZWFkPg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4NCiAgPC9oZWFkPg0KICA8Ym9k eT4NCiAgICA8cD5EZWFyIGFsbDo8YnI+DQogICAgICA8YnI+DQogICAgICBSZWdhcmRpbmcg dGhlIG5ldyBjaGFydGVyLCBzaW5jZSBBQ0UgaXMgY29uc2lkZXJpbmcgdGhlIGRlZmluaXRp b24NCiAgICAgIG9mIENvQVAgdHJhbnNwb3J0IGZvciBDTVB2Mg0KICAgICAgKDxhIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1tc2FobmktYWNlLWNtcHYyLWNvYXAtdHJhbnNwb3J0LTAwIj5odHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtbXNhaG5pLWFjZS1jbXB2Mi1jb2FwLXRyYW5z cG9ydC0wMDwvYT4pLA0KICAgICAgd2Ugd2VyZSB3b25kZXJpbmcgd2hldGhlcmUgaXQgY291 bGQgYWxzbyBjb25zaWRlciBzcGVjaWZ5aW5nIEVBUA0KICAgICAgKEV4dGVuc2libGUgQXV0 aGVudGljYXRpb24gUHJvdG9jb2wpIG92ZXIgQ29BUC48YnI+DQogICAgICA8YnI+DQogICAg ICBJbiB0aGlzIHNlbnNlLCB3ZSBwcm9wb3NlZCB0aGlzIHNvbWUgdGltZSBhZ28gYW5kIHdl IGhhdmUNCiAgICAgIGltcGxlbWVudGF0aW9ucyBhYm91dCB0aGlzLjxicj4NCiAgICAgIDxi cj4NCjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtbWFyaW4tYWNlLXdnLWNvYXAtZWFw LTA2Ij5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LW1hcmlu LWFjZS13Zy1jb2FwLWVhcC0wNjwvYT48YnI+DQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL3d3dy5tZHBpLmNvbS8xNDI0LTgyMjAvMTYv My8zNTgiPmh0dHBzOi8vd3d3Lm1kcGkuY29tLzE0MjQtODIyMC8xNi8zLzM1ODwvYT48YnI+ DQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczov L3d3dy5tZHBpLmNvbS8xNDI0LTgyMjAvMTcvMTEvMjY0NiI+aHR0cHM6Ly93d3cubWRwaS5j b20vMTQyNC04MjIwLzE3LzExLzI2NDY8L2E+PGJyPg0KICAgICAgPGJyPg0KICAgICAgVGhl IHVzYWdlIG9mIENvQVAgY2FuIHByb3ZpZGUgYSB2ZXJ5IGxpZ2h0IGFuZCBsaW5rLWxheWVy DQogICAgICBpbmRlcGVuZGVudCAod2UgZXZlbiB0ZXN0ZWQgaW4gTG9SYSBuZXR3b3Jrcykg RUFQIGxvd2VyLWxheWVyDQogICAgICAodHJhbnNwb3J0IGZvciBFQVApIHN1aXRhYmxlIGZv ciBJb1QgZW52aXJvbWVudC4gV2UgYmVsaWV2ZSB0aGlzDQogICAgICB3b3VsZCBiZSByZWFs bHkgdXNlZnVsIHNpbmNlIEVBUCBwcm92aWRlcyBmbGV4aWJpbGl0eSBmb3IgdGhlDQogICAg ICBhdXRoZW50aWNhdGlvbiBhbmQgaXQgaXMgYSB3ZWxsLWtub3duIHByb3RvY29sLjxicj4N CiAgICAgIDxicj4NCiAgICAgIFRoZXJlZm9yZSwgd2Ugd291bGQgbGlrZSB0byBwcm9wb3Nl IHRoZSBmb2xsb3dpbmcgbW9kaWZpY2F0aW9uIHRvDQogICAgICB0aGUgY2hhcnRlcjo8YnI+ DQogICAgICA8YnI+DQogICAgICAiVGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBleGFtaW5lIGhv dyB0byB1c2UgQ29uc3RyYWluZWQgQXBwbGljYXRpb24NCiAgICAgIFByb3RvY29sIChDb0FQ KSBhcyBhIHRyYW5zcG9ydCBtZWRpdW0gZm9yIGNlcnRpZmljYXRlIGVucm9sbG1lbnQNCiAg ICAgIHByb3RvY29scywgc3VjaCBhcyBFU1QgYW5kIENNUHYyLCA8Yj5hcyB3ZWxsIGFzIGEg dHJhbnNwb3J0IGZvcg0KICAgICAgICBhdXRoZW50aWNhdGlvbiBwcm90b2NvbHMgc3VjaCBh cyBFQVA8L2I+LCBhbmQgc3RhbmRhcmRpemUgdGhlbQ0KICAgICAgYXMgbmVlZGVkLiI8YnI+ DQogICAgICA8YnI+DQogICAgICBUaGlzIG1vZGlmaWNhdGlvbiBkb2VzIG5vdCBuZWNlc3Nh cmlseSBtZWFuIHRoZSBhZG9wdGlvbiBvZiBvdXINCiAgICAgIGRyYWZ0LiBBZnRlciBhbGws IHdlIGNvbXBsZXRlbHkgdW5kZXJzdGFuZCB0aGF0IHRoaXMgd291bGQgaGFwcGVuDQogICAg ICBvbmx5IGlmIHRoZXJlIGlzIGFuIGludGVyZXN0IGluIHRoZSBXRy4gTmV2ZXJ0aGVsZXNz LCB3ZSB3b3VsZA0KICAgICAgbGlrZSB0byBhdm9pZCB0aGF0IHRoZSBjaGFydGVyIGlzIGEg YmFycmllciBsYXRlciBpZiB0aGVyZSBpcw0KICAgICAgaW50ZXJlc3QgaW4gdGhlIFdHIHRv IHdvcmsgaW4gdGhpcyB0cmFuc3BvcnQgb2YgRUFQIG92ZXIgQ29BUDo8YnI+DQogICAgICA8 YnI+DQogICAgICBBbnkgb3BpbmlvbiBhYm91dCB0aGlzPzxicj4NCiAgICAgIDxicj4NCiAg ICAgIEJlc3QgUmVnYXJkcy48YnI+DQogICAgPC9wPg0KICAgIDxkaXYgY2xhc3M9Im1vei1j aXRlLXByZWZpeCI+RWwgMTgvMTEvMjAyMCBhIGxhcyA4OjA4LCBEYW5pZWwNCiAgICAgIE1p Z2F1bHQgZXNjcmliacOzOjxicj4NCiAgICA8L2Rpdj4NCiAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIg0KY2l0ZT0ibWlkOkNBRFp5VGtuZWozRFViYktiUnhkZmkwSHFWUjdHN3FrQWg1 aHR1M3c5eUZqRTA5c090Z0BtYWlsLmdtYWlsLmNvbSI+DQogICAgICA8bWV0YSBodHRwLWVx dWl2PSJjb250ZW50LXR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+ DQogICAgICA8ZGl2IGRpcj0ibHRyIj4NCiAgICAgICAgPGRpdiBkaXI9Imx0ciI+SGkswqAN CiAgICAgICAgICA8ZGl2Pjxicj4NCiAgICAgICAgICA8L2Rpdj4NCiAgICAgICAgICA8ZGl2 PlBsZWFzZSBmaW5kIHRoZSBwcm9wb3NlZCBjaGFydGVyIHdlIGFncmVlZCBvbiBkdXJpbmcg dGhlDQogICAgICAgICAgICBpbnRlcmltIG1lZXRpbmcuIElmIHlvdSB3b3VsZCBsaWtlIHRv IHByb3Bvc2UgYW55IGNoYW5nZSwNCiAgICAgICAgICAgIHBsZWFzZSB1c2UgdGhlIGZvbGxv d2luZyBVUkwgYnkgTm92ZW1iZXIgMjU6PC9kaXY+DQogICAgICAgICAgPGRpdj48YnI+DQog ICAgICAgICAgPC9kaXY+DQogICAgICAgICAgPGRpdj48YQ0KaHJlZj0iaHR0cHM6Ly9kb2Nz Lmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQ TTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nIg0KICAgICAgICAgICAgICBtb3otZG8t bm90LXNlbmQ9InRydWUiPmh0dHBzOi8vZG9jcy5nb29nbGUuY29tL2RvY3VtZW50L2QvMVJ0 eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFkvZWRpdD91c3A9c2hh cmluZzwvYT48YnI+DQogICAgICAgICAgPC9kaXY+DQogICAgICAgICAgPGRpdj48YnI+DQog ICAgICAgICAgPC9kaXY+DQogICAgICAgICAgPGRpdj5Zb3VycyzCoDxicj4NCiAgICAgICAg ICAgIERhbmllbDwvZGl2Pg0KICAgICAgICAgIDxkaXY+PGJyPg0KICAgICAgICAgIDwvZGl2 Pg0KICAgICAgICAgIDxkaXY+PHNwYW4NCiAgICAgICAgICAgICAgaWQ9ImdtYWlsLWRvY3Mt aW50ZXJuYWwtZ3VpZC0wMWZkNWZkYS03ZmZmLWQ3ODQtOWRkZC0wYmJiNDczYWI0MDUiPg0K ICAgICAgICAgICAgICA8cCBkaXI9Imx0ciINCiAgICAgICAgICAgICAgICBzdHlsZT0ibGlu ZS1oZWlnaHQ6MS4zODttYXJnaW4tdG9wOjBwdDttYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7O2JhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVyaWM6 bm9ybWFsO2ZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGlnbjpi YXNlbGluZTt3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+VGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBB dXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgKGFjZSkgV0cgaGFz IGRlZmluZWQgYSBzdGFuZGFyZGl6ZWQgc29sdXRpb24gZnJhbWV3b3JrIGZvciBhdXRoZW50 aWNhdGlvbiBhbmQgYXV0aG9yaXphdGlvbiB0byBlbmFibGUgYXV0aG9yaXplZCBhY2Nlc3Mg dG8gcmVzb3VyY2VzIGlkZW50aWZpZWQgYnkgYSBVUkkgYW5kIGhvc3RlZCBvbiBhIHJlc291 cmNlIHNlcnZlciBpbiBjb25zdHJhaW5lZCBlbnZpcm9ubWVudHMuwqA8L3NwYW4+PC9wPg0K ICAgICAgICAgICAgICA8cCBkaXI9Imx0ciINCiAgICAgICAgICAgICAgICBzdHlsZT0ibGlu ZS1oZWlnaHQ6MS4zODttYXJnaW4tdG9wOjBwdDttYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7O2JhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVyaWM6 bm9ybWFsO2ZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGlnbjpi YXNlbGluZTt3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+VGhlIGFjY2VzcyB0byB0aGUgcmVzb3Vy Y2UgaXMgbWVkaWF0ZWQgYnkgYW4gYXV0aG9yaXphdGlvbiBzZXJ2ZXIsIHdoaWNoIGlzIG5v dCBjb25zaWRlcmVkIHRvIGJlIGNvbnN0cmFpbmVkLjwvc3Bhbj48L3A+DQogICAgICAgICAg ICAgIDxicj4NCiAgICAgICAgICAgICAgPHAgZGlyPSJsdHIiDQogICAgICAgICAgICAgICAg c3R5bGU9ImxpbmUtaGVpZ2h0OjEuMzg7bWFyZ2luLXRvcDowcHQ7bWFyZ2luLWJvdHRvbTow cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OztiYWNrZ3JvdW5kLWNvbG9yOnRyYW5zcGFyZW50O2ZvbnQtdmFyaWFu dC1udW1lcmljOm5vcm1hbDtmb250LXZhcmlhbnQtZWFzdC1hc2lhbjpub3JtYWw7dmVydGlj YWwtYWxpZ246YmFzZWxpbmU7d2hpdGUtc3BhY2U6cHJlLXdyYXAiPlByb2ZpbGVzIG9mIHRo aXMgZnJhbWV3b3JrIGZvciBhcHBsaWNhdGlvbiB0byBzZWN1cml0eSBwcm90b2NvbHMgY29t bW9ubHkgdXNlZCBpbiBjb25zdHJhaW5lZCBlbnZpcm9ubWVudHMsIGluY2x1ZGluZyBDb0FQ K0RUTFMgYW5kIENvQVArT1NDT1JFLCBoYXZlIGFsc28gYmVlbiBzdGFuZGFyZGl6ZWQuwqAg VGhlIFdvcmtpbmcgR3JvdXAgaXMgY2hhcmdlZCB3aXRoIG1haW50ZW5hbmNlIG9mIHRoZSBm cmFtZXdvcmsgYW5kIGV4aXN0aW5nIHByb2ZpbGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0 YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9maWxlcyBvZiB0aGUgZnJhbWV3b3JrIGZvciBhZGRp dGlvbmFsIHNlY3VyZSBjb21tdW5pY2F0aW9ucyBwcm90b2NvbHMgPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 Oztmb250LXZhcmlhbnQtbnVtZXJpYzpub3JtYWw7Zm9udC12YXJpYW50LWVhc3QtYXNpYW46 bm9ybWFsO3ZlcnRpY2FsLWFsaWduOmJhc2VsaW5lO3doaXRlLXNwYWNlOnByZS13cmFwIj5h bmQgZm9yIGFkZGl0aW9uYWwgc3VwcG9ydCBzZXJ2aWNlcyBwcm92aWRpbmcgYXV0aG9yaXpl ZCBhY2Nlc3MgdG8gY3J5cHRvIGtleXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2JhY2tncm91bmQtY29s b3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVyaWM6bm9ybWFsO2ZvbnQtdmFyaWFu dC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGlnbjpiYXNlbGluZTt3aGl0ZS1zcGFj ZTpwcmUtd3JhcCI+ICh0aGF0IGFyZSBub3QgbmVjZXNzYXJpbHkgbGltaXRlZCB0byBjb25z dHJhaW5lZCBlbmRwb2ludHMsIHRob3VnaCB0aGUgZm9jdXMgcmVtYWlucyBvbiBkZXBsb3lt ZW50IGluIGVjb3N5c3RlbXMgd2l0aCBhIHN1YnN0YW50aWFsIHBvcnRpb24gb2YgY29uc3Ry YWluZWQgZGV2aWNlcykuPC9zcGFuPjwvcD4NCiAgICAgICAgICAgICAgPGJyPg0KICAgICAg ICAgICAgICA8cCBkaXI9Imx0ciINCiAgICAgICAgICAgICAgICBzdHlsZT0ibGluZS1oZWln aHQ6MS4zODttYXJnaW4tdG9wOjBwdDttYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Jh Y2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVyaWM6bm9ybWFs O2ZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGlnbjpiYXNlbGlu ZTt3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+SW4gYWRkaXRpb24gdG8gdGhlIG9uZ29pbmcgbWFp bnRlbmFuY2Ugd29yaywgdGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBleHRlbmQgdGhlIGZyYW1l d29yayBhcyBuZWVkZWQgZm9yIGFwcGxpY2FiaWxpdHkgdG8gZ3JvdXAgY29tbXVuaWNhdGlv bnMsIHdpdGggaW5pdGlhbCBmb2N1cyBvbiAoRClUTFMgYW5kIChHcm91cCkgT1NDT1JFIGFz IHRoZSB1bmRlcmx5aW5nIGdyb3VwIGNvbW11bmljYXRpb24gc2VjdXJpdHkgcHJvdG9jb2xz LiBUaGUgV29ya2luZyBHcm91cCB3aWxsIHN0YW5kYXJkaXplIHByb2NlZHVyZXMgZm9yIHJl cXVlc3RpbmcgYW5kIGRpc3RyaWJ1dGluZyBncm91cCBrZXlpbmcgbWF0ZXJpYWwgdXNpbmcg dGhlIEFDRSBmcmFtZXdvcmsgYXMgd2VsbCBhcyBhcHByb3ByaWF0ZWQgbWFuYWdlbWVudCBp bnRlcmZhY2VzLsKgPC9zcGFuPjwvcD4NCiAgICAgICAgICAgICAgPGJyPg0KICAgICAgICAg ICAgICA8cCBkaXI9Imx0ciINCiAgICAgICAgICAgICAgICBzdHlsZT0ibGluZS1oZWlnaHQ6 MS4zODttYXJnaW4tdG9wOjBwdDttYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2JhY2tn cm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVyaWM6bm9ybWFsO2Zv bnQtdmFyaWFudC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGlnbjpiYXNlbGluZTt3 aGl0ZS1zcGFjZTpwcmUtd3JhcCI+VGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBzdGFuZGFyZGl6 ZSBhIGZvcm1hdCBmb3IgZXhwcmVzc2luZyBhdXRob3JpemF0aW9uIGluZm9ybWF0aW9uIGZv ciBhIGdpdmVuIGF1dGhlbnRpY2F0ZWQgcHJpbmNpcGFsIGFzIHJlY2VpdmVkIGZyb20gYW4g YXV0aG9yaXphdGlvbiBtYW5hZ2VyLsKgPC9zcGFuPjwvcD4NCiAgICAgICAgICAgICAgPGJy Pg0KICAgICAgICAgICAgICA8cCBkaXI9Imx0ciINCiAgICAgICAgICAgICAgICBzdHlsZT0i bGluZS1oZWlnaHQ6MS4zODttYXJnaW4tdG9wOjBwdDttYXJnaW4tYm90dG9tOjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2JhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7Zm9udC12YXJpYW50LW51bWVy aWM6bm9ybWFsO2ZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOm5vcm1hbDt2ZXJ0aWNhbC1hbGln bjpiYXNlbGluZTt3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+VGhlIFdvcmtpbmcgR3JvdXAgd2ls bCBleGFtaW5lIGhvdyB0byB1c2UgQ29uc3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9jb2wg KENvQVApIGFzIGEgdHJhbnNwb3J0IG1lZGl1bSBmb3IgY2VydGlmaWNhdGUgZW5yb2xsbWVu dCBwcm90b2NvbHMsIHN1Y2ggYXMgRVNUIGFuZCBDTVB2MiwgYW5kIHN0YW5kYXJkaXplIGFz IG5lZWRlZC48L3NwYW4+PC9wPg0KICAgICAgICAgICAgICA8YnI+DQogICAgICAgICAgICA8 L3NwYW4+PC9kaXY+DQogICAgICAgIDwvZGl2Pg0KICAgICAgICA8YnI+DQogICAgICAgIDxk aXYgY2xhc3M9ImdtYWlsX3F1b3RlIj4NCiAgICAgICAgICA8ZGl2IGRpcj0ibHRyIiBjbGFz cz0iZ21haWxfYXR0ciI+T24gVHVlLCBOb3YgMTcsIDIwMjAgYXQgNjo0Nw0KICAgICAgICAg ICAgUE0gQmVuamFtaW4gS2FkdWsgJmx0OzxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1 Ig0KICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmthZHVrQG1pdC5lZHU8 L2E+Jmd0OyB3cm90ZTo8YnI+DQogICAgICAgICAgPC9kaXY+DQogICAgICAgICAgPGJsb2Nr cXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQog ICAgICAgICAgICAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAgICAgIHJn YigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+VGhhbmtzIGZvciB1cGRhdGluZyB0 aGUNCiAgICAgICAgICAgIGRyYWZ0IGNoYXJ0ZXIgYXQgWzFdLCBEYW5pZWwhPGJyPg0KICAg ICAgICAgICAgPGJyPg0KICAgICAgICAgICAgSSBub3RlIHRoYXQgTWljaGFlbCByYWlzZWQg dGhlIHF1ZXN0aW9uIG9mIHdoZXRoZXIgc29tZQ0KICAgICAgICAgICAgb3RoZXIgZ3JvdXAg bWlnaHQ8YnI+DQogICAgICAgICAgICBhbHNvIGJlIGludGVyZXN0ZWQgaW4gd29ya2luZyBv biBDTVAtb3Zlci1jb2FwLCBzbyB0aGUgSUVTRw0KICAgICAgICAgICAgd2lsbCBiZSBzdXJl IHRvPGJyPg0KICAgICAgICAgICAgZGlzY3VzcyB0aGF0IGlmIENNUCBpcyBzdGlsbCBpbiB0 aGUgZHJhZnQgQUNFIGNoYXJ0ZXIgd2hlbg0KICAgICAgICAgICAgaXQgZ29lcyB0byB0aGU8 YnI+DQogICAgICAgICAgICBJRVNHIGZvciByZXZpZXcuPGJyPg0KICAgICAgICAgICAgPGJy Pg0KICAgICAgICAgICAgLUJlbjxicj4NCiAgICAgICAgICAgIDxicj4NCiAgICAgICAgICAg IE9uIFR1ZSwgTm92IDE3LCAyMDIwIGF0IDA2OjE2OjQ4UE0gLTA1MDAsIERhbmllbCBNaWdh dWx0DQogICAgICAgICAgICB3cm90ZTo8YnI+DQogICAgICAgICAgICAmZ3Q7IFRoYW5rIHlv dSBhbGwgZm9yIHRoZSBmZWVkIGJhY2tzLiBGb3IgdGhlIHB1cnBvc2Ugb2YNCiAgICAgICAg ICAgIGRyaXZpbmcgdGhlIGNoYXJ0ZXI8YnI+DQogICAgICAgICAgICAmZ3Q7IGRpc2N1c3Np b24gYXQgdGhlIElFVGYgMTA5LCBJIGhhdmUgYWRkZWQgdGhlIGNvbW1lbnRzDQogICAgICAg ICAgICBpbnRvIHRoZSBwcm9wb3NlZDxicj4NCiAgICAgICAgICAgICZndDsgdGV4dCBbMV0u PGJyPg0KICAgICAgICAgICAgJmd0OyA8YnI+DQogICAgICAgICAgICAmZ3Q7IE15IGN1cnJl bnQgdW5kZXJzdGFuZGluZyBpcyB0aGF0IGl0IHNlZW1zIGJlbmVmaWNpYWwgdG8NCiAgICAg ICAgICAgIGFkZCBDTVB2MiBvdmVyIENvQVA8YnI+DQogICAgICAgICAgICAmZ3Q7IGluIHRo ZSBjaGFydGVyLiBJIGFtIGhhcHB5IHRvIGJlIGNvbnRyYWRpY3RlZC48YnI+DQogICAgICAg ICAgICAmZ3Q7ICogSSBoYXZlIG5vdCBzZWVuIGEgY2xlYXIgY3V0IHRvIGRvIG9uZSBvciB0 aGUgb3RoZXIuPGJyPg0KICAgICAgICAgICAgJmd0OyAqIEVTVCBhbmQgQ01QdjIgYXJlIHR3 byBwcm90b2NvbHMgdGhhdCBjYW4gYmUgdXNlZCBmb3INCiAgICAgICAgICAgIGVucm9sbG1l bnQgb3IgY2VydDxicj4NCiAgICAgICAgICAgICZndDsgbWFuYWdlbWVudCB3aGlsZSBhZGRy ZXNzaW5nIGRpZmZlcmVudCBjYXNlcyAvIG5lZWRzIC8NCiAgICAgICAgICAgIHNpdHVhdGlv bnMgLS0gbWF5YmU8YnI+DQogICAgICAgICAgICAmZ3Q7IHdlIGNhbiBjbGFyaWZ5IHRoYXQg cG9pbnQuIEkgY2FuIHNlZSBsZXZlcmFnaW5nIHRoZQ0KICAgICAgICAgICAgZXhpc3Rpbmcg Q01QPGJyPg0KICAgICAgICAgICAgJmd0OyBpbmZyYXN0cnVjdHVyZSwgYnV0IGl0IHNlZW1z IHRoYXQgaXMgbm90IHRoZSBvbmx5IG9uZS48YnI+DQogICAgICAgICAgICAmZ3Q7ICogSSBh bSBub3QgY29udmluY2VkIHRoYXQgbm90IGhhdmluZyBDTVAgb3ZlciBDb0FQIHdpbGwNCiAg ICAgICAgICAgIG5vdCBwcmV2ZW50IGl0czxicj4NCiAgICAgICAgICAgICZndDsgZGVwbG95 bWVudCBhbmQgYXMgc3VjaCBJIHByZWZlciB0byBoYXZlIGl0IHN0YW5kYXJkaXplZA0KICAg ICAgICAgICAgLSB0aGlzIG1pZ2h0IGJlIGE8YnI+DQogICAgICAgICAgICAmZ3Q7IHBlcnNv bmFsIHRob3VnaHQuPGJyPg0KICAgICAgICAgICAgJmd0OyAqIEFkZGluZyBhbnkgcGllY2Ug b2Ygd29yayByZXF1aXJlIGN5Y2xlcywgYnV0IGl0IHNlZW1zDQogICAgICAgICAgICB0byBt ZSB0aGF0IENQTSB3aWxsPGJyPg0KICAgICAgICAgICAgJmd0OyBub3QgaGF2ZSBhIG1ham9y IGltcGFjdCBvbiB0aGUgV0cgcHJvZ3Jlc3MuIFRoZSB3b3JrDQogICAgICAgICAgICB3aWxs IHByb2JhYmx5IGluY2x1ZGU8YnI+DQogICAgICAgICAgICAmZ3Q7IG90aGVyIFdHIHN1Y2gg YSBMQU1QUy48YnI+DQogICAgICAgICAgICAmZ3Q7IDxicj4NCiAgICAgICAgICAgICZndDsg WW91cnMsPGJyPg0KICAgICAgICAgICAgJmd0OyBEYW5pZWw8YnI+DQogICAgICAgICAgICAm Z3Q7IDxicj4NCiAgICAgICAgICAgICZndDsgWzFdPGJyPg0KICAgICAgICAgICAgJmd0OyA8 YQ0KaHJlZj0iaHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVC ZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nIg0K ICAgICAgICAgICAgICByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPmh0dHBzOi8vZG9jcy5nb29nbGUuY29tL2RvY3VtZW50L2QvMVJ0 eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFkvZWRpdD91c3A9c2hh cmluZzwvYT48YnI+DQogICAgICAgICAgICAmZ3Q7IDxicj4NCiAgICAgICAgICAgICZndDsg T24gVHVlLCBOb3YgMTcsIDIwMjAgYXQgNjowMiBQTSBEYW5pZWwgTWlnYXVsdCAmbHQ7PGEN CiAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOm1nbHQuaWV0ZkBnbWFpbC5jb20iIHRhcmdl dD0iX2JsYW5rIg0KICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPm1nbHQu aWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8YnI+DQogICAgICAgICAgICAmZ3Q7IDxi cj4NCiAgICAgICAgICAgICZndDsgJmd0OyBIaSBHb3Jhbiw8YnI+DQogICAgICAgICAgICAm Z3Q7ICZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsgSSBhZGRlZCB0aGUgdGV4dCB0 byB0aGUgY2hhcnRlciB3ZSB3aWxsIGRpc2N1c3MNCiAgICAgICAgICAgIGxhdGVyLjxicj4N CiAgICAgICAgICAgICZndDsgJmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyBZb3Vy cyw8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsgRGFuaWVsPGJyPg0KICAgICAgICAgICAg Jmd0OyAmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7IE9uIEZyaSwgTm92IDEzLCAy MDIwIGF0IDEwOjI2IEFNIEfDtnJhbiBTZWxhbmRlcg0KICAgICAgICAgICAgJmx0Ozxicj4N CiAgICAgICAgICAgICZndDsgJmd0OyA8YSBocmVmPSJtYWlsdG86Z29yYW4uc2VsYW5kZXJA ZXJpY3Nzb24uY29tIg0KICAgICAgICAgICAgICB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIj5nb3Jhbi5zZWxhbmRlckBlcmljc3Nvbi5jb208L2E+Jmd0Ow0KICAg ICAgICAgICAgd3JvdGU6PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0OyBIaSBEYW5pZWwsPGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAg ICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBIZXJl4oCZ cyBhbm90aGVyIGlucHV0IHRvIHRoZSBjaGFydGVyLjxicj4NCiAgICAgICAgICAgICZndDsg Jmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAg ICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgVGhlIGN1 cnJlbnQgZ3JvdXAga2V5IG1hbmFnZW1lbnQgc29sdXRpb25zDQogICAgICAgICAgICBhZGRy ZXNzZXMgdGhlIHByb2JsZW0gb2Y8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IGF1 dGhvcml6ZWQgYWNjZXNzIHRvIGdyb3VwIGtleXMgYW5kIHB1YmxpYw0KICAgICAgICAgICAg a2V5cyBvZiBncm91cCBtZW1iZXJzLjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8 YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgQSByZWxhdGVkIHByb2Js ZW0gaXMgYXV0aG9yaXplZCBhY2Nlc3Mgb2YNCiAgICAgICAgICAgIHB1YmxpYyBrZXlzIG9m IG90aGVyIGRldmljZXM8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IG5vdCBuZWNl c3NhcmlseSBwYXJ0IG9mIGEgc2VjdXJpdHkgZ3JvdXAsIGluDQogICAgICAgICAgICB0aGUg c2Vuc2Ugb2Ygc2hhcmluZyBhPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBzeW1t ZXRyaWMga2V5IHVzZWQgdG8gcHJvdGVjdCBncm91cCBtZXNzYWdlcy48YnI+DQogICAgICAg ICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4N CiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsm Z3Q7IEF1dGhvcml6ZWQgYWNjZXNzIHRvIHJhdyBwdWJsaWMga2V5cyBzZXJ2ZXMgYW4NCiAg ICAgICAgICAgIGltcG9ydGFudCBmdW5jdGlvbiBpbjxicj4NCiAgICAgICAgICAgICZndDsg Jmd0OyZndDsgY29uc3RyYWluZWQgc2V0dGluZ3Mgd2hlcmUgcHVibGljIGtleQ0KICAgICAg ICAgICAgY2VydGlmaWNhdGVzIG1heSBub3QgYmUgZmVhc2libGUgZHVlPGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0OyB0byB0aGUgaW5jdXJyZWQgb3ZlcmhlYWQsIGUuZy4gZm9y IHdoZW4NCiAgICAgICAgICAgIGF1dGhlbnRpY2F0aW5nIHVzaW5nIEVESE9DPGJyPg0KICAg ICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyAoZHJhZnQtaWV0Zi1sYWtlLWVkaG9jKS48YnI+DQog ICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0 OyBUaGlzIGZ1bmN0aW9uYWxpdHkgaXMgdGh1cyBhIHN1YnNldCBvZiB3aGF0IGlzDQogICAg ICAgICAgICBhbHJlYWR5IHN1cHBvcnRlZCwgYnV0PGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0OyBzaW5jZSB0aGUgY3VycmVudCBzb2x1dGlvbiBpcyBnZWFyZWQgdG93YXJkcw0K ICAgICAgICAgICAgZ3JvdXBzIGEgZGlmZmVyZW50IHNvbHV0aW9uPGJyPg0KICAgICAgICAg ICAgJmd0OyAmZ3Q7Jmd0OyBtYXkgYmUgbmVlZGVkIChhbHRob3VnaCBpdCBpcyBwcm9iYWJs eQ0KICAgICAgICAgICAgcG9zc2libGUgdG8gcmV1c2UgcGFydHMgZnJvbSB0aGU8YnI+DQog ICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IGV4aXN0aW5nIHNjaGVtZXMgZm9yIHByb3Zpc2lv bmluZyBhbmQNCiAgICAgICAgICAgIHJlcXVlc3RpbmcgcHVibGljIGtleXMpLjxicj4NCiAg ICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7 PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsg Jmd0OyZndDsgV2l0aCB0aGlzIGluIG1pbmQsIEkgcHJvcG9zZSB0aGUgZm9sbG93aW5nDQog ICAgICAgICAgICBjaGFuZ2UgKGhpZ2hsaWdodGVkIGluPGJyPg0KICAgICAgICAgICAgJmd0 OyAmZ3Q7Jmd0OyBib2xkZmFjZSBiZWxvdyk6PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7 Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAm Z3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBPTEQ8YnI+DQog ICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0 OyBUaGUgV29ya2luZyBHcm91cCBpcyBjaGFyZ2VkIHdpdGggbWFpbnRlbmFuY2UNCiAgICAg ICAgICAgIG9mIHRoZSBmcmFtZXdvcmsgYW5kPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7 Jmd0OyBleGlzdGluZyBwcm9maWxlcyB0aGVyZW9mLCBhbmQgbWF5IHVuZGVydGFrZQ0KICAg ICAgICAgICAgd29yayB0byBzcGVjaWZ5IHByb2ZpbGVzIG9mPGJyPg0KICAgICAgICAgICAg Jmd0OyAmZ3Q7Jmd0OyB0aGUgZnJhbWV3b3JrIGZvciBhZGRpdGlvbmFsIHNlY3VyZQ0KICAg ICAgICAgICAgY29tbXVuaWNhdGlvbnMgcHJvdG9jb2xzICh0aGF0IGFyZSBub3Q8YnI+DQog ICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IG5lY2Vzc2FyaWx5IGxpbWl0ZWQgdG8gY29uc3Ry YWluZWQgZW5kcG9pbnRzLA0KICAgICAgICAgICAgdGhvdWdoIHRoZSBmb2N1cyByZW1haW5z IG9uPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBkZXBsb3ltZW50IGVjb3N5c3Rl bXMgd2l0aCBhIHN1YnN0YW50aWFsDQogICAgICAgICAgICBwb3J0aW9uIG9mIGNvbnN0cmFp bmVkIGRldmljZXMpLjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAg ICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgTkVXPGJyPg0KICAgICAgICAgICAgJmd0 OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgVGhlIFdvcmtpbmcg R3JvdXAgaXMgY2hhcmdlZCB3aXRoIG1haW50ZW5hbmNlDQogICAgICAgICAgICBvZiB0aGUg ZnJhbWV3b3JrIGFuZDxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgZXhpc3Rpbmcg cHJvZmlsZXMgdGhlcmVvZiwgYW5kIG1heSB1bmRlcnRha2UNCiAgICAgICAgICAgIHdvcmsg dG8gc3BlY2lmeSBwcm9maWxlcyBvZjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsg dGhlIGZyYW1ld29yayBmb3IgYWRkaXRpb25hbCBzZWN1cmUNCiAgICAgICAgICAgIGNvbW11 bmljYXRpb25zIHByb3RvY29scyAqYW5kICoqZm9yPGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0OyBhZGRpdGlvbmFsICoqc3VwcG9ydCBzZXJ2aWNlcyAqKnByb3ZpZGluZyoNCiAg ICAgICAgICAgICphdXRob3JpemVkIGFjY2VzcyB0byBjcnlwdG8qICprZXlzPGJyPg0KICAg ICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyAqKHRoYXQgYXJlIG5vdCBuZWNlc3NhcmlseSBsaW1p dGVkIHRvDQogICAgICAgICAgICBjb25zdHJhaW5lZCBlbmRwb2ludHMsIHRob3VnaCB0aGU8 YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IGZvY3VzIHJlbWFpbnMgb24gZGVwbG95 bWVudCBlY29zeXN0ZW1zIHdpdGggYQ0KICAgICAgICAgICAgc3Vic3RhbnRpYWwgcG9ydGlv biBvZjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgY29uc3RyYWluZWQgZGV2aWNl cykuPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZn dDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0OyBHw7ZyYW48YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsm Z3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZn dDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+ DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7 Jmd0OyBPbiAyMDIwLTEwLTE1LCAxOTo1MCwgIkFjZSIgJmx0OzxhDQogICAgICAgICAgICAg IGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiDQog ICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+YWNlLWJvdW5jZXNAaWV0Zi5v cmc8L2E+Jmd0OyB3cm90ZTo8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0K ICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBIaSw8YnI+DQogICAgICAgICAgICAmZ3Q7ICZn dDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBJIHdvdWxkIGxpa2UgdG8g c3RhcnQgdGhlIGNoYXJ0ZXIgZGlzY3Vzc2lvbi4NCiAgICAgICAgICAgIEhlcmUgaXMgYSBk cmFmdCBvZiBhPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBwcm9wb3NlZCBjaGFy dGVyIFsxXS48YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAg ICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQog ICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IEl0IHNlZW1zIHRvIGJlIHRoYXQgYWRkaXRpb25h bCBkaXNjdXNzaW9uIGlzDQogICAgICAgICAgICBuZWVkZWQgd2l0aCByZWdhcmQgdG8gdGhl PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBsYXN0IHBhcmFncmFwaCByZWxhdGVk IGNlcnRpZmljYXRlIG1hbmFnZW1lbnQuDQogICAgICAgICAgICBJbiBwYXJ0aWN1bGFyIHRo ZSBkaXNjdXNzaW9uPGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBtaWdodCByZXZp dmUgYSBkaXNjdXNzaW9uIHRoYXQgaGFwcGVuZWQgaW4NCiAgICAgICAgICAgIDIwMTcgWzJd IC0gd2hlbiBJIHdhcyBub3Q8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IGNvLWNo YWlyIG9mIEFDRSAtYW5kIGNvbnNpZGVyZWQgb3RoZXIgZXhwaXJlZA0KICAgICAgICAgICAg d29yayBzdWNoIGFzIFszXS4gUGxlYXNlIG1ha2U8YnI+DQogICAgICAgICAgICAmZ3Q7ICZn dDsmZ3Q7IHRoaXMgZGlzY3Vzc2lvbiBjb25zdHJ1Y3RpdmUgb24gdGhpcyB0aHJlYWQuPGJy Pg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0 OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAg Jmd0OyAmZ3Q7Jmd0OyBUaGUgZnVuZGFtZW50YWwgcXVlc3Rpb24gaXMgd2hldGhlciB3ZSBu ZWVkDQogICAgICAgICAgICBjZXJ0aWZpY2F0ZSBtYW5hZ2VtZW50IGF0PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0OyB0aGlzIHN0YWdlLiBJZiB0aGUgYW5zd2VyIGlzIHllcywg YW5kIHdlIGhhdmUNCiAgICAgICAgICAgIG11bHRpcGxlIHByb3Bvc2FscywgaXQgd291bGQ8 YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IGJlIGdvb2QgdG8gY2xhcmlmeSB0aGUg cG9zaXRpb24gb2YgdGhlDQogICAgICAgICAgICBkaWZmZXJlbnQgcHJvcG9zYWxzIGFuZCBl dmFsdWF0ZTxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgd2hldGhlciBhIHNlbGVj dGlvbiBpcyBuZWVkZWQgb3Igbm90IGJlZm9yZQ0KICAgICAgICAgICAgdmFsaWRhdGluZyB0 aGUgY2hhcnRlci48YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+ DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IFBsZWFzZSBwcm92aWRlIHlvdXIgaW5wdXRz IG9uIHRoZSBtYWlsaW5nIGxpc3QNCiAgICAgICAgICAgIGJlZm9yZSBPY3RvYmVyIDMwLiBP Zjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgY291cnNlIGZvciBtaW5vciBlZGl0 cywgeW91IG1heSBzdWdnZXN0IHRoZW0NCiAgICAgICAgICAgIGRpcmVjdGx5IG9uIHRoZSBn b29nbGUgZG9jLjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAg ICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4N CiAgICAgICAgICAgICZndDsgJmd0OyZndDsgWW91cnMsPGJyPg0KICAgICAgICAgICAgJmd0 OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgRGFuaWVsPGJyPg0K ICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZn dDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0 OyAmZ3Q7Jmd0OyBbMV08YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7IDxhDQpocmVm PSJodHRwczovL2RvY3MuZ29vZ2xlLmNvbS9kb2N1bWVudC9kLzFSdHhVU3ZVZUJkWldvUWtq U2oyYzNEdFI4RHVCd1BNMkJuQlhob0RpcHRZL2VkaXQ/dXNwPXNoYXJpbmciDQogICAgICAg ICAgICAgIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2Vu ZD0idHJ1ZSI+aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVC ZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nPC9h Pjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgJmx0Ozxicj4NCiAgICAgICAgICAg ICZndDsgJmd0OyZndDsgPGENCmhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20v djEvdXJsP2s9NGYzZDljM2ItMTE4YzQ3NWItNGYzZGRjYTAtODZlMjIzN2Y1MWZiLTYyN2U0 OGIwNjk0NjJkNzAmYW1wO3E9MSZhbXA7ZT02OTI0YjJhNi1lN2U1LTRlYzEtYTFhZi1jOTQ2 Mzc5NTNkYzUmYW1wO3U9aHR0cHMlM0ElMkYlMkZkb2NzLmdvb2dsZS5jb20lMkZkb2N1bWVu dCUyRmQlMkYxUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WSUy RmVkaXQlM0Z1c3AlM0RzaGFyaW5nIg0KICAgICAgICAgICAgICByZWw9Im5vcmVmZXJyZXIi IHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vcHJvdGVj dDIuZmlyZWV5ZS5jb20vdjEvdXJsP2s9NGYzZDljM2ItMTE4YzQ3NWItNGYzZGRjYTAtODZl MjIzN2Y1MWZiLTYyN2U0OGIwNjk0NjJkNzAmYW1wO3E9MSZhbXA7ZT02OTI0YjJhNi1lN2U1 LTRlYzEtYTFhZi1jOTQ2Mzc5NTNkYzUmYW1wO3U9aHR0cHMlM0ElMkYlMkZkb2NzLmdvb2ds ZS5jb20lMkZkb2N1bWVudCUyRmQlMkYxUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQ TTJCbkJYaG9EaXB0WSUyRmVkaXQlM0Z1c3AlM0RzaGFyaW5nPC9hPiZndDs8YnI+DQogICAg ICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgWzJdPGJyPg0KICAgICAgICAgICAgJmd0 OyAmZ3Q7Jmd0OyA8YQ0KaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2Mv bWludXRlcy1pbnRlcmltLTIwMTctYWNlLTAzLTIwMTcxMDE5MTMwMC8iDQogICAgICAgICAg ICAgIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvbWludXRlcy1pbnRlcmlt LTIwMTctYWNlLTAzLTIwMTcxMDE5MTMwMC88L2E+PGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDsgWzNdIDxhDQogICAgICAg ICAgICAgIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXNl bGFuZGVyLWFjZS1lYWxzLyINCiAgICAgICAgICAgICAgcmVsPSJub3JlZmVycmVyIiB0YXJn ZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1zZWxhbmRlci1hY2UtZWFscy88L2E+PGJyPg0KICAgICAg ICAgICAgJmd0OyAmZ3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+ DQogICAgICAgICAgICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7 Jmd0OyAtLTxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAg ICAmZ3Q7ICZndDsmZ3Q7IERhbmllbCBNaWdhdWx0PGJyPg0KICAgICAgICAgICAgJmd0OyAm Z3Q7Jmd0Ozxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAg ICAmZ3Q7ICZndDsmZ3Q7PGJyPg0KICAgICAgICAgICAgJmd0OyAmZ3Q7Jmd0OyBFcmljc3Nv bjxicj4NCiAgICAgICAgICAgICZndDsgJmd0OyZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7 ICZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7 ICZndDsgLS08YnI+DQogICAgICAgICAgICAmZ3Q7ICZndDsgRGFuaWVsIE1pZ2F1bHQ8YnI+ DQogICAgICAgICAgICAmZ3Q7ICZndDsgRXJpY3Nzb248YnI+DQogICAgICAgICAgICAmZ3Q7 ICZndDs8YnI+DQogICAgICAgICAgICAmZ3Q7IDxicj4NCiAgICAgICAgICAgICZndDsgPGJy Pg0KICAgICAgICAgICAgJmd0OyAtLSA8YnI+DQogICAgICAgICAgICAmZ3Q7IERhbmllbCBN aWdhdWx0PGJyPg0KICAgICAgICAgICAgJmd0OyBFcmljc3Nvbjxicj4NCiAgICAgICAgICAg IDxicj4NCiAgICAgICAgICAgICZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+DQogICAgICAgICAgICAmZ3Q7IEFjZSBtYWlsaW5nIGxp c3Q8YnI+DQogICAgICAgICAgICAmZ3Q7IDxhIGhyZWY9Im1haWx0bzpBY2VAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIg0KICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PkFjZUBpZXRmLm9yZzwvYT48YnI+DQogICAgICAgICAgICAmZ3Q7IDxhIGhyZWY9Imh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIg0KICAgICAgICAgICAgICBy ZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlPC9hPjxicj4NCiAg ICAgICAgICAgIDxicj4NCiAgICAgICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPg0KICAgICAgICAgICAgQWNlIG1haWxpbmcgbGlz dDxicj4NCiAgICAgICAgICAgIDxhIGhyZWY9Im1haWx0bzpBY2VAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIg0KICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPkFjZUBp ZXRmLm9yZzwvYT48YnI+DQogICAgICAgICAgICA8YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZSINCiAgICAgICAgICAgICAgcmVsPSJub3JlZmVy cmVyIiB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48YnI+DQogICAgICAgICAgPC9i bG9ja3F1b3RlPg0KICAgICAgICA8L2Rpdj4NCiAgICAgICAgPGJyIGNsZWFyPSJhbGwiPg0K ICAgICAgICA8ZGl2Pjxicj4NCiAgICAgICAgPC9kaXY+DQogICAgICAgIC0tIDxicj4NCiAg ICAgICAgPGRpdiBkaXI9Imx0ciIgY2xhc3M9ImdtYWlsX3NpZ25hdHVyZSI+DQogICAgICAg ICAgPGRpdiBkaXI9Imx0ciI+DQogICAgICAgICAgICA8ZGl2PkRhbmllbCBNaWdhdWx0PGJy Pg0KICAgICAgICAgICAgPC9kaXY+DQogICAgICAgICAgICA8ZGl2PkVyaWNzc29uPC9kaXY+ DQogICAgICAgICAgPC9kaXY+DQogICAgICAgIDwvZGl2Pg0KICAgICAgPC9kaXY+DQogICAg ICA8YnI+DQogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48 L2ZpZWxkc2V0Pg0KICAgICAgPHByZSBjbGFzcz0ibW96LXF1b3RlLXByZSIgd3JhcD0iIj5f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQWNlIG1h aWxpbmcgbGlzdA0KPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0i bWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPg0KPGEgY2xhc3M9Im1vei10 eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9hY2UiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl PC9hPg0KPC9wcmU+DQogICAgPC9ibG9ja3F1b3RlPg0KICA8L2JvZHk+DQo8L2h0bWw+DQo= --------------A660BF9B57C88F79D2C2305E-- From nobody Thu Dec 3 05:20:24 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1E343A09E7; Thu, 3 Dec 2020 05:20:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5zpptS4UiFva; Thu, 3 Dec 2020 05:20:13 -0800 (PST) Received: from NAM04-DM6-obe.outbound.protection.outlook.com (mail-dm6nam08on2083.outbound.protection.outlook.com [40.107.102.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 917813A09D7; Thu, 3 Dec 2020 05:20:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FrhT0Iqm8JwY4eRYw1GcyLXeh7AyrXO+jqEkorfbVd0pMqqhIMXpkHxuQdiLyCld87d3kgTj65ZSrL8kLLNIKPUbicPXGa/ZL5LJ2WVzDFWU423dL8Rr7nknKCgTNZIlYfF1mHPyIrvhkR91q9V4AQaWvsFMjWIWoA29UIATFvUrzxQg/HUBakTp4onCgNsFOPt1mzvDhUde/Hc35suwi+xESws8mE3o13DOEq2X2AgmAz27iep/Pasy+gW03duVdSSQ+aJnGbd5KJJOJ5ZkWzgTqG3Jtbwj4uEEUZLwCu8d/ewgZbUigLYq9ZX/sgvedw3G4cDIHuThV5Q8gQBZug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x0wCGmqQJhvij7m+ceMz/SbrexStwRFhYYYbpXX55AU=; b=oHYq1paJwGULSD8TIPSfpNrBNOw2PU0mU2zdFiTGTQTMArMVfRv7zi0vrmtcf2omwCVi5Me9ujrPoZJ6dEUKU6lZxbYIZTaTn4weCOw4DY89SVw04C4UBtHlfj3N9YhyVmwy1zjzQ2o86uc6pdO9qEEFYNbhM7mqiUZ+DpT8nbTOnRZbKurx1GQIrJc+c+wXdlfvPKPyoxbOk6Z48jd7S+LCVJLSY06pRWQHYC8xivbvilyiIun9NazwWrrxBDLv7By9hm7wTTiGN9LWVyJrSiLcRyBDDGSd0831BQdX2dSoiMA4UDPmfqhdVJdmcTMJ8RCOus3HKmsas7vDghK3hA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x0wCGmqQJhvij7m+ceMz/SbrexStwRFhYYYbpXX55AU=; b=ZnpOx6YHhW85Pdl+DmXVcPzsI0bBfEUpp1PxGid9O8z7OUbAiD88M8ZRJeRgBh4LwIeZDCzLwlMjgLuwJfp9dg9MiQJ8tpUUg9AyoPm/7e0kyFQ9mELCunRZQ8NGTFt9lV6LM61uWu/SmBF957g0a4XeF7PwMJl42X9lxaahMRY= Received: from DM6PR15MB2379.namprd15.prod.outlook.com (2603:10b6:5:8a::16) by DM6PR15MB3847.namprd15.prod.outlook.com (2603:10b6:5:2bb::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3589.25; Thu, 3 Dec 2020 13:20:08 +0000 Received: from DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::b9ed:d237:de1a:adc0]) by DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::b9ed:d237:de1a:adc0%6]) with mapi id 15.20.3611.034; Thu, 3 Dec 2020 13:20:08 +0000 From: Daniel Migault To: Dan Garcia , "ace@ietf.org" CC: EMU WG , "core@ietf.org WG (core@ietf.org)" Thread-Topic: [Ace] Proposed charter for ACE (EAP over CoAP?) Thread-Index: AQHWyWUZNJB+ahHZ90WKorfx1h39X6nlWNof Date: Thu, 3 Dec 2020 13:20:08 +0000 Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: um.es; dkim=none (message not signed) header.d=none;um.es; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [96.22.11.129] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8a359f0c-02f4-4e1a-d974-08d8978e280f x-ms-traffictypediagnostic: DM6PR15MB3847: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: h729uzorzyIBf7KjrPf0INEQUunyOs6wKnHUovVFAEjhvaJHWvd0heEOWhNxPEhXnvQOdhvywp1ycFE8DCFlvDCeGJuFGgFKA3HOGhEXwqobPzjFGWI2NK4cnCqg5so3x+y+ELE2AlMuIBpav/FW1gXA+2hHzBULqxCOYKnntiFhK+OmX23p0S6EKvphK7ntpCXCGfkqI/5KodtoIJs4N02UTpEjYDPlvPe/u7pKeDWW8h06cKyyEM4rk/xREYwWdnB2sDU19byRY19iPLE+glq08iWSTQWXywNTq5Kvkqii3JMRV+t3qdsfre4zr6EsC2E7HxQiI8n97rZga5SFbqAPDtRzNEmUtV2UIw3APrYqzxYwJLK35ccXQBU7a/nPu1JvZdrrgB4/wQZUfK56Cw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR15MB2379.namprd15.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(366004)(346002)(376002)(136003)(396003)(44832011)(4001150100001)(8936002)(9686003)(7696005)(83380400001)(66574015)(166002)(19627405001)(6506007)(8676002)(4326008)(91956017)(26005)(30864003)(86362001)(64756008)(66556008)(54906003)(52536014)(2906002)(478600001)(66946007)(966005)(33656002)(71200400001)(5660300002)(53546011)(66446008)(76116006)(316002)(66476007)(110136005)(55016002)(186003); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?Windows-1252?Q?EIsVaQy8uIvL3HslRWoCDeRijetdNmOoUCieiBgAUyH5MIhvzxqt3V+L?= =?Windows-1252?Q?gxO6UfibaBB9LwqayaXoH/UVJnouSsuGZYrnYXa/B3dmYN75Y8cFEB0Q?= =?Windows-1252?Q?5qIG3lPNnYlm9HPRJ/DMFeC5iknHEBdiSSRB2P7qGCD8O1gFNFmPpOn7?= =?Windows-1252?Q?N0YhjRyrWG9ExK89xRa9hzP50h8CX+LW8UOYnHi5wUGqslJIl8Uc4H/+?= =?Windows-1252?Q?e+lh2ATQ4nlY/EW+yw0FKkNMvyznA/4nd4a3l26HYQGeiWhpw+ONH2uZ?= =?Windows-1252?Q?q9YoRahqolHRDVJ2Eng++UDVlBX7AjFPlFDXh5soGa8a6HUP+5uep/H/?= =?Windows-1252?Q?flxyVXhUm09Ih6mGZYsh5UohVpPet6ineQWKZtnvP+ls1uZd+ZhcU+0w?= =?Windows-1252?Q?eUmLrSLSR9xPvGnjCDD+FUc6c8h/gPRi3wrsFhngHGilSxMYkro1QCL1?= =?Windows-1252?Q?YODWt4Jyuj2lcCjeS0GR0sks2dCpQfmPtJRzKQDcjDXlco+5k1Lepff5?= =?Windows-1252?Q?/Tm703JMSXLEaeWlB7vDNIkA54UH6yP+UZGmi+XuYobyM9/o5hypPnjY?= =?Windows-1252?Q?7db2xixZTYcww2RbJrLibh9SlwQY5pTrJnvyaEUkU2AeZWN9BcQeO/n0?= =?Windows-1252?Q?UybeL+gFHPH2o8WmlUKpLZBjdwdYAyur6yTgWRfBGMHlFeERTUCd2QYb?= =?Windows-1252?Q?ZX5TsFAd3I6jzESgGTiBa2k961wLV/8uIp8N+P6+esiGq+SrDXzZRCk9?= =?Windows-1252?Q?xHQi61T/uVaWL25RtcahVbasFH1ZeYWhOwHtS3Hw1Yp9x05Iqphv03dT?= =?Windows-1252?Q?8G0j+J394ruTGGP24snQnD8YxhEUWrr7dy+W+C+fFXAhkCuS8R16WP/J?= =?Windows-1252?Q?8Up6g5XB2EdPSaYUNkzpyTmu9AkM+OcebRnl+YodCOS69cGtxhtqHDxr?= =?Windows-1252?Q?yv2q+NHgIVClMNFl+niVrsAKRMsWJjn2n28k/p++Bqu9h49u0dFzAlrI?= =?Windows-1252?Q?V56qjL4s+5obD+kFR61vBxnPEI0dKySbLX49HRsiMOOdW0xHl+E=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR15MB2379308BD779061F6F46233EE3F20DM6PR15MB2379namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR15MB2379.namprd15.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8a359f0c-02f4-4e1a-d974-08d8978e280f X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Dec 2020 13:20:08.4653 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +Hlh48JxDiAby/LVZOEZPVxNQNiAY9lMXhVkgVWbej/MPdQZsOCcz/LqoyClkhulaisugPFkD4+g0LGaMn1/QYzUguWq8HGOv+uEDuS1N64= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR15MB3847 Archived-At: Subject: Re: [Ace] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 13:20:16 -0000 --_000_DM6PR15MB2379308BD779061F6F46233EE3F20DM6PR15MB2379namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable CCing emu, core It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it. Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter. Yours, Daniel ________________________________ From: Ace on behalf of Dan Garcia Sent: Thursday, December 3, 2020 6:10 AM To: ace@ietf.org Subject: [Ace] Proposed charter for ACE (EAP over CoAP?) Dear all: Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coa= p-transport-00), we were wondering whethere it could also consider specifyi= ng EAP (Extensible Authentication Protocol) over CoAP. In this sense, we proposed this some time ago and we have implementations a= bout this. https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 https://www.mdpi.com/1424-8220/16/3/358 https://www.mdpi.com/1424-8220/17/11/2646 The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol. Therefore, we would like to propose the following modification to the chart= er: "The Working Group will examine how to use Constrained Application Protocol= (CoAP) as a transport medium for certificate enrollment protocols, such as= EST and CMPv2, as well as a transport for authentication protocols such as= EAP, and standardize them as needed." This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport = of EAP over CoAP: Any opinion about this? Best Regards. El 18/11/2020 a las 8:08, Daniel Migault escribi=F3: Hi, Please find the proposed charter we agreed on during the interim meeting. I= f you would like to propose any change, please use the following URL by Nov= ember 25: https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing Yours, Daniel The Authentication and Authorization for Constrained Environments (ace) WG = has defined a standardized solution framework for authentication and author= ization to enable authorized access to resources identified by a URI and ho= sted on a resource server in constrained environments. The access to the resource is mediated by an authorization server, which is= not considered to be constrained. Profiles of this framework for application to security protocols commonly u= sed in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have = also been standardized. The Working Group is charged with maintenance of t= he framework and existing profiles thereof, and may undertake work to speci= fy profiles of the framework for additional secure communications protocols= and for additional support services providing authorized access to crypto = keys (that are not necessarily limited to constrained endpoints, though the= focus remains on deployment in ecosystems with a substantial portion of co= nstrained devices). In addition to the ongoing maintenance work, the Working Group will extend = the framework as needed for applicability to group communications, with ini= tial focus on (D)TLS and (Group) OSCORE as the underlying group communicati= on security protocols. The Working Group will standardize procedures for re= questing and distributing group keying material using the ACE framework as = well as appropriated management interfaces. The Working Group will standardize a format for expressing authorization in= formation for a given authenticated principal as received from an authoriza= tion manager. The Working Group will examine how to use Constrained Application Protocol = (CoAP) as a transport medium for certificate enrollment protocols, such as = EST and CMPv2, and standardize as needed. On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: Thanks for updating the draft charter at [1], Daniel! I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review. -Ben On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > Thank you all for the feed backs. For the purpose of driving the charter > discussion at the IETf 109, I have added the comments into the proposed > text [1]. > > My current understanding is that it seems beneficial to add CMPv2 over Co= AP > in the charter. I am happy to be contradicted. > * I have not seen a clear cut to do one or the other. > * EST and CMPv2 are two protocols that can be used for enrollment or cert > management while addressing different cases / needs / situations -- maybe > we can clarify that point. I can see leveraging the existing CMP > infrastructure, but it seems that is not the only one. > * I am not convinced that not having CMP over CoAP will not prevent its > deployment and as such I prefer to have it standardized - this might be a > personal thought. > * Adding any piece of work require cycles, but it seems to me that CPM wi= ll > not have a major impact on the WG progress. The work will probably includ= e > other WG such a LAMPS. > > Yours, > Daniel > > [1] > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > Hi Goran, > > > > I added the text to the charter we will discuss later. > > > > Yours, > > Daniel > > > > On Fri, Nov 13, 2020 at 10:26 AM G=F6ran Selander < > > goran.selander@ericsson.com> wrote: > > > >> Hi Daniel, > >> > >> > >> > >> Here=92s another input to the charter. > >> > >> > >> > >> The current group key management solutions addresses the problem of > >> authorized access to group keys and public keys of group members. > >> > >> > >> > >> A related problem is authorized access of public keys of other devices > >> not necessarily part of a security group, in the sense of sharing a > >> symmetric key used to protect group messages. > >> > >> > >> > >> Authorized access to raw public keys serves an important function in > >> constrained settings where public key certificates may not be feasible= due > >> to the incurred overhead, e.g. for when authenticating using EDHOC > >> (draft-ietf-lake-edhoc). > >> > >> This functionality is thus a subset of what is already supported, but > >> since the current solution is geared towards groups a different soluti= on > >> may be needed (although it is probably possible to reuse parts from th= e > >> existing schemes for provisioning and requesting public keys). > >> > >> > >> > >> With this in mind, I propose the following change (highlighted in > >> boldface below): > >> > >> > >> > >> OLD > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols (that are= not > >> necessarily limited to constrained endpoints, though the focus remains= on > >> deployment ecosystems with a substantial portion of constrained device= s). > >> > >> > >> > >> NEW > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols *and **fo= r > >> additional **support services **providing* *authorized access to crypt= o* *keys > >> *(that are not necessarily limited to constrained endpoints, though th= e > >> focus remains on deployment ecosystems with a substantial portion of > >> constrained devices). > >> > >> > >> > >> G=F6ran > >> > >> > >> > >> > >> > >> > >> > >> On 2020-10-15, 19:50, "Ace" > wrote: > >> > >> Hi, > >> > >> I would like to start the charter discussion. Here is a draft of a > >> proposed charter [1]. > >> > >> > >> > >> It seems to be that additional discussion is needed with regard to the > >> last paragraph related certificate management. In particular the discu= ssion > >> might revive a discussion that happened in 2017 [2] - when I was not > >> co-chair of ACE -and considered other expired work such as [3]. Please= make > >> this discussion constructive on this thread. > >> > >> > >> > >> The fundamental question is whether we need certificate management at > >> this stage. If the answer is yes, and we have multiple proposals, it w= ould > >> be good to clarify the position of the different proposals and evaluat= e > >> whether a selection is needed or not before validating the charter. > >> > >> > >> > >> Please provide your inputs on the mailing list before October 30. Of > >> course for minor edits, you may suggest them directly on the google do= c. > >> > >> > >> > >> Yours, > >> > >> Daniel > >> > >> > >> > >> [1] > >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2Bn= BXhoDiptY/edit?usp=3Dsharing > >> < > >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e= 2237f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u= =3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR= 8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing> > >> > >> > >> [2] > >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191= 300/ > >> > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > >> > >> > >> > >> -- > >> > >> Daniel Migault > >> > >> > >> > >> Ericsson > >> > > > > > > -- > > Daniel Migault > > Ericsson > > > > > -- > Daniel Migault > Ericsson > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace -- Daniel Migault Ericsson _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace --_000_DM6PR15MB2379308BD779061F6F46233EE3F20DM6PR15MB2379namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
CCing emu, core

It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it. = ;

Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter. 

Yours, 
Daniel
From: Ace <ace-bounces@i= etf.org> on behalf of Dan Garcia <dan.garcia@um.es>
Sent: Thursday, December 3, 2020 6:10 AM
To: ace@ietf.org <ace@ietf.org>
Subject: [Ace] Proposed charter for ACE (EAP over CoAP?)
 

Dear all:

Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.= ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensib= le Authentication Protocol) over CoAP.

In this sense, we proposed this some time ago and we have implementations a= bout this.

https://datatracker.ietf.org/doc/ht= ml/draft-marin-ace-wg-coap-eap-06
https://www.mdpi.com/1424-8220/16/3/358
https://www.mdpi.com/1424-8220/17/11/2646

The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol.

Therefore, we would like to propose the following modification to the chart= er:

"The Working Group will examine how to use Constrained Application Pro= tocol (CoAP) as a transport medium for certificate enrollment protocols, su= ch as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and= standardize them as needed."

This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport of EAP over CoAP:

Any opinion about this?

Best Regards.

El 18/11/2020 a las 8:08, Daniel Migault e= scribi=F3:
Hi, 

Please find the proposed charter we agreed on during the interim meeti= ng. If you would like to propose any change, please use the following URL b= y November 25:


Yours, 
Daniel

The Authentication and Authorization for Constrained Environments (ace) WG has= defined a standardized solution framework for authentication and authoriza= tion to enable authorized access to resources identified by a URI and hoste= d on a resource server in constrained environments. 

The access to the resource is mediated by an authorization server, which is no= t considered to be constrained.


Profiles of this framework for application to security protocols commonly used in c= onstrained environments, including CoAP+DTLS and CoAP+OSCORE, have also bee= n standardized.  The Working Group is charged with maintenance of the = framework and existing profiles thereof, and may undertake work to specify profiles of the framework for additional= secure communications protocols and for additional support services provid= ing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the foc= us remains on deployment in ecosystems with a substantial portion of constr= ained devices).


In addition to the ongoing maintenance work, the Working Group will extend th= e framework as needed for applicability to group communications, with initi= al focus on (D)TLS and (Group) OSCORE as the underlying group communication= security protocols. The Working Group will standardize procedures for requesting and distributing group ke= ying material using the ACE framework as well as appropriated management in= terfaces. 


The Working Group will standardize a format for expressing authorization infor= mation for a given authenticated principal as received from an authorizatio= n manager. 


The Working Group will examine how to use Constrained Application Protocol (Co= AP) as a transport medium for certificate enrollment protocols, such as EST= and CMPv2, and standardize as needed.



On Tue, Nov 17, 2020 at 6:47 PM Ben= jamin Kaduk <kaduk@mit.edu> wrot= e:
Thanks for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to=
discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the chart= er
> discussion at the IETf 109, I have added the comments into the propose= d
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over= CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the other.
> * EST and CMPv2 are two protocols that can be used for enrollment or c= ert
> management while addressing different cases / needs / situations -- ma= ybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only one.
> * I am not convinced that not having CMP over CoAP will not prevent it= s
> deployment and as such I prefer to have it standardized - this might b= e a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM= will
> not have a major impact on the WG progress. The work will probably inc= lude
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> wrote: >
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=F6ran Selander <
> > = goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=92s another input to the charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the prob= lem of
> >> authorized access to group keys and public keys of group memb= ers.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of othe= r devices
> >> not necessarily part of a security group, in the sense of sha= ring a
> >> symmetric key used to protect group messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important func= tion in
> >> constrained settings where public key certificates may not be= feasible due
> >> to the incurred overhead, e.g. for when authenticating using = EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already suppor= ted, but
> >> since the current solution is geared towards groups a differe= nt solution
> >> may be needed (although it is probably possible to reuse part= s from the
> >> existing schemes for provisioning and requesting public keys)= .
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighte= d in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = (that are not
> >> necessarily limited to constrained endpoints, though the focu= s remains on
> >> deployment ecosystems with a substantial portion of constrain= ed devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = *and **for
> >> additional **support services **providing* *authorized access= to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, = though the
> >> focus remains on deployment ecosystems with a substantial por= tion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=F6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> wrote:<= br> > >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft= of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with rega= rd to the
> >> last paragraph related certificate management. In particular = the discussion
> >> might revive a discussion that happened in 2017 [2] - when I = was not
> >> co-chair of ACE -and considered other expired work such as [3= ]. Please make
> >> this discussion constructive on this thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate manag= ement at
> >> this stage. If the answer is yes, and we have multiple propos= als, it would
> >> be good to clarify the position of the different proposals an= d evaluate
> >> whether a selection is needed or not before validating the ch= arter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October= 30. Of
> >> course for minor edits, you may suggest them directly on the = google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e2237f= 51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc= 5&u=3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjS= j2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing>
> >>
> >>
> >> [2]
> >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/<= /a>
> >>
> >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/
> >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson

____________________________________________=
___
Ace mailing list
Ace@ie=
tf.org
https://www.ietf.org/mailman/listinfo/ace
--_000_DM6PR15MB2379308BD779061F6F46233EE3F20DM6PR15MB2379namp_-- From nobody Thu Dec 3 11:01:42 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAF703A067A; Thu, 3 Dec 2020 11:01:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.076 X-Spam-Level: X-Spam-Status: No, score=-2.076 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_FACE_BAD=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, T_KAM_HTML_FONT_INVALID=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-bretagne.eu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vC46gYcX0NzB; Thu, 3 Dec 2020 11:01:29 -0800 (PST) Received: from zproxy120.enst.fr (zproxy120.enst.fr [IPv6:2001:660:330f:2::c1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89A8F3A064B; Thu, 3 Dec 2020 11:01:27 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by zproxy120.enst.fr (Postfix) with ESMTP id 37ACD80D57; Thu, 3 Dec 2020 20:01:25 +0100 (CET) Received: from zproxy120.enst.fr ([IPv6:::1]) by localhost (zproxy120.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id hbqJ2crASlQQ; Thu, 3 Dec 2020 20:01:24 +0100 (CET) Received: from localhost (localhost [IPv6:::1]) by zproxy120.enst.fr (Postfix) with ESMTP id 363378080D; Thu, 3 Dec 2020 20:01:24 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy120.enst.fr 363378080D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-bretagne.eu; s=CFDC2CFA-4654-11E5-AACD-7BCC68B6580D; t=1607022084; bh=PwiDt1aSyP6yxRqp7KLM/IdAF58HYfKpGOPJ5cyhe4I=; h=MIME-Version:From:Date:Message-ID:To; b=TuvQp6zcL8BvBrDHmT6BM62YCTOcjpQpaODjcqZdzowt5UNkIdEhgCgNCz300TGWK Q+iA0/KF8OIKIbUgo3w+yTiGI+CN2jqR4Pv0lUGjD7KBC1AWLY5qS+CdgCUN1ct+sE FEjeN5is5GXjo0F3q88rr9TEqqcywez/eeEOVLoU= X-Virus-Scanned: amavisd-new at zproxy120.enst.fr Received: from zproxy120.enst.fr ([IPv6:::1]) by localhost (zproxy120.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id IoFMnGYxcV6E; Thu, 3 Dec 2020 20:01:24 +0100 (CET) Received: from mail-io1-f41.google.com (mail-io1-f41.google.com [209.85.166.41]) by zproxy120.enst.fr (Postfix) with ESMTPSA id B675980D57; Thu, 3 Dec 2020 20:01:23 +0100 (CET) Received: by mail-io1-f41.google.com with SMTP id q137so3173903iod.9; Thu, 03 Dec 2020 11:01:23 -0800 (PST) X-Gm-Message-State: AOAM533fW5iEPD/sAyYRW35Kr3739DF/xblqwHftPoFo65xbTZdUvcv+ 4QXM3yGCo+RV+UIIDfejxUS8e1T5qWt0HAwedO8= X-Google-Smtp-Source: ABdhPJy5mefNbUhkstUmgpWiWp6Lp1f4PHQAUEsrCY3F55voNZLYdoQ/TfHj5B9ieJkIZR2PAM6SXhU7QGgHqZb/zDA= X-Received: by 2002:a5d:9a8e:: with SMTP id c14mr807929iom.178.1607022082534; Thu, 03 Dec 2020 11:01:22 -0800 (PST) MIME-Version: 1.0 References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: From: Laurent Toutain Date: Thu, 3 Dec 2020 20:00:44 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Daniel Migault Cc: Dan Garcia , "ace@ietf.org" , EMU WG , "core@ietf.org WG (core@ietf.org)" Content-Type: multipart/alternative; boundary="00000000000060341a05b593fca0" Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 19:01:34 -0000 --00000000000060341a05b593fca0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I think it is important to have EAP on top of CoAP, as Dan said it fit well with the last charter item. Laurent On Thu, Dec 3, 2020 at 2:20 PM Daniel Migault wrote: > CCing emu, core > > It seems ACE to me that ACE could be home for such a document. I am > wondering if emu core or any other WG believe there is a better place for > it. > > Regarding ACE I am wondering what is the WG opinion about adding this ite= m > to the ACE charter. > > Yours, > Daniel > ------------------------------ > *From:* Ace on behalf of Dan Garcia < > dan.garcia@um.es> > *Sent:* Thursday, December 3, 2020 6:10 AM > *To:* ace@ietf.org > *Subject:* [Ace] Proposed charter for ACE (EAP over CoAP?) > > > Dear all: > > Regarding the new charter, since ACE is considering the definition of CoA= P > transport for CMPv2 ( > https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we > were wondering whethere it could also consider specifying EAP (Extensible > Authentication Protocol) over CoAP. > > In this sense, we proposed this some time ago and we have implementations > about this. > > https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 > https://www.mdpi.com/1424-8220/16/3/358 > https://www.mdpi.com/1424-8220/17/11/2646 > > The usage of CoAP can provide a very light and link-layer independent (we > even tested in LoRa networks) EAP lower-layer (transport for EAP) suitabl= e > for IoT enviroment. We believe this would be really useful since EAP > provides flexibility for the authentication and it is a well-known protoc= ol. > > Therefore, we would like to propose the following modification to the > charter: > > "The Working Group will examine how to use Constrained Application > Protocol (CoAP) as a transport medium for certificate enrollment protocol= s, > such as EST and CMPv2, *as well as a transport for authentication > protocols such as EAP*, and standardize them as needed." > > This modification does not necessarily mean the adoption of our draft. > After all, we completely understand that this would happen only if there = is > an interest in the WG. Nevertheless, we would like to avoid that the > charter is a barrier later if there is interest in the WG to work in this > transport of EAP over CoAP: > > Any opinion about this? > > Best Regards. > El 18/11/2020 a las 8:08, Daniel Migault escribi=C3=B3: > > Hi, > > Please find the proposed charter we agreed on during the interim meeting. > If you would like to propose any change, please use the following URL by > November 25: > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > Yours, > Daniel > > The Authentication and Authorization for Constrained Environments (ace) W= G > has defined a standardized solution framework for authentication and > authorization to enable authorized access to resources identified by a UR= I > and hosted on a resource server in constrained environments. > > The access to the resource is mediated by an authorization server, which > is not considered to be constrained. > > Profiles of this framework for application to security protocols commonly > used in constrained environments, including CoAP+DTLS and CoAP+OSCORE, ha= ve > also been standardized. The Working Group is charged with maintenance of > the framework and existing profiles thereof, and may undertake work to > specify profiles of the framework for additional secure communications > protocols and for additional support services providing authorized access > to crypto keys (that are not necessarily limited to constrained > endpoints, though the focus remains on deployment in ecosystems with a > substantial portion of constrained devices). > > In addition to the ongoing maintenance work, the Working Group will exten= d > the framework as needed for applicability to group communications, with > initial focus on (D)TLS and (Group) OSCORE as the underlying group > communication security protocols. The Working Group will standardize > procedures for requesting and distributing group keying material using th= e > ACE framework as well as appropriated management interfaces. > > The Working Group will standardize a format for expressing authorization > information for a given authenticated principal as received from an > authorization manager. > > The Working Group will examine how to use Constrained Application Protoco= l > (CoAP) as a transport medium for certificate enrollment protocols, such a= s > EST and CMPv2, and standardize as needed. > > > On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk wrote: > > Thanks for updating the draft charter at [1], Daniel! > > I note that Michael raised the question of whether some other group might > also be interested in working on CMP-over-coap, so the IESG will be sure = to > discuss that if CMP is still in the draft ACE charter when it goes to the > IESG for review. > > -Ben > > On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > > Thank you all for the feed backs. For the purpose of driving the charte= r > > discussion at the IETf 109, I have added the comments into the proposed > > text [1]. > > > > My current understanding is that it seems beneficial to add CMPv2 over > CoAP > > in the charter. I am happy to be contradicted. > > * I have not seen a clear cut to do one or the other. > > * EST and CMPv2 are two protocols that can be used for enrollment or ce= rt > > management while addressing different cases / needs / situations -- may= be > > we can clarify that point. I can see leveraging the existing CMP > > infrastructure, but it seems that is not the only one. > > * I am not convinced that not having CMP over CoAP will not prevent its > > deployment and as such I prefer to have it standardized - this might be= a > > personal thought. > > * Adding any piece of work require cycles, but it seems to me that CPM > will > > not have a major impact on the WG progress. The work will probably > include > > other WG such a LAMPS. > > > > Yours, > > Daniel > > > > [1] > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > > > Hi Goran, > > > > > > I added the text to the charter we will discuss later. > > > > > > Yours, > > > Daniel > > > > > > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander < > > > goran.selander@ericsson.com> wrote: > > > > > >> Hi Daniel, > > >> > > >> > > >> > > >> Here=E2=80=99s another input to the charter. > > >> > > >> > > >> > > >> The current group key management solutions addresses the problem of > > >> authorized access to group keys and public keys of group members. > > >> > > >> > > >> > > >> A related problem is authorized access of public keys of other devic= es > > >> not necessarily part of a security group, in the sense of sharing a > > >> symmetric key used to protect group messages. > > >> > > >> > > >> > > >> Authorized access to raw public keys serves an important function in > > >> constrained settings where public key certificates may not be > feasible due > > >> to the incurred overhead, e.g. for when authenticating using EDHOC > > >> (draft-ietf-lake-edhoc). > > >> > > >> This functionality is thus a subset of what is already supported, bu= t > > >> since the current solution is geared towards groups a different > solution > > >> may be needed (although it is probably possible to reuse parts from > the > > >> existing schemes for provisioning and requesting public keys). > > >> > > >> > > >> > > >> With this in mind, I propose the following change (highlighted in > > >> boldface below): > > >> > > >> > > >> > > >> OLD > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols (that > are not > > >> necessarily limited to constrained endpoints, though the focus > remains on > > >> deployment ecosystems with a substantial portion of constrained > devices). > > >> > > >> > > >> > > >> NEW > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols *and > **for > > >> additional **support services **providing* *authorized access to > crypto* *keys > > >> *(that are not necessarily limited to constrained endpoints, though > the > > >> focus remains on deployment ecosystems with a substantial portion of > > >> constrained devices). > > >> > > >> > > >> > > >> G=C3=B6ran > > >> > > >> > > >> > > >> > > >> > > >> > > >> > > >> On 2020-10-15, 19:50, "Ace" wrote: > > >> > > >> Hi, > > >> > > >> I would like to start the charter discussion. Here is a draft of a > > >> proposed charter [1]. > > >> > > >> > > >> > > >> It seems to be that additional discussion is needed with regard to t= he > > >> last paragraph related certificate management. In particular the > discussion > > >> might revive a discussion that happened in 2017 [2] - when I was not > > >> co-chair of ACE -and considered other expired work such as [3]. > Please make > > >> this discussion constructive on this thread. > > >> > > >> > > >> > > >> The fundamental question is whether we need certificate management a= t > > >> this stage. If the answer is yes, and we have multiple proposals, it > would > > >> be good to clarify the position of the different proposals and > evaluate > > >> whether a selection is needed or not before validating the charter. > > >> > > >> > > >> > > >> Please provide your inputs on the mailing list before October 30. Of > > >> course for minor edits, you may suggest them directly on the google > doc. > > >> > > >> > > >> > > >> Yours, > > >> > > >> Daniel > > >> > > >> > > >> > > >> [1] > > >> > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > >> < > > >> > https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e223= 7f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=3D= https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing > > > > >> > > >> > > >> [2] > > >> > https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300= / > > >> > > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > > >> > > >> > > >> > > >> -- > > >> > > >> Daniel Migault > > >> > > >> > > >> > > >> Ericsson > > >> > > > > > > > > > -- > > > Daniel Migault > > > Ericsson > > > > > > > > > -- > > Daniel Migault > > Ericsson > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > > > -- > Daniel Migault > Ericsson > > _______________________________________________ > Ace mailing listAce@ietf.orghttps://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > core mailing list > core@ietf.org > https://www.ietf.org/mailman/listinfo/core > --=20 Laurent Toutain +--- VoIP (recommended) ---+----------- T=C3=A9l=C3=A9com Bretagne --------= ---+ | Tel: +33 2 22 06 8156 | Tel: + 33 2 99 12 7026 | Visit : | Mob: +33 6 800 75 900 | | | Fax: +33 2 22 06 8445 | Fax: +33 2 99 12 7030 | http://class.touta.in | Laurent@Touta.in | Laurent.Toutain@Telecom-Bretagne.eu | +--------------------------+----------------------------------------+ --00000000000060341a05b593fca0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I think it is important to have EAP= on top of CoAP, as Dan said it fit well with the last charter item.
<= div>
Laurent

On Thu, Dec 3, 2020 at 2:20 PM Daniel Migau= lt <daniel.migault=3D40ericsson.com@dmarc.ietf.org> wrote:
CCing emu, core

It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it.=C2= =A0

Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter.=C2=A0

Yours,=C2=A0
Daniel
From: Ace <ace-bounces@ietf.org> on behalf of Dan Garc= ia <dan.garcia@um.= es>
Sent: Thursday, December 3, 2020 6:10 AM
To: ace@ietf.org <ace@ietf.org&g= t;
Subject: [Ace] Proposed charter for ACE (EAP over CoAP?)
=C2=A0

Dear all:

Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.ietf.org/html/dr= aft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensib= le Authentication Protocol) over CoAP.

In this sense, we proposed this some time ago and we have implementations a= bout this.

https://datatracker.ietf.org/doc/html/draft-marin-a= ce-wg-coap-eap-06
https= ://www.mdpi.com/1424-8220/16/3/358
htt= ps://www.mdpi.com/1424-8220/17/11/2646

The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol.

Therefore, we would like to propose the following modification to the chart= er:

"The Working Group will examine how to use Constrained Application Pro= tocol (CoAP) as a transport medium for certificate enrollment protocols, su= ch as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and= standardize them as needed."

This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport of EAP over CoAP:

Any opinion about this?

Best Regards.

El 18/11/2020 a las 8:08, Daniel Migault escribi=C3=B3:
Hi,=C2=A0

Please find the proposed charter we agreed on during the interim meeti= ng. If you would like to propose any change, please use the following URL b= y November 25:


Yours,=C2=A0
Daniel

= The Authentication and Authorization for Constrained Environments (ace) WG has= defined a standardized solution framework for authentication and authoriza= tion to enable authorized access to resources identified by a URI and hoste= d on a resource server in constrained environments.=C2=A0

= The access to the resource is mediated by an authorization server, which is no= t considered to be constrained.


= Profiles of this framework for application to security protocols commonly used in c= onstrained environments, including CoAP+DTLS and CoAP+OSCORE, have also bee= n standardized.=C2=A0 The Working Group is charged with maintenance of the = framework and existing profiles thereof, and may undertake work to specify profiles of the framework for additional= secure communications protocols and for additional support services providing a= uthorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the foc= us remains on deployment in ecosystems with a substantial portion of constr= ained devices).


= In addition to the ongoing maintenance work, the Working Group will extend th= e framework as needed for applicability to group communications, with initi= al focus on (D)TLS and (Group) OSCORE as the underlying group communication= security protocols. The Working Group will standardize procedures for requesting and distributing group ke= ying material using the ACE framework as well as appropriated management in= terfaces.=C2=A0


= The Working Group will standardize a format for expressing authorization infor= mation for a given authenticated principal as received from an authorizatio= n manager.=C2=A0


= The Working Group will examine how to use Constrained Application Protocol (Co= AP) as a transport medium for certificate enrollment protocols, such as EST= and CMPv2, and standardize as needed.



On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
Thanks for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to=
discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the chart= er
> discussion at the IETf 109, I have added the comments into the propose= d
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over= CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the other.
> * EST and CMPv2 are two protocols that can be used for enrollment or c= ert
> management while addressing different cases / needs / situations -- ma= ybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only one.
> * I am not convinced that not having CMP over CoAP will not prevent it= s
> deployment and as such I prefer to have it standardized - this might b= e a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM= will
> not have a major impact on the WG progress. The work will probably inc= lude
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> wrote: >
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander <
> > = goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=E2=80=99s another input to the charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the prob= lem of
> >> authorized access to group keys and public keys of group memb= ers.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of othe= r devices
> >> not necessarily part of a security group, in the sense of sha= ring a
> >> symmetric key used to protect group messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important func= tion in
> >> constrained settings where public key certificates may not be= feasible due
> >> to the incurred overhead, e.g. for when authenticating using = EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already suppor= ted, but
> >> since the current solution is geared towards groups a differe= nt solution
> >> may be needed (although it is probably possible to reuse part= s from the
> >> existing schemes for provisioning and requesting public keys)= .
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighte= d in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = (that are not
> >> necessarily limited to constrained endpoints, though the focu= s remains on
> >> deployment ecosystems with a substantial portion of constrain= ed devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = *and **for
> >> additional **support services **providing* *authorized access= to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, = though the
> >> focus remains on deployment ecosystems with a substantial por= tion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=C3=B6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> wrote:<= br> > >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft= of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with rega= rd to the
> >> last paragraph related certificate management. In particular = the discussion
> >> might revive a discussion that happened in 2017 [2] - when I = was not
> >> co-chair of ACE -and considered other expired work such as [3= ]. Please make
> >> this discussion constructive on this thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate manag= ement at
> >> this stage. If the answer is yes, and we have multiple propos= als, it would
> >> be good to clarify the position of the different proposals an= d evaluate
> >> whether a selection is needed or not before validating the ch= arter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October= 30. Of
> >> course for minor edits, you may suggest them directly on the = google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e2237f= 51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc= 5&u=3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjS= j2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing>
> >>
> >>
> >> [2]
> >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/<= /a>
> >>
> >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/
> >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson

_______________________________________________
Ace mailing list
Ace@ietf.org
htt=
ps://www.ietf.org/mailman/listinfo/ace
_______________________________________________
core mailing list
core@ietf.org
https://www.ietf.org/mailman/listinfo/core


--
Laurent Toutain=C2=A0
+---= VoIP (recommended) ---+----------- T=C3=A9l=C3=A9com Bretagne -----------+=
| Tel: +33 2 22 06 8156 =C2=A0 =C2=A0| Tel: + 33 2 99 12 7026 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 | Visit :
| Mob: +33 6 800 75 900 =C2=A0 = =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<= /font>
| Fax: +33= 2 22 06 8445 =C2=A0 =C2=A0| Fax: +33 2 99 12 7030 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| =C2=A0http://class.touta.in
| Laurent@Touta.in =C2= =A0 =C2=A0 =C2=A0 =C2=A0 | Laurent.Toutain@Telecom-Bretagne.eu =C2=A0 =C2= =A0|
+--------------------------+---------------------------------------= -+
--00000000000060341a05b593fca0-- From nobody Thu Dec 3 13:58:19 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 644E83A0D31; Thu, 3 Dec 2020 13:58:15 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Kathleen Moriarty via Datatracker To: Cc: draft-ietf-ace-oscore-profile.all@ietf.org, ace@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.23.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160703269537.9405.5185911182037137110@ietfa.amsl.com> Reply-To: Kathleen Moriarty Date: Thu, 03 Dec 2020 13:58:15 -0800 Archived-At: Subject: [Ace] Secdir last call review of draft-ietf-ace-oscore-profile-13 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 21:58:16 -0000 Reviewer: Kathleen Moriarty Review result: Ready Thank you for your work on this document, it appears ready for publication. From nobody Fri Dec 4 02:26:24 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C62753A0644; Fri, 4 Dec 2020 02:26:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.092 X-Spam-Level: X-Spam-Status: No, score=-2.092 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDRrCKVXLAwD; Fri, 4 Dec 2020 02:26:16 -0800 (PST) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2059.outbound.protection.outlook.com [40.107.22.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB1B73A05F8; Fri, 4 Dec 2020 02:26:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=C+qOfSF/upKCjkbxg39VPgFuYuAowN06bgEw9YdUfLknlDodLz4SEAh56qrVhe+IjRHa2YBTdNslDVgBb411DKC2SN4IUgALsHehNLS1WJEXCcacSNABczNDoy8UMpNe8Rr2Sgq4Q+Cz/flcCXitb8Bi/96G4fVaMwftpd+8xymvLPy4FKtp7pT76yzVJQ5mh5Hbfsxvm9U0E+ZwgK3Jh+eVbkAXzD566Mnjy8hOhDGnTRJBKYdBuJsTz/mxPQv7mI9M/LYjbql3rtAiL1jJHPYYj/LaTzHwAewTkX6JBZUoE4LNlN0x08o1xS3qLAfovO/x6lBf4n5IqlUB2PbHvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RETc61wXAjt316TIoLTo8Gs4JSRrcq7x05+6/wh+ews=; b=XSrmnBWEUJUlL+YN3twvnvhaYxyrNDu/x2IkOK3qN6Je8uBWdcxZFDUcjtZN0pbeMP5L751TJdFlX5IWJrobIvyJYmvDwbpg4c9EewO/Z2bXLvMENdiUk9XDFUoNcKvxakoDvxIhyS3A4CqwLspXigTObnvRhA56ok0dlHVc4MP1YvOKY8H8vLQIuNlgIx1QjyEbSu3lolfDoq7PF6ceBx2kUPhxiLltkQwYLjN54Owwlw/Bdh3TBkwzBRX/no4jbycHl//JitTJkby1TfGHkPAKSF5nRM3BDdG48PcZSRFOMqGkQXb7sh6ebYvFq5cFEY3uBLSsQG6AAmAAlo3QrA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RETc61wXAjt316TIoLTo8Gs4JSRrcq7x05+6/wh+ews=; b=bP+9jQXQ6dHIxHkyzzhSyL5vCUKzuYTmYmsqTAxw1lepFYuasq93FpEGw/LuUDSL7doKJ5u8Si/tv/0hhDpVgNWKnrUm57fzr5aD4wEje3047XJPTfHhBIW7rvVsfzK1Hn4HPU9T3rhzWtKD/IdHVUx2pChipQpiD/9PUVfXrEc= Received: from HE1PR0701MB2185.eurprd07.prod.outlook.com (2603:10a6:3:2a::21) by HE1PR07MB4201.eurprd07.prod.outlook.com (2603:10a6:7:98::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.15; Fri, 4 Dec 2020 10:26:13 +0000 Received: from HE1PR0701MB2185.eurprd07.prod.outlook.com ([fe80::9923:403e:592f:d8eb]) by HE1PR0701MB2185.eurprd07.prod.outlook.com ([fe80::9923:403e:592f:d8eb%10]) with mapi id 15.20.3654.009; Fri, 4 Dec 2020 10:26:13 +0000 From: Mohit Sethi M To: Daniel Migault , Dan Garcia , "ace@ietf.org" CC: EMU WG , "core@ietf.org WG (core@ietf.org)" Thread-Topic: [Emu] [Ace] Proposed charter for ACE (EAP over CoAP?) Thread-Index: AQHWyifjYCmuD4WkfEaX3bQfrc+gxA== Date: Fri, 4 Dec 2020 10:26:12 +0000 Message-ID: <037f8fae-e663-0f68-01db-f8c36e0fe25f@ericsson.com> References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:1a3:54b1::1a4f:ee01] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7fcba3ba-9f85-4982-deaa-08d8983f066a x-ms-traffictypediagnostic: HE1PR07MB4201: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: xiH6eRudVw5oma/KtbbmGLmnprfWwWEQuURmNjVcpiagQBA+l07kh+xvkUoHH1kI60ho4J1+HnzLPu8a0zjjOCYMOaJpwT2O6QNYsbpahSeRYapIARGTsnPfK9+ggzDOyL/C1nd5Ob1+1ppdeBmpbZHMnW68dWwGEXjHNFwGvSYuzf7jRkb1IX+6+uLFi79GFNOILVI7+a584R6rgs0TeBHe9Yqwpb2OenANZDSBOAVRd5Dfi3llZhiiFG0t0MQQwFfqysci0eANRtolmeP+CmU0XGXFyO/XDkKmz3ccv5vu1q+3RXdzXgglSUgu1h1ooy6c/dGQZL4T9Q7UZl1knHzhG8sgG+7ymVeTPHZ/zps4YBc4Aj3aYH+LEhYepQJUUl8oA7p7fZQfteEF8HheLUiBAh3xpwZk8+hEfne5Mnm9pvCDDm/IxUDcfYWDkmoSIyz2fQS4JzmAysDaZZ7oLzd6mToIBWoyS2fpQvLMkjU= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0701MB2185.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(346002)(39860400002)(376002)(366004)(136003)(110136005)(31686004)(8936002)(966005)(54906003)(71200400001)(66446008)(66476007)(5660300002)(66556008)(36756003)(76116006)(478600001)(19627405001)(316002)(30864003)(6512007)(66574015)(31696002)(66946007)(6486002)(83380400001)(166002)(53546011)(4326008)(2906002)(6506007)(64756008)(4001150100001)(86362001)(8676002)(2616005)(186003)(45980500001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?Windows-1252?Q?TqE9N0aZZj1D10xRPza2FEBDXzdyuqWR8i3cAwyAyNp+T07JSVCcOUTa?= =?Windows-1252?Q?Nv2cbs4UvxBlVhsEmajFMypm6crJrQV8aYguBhPDAlremvHdljlH7lJK?= =?Windows-1252?Q?jDEjeXsW8D4SpJJ//s2uX+LJyWj8sFlEc6gFhZpebzmob6QWAcSgikVp?= =?Windows-1252?Q?m+TkAWxhtpq9pdWYnrHfn1XXrc5Yv3XLNHVUQSQ62db4RWolW99pZedY?= =?Windows-1252?Q?837PzfWhuUzTmlNCIkQqOBuJ70haxGCYQi0VYlr4KiZmzAcuXjZ8MKcB?= =?Windows-1252?Q?wtBK5BnB7OXWbkjPmd3W6uQqU2pbEhRT+kUPRE8uiv82AIYQiidEy1zj?= =?Windows-1252?Q?NoKmyNKeqX+nvNrgbYaTmElb+BDS8+D1hDSK6JAbfxhNMqbGcbD9NYX6?= =?Windows-1252?Q?5e3RQjzawMXGYvf0qjGPzFmLa3GlM1dLyiBBIYAGCXImLWo84hOYbEDf?= =?Windows-1252?Q?M1h1e7GEM5Twkhdwt260n8k4MeVElJIFf0E6cggHqzl0wAKlvVaoynaC?= =?Windows-1252?Q?AnOJwim6WvW8L7byw403WMFJL9salYnLPzZcSsbnBG71PSe2UESXVlb2?= =?Windows-1252?Q?ZbKvaH72PjF2acI6x4bzqauR8nHZz1St8S5OAmgTo6aj8m7I5RAV7Phz?= =?Windows-1252?Q?zqCEsGOCNtSSFIGkZjTOPo1TItuXUvP4Y5XocfqVun02FDfgIGqLV/mx?= =?Windows-1252?Q?PvbY7MUwIv6ltqKJDjZY5En/WMnNN3roBU36scBER8fwUBK2xFtYPXD+?= =?Windows-1252?Q?UKIp++WDgQb9R8BvFAkuZjPOuWSNePyc+UhokTQAP30ClLw5U7LYRaAI?= =?Windows-1252?Q?jnfBFRd/+ad1EQp5P/lvaRmrGPuc+eZIBfADaXljakmoezqUnNZwxeyU?= =?Windows-1252?Q?bVLaaqWsVSyUs4iGDF5NspGCC6YMMsUpqoIo/6gza3nzuR6dssVFMW3e?= =?Windows-1252?Q?NTybb91wUKDSKU8IfhbP/8wzSIfM81YBJ/UfK+okqttpKG6LZPzhWkRb?= =?Windows-1252?Q?X5vEVxMjpnsnCmoaLsMmV90cvRPbXwpJ+FtUX6xjcDXcDoJRnDGhvEdc?= =?Windows-1252?Q?3nY5hMQdFjaXAzEWmYSh47zIPfzUxWCL+Pv2xg=3D=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_037f8faee6630f6801dbf8c36e0fe25fericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR0701MB2185.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7fcba3ba-9f85-4982-deaa-08d8983f066a X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Dec 2020 10:26:13.0064 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 7PFpGZqROF5oBOLsrCCGP0BkWcbgKOkqsJxdI+eHtz83PkX/cFz/IlDAtLAQa+SbPszLZ3yr7ewgleANhf9BHDR7wDE5l/Ltn+AO7uU4TOg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4201 Archived-At: Subject: Re: [Ace] [Emu] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Dec 2020 10:26:20 -0000 --_000_037f8faee6630f6801dbf8c36e0fe25fericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi ACE, I guess EMU is happy to see new deployments and uses of EAP. I think ACE is= better suited for taking on this work if there is interest. EMU primarily = deals with the base EAP protocol and various EAP authentication methods. We= can obviously help with reviewing the document later on. I would note that EAP-over-foo is generally defined by the lower-layer. So = for example, EAP over LAN (EAPOL) is specified by IEEE. In this case, the l= ower-layer is CoAP so we at the IETF are responsible for specifying it (if = there is a desire to do so). A draft for HTTP authentication with EAP was s= ubmitted a couple of decades ago: https://tools.ietf.org/html/draft-torvine= n-http-eap-01. That was unfortunately never finished. But maybe CoAP will b= e different and ACE can finish this work item if it chooses to adopt it. --Mohit On 12/3/20 3:20 PM, Daniel Migault wrote: CCing emu, core It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it. Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter. Yours, Daniel ________________________________ From: Ace on behalf of = Dan Garcia Sent: Thursday, December 3, 2020 6:10 AM To: ace@ietf.org Subject: [Ace] Proposed charter for ACE (EAP over CoAP?) Dear all: Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coa= p-transport-00), we were wondering whethere it could also consider specifyi= ng EAP (Extensible Authentication Protocol) over CoAP. In this sense, we proposed this some time ago and we have implementations a= bout this. https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 https://www.mdpi.com/1424-8220/16/3/358 https://www.mdpi.com/1424-8220/17/11/2646 The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol. Therefore, we would like to propose the following modification to the chart= er: "The Working Group will examine how to use Constrained Application Protocol= (CoAP) as a transport medium for certificate enrollment protocols, such as= EST and CMPv2, as well as a transport for authentication protocols such as= EAP, and standardize them as needed." This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport = of EAP over CoAP: Any opinion about this? Best Regards. El 18/11/2020 a las 8:08, Daniel Migault escribi=F3: Hi, Please find the proposed charter we agreed on during the interim meeting. I= f you would like to propose any change, please use the following URL by Nov= ember 25: https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing Yours, Daniel The Authentication and Authorization for Constrained Environments (ace) WG = has defined a standardized solution framework for authentication and author= ization to enable authorized access to resources identified by a URI and ho= sted on a resource server in constrained environments. The access to the resource is mediated by an authorization server, which is= not considered to be constrained. Profiles of this framework for application to security protocols commonly u= sed in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have = also been standardized. The Working Group is charged with maintenance of t= he framework and existing profiles thereof, and may undertake work to speci= fy profiles of the framework for additional secure communications protocols= and for additional support services providing authorized access to crypto = keys (that are not necessarily limited to constrained endpoints, though the= focus remains on deployment in ecosystems with a substantial portion of co= nstrained devices). In addition to the ongoing maintenance work, the Working Group will extend = the framework as needed for applicability to group communications, with ini= tial focus on (D)TLS and (Group) OSCORE as the underlying group communicati= on security protocols. The Working Group will standardize procedures for re= questing and distributing group keying material using the ACE framework as = well as appropriated management interfaces. The Working Group will standardize a format for expressing authorization in= formation for a given authenticated principal as received from an authoriza= tion manager. The Working Group will examine how to use Constrained Application Protocol = (CoAP) as a transport medium for certificate enrollment protocols, such as = EST and CMPv2, and standardize as needed. On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: Thanks for updating the draft charter at [1], Daniel! I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review. -Ben On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > Thank you all for the feed backs. For the purpose of driving the charter > discussion at the IETf 109, I have added the comments into the proposed > text [1]. > > My current understanding is that it seems beneficial to add CMPv2 over Co= AP > in the charter. I am happy to be contradicted. > * I have not seen a clear cut to do one or the other. > * EST and CMPv2 are two protocols that can be used for enrollment or cert > management while addressing different cases / needs / situations -- maybe > we can clarify that point. I can see leveraging the existing CMP > infrastructure, but it seems that is not the only one. > * I am not convinced that not having CMP over CoAP will not prevent its > deployment and as such I prefer to have it standardized - this might be a > personal thought. > * Adding any piece of work require cycles, but it seems to me that CPM wi= ll > not have a major impact on the WG progress. The work will probably includ= e > other WG such a LAMPS. > > Yours, > Daniel > > [1] > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > Hi Goran, > > > > I added the text to the charter we will discuss later. > > > > Yours, > > Daniel > > > > On Fri, Nov 13, 2020 at 10:26 AM G=F6ran Selander < > > goran.selander@ericsson.com> wrote: > > > >> Hi Daniel, > >> > >> > >> > >> Here=92s another input to the charter. > >> > >> > >> > >> The current group key management solutions addresses the problem of > >> authorized access to group keys and public keys of group members. > >> > >> > >> > >> A related problem is authorized access of public keys of other devices > >> not necessarily part of a security group, in the sense of sharing a > >> symmetric key used to protect group messages. > >> > >> > >> > >> Authorized access to raw public keys serves an important function in > >> constrained settings where public key certificates may not be feasible= due > >> to the incurred overhead, e.g. for when authenticating using EDHOC > >> (draft-ietf-lake-edhoc). > >> > >> This functionality is thus a subset of what is already supported, but > >> since the current solution is geared towards groups a different soluti= on > >> may be needed (although it is probably possible to reuse parts from th= e > >> existing schemes for provisioning and requesting public keys). > >> > >> > >> > >> With this in mind, I propose the following change (highlighted in > >> boldface below): > >> > >> > >> > >> OLD > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols (that are= not > >> necessarily limited to constrained endpoints, though the focus remains= on > >> deployment ecosystems with a substantial portion of constrained device= s). > >> > >> > >> > >> NEW > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols *and **fo= r > >> additional **support services **providing* *authorized access to crypt= o* *keys > >> *(that are not necessarily limited to constrained endpoints, though th= e > >> focus remains on deployment ecosystems with a substantial portion of > >> constrained devices). > >> > >> > >> > >> G=F6ran > >> > >> > >> > >> > >> > >> > >> > >> On 2020-10-15, 19:50, "Ace" > wrote: > >> > >> Hi, > >> > >> I would like to start the charter discussion. Here is a draft of a > >> proposed charter [1]. > >> > >> > >> > >> It seems to be that additional discussion is needed with regard to the > >> last paragraph related certificate management. In particular the discu= ssion > >> might revive a discussion that happened in 2017 [2] - when I was not > >> co-chair of ACE -and considered other expired work such as [3]. Please= make > >> this discussion constructive on this thread. > >> > >> > >> > >> The fundamental question is whether we need certificate management at > >> this stage. If the answer is yes, and we have multiple proposals, it w= ould > >> be good to clarify the position of the different proposals and evaluat= e > >> whether a selection is needed or not before validating the charter. > >> > >> > >> > >> Please provide your inputs on the mailing list before October 30. Of > >> course for minor edits, you may suggest them directly on the google do= c. > >> > >> > >> > >> Yours, > >> > >> Daniel > >> > >> > >> > >> [1] > >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2Bn= BXhoDiptY/edit?usp=3Dsharing > >> < > >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e= 2237f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u= =3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR= 8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing> > >> > >> > >> [2] > >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191= 300/ > >> > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > >> > >> > >> > >> -- > >> > >> Daniel Migault > >> > >> > >> > >> Ericsson > >> > > > > > > -- > > Daniel Migault > > Ericsson > > > > > -- > Daniel Migault > Ericsson > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace -- Daniel Migault Ericsson _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu --_000_037f8faee6630f6801dbf8c36e0fe25fericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-ID: <7A7D2D832A5CF64D83B63134D3C9BC3E@eurprd07.prod.outlook.com> Content-Transfer-Encoding: quoted-printable

Hi ACE,

I guess EMU is happy to see new deployments and uses of EAP. I think ACE is= better suited for taking on this work if there is interest. EMU primarily = deals with the base EAP protocol and various EAP authentication methods. We= can obviously help with reviewing the document later on.

I would note that EAP-over-foo is generally defined by the lower-layer. So = for example, EAP over LAN (EAPOL) is specified by IEEE. In this case, the l= ower-layer is CoAP so we at the IETF are responsible for specifying it (if = there is a desire to do so). A draft for HTTP authentication with EAP was submitted a couple of decades ago: https://tools.ietf.org/html/draft-torvinen-http-eap-01. That was unfort= unately never finished. But maybe CoAP will be different and ACE can finish= this work item if it chooses to adopt it. 


--Mohit

On 12/3/20 3:20 PM, Daniel Migault wrote:
CCing emu, core

It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it. = ;

Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter. 

Yours, 
Daniel
From: Ace <= ;ace-bounces@ietf.org> on behalf of Dan Garcia <dan= .garcia@um.es>
Sent: Thursday, December 3, 2020 6:10 AM
To: ace@ietf.org <ace@iet= f.org>
Subject: [Ace] Proposed charter for ACE (EAP over CoAP?)
 

Dear all:

Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transpor= t-00), we were wondering whethere it could also consider specifying EAP (Extensib= le Authentication Protocol) over CoAP.

In this sense, we proposed this some time ago and we have implementations a= bout this.

https://da= tatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06
https://www.mdpi.com/1424-8220/16/3/358=
https://www.mdpi.com/1424-8220/17/11/= 2646

The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol.

Therefore, we would like to propose the following modification to the chart= er:

"The Working Group will examine how to use Constrained Application Pro= tocol (CoAP) as a transport medium for certificate enrollment protocols, su= ch as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and= standardize them as needed."

This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport of EAP over CoAP:

Any opinion about this?

Best Regards.

El 18/11/2020 a las 8:08, Daniel Migault e= scribi=F3:
Hi, 

Please find the proposed charter we agreed on during the interim meeti= ng. If you would like to propose any change, please use the following URL b= y November 25:


Yours, 
Daniel

The Authentication = and Authorization for Constrained Environments (ace) WG has defined a standardized solution framework for authentication = and authorization to enable authorized access to resources identified by a = URI and hosted on a resource server in constrained environments. 

The access to the r= esource is mediated by an authorization server, which is not considered to be constrained.


Profiles of this fr= amework for application to security protocols commonly used in constrained environments, including CoAP+DTLS and CoAP+OS= CORE, have also been standardized.  The Working Group is charged with = maintenance of the framework and existing profiles thereof, and may underta= ke work to specify profiles of the framework for additional secure communications protocols and for additional support services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the focus remains on deployment i= n ecosystems with a substantial portion of constrained devices).


In addition to the = ongoing maintenance work, the Working Group will extend the framework as needed for applicability to group communicati= ons, with initial focus on (D)TLS and (Group) OSCORE as the underlying grou= p communication security protocols. The Working Group will standardize proc= edures for requesting and distributing group keying material using the ACE framework as well as appropriated mana= gement interfaces. 


The Working Group w= ill standardize a format for expressing authorization information for a given authenticated principal as received from an author= ization manager. 


The Working Group w= ill examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols= , such as EST and CMPv2, and standardize as needed.



On Tue, Nov 17, 2020 at 6:47 PM Ben= jamin Kaduk <k= aduk@mit.edu> wrote:
Thanks for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to=
discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the chart= er
> discussion at the IETf 109, I have added the comments into the propose= d
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over= CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the other.
> * EST and CMPv2 are two protocols that can be used for enrollment or c= ert
> management while addressing different cases / needs / situations -- ma= ybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only one.
> * I am not convinced that not having CMP over CoAP will not prevent it= s
> deployment and as such I prefer to have it standardized - this might b= e a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM= will
> not have a major impact on the WG progress. The work will probably inc= lude
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gm= ail.com> wrote:
>
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=F6ran Selander <
> > goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=92s another input to the charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the prob= lem of
> >> authorized access to group keys and public keys of group memb= ers.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of othe= r devices
> >> not necessarily part of a security group, in the sense of sha= ring a
> >> symmetric key used to protect group messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important func= tion in
> >> constrained settings where public key certificates may not be= feasible due
> >> to the incurred overhead, e.g. for when authenticating using = EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already suppor= ted, but
> >> since the current solution is geared towards groups a differe= nt solution
> >> may be needed (although it is probably possible to reuse part= s from the
> >> existing schemes for provisioning and requesting public keys)= .
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighte= d in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = (that are not
> >> necessarily limited to constrained endpoints, though the focu= s remains on
> >> deployment ecosystems with a substantial portion of constrain= ed devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = *and **for
> >> additional **support services **providing* *authorized access= to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, = though the
> >> focus remains on deployment ecosystems with a substantial por= tion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=F6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces= @ietf.org> wrote:
> >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft= of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with rega= rd to the
> >> last paragraph related certificate management. In particular = the discussion
> >> might revive a discussion that happened in 2017 [2] - when I = was not
> >> co-chair of ACE -and considered other expired work such as [3= ]. Please make
> >> this discussion constructive on this thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate manag= ement at
> >> this stage. If the answer is yes, and we have multiple propos= als, it would
> >> be good to clarify the position of the different proposals an= d evaluate
> >> whether a selection is needed or not before validating the ch= arter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October= 30. Of
> >> course for minor edits, you may suggest them directly on the = google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e2237f= 51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc= 5&u=3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjS= j2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing>
> >>
> >>
> >> [2]
> >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/<= /a>
> >>
> >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/
> >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
= Ace@ietf.org
https://www.ietf.org/mailman/listi= nfo/ace


--
Daniel Migault
Ericsson

____________________________________________=
___
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo=
/ace


____________________________________=
___________
Emu mailing list
Emu@ietf=
.org
https://www.ietf.org/mailman/listinfo/emu
--_000_037f8faee6630f6801dbf8c36e0fe25fericssoncom_-- From nobody Mon Dec 7 05:43:44 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14A063A13A5 for ; Mon, 7 Dec 2020 05:43:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.087 X-Spam-Level: X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TJ4RGRb8Yqug for ; Mon, 7 Dec 2020 05:43:40 -0800 (PST) Received: from mail-vs1-xe43.google.com (mail-vs1-xe43.google.com [IPv6:2607:f8b0:4864:20::e43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 709413A13A3 for ; Mon, 7 Dec 2020 05:43:40 -0800 (PST) Received: by mail-vs1-xe43.google.com with SMTP id x4so7542206vsp.7 for ; Mon, 07 Dec 2020 05:43:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HZ71sd4CGrFSI/8AEFOEibGvsV3cfyUnHoLiB9Qo+ak=; b=vczPxzVV9cpEnPHsLQ4GKfjozGRUytDESsHIyeD7CldjutMdyPmGje/3rrFMLGPEGH urWCj29ZO/kEoRFoRxYqVsPfvn61cQpbahcsjEJyogR7iJggRSRGEU1ANvro6gU6gmmI Qya4wdC/ZbSd1nTFU6P8ZI9u182nj9cJCoMImBWbOTK6d9Ha10EVO3grhBXja3Xo5pEJ JCi1Qn+0TC9LrBgEijiDIbQ2xTolWrYwU+VwLB1vaKj+1gCvYUCIuzE7bqk4bVcvsPLU Tt8kP6NAti6nz40MyZi+O6p3qz2QEUQV+aeqBqXgs7EWTGoSzP4pNRn8ts7nYoSF85H5 1JwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HZ71sd4CGrFSI/8AEFOEibGvsV3cfyUnHoLiB9Qo+ak=; b=I7OQmLESFC/57BelybjGoP/RMjaSGdJqnNLYdmGXj6ZQCazPfzsZ+g+aoaDdSiQ08n 0FCRTxlxuHnJy8c43LHV7s4gBol7Grmg5LdN6uZ6KxXW9t6Gj2Oyund7xxrRkRSyLijs 1HQNfzV0OEadBjhzc6luCRwdhM4gf84LQyZV5NUljYFkm7mRasX2O7j738+wJoFZgkeX ia7uXgiL60yAt+25CNrbLSbwlWdWHoO2BDCwBPn1JeeLM50dT/pcffNI4FGv/GBRfwNi Rnh4EC1wvj7QhyqrFgsF9rEPTakMieOPCC4Xs+rwBYFyD0dtxG0+/T+W8e5tTJSxutB7 5tlw== X-Gm-Message-State: AOAM533EnVAQ/0tU+Q7hPueie7xnn+Om5kAw9viEo3fJf46Q1ieCRpVF aD/Wzv6Cq/bIYR/GOK/Ibe2VaaGg5iM0rgYIzes= X-Google-Smtp-Source: ABdhPJxPyAvn6vTPSG1jQjfJIacuo6BBYABr1yLzHqBdnXzq5qaXR1iTalc16gIU14ITmRMNtwFkNAbZZBcwMSUGgOQ= X-Received: by 2002:a67:32d4:: with SMTP id y203mr11497322vsy.30.1607348619387; Mon, 07 Dec 2020 05:43:39 -0800 (PST) MIME-Version: 1.0 References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: <20201117234700.GR39170@kduck.mit.edu> From: Daniel Migault Date: Mon, 7 Dec 2020 08:43:28 -0500 Message-ID: To: Benjamin Kaduk Cc: Ace Wg Content-Type: multipart/alternative; boundary="0000000000007d278d05b5e00370" Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 13:43:43 -0000 --0000000000007d278d05b5e00370 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, Please have a look at the latest version of the charter before we move it forward by the end of the week - December 11. I added a note on potential WG that could host the CMPv2 over CoAP - eventually. I am wondering if we should put a note to these WGs. Yours, Daniel The Authentication and Authorization for Constrained Environments (ace) WG has defined a standardized solution framework for authentication and authorization to enable authorized access to resources identified by a URI and hosted on a resource server in constrained environments. The access to the resource is mediated by an authorization server, which is not considered to be constrained. Profiles of this framework for application to security protocols commonly used in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have also been standardized. The Working Group is charged with maintenance of the framework and existing profiles thereof, and may undertake work to specify profiles of the framework for additional secure communications protocols and for additional support services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the focus remains on deployment in ecosystems with a substantial portion of constrained devices). In addition to the ongoing maintenance work, the Working Group will extend the framework as needed for applicability to group communications, with initial focus on (D)TLS and (Group) OSCORE as the underlying group communication security protocols. The Working Group will standardize procedures for requesting and distributing group keying material using the ACE framework as well as appropriated management interfaces. The Working Group will standardize a format for expressing authorization information for a given authenticated principal as received from an authorization manager. The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and standardize as needed. [Note that CMPv2 work may also be hosted in LAMPS (which revisits CMPv2), ANIMA ( which defines CMPv2 as an alternative to EST) or IOTPS. EAP work has been coordinated with EMU. In any case, if the work is being considered in ACE, we will make sure the corresponding WG will follow the progress.] On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk wrote: > Thanks for updating the draft charter at [1], Daniel! > > I note that Michael raised the question of whether some other group might > also be interested in working on CMP-over-coap, so the IESG will be sure = to > discuss that if CMP is still in the draft ACE charter when it goes to the > IESG for review. > > -Ben > > On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > > Thank you all for the feed backs. For the purpose of driving the charte= r > > discussion at the IETf 109, I have added the comments into the proposed > > text [1]. > > > > My current understanding is that it seems beneficial to add CMPv2 over > CoAP > > in the charter. I am happy to be contradicted. > > * I have not seen a clear cut to do one or the other. > > * EST and CMPv2 are two protocols that can be used for enrollment or ce= rt > > management while addressing different cases / needs / situations -- may= be > > we can clarify that point. I can see leveraging the existing CMP > > infrastructure, but it seems that is not the only one. > > * I am not convinced that not having CMP over CoAP will not prevent its > > deployment and as such I prefer to have it standardized - this might be= a > > personal thought. > > * Adding any piece of work require cycles, but it seems to me that CPM > will > > not have a major impact on the WG progress. The work will probably > include > > other WG such a LAMPS. > > > > Yours, > > Daniel > > > > [1] > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > > > Hi Goran, > > > > > > I added the text to the charter we will discuss later. > > > > > > Yours, > > > Daniel > > > > > > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander < > > > goran.selander@ericsson.com> wrote: > > > > > >> Hi Daniel, > > >> > > >> > > >> > > >> Here=E2=80=99s another input to the charter. > > >> > > >> > > >> > > >> The current group key management solutions addresses the problem of > > >> authorized access to group keys and public keys of group members. > > >> > > >> > > >> > > >> A related problem is authorized access of public keys of other devic= es > > >> not necessarily part of a security group, in the sense of sharing a > > >> symmetric key used to protect group messages. > > >> > > >> > > >> > > >> Authorized access to raw public keys serves an important function in > > >> constrained settings where public key certificates may not be > feasible due > > >> to the incurred overhead, e.g. for when authenticating using EDHOC > > >> (draft-ietf-lake-edhoc). > > >> > > >> This functionality is thus a subset of what is already supported, bu= t > > >> since the current solution is geared towards groups a different > solution > > >> may be needed (although it is probably possible to reuse parts from > the > > >> existing schemes for provisioning and requesting public keys). > > >> > > >> > > >> > > >> With this in mind, I propose the following change (highlighted in > > >> boldface below): > > >> > > >> > > >> > > >> OLD > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols (that > are not > > >> necessarily limited to constrained endpoints, though the focus > remains on > > >> deployment ecosystems with a substantial portion of constrained > devices). > > >> > > >> > > >> > > >> NEW > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols *and > **for > > >> additional **support services **providing* *authorized access to > crypto* *keys > > >> *(that are not necessarily limited to constrained endpoints, though > the > > >> focus remains on deployment ecosystems with a substantial portion of > > >> constrained devices). > > >> > > >> > > >> > > >> G=C3=B6ran > > >> > > >> > > >> > > >> > > >> > > >> > > >> > > >> On 2020-10-15, 19:50, "Ace" wrote: > > >> > > >> Hi, > > >> > > >> I would like to start the charter discussion. Here is a draft of a > > >> proposed charter [1]. > > >> > > >> > > >> > > >> It seems to be that additional discussion is needed with regard to t= he > > >> last paragraph related certificate management. In particular the > discussion > > >> might revive a discussion that happened in 2017 [2] - when I was not > > >> co-chair of ACE -and considered other expired work such as [3]. > Please make > > >> this discussion constructive on this thread. > > >> > > >> > > >> > > >> The fundamental question is whether we need certificate management a= t > > >> this stage. If the answer is yes, and we have multiple proposals, it > would > > >> be good to clarify the position of the different proposals and > evaluate > > >> whether a selection is needed or not before validating the charter. > > >> > > >> > > >> > > >> Please provide your inputs on the mailing list before October 30. Of > > >> course for minor edits, you may suggest them directly on the google > doc. > > >> > > >> > > >> > > >> Yours, > > >> > > >> Daniel > > >> > > >> > > >> > > >> [1] > > >> > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > >> < > > >> > https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e223= 7f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=3D= https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing > > > > >> > > >> > > >> [2] > > >> > https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300= / > > >> > > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > > >> > > >> > > >> > > >> -- > > >> > > >> Daniel Migault > > >> > > >> > > >> > > >> Ericsson > > >> > > > > > > > > > -- > > > Daniel Migault > > > Ericsson > > > > > > > > > -- > > Daniel Migault > > Ericsson > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --=20 Daniel Migault Ericsson --0000000000007d278d05b5e00370 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

Please have a look at the lat= est version of the charter before we move it forward by the end of the week= - December 11.=C2=A0

I added a note on potential = WG that could=C2=A0host the CMPv2 over CoAP - eventually. I am wondering if= we should put a note to these WGs.=C2=A0

Yours,= =C2=A0
Daniel

The Authentication and Authorization for Constrained Envir= onments (ace) WG has defined a standardized solution framework for authenti= cation and authorization to enable authorized access to resources identifie= d by a URI and hosted on a resource server in constrained environments.=C2= =A0

The access = to the resource is mediated by an authorization server, which is not consid= ered to be constrained.


Profiles of this framework for application to security protoco= ls commonly used in constrained environments, including CoAP+DTLS and CoAP+= OSCORE, have also been standardized.=C2=A0 The Working Group is charged wit= h maintenance of the framework and existing profiles thereof, and may under= take work to specify profiles of the framework for additional secure commun= ications protocols and for additional support s= ervices providing authorized access to crypto keys (that are not necessarily limited to const= rained endpoints, though the focus remains on deployment in ecosystems with= a substantial portion of constrained devices).


In addition to the ongoing maintenan= ce work, the Working Group will extend the framework as needed for applicab= ility to group communications, with initial focus on (D)TLS and (Group) OSC= ORE as the underlying group communication security protocols. The Working G= roup will standardize procedures for requesting and distributing group keyi= ng material using the ACE framework as well as appropriated management inte= rfaces.=C2=A0


The Working Group will standardize a format for expressing authorization= information for a given authenticated principal as received from an author= ization manager.=C2=A0


The Working Group will examine how to use Constrained Applicati= on Protocol (CoAP) as a transport medium for certificate enrollment protoco= ls, such as EST and CMPv2, as well as a transport for authentication protoc= ols such as EAP, and standardize as needed. [Note that CMPv2 work may also = be hosted in LAMPS (which revisits CMPv2), ANIMA ( which defines CMPv2 as a= n alternative to EST) or IOTPS. EAP work has been coordinated with EMU. In = any case, if the work is being considered in ACE, we will make sure the cor= responding WG will follow the progress.]


=C2=A0




On Tue, Nov 17, 2020 at 6:47 = PM Benjamin Kaduk <kaduk@mit.edu>= ; wrote:
Thanks = for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to=
discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the chart= er
> discussion at the IETf 109, I have added the comments into the propose= d
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over= CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the other.
> * EST and CMPv2 are two protocols that can be used for enrollment or c= ert
> management while addressing different cases / needs / situations -- ma= ybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only one.
> * I am not convinced that not having CMP over CoAP will not prevent it= s
> deployment and as such I prefer to have it standardized - this might b= e a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM= will
> not have a major impact on the WG progress. The work will probably inc= lude
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBX= hoDiptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> wrote: >
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander <
> > = goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=E2=80=99s another input to the charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the prob= lem of
> >> authorized access to group keys and public keys of group memb= ers.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of othe= r devices
> >> not necessarily part of a security group, in the sense of sha= ring a
> >> symmetric key used to protect group messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important func= tion in
> >> constrained settings where public key certificates may not be= feasible due
> >> to the incurred overhead, e.g. for when authenticating using = EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already suppor= ted, but
> >> since the current solution is geared towards groups a differe= nt solution
> >> may be needed (although it is probably possible to reuse part= s from the
> >> existing schemes for provisioning and requesting public keys)= .
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighte= d in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = (that are not
> >> necessarily limited to constrained endpoints, though the focu= s remains on
> >> deployment ecosystems with a substantial portion of constrain= ed devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = *and **for
> >> additional **support services **providing* *authorized access= to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, = though the
> >> focus remains on deployment ecosystems with a substantial por= tion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=C3=B6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> wrote:<= br> > >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft= of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with rega= rd to the
> >> last paragraph related certificate management. In particular = the discussion
> >> might revive a discussion that happened in 2017 [2] - when I = was not
> >> co-chair of ACE -and considered other expired work such as [3= ]. Please make
> >> this discussion constructive on this thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate manag= ement at
> >> this stage. If the answer is yes, and we have multiple propos= als, it would
> >> be good to clarify the position of the different proposals an= d evaluate
> >> whether a selection is needed or not before validating the ch= arter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October= 30. Of
> >> course for minor edits, you may suggest them directly on the = google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k= =3D4f3d9c3b-118c475b-4f3ddca0-86e2237f51fb-627e48b069462d70&q=3D1&e= =3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=3Dhttps%3A%2F%2Fdocs.google.c= om%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fu= sp%3Dsharing>
> >>
> >>
> >> [2]
> >> https://data= tracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/
> >>
> >> [3] https://datatracker.ietf.= org/doc/draft-selander-ace-eals/
> >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson
--0000000000007d278d05b5e00370-- From nobody Mon Dec 7 06:07:51 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E223C3A13E9; Mon, 7 Dec 2020 06:07:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sOgjNwR0yv0b; Mon, 7 Dec 2020 06:07:45 -0800 (PST) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2056.outbound.protection.outlook.com [40.107.20.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7DE73A0D78; Mon, 7 Dec 2020 06:07:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=N2ZmbjPLPPpJKIH4CSgOSXR44cWI72xPNwUeFu7rR5vdZiKGGgFBeoUS6VL4JZqvZYzrK+DuPy6oNZMD3fDzH/iiSlt0aqB9wrQh4tXxPper3GNMfSdG7sovZOzmcOET5cWR5VZQYf5gM6Tl6z9g864eZScdSoxaqstTEL6MMBmUNtQze7dJmEqRYgMalDPsbMywErLi2WdcTK2joiOPmTsyQ4B0kebx2tcYU18sYMUKc63FLIHUkTxHjAxdxa873tuPAA8rw1roBiWLMrcVi8iToOIperha294ypTg3io8pg/486Bs3t5QM74itln6T+sYLDOTCYGPpE4Vm+xwRyQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X7UM25wtKf5P7+jbujTijJ1z5/fw2uCXLkQBgD9DIDY=; b=ZNmMJ3tlb/bdebiAe1u4oDRzBvzLQgtvHZnfZRED9/qX/vp3AYAocYbeE76YKS2V02KsLfFLq6xP0ChKydd7lgHO/Ch9mTDXfp5OtPg6aa1gs4T31Z4Ibh/u+vJpMr2ii+6Qb09oD2w90ncTGiwJUg0ue03JonebVGDXNYjK0ZFbplkrW8IbZVPRVqjrVHDpX3drXV90EFSUw2EwAZB3cPYVqcBv0cVj1xKBUNqnDNrIr95PS5l9EDt3Qi9OBqkacmwx4A+oBnhY2tzmMRurD9yINH167zS1Xnil9itrKvc2c28pFYaFNScw3EONmy+QcSU5PgosddCA+RZKfKjAcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X7UM25wtKf5P7+jbujTijJ1z5/fw2uCXLkQBgD9DIDY=; b=NFE3aPHR5KZlRO5wi+dr5+wk82iV3tn3zOMHQaiumA4XXU6Pv2xSzWOohfqXwLdQA/fLa/fkZRgUMqt7sHrE4ocjiGdbIkcfmGcM5LEAl9tbZOIMvyEOBZgU7DL62dXrBscu7lVxD2Lz7pPsr4Z26qKI60TMBHd23Ap+Neju4d8= Received: from HE1PR0702MB3674.eurprd07.prod.outlook.com (2603:10a6:7:82::14) by HE1PR0702MB3673.eurprd07.prod.outlook.com (2603:10a6:7:81::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.11; Mon, 7 Dec 2020 14:07:40 +0000 Received: from HE1PR0702MB3674.eurprd07.prod.outlook.com ([fe80::fd09:b8f4:2698:e86]) by HE1PR0702MB3674.eurprd07.prod.outlook.com ([fe80::fd09:b8f4:2698:e86%6]) with mapi id 15.20.3654.006; Mon, 7 Dec 2020 14:07:40 +0000 From: =?Windows-1252?Q?G=F6ran_Selander?= To: Laurent Toutain , Daniel Migault CC: "core@ietf.org WG (core@ietf.org)" , EMU WG , "ace@ietf.org" Thread-Topic: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) Thread-Index: AQHWyWUY8FZyqW9rGEq1RKImqUzE1qnlW0AAgABfKQCABfZHuQ== Date: Mon, 7 Dec 2020 14:07:40 +0000 Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: telecom-bretagne.eu; dkim=none (message not signed) header.d=none;telecom-bretagne.eu; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [83.251.145.232] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 29d1003c-d61c-45fb-bff8-08d89ab97582 x-ms-traffictypediagnostic: HE1PR0702MB3673: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Mw3y7qO5+1dYO7pfBxV4gV/6HuMjdZozvv/BZ9AupTib0r7gUwHHxnZCgmmBV3BA3SNLj+JbY29Yize7EKKDUdfxhzXg4GtztILdF0MhEGFYRkfuSeEYSIgHsjD4JbTjZFhLv1MhmqRcPfqgU6mawV+aX3ablfGipOuHu1hhzYyyk7MQcOnufULo/R17m9S7CebUJM9lB5xZK0PcXPKnwfWkwedRAfaVRL8uR7hxAUM8mGHV9/g/8hWSfJPe2QA2U0FxotA0nwW0XDfEVCHPix2Iq9zExtNkVktEKPsmIDx+TkhWmZBoH9VbyvQDefdTefd+8tdrJEnnpsZmRENZ3u4DtA2tcduTmgbCWv/A7ATv2W9THPyQ6teKQUndmbmweRf+3EnX/VH7jYsH5nykfgZEMT+g9+3NBMuBOzbfhzQQIjFo/XakjG5BYrGBCKwZ8iWwou83w5xvAfyX9/3yzg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0702MB3674.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(39860400002)(346002)(376002)(136003)(110136005)(66574015)(478600001)(52536014)(4001150100001)(9686003)(33656002)(8936002)(66556008)(186003)(55016002)(66946007)(54906003)(64756008)(8676002)(316002)(66476007)(4326008)(2906002)(86362001)(166002)(7696005)(71200400001)(5660300002)(76116006)(66446008)(30864003)(966005)(53546011)(6506007)(26005)(83380400001)(579004)(15940465004); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?Windows-1252?Q?S6pKRXEwdHDJouJJSoh26nfvKSR0tiq7Hy4rEi2lTHTexD8nPSpGAzZL?= =?Windows-1252?Q?WwAN/54maXj8ccIC1dZMqFYyVLUf6fiy3xgfxoBPy8V6sr+JZih7iUyo?= =?Windows-1252?Q?dYtdxyAv1nnUTf1f0xE85Cj10BDXEq0Olyi+Z+Phu2O4e3Zq5CC6+UyD?= =?Windows-1252?Q?0oOLjX5KGUEJWecsZePL4+Wid5XfiLqoVuqkd2oy8zTrujiIyUyFDBE/?= =?Windows-1252?Q?etm6c/Xo/bRxJD+ar/tznrUkZkGZ/zsjQ6/qKxm7a//zCfhmk2RrHbYI?= =?Windows-1252?Q?l7X6D3Trm/k0twIN+uHpN7YD/T/VekinIpGiL0vBn/V5hlqgyZYTqm1q?= =?Windows-1252?Q?3lyWvp8rCTjvu0ck5LFJZ2t+zbOvoRi243pgy1m8nPQrNETfPi/A6Be+?= =?Windows-1252?Q?EYYxRNgBBEDxlN/6jj+hgr/VVUgdiDVj/TEGOM0sV40iNKNkR49WIeGt?= =?Windows-1252?Q?sL1F78V1Io815BQrq+UhuopRcymggCNA7873PCQMv4lKQLeWbjW1OB+3?= =?Windows-1252?Q?R5+vbAzUTg0qm5rRX/c4VXKYzQRfHYRTy2K0CUXDRLFsgevI06Erm8x4?= =?Windows-1252?Q?NZYH2aliotlmAEuD0jBgC67cj1x7T7ukO3yjL/ILgBYJ2Vc45b1/mrd8?= =?Windows-1252?Q?I5rWtpeDGuctvJkuKD2R0LsDUnh1ZOpj0+KNrWlbg4dDF77xO7EB+hie?= =?Windows-1252?Q?cvK8g4WbglXw7uiKWPElp66xu6QEyGfSwIG2BALohF8cf7DfXdy7Ick7?= =?Windows-1252?Q?rNSJsQUpKzu1jBYW2NCLT+soxgDbpWAsN0TlWbTOF/8+mhLuGLvYuwor?= =?Windows-1252?Q?QvmeiCgu9NDJm9QDkwzWiuKyRECIajg0LxJCOH8i8njcXba/gL+8lISZ?= =?Windows-1252?Q?71137gtfViWPyys0MpZsfmDLpx55JrtFEfXxxLE4xNeXUIzjj0fadThl?= =?Windows-1252?Q?qoXfG4o8mjOwEXm5G5M+WwK4TvAEPkPxCrvWIG58PpuJMSZuHVEd2K28?= =?Windows-1252?Q?C3NWIS8dnKWPyQOE0L2jN5fhwjTxEFWJFuf/fjv/5duaMuUb+8TAUBsY?= =?Windows-1252?Q?iyKK7M/Vra22twE8SmgoLBiGB6ZNyGu2PQnM/Q=3D=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_HE1PR0702MB367429A9C8921A5252133523F4CE0HE1PR0702MB3674_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR0702MB3674.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 29d1003c-d61c-45fb-bff8-08d89ab97582 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Dec 2020 14:07:40.3096 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: YGKsIxty2BmXjd1CXGLRddMguJi4NsChc5Nyqc3nqpqaXKxNWaTuZeuiB9Krgt6QnUSihaKgeUE8MXQVYsH2IFBHOuwUfT6AKNl8VtaGQR8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3673 Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 14:07:50 -0000 --_000_HE1PR0702MB367429A9C8921A5252133523F4CE0HE1PR0702MB3674_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable +1. (The recently updated ACE charter should cover this work.) G=F6ran On 2020-12-03, 20:03, "core" wrote: Hi, I think it is important to have EAP on top of CoAP, as Dan said it fit well= with the last charter item. Laurent On Thu, Dec 3, 2020 at 2:20 PM Daniel Migault > = wrote: CCing emu, core It seems ACE to me that ACE could be home for such a document. I am wonderi= ng if emu core or any other WG believe there is a better place for it. Regarding ACE I am wondering what is the WG opinion about adding this item = to the ACE charter. Yours, Daniel ________________________________________ From: Ace > on behalf of = Dan Garcia > Sent: Thursday, December 3, 2020 6:10 AM To: ace@ietf.org > Subject: [Ace] Proposed charter for ACE (EAP over CoAP?) Dear all: Regarding the new charter, since ACE is considering the definition of CoAP = transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coa= p-transport-00), we were wondering whethere it could also consider specifyi= ng EAP (Extensible Authentication Protocol) over CoAP. In this sense, we proposed this some time ago and we have implementations a= bout this. https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 https://www.mdpi.com/1424-8220/16/3/358 https://www.mdpi.com/1424-8220/17/11/2646 The usage of CoAP can provide a very light and link-layer independent (we e= ven tested in LoRa networks) EAP lower-layer (transport for EAP) suitable f= or IoT enviroment. We believe this would be really useful since EAP provide= s flexibility for the authentication and it is a well-known protocol. Therefore, we would like to propose the following modification to the chart= er: "The Working Group will examine how to use Constrained Application Protocol= (CoAP) as a transport medium for certificate enrollment protocols, such as= EST and CMPv2, as well as a transport for authentication protocols such as= EAP, and standardize them as needed." This modification does not necessarily mean the adoption of our draft. Afte= r all, we completely understand that this would happen only if there is an = interest in the WG. Nevertheless, we would like to avoid that the charter i= s a barrier later if there is interest in the WG to work in this transport = of EAP over CoAP: Any opinion about this? Best Regards. El 18/11/2020 a las 8:08, Daniel Migault escribi=F3: Hi, Please find the proposed charter we agreed on during the interim meeting. I= f you would like to propose any change, please use the following URL by Nov= ember 25: https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing Yours, Daniel The Authentication and Authorization for Constrained Environments (ace) WG = has defined a standardized solution framework for authentication and author= ization to enable authorized access to resources identified by a URI and ho= sted on a resource server in constrained environments. The access to the resource is mediated by an authorization server, which is= not considered to be constrained. Profiles of this framework for application to security protocols commonly u= sed in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have = also been standardized. The Working Group is charged with maintenance of t= he framework and existing profiles thereof, and may undertake work to speci= fy profiles of the framework for additional secure communications protocols= and for additional support services providing authorized access to crypto = keys (that are not necessarily limited to constrained endpoints, though the= focus remains on deployment in ecosystems with a substantial portion of co= nstrained devices). In addition to the ongoing maintenance work, the Working Group will extend = the framework as needed for applicability to group communications, with ini= tial focus on (D)TLS and (Group) OSCORE as the underlying group communicati= on security protocols. The Working Group will standardize procedures for re= questing and distributing group keying material using the ACE framework as = well as appropriated management interfaces. The Working Group will standardize a format for expressing authorization in= formation for a given authenticated principal as received from an authoriza= tion manager. The Working Group will examine how to use Constrained Application Protocol = (CoAP) as a transport medium for certificate enrollment protocols, such as = EST and CMPv2, and standardize as needed. On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: Thanks for updating the draft charter at [1], Daniel! I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review. -Ben On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > Thank you all for the feed backs. For the purpose of driving the charter > discussion at the IETf 109, I have added the comments into the proposed > text [1]. > > My current understanding is that it seems beneficial to add CMPv2 over Co= AP > in the charter. I am happy to be contradicted. > * I have not seen a clear cut to do one or the other. > * EST and CMPv2 are two protocols that can be used for enrollment or cert > management while addressing different cases / needs / situations -- maybe > we can clarify that point. I can see leveraging the existing CMP > infrastructure, but it seems that is not the only one. > * I am not convinced that not having CMP over CoAP will not prevent its > deployment and as such I prefer to have it standardized - this might be a > personal thought. > * Adding any piece of work require cycles, but it seems to me that CPM wi= ll > not have a major impact on the WG progress. The work will probably includ= e > other WG such a LAMPS. > > Yours, > Daniel > > [1] > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > Hi Goran, > > > > I added the text to the charter we will discuss later. > > > > Yours, > > Daniel > > > > On Fri, Nov 13, 2020 at 10:26 AM G=F6ran Selander < > > goran.selander@ericsson.com> wrote: > > > >> Hi Daniel, > >> > >> > >> > >> Here=92s another input to the charter. > >> > >> > >> > >> The current group key management solutions addresses the problem of > >> authorized access to group keys and public keys of group members. > >> > >> > >> > >> A related problem is authorized access of public keys of other devices > >> not necessarily part of a security group, in the sense of sharing a > >> symmetric key used to protect group messages. > >> > >> > >> > >> Authorized access to raw public keys serves an important function in > >> constrained settings where public key certificates may not be feasible= due > >> to the incurred overhead, e.g. for when authenticating using EDHOC > >> (draft-ietf-lake-edhoc). > >> > >> This functionality is thus a subset of what is already supported, but > >> since the current solution is geared towards groups a different soluti= on > >> may be needed (although it is probably possible to reuse parts from th= e > >> existing schemes for provisioning and requesting public keys). > >> > >> > >> > >> With this in mind, I propose the following change (highlighted in > >> boldface below): > >> > >> > >> > >> OLD > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols (that are= not > >> necessarily limited to constrained endpoints, though the focus remains= on > >> deployment ecosystems with a substantial portion of constrained device= s). > >> > >> > >> > >> NEW > >> > >> The Working Group is charged with maintenance of the framework and > >> existing profiles thereof, and may undertake work to specify profiles = of > >> the framework for additional secure communications protocols *and **fo= r > >> additional **support services **providing* *authorized access to crypt= o* *keys > >> *(that are not necessarily limited to constrained endpoints, though th= e > >> focus remains on deployment ecosystems with a substantial portion of > >> constrained devices). > >> > >> > >> > >> G=F6ran > >> > >> > >> > >> > >> > >> > >> > >> On 2020-10-15, 19:50, "Ace" > wrote: > >> > >> Hi, > >> > >> I would like to start the charter discussion. Here is a draft of a > >> proposed charter [1]. > >> > >> > >> > >> It seems to be that additional discussion is needed with regard to the > >> last paragraph related certificate management. In particular the discu= ssion > >> might revive a discussion that happened in 2017 [2] - when I was not > >> co-chair of ACE -and considered other expired work such as [3]. Please= make > >> this discussion constructive on this thread. > >> > >> > >> > >> The fundamental question is whether we need certificate management at > >> this stage. If the answer is yes, and we have multiple proposals, it w= ould > >> be good to clarify the position of the different proposals and evaluat= e > >> whether a selection is needed or not before validating the charter. > >> > >> > >> > >> Please provide your inputs on the mailing list before October 30. Of > >> course for minor edits, you may suggest them directly on the google do= c. > >> > >> > >> > >> Yours, > >> > >> Daniel > >> > >> > >> > >> [1] > >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2Bn= BXhoDiptY/edit?usp=3Dsharing > >> < > >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e= 2237f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u= =3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR= 8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing> > >> > >> > >> [2] > >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191= 300/ > >> > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > >> > >> > >> > >> -- > >> > >> Daniel Migault > >> > >> > >> > >> Ericsson > >> > > > > > > -- > > Daniel Migault > > Ericsson > > > > > -- > Daniel Migault > Ericsson > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace -- Daniel Migault Ericsson _______________________________________________ Ace mailing list Ace@ietf.orghttps://www.ietf.org/mailman/listinfo= /ace _______________________________________________ core mailing list core@ietf.org https://www.ietf.org/mailman/listinfo/core -- Laurent Toutain +--- VoIP (recommended) ---+----------- T=E9l=E9com Bretagne -----------+ | Tel: +33 2 22 06 8156 | Tel: + 33 2 99 12 7026 | Visit= :| Mob: +33 6 800 75 900 | | | Fax: +33 2 22 06 8445 | Fax: +33 2 99 12 7030 | http= ://class.touta.in | Laurent@Touta.in | Laurent.Toutain@Telec= om-Bretagne.eu | +--------------------------+----------------------------------------+ --_000_HE1PR0702MB367429A9C8921A5252133523F4CE0HE1PR0702MB3674_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

+1.

 

(The recently updated ACE charter should cover this work.)=

 

G=F6ran

&nbs= p;

On 2020-12-03, 20:03, "core" <core-bounces@ietf.org> wrote:=

Hi,

I think it is important= to have EAP on top of CoAP, as Dan said it fit well with the last charter = item.

 

Laurent

 

 

On Thu, Dec 3, 2020 at = 2:20 PM Daniel Migault <daniel.migault=3D40ericsson.com@dmarc.ietf.org> wr= ote:

 

 

CCing emu, core

 

It seems ACE to me that= ACE could be home for such a document. I am wondering if emu core or any o= ther WG believe there is a better place for it.

 

Regarding ACE I am wond= ering what is the WG opinion about adding this item to the ACE charter.

 

Yours,

Daniel

_______________________= _________________

From: Ace <ace-bounces@ietf.org> on behalf of = Dan Garcia <dan.garcia@um.es>=

Sent: Thursday, Decembe= r 3, 2020 6:10 AM

Subject: [Ace] Proposed= charter for ACE (EAP over CoAP?)  

 

Dear all:

 

Regarding the new chart= er, since ACE is considering the definition of CoAP transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensib= le Authentication Protocol) over CoAP.

 

In this sense, we propo= sed this some time ago and we have implementations about this.

 

 

The usage of CoAP can p= rovide a very light and link-layer independent (we even tested in LoRa netw= orks) EAP lower-layer (transport for EAP) suitable for IoT enviroment. We b= elieve this would be really useful since EAP provides flexibility for the authentication and it is a well-known pro= tocol.

 

Therefore, we would lik= e to propose the following modification to the charter:

 

"The Working Group= will examine how to use Constrained Application Protocol (CoAP) as a trans= port medium for certificate enrollment protocols, such as EST and CMPv2, as= well as a transport for authentication protocols such as EAP, and standardize them as needed."

 

This modification does = not necessarily mean the adoption of our draft. After all, we completely un= derstand that this would happen only if there is an interest in the WG. Nev= ertheless, we would like to avoid that the charter is a barrier later if there is interest in the WG to work in t= his transport of EAP over CoAP:

 

Any opinion about this?=

 

Best Regards.

 

El 18/11/2020 a las 8:0= 8, Daniel Migault escribi=F3:

 

 

Hi,  

Please find the propose= d charter we agreed on during the interim meeting. If you would like to pro= pose any change, please use the following URL by November 25:

 

 

 

Yours,

Daniel

 

The Authentication and = Authorization for Constrained Environments (ace) WG has defined a standardi= zed solution framework for authentication and authorization to enable autho= rized access to resources identified by a URI and hosted on a resource server in constrained environments.

The access to the resou= rce is mediated by an authorization server, which is not considered to be c= onstrained.

 

Profiles of this framew= ork for application to security protocols commonly used in constrained envi= ronments, including CoAP+DTLS and CoAP+OSCORE, have also been standardized.=   The Working Group is charged with maintenance of the framework and existing profiles thereof, and may undert= ake work to specify profiles of the framework for additional secure communi= cations protocols and for additional support services providing authorized = access to crypto keys (that are not necessarily limited to constrained endpoints, though the focus remains= on deployment in ecosystems with a substantial portion of constrained devi= ces).

 

In addition to the ongo= ing maintenance work, the Working Group will extend the framework as needed= for applicability to group communications, with initial focus on (D)TLS an= d (Group) OSCORE as the underlying group communication security protocols. The Working Group will standardize proce= dures for requesting and distributing group keying material using the ACE f= ramework as well as appropriated management interfaces.

 

The Working Group will = standardize a format for expressing authorization information for a given a= uthenticated principal as received from an authorization manager.

 

The Working Group will = examine how to use Constrained Application Protocol (CoAP) as a transport m= edium for certificate enrollment protocols, such as EST and CMPv2, and stan= dardize as needed.

 

 

 

 

On Tue, Nov 17, 2020 at= 6:47 PM Benjamin Kaduk <kaduk@mit.edu<= /a>> wrote:

 

 

Thanks for updating the= draft charter at [1], Daniel!

 

I note that Michael rai= sed the question of whether some other group might

also be interested in w= orking on CMP-over-coap, so the IESG will be sure to

discuss that if CMP is = still in the draft ACE charter when it goes to the

IESG for review.

 

-Ben

 

On Tue, Nov 17, 2020 at= 06:16:48PM -0500, Daniel Migault wrote:

> Thank you all for = the feed backs. For the purpose of driving the charter

> discussion at the = IETf 109, I have added the comments into the proposed

> text [1].

>

> My current underst= anding is that it seems beneficial to add CMPv2 over CoAP

> in the charter. I = am happy to be contradicted.

> * I have not seen = a clear cut to do one or the other.

> * EST and CMPv2 ar= e two protocols that can be used for enrollment or cert

> management while a= ddressing different cases / needs / situations -- maybe

> we can clarify tha= t point. I can see leveraging the existing CMP

> infrastructure, bu= t it seems that is not the only one.

> * I am not convinc= ed that not having CMP over CoAP will not prevent its

> deployment and as = such I prefer to have it standardized - this might be a

> personal thought.<= o:p>

> * Adding any piece= of work require cycles, but it seems to me that CPM will

> not have a major i= mpact on the WG progress. The work will probably include

> other WG such a LA= MPS.

>

> Yours,<= /p>

> Daniel<= /p>

>

> [1]

>

> On Tue, Nov 17, 20= 20 at 6:02 PM Daniel Migault <mgl= t.ietf@gmail.com> wrote:

>

> > Hi Goran,

> >

> > I added the t= ext to the charter we will discuss later.

> >

> > Yours,

> > Daniel

> >

> > On Fri, Nov 1= 3, 2020 at 10:26 AM G=F6ran Selander <

> >

> >> Hi Daniel= ,

> >>

> >>

> >>

> >> Here=92s = another input to the charter.

> >>

> >>

> >>

> >> The curre= nt group key management solutions addresses the problem of

> >> authorize= d access to group keys and public keys of group members.

> >>

> >>

> >>

> >> A related= problem is authorized access of public keys of other devices

> >> not neces= sarily part of a security group, in the sense of sharing a

> >> symmetric= key used to protect group messages.

> >>

> >>

> >>

> >> Authorize= d access to raw public keys serves an important function in

> >> constrain= ed settings where public key certificates may not be feasible due

> >> to the in= curred overhead, e.g. for when authenticating using EDHOC

> >> (draft-ie= tf-lake-edhoc).

> >>

> >> This func= tionality is thus a subset of what is already supported, but

> >> since the= current solution is geared towards groups a different solution<= /p>

> >> may be ne= eded (although it is probably possible to reuse parts from the

> >> existing = schemes for provisioning and requesting public keys).

> >>

> >>

> >>

> >> With this= in mind, I propose the following change (highlighted in

> >> boldface = below):

> >>

> >>

> >>

> >> OLD<= /o:p>

> >>

> >> The Worki= ng Group is charged with maintenance of the framework and

> >> existing = profiles thereof, and may undertake work to specify profiles of<= /p>

> >> the frame= work for additional secure communications protocols (that are not

> >> necessari= ly limited to constrained endpoints, though the focus remains on=

> >> deploymen= t ecosystems with a substantial portion of constrained devices).=

> >>

> >>

> >>

> >> NEW<= /o:p>

> >>

> >> The Worki= ng Group is charged with maintenance of the framework and

> >> existing = profiles thereof, and may undertake work to specify profiles of<= /p>

> >> the frame= work for additional secure communications protocols *and **for

> >> additiona= l **support services **providing* *authorized access to crypto* *keys<= /o:p>

> >> *(that ar= e not necessarily limited to constrained endpoints, though the

> >> focus rem= ains on deployment ecosystems with a substantial portion of

> >> constrain= ed devices).

> >>

> >>

> >>

> >> G=F6ran

> >>

> >>

> >>

> >>

> >>

> >>

> >>

> >> On 2020-1= 0-15, 19:50, "Ace" <ac= e-bounces@ietf.org> wrote:

> >>

> >> Hi,<= /o:p>

> >>

> >> I would l= ike to start the charter discussion. Here is a draft of a

> >> proposed = charter [1].

> >>

> >>

> >>

> >> It seems = to be that additional discussion is needed with regard to the

> >> last para= graph related certificate management. In particular the discussion

> >> might rev= ive a discussion that happened in 2017 [2] - when I was not

> >> co-chair = of ACE -and considered other expired work such as [3]. Please make

> >> this disc= ussion constructive on this thread.

> >>

> >>

> >>

> >> The funda= mental question is whether we need certificate management at

> >> this stag= e. If the answer is yes, and we have multiple proposals, it would

> >> be good t= o clarify the position of the different proposals and evaluate

> >> whether a= selection is needed or not before validating the charter.

> >>

> >>

> >>

> >> Please pr= ovide your inputs on the mailing list before October 30. Of

> >> course fo= r minor edits, you may suggest them directly on the google doc.<= /p>

> >>

> >>

> >>

> >> Yours,

> >>

> >> Daniel

> >>

> >>

> >>

> >> [1]<= /o:p>

> >> <=

> >>

> >>

> >> [2]<= /o:p>

> >>

> >>

> >>

> >>

> >> --

> >>

> >> Daniel Mi= gault

> >>

> >>

> >>

> >> Ericsson<= o:p>

> >>

> >

> >

> > --=

> > Daniel Migaul= t

> > Ericsson=

> >

>

>

> --

> Daniel Migault

> Ericsson

 

> __________________= _____________________________

> Ace mailing list

 

_______________________= ________________________

Ace mailing list

 

 

 

 

 

--

Daniel Migault

 

Ericsson

 

 

 

 

_______________________= ________________________

Ace mailing list

Ace@ietf.orghttps://www.ietf.org/mailman/listinfo/ace

 

 

 

_______________________= ________________________

core mailing list<= /o:p>

 

 

 

 

 

--

Laurent Toutain

+--- VoIP (recommended)= ---+----------- T=E9l=E9com Bretagne -----------+

| Tel: +33 2 22 06 8156=     | Tel: + 33 2 99 12 7026    &nb= sp;            | Vis= it :| Mob: +33 6 800 75 900    |    = ;            &n= bsp;            = ;           |

+----------------------= ----+----------------------------------------+

--_000_HE1PR0702MB367429A9C8921A5252133523F4CE0HE1PR0702MB3674_-- From nobody Mon Dec 7 08:24:56 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADAF53A1424 for ; Mon, 7 Dec 2020 08:24:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 56ifF8heTE3z for ; Mon, 7 Dec 2020 08:24:53 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 654553A1411 for ; Mon, 7 Dec 2020 08:24:53 -0800 (PST) Received: from wangari.tzi.org (p54bde1a0.dip0.t-ipconnect.de [84.189.225.160]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4CqTDM2gfkzyjb; Mon, 7 Dec 2020 17:24:51 +0100 (CET) From: Olaf Bergmann To: Daniel Migault Cc: Benjamin Kaduk , Ace Wg In-Reply-To: (Daniel Migault's message of "Mon, 7 Dec 2020 08:43:28 -0500") Date: Mon, 07 Dec 2020 15:12:13 +0100 References: <20201117234700.GR39170@kduck.mit.edu> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) Message-ID: <87h7oxr3cd.fsf@wangari> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 16:24:56 -0000 Hi Daniel, On 2020-12-07, Daniel Migault wrote: > IOTPS. There is an 'O' missing (IOTOPS), I presume? Gr=C3=BC=C3=9Fe Olaf From nobody Mon Dec 7 08:37:28 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A0C53A1458 for ; Mon, 7 Dec 2020 08:37:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iNtqXWcW4DY3 for ; Mon, 7 Dec 2020 08:37:25 -0800 (PST) Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11on2087.outbound.protection.outlook.com [40.107.236.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 832E63A0F0B for ; Mon, 7 Dec 2020 08:37:25 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TnG1agyhxUeVAy0SnXC2fJCz6PiBs+TjTqsfIKWTQ+tpUufJEYee7j8HV8HKOoT/krO6Kv1AukyTqh5ofQtBpKdboIU9ftxc54qPA9WcTUSMjTMTs59b1V6NUowkA5ZSg9jyE1P56ocJRhffpLcSRQT5+/OFL0hH1hnWKVQkDZ8jV5fGOAE5ooPVJ1c9cnzQ7T2sCqIPoK/K+av23csuzn6X4qFUzzY8igFj7Sj9wRt+pXVJbn+9Al26ShE2HA9VrKO1O6BmX+PTfrCzCrvNGwiWddcekj06nj0oo1/eHSaScdn6vsS5BaW9dxVXpVtcSIJQPwUg/2Pe2hcMYcxAYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xSXbfSxPw2oSNEZPDIljSt/BP6fvhavf07RITvDUi2s=; b=dhi6hAkIM0k/GMWekdVZ+dXQNXb+EMm1RDlpFcNSCc2qyZJqsi5EiplP5t3iAeiw+gxH+eRZBlvKAMSbLqj9Shdj/zhpgQo4DbCyb6Mq9HTzvG8R8Nq8fX2jHsk5VUs0zVaFyWZxPptYqV0pETT5Q68efJPn4fqB4IrABhqsr+4ouvwXQN4APQSKrJM/qvajwv7/cV2hcWcoKPhsX55bbgGUhL5BhiO3RWHAta9rXZL3+ciAOnxDI9keUA4p39Kn2c+HZsbopS/DYkQwvrrIGP6n1FsElevK11Ti4k2LX96oVaZr3XWaBhb+w5ojb70jMNmFSyYg9YnyXD6U0Aiz0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xSXbfSxPw2oSNEZPDIljSt/BP6fvhavf07RITvDUi2s=; b=grVYcUE2QVxhyE6NMXZoCAYhYFsbz2ZJ5YYE8wdS5oF9g5+0ECCtGBb8jPsoi1AOS2uewP4mrbCbBVMkZFAj6aiAJL3vtV7WPplAh8mfI9JD7887L+EebNR7YE3ePLnawfb3FM4DTFKkYgMQ6LsjfiyoItYq08xwAqjkR9hTqdM= Received: from DM6PR15MB2379.namprd15.prod.outlook.com (2603:10b6:5:8a::16) by DM6PR15MB2667.namprd15.prod.outlook.com (2603:10b6:5:1a6::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.19; Mon, 7 Dec 2020 16:37:23 +0000 Received: from DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::31fd:dc5c:cee5:6331]) by DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::31fd:dc5c:cee5:6331%6]) with mapi id 15.20.3632.023; Mon, 7 Dec 2020 16:37:23 +0000 From: Daniel Migault To: Olaf Bergmann , Daniel Migault CC: Benjamin Kaduk , Ace Wg Thread-Topic: [Ace] Charter discussion Thread-Index: AQHWoxud03r8WJLv1EWdAkJ4mJrIXKnGXF0AgAbIw4CAAAQaAIAACHEAgB7GAACAAC0zloAAAxtM Date: Mon, 7 Dec 2020 16:37:23 +0000 Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> , <87h7oxr3cd.fsf@wangari> In-Reply-To: <87h7oxr3cd.fsf@wangari> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: tzi.org; dkim=none (message not signed) header.d=none;tzi.org; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [96.22.11.129] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fc06c079-4cb2-4e16-62a4-08d89ace5fc9 x-ms-traffictypediagnostic: DM6PR15MB2667: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1148; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: JqYxwqohHo15NH1ghNcqY5PFypMKSBqHIh2/zuBJ1iJny4Lf1TZPie7NbZvDsBJS0f+fFEB9mExDHiVT34N5kx+rGSvBdNvGT06K2COIZgvuarlbdBKBwmn4tTGs72zyuy1X3CYZaEvsQ8/NuOsaFyrixE4+o8dZUujsDSa+QiaftwKCE2XwyF/iM2L+InxNmzBwBddIysy5EJFSDEjWmIIhaaC9Fi0/arF3NzqWeIf231ixCEE6OSMGujLr01vhXeEFb5xasJS40p6Keu8r9MqJz7rG6v68mZzY0sNqmc+THgGMELrK5F8eruMHxwUgNbVH4689SpqvpV+2RCoCBfsQryxlmimCYizx1/wSRTAF/Ue8hNYVmp/kjeNUMbocU3kqc9zs6aL80ulUeUGSow== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR15MB2379.namprd15.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(396003)(366004)(346002)(39860400002)(966005)(76116006)(55016002)(186003)(26005)(19627405001)(2906002)(44832011)(64756008)(66476007)(8676002)(4744005)(478600001)(66556008)(4326008)(166002)(66446008)(91956017)(6506007)(110136005)(8936002)(7696005)(53546011)(5660300002)(54906003)(66946007)(71200400001)(52536014)(9686003)(316002)(86362001)(33656002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?iso-8859-1?Q?w3BYrMEWWVNpYhnNIpcC+yBIg5K2A30ggdWebIPsGvEPl64g9DFBZVitiK?= =?iso-8859-1?Q?2tF1rH/aj7FC38WhUU51rQOn8wXzcfNjdTLx/X3Zvz5RS7hnq+pOSKebZ6?= =?iso-8859-1?Q?Rxu0rVnoGvImeon26nKQ/1AkPoZOe+kX6cWH21PKqnm28X8koKLwV/E/28?= =?iso-8859-1?Q?EMzLYHWTylwGjJ2Th1d8sDTnFIwv6EymuqnqN4Mo5tQk9H3MTTTP5ZwEf6?= =?iso-8859-1?Q?xSaT2zyZd6ugCegu+vnbdr0tDsY0VAiXYYsmy03z9/zhK+T4RNYYHOIhgz?= =?iso-8859-1?Q?cmrIGzI5i1ptq5I1Iiww0+2DtJHE7hbBz//cfVff7em6+98heumyWYAlAn?= =?iso-8859-1?Q?08oYuy7uUCQbuJFww/2OoWME79F/34cJPNvsFjLa2VJy0InY4pp1jjos15?= =?iso-8859-1?Q?6lTFTSLdT3hz62F0uAupPlvbsb6LXWbDgOXhFGX7vYcmMl3+fr5oL9TAso?= =?iso-8859-1?Q?qKm6znVdDajaWNAX6WjVyYcUPbrVyVgOgLUIOSnZCPqxP4q65hTu+xtajI?= =?iso-8859-1?Q?rayhSQFhJPb45ZBWi23/Snp0JWOkwG7YPwRWjUjabGk7iEahGHEKjhkHSM?= =?iso-8859-1?Q?8dmOCJSZVcNfTjVZoEUfiVVRGvwlNYqz9pQyP3uGVrUP99hW5rOMsyT0J6?= =?iso-8859-1?Q?obSr7aDO3TLDEXLPwJkvlRlukresYxiDc8c0ngrZ11bHXTuBGm4+r2iKS+?= =?iso-8859-1?Q?ronWAVa/MH4CZlyhP/rOZW2gQAGWS0Wcol1zstZ3sbLy0y2ZkYHLSqrANI?= =?iso-8859-1?Q?LPdPegwCty1sKu+0X/z0y3x866VZAWGqNhc+YYsgAQBrFyqrzKqEeZ/MW5?= =?iso-8859-1?Q?y1iMBaoYZ4Wm0yePEDzMsKTV6CvGGqCv8CaE8G0FRsnRHDXrE1r3bhP77U?= =?iso-8859-1?Q?HxYLFTQe1kVsBXvkKXniUkXuTiuVkAA8a35QazC8uweZ8Cb0iFFsmiFze7?= =?iso-8859-1?Q?40aIJ4xCvFYwY7T/Fzv9saQPl1tO1u4WxcIn5zDQekcFHJa36ax310tP05?= =?iso-8859-1?Q?XXBHfR574mXFjpBAw=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR15MB2379CD3CD4CF509EA31DE935E3CE0DM6PR15MB2379namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR15MB2379.namprd15.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: fc06c079-4cb2-4e16-62a4-08d89ace5fc9 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Dec 2020 16:37:23.3679 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +ivzh2k5r8kuEITFZamFldKB+Q4cFT0uK4ZNSl0p6sVvym4Wg+f3/+9Bmz1mXUXhsm3OhMqLPtEJHDP7pG5QyE9r2h0pFRb24B03YgkD5F0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR15MB2667 Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 16:37:27 -0000 --_000_DM6PR15MB2379CD3CD4CF509EA31DE935E3CE0DM6PR15MB2379namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Correct and fixed Thanks! Yours, Daniel ________________________________ From: Ace on behalf of Olaf Bergmann Sent: Monday, December 7, 2020 9:12 AM To: Daniel Migault Cc: Benjamin Kaduk ; Ace Wg Subject: Re: [Ace] Charter discussion Hi Daniel, On 2020-12-07, Daniel Migault wrote: > IOTPS. There is an 'O' missing (IOTOPS), I presume? Gr=FC=DFe Olaf _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace --_000_DM6PR15MB2379CD3CD4CF509EA31DE935E3CE0DM6PR15MB2379namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Correct and fixed Thanks!
Yours, 
Daniel
From: Ace <ace-bounces@i= etf.org> on behalf of Olaf Bergmann <bergmann@tzi.org>
Sent: Monday, December 7, 2020 9:12 AM
To: Daniel Migault <mglt.ietf@gmail.com>
Cc: Benjamin Kaduk <kaduk@mit.edu>; Ace Wg <ace@ietf.org>= ;
Subject: Re: [Ace] Charter discussion
 
Hi Daniel,

On 2020-12-07, Daniel Migault <mglt.ietf@gmail.com> wrote:

> IOTPS.

There is an 'O' missing (IOTOPS), I presume?

Gr=FC=DFe
Olaf

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/= mailman/listinfo/ace
--_000_DM6PR15MB2379CD3CD4CF509EA31DE935E3CE0DM6PR15MB2379namp_-- From nobody Mon Dec 7 09:05:46 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FDB33A15A7 for ; Mon, 7 Dec 2020 09:05:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.8 X-Spam-Level: X-Spam-Status: No, score=-1.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TwQf-V78kPdb for ; Mon, 7 Dec 2020 09:05:42 -0800 (PST) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140078.outbound.protection.outlook.com [40.107.14.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11CEE3A146B for ; Mon, 7 Dec 2020 09:05:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E2uljfROKsIkr6ZMRIALaRx2akkcP7SsZPsfypEOaLmt66a1KzUHXNx4oQrouzKRfgwAozVzY1kAHqYsSRBmVGpn5bNgeKDORsk+WbxK2QRKCLs/IwSDcPnUSYI0dja1H2hUOdY6cUsfZnvI5tkkGtnBEoiOeK7eq71a6oZP4ksEyoHHEQeNeiHhW2L0c1Y0esBZCXUI20Mx9/KJJGqDKcYCIKXSSNclLVztQion//FYgRhG8iikuiXXeHj6VOpTHoHuDXs67qQS/cWfaernPTyIKPK2xJhljwW+j0PedRjFelXTnjHc6eE4cO+fAfufKXidqUP/Qv33C3Ihcutnmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KJ4anGLZYx3mFJATm1jDDwwx3hMsZTNs3j7HmFBf1rU=; b=lWYQWStDtNOpflcHyeUUmktUSrctOU76f7qmAYLjwFx/4OlZmKQZpu7Dx52sjpGDbb4mAc/DiWXS64vtw2b7TqSeqOBZLCJumn/AYhQSjfpJ/ybNCMKuOhEt5vZNMU0MVl5ALk66i6qQ3jq/7KHsfVVXsSRMNgvyciB/6IL2peleoi2Fv+JOVi+ruqYPS4hkPQStiONu+HOjjmwEJuDE/t1R8uiCiX2xkaj7bAnMGawRKTWeYLcJ/OcCI0B4ym62T0PUdTN892B4cR1f1sIDOnchHQyw+Wc55kzpzdary1J3DE7zw3ojPjsmmbYN0Pz3E1UT+KisJQA8vC/k6/9zkA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KJ4anGLZYx3mFJATm1jDDwwx3hMsZTNs3j7HmFBf1rU=; b=o4k2KyuOHhPIng1bMIVjJ/hQWkviHAO2o+VJXmZhDnWiVgDb+foA33T67HrdNm0m3yWWGvKXtTA9KwminWAJQo85ApKMbqt70zyeCu+G0WCdqHV3pYUBmXykatVf4OJnCd6CoM7reCKgOZIKxT8tzVBRhuEQDW1Jg5VlPvhU6js= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM0PR10MB3203.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:184::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.17; Mon, 7 Dec 2020 17:05:39 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::a5a7:8af9:1e22:1d69]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::a5a7:8af9:1e22:1d69%6]) with mapi id 15.20.3632.023; Mon, 7 Dec 2020 17:05:39 +0000 From: "Brockhaus, Hendrik" To: Daniel Migault , Benjamin Kaduk CC: Ace Wg Thread-Topic: [Ace] Charter discussion Thread-Index: AQHWoxtjVCYB49eUE0iMxKcy60l0NanGXF0AgAbIxICAAAQaAIAACHAAgB7GAACAADZ9oA== Date: Mon, 7 Dec 2020 17:05:38 +0000 Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-12-07T17:05:37Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=3f48a166-c0c3-4f11-967d-a4bcea9bc621; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=siemens.com; x-originating-ip: [77.7.101.10] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 626299ea-3f86-414d-8b7d-08d89ad25284 x-ms-traffictypediagnostic: AM0PR10MB3203: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 7mWGt574LC53L2H2f8og51yp84RtFhQXB6Tf2Z23s8VyxbyArBTpyiPnqItFphyiz0b4AWQ+Un3kLCA9eVS7AMQcSw52YWXKrK/aRZGzZUs/Vy+pnaWB4fGVp2Tz04YAn4pqEahd6zPwItcCYe3gkFPdB9/GP08LVkR0iy83+y0PkbW+8qEs+Qizs+rw4JuSy+5DHqyT/6PpEbyN9VqKX9behMxTZ5a+DwYmayyU3d5LWRCKoj9gX5DU1pWwOcre5perpWHwjksx6giaxVGqlp9pGCSBPAhX4bjmW1N4BMjWjZZXnEnTl40+ADReQI1odxSQ1Bb1fUfcGhkyaVUTm0DwYdnsz3YpfHCob+WG6UKLfjanJlgEwn4ZKXPBCk1V5bj/i3wmQ4qe9JWxoKhZ8w== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(346002)(136003)(396003)(376002)(39860400002)(366004)(8936002)(66476007)(76116006)(4326008)(83380400001)(316002)(9686003)(86362001)(66574015)(52536014)(53546011)(55016002)(166002)(6506007)(966005)(26005)(8676002)(64756008)(71200400001)(478600001)(110136005)(2906002)(5660300002)(186003)(66946007)(66446008)(66556008)(4001150100001)(33656002)(7696005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?cWVraGdUUCtFdUdMdFk0OW9pSjVXc2txdE42QUhESURrSGsyaTBSckEyNFlW?= =?utf-8?B?bjVIK1pQanZvUStOVVdSUzY2MWVPM2Z0ZjVNWVNPUG52S1p2ZGtQQ0c2SHcw?= =?utf-8?B?Q2duMVVDTFYzNWdiOE5odzJIRkIwOGJEMElFNk9RcTA0WWZ3blVLZWtORU1V?= =?utf-8?B?aEkxKzltUWFubjYyWUNJS0JGYVRvem5sdlFvRlRZbVpVY1BpcEtwMzA3U2Rz?= =?utf-8?B?azFXK2dadU1qZ2JoR1F1a1RmRUFOZ1JMUkJ3ZVdvd3IxR0wrc2kxdzduWTZo?= =?utf-8?B?N2lXcFh0SmVZenpRTVVweHE4a201VDU4dlRNc3JXeW82d2lmSk1XUEJmMTBn?= =?utf-8?B?RnFsbkxqT0RmclVHU0JRTmczcWg4Q1lObzNZY0tLSlcvdkZxeENsOUZmMEt2?= =?utf-8?B?NEVWa1lXL1F2ZWkySk8xdTdZV240clExYSs5Tjlva3lxMGtEWFZFUUU4RTlh?= =?utf-8?B?NzdqejFnUFVVWjZlSnF3YldmYzRxakZ3cDRxVUlIMEZqSS9Kblh1ZC93OVlx?= =?utf-8?B?alF2REt4OGpxSTlNR2kxUXVKektlS2crb0ZKWkJLc04rNVk0bTFWY2dpcGFZ?= =?utf-8?B?bk9BdDBZWklWKzF0NHdIcEZyaUN4RU03K1lsOTNHaHFVYmgyQWgydXpYWXlk?= =?utf-8?B?VHE3a2cwVVAvelQ4SzhtVWZZY2NscTB2cW1IaGtoenkvYSsyMnVCQ29SM0Ev?= =?utf-8?B?L2h2L2I1QzFXYlpyRzlXb2RYZGNCUlhrQ1RUMENnZjZkMzVrYTB2cGR4WU9O?= =?utf-8?B?bk5aVzNuV2l3YnFSeWZZRUpYOGU4VExKTkRqSWdyS01SVk5abG9VbGJTclNB?= =?utf-8?B?WWhkV1MvczFTd2dZYzJISVNMQ2VXOEczTTBkOU9kclJQNU5ZUStNWWVmQ1Vm?= =?utf-8?B?R2dSVi9FNDJtQllJbXIrMTliRWpDUWhYdzFvQ3A2QXI5b0hKUjJKZEhHQ3Zo?= =?utf-8?B?Yy9Hb0tZY21idzRvWklnenhTbHB6RGJUMkpJY081UExMNk1PL2tLTyt2ZUlR?= =?utf-8?B?ZU5qT1pjZlFmUnFDK1JrelorY3Z0a0Y0OExndnRRczNpSks2dUVDbFpka0g0?= =?utf-8?B?WnNGV3lkZ2FUNFBkRGptakdEZWI1K3B6MFhrL0ZldmhWNUJwMXRDVUZLaHNB?= =?utf-8?B?Z3k0b2FxanF6eE9OdjlIUTUwR1JFZWNwOWtEMmk2QTlzTHVFVFdBNGFxYTlZ?= =?utf-8?B?dHZRb2tMOXdmbUZZZnlBalc0clhDUU5nNlNFN1FaTlVCN2JVNnRLdUl4SUNN?= =?utf-8?B?OGQvN0s4WmMrMnAzR3NXRDE0Sks1Vk5NT0VGR3dSSTljR1VCRG9iMUFpVnJX?= =?utf-8?Q?7EJnI/7WGZmik=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_AM0PR10MB24188E1E747D0E6EE1BDB82CFECE0AM0PR10MB2418EURP_" MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 626299ea-3f86-414d-8b7d-08d89ad25284 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Dec 2020 17:05:38.9923 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: icdd+5FV/nvjGBamC+1beAWQUUFSAWkU8PVuYwAFmCs5zprFmCIkOhLZT7u/YqYG0kF7a9NoA8DtHGLimm2U+fR5FKtfjeH8fJYW2DhSKcE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB3203 Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 17:05:45 -0000 --_000_AM0PR10MB24188E1E747D0E6EE1BDB82CFECE0AM0PR10MB2418EURP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QXMgdGhlIENNUG92ZXJDb0FQIGRyYWZ0IHdhcyBhbHJlYWR5IGRpc2N1c3NlZCBpbiBMQU1QUyBh bmQgSmltIHN1Z2dlc3RlZCB0byBjb25zaWRlciBpdCBpbiBBQ0UsIEkgc3VnZ2VzdCB0byBkcm9w IHRoZSBOb3RlIGFuZCBjb21lIGJhY2sgdG8gYSBjbGVhciBzdGF0ZW1lbnQgYXMgZGlzY3Vzc2Vk IGF0IElFVEYxMDkuDQoNCkRpc2N1c3Npb24gb24gdGhlIExBTVBTIE1haWxpbmcgTGlzdCBmcm9t IEp1bmU6DQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3NwYXNtL3V5WUNm NXNNY3hnNnhvUUZjYmUxc1B4cVZMdy8NCg0KSGVuZHJpaw0KDQpWb246IEFjZSA8YWNlLWJvdW5j ZXNAaWV0Zi5vcmc+IEltIEF1ZnRyYWcgdm9uIERhbmllbCBNaWdhdWx0DQpHZXNlbmRldDogTW9u dGFnLCA3LiBEZXplbWJlciAyMDIwIDE0OjQzDQpBbjogQmVuamFtaW4gS2FkdWsgPGthZHVrQG1p dC5lZHU+DQpDYzogQWNlIFdnIDxhY2VAaWV0Zi5vcmc+DQpCZXRyZWZmOiBSZTogW0FjZV0gQ2hh cnRlciBkaXNjdXNzaW9uDQoNCkhpLA0KDQpQbGVhc2UgaGF2ZSBhIGxvb2sgYXQgdGhlIGxhdGVz dCB2ZXJzaW9uIG9mIHRoZSBjaGFydGVyIGJlZm9yZSB3ZSBtb3ZlIGl0IGZvcndhcmQgYnkgdGhl IGVuZCBvZiB0aGUgd2VlayAtIERlY2VtYmVyIDExLg0KDQpJIGFkZGVkIGEgbm90ZSBvbiBwb3Rl bnRpYWwgV0cgdGhhdCBjb3VsZCBob3N0IHRoZSBDTVB2MiBvdmVyIENvQVAgLSBldmVudHVhbGx5 LiBJIGFtIHdvbmRlcmluZyBpZiB3ZSBzaG91bGQgcHV0IGEgbm90ZSB0byB0aGVzZSBXR3MuDQoN CllvdXJzLA0KRGFuaWVsDQoNCg0KVGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9u IGZvciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgKGFjZSkgV0cgaGFzIGRlZmluZWQgYSBzdGFu ZGFyZGl6ZWQgc29sdXRpb24gZnJhbWV3b3JrIGZvciBhdXRoZW50aWNhdGlvbiBhbmQgYXV0aG9y aXphdGlvbiB0byBlbmFibGUgYXV0aG9yaXplZCBhY2Nlc3MgdG8gcmVzb3VyY2VzIGlkZW50aWZp ZWQgYnkgYSBVUkkgYW5kIGhvc3RlZCBvbiBhIHJlc291cmNlIHNlcnZlciBpbiBjb25zdHJhaW5l ZCBlbnZpcm9ubWVudHMuDQoNClRoZSBhY2Nlc3MgdG8gdGhlIHJlc291cmNlIGlzIG1lZGlhdGVk IGJ5IGFuIGF1dGhvcml6YXRpb24gc2VydmVyLCB3aGljaCBpcyBub3QgY29uc2lkZXJlZCB0byBi ZSBjb25zdHJhaW5lZC4NCg0KDQpQcm9maWxlcyBvZiB0aGlzIGZyYW1ld29yayBmb3IgYXBwbGlj YXRpb24gdG8gc2VjdXJpdHkgcHJvdG9jb2xzIGNvbW1vbmx5IHVzZWQgaW4gY29uc3RyYWluZWQg ZW52aXJvbm1lbnRzLCBpbmNsdWRpbmcgQ29BUCtEVExTIGFuZCBDb0FQK09TQ09SRSwgaGF2ZSBh bHNvIGJlZW4gc3RhbmRhcmRpemVkLiAgVGhlIFdvcmtpbmcgR3JvdXAgaXMgY2hhcmdlZCB3aXRo IG1haW50ZW5hbmNlIG9mIHRoZSBmcmFtZXdvcmsgYW5kIGV4aXN0aW5nIHByb2ZpbGVzIHRoZXJl b2YsIGFuZCBtYXkgdW5kZXJ0YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9maWxlcyBvZiB0aGUgZnJh bWV3b3JrIGZvciBhZGRpdGlvbmFsIHNlY3VyZSBjb21tdW5pY2F0aW9ucyBwcm90b2NvbHMgYW5k IGZvciBhZGRpdGlvbmFsIHN1cHBvcnQgc2VydmljZXMgcHJvdmlkaW5nIGF1dGhvcml6ZWQgYWNj ZXNzIHRvIGNyeXB0byBrZXlzICh0aGF0IGFyZSBub3QgbmVjZXNzYXJpbHkgbGltaXRlZCB0byBj b25zdHJhaW5lZCBlbmRwb2ludHMsIHRob3VnaCB0aGUgZm9jdXMgcmVtYWlucyBvbiBkZXBsb3lt ZW50IGluIGVjb3N5c3RlbXMgd2l0aCBhIHN1YnN0YW50aWFsIHBvcnRpb24gb2YgY29uc3RyYWlu ZWQgZGV2aWNlcykuDQoNCg0KSW4gYWRkaXRpb24gdG8gdGhlIG9uZ29pbmcgbWFpbnRlbmFuY2Ug d29yaywgdGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBleHRlbmQgdGhlIGZyYW1ld29yayBhcyBuZWVk ZWQgZm9yIGFwcGxpY2FiaWxpdHkgdG8gZ3JvdXAgY29tbXVuaWNhdGlvbnMsIHdpdGggaW5pdGlh bCBmb2N1cyBvbiAoRClUTFMgYW5kIChHcm91cCkgT1NDT1JFIGFzIHRoZSB1bmRlcmx5aW5nIGdy b3VwIGNvbW11bmljYXRpb24gc2VjdXJpdHkgcHJvdG9jb2xzLiBUaGUgV29ya2luZyBHcm91cCB3 aWxsIHN0YW5kYXJkaXplIHByb2NlZHVyZXMgZm9yIHJlcXVlc3RpbmcgYW5kIGRpc3RyaWJ1dGlu ZyBncm91cCBrZXlpbmcgbWF0ZXJpYWwgdXNpbmcgdGhlIEFDRSBmcmFtZXdvcmsgYXMgd2VsbCBh cyBhcHByb3ByaWF0ZWQgbWFuYWdlbWVudCBpbnRlcmZhY2VzLg0KDQoNClRoZSBXb3JraW5nIEdy b3VwIHdpbGwgc3RhbmRhcmRpemUgYSBmb3JtYXQgZm9yIGV4cHJlc3NpbmcgYXV0aG9yaXphdGlv biBpbmZvcm1hdGlvbiBmb3IgYSBnaXZlbiBhdXRoZW50aWNhdGVkIHByaW5jaXBhbCBhcyByZWNl aXZlZCBmcm9tIGFuIGF1dGhvcml6YXRpb24gbWFuYWdlci4NCg0KDQpUaGUgV29ya2luZyBHcm91 cCB3aWxsIGV4YW1pbmUgaG93IHRvIHVzZSBDb25zdHJhaW5lZCBBcHBsaWNhdGlvbiBQcm90b2Nv bCAoQ29BUCkgYXMgYSB0cmFuc3BvcnQgbWVkaXVtIGZvciBjZXJ0aWZpY2F0ZSBlbnJvbGxtZW50 IHByb3RvY29scywgc3VjaCBhcyBFU1QgYW5kIENNUHYyLCBhcyB3ZWxsIGFzIGEgdHJhbnNwb3J0 IGZvciBhdXRoZW50aWNhdGlvbiBwcm90b2NvbHMgc3VjaCBhcyBFQVAsIGFuZCBzdGFuZGFyZGl6 ZSBhcyBuZWVkZWQuIFtOb3RlIHRoYXQgQ01QdjIgd29yayBtYXkgYWxzbyBiZSBob3N0ZWQgaW4g TEFNUFMgKHdoaWNoIHJldmlzaXRzIENNUHYyKSwgQU5JTUEgKCB3aGljaCBkZWZpbmVzIENNUHYy IGFzIGFuIGFsdGVybmF0aXZlIHRvIEVTVCkgb3IgSU9UUFMuIEVBUCB3b3JrIGhhcyBiZWVuIGNv b3JkaW5hdGVkIHdpdGggRU1VLiBJbiBhbnkgY2FzZSwgaWYgdGhlIHdvcmsgaXMgYmVpbmcgY29u c2lkZXJlZCBpbiBBQ0UsIHdlIHdpbGwgbWFrZSBzdXJlIHRoZSBjb3JyZXNwb25kaW5nIFdHIHdp bGwgZm9sbG93IHRoZSBwcm9ncmVzcy5dDQoNCg0KDQoNCg0KDQpPbiBUdWUsIE5vdiAxNywgMjAy MCBhdCA2OjQ3IFBNIEJlbmphbWluIEthZHVrIDxrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0Bt aXQuZWR1Pj4gd3JvdGU6DQpUaGFua3MgZm9yIHVwZGF0aW5nIHRoZSBkcmFmdCBjaGFydGVyIGF0 IFsxXSwgRGFuaWVsIQ0KDQpJIG5vdGUgdGhhdCBNaWNoYWVsIHJhaXNlZCB0aGUgcXVlc3Rpb24g b2Ygd2hldGhlciBzb21lIG90aGVyIGdyb3VwIG1pZ2h0DQphbHNvIGJlIGludGVyZXN0ZWQgaW4g d29ya2luZyBvbiBDTVAtb3Zlci1jb2FwLCBzbyB0aGUgSUVTRyB3aWxsIGJlIHN1cmUgdG8NCmRp c2N1c3MgdGhhdCBpZiBDTVAgaXMgc3RpbGwgaW4gdGhlIGRyYWZ0IEFDRSBjaGFydGVyIHdoZW4g aXQgZ29lcyB0byB0aGUNCklFU0cgZm9yIHJldmlldy4NCg0KLUJlbg0KDQpPbiBUdWUsIE5vdiAx NywgMjAyMCBhdCAwNjoxNjo0OFBNIC0wNTAwLCBEYW5pZWwgTWlnYXVsdCB3cm90ZToNCj4gVGhh bmsgeW91IGFsbCBmb3IgdGhlIGZlZWQgYmFja3MuIEZvciB0aGUgcHVycG9zZSBvZiBkcml2aW5n IHRoZSBjaGFydGVyDQo+IGRpc2N1c3Npb24gYXQgdGhlIElFVGYgMTA5LCBJIGhhdmUgYWRkZWQg dGhlIGNvbW1lbnRzIGludG8gdGhlIHByb3Bvc2VkDQo+IHRleHQgWzFdLg0KPg0KPiBNeSBjdXJy ZW50IHVuZGVyc3RhbmRpbmcgaXMgdGhhdCBpdCBzZWVtcyBiZW5lZmljaWFsIHRvIGFkZCBDTVB2 MiBvdmVyIENvQVANCj4gaW4gdGhlIGNoYXJ0ZXIuIEkgYW0gaGFwcHkgdG8gYmUgY29udHJhZGlj dGVkLg0KPiAqIEkgaGF2ZSBub3Qgc2VlbiBhIGNsZWFyIGN1dCB0byBkbyBvbmUgb3IgdGhlIG90 aGVyLg0KPiAqIEVTVCBhbmQgQ01QdjIgYXJlIHR3byBwcm90b2NvbHMgdGhhdCBjYW4gYmUgdXNl ZCBmb3IgZW5yb2xsbWVudCBvciBjZXJ0DQo+IG1hbmFnZW1lbnQgd2hpbGUgYWRkcmVzc2luZyBk aWZmZXJlbnQgY2FzZXMgLyBuZWVkcyAvIHNpdHVhdGlvbnMgLS0gbWF5YmUNCj4gd2UgY2FuIGNs YXJpZnkgdGhhdCBwb2ludC4gSSBjYW4gc2VlIGxldmVyYWdpbmcgdGhlIGV4aXN0aW5nIENNUA0K PiBpbmZyYXN0cnVjdHVyZSwgYnV0IGl0IHNlZW1zIHRoYXQgaXMgbm90IHRoZSBvbmx5IG9uZS4N Cj4gKiBJIGFtIG5vdCBjb252aW5jZWQgdGhhdCBub3QgaGF2aW5nIENNUCBvdmVyIENvQVAgd2ls bCBub3QgcHJldmVudCBpdHMNCj4gZGVwbG95bWVudCBhbmQgYXMgc3VjaCBJIHByZWZlciB0byBo YXZlIGl0IHN0YW5kYXJkaXplZCAtIHRoaXMgbWlnaHQgYmUgYQ0KPiBwZXJzb25hbCB0aG91Z2h0 Lg0KPiAqIEFkZGluZyBhbnkgcGllY2Ugb2Ygd29yayByZXF1aXJlIGN5Y2xlcywgYnV0IGl0IHNl ZW1zIHRvIG1lIHRoYXQgQ1BNIHdpbGwNCj4gbm90IGhhdmUgYSBtYWpvciBpbXBhY3Qgb24gdGhl IFdHIHByb2dyZXNzLiBUaGUgd29yayB3aWxsIHByb2JhYmx5IGluY2x1ZGUNCj4gb3RoZXIgV0cg c3VjaCBhIExBTVBTLg0KPg0KPiBZb3VycywNCj4gRGFuaWVsDQo+DQo+IFsxXQ0KPiBodHRwczov L2RvY3MuZ29vZ2xlLmNvbS9kb2N1bWVudC9kLzFSdHhVU3ZVZUJkWldvUWtqU2oyYzNEdFI4RHVC d1BNMkJuQlhob0RpcHRZL2VkaXQ/dXNwPXNoYXJpbmc8aHR0cHM6Ly9ldXIwMS5zYWZlbGlua3Mu cHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZG9jcy5nb29nbGUuY29t JTJGZG9jdW1lbnQlMkZkJTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhv RGlwdFklMkZlZGl0JTNGdXNwJTNEc2hhcmluZyZkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2Nr aGF1cyU0MHNpZW1lbnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0NjYwOGQ4OWFiNjJiZGUlN0Mz OGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MxJTdDNjM3NDI5NDU0NDk4OTAz OTE5JTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lW Mmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmc2RhdGE9aFdWdkVB ZVRSMzUlMkZsa2hCOHB6RHlXNmtjMTQzUSUyQjNEYzVZMGY5MExuQjAlM0QmcmVzZXJ2ZWQ9MD4N Cj4NCj4gT24gVHVlLCBOb3YgMTcsIDIwMjAgYXQgNjowMiBQTSBEYW5pZWwgTWlnYXVsdCA8bWds dC5pZXRmQGdtYWlsLmNvbTxtYWlsdG86bWdsdC5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KPg0K PiA+IEhpIEdvcmFuLA0KPiA+DQo+ID4gSSBhZGRlZCB0aGUgdGV4dCB0byB0aGUgY2hhcnRlciB3 ZSB3aWxsIGRpc2N1c3MgbGF0ZXIuDQo+ID4NCj4gPiBZb3VycywNCj4gPiBEYW5pZWwNCj4gPg0K PiA+IE9uIEZyaSwgTm92IDEzLCAyMDIwIGF0IDEwOjI2IEFNIEfDtnJhbiBTZWxhbmRlciA8DQo+ ID4gZ29yYW4uc2VsYW5kZXJAZXJpY3Nzb24uY29tPG1haWx0bzpnb3Jhbi5zZWxhbmRlckBlcmlj c3Nvbi5jb20+PiB3cm90ZToNCj4gPg0KPiA+PiBIaSBEYW5pZWwsDQo+ID4+DQo+ID4+DQo+ID4+ DQo+ID4+IEhlcmXigJlzIGFub3RoZXIgaW5wdXQgdG8gdGhlIGNoYXJ0ZXIuDQo+ID4+DQo+ID4+ DQo+ID4+DQo+ID4+IFRoZSBjdXJyZW50IGdyb3VwIGtleSBtYW5hZ2VtZW50IHNvbHV0aW9ucyBh ZGRyZXNzZXMgdGhlIHByb2JsZW0gb2YNCj4gPj4gYXV0aG9yaXplZCBhY2Nlc3MgdG8gZ3JvdXAg a2V5cyBhbmQgcHVibGljIGtleXMgb2YgZ3JvdXAgbWVtYmVycy4NCj4gPj4NCj4gPj4NCj4gPj4N Cj4gPj4gQSByZWxhdGVkIHByb2JsZW0gaXMgYXV0aG9yaXplZCBhY2Nlc3Mgb2YgcHVibGljIGtl eXMgb2Ygb3RoZXIgZGV2aWNlcw0KPiA+PiBub3QgbmVjZXNzYXJpbHkgcGFydCBvZiBhIHNlY3Vy aXR5IGdyb3VwLCBpbiB0aGUgc2Vuc2Ugb2Ygc2hhcmluZyBhDQo+ID4+IHN5bW1ldHJpYyBrZXkg dXNlZCB0byBwcm90ZWN0IGdyb3VwIG1lc3NhZ2VzLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+PiBB dXRob3JpemVkIGFjY2VzcyB0byByYXcgcHVibGljIGtleXMgc2VydmVzIGFuIGltcG9ydGFudCBm dW5jdGlvbiBpbg0KPiA+PiBjb25zdHJhaW5lZCBzZXR0aW5ncyB3aGVyZSBwdWJsaWMga2V5IGNl cnRpZmljYXRlcyBtYXkgbm90IGJlIGZlYXNpYmxlIGR1ZQ0KPiA+PiB0byB0aGUgaW5jdXJyZWQg b3ZlcmhlYWQsIGUuZy4gZm9yIHdoZW4gYXV0aGVudGljYXRpbmcgdXNpbmcgRURIT0MNCj4gPj4g KGRyYWZ0LWlldGYtbGFrZS1lZGhvYykuDQo+ID4+DQo+ID4+IFRoaXMgZnVuY3Rpb25hbGl0eSBp cyB0aHVzIGEgc3Vic2V0IG9mIHdoYXQgaXMgYWxyZWFkeSBzdXBwb3J0ZWQsIGJ1dA0KPiA+PiBz aW5jZSB0aGUgY3VycmVudCBzb2x1dGlvbiBpcyBnZWFyZWQgdG93YXJkcyBncm91cHMgYSBkaWZm ZXJlbnQgc29sdXRpb24NCj4gPj4gbWF5IGJlIG5lZWRlZCAoYWx0aG91Z2ggaXQgaXMgcHJvYmFi bHkgcG9zc2libGUgdG8gcmV1c2UgcGFydHMgZnJvbSB0aGUNCj4gPj4gZXhpc3Rpbmcgc2NoZW1l cyBmb3IgcHJvdmlzaW9uaW5nIGFuZCByZXF1ZXN0aW5nIHB1YmxpYyBrZXlzKS4NCj4gPj4NCj4g Pj4NCj4gPj4NCj4gPj4gV2l0aCB0aGlzIGluIG1pbmQsIEkgcHJvcG9zZSB0aGUgZm9sbG93aW5n IGNoYW5nZSAoaGlnaGxpZ2h0ZWQgaW4NCj4gPj4gYm9sZGZhY2UgYmVsb3cpOg0KPiA+Pg0KPiA+ Pg0KPiA+Pg0KPiA+PiBPTEQNCj4gPj4NCj4gPj4gVGhlIFdvcmtpbmcgR3JvdXAgaXMgY2hhcmdl ZCB3aXRoIG1haW50ZW5hbmNlIG9mIHRoZSBmcmFtZXdvcmsgYW5kDQo+ID4+IGV4aXN0aW5nIHBy b2ZpbGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9maWxl cyBvZg0KPiA+PiB0aGUgZnJhbWV3b3JrIGZvciBhZGRpdGlvbmFsIHNlY3VyZSBjb21tdW5pY2F0 aW9ucyBwcm90b2NvbHMgKHRoYXQgYXJlIG5vdA0KPiA+PiBuZWNlc3NhcmlseSBsaW1pdGVkIHRv IGNvbnN0cmFpbmVkIGVuZHBvaW50cywgdGhvdWdoIHRoZSBmb2N1cyByZW1haW5zIG9uDQo+ID4+ IGRlcGxveW1lbnQgZWNvc3lzdGVtcyB3aXRoIGEgc3Vic3RhbnRpYWwgcG9ydGlvbiBvZiBjb25z dHJhaW5lZCBkZXZpY2VzKS4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4gTkVXDQo+ID4+DQo+ID4+ IFRoZSBXb3JraW5nIEdyb3VwIGlzIGNoYXJnZWQgd2l0aCBtYWludGVuYW5jZSBvZiB0aGUgZnJh bWV3b3JrIGFuZA0KPiA+PiBleGlzdGluZyBwcm9maWxlcyB0aGVyZW9mLCBhbmQgbWF5IHVuZGVy dGFrZSB3b3JrIHRvIHNwZWNpZnkgcHJvZmlsZXMgb2YNCj4gPj4gdGhlIGZyYW1ld29yayBmb3Ig YWRkaXRpb25hbCBzZWN1cmUgY29tbXVuaWNhdGlvbnMgcHJvdG9jb2xzICphbmQgKipmb3INCj4g Pj4gYWRkaXRpb25hbCAqKnN1cHBvcnQgc2VydmljZXMgKipwcm92aWRpbmcqICphdXRob3JpemVk IGFjY2VzcyB0byBjcnlwdG8qICprZXlzDQo+ID4+ICoodGhhdCBhcmUgbm90IG5lY2Vzc2FyaWx5 IGxpbWl0ZWQgdG8gY29uc3RyYWluZWQgZW5kcG9pbnRzLCB0aG91Z2ggdGhlDQo+ID4+IGZvY3Vz IHJlbWFpbnMgb24gZGVwbG95bWVudCBlY29zeXN0ZW1zIHdpdGggYSBzdWJzdGFudGlhbCBwb3J0 aW9uIG9mDQo+ID4+IGNvbnN0cmFpbmVkIGRldmljZXMpLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+ PiBHw7ZyYW4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4g T24gMjAyMC0xMC0xNSwgMTk6NTAsICJBY2UiIDxhY2UtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86 YWNlLWJvdW5jZXNAaWV0Zi5vcmc+PiB3cm90ZToNCj4gPj4NCj4gPj4gSGksDQo+ID4+DQo+ID4+ IEkgd291bGQgbGlrZSB0byBzdGFydCB0aGUgY2hhcnRlciBkaXNjdXNzaW9uLiBIZXJlIGlzIGEg ZHJhZnQgb2YgYQ0KPiA+PiBwcm9wb3NlZCBjaGFydGVyIFsxXS4NCj4gPj4NCj4gPj4NCj4gPj4N Cj4gPj4gSXQgc2VlbXMgdG8gYmUgdGhhdCBhZGRpdGlvbmFsIGRpc2N1c3Npb24gaXMgbmVlZGVk IHdpdGggcmVnYXJkIHRvIHRoZQ0KPiA+PiBsYXN0IHBhcmFncmFwaCByZWxhdGVkIGNlcnRpZmlj YXRlIG1hbmFnZW1lbnQuIEluIHBhcnRpY3VsYXIgdGhlIGRpc2N1c3Npb24NCj4gPj4gbWlnaHQg cmV2aXZlIGEgZGlzY3Vzc2lvbiB0aGF0IGhhcHBlbmVkIGluIDIwMTcgWzJdIC0gd2hlbiBJIHdh cyBub3QNCj4gPj4gY28tY2hhaXIgb2YgQUNFIC1hbmQgY29uc2lkZXJlZCBvdGhlciBleHBpcmVk IHdvcmsgc3VjaCBhcyBbM10uIFBsZWFzZSBtYWtlDQo+ID4+IHRoaXMgZGlzY3Vzc2lvbiBjb25z dHJ1Y3RpdmUgb24gdGhpcyB0aHJlYWQuDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+IFRoZSBmdW5k YW1lbnRhbCBxdWVzdGlvbiBpcyB3aGV0aGVyIHdlIG5lZWQgY2VydGlmaWNhdGUgbWFuYWdlbWVu dCBhdA0KPiA+PiB0aGlzIHN0YWdlLiBJZiB0aGUgYW5zd2VyIGlzIHllcywgYW5kIHdlIGhhdmUg bXVsdGlwbGUgcHJvcG9zYWxzLCBpdCB3b3VsZA0KPiA+PiBiZSBnb29kIHRvIGNsYXJpZnkgdGhl IHBvc2l0aW9uIG9mIHRoZSBkaWZmZXJlbnQgcHJvcG9zYWxzIGFuZCBldmFsdWF0ZQ0KPiA+PiB3 aGV0aGVyIGEgc2VsZWN0aW9uIGlzIG5lZWRlZCBvciBub3QgYmVmb3JlIHZhbGlkYXRpbmcgdGhl IGNoYXJ0ZXIuDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+IFBsZWFzZSBwcm92aWRlIHlvdXIgaW5w dXRzIG9uIHRoZSBtYWlsaW5nIGxpc3QgYmVmb3JlIE9jdG9iZXIgMzAuIE9mDQo+ID4+IGNvdXJz ZSBmb3IgbWlub3IgZWRpdHMsIHlvdSBtYXkgc3VnZ2VzdCB0aGVtIGRpcmVjdGx5IG9uIHRoZSBn b29nbGUgZG9jLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+PiBZb3VycywNCj4gPj4NCj4gPj4gRGFu aWVsDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+IFsxXQ0KPiA+PiBodHRwczovL2RvY3MuZ29vZ2xl LmNvbS9kb2N1bWVudC9kLzFSdHhVU3ZVZUJkWldvUWtqU2oyYzNEdFI4RHVCd1BNMkJuQlhob0Rp cHRZL2VkaXQ/dXNwPXNoYXJpbmc8aHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5v dXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZG9jcy5nb29nbGUuY29tJTJGZG9jdW1lbnQl MkZkJTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFklMkZlZGl0 JTNGdXNwJTNEc2hhcmluZyZkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0MHNpZW1l bnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0NjYwOGQ4OWFiNjJiZGUlN0MzOGFlM2JjZDk1Nzk0 ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MxJTdDNjM3NDI5NDU0NDk4OTAzOTE5JTdDVW5rbm93 biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJU aUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmc2RhdGE9aFdWdkVBZVRSMzUlMkZsa2hC OHB6RHlXNmtjMTQzUSUyQjNEYzVZMGY5MExuQjAlM0QmcmVzZXJ2ZWQ9MD4NCj4gPj4gPA0KPiA+ PiBodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3YxL3VybD9rPTRmM2Q5YzNiLTExOGM0NzVi LTRmM2RkY2EwLTg2ZTIyMzdmNTFmYi02MjdlNDhiMDY5NDYyZDcwJnE9MSZlPTY5MjRiMmE2LWU3 ZTUtNGVjMS1hMWFmLWM5NDYzNzk1M2RjNSZ1PWh0dHBzJTNBJTJGJTJGZG9jcy5nb29nbGUuY29t JTJGZG9jdW1lbnQlMkZkJTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhv RGlwdFklMkZlZGl0JTNGdXNwJTNEc2hhcmluZzxodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90 ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZwcm90ZWN0Mi5maXJlZXllLmNv bSUyRnYxJTJGdXJsJTNGayUzRDRmM2Q5YzNiLTExOGM0NzViLTRmM2RkY2EwLTg2ZTIyMzdmNTFm Yi02MjdlNDhiMDY5NDYyZDcwJTI2cSUzRDElMjZlJTNENjkyNGIyYTYtZTdlNS00ZWMxLWExYWYt Yzk0NjM3OTUzZGM1JTI2dSUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGZG9jcy5nb29nbGUuY29tJTI1 MkZkb2N1bWVudCUyNTJGZCUyNTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5C WGhvRGlwdFklMjUyRmVkaXQlMjUzRnVzcCUyNTNEc2hhcmluZyZkYXRhPTA0JTdDMDElN0NoZW5k cmlrLmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0NjYwOGQ4OWFi NjJiZGUlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MwJTdDNjM3NDI5 NDU0NDk4OTEzODc4JTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFp TENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmc2Rh dGE9VCUyQlJFSkVHSnJuNlF3dFNsVFUzMDBnbTRlUURrRGY2azA4emtkUjVJWUpjJTNEJnJlc2Vy dmVkPTA+Pg0KPiA+Pg0KPiA+Pg0KPiA+PiBbMl0NCj4gPj4gaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvbWludXRlcy1pbnRlcmltLTIwMTctYWNlLTAzLTIwMTcxMDE5MTMwMC88aHR0 cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNB JTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZtaW51dGVzLWludGVyaW0tMjAxNy1h Y2UtMDMtMjAxNzEwMTkxMzAwJTJGJmRhdGE9MDQlN0MwMSU3Q2hlbmRyaWsuYnJvY2toYXVzJTQw c2llbWVucy5jb20lN0NjYjI1NjMxZGI5MjY0ZDI2ZTQ2NjA4ZDg5YWI2MmJkZSU3QzM4YWUzYmNk OTU3OTRmZDRhZGRhYjQyZTE0OTVkNTVhJTdDMSU3QzElN0M2Mzc0Mjk0NTQ0OTg5MTM4NzglN0NV bmtub3duJTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklp TENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTNEJTdDMzAwMCZzZGF0YT1jOUZSRDNpZXVEQUha UlkxbnBIYUFxVjNTVjFhTXclMkZDRmdvZUdTJTJCQldpZyUzRCZyZXNlcnZlZD0wPg0KPiA+Pg0K PiA+PiBbM10gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtc2VsYW5kZXIt YWNlLWVhbHMvPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20v P3VybD1odHRwcyUzQSUyRiUyRmRhdGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJGZHJhZnQtc2Vs YW5kZXItYWNlLWVhbHMlMkYmZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVt ZW5zLmNvbSU3Q2NiMjU2MzFkYjkyNjRkMjZlNDY2MDhkODlhYjYyYmRlJTdDMzhhZTNiY2Q5NTc5 NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMSU3QzYzNzQyOTQ1NDQ5ODkyMzgzMyU3Q1Vua25v d24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pC VGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0MzMDAwJnNkYXRhPUtjdk0xVUNodHBzQkNlN3k2 JTJGcyUyQnYwbEVuRmNwJTJCRGZ3ZGplSnFQVUxlVnclM0QmcmVzZXJ2ZWQ9MD4NCj4gPj4NCj4g Pj4NCj4gPj4NCj4gPj4gLS0NCj4gPj4NCj4gPj4gRGFuaWVsIE1pZ2F1bHQNCj4gPj4NCj4gPj4N Cj4gPj4NCj4gPj4gRXJpY3Nzb24NCj4gPj4NCj4gPg0KPiA+DQo+ID4gLS0NCj4gPiBEYW5pZWwg TWlnYXVsdA0KPiA+IEVyaWNzc29uDQo+ID4NCj4NCj4NCj4gLS0NCj4gRGFuaWVsIE1pZ2F1bHQN Cj4gRXJpY3Nzb24NCg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPiBBY2UgbWFpbGluZyBsaXN0DQo+IEFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGll dGYub3JnPg0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTxodHRw czovL2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0El MkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZhY2UmZGF0YT0wNCU3QzAx JTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2NiMjU2MzFkYjkyNjRkMjZlNDY2 MDhkODlhYjYyYmRlJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMSU3 QzYzNzQyOTQ1NDQ5ODkyMzgzMyU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdM akF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0Mz MDAwJnNkYXRhPVR4VTZQWHBPODZXUVVVaVFzbDlXYWE1NCUyRiUyQldLUE9DU0VxTzZ4V21GaTlR JTNEJnJlc2VydmVkPTA+DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpBY2UgbWFpbGluZyBsaXN0DQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRm Lm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlPGh0dHBzOi8v ZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUy Rnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFjZSZkYXRhPTA0JTdDMDElN0No ZW5kcmlrLmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0NjYwOGQ4 OWFiNjJiZGUlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MxJTdDNjM3 NDI5NDU0NDk4OTIzODMzJTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdN REFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAm c2RhdGE9VHhVNlBYcE84NldRVVVpUXNsOVdhYTU0JTJGJTJCV0tQT0NTRXFPNnhXbUZpOVElM0Qm cmVzZXJ2ZWQ9MD4NCg0KDQotLQ0KRGFuaWVsIE1pZ2F1bHQNCkVyaWNzc29uDQo= --_000_AM0PR10MB24188E1E747D0E6EE1BDB82CFECE0AM0PR10MB2418EURP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7 DQoJbWFyZ2luOjcwLjg1cHQgNzAuODVwdCAyLjBjbSA3MC44NXB0O30NCmRpdi5Xb3JkU2VjdGlv bjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8 L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0 IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNo YXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iREUiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPkFzIHRoZSBDTVBvdmVyQ29BUCBkcmFmdCB3YXMgYWxyZWFkeSBkaXNj dXNzZWQgaW4gTEFNUFMgYW5kIEppbSBzdWdnZXN0ZWQgdG8gY29uc2lkZXIgaXQgaW4gQUNFLCBJ IHN1Z2dlc3QgdG8gZHJvcCB0aGUgTm90ZSBhbmQgY29tZSBiYWNrIHRvIGEgY2xlYXIgc3RhdGVt ZW50IGFzIGRpc2N1c3NlZCBhdCBJRVRGMTA5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFu Z3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPkRpc2N1c3Npb24gb24gdGhlIExBTVBTIE1haWxpbmcgTGlzdCBmcm9tIEp1bmU6PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi IHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PGEgaHJlZj0iaHR0cHM6Ly9tYWls YXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9zcGFzbS91eVlDZjVzTWN4ZzZ4b1FGY2JlMXNQeHFW THcvIj5odHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3NwYXNtL3V5WUNmNXNN Y3hnNnhvUUZjYmUxc1B4cVZMdy88L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ SGVuZHJpazxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRp bmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+Vm9uOjwvYj4g QWNlICZsdDthY2UtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+SW0gQXVmdHJhZyB2b24gPC9iPg0K RGFuaWVsIE1pZ2F1bHQ8YnI+DQo8Yj5HZXNlbmRldDo8L2I+IE1vbnRhZywgNy4gRGV6ZW1iZXIg MjAyMCAxNDo0Mzxicj4NCjxiPkFuOjwvYj4gQmVuamFtaW4gS2FkdWsgJmx0O2thZHVrQG1pdC5l ZHUmZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBBY2UgV2cgJmx0O2FjZUBpZXRmLm9yZyZndDs8YnI+DQo8 Yj5CZXRyZWZmOjwvYj4gUmU6IFtBY2VdIENoYXJ0ZXIgZGlzY3Vzc2lvbjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpLCZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGxlYXNlIGhhdmUgYSBsb29rIGF0IHRo ZSBsYXRlc3QgdmVyc2lvbiBvZiB0aGUgY2hhcnRlciBiZWZvcmUgd2UgbW92ZSBpdCBmb3J3YXJk IGJ5IHRoZSBlbmQgb2YgdGhlIHdlZWsgLSBEZWNlbWJlciAxMS4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhZGRlZCBhIG5vdGUg b24gcG90ZW50aWFsIFdHIHRoYXQgY291bGQmbmJzcDtob3N0IHRoZSBDTVB2MiBvdmVyIENvQVAg LSBldmVudHVhbGx5LiBJIGFtIHdvbmRlcmluZyBpZiB3ZSBzaG91bGQgcHV0IGEgbm90ZSB0byB0 aGVzZSBXR3MuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPllvdXJzLCZuYnNwOzxicj4NCkRhbmllbDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlRoZSBBdXRoZW50 aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlvbiBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIChh Y2UpIFdHIGhhcyBkZWZpbmVkIGEgc3RhbmRhcmRpemVkIHNvbHV0aW9uIGZyYW1ld29yayBmb3Ig YXV0aGVudGljYXRpb24gYW5kIGF1dGhvcml6YXRpb24gdG8gZW5hYmxlIGF1dGhvcml6ZWQNCiBh Y2Nlc3MgdG8gcmVzb3VyY2VzIGlkZW50aWZpZWQgYnkgYSBVUkkgYW5kIGhvc3RlZCBvbiBhIHJl c291cmNlIHNlcnZlciBpbiBjb25zdHJhaW5lZCBlbnZpcm9ubWVudHMuJm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY20iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5UaGUgYWNjZXNz IHRvIHRoZSByZXNvdXJjZSBpcyBtZWRpYXRlZCBieSBhbiBhdXRob3JpemF0aW9uIHNlcnZlciwg d2hpY2ggaXMgbm90IGNvbnNpZGVyZWQgdG8gYmUgY29uc3RyYWluZWQuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlByb2ZpbGVzIG9mIHRoaXMgZnJhbWV3b3JrIGZv ciBhcHBsaWNhdGlvbiB0byBzZWN1cml0eSBwcm90b2NvbHMgY29tbW9ubHkgdXNlZCBpbiBjb25z dHJhaW5lZCBlbnZpcm9ubWVudHMsIGluY2x1ZGluZyBDb0FQK0RUTFMgYW5kIENvQVArT1NDT1JF LCBoYXZlIGFsc28gYmVlbiBzdGFuZGFyZGl6ZWQuJm5ic3A7IFRoZQ0KIFdvcmtpbmcgR3JvdXAg aXMgY2hhcmdlZCB3aXRoIG1haW50ZW5hbmNlIG9mIHRoZSBmcmFtZXdvcmsgYW5kIGV4aXN0aW5n IHByb2ZpbGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9m aWxlcyBvZiB0aGUgZnJhbWV3b3JrIGZvciBhZGRpdGlvbmFsIHNlY3VyZSBjb21tdW5pY2F0aW9u cyBwcm90b2NvbHMgYW5kIGZvciBhZGRpdGlvbmFsIHN1cHBvcnQgc2VydmljZXMgcHJvdmlkaW5n IGF1dGhvcml6ZWQgYWNjZXNzDQogdG8gY3J5cHRvIGtleXMgKHRoYXQgYXJlIG5vdCBuZWNlc3Nh cmlseSBsaW1pdGVkIHRvIGNvbnN0cmFpbmVkIGVuZHBvaW50cywgdGhvdWdoIHRoZSBmb2N1cyBy ZW1haW5zIG9uIGRlcGxveW1lbnQgaW4gZWNvc3lzdGVtcyB3aXRoIGEgc3Vic3RhbnRpYWwgcG9y dGlvbiBvZiBjb25zdHJhaW5lZCBkZXZpY2VzKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 MGNtIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+SW4gYWRkaXRpb24gdG8gdGhlIG9uZ29pbmcgbWFpbnRlbmFuY2Ugd29y aywgdGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBleHRlbmQgdGhlIGZyYW1ld29yayBhcyBuZWVkZWQg Zm9yIGFwcGxpY2FiaWxpdHkgdG8gZ3JvdXAgY29tbXVuaWNhdGlvbnMsIHdpdGggaW5pdGlhbCBm b2N1cyBvbiAoRClUTFMgYW5kIChHcm91cCkNCiBPU0NPUkUgYXMgdGhlIHVuZGVybHlpbmcgZ3Jv dXAgY29tbXVuaWNhdGlvbiBzZWN1cml0eSBwcm90b2NvbHMuIFRoZSBXb3JraW5nIEdyb3VwIHdp bGwgc3RhbmRhcmRpemUgcHJvY2VkdXJlcyBmb3IgcmVxdWVzdGluZyBhbmQgZGlzdHJpYnV0aW5n IGdyb3VwIGtleWluZyBtYXRlcmlhbCB1c2luZyB0aGUgQUNFIGZyYW1ld29yayBhcyB3ZWxsIGFz IGFwcHJvcHJpYXRlZCBtYW5hZ2VtZW50IGludGVyZmFjZXMuJm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBz dHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlRoZSBXb3JraW5nIEdyb3VwIHdpbGwgc3RhbmRh cmRpemUgYSBmb3JtYXQgZm9yIGV4cHJlc3NpbmcgYXV0aG9yaXphdGlvbiBpbmZvcm1hdGlvbiBm b3IgYSBnaXZlbiBhdXRoZW50aWNhdGVkIHByaW5jaXBhbCBhcyByZWNlaXZlZCBmcm9tIGFuIGF1 dGhvcml6YXRpb24gbWFuYWdlci4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNt Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+VGhlIFdvcmtpbmcgR3JvdXAgd2lsbCBleGFtaW5lIGhvdyB0byB1c2UgQ29u c3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9jb2wgKENvQVApIGFzIGEgdHJhbnNwb3J0IG1lZGl1 bSBmb3IgY2VydGlmaWNhdGUgZW5yb2xsbWVudCBwcm90b2NvbHMsIHN1Y2ggYXMgRVNUIGFuZCBD TVB2MiwgYXMgd2VsbCBhcyBhDQogdHJhbnNwb3J0IGZvciBhdXRoZW50aWNhdGlvbiBwcm90b2Nv bHMgc3VjaCBhcyBFQVAsIGFuZCBzdGFuZGFyZGl6ZSBhcyBuZWVkZWQuIFtOb3RlIHRoYXQgQ01Q djIgd29yayBtYXkgYWxzbyBiZSBob3N0ZWQgaW4gTEFNUFMgKHdoaWNoIHJldmlzaXRzIENNUHYy KSwgQU5JTUEgKCB3aGljaCBkZWZpbmVzIENNUHYyIGFzIGFuIGFsdGVybmF0aXZlIHRvIEVTVCkg b3IgSU9UUFMuIEVBUCB3b3JrIGhhcyBiZWVuIGNvb3JkaW5hdGVkIHdpdGggRU1VLg0KIEluIGFu eSBjYXNlLCBpZiB0aGUgd29yayBpcyBiZWluZyBjb25zaWRlcmVkIGluIEFDRSwgd2Ugd2lsbCBt YWtlIHN1cmUgdGhlIGNvcnJlc3BvbmRpbmcgV0cgd2lsbCBmb2xsb3cgdGhlIHByb2dyZXNzLl08 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46MGNtIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBOb3YgMTcs IDIwMjAgYXQgNjo0NyBQTSBCZW5qYW1pbiBLYWR1ayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmthZHVr QG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyBmb3IgdXBkYXRp bmcgdGhlIGRyYWZ0IGNoYXJ0ZXIgYXQgWzFdLCBEYW5pZWwhPGJyPg0KPGJyPg0KSSBub3RlIHRo YXQgTWljaGFlbCByYWlzZWQgdGhlIHF1ZXN0aW9uIG9mIHdoZXRoZXIgc29tZSBvdGhlciBncm91 cCBtaWdodDxicj4NCmFsc28gYmUgaW50ZXJlc3RlZCBpbiB3b3JraW5nIG9uIENNUC1vdmVyLWNv YXAsIHNvIHRoZSBJRVNHIHdpbGwgYmUgc3VyZSB0bzxicj4NCmRpc2N1c3MgdGhhdCBpZiBDTVAg aXMgc3RpbGwgaW4gdGhlIGRyYWZ0IEFDRSBjaGFydGVyIHdoZW4gaXQgZ29lcyB0byB0aGU8YnI+ DQpJRVNHIGZvciByZXZpZXcuPGJyPg0KPGJyPg0KLUJlbjxicj4NCjxicj4NCk9uIFR1ZSwgTm92 IDE3LCAyMDIwIGF0IDA2OjE2OjQ4UE0gLTA1MDAsIERhbmllbCBNaWdhdWx0IHdyb3RlOjxicj4N CiZndDsgVGhhbmsgeW91IGFsbCBmb3IgdGhlIGZlZWQgYmFja3MuIEZvciB0aGUgcHVycG9zZSBv ZiBkcml2aW5nIHRoZSBjaGFydGVyPGJyPg0KJmd0OyBkaXNjdXNzaW9uIGF0IHRoZSBJRVRmIDEw OSwgSSBoYXZlIGFkZGVkIHRoZSBjb21tZW50cyBpbnRvIHRoZSBwcm9wb3NlZDxicj4NCiZndDsg dGV4dCBbMV0uPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IE15IGN1cnJlbnQgdW5kZXJzdGFuZGluZyBp cyB0aGF0IGl0IHNlZW1zIGJlbmVmaWNpYWwgdG8gYWRkIENNUHYyIG92ZXIgQ29BUDxicj4NCiZn dDsgaW4gdGhlIGNoYXJ0ZXIuIEkgYW0gaGFwcHkgdG8gYmUgY29udHJhZGljdGVkLjxicj4NCiZn dDsgKiBJIGhhdmUgbm90IHNlZW4gYSBjbGVhciBjdXQgdG8gZG8gb25lIG9yIHRoZSBvdGhlci48 YnI+DQomZ3Q7ICogRVNUIGFuZCBDTVB2MiBhcmUgdHdvIHByb3RvY29scyB0aGF0IGNhbiBiZSB1 c2VkIGZvciBlbnJvbGxtZW50IG9yIGNlcnQ8YnI+DQomZ3Q7IG1hbmFnZW1lbnQgd2hpbGUgYWRk cmVzc2luZyBkaWZmZXJlbnQgY2FzZXMgLyBuZWVkcyAvIHNpdHVhdGlvbnMgLS0gbWF5YmU8YnI+ DQomZ3Q7IHdlIGNhbiBjbGFyaWZ5IHRoYXQgcG9pbnQuIEkgY2FuIHNlZSBsZXZlcmFnaW5nIHRo ZSBleGlzdGluZyBDTVA8YnI+DQomZ3Q7IGluZnJhc3RydWN0dXJlLCBidXQgaXQgc2VlbXMgdGhh dCBpcyBub3QgdGhlIG9ubHkgb25lLjxicj4NCiZndDsgKiBJIGFtIG5vdCBjb252aW5jZWQgdGhh dCBub3QgaGF2aW5nIENNUCBvdmVyIENvQVAgd2lsbCBub3QgcHJldmVudCBpdHM8YnI+DQomZ3Q7 IGRlcGxveW1lbnQgYW5kIGFzIHN1Y2ggSSBwcmVmZXIgdG8gaGF2ZSBpdCBzdGFuZGFyZGl6ZWQg LSB0aGlzIG1pZ2h0IGJlIGE8YnI+DQomZ3Q7IHBlcnNvbmFsIHRob3VnaHQuPGJyPg0KJmd0OyAq IEFkZGluZyBhbnkgcGllY2Ugb2Ygd29yayByZXF1aXJlIGN5Y2xlcywgYnV0IGl0IHNlZW1zIHRv IG1lIHRoYXQgQ1BNIHdpbGw8YnI+DQomZ3Q7IG5vdCBoYXZlIGEgbWFqb3IgaW1wYWN0IG9uIHRo ZSBXRyBwcm9ncmVzcy4gVGhlIHdvcmsgd2lsbCBwcm9iYWJseSBpbmNsdWRlPGJyPg0KJmd0OyBv dGhlciBXRyBzdWNoIGEgTEFNUFMuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFlvdXJzLDxicj4NCiZn dDsgRGFuaWVsPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFsxXTxicj4NCiZndDsgPGEgaHJlZj0iaHR0 cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNB JTJGJTJGZG9jcy5nb29nbGUuY29tJTJGZG9jdW1lbnQlMkZkJTJGMVJ0eFVTdlVlQmRaV29Ra2pT ajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFklMkZlZGl0JTNGdXNwJTNEc2hhcmluZyZhbXA7ZGF0 YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2NiMjU2MzFkYjky NjRkMjZlNDY2MDhkODlhYjYyYmRlJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWEl N0MxJTdDMSU3QzYzNzQyOTQ1NDQ5ODkwMzkxOSU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpX SWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZN bjAlM0QlN0MzMDAwJmFtcDtzZGF0YT1oV1Z2RUFlVFIzNSUyRmxraEI4cHpEeVc2a2MxNDNRJTJC M0RjNVkwZjkwTG5CMCUzRCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6 Ly9kb2NzLmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1 QndQTTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nPC9hPjxicj4NCiZndDsgPGJyPg0KJmd0 OyBPbiBUdWUsIE5vdiAxNywgMjAyMCBhdCA2OjAyIFBNIERhbmllbCBNaWdhdWx0ICZsdDs8YSBo cmVmPSJtYWlsdG86bWdsdC5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1nbHQuaWV0 ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDsgJmd0OyBIaSBH b3Jhbiw8YnI+DQomZ3Q7ICZndDs8YnI+DQomZ3Q7ICZndDsgSSBhZGRlZCB0aGUgdGV4dCB0byB0 aGUgY2hhcnRlciB3ZSB3aWxsIGRpc2N1c3MgbGF0ZXIuPGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7IFlvdXJzLDxicj4NCiZndDsgJmd0OyBEYW5pZWw8YnI+DQomZ3Q7ICZndDs8YnI+DQom Z3Q7ICZndDsgT24gRnJpLCBOb3YgMTMsIDIwMjAgYXQgMTA6MjYgQU0gR8O2cmFuIFNlbGFuZGVy ICZsdDs8YnI+DQomZ3Q7ICZndDsgPGEgaHJlZj0ibWFpbHRvOmdvcmFuLnNlbGFuZGVyQGVyaWNz c29uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmdvcmFuLnNlbGFuZGVyQGVyaWNzc29uLmNvbTwvYT4m Z3Q7IHdyb3RlOjxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyZndDsgSGkgRGFuaWVsLDxi cj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDsgSGVyZeKAmXMgYW5vdGhlciBpbnB1dCB0byB0aGUgY2hhcnRlci48 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7IFRoZSBjdXJyZW50IGdyb3VwIGtleSBtYW5hZ2VtZW50IHNvbHV0 aW9ucyBhZGRyZXNzZXMgdGhlIHByb2JsZW0gb2Y8YnI+DQomZ3Q7ICZndDsmZ3Q7IGF1dGhvcml6 ZWQgYWNjZXNzIHRvIGdyb3VwIGtleXMgYW5kIHB1YmxpYyBrZXlzIG9mIGdyb3VwIG1lbWJlcnMu PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7 PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBBIHJlbGF0ZWQgcHJvYmxlbSBpcyBhdXRob3JpemVkIGFjY2Vz cyBvZiBwdWJsaWMga2V5cyBvZiBvdGhlciBkZXZpY2VzPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBub3Qg bmVjZXNzYXJpbHkgcGFydCBvZiBhIHNlY3VyaXR5IGdyb3VwLCBpbiB0aGUgc2Vuc2Ugb2Ygc2hh cmluZyBhPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBzeW1tZXRyaWMga2V5IHVzZWQgdG8gcHJvdGVjdCBn cm91cCBtZXNzYWdlcy48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4N CiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IEF1dGhvcml6ZWQgYWNjZXNzIHRvIHJh dyBwdWJsaWMga2V5cyBzZXJ2ZXMgYW4gaW1wb3J0YW50IGZ1bmN0aW9uIGluPGJyPg0KJmd0OyAm Z3Q7Jmd0OyBjb25zdHJhaW5lZCBzZXR0aW5ncyB3aGVyZSBwdWJsaWMga2V5IGNlcnRpZmljYXRl cyBtYXkgbm90IGJlIGZlYXNpYmxlIGR1ZTxicj4NCiZndDsgJmd0OyZndDsgdG8gdGhlIGluY3Vy cmVkIG92ZXJoZWFkLCBlLmcuIGZvciB3aGVuIGF1dGhlbnRpY2F0aW5nIHVzaW5nIEVESE9DPGJy Pg0KJmd0OyAmZ3Q7Jmd0OyAoZHJhZnQtaWV0Zi1sYWtlLWVkaG9jKS48YnI+DQomZ3Q7ICZndDsm Z3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBUaGlzIGZ1bmN0aW9uYWxpdHkgaXMgdGh1cyBhIHN1YnNl dCBvZiB3aGF0IGlzIGFscmVhZHkgc3VwcG9ydGVkLCBidXQ8YnI+DQomZ3Q7ICZndDsmZ3Q7IHNp bmNlIHRoZSBjdXJyZW50IHNvbHV0aW9uIGlzIGdlYXJlZCB0b3dhcmRzIGdyb3VwcyBhIGRpZmZl cmVudCBzb2x1dGlvbjxicj4NCiZndDsgJmd0OyZndDsgbWF5IGJlIG5lZWRlZCAoYWx0aG91Z2gg aXQgaXMgcHJvYmFibHkgcG9zc2libGUgdG8gcmV1c2UgcGFydHMgZnJvbSB0aGU8YnI+DQomZ3Q7 ICZndDsmZ3Q7IGV4aXN0aW5nIHNjaGVtZXMgZm9yIHByb3Zpc2lvbmluZyBhbmQgcmVxdWVzdGlu ZyBwdWJsaWMga2V5cykuPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+ DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBXaXRoIHRoaXMgaW4gbWluZCwgSSBw cm9wb3NlIHRoZSBmb2xsb3dpbmcgY2hhbmdlIChoaWdobGlnaHRlZCBpbjxicj4NCiZndDsgJmd0 OyZndDsgYm9sZGZhY2UgYmVsb3cpOjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsm Z3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgT0xEPGJyPg0KJmd0OyAm Z3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgVGhlIFdvcmtpbmcgR3JvdXAgaXMgY2hhcmdlZCB3 aXRoIG1haW50ZW5hbmNlIG9mIHRoZSBmcmFtZXdvcmsgYW5kPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBl eGlzdGluZyBwcm9maWxlcyB0aGVyZW9mLCBhbmQgbWF5IHVuZGVydGFrZSB3b3JrIHRvIHNwZWNp ZnkgcHJvZmlsZXMgb2Y8YnI+DQomZ3Q7ICZndDsmZ3Q7IHRoZSBmcmFtZXdvcmsgZm9yIGFkZGl0 aW9uYWwgc2VjdXJlIGNvbW11bmljYXRpb25zIHByb3RvY29scyAodGhhdCBhcmUgbm90PGJyPg0K Jmd0OyAmZ3Q7Jmd0OyBuZWNlc3NhcmlseSBsaW1pdGVkIHRvIGNvbnN0cmFpbmVkIGVuZHBvaW50 cywgdGhvdWdoIHRoZSBmb2N1cyByZW1haW5zIG9uPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBkZXBsb3lt ZW50IGVjb3N5c3RlbXMgd2l0aCBhIHN1YnN0YW50aWFsIHBvcnRpb24gb2YgY29uc3RyYWluZWQg ZGV2aWNlcykuPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7 ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBORVc8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0K Jmd0OyAmZ3Q7Jmd0OyBUaGUgV29ya2luZyBHcm91cCBpcyBjaGFyZ2VkIHdpdGggbWFpbnRlbmFu Y2Ugb2YgdGhlIGZyYW1ld29yayBhbmQ8YnI+DQomZ3Q7ICZndDsmZ3Q7IGV4aXN0aW5nIHByb2Zp bGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9maWxlcyBv Zjxicj4NCiZndDsgJmd0OyZndDsgdGhlIGZyYW1ld29yayBmb3IgYWRkaXRpb25hbCBzZWN1cmUg Y29tbXVuaWNhdGlvbnMgcHJvdG9jb2xzICphbmQgKipmb3I8YnI+DQomZ3Q7ICZndDsmZ3Q7IGFk ZGl0aW9uYWwgKipzdXBwb3J0IHNlcnZpY2VzICoqcHJvdmlkaW5nKiAqYXV0aG9yaXplZCBhY2Nl c3MgdG8gY3J5cHRvKiAqa2V5czxicj4NCiZndDsgJmd0OyZndDsgKih0aGF0IGFyZSBub3QgbmVj ZXNzYXJpbHkgbGltaXRlZCB0byBjb25zdHJhaW5lZCBlbmRwb2ludHMsIHRob3VnaCB0aGU8YnI+ DQomZ3Q7ICZndDsmZ3Q7IGZvY3VzIHJlbWFpbnMgb24gZGVwbG95bWVudCBlY29zeXN0ZW1zIHdp dGggYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBjb25zdHJhaW5l ZCBkZXZpY2VzKS48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZn dDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IEfDtnJhbjxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7IE9uIDIwMjAtMTAtMTUsIDE5OjUwLCAmcXVvdDtBY2UmcXVvdDsg Jmx0OzxhIGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PmFjZS1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDsgSGksPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZn dDsgSSB3b3VsZCBsaWtlIHRvIHN0YXJ0IHRoZSBjaGFydGVyIGRpc2N1c3Npb24uIEhlcmUgaXMg YSBkcmFmdCBvZiBhPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBwcm9wb3NlZCBjaGFydGVyIFsxXS48YnI+ DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+ DQomZ3Q7ICZndDsmZ3Q7IEl0IHNlZW1zIHRvIGJlIHRoYXQgYWRkaXRpb25hbCBkaXNjdXNzaW9u IGlzIG5lZWRlZCB3aXRoIHJlZ2FyZCB0byB0aGU8YnI+DQomZ3Q7ICZndDsmZ3Q7IGxhc3QgcGFy YWdyYXBoIHJlbGF0ZWQgY2VydGlmaWNhdGUgbWFuYWdlbWVudC4gSW4gcGFydGljdWxhciB0aGUg ZGlzY3Vzc2lvbjxicj4NCiZndDsgJmd0OyZndDsgbWlnaHQgcmV2aXZlIGEgZGlzY3Vzc2lvbiB0 aGF0IGhhcHBlbmVkIGluIDIwMTcgWzJdIC0gd2hlbiBJIHdhcyBub3Q8YnI+DQomZ3Q7ICZndDsm Z3Q7IGNvLWNoYWlyIG9mIEFDRSAtYW5kIGNvbnNpZGVyZWQgb3RoZXIgZXhwaXJlZCB3b3JrIHN1 Y2ggYXMgWzNdLiBQbGVhc2UgbWFrZTxicj4NCiZndDsgJmd0OyZndDsgdGhpcyBkaXNjdXNzaW9u IGNvbnN0cnVjdGl2ZSBvbiB0aGlzIHRocmVhZC48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFRoZSBmdW5k YW1lbnRhbCBxdWVzdGlvbiBpcyB3aGV0aGVyIHdlIG5lZWQgY2VydGlmaWNhdGUgbWFuYWdlbWVu dCBhdDxicj4NCiZndDsgJmd0OyZndDsgdGhpcyBzdGFnZS4gSWYgdGhlIGFuc3dlciBpcyB5ZXMs IGFuZCB3ZSBoYXZlIG11bHRpcGxlIHByb3Bvc2FscywgaXQgd291bGQ8YnI+DQomZ3Q7ICZndDsm Z3Q7IGJlIGdvb2QgdG8gY2xhcmlmeSB0aGUgcG9zaXRpb24gb2YgdGhlIGRpZmZlcmVudCBwcm9w b3NhbHMgYW5kIGV2YWx1YXRlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyB3aGV0aGVyIGEgc2VsZWN0aW9u IGlzIG5lZWRlZCBvciBub3QgYmVmb3JlIHZhbGlkYXRpbmcgdGhlIGNoYXJ0ZXIuPGJyPg0KJmd0 OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7Jmd0OyBQbGVhc2UgcHJvdmlkZSB5b3VyIGlucHV0cyBvbiB0aGUgbWFpbGluZyBsaXN0 IGJlZm9yZSBPY3RvYmVyIDMwLiBPZjxicj4NCiZndDsgJmd0OyZndDsgY291cnNlIGZvciBtaW5v ciBlZGl0cywgeW91IG1heSBzdWdnZXN0IHRoZW0gZGlyZWN0bHkgb24gdGhlIGdvb2dsZSBkb2Mu PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7 PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBZb3Vycyw8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAm Z3Q7Jmd0OyBEYW5pZWw8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4N CiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFsxXTxicj4NCiZndDsgJmd0OyZndDsg PGEgaHJlZj0iaHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/ dXJsPWh0dHBzJTNBJTJGJTJGZG9jcy5nb29nbGUuY29tJTJGZG9jdW1lbnQlMkZkJTJGMVJ0eFVT dlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFklMkZlZGl0JTNGdXNwJTNEc2hh cmluZyZhbXA7ZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3 Q2NiMjU2MzFkYjkyNjRkMjZlNDY2MDhkODlhYjYyYmRlJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFi NDJlMTQ5NWQ1NWElN0MxJTdDMSU3QzYzNzQyOTQ1NDQ5ODkwMzkxOSU3Q1Vua25vd24lN0NUV0Zw Ykdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhh V3dpTENKWFZDSTZNbjAlM0QlN0MzMDAwJmFtcDtzZGF0YT1oV1Z2RUFlVFIzNSUyRmxraEI4cHpE eVc2a2MxNDNRJTJCM0RjNVkwZjkwTG5CMCUzRCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxh bmsiPg0KaHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVCZFpXb1Fr alNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nPC9hPjxicj4NCiZn dDsgJmd0OyZndDsgJmx0Ozxicj4NCiZndDsgJmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9ldXIw MS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGcHJv dGVjdDIuZmlyZWV5ZS5jb20lMkZ2MSUyRnVybCUzRmslM0Q0ZjNkOWMzYi0xMThjNDc1Yi00ZjNk ZGNhMC04NmUyMjM3ZjUxZmItNjI3ZTQ4YjA2OTQ2MmQ3MCUyNnElM0QxJTI2ZSUzRDY5MjRiMmE2 LWU3ZTUtNGVjMS1hMWFmLWM5NDYzNzk1M2RjNSUyNnUlM0RodHRwcyUyNTNBJTI1MkYlMjUyRmRv Y3MuZ29vZ2xlLmNvbSUyNTJGZG9jdW1lbnQlMjUyRmQlMjUyRjFSdHhVU3ZVZUJkWldvUWtqU2oy YzNEdFI4RHVCd1BNMkJuQlhob0RpcHRZJTI1MkZlZGl0JTI1M0Z1c3AlMjUzRHNoYXJpbmcmYW1w O2RhdGE9MDQlN0MwMSU3Q2hlbmRyaWsuYnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NjYjI1NjMx ZGI5MjY0ZDI2ZTQ2NjA4ZDg5YWI2MmJkZSU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0OTVk NTVhJTdDMSU3QzAlN0M2Mzc0Mjk0NTQ0OTg5MTM4NzglN0NVbmtub3duJTdDVFdGcGJHWnNiM2Q4 ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhW Q0k2TW4wJTNEJTdDMzAwMCZhbXA7c2RhdGE9VCUyQlJFSkVHSnJuNlF3dFNsVFUzMDBnbTRlUURr RGY2azA4emtkUjVJWUpjJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRw czovL3Byb3RlY3QyLmZpcmVleWUuY29tL3YxL3VybD9rPTRmM2Q5YzNiLTExOGM0NzViLTRmM2Rk Y2EwLTg2ZTIyMzdmNTFmYi02MjdlNDhiMDY5NDYyZDcwJmFtcDtxPTEmYW1wO2U9NjkyNGIyYTYt ZTdlNS00ZWMxLWExYWYtYzk0NjM3OTUzZGM1JmFtcDt1PWh0dHBzJTNBJTJGJTJGZG9jcy5nb29n bGUuY29tJTJGZG9jdW1lbnQlMkZkJTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0y Qm5CWGhvRGlwdFklMkZlZGl0JTNGdXNwJTNEc2hhcmluZzwvYT4mZ3Q7PGJyPg0KJmd0OyAmZ3Q7 Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFsyXTxicj4NCiZndDsg Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZt aW51dGVzLWludGVyaW0tMjAxNy1hY2UtMDMtMjAxNzEwMTkxMzAwJTJGJmFtcDtkYXRhPTA0JTdD MDElN0NoZW5kcmlrLmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0 NjYwOGQ4OWFiNjJiZGUlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0Mx JTdDNjM3NDI5NDU0NDk4OTEzODc4JTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0 d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3 QzMwMDAmYW1wO3NkYXRhPWM5RlJEM2lldURBSFpSWTFucEhhQXFWM1NWMWFNdyUyRkNGZ29lR1Ml MkJCV2lnJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RvYy9taW51dGVzLWludGVyaW0tMjAxNy1hY2UtMDMtMjAxNzEwMTkx MzAwLzwvYT48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBbM10gPGEgaHJl Zj0iaHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0 dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZkcmFmdC1zZWxhbmRlci1h Y2UtZWFscyUyRiZhbXA7ZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5z LmNvbSU3Q2NiMjU2MzFkYjkyNjRkMjZlNDY2MDhkODlhYjYyYmRlJTdDMzhhZTNiY2Q5NTc5NGZk NGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMSU3QzYzNzQyOTQ1NDQ5ODkyMzgzMyU3Q1Vua25vd24l N0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJ NklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0MzMDAwJmFtcDtzZGF0YT1LY3ZNMVVDaHRwc0JDZTd5 NiUyRnMlMkJ2MGxFbkZjcCUyQkRmd2RqZUpxUFVMZVZ3JTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJn ZXQ9Il9ibGFuayI+DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1zZWxh bmRlci1hY2UtZWFscy88L2E+PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyAtLTxicj4NCiZndDsgJmd0OyZn dDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IERhbmllbCBNaWdhdWx0PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBF cmljc3Nvbjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDs8YnI+DQomZ3Q7ICZndDs8 YnI+DQomZ3Q7ICZndDsgLS08YnI+DQomZ3Q7ICZndDsgRGFuaWVsIE1pZ2F1bHQ8YnI+DQomZ3Q7 ICZndDsgRXJpY3Nzb248YnI+DQomZ3Q7ICZndDs8YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0K Jmd0OyAtLSA8YnI+DQomZ3Q7IERhbmllbCBNaWdhdWx0PGJyPg0KJmd0OyBFcmljc3Nvbjxicj4N Cjxicj4NCiZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQomZ3Q7IEFjZSBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7IDxhIGhyZWY9Im1haWx0bzpB Y2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KJmd0OyA8 YSBocmVmPSJodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZhY2Um YW1wO2RhdGE9MDQlN0MwMSU3Q2hlbmRyaWsuYnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NjYjI1 NjMxZGI5MjY0ZDI2ZTQ2NjA4ZDg5YWI2MmJkZSU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0 OTVkNTVhJTdDMSU3QzElN0M2Mzc0Mjk0NTQ0OTg5MjM4MzMlN0NVbmtub3duJTdDVFdGcGJHWnNi M2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxD SlhWQ0k2TW4wJTNEJTdDMzAwMCZhbXA7c2RhdGE9VHhVNlBYcE84NldRVVVpUXNsOVdhYTU0JTJG JTJCV0tQT0NTRXFPNnhXbUZpOVElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj4N Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlPC9hPjxicj4NCjxicj4N Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KQWNl IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBY2VAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5BY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9ldXIwMS5zYWZl bGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYu b3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWNlJmFtcDtkYXRhPTA0JTdDMDElN0NoZW5kcmlr LmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdDY2IyNTYzMWRiOTI2NGQyNmU0NjYwOGQ4OWFiNjJi ZGUlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MxJTdDNjM3NDI5NDU0 NDk4OTIzODMzJTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENK UUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmYW1wO3Nk YXRhPVR4VTZQWHBPODZXUVVVaVFzbDlXYWE1NCUyRiUyQldLUE9DU0VxTzZ4V21GaTlRJTNEJmFt cDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9hY2U8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRhbmllbCBNaWdhdWx0PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Fcmljc3NvbjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwv aHRtbD4NCg== --_000_AM0PR10MB24188E1E747D0E6EE1BDB82CFECE0AM0PR10MB2418EURP_-- From nobody Mon Dec 7 10:11:19 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45BFC3A1643 for ; Mon, 7 Dec 2020 10:11:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4oFAf24Tcl9F for ; Mon, 7 Dec 2020 10:11:15 -0800 (PST) Received: from mail-vs1-xe2e.google.com (mail-vs1-xe2e.google.com [IPv6:2607:f8b0:4864:20::e2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3196A3A1642 for ; Mon, 7 Dec 2020 10:11:15 -0800 (PST) Received: by mail-vs1-xe2e.google.com with SMTP id z16so8077192vsp.5 for ; Mon, 07 Dec 2020 10:11:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gzTy/Jrn8p3SOUrlDRTKSSDsJhEalTdN9zc/Pw7gmws=; b=cWylT8o39WJV9Vcl6SUMh/u7UWRe0AowV77vAVSxq6UwKsvnNAGUP159qbl1OYoUoo YU7gVjjUMayCMcyy0TQX862z7tmRqopfvSMr+ehwmj+3U65EGPLhN7/tM4tTd1wgXhN9 gNZ4i53mVuMD4YD3bV3qYfG0ShyRUwazr5cRB/qOoO7hWjbT2m6d8Ddl5RcIqTREhEzI VnRJNQimnJ38sJg/rjk5ltLxXM815g7+YMyXfZuwJTGZn8Vre3NPBm/kS5ixOHaCYPE7 GAs1fg9k9yNB1enArIzApCil3YWOmoI+S00WRHUg/Kqo7pskC5EANmZ9+w5j866bAeOE mNBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gzTy/Jrn8p3SOUrlDRTKSSDsJhEalTdN9zc/Pw7gmws=; b=AGv0ufM7HWAcqqnqMUgDrJSKXvI2u3uya3nCUcwPd5GgbLO1sa3kW/L4GzbU7jhMAD eQEaxeGL0Bns15Vm2RyVGahO4VjrHdp60ai/wOif8DXOoJBjgq/sbRTQmBHdNKvv5iMR cXYE0SR+obze8xVKK1zjfQnzwI6nOacpsV0APL56hzSP+LHRHbVCc2S6OJ6lWm7RpUWw X+AUEaCz8IM6gU5AqupmIhMdyi78WyIGGD7L0VKIeX+5oy2Rz7sQIUdQ13SBphmZAz5/ D2wviPBRKtCngh9XnhSg1aukai1JTDwSSpAFbywfQJkotHkMxFrNNO7lNdF72Dal7llT L0KQ== X-Gm-Message-State: AOAM530cADwtUf2RqqKprFhwH1Z+xnwQ4x6i3YqtYsfsIze1iBAOnhQC ENYzn0l3nKiokaNGglOQ2x5+aF3HNPeU/JKY7ac= X-Google-Smtp-Source: ABdhPJyvua0sQn/PIG65RK5ncpHPAh/j2OFnrJZDCakjq+RRAVu2PcJdzW23Dz361VrKdA2vRN3F1h/MHx9mMDju/vI= X-Received: by 2002:a67:32c5:: with SMTP id y188mr13214431vsy.4.1607364674125; Mon, 07 Dec 2020 10:11:14 -0800 (PST) MIME-Version: 1.0 References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: From: Daniel Migault Date: Mon, 7 Dec 2020 13:11:03 -0500 Message-ID: To: "Brockhaus, Hendrik" Cc: Benjamin Kaduk , Ace Wg Content-Type: multipart/alternative; boundary="0000000000006d03d205b5e3c053" Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 18:11:18 -0000 --0000000000006d03d205b5e3c053 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks, I was about just sending them a note, but that is maybe not needed. Just for your information, the note is not part of the charter, but to our AD/IESG. Yours, Daniel On Mon, Dec 7, 2020 at 12:05 PM Brockhaus, Hendrik < hendrik.brockhaus@siemens.com> wrote: > As the CMPoverCoAP draft was already discussed in LAMPS and Jim suggested > to consider it in ACE, I suggest to drop the Note and come back to a clea= r > statement as discussed at IETF109. > > > > Discussion on the LAMPS Mailing List from June: > > https://mailarchive.ietf.org/arch/msg/spasm/uyYCf5sMcxg6xoQFcbe1sPxqVLw/ > > > > Hendrik > > > > *Von:* Ace *Im Auftrag von * Daniel Migault > *Gesendet:* Montag, 7. Dezember 2020 14:43 > *An:* Benjamin Kaduk > *Cc:* Ace Wg > *Betreff:* Re: [Ace] Charter discussion > > > > Hi, > > > > Please have a look at the latest version of the charter before we move it > forward by the end of the week - December 11. > > > > I added a note on potential WG that could host the CMPv2 over CoAP - > eventually. I am wondering if we should put a note to these WGs. > > > > Yours, > Daniel > > > > The Authentication and Authorization for Constrained Environments (ace) W= G > has defined a standardized solution framework for authentication and > authorization to enable authorized access to resources identified by a UR= I > and hosted on a resource server in constrained environments. > > The access to the resource is mediated by an authorization server, which > is not considered to be constrained. > > > > Profiles of this framework for application to security protocols commonly > used in constrained environments, including CoAP+DTLS and CoAP+OSCORE, ha= ve > also been standardized. The Working Group is charged with maintenance of > the framework and existing profiles thereof, and may undertake work to > specify profiles of the framework for additional secure communications > protocols and for additional support services providing authorized access > to crypto keys (that are not necessarily limited to constrained endpoints= , > though the focus remains on deployment in ecosystems with a substantial > portion of constrained devices). > > > > In addition to the ongoing maintenance work, the Working Group will exten= d > the framework as needed for applicability to group communications, with > initial focus on (D)TLS and (Group) OSCORE as the underlying group > communication security protocols. The Working Group will standardize > procedures for requesting and distributing group keying material using th= e > ACE framework as well as appropriated management interfaces. > > > > The Working Group will standardize a format for expressing authorization > information for a given authenticated principal as received from an > authorization manager. > > > > The Working Group will examine how to use Constrained Application Protoco= l > (CoAP) as a transport medium for certificate enrollment protocols, such a= s > EST and CMPv2, as well as a transport for authentication protocols such a= s > EAP, and standardize as needed. [Note that CMPv2 work may also be hosted = in > LAMPS (which revisits CMPv2), ANIMA ( which defines CMPv2 as an alternati= ve > to EST) or IOTPS. EAP work has been coordinated with EMU. In any case, if > the work is being considered in ACE, we will make sure the corresponding = WG > will follow the progress.] > > > > > > > > > > > > On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk wrote: > > Thanks for updating the draft charter at [1], Daniel! > > I note that Michael raised the question of whether some other group might > also be interested in working on CMP-over-coap, so the IESG will be sure = to > discuss that if CMP is still in the draft ACE charter when it goes to the > IESG for review. > > -Ben > > On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > > Thank you all for the feed backs. For the purpose of driving the charte= r > > discussion at the IETf 109, I have added the comments into the proposed > > text [1]. > > > > My current understanding is that it seems beneficial to add CMPv2 over > CoAP > > in the charter. I am happy to be contradicted. > > * I have not seen a clear cut to do one or the other. > > * EST and CMPv2 are two protocols that can be used for enrollment or ce= rt > > management while addressing different cases / needs / situations -- may= be > > we can clarify that point. I can see leveraging the existing CMP > > infrastructure, but it seems that is not the only one. > > * I am not convinced that not having CMP over CoAP will not prevent its > > deployment and as such I prefer to have it standardized - this might be= a > > personal thought. > > * Adding any piece of work require cycles, but it seems to me that CPM > will > > not have a major impact on the WG progress. The work will probably > include > > other WG such a LAMPS. > > > > Yours, > > Daniel > > > > [1] > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > > > Hi Goran, > > > > > > I added the text to the charter we will discuss later. > > > > > > Yours, > > > Daniel > > > > > > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander < > > > goran.selander@ericsson.com> wrote: > > > > > >> Hi Daniel, > > >> > > >> > > >> > > >> Here=E2=80=99s another input to the charter. > > >> > > >> > > >> > > >> The current group key management solutions addresses the problem of > > >> authorized access to group keys and public keys of group members. > > >> > > >> > > >> > > >> A related problem is authorized access of public keys of other devic= es > > >> not necessarily part of a security group, in the sense of sharing a > > >> symmetric key used to protect group messages. > > >> > > >> > > >> > > >> Authorized access to raw public keys serves an important function in > > >> constrained settings where public key certificates may not be > feasible due > > >> to the incurred overhead, e.g. for when authenticating using EDHOC > > >> (draft-ietf-lake-edhoc). > > >> > > >> This functionality is thus a subset of what is already supported, bu= t > > >> since the current solution is geared towards groups a different > solution > > >> may be needed (although it is probably possible to reuse parts from > the > > >> existing schemes for provisioning and requesting public keys). > > >> > > >> > > >> > > >> With this in mind, I propose the following change (highlighted in > > >> boldface below): > > >> > > >> > > >> > > >> OLD > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols (that > are not > > >> necessarily limited to constrained endpoints, though the focus > remains on > > >> deployment ecosystems with a substantial portion of constrained > devices). > > >> > > >> > > >> > > >> NEW > > >> > > >> The Working Group is charged with maintenance of the framework and > > >> existing profiles thereof, and may undertake work to specify profile= s > of > > >> the framework for additional secure communications protocols *and > **for > > >> additional **support services **providing* *authorized access to > crypto* *keys > > >> *(that are not necessarily limited to constrained endpoints, though > the > > >> focus remains on deployment ecosystems with a substantial portion of > > >> constrained devices). > > >> > > >> > > >> > > >> G=C3=B6ran > > >> > > >> > > >> > > >> > > >> > > >> > > >> > > >> On 2020-10-15, 19:50, "Ace" wrote: > > >> > > >> Hi, > > >> > > >> I would like to start the charter discussion. Here is a draft of a > > >> proposed charter [1]. > > >> > > >> > > >> > > >> It seems to be that additional discussion is needed with regard to t= he > > >> last paragraph related certificate management. In particular the > discussion > > >> might revive a discussion that happened in 2017 [2] - when I was not > > >> co-chair of ACE -and considered other expired work such as [3]. > Please make > > >> this discussion constructive on this thread. > > >> > > >> > > >> > > >> The fundamental question is whether we need certificate management a= t > > >> this stage. If the answer is yes, and we have multiple proposals, it > would > > >> be good to clarify the position of the different proposals and > evaluate > > >> whether a selection is needed or not before validating the charter. > > >> > > >> > > >> > > >> Please provide your inputs on the mailing list before October 30. Of > > >> course for minor edits, you may suggest them directly on the google > doc. > > >> > > >> > > >> > > >> Yours, > > >> > > >> Daniel > > >> > > >> > > >> > > >> [1] > > >> > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > > >> < > > >> > https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e223= 7f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=3D= https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing > > > > > >> > > >> > > >> [2] > > >> > https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300= / > > > >> > > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > > > >> > > >> > > >> > > >> -- > > >> > > >> Daniel Migault > > >> > > >> > > >> > > >> Ericsson > > >> > > > > > > > > > -- > > > Daniel Migault > > > Ericsson > > > > > > > > > -- > > Daniel Migault > > Ericsson > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > > > > > -- > > Daniel Migault > > Ericsson > --=20 Daniel Migault Ericsson --0000000000006d03d205b5e3c053 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks, I was about just sending them a note, but that is = maybe not needed. Just for your information, the note is not part of the ch= arter, but to our AD/IESG.=C2=A0
Yours, Daniel

On Mon, Dec 7, 2020= at 12:05 PM Brockhaus, Hendrik <hendrik.brockhaus@siemens.com> wrote:

As the CMPoverCoAP draft was al= ready discussed in LAMPS and Jim suggested to consider it in ACE, I suggest= to drop the Note and come back to a clear statement as discussed at IETF10= 9.

=C2=A0

Discussion on the LAMPS Mailing= List from June:

htt= ps://mailarchive.ietf.org/arch/msg/spasm/uyYCf5sMcxg6xoQFcbe1sPxqVLw/

=C2=A0

Hendrik

=C2=A0

Von: Ace <ace-bounces@ietf.org> Im Auftrag von Daniel Migault
Gesendet: Montag, 7. Dezember 2020 14:43
An: Benjamin Kaduk <kaduk@mit.edu>
Cc: Ace Wg <ace= @ietf.org>
Betreff: Re: [Ace] Charter discussion

=C2=A0

Hi,=C2=A0

=C2=A0

Please have a look at the latest version of the char= ter before we move it forward by the end of the week - December 11.=C2=A0

=C2=A0

I added a note on potential WG that could=C2=A0host = the CMPv2 over CoAP - eventually. I am wondering if we should put a note to= these WGs.=C2=A0

=C2=A0

Yours,=C2=A0
Daniel

=C2=A0

The Authentication and Authorization for Constrained Enviro= nments (ace) WG has defined a standardized solution framework for authentic= ation and authorization to enable authorized access to resources identified by a URI and hosted on a resource server in= constrained environments.=C2=A0

The access to the resource is mediated by an authorization = server, which is not considered to be constrained.

=C2=A0

Profiles of this framework for application to security prot= ocols commonly used in constrained environments, including CoAP+DTLS and Co= AP+OSCORE, have also been standardized.=C2=A0 The Working Group is charged with maintenance of the framework and existing pr= ofiles thereof, and may undertake work to specify profiles of the framework= for additional secure communications protocols and for additional support = services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints,= though the focus remains on deployment in ecosystems with a substantial po= rtion of constrained devices).

=C2=A0

In addition to the ongoing maintenance work, the Working Gr= oup will extend the framework as needed for applicability to group communic= ations, with initial focus on (D)TLS and (Group) OSCORE as the underlying group communication security protocols. The Worki= ng Group will standardize procedures for requesting and distributing group = keying material using the ACE framework as well as appropriated management = interfaces.=C2=A0

=C2=A0

The Working Group will standardize a format for expressing = authorization information for a given authenticated principal as received f= rom an authorization manager.=C2=A0

=C2=A0

The Working Group will examine how to use Constrained Appli= cation Protocol (CoAP) as a transport medium for certificate enrollment pro= tocols, such as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and standardize as nee= ded. [Note that CMPv2 work may also be hosted in LAMPS (which revisits CMPv= 2), ANIMA ( which defines CMPv2 as an alternative to EST) or IOTPS. EAP wor= k has been coordinated with EMU. In any case, if the work is being considered in ACE, we will make sure the= corresponding WG will follow the progress.]

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk <<= a href=3D"mailto:kaduk@mit.edu" target=3D"_blank">kaduk@mit.edu> wro= te:

Thanks for updating the draft charter at [1], Daniel= !

I note that Michael raised the question of whether some other group might also be interested in working on CMP-over-coap, so the IESG will be sure to=
discuss that if CMP is still in the draft ACE charter when it goes to the IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the chart= er
> discussion at the IETf 109, I have added the comments into the propose= d
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over= CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the other.
> * EST and CMPv2 are two protocols that can be used for enrollment or c= ert
> management while addressing different cases / needs / situations -- ma= ybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only one.
> * I am not convinced that not having CMP over CoAP will not prevent it= s
> deployment and as such I prefer to have it standardized - this might b= e a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM= will
> not have a major impact on the WG progress. The work will probably inc= lude
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> wrote: >
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander <
> > = goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=E2=80=99s another input to the charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the prob= lem of
> >> authorized access to group keys and public keys of group memb= ers.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of othe= r devices
> >> not necessarily part of a security group, in the sense of sha= ring a
> >> symmetric key used to protect group messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important func= tion in
> >> constrained settings where public key certificates may not be= feasible due
> >> to the incurred overhead, e.g. for when authenticating using = EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already suppor= ted, but
> >> since the current solution is geared towards groups a differe= nt solution
> >> may be needed (although it is probably possible to reuse part= s from the
> >> existing schemes for provisioning and requesting public keys)= .
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighte= d in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = (that are not
> >> necessarily limited to constrained endpoints, though the focu= s remains on
> >> deployment ecosystems with a substantial portion of constrain= ed devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framewor= k and
> >> existing profiles thereof, and may undertake work to specify = profiles of
> >> the framework for additional secure communications protocols = *and **for
> >> additional **support services **providing* *authorized access= to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, = though the
> >> focus remains on deployment ecosystems with a substantial por= tion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=C3=B6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> wrote:<= br> > >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft= of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with rega= rd to the
> >> last paragraph related certificate management. In particular = the discussion
> >> might revive a discussion that happened in 2017 [2] - when I = was not
> >> co-chair of ACE -and considered other expired work such as [3= ]. Please make
> >> this discussion constructive on this thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate manag= ement at
> >> this stage. If the answer is yes, and we have multiple propos= als, it would
> >> be good to clarify the position of the different proposals an= d evaluate
> >> whether a selection is needed or not before validating the ch= arter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October= 30. Of
> >> course for minor edits, you may suggest them directly on the = google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoD= iptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e2237f= 51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc= 5&u=3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjS= j2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing>
> >>
> >>
> >> [2]
> >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/<= /a>
> >>
> >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/
> >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


=C2=A0

--

Daniel Migault

Ericsson



--
Daniel Migault
Ericsson
--0000000000006d03d205b5e3c053-- From nobody Mon Dec 7 10:23:04 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E0413A1649; Mon, 7 Dec 2020 10:23:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rvixzi3o3wja; Mon, 7 Dec 2020 10:23:01 -0800 (PST) Received: from mail-vs1-xe31.google.com (mail-vs1-xe31.google.com [IPv6:2607:f8b0:4864:20::e31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA2053A1402; Mon, 7 Dec 2020 10:23:00 -0800 (PST) Received: by mail-vs1-xe31.google.com with SMTP id h6so8090572vsr.6; Mon, 07 Dec 2020 10:23:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=j1pp6IGffPEr12SzP+/GRmkgseP5ECtY0t4Alb91ETo=; b=BOXno+xuIAlIOXj7whlmlZSydZYtqKJs5lVkT1M+Gb+8vPz4JYVOeww31OnShLKQVM 5lIbjshv9f1nEp09NeCofnfc7tfWxXXVvp1j+elOg630e8X19s4pUsROXHUm/0M5MyEY sRiCxpZvptI0WesC2OO51aBARDcz1YdKY5sVpbfggwL3+PMLWrpfS8uxRgQ1Di3+GLdk Lz4GpeEnMuzABn1tCOEtqj4wds1+wwdnaO5rztxHeXOMvm1GTenrWJPJIW97Ki3KaUBY 5GjvyMCthX1GyjiMe+Dqz+xtYiCjsW0Ubr0N8Q/WBFPYhCXqi60LT03VWKsIkv/kOUwO dEqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=j1pp6IGffPEr12SzP+/GRmkgseP5ECtY0t4Alb91ETo=; b=uMzkO6hcRyq0nYGKNmka3apMvj4JxdJtdCUkInk+O3RPxyb9IccAFX3XAQtxl9k2vC mHRyx7x/7kJV1YCD8YlZv0zVczKPmrMObinWXIujgnOf7vyzTvjWjWU94Mi2XUnRIszv +P7Fuha0Hm5N+wHLIk+qoOO8+BDsIyfTmfHjnZ2JrCFsFEqHeag6P+C1QIX//aMqmy4j jSSeDxJnwVkTPc2ngdKmNku1YBc7IHlyziEKVOXZjjrv6t2vNNgOK/TxMExN7+9lkOeR 3MEzX8rcvbc8hUbZXUJxClWKcdgKKm5Mof6ADtzjPSO3eQs9vpYHzyVcqz0EYWWnN3DL p/BQ== X-Gm-Message-State: AOAM5306ahsC0JDjszzQhfWLCRSGcJ7Jz/fSP68k+SlkAbGgTLo9dKsN B3wDtlI5bo2FuwqctbNn5Otk3PFUNZPdX6jpRUOpzv264Oo= X-Google-Smtp-Source: ABdhPJwK7HyDC5ftaGmWII6nvHW9TicCjlUHdFqhqTDPPtcABrbsGf0Xh1qWlp1eNrlErc7U1CVtFJAbE96iVbm0b/A= X-Received: by 2002:a05:6102:3ce:: with SMTP id n14mr3674912vsq.56.1607365379582; Mon, 07 Dec 2020 10:22:59 -0800 (PST) MIME-Version: 1.0 From: Daniel Migault Date: Mon, 7 Dec 2020 13:22:48 -0500 Message-ID: To: SPASM , anima@ietf.org, iotops@ietf.org Cc: Ace Wg Content-Type: multipart/alternative; boundary="000000000000796ddd05b5e3eac4" Archived-At: Subject: [Ace] ACE new charter X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 18:23:03 -0000 --000000000000796ddd05b5e3eac4 Content-Type: text/plain; charset="UTF-8" Hi, The ACE WG though you might be interested in knowing that the current ACE charter considers, among other things, working on CMPv2 over CoAP. The current charter can be found here [1]. If you think the work should be done in another WG, please let us know before Friday December 11, so we can move the charter forward. Yours, Daniel [1] https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing -- Daniel Migault Ericsson --000000000000796ddd05b5e3eac4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

The ACE WG though you might b= e interested in knowing that the current ACE charter considers, among other= =C2=A0things, working on CMPv2 over CoAP. The current charter can be found = here [1].=C2=A0
If you think the work should=C2=A0be done in anot= her WG, please let us know before Friday December 11, so we can move the ch= arter forward.=C2=A0

Yours,=C2=A0
Daniel=C2=A0<= /div>

=
--000000000000796ddd05b5e3eac4-- From nobody Mon Dec 7 14:10:00 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89BAB3A0B6D; Mon, 7 Dec 2020 14:09:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zj5NhsxGbsBf; Mon, 7 Dec 2020 14:09:56 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AD1D3A08A5; Mon, 7 Dec 2020 14:09:54 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 079B2389AE; Mon, 7 Dec 2020 17:12:02 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id C3tJ6VHbyshp; Mon, 7 Dec 2020 17:12:00 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 6591A389AD; Mon, 7 Dec 2020 17:12:00 -0500 (EST) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id D559F48F; Mon, 7 Dec 2020 17:09:51 -0500 (EST) From: Michael Richardson To: EMU WG , "core\@ietf.org WG \(core\@ietf.org\)" , "ace\@ietf.org" In-Reply-To: References: <20201117234700.GR39170@kduck.mit.edu> , X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2020 22:09:59 -0000 --=-=-= Content-Type: text/plain Could someone point to a use case for "EAP over CoAP" please? Is the goal to key an OSCORE context, or what? -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl/OqC8ACgkQgItw+93Q 3WXnwgf/SG6znSLD0QJqeBtDq+mimLEHlNuASPNBgFFSuZzKVrsm+Ce7uE4sRDcH 6bRnb8IEMJzI8vVxgeSwrlqXR/h8KxCVdQpl+OXW2A324I89NRLdh+5K4Ca71w+L N8GHVDDZpfOBR4H/RCBFe46a6ICGw8vZ88X902ByZRFSP/dCjYZm338IEoTLK5wI wHTlKPHQRBjIAB4BoHJ8gIhNSh+uy8ezPO0yPFWOGEgNl/NqE9QuWWzmZJYSvCEX f81PZl+WIhfhh6Bipi803+51FNTJ+bm/oY82X6NEzHFfSwnfhNLRxh/76Qa2t/Ng 2diDuzQcWZv+uW+23zLu1CaMtJlPaQ== =MZAX -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Dec 7 23:20:07 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAC763A0D41 for ; Mon, 7 Dec 2020 23:20:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.8 X-Spam-Level: X-Spam-Status: No, score=-1.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wm_-ubHCI03j for ; Mon, 7 Dec 2020 23:20:01 -0800 (PST) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80042.outbound.protection.outlook.com [40.107.8.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21B673A0D4A for ; Mon, 7 Dec 2020 23:20:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=k6FnpzSdJEIxzdEjyZs5u1njK/+HTrT7PfW9IzfrEPWkJWJf47O44dx6V60mDRzKVr6QilesNFut9Zk798bs2vQGO2nxMw4fUoOST/ld/sTpZJLEiF20bEA/LUygQDF6izHJayj8Ded6MQbsvYB2OxmJyRkArYL4fJp95iT4hwqaaRiTM2g2cPQNxryDceQuKwBBaabtSuauj3GgZ7e7lTFaaUET2K47+BPbwVklIUJCDh+oIfugw/vvBwQNVvPcazKHRP9cfXHRknn6y8ECG2IbwbHOY0UOS1UfbnbnAhqWhFAxmeScHHzUaZmS/jCO52SiaZ/LSENXSj4wNcpw1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IYZgU5PvQT0y47gw5iB1JHTzJXNt5ZHriXtWlrZvpVQ=; b=YF1Fp7LUYLvj5ynUGR8zn96WoON9JW4lDnGvBbwFg+jllffVlJUjtr3tF4jKFpyJ5eRyBm6Q4WJgBltAkVLChmOIAfxoHCqabg6mKqsSoANVGKQwlMrjre68Gbpa6+4Gwy8hwdTuBJHfBzbhAgAT7MM8wlWQRG4e7qQRZOJNiKqMvFsGEgjjFA6OadEjbbp2X6ASKbDFvzw/QetN+l1ZXKc7uuaCpgBJMaTbDHWlBED6SojTei8gNoxG7QZq/eiyV2RT9cLwiX7NvpQpT60fQVQM2jC9lGtZB5bCrmqHMhbsUjea7wYCoyoJA9TI7WNJ14A3npXVEIfTeqC6IKdYUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IYZgU5PvQT0y47gw5iB1JHTzJXNt5ZHriXtWlrZvpVQ=; b=kFyKcF3uD6L48ZdASdxTP3KpTuJ4qzASfLzf1AG0HDvNx3sPcTQHh9i/gm5FaJXr/9Uz12JivH/QYjiZOClw6Yy1qx0h9YwLwKreLrY5NhfRkV5ZmgCBybXnghvMYu6JJfQBcBsk/r1v4rAPInvbJFu999QM3Tk0DP2GO0QsAQM= Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM0PR10MB2004.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:46::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.18; Tue, 8 Dec 2020 07:19:58 +0000 Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::a5a7:8af9:1e22:1d69]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::a5a7:8af9:1e22:1d69%6]) with mapi id 15.20.3632.023; Tue, 8 Dec 2020 07:19:58 +0000 From: "Brockhaus, Hendrik" To: Daniel Migault CC: Benjamin Kaduk , Ace Wg Thread-Topic: [Ace] Charter discussion Thread-Index: AQHWoxtjVCYB49eUE0iMxKcy60l0NanGXF0AgAbIxICAAAQaAIAACHAAgB7GAACAADZ9oIAAFEaAgADcMbA= Date: Tue, 8 Dec 2020 07:19:57 +0000 Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-12-08T07:19:57Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=80e8e088-aa60-4c1c-b0a6-12347c0bebf5; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0 document_confidentiality: Restricted authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=siemens.com; x-originating-ip: [165.225.200.170] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: e5cb1ee8-8910-42e1-8ba0-08d89b49ab54 x-ms-traffictypediagnostic: AM0PR10MB2004: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 50zniRmU89+S08B4mTnY3R18NZOFRD4Dr2853DPqajrzG7nP6ePWz6O9KbvlHfAQ4O2Dte8csHc37sdQVZ77LImEMAal5VUobvh/60Eua9MIoW2ir/8v4qlEyJyZQ663Xnp1yB4HYHQc/dtq6akMD1wmyPPNNBc7UMzWTrRcFujyOaYpbf7Nv6arhBJ5uHhwxtofLOgK7GOir389GaNRfItlKWzGtQA6RoQ7/t1PfiGr6K6TLWE5LLKhjcv4GiQj5xnhQ8fv6mk2kP2rhivcMI8pcIZvYckgS6CsZHDlLJSg9R3ZDl+CVo5ZCtWkLluH9OM/3vPPjkjX54LffROte38mDdX28FJfv0NRlG5sHjVFXvkHB21QO0f3selk+VkMVmQB8O9SuYZiK9EusbthUA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(366004)(346002)(376002)(136003)(2906002)(7696005)(76116006)(66476007)(55236004)(4001150100001)(9686003)(71200400001)(6506007)(186003)(53546011)(64756008)(26005)(166002)(33656002)(8676002)(66446008)(66946007)(508600001)(6916009)(8936002)(966005)(4326008)(5660300002)(86362001)(54906003)(52536014)(66556008)(66574015)(55016002)(83380400001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?bUJROVBzRHRhaUZqRGZvdVZScE1rQlUwUSt3dGJkMmdaMEFWWHZ2TXhXRitt?= =?utf-8?B?RHhQUGlmemVnaDhDdTRGb0pSZ1YwUnd4U2wzQ1g0dERQaWxoMzdncUtrSTNo?= =?utf-8?B?b1FWbWJqd0pFYXRpZEx4cFNLL0M1WG5qT00xNEpmMFNBQ05LOEk1VXFsdWt5?= =?utf-8?B?TFN5QUtaT0xxYnJaSFVHN21WOW41dHpwZ1JBRXQrNW90U1BOU3dHa3ZSSEdp?= =?utf-8?B?elpaSlpFbndGRTlOMU4xSHRsUEM1RVEzNHZrZWdyVkU1dkVSd1lOSzN2RTJF?= =?utf-8?B?MTRNbW9rT1JJaFNRZFhCOXQzUFFjbnRxd21tTytEamlQL0RvNHhBRUl2SGtn?= =?utf-8?B?T0tPUGhwWFBqMHRSYkZQeU5kUXdwOFo1ckt4c0tGMHBxenJtclNPSmVyMEh4?= =?utf-8?B?S1ZWTmNKTURtTnNEQU5LdHpIdm9zWnZpUDZkekRVSDNIcGZISzJ4VUpGYzJI?= =?utf-8?B?LzhoQ3dwQ3FEZGhGZWlNcFVoTit6aS9ZMTQyaFBLY0pTVWJWditwZkpFNUVK?= =?utf-8?B?V1B5VG1TRUpCam9XUnFUVXlzRzNqRk14b2tGcjhuVXQzYndsTkNWRlFnTDQ2?= =?utf-8?B?SldCcEZEN3hGQXFLK1hSNWNyS3Rud2lob0dwYTRIZzZMUjFpMUliWTQ5aGpP?= =?utf-8?B?d1IwaUpRUFp4T3RNUmxNcm5jdGxtOGg0aDVLUER2Q01ic2hkYk9mTldieUxD?= =?utf-8?B?cEdRcXZOZXNZejA5VnFXSm5sOS9mdmU5Sm1oeGtwZzNaaFRJM29NakI5QmdI?= =?utf-8?B?eDRpVjNxdXliVG9IOHpGb1U3SnBSa1plcS9BeGVPU3drcjBVd3d4eW00S3FJ?= =?utf-8?B?T2VVdGJwMTc3aTBOVWxQaEtQaloyZ2swdFplanMraVdVellYSEh4Wld0R0tR?= =?utf-8?B?dWtEZk53UnpYeEY0VEN0cmRXWDNHMG5IblF0NVN4WHhPVVNLMHZzNzBjRitV?= =?utf-8?B?WkM3UUlMY09mYmJwN0s2ZTNkUlRCRm1yREpGOGhBSFBTZFhOcllLbGJBN1gw?= =?utf-8?B?cW04WDBDQllzRDRwUUdqWi9nSUNKQ3d1L3htUS8vZHdhVExSOEUxbXNmdkRD?= =?utf-8?B?SVFYd0VyZk9tVG1vYkg5ZnB5MENsYmNCbHJ2VFVUVTVpVmI0OUNlMUJpcTFF?= =?utf-8?B?eXJuVDJHMUZONFlMSS9teGR0OE03UHdERzRiWTdFdXlXYjhZRGl5ZEdjeW5r?= =?utf-8?B?ZTI2cDJwRGxBb0JoN2RVMDI4S1hhaDhqSHo3Z05GZWE3YXFVZlZnWUJjRDZo?= =?utf-8?B?NThJbWNHYVY0Wm8yZisyMlhlcC9EUVhoeFZwR2x0SDV5d3NEVjlMWVV3bUNk?= =?utf-8?Q?RF68tC3Jnkt0b+upk3cZ3mheVDGZ2KIDyY?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_AM0PR10MB2418717998D1976E290A7461FECD0AM0PR10MB2418EURP_" MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: e5cb1ee8-8910-42e1-8ba0-08d89b49ab54 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Dec 2020 07:19:58.0998 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: EAOkZwTWw+JyO8h8Du+zAICLRZhdRgLxtRQGc9XEO1SZpPXQF2ejIarC96lcPdjJDtpQLjKdsSIy+0oT18rDqNOUjsZft4KgfFjXkdpI9Fs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB2004 Archived-At: Subject: Re: [Ace] Charter discussion X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 07:20:05 -0000 --_000_AM0PR10MB2418717998D1976E290A7461FECD0AM0PR10MB2418EURP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmsgeW91IERhbmllbCBmb3IgdGhlIGNsYXJpZmljYXRpb24uDQpIZW5kcmlrDQoNClZvbjog RGFuaWVsIE1pZ2F1bHQgPG1nbHQuaWV0ZkBnbWFpbC5jb20+DQpHZXNlbmRldDogTW9udGFnLCA3 LiBEZXplbWJlciAyMDIwIDE5OjExDQpBbjogQnJvY2toYXVzLCBIZW5kcmlrIChUIFJEQSBDU1Qg U0VBLURFKSA8aGVuZHJpay5icm9ja2hhdXNAc2llbWVucy5jb20+DQpDYzogQmVuamFtaW4gS2Fk dWsgPGthZHVrQG1pdC5lZHU+OyBBY2UgV2cgPGFjZUBpZXRmLm9yZz4NCkJldHJlZmY6IFJlOiBb QWNlXSBDaGFydGVyIGRpc2N1c3Npb24NCg0KVGhhbmtzLCBJIHdhcyBhYm91dCBqdXN0IHNlbmRp bmcgdGhlbSBhIG5vdGUsIGJ1dCB0aGF0IGlzIG1heWJlIG5vdCBuZWVkZWQuIEp1c3QgZm9yIHlv dXIgaW5mb3JtYXRpb24sIHRoZSBub3RlIGlzIG5vdCBwYXJ0IG9mIHRoZSBjaGFydGVyLCBidXQg dG8gb3VyIEFEL0lFU0cuDQpZb3VycywgRGFuaWVsDQoNCk9uIE1vbiwgRGVjIDcsIDIwMjAgYXQg MTI6MDUgUE0gQnJvY2toYXVzLCBIZW5kcmlrIDxoZW5kcmlrLmJyb2NraGF1c0BzaWVtZW5zLmNv bTxtYWlsdG86aGVuZHJpay5icm9ja2hhdXNAc2llbWVucy5jb20+PiB3cm90ZToNCkFzIHRoZSBD TVBvdmVyQ29BUCBkcmFmdCB3YXMgYWxyZWFkeSBkaXNjdXNzZWQgaW4gTEFNUFMgYW5kIEppbSBz dWdnZXN0ZWQgdG8gY29uc2lkZXIgaXQgaW4gQUNFLCBJIHN1Z2dlc3QgdG8gZHJvcCB0aGUgTm90 ZSBhbmQgY29tZSBiYWNrIHRvIGEgY2xlYXIgc3RhdGVtZW50IGFzIGRpc2N1c3NlZCBhdCBJRVRG MTA5Lg0KDQpEaXNjdXNzaW9uIG9uIHRoZSBMQU1QUyBNYWlsaW5nIExpc3QgZnJvbSBKdW5lOg0K aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9zcGFzbS91eVlDZjVzTWN4ZzZ4 b1FGY2JlMXNQeHFWTHcvPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9v ay5jb20vP3VybD1odHRwcyUzQSUyRiUyRm1haWxhcmNoaXZlLmlldGYub3JnJTJGYXJjaCUyRm1z ZyUyRnNwYXNtJTJGdXlZQ2Y1c01jeGc2eG9RRmNiZTFzUHhxVkx3JTJGJmRhdGE9MDQlN0MwMSU3 Q2hlbmRyaWsuYnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NmYzQ5NTg1N2JjZDc0YWZjNWRhMjA4 ZDg5YWRiN2U3ZiU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0OTVkNTVhJTdDMSU3QzAlN0M2 Mzc0Mjk2MTQ3OTIyMDU0ODglN0NVbmtub3duJTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpB d01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTNEJTdDMTAw MCZzZGF0YT16Y1NhQ3RmZkRIdHdWZTBDM09aYnNjRkhDa3RiT2lwNmRLbDkwWVBGTUZVJTNEJnJl c2VydmVkPTA+DQoNCkhlbmRyaWsNCg0KVm9uOiBBY2UgPGFjZS1ib3VuY2VzQGlldGYub3JnPG1h aWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZz4+IEltIEF1ZnRyYWcgdm9uIERhbmllbCBNaWdhdWx0 DQpHZXNlbmRldDogTW9udGFnLCA3LiBEZXplbWJlciAyMDIwIDE0OjQzDQpBbjogQmVuamFtaW4g S2FkdWsgPGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+Pg0KQ2M6IEFjZSBXZyA8 YWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+Pg0KQmV0cmVmZjogUmU6IFtBY2VdIENo YXJ0ZXIgZGlzY3Vzc2lvbg0KDQpIaSwNCg0KUGxlYXNlIGhhdmUgYSBsb29rIGF0IHRoZSBsYXRl c3QgdmVyc2lvbiBvZiB0aGUgY2hhcnRlciBiZWZvcmUgd2UgbW92ZSBpdCBmb3J3YXJkIGJ5IHRo ZSBlbmQgb2YgdGhlIHdlZWsgLSBEZWNlbWJlciAxMS4NCg0KSSBhZGRlZCBhIG5vdGUgb24gcG90 ZW50aWFsIFdHIHRoYXQgY291bGQgaG9zdCB0aGUgQ01QdjIgb3ZlciBDb0FQIC0gZXZlbnR1YWxs eS4gSSBhbSB3b25kZXJpbmcgaWYgd2Ugc2hvdWxkIHB1dCBhIG5vdGUgdG8gdGhlc2UgV0dzLg0K DQpZb3VycywNCkRhbmllbA0KDQoNClRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlv biBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIChhY2UpIFdHIGhhcyBkZWZpbmVkIGEgc3Rh bmRhcmRpemVkIHNvbHV0aW9uIGZyYW1ld29yayBmb3IgYXV0aGVudGljYXRpb24gYW5kIGF1dGhv cml6YXRpb24gdG8gZW5hYmxlIGF1dGhvcml6ZWQgYWNjZXNzIHRvIHJlc291cmNlcyBpZGVudGlm aWVkIGJ5IGEgVVJJIGFuZCBob3N0ZWQgb24gYSByZXNvdXJjZSBzZXJ2ZXIgaW4gY29uc3RyYWlu ZWQgZW52aXJvbm1lbnRzLg0KDQpUaGUgYWNjZXNzIHRvIHRoZSByZXNvdXJjZSBpcyBtZWRpYXRl ZCBieSBhbiBhdXRob3JpemF0aW9uIHNlcnZlciwgd2hpY2ggaXMgbm90IGNvbnNpZGVyZWQgdG8g YmUgY29uc3RyYWluZWQuDQoNCg0KUHJvZmlsZXMgb2YgdGhpcyBmcmFtZXdvcmsgZm9yIGFwcGxp Y2F0aW9uIHRvIHNlY3VyaXR5IHByb3RvY29scyBjb21tb25seSB1c2VkIGluIGNvbnN0cmFpbmVk IGVudmlyb25tZW50cywgaW5jbHVkaW5nIENvQVArRFRMUyBhbmQgQ29BUCtPU0NPUkUsIGhhdmUg YWxzbyBiZWVuIHN0YW5kYXJkaXplZC4gIFRoZSBXb3JraW5nIEdyb3VwIGlzIGNoYXJnZWQgd2l0 aCBtYWludGVuYW5jZSBvZiB0aGUgZnJhbWV3b3JrIGFuZCBleGlzdGluZyBwcm9maWxlcyB0aGVy ZW9mLCBhbmQgbWF5IHVuZGVydGFrZSB3b3JrIHRvIHNwZWNpZnkgcHJvZmlsZXMgb2YgdGhlIGZy YW1ld29yayBmb3IgYWRkaXRpb25hbCBzZWN1cmUgY29tbXVuaWNhdGlvbnMgcHJvdG9jb2xzIGFu ZCBmb3IgYWRkaXRpb25hbCBzdXBwb3J0IHNlcnZpY2VzIHByb3ZpZGluZyBhdXRob3JpemVkIGFj Y2VzcyB0byBjcnlwdG8ga2V5cyAodGhhdCBhcmUgbm90IG5lY2Vzc2FyaWx5IGxpbWl0ZWQgdG8g Y29uc3RyYWluZWQgZW5kcG9pbnRzLCB0aG91Z2ggdGhlIGZvY3VzIHJlbWFpbnMgb24gZGVwbG95 bWVudCBpbiBlY29zeXN0ZW1zIHdpdGggYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mIGNvbnN0cmFp bmVkIGRldmljZXMpLg0KDQoNCkluIGFkZGl0aW9uIHRvIHRoZSBvbmdvaW5nIG1haW50ZW5hbmNl IHdvcmssIHRoZSBXb3JraW5nIEdyb3VwIHdpbGwgZXh0ZW5kIHRoZSBmcmFtZXdvcmsgYXMgbmVl ZGVkIGZvciBhcHBsaWNhYmlsaXR5IHRvIGdyb3VwIGNvbW11bmljYXRpb25zLCB3aXRoIGluaXRp YWwgZm9jdXMgb24gKEQpVExTIGFuZCAoR3JvdXApIE9TQ09SRSBhcyB0aGUgdW5kZXJseWluZyBn cm91cCBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IHByb3RvY29scy4gVGhlIFdvcmtpbmcgR3JvdXAg d2lsbCBzdGFuZGFyZGl6ZSBwcm9jZWR1cmVzIGZvciByZXF1ZXN0aW5nIGFuZCBkaXN0cmlidXRp bmcgZ3JvdXAga2V5aW5nIG1hdGVyaWFsIHVzaW5nIHRoZSBBQ0UgZnJhbWV3b3JrIGFzIHdlbGwg YXMgYXBwcm9wcmlhdGVkIG1hbmFnZW1lbnQgaW50ZXJmYWNlcy4NCg0KDQpUaGUgV29ya2luZyBH cm91cCB3aWxsIHN0YW5kYXJkaXplIGEgZm9ybWF0IGZvciBleHByZXNzaW5nIGF1dGhvcml6YXRp b24gaW5mb3JtYXRpb24gZm9yIGEgZ2l2ZW4gYXV0aGVudGljYXRlZCBwcmluY2lwYWwgYXMgcmVj ZWl2ZWQgZnJvbSBhbiBhdXRob3JpemF0aW9uIG1hbmFnZXIuDQoNCg0KVGhlIFdvcmtpbmcgR3Jv dXAgd2lsbCBleGFtaW5lIGhvdyB0byB1c2UgQ29uc3RyYWluZWQgQXBwbGljYXRpb24gUHJvdG9j b2wgKENvQVApIGFzIGEgdHJhbnNwb3J0IG1lZGl1bSBmb3IgY2VydGlmaWNhdGUgZW5yb2xsbWVu dCBwcm90b2NvbHMsIHN1Y2ggYXMgRVNUIGFuZCBDTVB2MiwgYXMgd2VsbCBhcyBhIHRyYW5zcG9y dCBmb3IgYXV0aGVudGljYXRpb24gcHJvdG9jb2xzIHN1Y2ggYXMgRUFQLCBhbmQgc3RhbmRhcmRp emUgYXMgbmVlZGVkLiBbTm90ZSB0aGF0IENNUHYyIHdvcmsgbWF5IGFsc28gYmUgaG9zdGVkIGlu IExBTVBTICh3aGljaCByZXZpc2l0cyBDTVB2MiksIEFOSU1BICggd2hpY2ggZGVmaW5lcyBDTVB2 MiBhcyBhbiBhbHRlcm5hdGl2ZSB0byBFU1QpIG9yIElPVFBTLiBFQVAgd29yayBoYXMgYmVlbiBj b29yZGluYXRlZCB3aXRoIEVNVS4gSW4gYW55IGNhc2UsIGlmIHRoZSB3b3JrIGlzIGJlaW5nIGNv bnNpZGVyZWQgaW4gQUNFLCB3ZSB3aWxsIG1ha2Ugc3VyZSB0aGUgY29ycmVzcG9uZGluZyBXRyB3 aWxsIGZvbGxvdyB0aGUgcHJvZ3Jlc3MuXQ0KDQoNCg0KDQoNCg0KT24gVHVlLCBOb3YgMTcsIDIw MjAgYXQgNjo0NyBQTSBCZW5qYW1pbiBLYWR1ayA8a2FkdWtAbWl0LmVkdTxtYWlsdG86a2FkdWtA bWl0LmVkdT4+IHdyb3RlOg0KVGhhbmtzIGZvciB1cGRhdGluZyB0aGUgZHJhZnQgY2hhcnRlciBh dCBbMV0sIERhbmllbCENCg0KSSBub3RlIHRoYXQgTWljaGFlbCByYWlzZWQgdGhlIHF1ZXN0aW9u IG9mIHdoZXRoZXIgc29tZSBvdGhlciBncm91cCBtaWdodA0KYWxzbyBiZSBpbnRlcmVzdGVkIGlu IHdvcmtpbmcgb24gQ01QLW92ZXItY29hcCwgc28gdGhlIElFU0cgd2lsbCBiZSBzdXJlIHRvDQpk aXNjdXNzIHRoYXQgaWYgQ01QIGlzIHN0aWxsIGluIHRoZSBkcmFmdCBBQ0UgY2hhcnRlciB3aGVu IGl0IGdvZXMgdG8gdGhlDQpJRVNHIGZvciByZXZpZXcuDQoNCi1CZW4NCg0KT24gVHVlLCBOb3Yg MTcsIDIwMjAgYXQgMDY6MTY6NDhQTSAtMDUwMCwgRGFuaWVsIE1pZ2F1bHQgd3JvdGU6DQo+IFRo YW5rIHlvdSBhbGwgZm9yIHRoZSBmZWVkIGJhY2tzLiBGb3IgdGhlIHB1cnBvc2Ugb2YgZHJpdmlu ZyB0aGUgY2hhcnRlcg0KPiBkaXNjdXNzaW9uIGF0IHRoZSBJRVRmIDEwOSwgSSBoYXZlIGFkZGVk IHRoZSBjb21tZW50cyBpbnRvIHRoZSBwcm9wb3NlZA0KPiB0ZXh0IFsxXS4NCj4NCj4gTXkgY3Vy cmVudCB1bmRlcnN0YW5kaW5nIGlzIHRoYXQgaXQgc2VlbXMgYmVuZWZpY2lhbCB0byBhZGQgQ01Q djIgb3ZlciBDb0FQDQo+IGluIHRoZSBjaGFydGVyLiBJIGFtIGhhcHB5IHRvIGJlIGNvbnRyYWRp Y3RlZC4NCj4gKiBJIGhhdmUgbm90IHNlZW4gYSBjbGVhciBjdXQgdG8gZG8gb25lIG9yIHRoZSBv dGhlci4NCj4gKiBFU1QgYW5kIENNUHYyIGFyZSB0d28gcHJvdG9jb2xzIHRoYXQgY2FuIGJlIHVz ZWQgZm9yIGVucm9sbG1lbnQgb3IgY2VydA0KPiBtYW5hZ2VtZW50IHdoaWxlIGFkZHJlc3Npbmcg ZGlmZmVyZW50IGNhc2VzIC8gbmVlZHMgLyBzaXR1YXRpb25zIC0tIG1heWJlDQo+IHdlIGNhbiBj bGFyaWZ5IHRoYXQgcG9pbnQuIEkgY2FuIHNlZSBsZXZlcmFnaW5nIHRoZSBleGlzdGluZyBDTVAN Cj4gaW5mcmFzdHJ1Y3R1cmUsIGJ1dCBpdCBzZWVtcyB0aGF0IGlzIG5vdCB0aGUgb25seSBvbmUu DQo+ICogSSBhbSBub3QgY29udmluY2VkIHRoYXQgbm90IGhhdmluZyBDTVAgb3ZlciBDb0FQIHdp bGwgbm90IHByZXZlbnQgaXRzDQo+IGRlcGxveW1lbnQgYW5kIGFzIHN1Y2ggSSBwcmVmZXIgdG8g aGF2ZSBpdCBzdGFuZGFyZGl6ZWQgLSB0aGlzIG1pZ2h0IGJlIGENCj4gcGVyc29uYWwgdGhvdWdo dC4NCj4gKiBBZGRpbmcgYW55IHBpZWNlIG9mIHdvcmsgcmVxdWlyZSBjeWNsZXMsIGJ1dCBpdCBz ZWVtcyB0byBtZSB0aGF0IENQTSB3aWxsDQo+IG5vdCBoYXZlIGEgbWFqb3IgaW1wYWN0IG9uIHRo ZSBXRyBwcm9ncmVzcy4gVGhlIHdvcmsgd2lsbCBwcm9iYWJseSBpbmNsdWRlDQo+IG90aGVyIFdH IHN1Y2ggYSBMQU1QUy4NCj4NCj4gWW91cnMsDQo+IERhbmllbA0KPg0KPiBbMV0NCj4gaHR0cHM6 Ly9kb2NzLmdvb2dsZS5jb20vZG9jdW1lbnQvZC8xUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1 QndQTTJCbkJYaG9EaXB0WS9lZGl0P3VzcD1zaGFyaW5nPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmRvY3MuZ29vZ2xlLmNv bSUyRmRvY3VtZW50JTJGZCUyRjFSdHhVU3ZVZUJkWldvUWtqU2oyYzNEdFI4RHVCd1BNMkJuQlho b0RpcHRZJTJGZWRpdCUzRnVzcCUzRHNoYXJpbmcmZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9j a2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2ZjNDk1ODU3YmNkNzRhZmM1ZGEyMDhkODlhZGI3ZTdmJTdD MzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMCU3QzYzNzQyOTYxNDc5MjIx NTQ4MSU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9p VjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0MxMDAwJnNkYXRhPXNSZXRJ YUNSVUkyNFVpOEJ2NzhBRDllYUVGQ0IlMkJOQzVwTUdEcEVWTG5PZyUzRCZyZXNlcnZlZD0wPg0K Pg0KPiBPbiBUdWUsIE5vdiAxNywgMjAyMCBhdCA2OjAyIFBNIERhbmllbCBNaWdhdWx0IDxtZ2x0 LmlldGZAZ21haWwuY29tPG1haWx0bzptZ2x0LmlldGZAZ21haWwuY29tPj4gd3JvdGU6DQo+DQo+ ID4gSGkgR29yYW4sDQo+ID4NCj4gPiBJIGFkZGVkIHRoZSB0ZXh0IHRvIHRoZSBjaGFydGVyIHdl IHdpbGwgZGlzY3VzcyBsYXRlci4NCj4gPg0KPiA+IFlvdXJzLA0KPiA+IERhbmllbA0KPiA+DQo+ ID4gT24gRnJpLCBOb3YgMTMsIDIwMjAgYXQgMTA6MjYgQU0gR8O2cmFuIFNlbGFuZGVyIDwNCj4g PiBnb3Jhbi5zZWxhbmRlckBlcmljc3Nvbi5jb208bWFpbHRvOmdvcmFuLnNlbGFuZGVyQGVyaWNz c29uLmNvbT4+IHdyb3RlOg0KPiA+DQo+ID4+IEhpIERhbmllbCwNCj4gPj4NCj4gPj4NCj4gPj4N Cj4gPj4gSGVyZeKAmXMgYW5vdGhlciBpbnB1dCB0byB0aGUgY2hhcnRlci4NCj4gPj4NCj4gPj4N Cj4gPj4NCj4gPj4gVGhlIGN1cnJlbnQgZ3JvdXAga2V5IG1hbmFnZW1lbnQgc29sdXRpb25zIGFk ZHJlc3NlcyB0aGUgcHJvYmxlbSBvZg0KPiA+PiBhdXRob3JpemVkIGFjY2VzcyB0byBncm91cCBr ZXlzIGFuZCBwdWJsaWMga2V5cyBvZiBncm91cCBtZW1iZXJzLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0K PiA+PiBBIHJlbGF0ZWQgcHJvYmxlbSBpcyBhdXRob3JpemVkIGFjY2VzcyBvZiBwdWJsaWMga2V5 cyBvZiBvdGhlciBkZXZpY2VzDQo+ID4+IG5vdCBuZWNlc3NhcmlseSBwYXJ0IG9mIGEgc2VjdXJp dHkgZ3JvdXAsIGluIHRoZSBzZW5zZSBvZiBzaGFyaW5nIGENCj4gPj4gc3ltbWV0cmljIGtleSB1 c2VkIHRvIHByb3RlY3QgZ3JvdXAgbWVzc2FnZXMuDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+IEF1 dGhvcml6ZWQgYWNjZXNzIHRvIHJhdyBwdWJsaWMga2V5cyBzZXJ2ZXMgYW4gaW1wb3J0YW50IGZ1 bmN0aW9uIGluDQo+ID4+IGNvbnN0cmFpbmVkIHNldHRpbmdzIHdoZXJlIHB1YmxpYyBrZXkgY2Vy dGlmaWNhdGVzIG1heSBub3QgYmUgZmVhc2libGUgZHVlDQo+ID4+IHRvIHRoZSBpbmN1cnJlZCBv dmVyaGVhZCwgZS5nLiBmb3Igd2hlbiBhdXRoZW50aWNhdGluZyB1c2luZyBFREhPQw0KPiA+PiAo ZHJhZnQtaWV0Zi1sYWtlLWVkaG9jKS4NCj4gPj4NCj4gPj4gVGhpcyBmdW5jdGlvbmFsaXR5IGlz IHRodXMgYSBzdWJzZXQgb2Ygd2hhdCBpcyBhbHJlYWR5IHN1cHBvcnRlZCwgYnV0DQo+ID4+IHNp bmNlIHRoZSBjdXJyZW50IHNvbHV0aW9uIGlzIGdlYXJlZCB0b3dhcmRzIGdyb3VwcyBhIGRpZmZl cmVudCBzb2x1dGlvbg0KPiA+PiBtYXkgYmUgbmVlZGVkIChhbHRob3VnaCBpdCBpcyBwcm9iYWJs eSBwb3NzaWJsZSB0byByZXVzZSBwYXJ0cyBmcm9tIHRoZQ0KPiA+PiBleGlzdGluZyBzY2hlbWVz IGZvciBwcm92aXNpb25pbmcgYW5kIHJlcXVlc3RpbmcgcHVibGljIGtleXMpLg0KPiA+Pg0KPiA+ Pg0KPiA+Pg0KPiA+PiBXaXRoIHRoaXMgaW4gbWluZCwgSSBwcm9wb3NlIHRoZSBmb2xsb3dpbmcg Y2hhbmdlIChoaWdobGlnaHRlZCBpbg0KPiA+PiBib2xkZmFjZSBiZWxvdyk6DQo+ID4+DQo+ID4+ DQo+ID4+DQo+ID4+IE9MRA0KPiA+Pg0KPiA+PiBUaGUgV29ya2luZyBHcm91cCBpcyBjaGFyZ2Vk IHdpdGggbWFpbnRlbmFuY2Ugb2YgdGhlIGZyYW1ld29yayBhbmQNCj4gPj4gZXhpc3RpbmcgcHJv ZmlsZXMgdGhlcmVvZiwgYW5kIG1heSB1bmRlcnRha2Ugd29yayB0byBzcGVjaWZ5IHByb2ZpbGVz IG9mDQo+ID4+IHRoZSBmcmFtZXdvcmsgZm9yIGFkZGl0aW9uYWwgc2VjdXJlIGNvbW11bmljYXRp b25zIHByb3RvY29scyAodGhhdCBhcmUgbm90DQo+ID4+IG5lY2Vzc2FyaWx5IGxpbWl0ZWQgdG8g Y29uc3RyYWluZWQgZW5kcG9pbnRzLCB0aG91Z2ggdGhlIGZvY3VzIHJlbWFpbnMgb24NCj4gPj4g ZGVwbG95bWVudCBlY29zeXN0ZW1zIHdpdGggYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mIGNvbnN0 cmFpbmVkIGRldmljZXMpLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+PiBORVcNCj4gPj4NCj4gPj4g VGhlIFdvcmtpbmcgR3JvdXAgaXMgY2hhcmdlZCB3aXRoIG1haW50ZW5hbmNlIG9mIHRoZSBmcmFt ZXdvcmsgYW5kDQo+ID4+IGV4aXN0aW5nIHByb2ZpbGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0 YWtlIHdvcmsgdG8gc3BlY2lmeSBwcm9maWxlcyBvZg0KPiA+PiB0aGUgZnJhbWV3b3JrIGZvciBh ZGRpdGlvbmFsIHNlY3VyZSBjb21tdW5pY2F0aW9ucyBwcm90b2NvbHMgKmFuZCAqKmZvcg0KPiA+ PiBhZGRpdGlvbmFsICoqc3VwcG9ydCBzZXJ2aWNlcyAqKnByb3ZpZGluZyogKmF1dGhvcml6ZWQg YWNjZXNzIHRvIGNyeXB0byogKmtleXMNCj4gPj4gKih0aGF0IGFyZSBub3QgbmVjZXNzYXJpbHkg bGltaXRlZCB0byBjb25zdHJhaW5lZCBlbmRwb2ludHMsIHRob3VnaCB0aGUNCj4gPj4gZm9jdXMg cmVtYWlucyBvbiBkZXBsb3ltZW50IGVjb3N5c3RlbXMgd2l0aCBhIHN1YnN0YW50aWFsIHBvcnRp b24gb2YNCj4gPj4gY29uc3RyYWluZWQgZGV2aWNlcykuDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+ IEfDtnJhbg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+Pg0KPiA+PiBP biAyMDIwLTEwLTE1LCAxOTo1MCwgIkFjZSIgPGFjZS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzph Y2UtYm91bmNlc0BpZXRmLm9yZz4+IHdyb3RlOg0KPiA+Pg0KPiA+PiBIaSwNCj4gPj4NCj4gPj4g SSB3b3VsZCBsaWtlIHRvIHN0YXJ0IHRoZSBjaGFydGVyIGRpc2N1c3Npb24uIEhlcmUgaXMgYSBk cmFmdCBvZiBhDQo+ID4+IHByb3Bvc2VkIGNoYXJ0ZXIgWzFdLg0KPiA+Pg0KPiA+Pg0KPiA+Pg0K PiA+PiBJdCBzZWVtcyB0byBiZSB0aGF0IGFkZGl0aW9uYWwgZGlzY3Vzc2lvbiBpcyBuZWVkZWQg d2l0aCByZWdhcmQgdG8gdGhlDQo+ID4+IGxhc3QgcGFyYWdyYXBoIHJlbGF0ZWQgY2VydGlmaWNh dGUgbWFuYWdlbWVudC4gSW4gcGFydGljdWxhciB0aGUgZGlzY3Vzc2lvbg0KPiA+PiBtaWdodCBy ZXZpdmUgYSBkaXNjdXNzaW9uIHRoYXQgaGFwcGVuZWQgaW4gMjAxNyBbMl0gLSB3aGVuIEkgd2Fz IG5vdA0KPiA+PiBjby1jaGFpciBvZiBBQ0UgLWFuZCBjb25zaWRlcmVkIG90aGVyIGV4cGlyZWQg d29yayBzdWNoIGFzIFszXS4gUGxlYXNlIG1ha2UNCj4gPj4gdGhpcyBkaXNjdXNzaW9uIGNvbnN0 cnVjdGl2ZSBvbiB0aGlzIHRocmVhZC4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4gVGhlIGZ1bmRh bWVudGFsIHF1ZXN0aW9uIGlzIHdoZXRoZXIgd2UgbmVlZCBjZXJ0aWZpY2F0ZSBtYW5hZ2VtZW50 IGF0DQo+ID4+IHRoaXMgc3RhZ2UuIElmIHRoZSBhbnN3ZXIgaXMgeWVzLCBhbmQgd2UgaGF2ZSBt dWx0aXBsZSBwcm9wb3NhbHMsIGl0IHdvdWxkDQo+ID4+IGJlIGdvb2QgdG8gY2xhcmlmeSB0aGUg cG9zaXRpb24gb2YgdGhlIGRpZmZlcmVudCBwcm9wb3NhbHMgYW5kIGV2YWx1YXRlDQo+ID4+IHdo ZXRoZXIgYSBzZWxlY3Rpb24gaXMgbmVlZGVkIG9yIG5vdCBiZWZvcmUgdmFsaWRhdGluZyB0aGUg Y2hhcnRlci4NCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4gUGxlYXNlIHByb3ZpZGUgeW91ciBpbnB1 dHMgb24gdGhlIG1haWxpbmcgbGlzdCBiZWZvcmUgT2N0b2JlciAzMC4gT2YNCj4gPj4gY291cnNl IGZvciBtaW5vciBlZGl0cywgeW91IG1heSBzdWdnZXN0IHRoZW0gZGlyZWN0bHkgb24gdGhlIGdv b2dsZSBkb2MuDQo+ID4+DQo+ID4+DQo+ID4+DQo+ID4+IFlvdXJzLA0KPiA+Pg0KPiA+PiBEYW5p ZWwNCj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4gWzFdDQo+ID4+IGh0dHBzOi8vZG9jcy5nb29nbGUu Y29tL2RvY3VtZW50L2QvMVJ0eFVTdlVlQmRaV29Ra2pTajJjM0R0UjhEdUJ3UE0yQm5CWGhvRGlw dFkvZWRpdD91c3A9c2hhcmluZzxodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZkb2NzLmdvb2dsZS5jb20lMkZkb2N1bWVudCUy RmQlMkYxUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WSUyRmVkaXQl M0Z1c3AlM0RzaGFyaW5nJmRhdGE9MDQlN0MwMSU3Q2hlbmRyaWsuYnJvY2toYXVzJTQwc2llbWVu cy5jb20lN0NmYzQ5NTg1N2JjZDc0YWZjNWRhMjA4ZDg5YWRiN2U3ZiU3QzM4YWUzYmNkOTU3OTRm ZDRhZGRhYjQyZTE0OTVkNTVhJTdDMSU3QzAlN0M2Mzc0Mjk2MTQ3OTIyMjU0NzQlN0NVbmtub3du JTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRp STZJazFoYVd3aUxDSlhWQ0k2TW4wJTNEJTdDMTAwMCZzZGF0YT0lMkJraHJCVnNOMHBYdHVxY3ZY V2pCanBESllUZTZmN0pjTUklMkZjTzN6NmZPZyUzRCZyZXNlcnZlZD0wPg0KPiA+PiA8DQo+ID4+ IGh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdjEvdXJsP2s9NGYzZDljM2ItMTE4YzQ3NWIt NGYzZGRjYTAtODZlMjIzN2Y1MWZiLTYyN2U0OGIwNjk0NjJkNzAmcT0xJmU9NjkyNGIyYTYtZTdl NS00ZWMxLWExYWYtYzk0NjM3OTUzZGM1JnU9aHR0cHMlM0ElMkYlMkZkb2NzLmdvb2dsZS5jb20l MkZkb2N1bWVudCUyRmQlMkYxUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9E aXB0WSUyRmVkaXQlM0Z1c3AlM0RzaGFyaW5nPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnByb3RlY3QyLmZpcmVleWUuY29t JTJGdjElMkZ1cmwlM0ZrJTNENGYzZDljM2ItMTE4YzQ3NWItNGYzZGRjYTAtODZlMjIzN2Y1MWZi LTYyN2U0OGIwNjk0NjJkNzAlMjZxJTNEMSUyNmUlM0Q2OTI0YjJhNi1lN2U1LTRlYzEtYTFhZi1j OTQ2Mzc5NTNkYzUlMjZ1JTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZkb2NzLmdvb2dsZS5jb20lMjUy RmRvY3VtZW50JTI1MkZkJTI1MkYxUnR4VVN2VWVCZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJY aG9EaXB0WSUyNTJGZWRpdCUyNTNGdXNwJTI1M0RzaGFyaW5nJmRhdGE9MDQlN0MwMSU3Q2hlbmRy aWsuYnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NmYzQ5NTg1N2JjZDc0YWZjNWRhMjA4ZDg5YWRi N2U3ZiU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0OTVkNTVhJTdDMSU3QzAlN0M2Mzc0Mjk2 MTQ3OTIyMjU0NzQlN0NVbmtub3duJTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlM Q0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTNEJTdDMTAwMCZzZGF0 YT1JcnZmRll1S3lVRTklMkJoZG9xbmV2dXdKamcxVjJxS04lMkJjMndLQU1UeThpcyUzRCZyZXNl cnZlZD0wPj4NCj4gPj4NCj4gPj4NCj4gPj4gWzJdDQo+ID4+IGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL21pbnV0ZXMtaW50ZXJpbS0yMDE3LWFjZS0wMy0yMDE3MTAxOTEzMDAvPGh0 dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRmRhdGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJGbWludXRlcy1pbnRlcmltLTIwMTct YWNlLTAzLTIwMTcxMDE5MTMwMCUyRiZkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0 MHNpZW1lbnMuY29tJTdDZmM0OTU4NTdiY2Q3NGFmYzVkYTIwOGQ4OWFkYjdlN2YlN0MzOGFlM2Jj ZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MwJTdDNjM3NDI5NjE0NzkyMjM1NDY5JTdD VW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJ aUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzEwMDAmc2RhdGE9eEZReEh1YWVwaDgl MkIlMkJEcDRQRURCNSUyRklPMEJ0MndENnJIUmdybiUyRlVDdVljJTNEJnJlc2VydmVkPTA+DQo+ ID4+DQo+ID4+IFszXSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1zZWxh bmRlci1hY2UtZWFscy88aHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkZkb2MlMkZkcmFm dC1zZWxhbmRlci1hY2UtZWFscyUyRiZkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0 MHNpZW1lbnMuY29tJTdDZmM0OTU4NTdiY2Q3NGFmYzVkYTIwOGQ4OWFkYjdlN2YlN0MzOGFlM2Jj ZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MwJTdDNjM3NDI5NjE0NzkyMjM1NDY5JTdD VW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJ aUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzEwMDAmc2RhdGE9UzclMkZqSmlGY3Vt aVolMkJmSnduMDQ2QXBWeEdueG83JTJCUnBJNlZqc2FFWVBITSUzRCZyZXNlcnZlZD0wPg0KPiA+ Pg0KPiA+Pg0KPiA+Pg0KPiA+PiAtLQ0KPiA+Pg0KPiA+PiBEYW5pZWwgTWlnYXVsdA0KPiA+Pg0K PiA+Pg0KPiA+Pg0KPiA+PiBFcmljc3Nvbg0KPiA+Pg0KPiA+DQo+ID4NCj4gPiAtLQ0KPiA+IERh bmllbCBNaWdhdWx0DQo+ID4gRXJpY3Nzb24NCj4gPg0KPg0KPg0KPiAtLQ0KPiBEYW5pZWwgTWln YXVsdA0KPiBFcmljc3Nvbg0KDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+IEFjZSBtYWlsaW5nIGxpc3QNCj4gQWNlQGlldGYub3JnPG1haWx0bzpB Y2VAaWV0Zi5vcmc+DQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl PGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw cyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFjZSZkYXRhPTA0 JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdDZmM0OTU4NTdiY2Q3NGFm YzVkYTIwOGQ4OWFkYjdlN2YlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzEl N0MwJTdDNjM3NDI5NjE0NzkyMjQ1NDYxJTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9p TUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUz RCU3QzEwMDAmc2RhdGE9bE5xb0VLeGY0ZjNjb0hQdERZOWU0d1Vaa21wREdhYmNhU0M1M1BZUEpY QSUzRCZyZXNlcnZlZD0wPg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KQWNlIG1haWxpbmcgbGlzdA0KQWNlQGlldGYub3JnPG1haWx0bzpBY2VAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTxodHRwczov L2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYl MkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZhY2UmZGF0YT0wNCU3QzAxJTdD aGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2ZjNDk1ODU3YmNkNzRhZmM1ZGEyMDhk ODlhZGI3ZTdmJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMCU3QzYz NzQyOTYxNDc5MjI1NTQ1OCU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3 TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0MxMDAw JnNkYXRhPSUyRlRKZTd6T2tXeGhSYU4lMkZmWnZNZ1Y3V0dvZFVrbjNMUDFaOVhmY1JGJTJGN28l M0QmcmVzZXJ2ZWQ9MD4NCg0KDQotLQ0KRGFuaWVsIE1pZ2F1bHQNCkVyaWNzc29uDQoNCg0KLS0N CkRhbmllbCBNaWdhdWx0DQpFcmljc3Nvbg0K --_000_AM0PR10MB2418717998D1976E290A7461FECD0AM0PR10MB2418EURP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7 DQoJbWFyZ2luOjcwLjg1cHQgNzAuODVwdCAyLjBjbSA3MC44NXB0O30NCmRpdi5Xb3JkU2VjdGlv bjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8 L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0 IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNo YXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iREUiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPlRoYW5rIHlvdSBEYW5pZWwgZm9yIHRoZSBjbGFyaWZpY2F0aW9uLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkhlbmRyaWs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0 O3BhZGRpbmc6MGNtIDBjbSAwY20gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20g MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPlZvbjo8L2I+IERhbmllbCBNaWdhdWx0ICZs dDttZ2x0LmlldGZAZ21haWwuY29tJmd0OyA8YnI+DQo8Yj5HZXNlbmRldDo8L2I+IE1vbnRhZywg Ny4gRGV6ZW1iZXIgMjAyMCAxOToxMTxicj4NCjxiPkFuOjwvYj4gQnJvY2toYXVzLCBIZW5kcmlr IChUIFJEQSBDU1QgU0VBLURFKSAmbHQ7aGVuZHJpay5icm9ja2hhdXNAc2llbWVucy5jb20mZ3Q7 PGJyPg0KPGI+Q2M6PC9iPiBCZW5qYW1pbiBLYWR1ayAmbHQ7a2FkdWtAbWl0LmVkdSZndDs7IEFj ZSBXZyAmbHQ7YWNlQGlldGYub3JnJmd0Ozxicj4NCjxiPkJldHJlZmY6PC9iPiBSZTogW0FjZV0g Q2hhcnRlciBkaXNjdXNzaW9uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGhhbmtzLCBJIHdhcyBhYm91dCBqdXN0IHNlbmRpbmcgdGhlbSBhIG5vdGUsIGJ1 dCB0aGF0IGlzIG1heWJlIG5vdCBuZWVkZWQuIEp1c3QgZm9yIHlvdXIgaW5mb3JtYXRpb24sIHRo ZSBub3RlIGlzIG5vdCBwYXJ0IG9mIHRoZSBjaGFydGVyLCBidXQgdG8gb3VyIEFEL0lFU0cuJm5i c3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WW91cnMsIERh bmllbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBNb24sIERlYyA3LCAyMDIwIGF0IDEyOjA1IFBNIEJyb2NraGF1cywgSGVuZHJpayAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmhlbmRyaWsuYnJvY2toYXVzQHNpZW1lbnMuY29tIj5oZW5kcmlrLmJy b2NraGF1c0BzaWVtZW5zLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IGxhbmc9IkVOLVVTIj5BcyB0aGUgQ01Qb3ZlckNvQVAgZHJhZnQgd2FzIGFscmVhZHkgZGlzY3Vz c2VkIGluIExBTVBTIGFuZCBKaW0gc3VnZ2VzdGVkIHRvIGNvbnNpZGVyIGl0IGluIEFDRSwgSSBz dWdnZXN0IHRvIGRyb3AgdGhlIE5vdGUgYW5kIGNvbWUgYmFjayB0byBhIGNsZWFyIHN0YXRlbWVu dA0KIGFzIGRpc2N1c3NlZCBhdCBJRVRGMTA5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPkRpc2N1 c3Npb24gb24gdGhlIExBTVBTIE1haWxpbmcgTGlzdCBmcm9tIEp1bmU6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+PGEgaHJl Zj0iaHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0 dHBzJTNBJTJGJTJGbWFpbGFyY2hpdmUuaWV0Zi5vcmclMkZhcmNoJTJGbXNnJTJGc3Bhc20lMkZ1 eVlDZjVzTWN4ZzZ4b1FGY2JlMXNQeHFWTHclMkYmYW1wO2RhdGE9MDQlN0MwMSU3Q2hlbmRyaWsu YnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NmYzQ5NTg1N2JjZDc0YWZjNWRhMjA4ZDg5YWRiN2U3 ZiU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0OTVkNTVhJTdDMSU3QzAlN0M2Mzc0Mjk2MTQ3 OTIyMDU0ODglN0NVbmtub3duJTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pR SWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTNEJTdDMTAwMCZhbXA7c2Rh dGE9emNTYUN0ZmZESHR3VmUwQzNPWmJzY0ZIQ2t0Yk9pcDZkS2w5MFlQRk1GVSUzRCZhbXA7cmVz ZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJj aC9tc2cvc3Bhc20vdXlZQ2Y1c01jeGc2eG9RRmNiZTFzUHhxVkx3LzwvYT48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxh bmc9IkVOLVVTIj5IZW5kcmlrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRk aW5nOjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPlZvbjo8L2I+IEFjZSAmbHQ7PGEgaHJlZj0ibWFp bHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlLWJvdW5jZXNAaWV0 Zi5vcmc8L2E+Jmd0Ow0KPGI+SW0gQXVmdHJhZyB2b24gPC9iPkRhbmllbCBNaWdhdWx0PGJyPg0K PGI+R2VzZW5kZXQ6PC9iPiBNb250YWcsIDcuIERlemVtYmVyIDIwMjAgMTQ6NDM8YnI+DQo8Yj5B bjo8L2I+IEJlbmphbWluIEthZHVrICZsdDs8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSIg dGFyZ2V0PSJfYmxhbmsiPmthZHVrQG1pdC5lZHU8L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gQWNl IFdnICZsdDs8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNl QGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5CZXRyZWZmOjwvYj4gUmU6IFtBY2VdIENoYXJ0ZXIg ZGlzY3Vzc2lvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5IaSwmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5QbGVhc2UgaGF2ZSBhIGxvb2sgYXQgdGhlIGxhdGVzdCB2ZXJzaW9uIG9mIHRoZSBj aGFydGVyIGJlZm9yZSB3ZSBtb3ZlIGl0IGZvcndhcmQgYnkgdGhlIGVuZCBvZiB0aGUgd2VlayAt IERlY2VtYmVyIDExLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+SSBhZGRlZCBhIG5vdGUgb24gcG90ZW50aWFsIFdHIHRoYXQg Y291bGQmbmJzcDtob3N0IHRoZSBDTVB2MiBvdmVyIENvQVAgLSBldmVudHVhbGx5LiBJIGFtIHdv bmRlcmluZyBpZiB3ZSBzaG91bGQgcHV0IGEgbm90ZSB0byB0aGVzZSBXR3MuJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Zb3Vy cywmbmJzcDs8YnI+DQpEYW5pZWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBzdHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPlRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0 aG9yaXphdGlvbiBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIChhY2UpIFdHIGhhcyBkZWZp bmVkIGEgc3RhbmRhcmRpemVkIHNvbHV0aW9uIGZyYW1ld29yayBmb3IgYXV0aGVudGljYXRpb24g YW5kIGF1dGhvcml6YXRpb24gdG8gZW5hYmxlIGF1dGhvcml6ZWQNCiBhY2Nlc3MgdG8gcmVzb3Vy Y2VzIGlkZW50aWZpZWQgYnkgYSBVUkkgYW5kIGhvc3RlZCBvbiBhIHJlc291cmNlIHNlcnZlciBp biBjb25zdHJhaW5lZCBlbnZpcm9ubWVudHMuJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbjowY20iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5UaGUgYWNjZXNzIHRvIHRoZSByZXNvdXJj ZSBpcyBtZWRpYXRlZCBieSBhbiBhdXRob3JpemF0aW9uIHNlcnZlciwgd2hpY2ggaXMgbm90IGNv bnNpZGVyZWQgdG8gYmUgY29uc3RyYWluZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIHN0eWxlPSJtYXJnaW46 MGNtIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+UHJvZmlsZXMgb2YgdGhpcyBmcmFtZXdvcmsgZm9yIGFwcGxpY2F0aW9u IHRvIHNlY3VyaXR5IHByb3RvY29scyBjb21tb25seSB1c2VkIGluIGNvbnN0cmFpbmVkIGVudmly b25tZW50cywgaW5jbHVkaW5nIENvQVArRFRMUyBhbmQgQ29BUCtPU0NPUkUsIGhhdmUgYWxzbyBi ZWVuIHN0YW5kYXJkaXplZC4mbmJzcDsgVGhlDQogV29ya2luZyBHcm91cCBpcyBjaGFyZ2VkIHdp dGggbWFpbnRlbmFuY2Ugb2YgdGhlIGZyYW1ld29yayBhbmQgZXhpc3RpbmcgcHJvZmlsZXMgdGhl cmVvZiwgYW5kIG1heSB1bmRlcnRha2Ugd29yayB0byBzcGVjaWZ5IHByb2ZpbGVzIG9mIHRoZSBm cmFtZXdvcmsgZm9yIGFkZGl0aW9uYWwgc2VjdXJlIGNvbW11bmljYXRpb25zIHByb3RvY29scyBh bmQgZm9yIGFkZGl0aW9uYWwgc3VwcG9ydCBzZXJ2aWNlcyBwcm92aWRpbmcgYXV0aG9yaXplZCBh Y2Nlc3MNCiB0byBjcnlwdG8ga2V5cyAodGhhdCBhcmUgbm90IG5lY2Vzc2FyaWx5IGxpbWl0ZWQg dG8gY29uc3RyYWluZWQgZW5kcG9pbnRzLCB0aG91Z2ggdGhlIGZvY3VzIHJlbWFpbnMgb24gZGVw bG95bWVudCBpbiBlY29zeXN0ZW1zIHdpdGggYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mIGNvbnN0 cmFpbmVkIGRldmljZXMpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPkluIGFkZGl0aW9uIHRvIHRoZSBvbmdvaW5nIG1haW50ZW5hbmNlIHdvcmssIHRoZSBXb3Jr aW5nIEdyb3VwIHdpbGwgZXh0ZW5kIHRoZSBmcmFtZXdvcmsgYXMgbmVlZGVkIGZvciBhcHBsaWNh YmlsaXR5IHRvIGdyb3VwIGNvbW11bmljYXRpb25zLCB3aXRoIGluaXRpYWwgZm9jdXMgb24gKEQp VExTIGFuZCAoR3JvdXApDQogT1NDT1JFIGFzIHRoZSB1bmRlcmx5aW5nIGdyb3VwIGNvbW11bmlj YXRpb24gc2VjdXJpdHkgcHJvdG9jb2xzLiBUaGUgV29ya2luZyBHcm91cCB3aWxsIHN0YW5kYXJk aXplIHByb2NlZHVyZXMgZm9yIHJlcXVlc3RpbmcgYW5kIGRpc3RyaWJ1dGluZyBncm91cCBrZXlp bmcgbWF0ZXJpYWwgdXNpbmcgdGhlIEFDRSBmcmFtZXdvcmsgYXMgd2VsbCBhcyBhcHByb3ByaWF0 ZWQgbWFuYWdlbWVudCBpbnRlcmZhY2VzLiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFy Z2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPlRoZSBXb3JraW5nIEdyb3VwIHdpbGwgc3RhbmRhcmRpemUgYSBm b3JtYXQgZm9yIGV4cHJlc3NpbmcgYXV0aG9yaXphdGlvbiBpbmZvcm1hdGlvbiBmb3IgYSBnaXZl biBhdXRoZW50aWNhdGVkIHByaW5jaXBhbCBhcyByZWNlaXZlZCBmcm9tIGFuIGF1dGhvcml6YXRp b24gbWFuYWdlci4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbjowY20iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij5UaGUgV29ya2luZyBHcm91cCB3aWxsIGV4YW1pbmUgaG93IHRvIHVzZSBDb25zdHJhaW5l ZCBBcHBsaWNhdGlvbiBQcm90b2NvbCAoQ29BUCkgYXMgYSB0cmFuc3BvcnQgbWVkaXVtIGZvciBj ZXJ0aWZpY2F0ZSBlbnJvbGxtZW50IHByb3RvY29scywgc3VjaCBhcyBFU1QgYW5kIENNUHYyLCBh cyB3ZWxsIGFzIGENCiB0cmFuc3BvcnQgZm9yIGF1dGhlbnRpY2F0aW9uIHByb3RvY29scyBzdWNo IGFzIEVBUCwgYW5kIHN0YW5kYXJkaXplIGFzIG5lZWRlZC4gW05vdGUgdGhhdCBDTVB2MiB3b3Jr IG1heSBhbHNvIGJlIGhvc3RlZCBpbiBMQU1QUyAod2hpY2ggcmV2aXNpdHMgQ01QdjIpLCBBTklN QSAoIHdoaWNoIGRlZmluZXMgQ01QdjIgYXMgYW4gYWx0ZXJuYXRpdmUgdG8gRVNUKSBvciBJT1RQ Uy4gRUFQIHdvcmsgaGFzIGJlZW4gY29vcmRpbmF0ZWQgd2l0aCBFTVUuDQogSW4gYW55IGNhc2Us IGlmIHRoZSB3b3JrIGlzIGJlaW5nIGNvbnNpZGVyZWQgaW4gQUNFLCB3ZSB3aWxsIG1ha2Ugc3Vy ZSB0aGUgY29ycmVzcG9uZGluZyBXRyB3aWxsIGZvbGxvdyB0aGUgcHJvZ3Jlc3MuXTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luOjBjbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gVHVlLCBOb3Yg MTcsIDIwMjAgYXQgNjo0NyBQTSBCZW5qYW1pbiBLYWR1ayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmth ZHVrQG1pdC5lZHUiIHRhcmdldD0iX2JsYW5rIj5rYWR1a0BtaXQuZWR1PC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5UaGFua3MgZm9yIHVwZGF0 aW5nIHRoZSBkcmFmdCBjaGFydGVyIGF0IFsxXSwgRGFuaWVsITxicj4NCjxicj4NCkkgbm90ZSB0 aGF0IE1pY2hhZWwgcmFpc2VkIHRoZSBxdWVzdGlvbiBvZiB3aGV0aGVyIHNvbWUgb3RoZXIgZ3Jv dXAgbWlnaHQ8YnI+DQphbHNvIGJlIGludGVyZXN0ZWQgaW4gd29ya2luZyBvbiBDTVAtb3Zlci1j b2FwLCBzbyB0aGUgSUVTRyB3aWxsIGJlIHN1cmUgdG88YnI+DQpkaXNjdXNzIHRoYXQgaWYgQ01Q IGlzIHN0aWxsIGluIHRoZSBkcmFmdCBBQ0UgY2hhcnRlciB3aGVuIGl0IGdvZXMgdG8gdGhlPGJy Pg0KSUVTRyBmb3IgcmV2aWV3Ljxicj4NCjxicj4NCi1CZW48YnI+DQo8YnI+DQpPbiBUdWUsIE5v diAxNywgMjAyMCBhdCAwNjoxNjo0OFBNIC0wNTAwLCBEYW5pZWwgTWlnYXVsdCB3cm90ZTo8YnI+ DQomZ3Q7IFRoYW5rIHlvdSBhbGwgZm9yIHRoZSBmZWVkIGJhY2tzLiBGb3IgdGhlIHB1cnBvc2Ug b2YgZHJpdmluZyB0aGUgY2hhcnRlcjxicj4NCiZndDsgZGlzY3Vzc2lvbiBhdCB0aGUgSUVUZiAx MDksIEkgaGF2ZSBhZGRlZCB0aGUgY29tbWVudHMgaW50byB0aGUgcHJvcG9zZWQ8YnI+DQomZ3Q7 IHRleHQgWzFdLjxicj4NCiZndDsgPGJyPg0KJmd0OyBNeSBjdXJyZW50IHVuZGVyc3RhbmRpbmcg aXMgdGhhdCBpdCBzZWVtcyBiZW5lZmljaWFsIHRvIGFkZCBDTVB2MiBvdmVyIENvQVA8YnI+DQom Z3Q7IGluIHRoZSBjaGFydGVyLiBJIGFtIGhhcHB5IHRvIGJlIGNvbnRyYWRpY3RlZC48YnI+DQom Z3Q7ICogSSBoYXZlIG5vdCBzZWVuIGEgY2xlYXIgY3V0IHRvIGRvIG9uZSBvciB0aGUgb3RoZXIu PGJyPg0KJmd0OyAqIEVTVCBhbmQgQ01QdjIgYXJlIHR3byBwcm90b2NvbHMgdGhhdCBjYW4gYmUg dXNlZCBmb3IgZW5yb2xsbWVudCBvciBjZXJ0PGJyPg0KJmd0OyBtYW5hZ2VtZW50IHdoaWxlIGFk ZHJlc3NpbmcgZGlmZmVyZW50IGNhc2VzIC8gbmVlZHMgLyBzaXR1YXRpb25zIC0tIG1heWJlPGJy Pg0KJmd0OyB3ZSBjYW4gY2xhcmlmeSB0aGF0IHBvaW50LiBJIGNhbiBzZWUgbGV2ZXJhZ2luZyB0 aGUgZXhpc3RpbmcgQ01QPGJyPg0KJmd0OyBpbmZyYXN0cnVjdHVyZSwgYnV0IGl0IHNlZW1zIHRo YXQgaXMgbm90IHRoZSBvbmx5IG9uZS48YnI+DQomZ3Q7ICogSSBhbSBub3QgY29udmluY2VkIHRo YXQgbm90IGhhdmluZyBDTVAgb3ZlciBDb0FQIHdpbGwgbm90IHByZXZlbnQgaXRzPGJyPg0KJmd0 OyBkZXBsb3ltZW50IGFuZCBhcyBzdWNoIEkgcHJlZmVyIHRvIGhhdmUgaXQgc3RhbmRhcmRpemVk IC0gdGhpcyBtaWdodCBiZSBhPGJyPg0KJmd0OyBwZXJzb25hbCB0aG91Z2h0Ljxicj4NCiZndDsg KiBBZGRpbmcgYW55IHBpZWNlIG9mIHdvcmsgcmVxdWlyZSBjeWNsZXMsIGJ1dCBpdCBzZWVtcyB0 byBtZSB0aGF0IENQTSB3aWxsPGJyPg0KJmd0OyBub3QgaGF2ZSBhIG1ham9yIGltcGFjdCBvbiB0 aGUgV0cgcHJvZ3Jlc3MuIFRoZSB3b3JrIHdpbGwgcHJvYmFibHkgaW5jbHVkZTxicj4NCiZndDsg b3RoZXIgV0cgc3VjaCBhIExBTVBTLjxicj4NCiZndDsgPGJyPg0KJmd0OyBZb3Vycyw8YnI+DQom Z3Q7IERhbmllbDxicj4NCiZndDsgPGJyPg0KJmd0OyBbMV08YnI+DQomZ3Q7IDxhIGhyZWY9Imh0 dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRmRvY3MuZ29vZ2xlLmNvbSUyRmRvY3VtZW50JTJGZCUyRjFSdHhVU3ZVZUJkWldvUWtq U2oyYzNEdFI4RHVCd1BNMkJuQlhob0RpcHRZJTJGZWRpdCUzRnVzcCUzRHNoYXJpbmcmYW1wO2Rh dGE9MDQlN0MwMSU3Q2hlbmRyaWsuYnJvY2toYXVzJTQwc2llbWVucy5jb20lN0NmYzQ5NTg1N2Jj ZDc0YWZjNWRhMjA4ZDg5YWRiN2U3ZiU3QzM4YWUzYmNkOTU3OTRmZDRhZGRhYjQyZTE0OTVkNTVh JTdDMSU3QzAlN0M2Mzc0Mjk2MTQ3OTIyMTU0ODElN0NVbmtub3duJTdDVFdGcGJHWnNiM2Q4ZXlK V0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2 TW4wJTNEJTdDMTAwMCZhbXA7c2RhdGE9c1JldElhQ1JVSTI0VWk4QnY3OEFEOWVhRUZDQiUyQk5D NXBNR0RwRVZMbk9nJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczov L2RvY3MuZ29vZ2xlLmNvbS9kb2N1bWVudC9kLzFSdHhVU3ZVZUJkWldvUWtqU2oyYzNEdFI4RHVC d1BNMkJuQlhob0RpcHRZL2VkaXQ/dXNwPXNoYXJpbmc8L2E+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IE9uIFR1ZSwgTm92IDE3LCAyMDIwIGF0IDY6MDIgUE0gRGFuaWVsIE1pZ2F1bHQgJmx0OzxhIGhy ZWY9Im1haWx0bzptZ2x0LmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+bWdsdC5pZXRm QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDsgPGJyPg0KJmd0OyAmZ3Q7IEhpIEdv cmFuLDxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgJmd0OyBJIGFkZGVkIHRoZSB0ZXh0IHRvIHRo ZSBjaGFydGVyIHdlIHdpbGwgZGlzY3VzcyBsYXRlci48YnI+DQomZ3Q7ICZndDs8YnI+DQomZ3Q7 ICZndDsgWW91cnMsPGJyPg0KJmd0OyAmZ3Q7IERhbmllbDxicj4NCiZndDsgJmd0Ozxicj4NCiZn dDsgJmd0OyBPbiBGcmksIE5vdiAxMywgMjAyMCBhdCAxMDoyNiBBTSBHw7ZyYW4gU2VsYW5kZXIg Jmx0Ozxicj4NCiZndDsgJmd0OyA8YSBocmVmPSJtYWlsdG86Z29yYW4uc2VsYW5kZXJAZXJpY3Nz b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+Z29yYW4uc2VsYW5kZXJAZXJpY3Nzb24uY29tPC9hPiZn dDsgd3JvdGU6PGJyPg0KJmd0OyAmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBIaSBEYW5pZWwsPGJy Pg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJy Pg0KJmd0OyAmZ3Q7Jmd0OyBIZXJl4oCZcyBhbm90aGVyIGlucHV0IHRvIHRoZSBjaGFydGVyLjxi cj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDsgVGhlIGN1cnJlbnQgZ3JvdXAga2V5IG1hbmFnZW1lbnQgc29sdXRp b25zIGFkZHJlc3NlcyB0aGUgcHJvYmxlbSBvZjxicj4NCiZndDsgJmd0OyZndDsgYXV0aG9yaXpl ZCBhY2Nlc3MgdG8gZ3JvdXAga2V5cyBhbmQgcHVibGljIGtleXMgb2YgZ3JvdXAgbWVtYmVycy48 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7IEEgcmVsYXRlZCBwcm9ibGVtIGlzIGF1dGhvcml6ZWQgYWNjZXNz IG9mIHB1YmxpYyBrZXlzIG9mIG90aGVyIGRldmljZXM8YnI+DQomZ3Q7ICZndDsmZ3Q7IG5vdCBu ZWNlc3NhcmlseSBwYXJ0IG9mIGEgc2VjdXJpdHkgZ3JvdXAsIGluIHRoZSBzZW5zZSBvZiBzaGFy aW5nIGE8YnI+DQomZ3Q7ICZndDsmZ3Q7IHN5bW1ldHJpYyBrZXkgdXNlZCB0byBwcm90ZWN0IGdy b3VwIG1lc3NhZ2VzLjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0K Jmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgQXV0aG9yaXplZCBhY2Nlc3MgdG8gcmF3 IHB1YmxpYyBrZXlzIHNlcnZlcyBhbiBpbXBvcnRhbnQgZnVuY3Rpb24gaW48YnI+DQomZ3Q7ICZn dDsmZ3Q7IGNvbnN0cmFpbmVkIHNldHRpbmdzIHdoZXJlIHB1YmxpYyBrZXkgY2VydGlmaWNhdGVz IG1heSBub3QgYmUgZmVhc2libGUgZHVlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyB0byB0aGUgaW5jdXJy ZWQgb3ZlcmhlYWQsIGUuZy4gZm9yIHdoZW4gYXV0aGVudGljYXRpbmcgdXNpbmcgRURIT0M8YnI+ DQomZ3Q7ICZndDsmZ3Q7IChkcmFmdC1pZXRmLWxha2UtZWRob2MpLjxicj4NCiZndDsgJmd0OyZn dDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFRoaXMgZnVuY3Rpb25hbGl0eSBpcyB0aHVzIGEgc3Vic2V0 IG9mIHdoYXQgaXMgYWxyZWFkeSBzdXBwb3J0ZWQsIGJ1dDxicj4NCiZndDsgJmd0OyZndDsgc2lu Y2UgdGhlIGN1cnJlbnQgc29sdXRpb24gaXMgZ2VhcmVkIHRvd2FyZHMgZ3JvdXBzIGEgZGlmZmVy ZW50IHNvbHV0aW9uPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBtYXkgYmUgbmVlZGVkIChhbHRob3VnaCBp dCBpcyBwcm9iYWJseSBwb3NzaWJsZSB0byByZXVzZSBwYXJ0cyBmcm9tIHRoZTxicj4NCiZndDsg Jmd0OyZndDsgZXhpc3Rpbmcgc2NoZW1lcyBmb3IgcHJvdmlzaW9uaW5nIGFuZCByZXF1ZXN0aW5n IHB1YmxpYyBrZXlzKS48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4N CiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFdpdGggdGhpcyBpbiBtaW5kLCBJIHBy b3Bvc2UgdGhlIGZvbGxvd2luZyBjaGFuZ2UgKGhpZ2hsaWdodGVkIGluPGJyPg0KJmd0OyAmZ3Q7 Jmd0OyBib2xkZmFjZSBiZWxvdyk6PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZn dDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBPTEQ8YnI+DQomZ3Q7ICZn dDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBUaGUgV29ya2luZyBHcm91cCBpcyBjaGFyZ2VkIHdp dGggbWFpbnRlbmFuY2Ugb2YgdGhlIGZyYW1ld29yayBhbmQ8YnI+DQomZ3Q7ICZndDsmZ3Q7IGV4 aXN0aW5nIHByb2ZpbGVzIHRoZXJlb2YsIGFuZCBtYXkgdW5kZXJ0YWtlIHdvcmsgdG8gc3BlY2lm eSBwcm9maWxlcyBvZjxicj4NCiZndDsgJmd0OyZndDsgdGhlIGZyYW1ld29yayBmb3IgYWRkaXRp b25hbCBzZWN1cmUgY29tbXVuaWNhdGlvbnMgcHJvdG9jb2xzICh0aGF0IGFyZSBub3Q8YnI+DQom Z3Q7ICZndDsmZ3Q7IG5lY2Vzc2FyaWx5IGxpbWl0ZWQgdG8gY29uc3RyYWluZWQgZW5kcG9pbnRz LCB0aG91Z2ggdGhlIGZvY3VzIHJlbWFpbnMgb248YnI+DQomZ3Q7ICZndDsmZ3Q7IGRlcGxveW1l bnQgZWNvc3lzdGVtcyB3aXRoIGEgc3Vic3RhbnRpYWwgcG9ydGlvbiBvZiBjb25zdHJhaW5lZCBk ZXZpY2VzKS48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsg Jmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IE5FVzxicj4NCiZndDsgJmd0OyZndDs8YnI+DQom Z3Q7ICZndDsmZ3Q7IFRoZSBXb3JraW5nIEdyb3VwIGlzIGNoYXJnZWQgd2l0aCBtYWludGVuYW5j ZSBvZiB0aGUgZnJhbWV3b3JrIGFuZDxicj4NCiZndDsgJmd0OyZndDsgZXhpc3RpbmcgcHJvZmls ZXMgdGhlcmVvZiwgYW5kIG1heSB1bmRlcnRha2Ugd29yayB0byBzcGVjaWZ5IHByb2ZpbGVzIG9m PGJyPg0KJmd0OyAmZ3Q7Jmd0OyB0aGUgZnJhbWV3b3JrIGZvciBhZGRpdGlvbmFsIHNlY3VyZSBj b21tdW5pY2F0aW9ucyBwcm90b2NvbHMgKmFuZCAqKmZvcjxicj4NCiZndDsgJmd0OyZndDsgYWRk aXRpb25hbCAqKnN1cHBvcnQgc2VydmljZXMgKipwcm92aWRpbmcqICphdXRob3JpemVkIGFjY2Vz cyB0byBjcnlwdG8qICprZXlzPGJyPg0KJmd0OyAmZ3Q7Jmd0OyAqKHRoYXQgYXJlIG5vdCBuZWNl c3NhcmlseSBsaW1pdGVkIHRvIGNvbnN0cmFpbmVkIGVuZHBvaW50cywgdGhvdWdoIHRoZTxicj4N CiZndDsgJmd0OyZndDsgZm9jdXMgcmVtYWlucyBvbiBkZXBsb3ltZW50IGVjb3N5c3RlbXMgd2l0 aCBhIHN1YnN0YW50aWFsIHBvcnRpb24gb2Y8YnI+DQomZ3Q7ICZndDsmZ3Q7IGNvbnN0cmFpbmVk IGRldmljZXMpLjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0 OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgR8O2cmFuPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxi cj4NCiZndDsgJmd0OyZndDsgT24gMjAyMC0xMC0xNSwgMTk6NTAsICZxdW90O0FjZSZxdW90OyAm bHQ7PGEgaHJlZj0ibWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJy Pg0KJmd0OyAmZ3Q7Jmd0OyBIaSw8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0 OyBJIHdvdWxkIGxpa2UgdG8gc3RhcnQgdGhlIGNoYXJ0ZXIgZGlzY3Vzc2lvbi4gSGVyZSBpcyBh IGRyYWZ0IG9mIGE8YnI+DQomZ3Q7ICZndDsmZ3Q7IHByb3Bvc2VkIGNoYXJ0ZXIgWzFdLjxicj4N CiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4N CiZndDsgJmd0OyZndDsgSXQgc2VlbXMgdG8gYmUgdGhhdCBhZGRpdGlvbmFsIGRpc2N1c3Npb24g aXMgbmVlZGVkIHdpdGggcmVnYXJkIHRvIHRoZTxicj4NCiZndDsgJmd0OyZndDsgbGFzdCBwYXJh Z3JhcGggcmVsYXRlZCBjZXJ0aWZpY2F0ZSBtYW5hZ2VtZW50LiBJbiBwYXJ0aWN1bGFyIHRoZSBk aXNjdXNzaW9uPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBtaWdodCByZXZpdmUgYSBkaXNjdXNzaW9uIHRo YXQgaGFwcGVuZWQgaW4gMjAxNyBbMl0gLSB3aGVuIEkgd2FzIG5vdDxicj4NCiZndDsgJmd0OyZn dDsgY28tY2hhaXIgb2YgQUNFIC1hbmQgY29uc2lkZXJlZCBvdGhlciBleHBpcmVkIHdvcmsgc3Vj aCBhcyBbM10uIFBsZWFzZSBtYWtlPGJyPg0KJmd0OyAmZ3Q7Jmd0OyB0aGlzIGRpc2N1c3Npb24g Y29uc3RydWN0aXZlIG9uIHRoaXMgdGhyZWFkLjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7 ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgVGhlIGZ1bmRh bWVudGFsIHF1ZXN0aW9uIGlzIHdoZXRoZXIgd2UgbmVlZCBjZXJ0aWZpY2F0ZSBtYW5hZ2VtZW50 IGF0PGJyPg0KJmd0OyAmZ3Q7Jmd0OyB0aGlzIHN0YWdlLiBJZiB0aGUgYW5zd2VyIGlzIHllcywg YW5kIHdlIGhhdmUgbXVsdGlwbGUgcHJvcG9zYWxzLCBpdCB3b3VsZDxicj4NCiZndDsgJmd0OyZn dDsgYmUgZ29vZCB0byBjbGFyaWZ5IHRoZSBwb3NpdGlvbiBvZiB0aGUgZGlmZmVyZW50IHByb3Bv c2FscyBhbmQgZXZhbHVhdGU8YnI+DQomZ3Q7ICZndDsmZ3Q7IHdoZXRoZXIgYSBzZWxlY3Rpb24g aXMgbmVlZGVkIG9yIG5vdCBiZWZvcmUgdmFsaWRhdGluZyB0aGUgY2hhcnRlci48YnI+DQomZ3Q7 ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7 ICZndDsmZ3Q7IFBsZWFzZSBwcm92aWRlIHlvdXIgaW5wdXRzIG9uIHRoZSBtYWlsaW5nIGxpc3Qg YmVmb3JlIE9jdG9iZXIgMzAuIE9mPGJyPg0KJmd0OyAmZ3Q7Jmd0OyBjb3Vyc2UgZm9yIG1pbm9y IGVkaXRzLCB5b3UgbWF5IHN1Z2dlc3QgdGhlbSBkaXJlY3RseSBvbiB0aGUgZ29vZ2xlIGRvYy48 YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8 YnI+DQomZ3Q7ICZndDsmZ3Q7IFlvdXJzLDxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZn dDsmZ3Q7IERhbmllbDxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0K Jmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgWzFdPGJyPg0KJmd0OyAmZ3Q7Jmd0OyA8 YSBocmVmPSJodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZkb2NzLmdvb2dsZS5jb20lMkZkb2N1bWVudCUyRmQlMkYxUnR4VVN2 VWVCZFpXb1FralNqMmMzRHRSOER1QndQTTJCbkJYaG9EaXB0WSUyRmVkaXQlM0Z1c3AlM0RzaGFy aW5nJmFtcDtkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0MHNpZW1lbnMuY29tJTdD ZmM0OTU4NTdiY2Q3NGFmYzVkYTIwOGQ4OWFkYjdlN2YlN0MzOGFlM2JjZDk1Nzk0ZmQ0YWRkYWI0 MmUxNDk1ZDU1YSU3QzElN0MwJTdDNjM3NDI5NjE0NzkyMjI1NDc0JTdDVW5rbm93biU3Q1RXRnBi R1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFX d2lMQ0pYVkNJNk1uMCUzRCU3QzEwMDAmYW1wO3NkYXRhPSUyQmtockJWc04wcFh0dXFjdlhXakJq cERKWVRlNmY3SmNNSSUyRmNPM3o2Zk9nJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFu ayI+DQpodHRwczovL2RvY3MuZ29vZ2xlLmNvbS9kb2N1bWVudC9kLzFSdHhVU3ZVZUJkWldvUWtq U2oyYzNEdFI4RHVCd1BNMkJuQlhob0RpcHRZL2VkaXQ/dXNwPXNoYXJpbmc8L2E+PGJyPg0KJmd0 OyAmZ3Q7Jmd0OyAmbHQ7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyA8YSBocmVmPSJodHRwczovL2V1cjAx LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZwcm90 ZWN0Mi5maXJlZXllLmNvbSUyRnYxJTJGdXJsJTNGayUzRDRmM2Q5YzNiLTExOGM0NzViLTRmM2Rk Y2EwLTg2ZTIyMzdmNTFmYi02MjdlNDhiMDY5NDYyZDcwJTI2cSUzRDElMjZlJTNENjkyNGIyYTYt ZTdlNS00ZWMxLWExYWYtYzk0NjM3OTUzZGM1JTI2dSUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGZG9j cy5nb29nbGUuY29tJTI1MkZkb2N1bWVudCUyNTJGZCUyNTJGMVJ0eFVTdlVlQmRaV29Ra2pTajJj M0R0UjhEdUJ3UE0yQm5CWGhvRGlwdFklMjUyRmVkaXQlMjUzRnVzcCUyNTNEc2hhcmluZyZhbXA7 ZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2ZjNDk1ODU3 YmNkNzRhZmM1ZGEyMDhkODlhZGI3ZTdmJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1 NWElN0MxJTdDMCU3QzYzNzQyOTYxNDc5MjIyNTQ3NCU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhl eUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZD STZNbjAlM0QlN0MxMDAwJmFtcDtzZGF0YT1JcnZmRll1S3lVRTklMkJoZG9xbmV2dXdKamcxVjJx S04lMkJjMndLQU1UeThpcyUzRCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0 cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az00ZjNkOWMzYi0xMThjNDc1Yi00ZjNk ZGNhMC04NmUyMjM3ZjUxZmItNjI3ZTQ4YjA2OTQ2MmQ3MCZhbXA7cT0xJmFtcDtlPTY5MjRiMmE2 LWU3ZTUtNGVjMS1hMWFmLWM5NDYzNzk1M2RjNSZhbXA7dT1odHRwcyUzQSUyRiUyRmRvY3MuZ29v Z2xlLmNvbSUyRmRvY3VtZW50JTJGZCUyRjFSdHhVU3ZVZUJkWldvUWtqU2oyYzNEdFI4RHVCd1BN MkJuQlhob0RpcHRZJTJGZWRpdCUzRnVzcCUzRHNoYXJpbmc8L2E+Jmd0Ozxicj4NCiZndDsgJmd0 OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0OyBbMl08YnI+DQomZ3Q7 ICZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0 bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRmRhdGF0cmFja2VyLmlldGYub3JnJTJGZG9jJTJG bWludXRlcy1pbnRlcmltLTIwMTctYWNlLTAzLTIwMTcxMDE5MTMwMCUyRiZhbXA7ZGF0YT0wNCU3 QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2ZjNDk1ODU3YmNkNzRhZmM1 ZGEyMDhkODlhZGI3ZTdmJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdD MCU3QzYzNzQyOTYxNDc5MjIzNTQ2OSU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1D NHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0Ql N0MxMDAwJmFtcDtzZGF0YT14RlF4SHVhZXBoOCUyQiUyQkRwNFBFREI1JTJGSU8wQnQyd0Q2ckhS Z3JuJTJGVUN1WWMlM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL21pbnV0ZXMtaW50ZXJpbS0yMDE3LWFjZS0wMy0yMDE3 MTAxOTEzMDAvPC9hPjxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IFszXSA8 YSBocmVmPSJodHRwczovL2V1cjAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyRmRvYyUyRmRyYWZ0LXNlbGFu ZGVyLWFjZS1lYWxzJTJGJmFtcDtkYXRhPTA0JTdDMDElN0NoZW5kcmlrLmJyb2NraGF1cyU0MHNp ZW1lbnMuY29tJTdDZmM0OTU4NTdiY2Q3NGFmYzVkYTIwOGQ4OWFkYjdlN2YlN0MzOGFlM2JjZDk1 Nzk0ZmQ0YWRkYWI0MmUxNDk1ZDU1YSU3QzElN0MwJTdDNjM3NDI5NjE0NzkyMjM1NDY5JTdDVW5r bm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxD SkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzEwMDAmYW1wO3NkYXRhPVM3JTJGakppRmN1 bWlaJTJCZkp3bjA0NkFwVnhHbnhvNyUyQlJwSTZWanNhRVlQSE0lM0QmYW1wO3Jlc2VydmVkPTAi IHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0 LXNlbGFuZGVyLWFjZS1lYWxzLzwvYT48YnI+DQomZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0OyAmZ3Q7 Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsmZ3Q7IC0tPGJyPg0KJmd0OyAm Z3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDsgRGFuaWVsIE1pZ2F1bHQ8YnI+DQomZ3Q7ICZndDsm Z3Q7PGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0OyZndDs8YnI+DQomZ3Q7ICZndDsm Z3Q7IEVyaWNzc29uPGJyPg0KJmd0OyAmZ3Q7Jmd0Ozxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsg Jmd0Ozxicj4NCiZndDsgJmd0OyAtLTxicj4NCiZndDsgJmd0OyBEYW5pZWwgTWlnYXVsdDxicj4N CiZndDsgJmd0OyBFcmljc3Nvbjxicj4NCiZndDsgJmd0Ozxicj4NCiZndDsgPGJyPg0KJmd0OyA8 YnI+DQomZ3Q7IC0tIDxicj4NCiZndDsgRGFuaWVsIE1pZ2F1bHQ8YnI+DQomZ3Q7IEVyaWNzc29u PGJyPg0KPGJyPg0KJmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxicj4NCiZndDsgQWNlIG1haWxpbmcgbGlzdDxicj4NCiZndDsgPGEgaHJlZj0ibWFp bHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBpZXRmLm9yZzwvYT48YnI+DQom Z3Q7IDxhIGhyZWY9Imh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5j b20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUy RmFjZSZhbXA7ZGF0YT0wNCU3QzAxJTdDaGVuZHJpay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3 Q2ZjNDk1ODU3YmNkNzRhZmM1ZGEyMDhkODlhZGI3ZTdmJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFi NDJlMTQ5NWQ1NWElN0MxJTdDMCU3QzYzNzQyOTYxNDc5MjI0NTQ2MSU3Q1Vua25vd24lN0NUV0Zw Ykdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhh V3dpTENKWFZDSTZNbjAlM0QlN0MxMDAwJmFtcDtzZGF0YT1sTnFvRUt4ZjRmM2NvSFB0RFk5ZTR3 VVprbXBER2FiY2FTQzUzUFlQSlhBJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48YnI+DQo8YnI+ DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCkFj ZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWNlQGlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+QWNlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vZXVyMDEuc2Fm ZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRm Lm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFjZSZhbXA7ZGF0YT0wNCU3QzAxJTdDaGVuZHJp ay5icm9ja2hhdXMlNDBzaWVtZW5zLmNvbSU3Q2ZjNDk1ODU3YmNkNzRhZmM1ZGEyMDhkODlhZGI3 ZTdmJTdDMzhhZTNiY2Q5NTc5NGZkNGFkZGFiNDJlMTQ5NWQ1NWElN0MxJTdDMCU3QzYzNzQyOTYx NDc5MjI1NTQ1OCU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxD SlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0QlN0MxMDAwJmFtcDtz ZGF0YT0lMkZUSmU3ek9rV3hoUmFOJTJGZlp2TWdWN1dHb2RVa24zTFAxWjlYZmNSRiUyRjdvJTNE JmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9hY2U8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4tLQ0KPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkRhbmllbCBNaWdhdWx0PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkVyaWNz c29uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi ciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4t LSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkRhbmllbCBNaWdhdWx0PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Fcmljc3NvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_AM0PR10MB2418717998D1976E290A7461FECD0AM0PR10MB2418EURP_-- From nobody Tue Dec 8 07:42:33 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E91673A0CC0; Tue, 8 Dec 2020 07:42:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fC1e9-7h2Snv; Tue, 8 Dec 2020 07:42:28 -0800 (PST) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80087.outbound.protection.outlook.com [40.107.8.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A72A83A0FC9; Tue, 8 Dec 2020 07:42:27 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XmmsHCKbEq6nWvqbGH6uauzRRz9ug8uvondnqMUo5LLmhPdG/rY52gs5KHW9C7qkY/Ut3C85n81wXxcd44VtJUU++cEyU/uuucTUanmJUufA3B+e6nY2Z0QcKnYYwJfAOfO/UXSNIyMLk2zKjxXe3MEvi7MR1dhvpmXRwxDQ2vZINEwOoU5dcgYnvWDeCXjVaIgd7YJZRm5yUoiTfKwUFs5hSCcWs+dIBA7SxaOmKNL/7OdupJPloNl0/VagDbEd5lFVnGkJl5A8wEaKYeyOCQruvSv+DkN7FHLVoJgiZdrTmo2NO2zy9Sx8ldMtPOlg9YA56L/hhoAazyxpFEV2Yg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DgEzjjuJXbQ+qtJWBV4geGfjjk0gpY8gIsPdOK0vPzk=; b=SIrfN1215AOXhQcwwQaFyizfz4vHXodDRcQVM21I5h/u08PQm8sREKtLDbdSk16GRppuG2RLmRwjjGku5nlIiJAxXZsX6p7LxjHjv1SiEloobKJZEiHxlKxJbm2d1R4UDJ5/0KeMD5HVdXIQUGTOoXMsHDXvZBmxffxx7cG9Yys1l2ZBlXKsIcMuIsQuhWKR/iH1eeE7s+12nXDOsosMwjw/frjL/1c2gKXrs70ByOP8XNFV2McNi/kfWC0uXF2NHg7dd3UovbLfnKuQQRTFnDFE0sba4tRQHc+coPnMHn4QQr2hzSceezqWd9VR2wBg3GAOGo9WzZ+IHaQXAZdNxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DgEzjjuJXbQ+qtJWBV4geGfjjk0gpY8gIsPdOK0vPzk=; b=Zu1khhyVlgScq193cREVZ1uv0kG1ly1Tc2xTMDzeuaQlBW0xp4VPsM9GlGM8G2xEoeSWR9VymSfspBZQRmxbGHeXVOHZ9ycLpppzAtckzclCvNwYNvrhjZJo1+rM8Dpq4rqQMc9UHwkpHbT/yKSEpjHzjDYiqPaj1/SHq9WjbgU= Received: from VI1PR07MB4477.eurprd07.prod.outlook.com (2603:10a6:803:74::33) by VI1PR07MB5552.eurprd07.prod.outlook.com (2603:10a6:803:c6::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.8; Tue, 8 Dec 2020 15:42:22 +0000 Received: from VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2]) by VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2%6]) with mapi id 15.20.3654.011; Tue, 8 Dec 2020 15:42:22 +0000 From: Francesca Palombini To: Marco Tiloca , "draft-ietf-ace-oscore-profile@ietf.org" , Ace Wg Thread-Topic: [Ace] WGLC draft-ietf-ace-oscore-profile-13.txt Thread-Index: AQHWtiHOnDedGRS/9Eq2TBYLdOn2L6nPrqqAgB3nRQA= Date: Tue, 8 Dec 2020 15:42:22 +0000 Message-ID: <81EAD8CA-2CFD-4295-86B3-44C3B8676A27@ericsson.com> References: <160381525062.27226.4156909974711721360@ietfa.amsl.com> <02a1d3ce-071b-e35a-104f-333e54458d4a@ri.se> In-Reply-To: <02a1d3ce-071b-e35a-104f-333e54458d4a@ri.se> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.42.20101102 authentication-results: ri.se; dkim=none (message not signed) header.d=none;ri.se; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:1ba8:147a:c100:8104:651a:fe73:167c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 286a270b-e5fb-473a-bb19-08d89b8fdabf x-ms-traffictypediagnostic: VI1PR07MB5552: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: pcVtJoFgprpQUisiRnoEMUl0oul/LuiJ4Dld3/k/W3xqDVinqcPg8x9GSORcGKd2wQlKDYznrx9h5PoQxan5Mn8qlW2afbs6aPrr5EqlyMgN+Ts3ynZuplzTN8JBs7Z8u7BgsojeyFEBucwPTJxDwp9CD+zbJHg0HD2S1IZA6iM0AkU0pEmqdeudmmCqu5slJLhArYZ3reHduVgrSr2P/+DVKdZQ9QMEGa4ztcqTOYXG32KWnmpndR0MqP0i1r0VTppPtJcQeFDAR3vkZTCAzu5Qm8V8ZIKGIWFATTnDL3Wp27eUHXRBvqT6L4+PhYwoQ4g1mjwpYbAmkIGBYIMyD8LJmARiM11pqI/UiUV/AjPSJe7WNeFS7JidgxM3eIYqmRNJrd2KzKJAk02keGoY1bs/DQgB0fmy9iBOTZs/jEqzN2ISxH3BNiHbGieCAlSoUdqVCV/REYALSwCP1XKXkQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI1PR07MB4477.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(366004)(346002)(6486002)(508600001)(8936002)(6512007)(9326002)(91956017)(2906002)(76116006)(6506007)(45080400002)(5660300002)(66476007)(186003)(166002)(83380400001)(110136005)(71200400001)(86362001)(53546011)(30864003)(66556008)(66574015)(36756003)(2616005)(8676002)(44832011)(33656002)(66446008)(64756008)(966005)(4001150100001)(66946007)(45980500001)(579004)(559001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?L1hKK0NOeWErNVltVGFJSHEwVWhlSy83bWFVRlQ5eGNaMnhaemFUZnkrazk3?= =?utf-8?B?Z3RVVXZVb1huaCt5QXdqbVN6ZzVMVW9rV0hrRVUrOWJzckFZUmk3SEY3ajM3?= =?utf-8?B?NmlaUUVNUEJBejlzWW10dUQ0ZC9oNkwrUmhOZC9USHBFbzFoRDh2VEdQTGtj?= =?utf-8?B?TER2SDlIeGluYnkrdXJ1SW9IbURlWkhBOVRFbHkvMHRWdWZrZm1yZ1JNM29n?= =?utf-8?B?MUtBeTdaeFVJR1VnTTlUeGR5b3ZaRnkvN2tsdzBZTldSN3lwRVRZV3czc2ZV?= =?utf-8?B?UG5qK0FvYjY4MVRlQlRIcExaLzVFZ2JVY3I1dC9yM0dOV3NjTC9VS2FsZUto?= =?utf-8?B?TkpBMWlCM0VPUFF3Q0YzYjBrQlczeHlVQzZSb1Myd21tbFU0d21ia01uOFh3?= =?utf-8?B?KzlDeVlkdnVpQzJLMDcrazZkSzQ3eTJHNk1XeCtDQmtmczhSc1JwOW1oT3NS?= =?utf-8?B?SldIVTlvWWxSbU5TZ1h6NmRkdkNwTHVMQ2d1ODVjWVJiQ1JEOVljVXVpRS8w?= =?utf-8?B?TXNBcVJOcFduSEhNR3dtdjhxOUo2Tjk5QlQ0UDNXMUdwdGVjM3NVSHhYMVBz?= =?utf-8?B?QjhmYWg5cVhtU1g3d0dmOEl5cmdIa3c0NXg5ZFlUczhkSmQ0WmZuWHZSMnpI?= =?utf-8?B?TXBJc1Z3NVhyb1ppVjJQdDFsbXJxbmU1Z2hEdTdNbHZZbmZkbTRnZGt1VFFG?= =?utf-8?B?OWFyME9ZeTIrbks0ODl2dVdiSnluU01rSFdRWnVxRERJNEc4L2IvVlhFMHVl?= =?utf-8?B?RTZSbEtEMVRTeXU2RGRaN05NbmkwTzhiTGhlWHdiV25tNTZ4V0lLakFiYVR5?= =?utf-8?B?ZXBKK0ttbEhaTlROT01LeGs3ZFlSY2UwSldVU1duczc2d1dPVjFaNlF6QmRW?= =?utf-8?B?cmovREhscVpESU1qbVUvZDFZWXhScHFoTm5qMGExMFQwMWNkZFFsV2E2WlBV?= =?utf-8?B?bzRlOUE4c3drK2tWYjJZV2x6WDA3NXUzcUpFV09QWTI5enE3dWVlNTJkU1pz?= =?utf-8?B?eGtxdkRYYXlNTHhTZFpialBMbnArNTlnN2dtc1ZiU055My9WM2lvVjVaVWRN?= =?utf-8?B?ZjNmNlk4d296QytpWkp1NHFXUW9hTER0WUtpeXBnMUI3bXhSR0FtK3dBNVRn?= =?utf-8?B?WmJ0MmN4ejl1ekVacUpUMkk1YlV2T3haNXFPR3RDOFBPU2QvT0t5U2JRanMw?= =?utf-8?B?UU5zWEtRcjlhclZlVEZxM2NyUHhJYUNUbzM4TXdKZjhxL1NqV2U2dWN3WEty?= =?utf-8?B?RU1Gd2dTQnNBNWYxcTdmM3UxWGlmWlltVnpFLy9iVmpmcTlnWTRYYUVFRllQ?= =?utf-8?B?K2VxOWdEZEExQWFUR3Z4SG9PQWF0QnJEUEc4VUl1RmtyZ3dOakJ1dWpTd2hW?= =?utf-8?B?UXNxMkVEaHBKUjNXUElnVmxQMTgxQ0M3cjAvbFpXeldUcU5UZ3Y5MmVlNjE3?= =?utf-8?Q?CxIA3/P9?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_81EAD8CA2CFD429586B344C3B8676A27ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: VI1PR07MB4477.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 286a270b-e5fb-473a-bb19-08d89b8fdabf X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Dec 2020 15:42:22.4562 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: g9Cq9HNY/sZBkqtmjHVdOSy8tpPfkoz6W6Ls36P092tnHDU9uBFwGroC5fhVSWNnV5wSZRaCtLS1KnLWW5dciVP0S0lWnqHEqvQaye9a96PWEUFbFPHWzGLmbj8t4/7j X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB5552 Archived-At: Subject: Re: [Ace] WGLC draft-ietf-ace-oscore-profile-13.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2020 15:42:32 -0000 --_000_81EAD8CA2CFD429586B344C3B8676A27ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWFyY28sDQoNClRoYW5rcywgdmVyeSBoZWxwZnVsIGFzIGFsd2F5cyEgSSBoYXZlIGltcGxl bWVudGVkIGFsbCB0aGUgY29tbWVudHMgaW4gdGhpcyBQUiBodHRwczovL2dpdGh1Yi5jb20vYWNl LXdnL2FjZS1vc2NvcmUtcHJvZmlsZS9wdWxsLzQ0ICwgaWYgeW91IGdpdmUgbWUgdGhlIE9LIEkg Y2FuIG1lcmdlIGFuZCB1cGxvYWQgYSBuZXcgc3VibWlzc2lvbi4gSGFwcHkgdG8gc2VlIHRoYXQg dGhlIGNvbW1lbnRzIHdlcmUgYWJvdXQgY2xhcmlmaWNhdGlvbnMgYW5kIGVkaXRvcmlhbHMuDQoN CklubGluZSBkZXRhaWxlZCBhbnN3ZXJzLg0KDQpUaGFua3MgYWdhaW4hDQpGcmFuY2VzY2ENCg0K RnJvbTogTWFyY28gVGlsb2NhIDxtYXJjby50aWxvY2FAcmkuc2U+DQpEYXRlOiBUaHVyc2RheSwg MTkgTm92ZW1iZXIgMjAyMCBhdCAxNzowNA0KVG86IDxkcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJv ZmlsZUBpZXRmLm9yZz4sIEFjZSBXZyA8YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBY2Vd IFdHTEMgZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTMudHh0DQpSZXNlbnQgZnJvbTog PGFsaWFzLWJvdW5jZXNAaWV0Zi5vcmc+DQpSZXNlbnQgdG86IEZyYW5jZXNjYSBQYWxvbWJpbmkg PGZyYW5jZXNjYS5wYWxvbWJpbmlAZXJpY3Nzb24uY29tPiwgPGx1ZHdpZy5zZWl0ekBjb21iaXRl Y2guc2U+LCBHw7ZyYW4gU2VsYW5kZXIgPGdvcmFuLnNlbGFuZGVyQGVyaWNzc29uLmNvbT4sIDxt YXJ0aW4uZ3VubmFyc3NvbkByaS5zZT4NClJlc2VudCBkYXRlOiBUaHUsIDE5IE5vdiAyMDIwIDA4 OjAzOjU0IC0wODAwIChQU1QpDQoNCkhlbGxvIE9TQ09SRSBwcm9maWxlIGF1dGhvcnMgYW5kIEFD RSwNCg0KUGxlYXNlLCBmaW5kIGJlbG93IHNvbWUgV0dMQyBjb21tZW50cy4gSG9wZSBpdCBoZWxw cyENCg0KQmVzdCwNCi9NYXJjbw0KDQoNCg0KU2VjdGlvbiAxDQoNCiogcy9pcyBub3QgZG9uZSBi eSBhL2lzIG5vdCBhY2hpZXZlZCB0aHJvdWdoIGENCg0KRlA6IE9rLCBmaXhlZC4NCg0KKiBzL2Fm dGVyIHRoZSBmaXJzdCBPU0NPUkUgZXhjaGFuZ2UvYWZ0ZXIgdGhlIGZpcnN0IG1lc3NhZ2UgZXhj aGFuZ2UNCnVzaW5nIE9TQ09SRQ0KDQpGUDogT2ssIGZpeGVkLg0KDQpTZWN0aW9uIDINCg0KKiAi VGhpcyBzcGVjaWZpYyBpZGVudGlmaWVyLCBlbmNvZGVkIGFzIGEgYnl0ZSBzdHJpbmcsIGlzIGFz c2lnbmVkIGJ5DQp0aGUgQVMgdG8gYmUgdW5pcXVlIGluIHRoZSBzZXRzIG9mIGl0cyBPU0NPUkUg U2VjdXJpdHkgQ29udGV4dHMgLi4uIg0KDQogICBUbyBhdm9pZCBjb25mdXNpb24sIGl0J3MgcHJv YmFibHkgYmV0dGVyIHRvIHNheSAidW5pcXVlIGFtb25nIHRoZQ0KaXNzdWVkIHNldHMgb2YgT1ND T1JFIGlucHV0IG1hdGVyaWFsIiwgc2luY2UgdGhlIEFTIGNhbiBoYXZlIGFjdHVhbA0KT1NDT1JF IFNlY3VyaXR5IENvbnRleHRzIGl0IHVzZXMgdG8gY29tbXVuaWNhdGUgd2l0aCBDbGllbnRzIG9y IFJlc291cmNlDQpTZXJ2ZXJzLg0KDQpGUDogT2ssIGZpeGVkLiBSZXBsYWNlZCB3aXRoIE9TQ09S RSBzZWN1cml0eSBpbnB1dCBtYXRlcmlhbHMNCg0KKiBSZWZlcnJpbmcgdG8gJ2lkJyBhcyBzcGVj aWZpYyBpZGVudGlmaWVyLCB0aGUgdGV4dCBzYXlzOiAiYW5kIGlzIG5vdA0KdXNlZCBhcyBpbnB1 dCBtYXRlcmlhbCB0byBkZXJpdmUgdGhlIGZ1bGwgT1NDT1JFIFNlY3VyaXR5IENvbnRleHQuIg0K DQogICBUaGF0J3MgY29ycmVjdCwgYnV0IHRoZW4gdGhlIGlkZW50aWZpZXIgaXMgbGF0ZXIgaW5j bHVkZWQgaW4gVGFibGUgMQ0KIk9TQ09SRV9JbnB1dF9NYXRlcmlhbCBQYXJhbWV0ZXJzIiA6LSkN Cg0KICAgUGVyaGFwcyBpdCdzIGZpbmUgdG8ganVzdCByZXZlcnQgdG8gT1NDT1JFX1NlY3VyaXR5 X0NvbnRleHRfT2JqZWN0LA0KYm90aCBmb3IgdGhlIG5hbWUgb2YgVGFibGUgMSBhbmQgaW4gZGlm ZmVyZW50IHNwb3RzIG9mIHRoZSB0ZXh0PyBUaGV5DQp3b3VsZCBzdGlsbCBjb25zaWRlciAnaWQn IGFzIE9TQ09SRSBJbnB1dCBNYXRlcmlhbCBJZGVudGlmaWVyLCB3aGlsZQ0KYWxpZ25lZCB3aXRo IHRoZSByZWdpc3RyeSBuYW1lIGZyb20gU2VjdGlvbiA5LjQuDQoNCkZQOiBJIHNlZSB5b3VyIHBv aW50LCBidXQgdGhlIG5hbWUgd2FzIHNvdXJjZSBvZiBkaXNjdXNzaW9uIGJlZm9yZSBhbmQgSSdk IHJhdGhlciBub3QgZ28gYmFjayBvbiB0aGF0LiBJIGRvbid0IHRoaW5rIGl0IGlzIGEgcHJvYmxl bSB0aGF0IHRoZSAnaWQnIGlzIGJvdGggcGFydCBvZiB0aGUgIk9TQ09SRV9JbnB1dF9NYXRlcmlh bCIgb2JqZWN0IGFuZCBhbHNvIG5vdCBwYXJ0IG9mIHRoZSBhY3R1YWwgaW5wdXQgbWF0ZXJpYWwu IEFmdGVyIGFsbCBpdCBuZWVkcyB0byBiZSBwYXJ0IG9mIHRoZSBvYmplY3QgdG8gaWRlbnRpZnkg aXQuIFdoYXQgSSBkaWQgaXMgdG8gY2hhbmdlIGl0cyBDQk9SIGxhYmVsIHRob3VnaCwgdG8gaGF2 ZSBpdCBhcyAwLCBzaW5jZSBJIHRoaW5rIHRoYXQgbWFrZXMgbW9yZSBzZW5zZSB0aGF0IHRvIGJl IGluIHRoZSBtaWRkbGUgb2Ygb3RoZXIgaW5wdXQgbWF0ZXJpYWxzLiBOb3RlIHRoYXQgdGhpcyBp cyBhIGNoYW5nZSB0aGF0IHdpbGwgYWZmZWN0IGltcGxlbWVudGF0aW9ucy4NCg0KKiBzL0lmIHRo ZSByZXF1ZXN0IHZlcmlmaWVzL0lmIHRoZSByZXF1ZXN0IGlzIHN1Y2Nlc3NmdWxseSB2ZXJpZmll ZA0KDQpGUDogT2ssIGZpeGVkLg0KDQoqIHMvdW50aWwgdG9rZW4gZXhwaXJhdGlvbi91bnRpbCB0 b2tlbiBkZWxldGlvbiwgZHVlIHRvIGUuZy4gZXhwaXJhdGlvbg0Kb3IgcmV2b2NhdGlvbg0KDQpG UDogdGhhbmtzIGZvciB0aGlzIGNvbW1lbnQuIEkgZGlkIG9ubHkga2VlcCBleHBpcmF0aW9uIGFz IGV4YW1wbGUsDQoNCiogcy90aGUgc2FtZSBvciBkaWZmZXJlbnQvdGhlIHNhbWUgb3IgYSBkaWZm ZXJlbnQgb25lDQoNCkZQOiBPaywgZml4ZWQuDQoNCiogRmlndXJlIDEgY2FuIGFsc28gc2hvdyB0 aGUgYWNoaWV2ZW1lbnQgb2YgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLA0KZm9sbG93aW5nIHRoZSBP U0NPUkUgZXhjaGFuZ2UgYXQgdGhlIGVuZA0KDQpGUDogR29vZCBwb2ludCwgYWRkZWQuDQoNCg0K U2VjdGlvbiAzLjENCg0KKiBzL29iamVjdC4ga2lkIGZpZWxkIGNhcnJ5aW5nL29iamVjdCwgd2l0 aCB0aGUga2lkIGZpZWxkIGNhcnJ5aW5nDQoNCkZQOiBPaywgZml4ZWQuDQoNClNlY3Rpb24gMy4y DQoNCiogIi4uLiBwcm9maWxlIG5lZ290aWF0aW9uIGNhbiBiZSBvbWl0dGVkIiAtIEkgdGhpbmsg InByb2ZpbGUgc2lnbmFsaW5nIg0KYmV0dGVyIHJlZmxlY3RzIHdoYXQgbWF5IGhhcHBlbiBoZXJl LCBzZWUgYWxzbyB0aGUgYmVnaW5uaW5nIG9mIHRoZQ0KcGFyYWdyYXBoLg0KDQpGUDogT2ssIGZp eGVkLg0KDQoqIHMvaW4gdGhlIHRoZS9pbiB0aGUNCg0KRlA6IE9rLCBmaXhlZC4NCg0KKiBzL2lu IHRoZSAnY25mJyBwYXJhbWV0ZXIgb2YgdGhlIHRva2VuL2luIHRoZSAnY25mJyBjbGFpbSBvZiB0 aGUgdG9rZW4NCg0KRlA6IE9rLCBmaXhlZC4NCg0KU2VjdGlvbiAzLjIuMQ0KDQoqIEluIHRoZSB0 ZXh0IGVudHJpZXMgZm9sbG93aW5nIFRhYmxlIDEsIHRoZSBDQk9SIGludGVnZXIgbGFiZWxzIG5l ZWQgdG8NCmJlIGFsaWduZWQgd2l0aCB0aGUgQ0RETCBzdW1tYXJ5IGF0IHRoZSBlbmQgb2YgdGhl IHNlY3Rpb24uDQoNCkZQOiBJIHRoaW5rIGl0IHdhcz8gTm93IEkgbW92ZWQgaWQgdG8gaW5kZXgg MCwgc28gSSBzd2l0Y2hlZCB0aGUgb3JkZXIgdGhlcmUgdG9vLg0KDQoqIHMvVGhpcyBwYXJhbWV0 ZXIgaWRlbnRpZmllcyB0aGUgT1NDT1JFX0lucHV0X01hdGVyaWFsL1RoaXMgcGFyYW1ldGVyDQpp ZGVudGlmaWVzIHRoZSBPU0NPUkVfSW5wdXRfTWF0ZXJpYWwgb2JqZWN0DQoNCkZQOiBJIHdpbGwg bGV0IHRoZSBSRkMgZWRpdG9ycyBkZWNpZGUgb24gdGhhdCBvbmUgOikgRG9uJ3Qgd2FudCB0byBi ZWNvbWUgdG9vIHZlcmJvc2UgaWYgaXQncyBub3QgbmVlZGVkLg0KDQoqIHMvdGhlICJpZCIgdHlw ZSBpcyBieXRlIHN0cmluZy90aGUgImlkIiB0eXBlIGlzIGJzdHINCg0KRlA6IGFoLCBnb29kIHBv aW50LiBJIGFjdHVhbGx5IGNoYW5nZWQgYWxsIHRoZSBkZXNjcmlwdGlvbiB0byBleHRlbmQgdGhl IHR5cGUgKHNvIGJ5dGUgc3RyaW5nIGluc3RlYWQgb2YgYnN0ciwgZXRjKSwgaW4gb3JkZXIgbm90 IHRvIHVzZSBDRERMIGluIHRleHQuDQoNCiogVGhpcyB2ZXJzaW9uIC0xMyBoYXMgcmVtb3ZlZCAn Y2xpZW50SWQnIGFuZCAnc2VydmVySWQnIGZyb20gVGFibGUgMQ0KYW5kIHRodXMgYXMgY29kZSBw b2ludHMgZnJvbSB0aGUgIk9TQ09SRSBTZWN1cml0eSBDb250ZXh0IFBhcmFtZXRlcnMiDQpyZWdp c3RyeS4NCg0KICBObyBzdHJvbmcgbmVlZCB0byBpbmNsdWRlIHRoZW0gYmFjaywgYnV0IGV2ZW4g aWYgdGhpcyBwcm9maWxlIGRvZXMgbm90DQp1c2UgdGhlbSBhbmQgZG9lcyBub3Qgc2VuZCB0aGVt IG9uIHRoZSB3aXJlLCBJIHRoaW5rIHRoZXkgc3RpbGwgYmVsb25nDQp0byB0aGUgc2FtZSBuYW1l c3BhY2UsIHNpbmNlIHRoZXkgYXJlIGRlc2NyaXB0aXZlIG9mIGEgc2VjdXJpdHkgY29udGV4dA0K YW5kIGFyZSBpbiBmYWN0IGFsc28gdXNlZCBhcyBpbnB1dCBtYXRlcmlhbCB0byBkZXJpdmUgaXQg Oi0pDQpGUDogSSBhZ3JlZSB3aXRoIHRoYXQsIGFuZCB0aGluayB0aGUgZmlyc3QgZHJhZnQgdG8g dXNlIHRoZW0gd2lsbCByZWdpc3RlciB0aGVtLiBUaGUgcmVnaXN0cmF0aW9uIG9mIHRoZSBPU0NP UkVfSW5wdXRfTWF0ZXJpYWwgZG9lcyBub3Qgc3BlY2lmeSBob3cgdGhpcyBtYXRlcmlhbCBpcyB1 c2VkLCB0aGF0IGlzIHVwIHRvIHRoZSBkcmFmdCBkZXNjcmliaW5nIHRoZSBkZXJpdmF0aW9uIHBy b2Nlc3MsIHNvIGl0IGRvZXMgbm90IG1ha2Ugc2Vuc2UgdG8gcmVnaXN0ZXIgdGhlbSBoZXJlIHdp dGhvdXQgZXhwbGFpbmluZyB0aGUgZGVyaXZhdGlvbiBwcm9jZXNzIHVzaW5nIHRob3NlIHBhcmFt ZXRlcnMuDQoNClNlY3Rpb24gNA0KDQoqIHMvdGhlIFJTIGFuZCBjbGllbnQgYXV0aGVudGljYXRl cyB0aGVtc2VsdmVzL3RoZSBSUyBhbmQgY2xpZW50DQphdXRoZW50aWNhdGUgZWFjaCBvdGhlcg0K DQpGUDogT2ssIGZpeGVkLg0KKiBzL3N1Y2Nlc3NmdWxseSB2ZXJpZmllZCB0aGUgcmVzcG9uc2Ug ZnJvbSB0aGUgUlMvc3VjY2Vzc2Z1bGx5IHZlcmlmaWVkDQphIHJlc3BvbnNlIGZyb20gdGhlIFJT IGFzIHByb3RlY3RlZCB3aXRoIHRoZSBlc3RhYmxpc2hlZCBPU0NPUkUgY29udGV4dA0KDQogICAo c2ltaWxhciBvY2N1cnJlbmNlcyBhcmUgYWxzbyBsYXRlciBpbiB0aGUgdGV4dCkNCg0KRlA6IE9r LCBmaXhlZC4NCg0KU2VjdGlvbiA0LjENCg0KKiBJbiB0aGUgZmlyc3QgcGFyYWdyYXBoLCBJIHN1 Z2dlc3QgdG8gcmVwaHJhc2UgYXMgImFuZCB0aGUgcG9zdGVkDQphY2Nlc3MgdG9rZW4gaXMgc3Rp bGwgcmV0YWluZWQiLg0KDQogIFRoYXQgZG9lc24ndCByZXF1aXJlIHRvIGV4cGxpY2l0bHkgbWVu dGlvbiAidmFsaWQiLCBzaW5jZSBhc3NlcnRpbmcNCmVzcGVjaWFsbHkgdmFsaWRpdHkgY2FuIGJl IG5vbi10cml2aWFsIGZvciB0aGUgY2xpZW50LCBlLmcuIGluIGNhc2Ugb2YNClRva2VuIHJldm9j YXRpb24uDQogIChzaW1pbGFyIG9jY3VycmVuY2VzIGFyZSBhbHNvIGxhdGVyIGluIHRoZSB0ZXh0 KQ0KDQpGUDogSSBhbSBub3Qgc3VyZSBhYm91dCB0aGlzIG9uZTogSSBkb24ndCB0aGluayB0YWxr aW5nIGFib3V0ICJyZXRhaW5pbmciIGFuIGFjY2VzcyB0b2tlbiBpcyBwcmVjaXNlIGVub3VnaCAo YSB0b2tlbiBtaWdodCBiZSAicmV0YWluZWQiIGluIG1lbW9yeSwgYnV0IGV4cGlyZWQpLiAiVmFs aWQiIHRvIG1lIHNlZW1zIGxlc3MgYW1iaWd1b3VzLiBJIHdvdWxkIGV4cGVjdCBpbXBsZW1lbnRh dGlvbnMgdG8gaGF2ZSBhIHdheSB0byBtYXJrIHRva2VuIGFzIHZhbGlkIG9yIG5vbiB2YWxpZCAo ZS5nLiBpZiBleHBpcmVkIG9yIHJldm9rZWQpLiBXaGF0IHdvdWQgYmUgZGlmZmljdWx0IGZvciBp bXBsZW1lbnRhdGlvbnMgdG8gYXNzZXJ0IHZhbGlkaXR5Pw0KKiBJbiB0aGUgc2Vjb25kIHBhcmFn cmFwaCwgSSBzdWdnZXN0IHRvIGV4dGVuZCB0aGUgZW5kaW5nIGFzOg0KDQogICIuLi4gbWFrZXMg c3VyZSB0aGF0IGl0IGRvZXMgbm90IGNvbGxpZGUgd2l0aCBhbnkgb2YgaXRzIFJlY2lwaWVudCBJ RHMNCmN1cnJlbnRseSB1c2VkLiBUaGVzZSBpbmNsdWRlIGFsc28gUmVjaXBpZW50IElEcyB1c2Vk IGFzIElEMSB2YWx1ZSBmb3INCm9uZ29pbmcgZXhlY3V0aW9ucyBvZiB0aGlzIHByb2ZpbGUuIg0K DQpGUDogR29vZCBwb2ludCwgSSB0aGluayBJIGdvdCBpdC4gUmVwaHJhc2VkIGl0IHdpdGggIiBu b3Igd2l0aCBhbnkgb3RoZXIgaWRlbnRpZmllciBJRDEgaWYgdGhlIGNsaWVudCBpcyBleGVjdXRp bmcgdGhpcyBleGNoYW5nZSB3aXRoIGEgZGlmZmVyZW50IFJTIGF0IHRoZSBzYW1lIHRpbWUuIg0K KiBzL3RoZSBjbGllbnQgTVVTVCB3cmFwIHRoZSB0b2tlbiBhbmQgTjEgaW4gYSBDQk9SIG1hcC90 aGUgY2xpZW50IE1VU1QNCndyYXAgdGhlIHRva2VuLCBOMSBhbmQgSUQxIGluIGEgQ0JPUiBtYXAN CkZQOiBPaywgZml4ZWQuDQoNCiogcy91c2luZyB0aGUgImFjY2Vzc190b2tlbiIgcGFyYW1ldGVy L3VzaW5nIHRoZSAnYWNjZXNzX3Rva2VuJyBwYXJhbWV0ZXINCg0KRlA6IE9rLCBmaXhlZC4NCg0K KiBJbiB0aGUgc2l4dGggcGFyYWdyYXBoLCB0aGUgbGFzdCBzZW50ZW5jZSBzYXlzICIuLi4gYXMg ZGlmZmVyZW50DQpub25jZXMgd2lsbCBiZSB1c2VkLiIgRG9lc24ndCB0aGUgY2xpZW50IGFuZCB0 aGUgUlMgYWxzbyBuZWdvdGlhdGUgbmV3DQpJRHMgbGlrZSB0aGV5IGRpZCBpbiB0aGUgZmlyc3Qg cG9zdGluZyBvZiB0aGUgc2FtZSBvcmlnaW5hbCB0b2tlbj8NCg0KRlA6IHllcywgYnV0IHRoZSBj bGllbnQgbWlnaHQgZGVjaWRlIHRvIHJldXNlIHRoZSBzYW1lIElELCBJIGRvbid0IHJlYWxseSBz ZWUgYSBwcm9ibGVtIHdpdGggdGhhdC4NCg0KKiBJbiB0aGUgbGFzdCBwYXJhZ3JhcGg6ICJUaGUg Y2xpZW50IE1VU1Qgb25seSBzZW5kIHRoZSBhY2Nlc3MgdG9rZW4gaW4NCnRoZSBwYXlsb2FkLCBu byBub25jZSBvciBpZGVudGlmaWVyIGFyZSBzZW50LiINCg0KICAgSnVzdCB0byBiZSBzdXJlLCBj YW4geW91IGV4cGFuZCBvbiB0aGlzIHJlcXVlc3QgZm9ybWF0PyBJIHN1cHBvc2UgdGhlDQpjbGll bnQgc3RpbGwgdXNlcyBDb250ZW50LUZvcm1hdCAiYXBwbGljYXRpb24vYWNlK2Nib3IiLCBqdXN0 IGluY2x1ZGluZw0Kb25seSB0aGUgJ2FjY2Vzc190b2tlbicgZW50cnkgaW4gdGhlIG1hcC4gQ29y cmVjdD8NCg0KRlA6IFllcyB0aGF0IGlzIGNvcnJlY3QuIFRoZSByZXF1ZXN0IGlzIHRoZSBzYW1l IGFzIGluIEZpZ3VyZSAxMCB3aXRoIHRoZSBleGNlcHRpb24gdGhhdCBpdCBpcyBwcm90ZWN0ZWQg d2l0aCBPU0NPUkUgYW5kIHRoYXQgbm8gbm9uY2Ugbm9yIGlkcyBhcmUgc2VudC4NCg0KKiBJbiB0 aGUgbGFzdCBwYXJhZ3JhcGg6ICIuLi4gdGhlIFJTIHdpbGwgcmVwbGFjZSB0aGUgb2xkIHRva2Vu IHdpdGggdGhlDQpuZXcgb25lLCBtYWludGFpbmluZyB0aGUgc2FtZSBTZWN1cml0eSBDb250ZXh0 LiINCg0KICAgVGhpcyByZXBsYWNlbWVudCBzdGVwIGNhbiBiZSBleHBhbmRlZCBmb3IgY2xhcml0 eS4gQSBzaW1wbGUgMS10by0xDQpyZXBsYWNlbWVudCB3b3VsZCBvdmVyd3JpdGUgYWxzbyB0aGUg c3RvcmVkICdjbmYnIGNsYWltIGZyb20gdGhlDQpvcmlnaW5hbCB0b2tlbiwgYW1vbmcgb3RoZXIg dGhpbmdzLiBTbyBpdCBzaG91bGQgYmUgbW9yZSBhYm91dA0Kc2VsZWN0aXZlbHkgcmVwbGFjaW5n IHNvbWUgaW5mb3JtYXRpb24gb3JpZ2luYWxseSBjb21pbmcgdGhlIGZpcnN0DQp0b2tlbiwgd2hp bGUga2VlcGluZyBzb21lIG90aGVyIGZyb20gaXQuIFdoYXQgdG8gYWN0dWFsbHkgcmVwbGFjZSBz aG91bGQNCmluY2x1ZGUsIGZvciBpbnN0YW5jZSwgaW5mb3JtYXRpb24gcmVsYXRlZCB0byBhY2Nl c3MgcmlnaHRzIChlLmcuDQpzY29wZSksIGFuZCB0byB0aGUgbmV3IHRva2VuJ3MgbGlmZXRpbWUg KGV4cCwgZXhpKS4NCg0KRlA6IEkgYmVsaWV2ZSB3aGF0IHlvdSB3ZXJlIGNvbW1lbnRpbmcgaGVy ZSAoaS5lLiB0aGUgUlMgYmVoYXZpb3IpIGlzIGFjdHVhbGx5IGRlc2NyaWJlZCBpbiBkZXRhaWxz IGluIHNlY3Rpb24gNC4yLCBzdGFydGluZyB3aXRoICJJZiB0aGUgUlMgcmVjZWl2ZXMgdGhlIHRv a2VuIGluIGEgT1NDT1JFIHByb3RlY3RlZCBtZXNzYWdlLi4uIi4gSSBvbmx5IHdhbnQgdG8gZ2l2 ZSB0aGUgaW50dWl0aW9uIGhlcmUsIGZvY3VzaW5nIG1vcmUgb24gdGhlIGNsaWVudCB3aXRob3V0 IGdvIGludG8gdGhlIGRldGFpbHMgb2Ygd2hhdCB0aGUgUlMgaGFzIHRvIGRvIGFzIGEgY29uc2Vx dWVuY2UsIHdoaWNoIGlzIHdoeSBJIGFtIHRlbXB0ZWQgdG8gbm90IG1ha2UgYSBjaGFuZ2UgaGVy ZS4gQnV0IGlmIHlvdSB0aGluayBzb21ldGhpbmcgaXMgbWlzc2luZyBmcm9tIDQuMiwgbGV0IG1l IGtub3cgYW5kIEknbGwgc2VlIGlmIHdlIGNhbiBleHBhbmQgdGhlcmUuDQoqIFdoaWxlIHJlYWRp bmcgdGhpcywgSSB3YXMgd29uZGVyaW5nIGlmIG9uZSBjb3VsZCByZXBvc3QgdGhlIHNhbWUgZmly c3QNCnRva2VuIHRvIHJla2V5IHRoZSBPU0NPUkUgY29udGV4dC4gVGhpcyBpcyBtZW50aW9uZWQg YXQgdGhlIGVuZCBvZg0KU2VjdGlvbiA0LjMsIGJ1dCBhbnRpY2lwYXRpbmcgdGhlIHBvc3NpYmls aXR5IGhlcmUgYW5kIGFkZGluZyBhIGZvcndhcmQNCnBvaW50ZXIgdG8gU2VjdGlvbiA0LjMgd291 bGQgaGVscC4NCg0KRlA6IEkgYWRkZWQgYSBwYXJhZ3JhcGggaW4gc2VjdGlvbiA0LjEgKHN0YXJ0 aW5nIHdpdGggIlRoZSBjbGllbnQgbWF5IGFsc28gY2hvc2UgdG8gcmUtUE9TVCB0aGUgYWNjZXNz IHRva2VuLi4uIikNCg0KU2VjdGlvbiA0LjEuMSBhbmQgU2VjdGlvbiA0LjEuMg0KDQoqIFRoZSBm aXJzdCBzZW50ZW5jZSBjYXB0dXJlcyB0aGUgY2FzZSB3aGVyZSB0aGUgZmlyc3QgdG9rZW4gaXMg cG9zdGVkDQpvciByZS1wb3N0ZWQuIEl0IGNhbiBiZSByZXBocmFzZWQgdG8gY292ZXIgYWxzbyB0 aGUgcG9zdGluZyBvZiBhIHRva2VuDQpmb3IgdXBkYXRpbmcgYWNjZXNzIHJpZ2h0cywgd2hlcmUg dGhlc2UgcGFyYW1ldGVycyBhcmUgbm90IGluY2x1ZGVkLg0KDQpGUDogT2ssIGFkZGVkIHRleHQg YXQgdGhlIGVuZCBvZiB0aGUgc2VudGVuY2UuDQoNClNlY3Rpb24gNC4yDQoNCiogImFueSBvZiB0 aGUgbWFuZGF0b3J5ICAgIHBhcmFtZXRlcnMgZnJvbSB0aGUgQVMgb3IgdGhlIGlkZW50aWZpZXIp IC4uLiINCg0KICAgSXQncyB3b3J0aCBtYWtpbmcgaXQgZXhwbGljaXQgdGhhdCB0aGUgbWVudGlv bmVkIGlkZW50aWZpZXIgaXMgJ2lkJy4NCg0KRlA6IEkgYWN0dWFsbHkgbWVhbnQgdGhlIGlkZW50 aWZpZXIgaWQxLiBBZGRlZCBpdC4NCg0KKiBzL2luIHRoZSAnb3NjJy9pbiB0aGUgJ29zYycgZmll bGQNCg0KRlA6IE9rLCBkb25lLg0KDQoqICIuLi4gdGhlIFJTIG11c3QgcmVzcG9uZCIgLS0tIFNo b3VsZCB0aGlzIG5vdCBiZSBhIE1VU1QgPw0KDQpGUDogTm8sIHRoaXMgcmVxdWlyZW1lbnQgY29t ZXMgZnJvbSB0aGUgZnJhbWV3b3JrLCBzbyBpdCBpcyBub24gbm9ybWF0aXZlICh0aGUgbm9ybWF0 aXZlIG9uZSBpcyAiVGhlIFJTIE1VU1QgZm9sbG93IHRoZSBwcm9jZWR1cmVzIGRlZmluZWQgaW4g c2VjdGlvbiA1LjguMSBvZg0KICAgW0ktRC5pZXRmLWFjZS1vYXV0aC1hdXRoel0iKQ0KKiBzL2lz IGRpZmZlcmVudCBmcm9tIHRoZSBhY2VfY2xpZW50X3JlY2lwaWVudGlkL2lzIGRpZmZlcmVudCBm cm9tIHRoZQ0KdmFsdWUgc3BlY2lmaWVkIGluIHRoZSByZWNlaXZlZCAnYWNlX2NsaWVudF9yZWNp cGllbnRpZCcgcGFyYW1ldGVyDQoNCkZQOiBPaywgZG9uZS4NCg0KKiBTZWNvbmQgcGFyYWdyYXBo IGFmdGVyIEZpZ3VyZSAxMQ0KDQogICAtIHMvTVVTVCBkaXNjYXJkL01VU1QgaWdub3JlDQoNCkZQ OiBPaywgZG9uZS4NCg0KICAgLSBzL3RoZSAiY25mIiBwYXJhbWV0ZXIgb2YvdGhlICdjbmYnIGNs YWltIG9mDQoNCkZQOiBPaywgZG9uZS4NCg0KICAgLSBzL21hdGNoZXMgdGhlIE9TQ09SRSBJbnB1 dC9tYXRjaGVzIHdpdGggdGhlIGlkZW50aWZpZXIgb2YgdGhlDQpPU0NPUkUgSW5wdXQNCg0KRlA6 IE9rLCBkb25lLg0KDQogICAtIFJlbGF0ZWQgdG8gYSBwcmV2aW91cyBjb21tZW50IGFib3V0IHRv a2VuIHJlcGxhY2VtZW50LCBzb21lDQppbmZvcm1hdGlvbiBoYXMgdG8gYmUgcmV0YWluZWQgZnJv bSB0aGUgZmlyc3QgdG9rZW4sIGFzIG5vdCBwcmVzZW50IGluDQp0aGUgbmV3IG9uZS4NCg0KRlA6 IEkgYW0gbm90IHN1cmUgaG93IHRvIGltcGxlbWVudCB0aGlzIGNvbW1lbnQgd2l0aG91dCBtYWtp bmcgaXQgdmVyeSBoYXJkIHRvIHJlYWQuIEkgdHJ1c3QgcmVhZGVycyBhdCB0aGlzIHBvaW50IHdp bGwgdW5kZXJzdGFuZCB3aGF0ICJkaXNjYXJkIHRoZSBvbGQgdG9rZW4gYW5kIGFzc29jaWF0ZSB0 aGUgbmV3IHRva2VuIiBtZWFucy4NCg0KICAgLXMvaW4gdGhlICJjbmYiIHBhcmFtZXRlci9pbiB0 aGUgJ2NuZicgY2xhaW0NCg0KRlA6IE9rLCBkb25lLg0KDQoqIEl0IGNhbiBoYXBwZW4gdGhhdCBh bGwgaXMgZmluZSBmb3IgdGhlIFJTLCBpdCBpbnN0YWxscyB0aGUgT1NDT1JFDQpTZWN1cml0eSBD b250ZXh0LCBpdCByZXNwb25kcyB0byB0aGUgY2xpZW50LCBhbmQgdGhlIHJlc3BvbnNlIGdldHMg bG9zdC4NCkluIHRoaXMgY2FzZToNCg0KICAgLSBBZnRlciBhIHRpbWVvdXQgZXhwaXJhdGlvbiwg Y2FuIHRoZSBjbGllbnQgc2ltcGx5IHJlcG9zdCB0aGUgc2FtZQ0KdG9rZW4gYXMgbWVudGlvbmVk IGF0IHRoZSBlbmQgb2YgU2VjdGlvbiA0LjM/IFRoaXMgY2FuIGJlIGFub3RoZXIgcmVhc29uDQpm b3IgcmVwb3N0aW5nIHRoZSBvcmlnaW5hbCB0b2tlbiwgdG8gbWVudGlvbiBpbiB0aGUgc2l4dGgg cGFyYWdyYXBoIG9mDQpTZWN0aW9uIDQuMS4NCg0KRlA6IFllcywgYWRkZWQuDQoNCiAgIC0gU2hv dWxkIHRoZSBzZXJ2ZXIgZGVsZXRlIHRoZSB0b2tlbiBhbmQgdGhlIE9TQ09SRSBTZWN1cml0eSBD b250ZXh0LA0KaWYgbm90IHJlY2VpdmluZyBhbiBPU0NPUkUgcHJvdGVjdGVkIHJlcXVlc3QgZnJv bSB0aGUgY2xpZW50IGJlZm9yZSBhDQp0aW1lb3V0IGV4cGlyZXM/IEFmdGVyIGFsbCwgaXQncyBy ZWFzb25hYmxlIHRvIGFzc3VtZSB0aGF0IGEgY2xpZW50DQpzZW5kcyBhIHJlcXVlc3QgcmlnaHQg YXdheSBvciBub3QgbG9uZyBhZnRlciB0aGUgdG9rZW4gcG9zdCBpcw0KY29tcGxldGVkLiBJZiB0 aGlzIGlzIGluY2x1ZGVkLCBpdCB3b3VsZCBiZSBvbmUgbW9yZSBwb2ludCBpbiB0aGUgYnVsbGV0 DQpsaXN0IGZvciB0aGUgUlMgaW4gU2VjdGlvbiA2Lg0KDQpGUDogSXQgaXMgcmVhc29uYWJsZSwg aG93ZXZlciBJIGRvbid0IHdhbnQgdG8gYWRkIGl0IHRvIFNlY3Rpb24gNiBhcyBJIGRvbid0IHdh bnQgdG8gbWFrZSBpdCBhIHJlcXVpcmVtZW50IHRvIHRoZSBSUy4gSXQgaXMgdXAgdG8gYXBwbGlj YXRpb25zIHRvIGRlZmluZSBwb2xpY2llcyBmb3Igc3VjaCBhIHRpbWVvdXQuIFdlIG1ha2UgaXQg Y2xlYXIgdGhhdCBpdCdzIG9ubHkgYWZ0ZXIgdGhlIGZpcnN0IE9TQ09SRSBleGNoYW5nZSBoYXMg aGFwcGVuZWQgdGhhdCBDIGFuZCBSUyBhcmUgYXNzdXJlIHRoYXQgdGhlIGV4Y2hhbmdlIHN1Y2Nl ZWRlZC4gSG93IGxvbmcgdG8gd2FpdCwgSSB0aGluayBzaG91bGQgYmUgb3V0IG9mIHNjb3BlLg0K DQpTZWN0aW9uIDQuMi4xIGFuZCA0LjIuMg0KDQoqIFRoZSBmaXJzdCBzZW50ZW5jZSBjYXB0dXJl cyB0aGUgY2FzZSB3aGVyZSB0aGUgZmlyc3QgdG9rZW4gaXMgcG9zdGVkDQpvciByZS1wb3N0ZWQu IEl0IGNhbiBiZSByZXBocmFzZWQgdG8gY292ZXIgYWxzbyB0aGUgcG9zdGluZyBvZiBhIHRva2Vu DQpmb3IgdXBkYXRpbmcgYWNjZXNzIHJpZ2h0cywgd2hlcmUgdGhlc2UgcGFyYW1ldGVycyBhcmUg bm90IGluY2x1ZGVkLg0KDQpGUDogT2ssIGRvbmUNCg0KU2VjdGlvbiA0LjMNCg0KKiBzL1NlY3Jl dCBmcm9tIHRoZSBwYXJhbWV0ZXIsIHJlY2VpdmVkL1NlY3JldCBmcm9tIHRoZSBwYXJhbWV0ZXIg cmVjZWl2ZWQNCg0KRlA6IE9rLCBkb25lDQoNCiogSWYgdGhlIGNsaWVudCBzdG9wcyB0aGUgZXhj aGFuZ2UsIGl0IHNob3VsZCBhbHNvIHVubG9jayB0aGUgSUQxIHZhbHVlDQpwcmV2aW91c2x5IG9m ZmVyZWQuDQoNCkZQOiBJIGJlbGlldmUgdGhpcyBpcyBpbXBsZW1lbnRhdGlvbiBkZXRhaWxzLiBJ IHRoaW5rIHRoaXMgc2hvdWxkIGJlIGNvdmVyZWQgYnkgdGhlIGNsYXJpZmljYXRpb25zIGFib3Zl Lg0KDQoqIHMvdG8gUlMvdG8gdGhlIFJTDQoNCkZQOiBPaywgZG9uZQ0KDQoqIFRoZSBlbmQgb2Yg dGhlIGxhc3QgcGFyYWdyYXBoIG1lbnRpb25zIHBvc3NpYmx5IHJlcG9zdGluZyB0aGUgc2FtZQ0K Zmlyc3QgdG9rZW4gdG8gcmVrZXkgdGhlIE9TQ09SRSBjb250ZXh0LiBDb25zaXN0ZW50bHkgd2l0 aCB0aGUgZm91cnRoDQpwYXJhZ3JhcGggb2YgU2VjdGlvbiA0LCBJIHN1Z2dlc3QgdG8gbWVudGlv biBoZXJlIGFnYWluIHRoYXQgdGhpcw0KcmVxdWVzdCBpcyBub3QgcHJvdGVjdGVkLCBzaW5jZSBu b3QgcmVsYXRlZCB0byB1cGRhdGluZyBhY2Nlc3MgcmlnaHRzLg0KDQpGUDogT2ssIGRvbmUNCg0K U2VjdGlvbiA1DQoNCiogcy9wcm9maWxlLCBvdGhlci9wcm9maWxlLCBidXQgb3RoZXINCg0KRlA6 IHMvLC87IGluc3RlYWQsIGJ1dCBkb25lDQoNClNlY3Rpb24gNg0KDQoqIHMvY29udGV4dCBleHBp cmVzL2NvbnRleHQgZXhwaXJlcyBvciBpcyByZXZva2VkICAgKDIgaW5zdGFuY2VzKQ0KDQpGUDog QWdhaW4sIEkgYW0gaGVzaXRhbnQgdG8gYWRkIHJldm9rZWQgaGVyZSwgYXMgdGhlIGZyYW1ld29y ayBiYXJlbHkgdG91Y2hlcyBvbiByZXZvY2F0aW9ucyBvZiB0b2tlbnMsIGFuZCBleHBsaWNpdGVs eSBzdGF0ZXMgdGhhdCBleHBpcmF0aW9uIGlzIHRoZSBub3JtIGluc3RlYWQuDQoNCiogSW4gdGhl IGZvdXJ0aCBidWxsZXQgcG9pbnQsIGlzbid0IHRoaXMgYWN0dWFsbHkgZmluZSBpZiB0aGUgcmVw b3N0ZWQNCnRva2VuIGlzIGV4YWN0bHkgdGhlIG9yaWdpbmFsIGZpcnN0IHRva2VuPyBJbiB0aGF0 IGNhc2UsIG5ldyBub25jZXMgKGFuZA0KSSBndWVzcyBhbHNvIElEcykgYXJlIGV4Y2hhbmdlZC4N Cg0KRlA6IFRoaXMgaXMgZmluZSwgYnV0IGl0IG1lYW5zIHRoZSBSUyBpcyB3aXNoaW5nIHRvIHJl LWRlcml2ZSBhIG5ldyBjb250ZXh0LCBzbyB0aGUgb2xkIG9uZSBtdXN0IGJlIGRpc2NhcmRlZC4N Cg0KKiBJIHRoaW5rIHRoZXJlIHNob3VsZCBiZSBvbmUgbW9yZSBidWxsZXQgcG9pbnQgaW4gdGhl IGNsaWVudCBsaXN0LCBmb3INCndoZW4gdGhlIGNsaWVudCByZWNlaXZlcyBiYWNrIElEMiA9PSBJ RDEgZnJvbSB0aGUgUlMsIGFmdGVyIGhhdmluZw0KcmVwb3N0ZWQgdGhlIG9yaWdpbmFsIGZpcnN0 IGFjY2VzcyB0b2tlbi4NCg0KKFRoaXMgcmVsYXRlcyB0byBhIHByZXZpb3VzIGNvbW1lbnQgZm9y IFNlY3Rpb24gNC4xOyBJIHRob3VnaHQgYQ0KcmVwb3N0aW5nIG9mIHRoZSBmaXJzdCBvcmlnaW5h bCB0b2tlbiBpbnZvbHZlcyBhbiBleGNoYW5nZSBvZiBuZXcgbm9uY2VzDQphcyB3ZWxsIGFzIG9m IG5ldyBJRHMpDQoNCkZQOiBXaHk/IEkgZG9uJ3QgdW5kZXJzdGFuZCB3aHkgdGhpcyBpcyBub3Qg YWxyZWFkeSBjb3ZlcmVkLiBBaCBvayBzbyBtYXliZSB0aGlzIGlzIG5vdCB2YWxpZCBhbnltb3Jl Pw0KDQpTZWN0aW9uIDcNCg0KKiBzL3VzZWNhc2UvdXNlIGNhc2UNCg0KRlA6IE9rLCBkb25lDQoN Ciogcy9mb3IgYSBjbGllbnQvZm9yIGEgc2FtZSBjbGllbnQgICAoMiBpbnN0YW5jZXMpDQoNCkZQ OiBPaywgZG9uZSAoSSBhbSBzdXJlIHRoZSBSRkNFZGl0b3Igd2lsbCBjaGFuZ2UgdGhpcyB0byBz b21ldGhpbmcgZWxzZSB0b28gOikgKQ0KDQoqIEkgdGhpbmsgaXQncyBiZXR0ZXIgdG8gZXhwYW5k IEMgYW5kIENzIHRvICJjbGllbnQiIGFuZCAiY2xpZW50cyINCg0KRlA6IE9rLCBkb25lDQoNCk9u IDIwMjAtMTEtMDggMjM6NTEsIERhbmllbCBNaWdhdWx0IHdyb3RlOg0KSGksDQoNClRoaXMgZW1h aWwgc3RhcnRzIGEgV0dMQyBmb3IgdGhlIGRyYWZ0IGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9m aWxlIHVudGlsIE1vbmRheSBOb3ZlbWJlciAyMy4gV2Ugd291bGQgbGlrZSB0byBzZW5kIHRoZSBk b2N1bWVudCBiYWNrIHRvIHRoZSBJRVNHIHdpdGggc3VmZmljaWVudCBjb25maWRlbmNlLCBzbyBw bGVhc2UgdGFrZSB0aGUgdGltZSB0byByZXZpZXcgaXQgY2FyZWZ1bGx5IHByb3ZpZGUgY29tbWVu dHMgYW5kIGZlZWQgYmFja3MuDQpOb3RlIHRoYXQgYWxzbyB0aGF0IHRoZSBkb2N1bWVudCAoMTMp IGlzIGJlaW5nIHJldmlld2VkIGJ5IHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZS4NCg0KWW91cnMs DQpEYW5pZWwNCg0KWzFdIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWll dGYtYWNlLW9zY29yZS1wcm9maWxlLzxodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3YxL3Vy bD9rPTU2MWI5NTFiLTA5ODBhYzJhLTU2MWJkNTgwLTg2ZTIyMzdmNTFmYi03ZThmZjBmMmI0NjAy NzdiJnE9MSZlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4MWNlNWFiOCZ1PWh0dHBzJTNB JTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20lMkYlM0Z1cmwlM0Ro dHRwcyUyNTNBJTI1MkYlMjUyRmRhdGF0cmFja2VyLmlldGYub3JnJTI1MkZkb2MlMjUyRmRyYWZ0 LWlldGYtYWNlLW9zY29yZS1wcm9maWxlJTI1MkYlMjZkYXRhJTNEMDQlMjU3QzAxJTI1N0NtYXJj by50aWxvY2ElMjU0MHJpLnNlJTI1N0MzMzAxODlkN2Q4MmI0OGRkMWU4ZTA4ZDg4NDM4ZjA0MyUy NTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglMjU3QzAlMjU3QzAlMjU3QzYzNzQw NDcyNzk4MDk3NDg0OCUyNTdDVW5rbm93biUyNTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpB d01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTI1M0QlMjU3 QzMwMDAlMjZzZGF0YSUzRERDemNPdVE3TW5CTHMwaHhpSGJJQWklMjUyQjFWakJITEJKUnppNE44 UDlWRFY0JTI1M0QlMjZyZXNlcnZlZCUzRDA+DQoNCi0tLS0tLS0tLS0gRm9yd2FyZGVkIG1lc3Nh Z2UgLS0tLS0tLS0tDQpGcm9tOiA8aW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPG1haWx0bzppbnRl cm5ldC1kcmFmdHNAaWV0Zi5vcmc+Pg0KRGF0ZTogVHVlLCBPY3QgMjcsIDIwMjAgYXQgMTI6MTQg UE0NClN1YmplY3Q6IFtBY2VdIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9m aWxlLTEzLnR4dA0KVG86IDxpLWQtYW5ub3VuY2VAaWV0Zi5vcmc8bWFpbHRvOmktZC1hbm5vdW5j ZUBpZXRmLm9yZz4+DQpDYzogPGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPj4NCg0K DQoNCkEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBvbi1saW5lIElu dGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy4NClRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2Yg dGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZp cm9ubWVudHMgV0cgb2YgdGhlIElFVEYuDQoNCiAgICAgICAgVGl0bGUgICAgICAgICAgIDogT1ND T1JFIFByb2ZpbGUgb2YgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvciBD b25zdHJhaW5lZCBFbnZpcm9ubWVudHMgRnJhbWV3b3JrDQogICAgICAgIEF1dGhvcnMgICAgICAg ICA6IEZyYW5jZXNjYSBQYWxvbWJpbmkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgTHVkd2ln IFNlaXR6DQogICAgICAgICAgICAgICAgICAgICAgICAgIEfDtnJhbiBTZWxhbmRlcg0KICAgICAg ICAgICAgICAgICAgICAgICAgICBNYXJ0aW4gR3VubmFyc3Nvbg0KICAgICAgICBGaWxlbmFtZSAg ICAgICAgOiBkcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xMy50eHQNCiAgICAgICAgUGFn ZXMgICAgICAgICAgIDogMzINCiAgICAgICAgRGF0ZSAgICAgICAgICAgIDogMjAyMC0xMC0yNw0K DQpBYnN0cmFjdDoNCiAgIFRoaXMgbWVtbyBzcGVjaWZpZXMgYSBwcm9maWxlIGZvciB0aGUgQXV0 aGVudGljYXRpb24gYW5kDQogICBBdXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9u bWVudHMgKEFDRSkgZnJhbWV3b3JrLiAgSXQNCiAgIHV0aWxpemVzIE9iamVjdCBTZWN1cml0eSBm b3IgQ29uc3RyYWluZWQgUkVTVGZ1bCBFbnZpcm9ubWVudHMNCiAgIChPU0NPUkUpIHRvIHByb3Zp ZGUgY29tbXVuaWNhdGlvbiBzZWN1cml0eSBhbmQgcHJvb2Ytb2YtcG9zc2Vzc2lvbg0KICAgZm9y IGEga2V5IG93bmVkIGJ5IHRoZSBjbGllbnQgYW5kIGJvdW5kIHRvIGFuIE9BdXRoIDIuMCBhY2Nl c3MgdG9rZW4uDQoNCg0KVGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMg ZHJhZnQgaXM6DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWFj ZS1vc2NvcmUtcHJvZmlsZS88aHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az01 NzdkYzgzMC0wOGU2ZjEwMS01NzdkODhhYi04NmUyMjM3ZjUxZmItMDg4MmYzMzdkYjJhNWI0YSZx PTEmZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00NzYzODFjZTVhYjgmdT1odHRwcyUzQSUyRiUy RmV1cjAyLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tJTJGJTNGdXJsJTNEaHR0cHMl MjUzQSUyNTJGJTI1MkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyNTJGZG9jJTI1MkZkcmFmdC1pZXRm LWFjZS1vc2NvcmUtcHJvZmlsZSUyNTJGJTI2ZGF0YSUzRDA0JTI1N0MwMSUyNTdDbWFyY28udGls b2NhJTI1NDByaS5zZSUyNTdDMzMwMTg5ZDdkODJiNDhkZDFlOGUwOGQ4ODQzOGYwNDMlMjU3QzVh OTgwOWNmMGJjYjQxM2E4MzhhMDllY2M0MGNjOWU4JTI1N0MwJTI1N0MwJTI1N0M2Mzc0MDQ3Mjc5 ODA5NzQ4NDglMjU3Q1Vua25vd24lMjU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFp TENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUyNTNEJTI1N0MzMDAw JTI2c2RhdGElM0REQ3pjT3VRN01uQkxzMGh4aUhiSUFpJTI1MkIxVmpCSExCSlJ6aTROOFA5VkRW NCUyNTNEJTI2cmVzZXJ2ZWQlM0QwPg0KDQpUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9u cyBhdmFpbGFibGUgYXQ6DQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1h Y2Utb3Njb3JlLXByb2ZpbGUtMTM8aHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/ az03NjE0OGRiNy0yOThmYjQ4Ni03NjE0Y2QyYy04NmUyMjM3ZjUxZmItNmRiN2E4NmMxYWYzOGUw MCZxPTEmZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00NzYzODFjZTVhYjgmdT1odHRwcyUzQSUy RiUyRmV1cjAyLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tJTJGJTNGdXJsJTNEaHR0 cHMlMjUzQSUyNTJGJTI1MkZ0b29scy5pZXRmLm9yZyUyNTJGaHRtbCUyNTJGZHJhZnQtaWV0Zi1h Y2Utb3Njb3JlLXByb2ZpbGUtMTMlMjZkYXRhJTNEMDQlMjU3QzAxJTI1N0NtYXJjby50aWxvY2El MjU0MHJpLnNlJTI1N0MzMzAxODlkN2Q4MmI0OGRkMWU4ZTA4ZDg4NDM4ZjA0MyUyNTdDNWE5ODA5 Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglMjU3QzAlMjU3QzAlMjU3QzYzNzQwNDcyNzk4MDk4 NDg0MiUyNTdDVW5rbm93biUyNTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pR SWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTI1M0QlMjU3QzMwMDAlMjZz ZGF0YSUzRE9heEpJQ0w2QnAlMjUyRnp0NURNd1VXY3YwNHlVMDdKa3ZFSUxDTnkxN01vcXJvJTI1 M0QlMjZyZXNlcnZlZCUzRDA+DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1s L2RyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLTEzPGh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5 ZS5jb20vdjEvdXJsP2s9NmEwNmQwYTUtMzU5ZGU5OTQtNmEwNjkwM2UtODZlMjIzN2Y1MWZiLTYx ZGI0OTBiOGM5OTA3ZmEmcT0xJmU9NTBlNDA0ZDUtODc3MC00Y2QzLWJkNDEtNDc2MzgxY2U1YWI4 JnU9aHR0cHMlM0ElMkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbSUy RiUzRnVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMjUyRmRv YyUyNTJGaHRtbCUyNTJGZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTMlMjZkYXRhJTNE MDQlMjU3QzAxJTI1N0NtYXJjby50aWxvY2ElMjU0MHJpLnNlJTI1N0MzMzAxODlkN2Q4MmI0OGRk MWU4ZTA4ZDg4NDM4ZjA0MyUyNTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglMjU3 QzAlMjU3QzAlMjU3QzYzNzQwNDcyNzk4MDk4NDg0MiUyNTdDVW5rbm93biUyNTdDVFdGcGJHWnNi M2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxD SlhWQ0k2TW4wJTI1M0QlMjU3QzMwMDAlMjZzZGF0YSUzRDdBYzZVZHJiSDZJQkljbTIlMjUyQllX ZDRpd3Vmd0libHY3Nk5xNFZyZXRKWnV3JTI1M0QlMjZyZXNlcnZlZCUzRDA+DQoNCkEgZGlmZiBm cm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBhdDoNCmh0dHBzOi8vd3d3Lmll dGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xMzxodHRw czovL3Byb3RlY3QyLmZpcmVleWUuY29tL3YxL3VybD9rPTcxNTk0YzNkLTJlYzI3NTBjLTcxNTkw Y2E2LTg2ZTIyMzdmNTFmYi1mMGM5ZTAzMzQwMmFkMjAwJnE9MSZlPTUwZTQwNGQ1LTg3NzAtNGNk My1iZDQxLTQ3NjM4MWNlNWFiOCZ1PWh0dHBzJTNBJTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20lMkYlM0Z1cmwlM0RodHRwcyUyNTNBJTI1MkYlMjUyRnd3dy5pZXRm Lm9yZyUyNTJGcmZjZGlmZiUyNTNGdXJsMiUyNTNEZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2Zp bGUtMTMlMjZkYXRhJTNEMDQlMjU3QzAxJTI1N0NtYXJjby50aWxvY2ElMjU0MHJpLnNlJTI1N0Mz MzAxODlkN2Q4MmI0OGRkMWU4ZTA4ZDg4NDM4ZjA0MyUyNTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEw OWVjYzQwY2M5ZTglMjU3QzAlMjU3QzAlMjU3QzYzNzQwNDcyNzk4MDk5NDg0MCUyNTdDVW5rbm93 biUyNTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENK QlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTI1M0QlMjU3QzMwMDAlMjZzZGF0YSUzRFIlMjUyQmo4 Y21QbnliOERVRWN5Z0N6aE9wQ0pCcVFiUzhnRGFsd1NzVlp0ZGt3JTI1M0QlMjZyZXNlcnZlZCUz RDA+DQoNCg0KUGxlYXNlIG5vdGUgdGhhdCBpdCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVz IGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lvbg0KdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24g YW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZzxodHRwczovL3Byb3RlY3Qy LmZpcmVleWUuY29tL3YxL3VybD9rPWNhMGM2YTc0LTk1OTc1MzQ1LWNhMGMyYWVmLTg2ZTIyMzdm NTFmYi1mOGIzNDYxOWY2ZDMxYTBhJnE9MSZlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4 MWNlNWFiOCZ1PWh0dHBzJTNBJTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9v ay5jb20lMkYlM0Z1cmwlM0RodHRwJTI1M0ElMjUyRiUyNTJGdG9vbHMuaWV0Zi5vcmclMjUyRiUy NmRhdGElM0QwNCUyNTdDMDElMjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3 ZDgyYjQ4ZGQxZThlMDhkODg0MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBj YzllOCUyNTdDMCUyNTdDMCUyNTdDNjM3NDA0NzI3OTgwOTk0ODQwJTI1N0NVbmtub3duJTI1N0NU V0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklr MWhhV3dpTENKWFZDSTZNbjAlMjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEcGVjMENsT01QSGolMjUy QnNIYSUyNTJCeURCRk92RGo5MGFQd2xjRVVSQ2NRSTZpZ3hJJTI1M0QlMjZyZXNlcnZlZCUzRDA+ Lg0KDQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAg YXQ6DQpmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLzxodHRwczovL3Byb3RlY3Qy LmZpcmVleWUuY29tL3YxL3VybD9rPWVjMTgxYTQwLWIzODMyMzcxLWVjMTg1YWRiLTg2ZTIyMzdm NTFmYi0wYzgwMTJlZmZlOWY4Y2Y4JnE9MSZlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4 MWNlNWFiOCZ1PWh0dHBzJTNBJTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9v ay5jb20lMkYlM0Z1cmwlM0RmdHAlMjUzQSUyNTJGJTI1MkZmdHAuaWV0Zi5vcmclMjUyRmludGVy bmV0LWRyYWZ0cyUyNTJGJTI2ZGF0YSUzRDA0JTI1N0MwMSUyNTdDbWFyY28udGlsb2NhJTI1NDBy aS5zZSUyNTdDMzMwMTg5ZDdkODJiNDhkZDFlOGUwOGQ4ODQzOGYwNDMlMjU3QzVhOTgwOWNmMGJj YjQxM2E4MzhhMDllY2M0MGNjOWU4JTI1N0MwJTI1N0MwJTI1N0M2Mzc0MDQ3Mjc5ODEwMDQ4MzQl MjU3Q1Vua25vd24lMjU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lW Mmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUyNTNEJTI1N0MzMDAwJTI2c2RhdGEl M0RBSmhOZU1Vcnd1R1duS2s3T2F6bzRqRnhtMGdYMXQ3aE1jSTlJdlJJUUNrJTI1M0QlMjZyZXNl cnZlZCUzRDA+DQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBpZXRmLm9yZzxtYWlsdG86QWNlQGlldGYub3Jn Pg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2U8aHR0cHM6Ly9wcm90 ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az04YzYzZjNmOC1kM2Y4Y2FjOS04YzYzYjM2My04NmUy MjM3ZjUxZmItMTJmMTk4ZjdmNGVhZWEzOCZxPTEmZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00 NzYzODFjZTVhYjgmdT1odHRwcyUzQSUyRiUyRmV1cjAyLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tJTJGJTNGdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cuaWV0Zi5vcmclMjUy Rm1haWxtYW4lMjUyRmxpc3RpbmZvJTI1MkZhY2UlMjZkYXRhJTNEMDQlMjU3QzAxJTI1N0NtYXJj by50aWxvY2ElMjU0MHJpLnNlJTI1N0MzMzAxODlkN2Q4MmI0OGRkMWU4ZTA4ZDg4NDM4ZjA0MyUy NTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglMjU3QzAlMjU3QzAlMjU3QzYzNzQw NDcyNzk4MTAwNDgzNCUyNTdDVW5rbm93biUyNTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpB d01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTI1M0QlMjU3 QzMwMDAlMjZzZGF0YSUzRHdNZHRKUmZpV3VyMmRYWFp3OHo4NHVzQVg3UDl2SGN2aEd5JTI1MkJQ TkhlRFZnJTI1M0QlMjZyZXNlcnZlZCUzRDA+DQoNCg0KLS0NCkRhbmllbCBNaWdhdWx0DQpFcmlj c3Nvbg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCg0KQWNlIG1haWxpbmcgbGlzdA0KDQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRmLm9y Zz4NCg0KaHR0cHM6Ly9ldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWNlJmFt cDtkYXRhPTA0JTdDMDElN0NtYXJjby50aWxvY2ElNDByaS5zZSU3QzMzMDE4OWQ3ZDgyYjQ4ZGQx ZThlMDhkODg0MzhmMDQzJTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglN0MwJTdD MCU3QzYzNzQwNDcyNzk4MTAyNDgxOCU3Q1Vua25vd24lN0NUV0ZwYkdac2IzZDhleUpXSWpvaU1D NHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlM0Ql N0MzMDAwJmFtcDtzZGF0YT1TbHBlY3VpRFh3Z29FNW9nTDhqU3F0VU83elZ1dDdkcjFxNlZYWDh5 OVo4JTNEJmFtcDtyZXNlcnZlZD0wPGh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdjEvdXJs P2s9MWIzYTY3MDctNDRhMTVlMzYtMWIzYTI3OWMtODZlMjIzN2Y1MWZiLWEzMjcyYTNjZDQ2MTRi ZjgmcT0xJmU9NTBlNDA0ZDUtODc3MC00Y2QzLWJkNDEtNDc2MzgxY2U1YWI4JnU9aHR0cHMlM0El MkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbSUyRiUzRnVybCUzRGh0 dHBzJTI1M0ElMjUyRiUyNTJGd3d3LmlldGYub3JnJTI1MkZtYWlsbWFuJTI1MkZsaXN0aW5mbyUy NTJGYWNlJTI2YW1wJTNCZGF0YSUzRDA0JTI1N0MwMSUyNTdDbWFyY28udGlsb2NhJTI1NDByaS5z ZSUyNTdDMzMwMTg5ZDdkODJiNDhkZDFlOGUwOGQ4ODQzOGYwNDMlMjU3QzVhOTgwOWNmMGJjYjQx M2E4MzhhMDllY2M0MGNjOWU4JTI1N0MwJTI1N0MwJTI1N0M2Mzc0MDQ3Mjc5ODEwMjQ4MTglMjU3 Q1Vua25vd24lMjU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1 TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUyNTNEJTI1N0MzMDAwJTI2YW1wJTNCc2Rh dGElM0RTbHBlY3VpRFh3Z29FNW9nTDhqU3F0VU83elZ1dDdkcjFxNlZYWDh5OVo4JTI1M0QlMjZh bXAlM0JyZXNlcnZlZCUzRDA+DQoNCg0KDQotLQ0KDQpNYXJjbyBUaWxvY2ENCg0KUGguRC4sIFNl bmlvciBSZXNlYXJjaGVyDQoNCg0KDQpSSVNFIFJlc2VhcmNoIEluc3RpdHV0ZXMgb2YgU3dlZGVu DQoNCkRpdmlzaW9uIElDVA0KDQpJc2Fmam9yZHNnYXRhbiAyMiAvIEtpc3RhZ8OlbmdlbiAxNg0K DQpTRS0xNjQgNDAgS2lzdGEgKFN3ZWRlbikNCg0KDQoNClBob25lOiArNDYgKDApNzAgNjAgNDYg NTAxDQoNCmh0dHBzOi8vd3d3LnJpLnNlPGh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdjEv dXJsP2s9MWVkNjViYzAtNDE0ZDYyZjEtMWVkNjFiNWItODZlMjIzN2Y1MWZiLWFmMjNhOTFmNjZm MjhiZjkmcT0xJmU9NTBlNDA0ZDUtODc3MC00Y2QzLWJkNDEtNDc2MzgxY2U1YWI4JnU9aHR0cHMl M0ElMkYlMkZ3d3cucmkuc2UlMkY+DQo= --_000_81EAD8CA2CFD429586B344C3B8676A27ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <3AD4665C6DA17D4C866EE50E6CF44119@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hh ciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnNwYW4uSFRNTFByZWZvcm1hdHRl ZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0K CWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSIgc3R5 bGU9IndvcmQtd3JhcDpicmVhay13b3JkIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPkhpIE1hcmNvLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5UaGFua3MsIHZlcnkgaGVscGZ1bCBhcyBhbHdheXMhIEkgaGF2 ZSBpbXBsZW1lbnRlZCBhbGwgdGhlIGNvbW1lbnRzIGluIHRoaXMgUFINCjxhIGhyZWY9Imh0dHBz Oi8vZ2l0aHViLmNvbS9hY2Utd2cvYWNlLW9zY29yZS1wcm9maWxlL3B1bGwvNDQiPmh0dHBzOi8v Z2l0aHViLmNvbS9hY2Utd2cvYWNlLW9zY29yZS1wcm9maWxlL3B1bGwvNDQ8L2E+ICwgaWYgeW91 IGdpdmUgbWUgdGhlIE9LIEkgY2FuIG1lcmdlIGFuZCB1cGxvYWQgYSBuZXcgc3VibWlzc2lvbi4g SGFwcHkgdG8gc2VlIHRoYXQgdGhlIGNvbW1lbnRzIHdlcmUgYWJvdXQgY2xhcmlmaWNhdGlvbnMg YW5kIGVkaXRvcmlhbHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPklubGluZSBkZXRhaWxlZCBhbnN3ZXJzLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5UaGFu a3MgYWdhaW4hPGJyPg0KRnJhbmNlc2NhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPk1hcmNvIFRpbG9jYSAmbHQ7bWFy Y28udGlsb2NhQHJpLnNlJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UaHVyc2RheSwgMTkgTm92ZW1i ZXIgMjAyMCBhdCAxNzowNDxicj4NCjxiPlRvOiA8L2I+Jmx0O2RyYWZ0LWlldGYtYWNlLW9zY29y ZS1wcm9maWxlQGlldGYub3JnJmd0OywgQWNlIFdnICZsdDthY2VAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDogPC9iPlJlOiBbQWNlXSBXR0xDIGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9m aWxlLTEzLnR4dDxicj4NCjxiPlJlc2VudCBmcm9tOiA8L2I+Jmx0O2FsaWFzLWJvdW5jZXNAaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+UmVzZW50IHRvOiA8L2I+RnJhbmNlc2NhIFBhbG9tYmluaSAmbHQ7 ZnJhbmNlc2NhLnBhbG9tYmluaUBlcmljc3Nvbi5jb20mZ3Q7LCAmbHQ7bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZSZndDssIEfDtnJhbiBTZWxhbmRlciAmbHQ7Z29yYW4uc2VsYW5kZXJAZXJpY3Nz b24uY29tJmd0OywgJmx0O21hcnRpbi5ndW5uYXJzc29uQHJpLnNlJmd0Ozxicj4NCjxiPlJlc2Vu dCBkYXRlOiA8L2I+VGh1LCAxOSBOb3YgMjAyMCAwODowMzo1NCAtMDgwMCAoUFNUKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpIZWxsbyBP U0NPUkUgcHJvZmlsZSBhdXRob3JzIGFuZCBBQ0UsPGJyPg0KPGJyPg0KUGxlYXNlLCBmaW5kIGJl bG93IHNvbWUgV0dMQyBjb21tZW50cy4gSG9wZSBpdCBoZWxwcyE8YnI+DQo8YnI+DQpCZXN0LDxi cj4NCi9NYXJjbzxicj4NCjxicj4NCjxicj4NCjxicj4NClNlY3Rpb24gMTxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFy Z2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0K PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvaXMgbm90IGRvbmUgYnkgYS9pcyBub3QgYWNoaWV2ZWQg dGhyb3VnaCBhPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0 O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZml4ZWQu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogcy9hZnRlciB0aGUgZmlyc3QgT1ND T1JFIGV4Y2hhbmdlL2FmdGVyIHRoZSBmaXJzdCBtZXNzYWdlIGV4Y2hhbmdlPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTtt YXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+ DQp1c2luZyBPU0NPUkU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBm aXhlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KU2VjdGlvbiAyPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogJnF1b3Q7VGhpcyBzcGVjaWZpYyBpZGVudGlmaWVy LCBlbmNvZGVkIGFzIGEgYnl0ZSBzdHJpbmcsIGlzIGFzc2lnbmVkIGJ5PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQp0 aGUgQVMgdG8gYmUgdW5pcXVlIGluIHRoZSBzZXRzIG9mIGl0cyBPU0NPUkUgU2VjdXJpdHkgQ29u dGV4dHMgLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206 MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyZu YnNwOyBUbyBhdm9pZCBjb25mdXNpb24sIGl0J3MgcHJvYmFibHkgYmV0dGVyIHRvIHNheSAmcXVv dDt1bmlxdWUgYW1vbmcgdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQppc3N1ZWQgc2V0cyBvZiBPU0NPUkUgaW5w dXQgbWF0ZXJpYWwmcXVvdDssIHNpbmNlIHRoZSBBUyBjYW4gaGF2ZSBhY3R1YWw8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNt O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0 Ij4NCk9TQ09SRSBTZWN1cml0eSBDb250ZXh0cyBpdCB1c2VzIHRvIGNvbW11bmljYXRlIHdpdGgg Q2xpZW50cyBvciBSZXNvdXJjZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KU2VydmVycy48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBmaXhlZC4gUmVwbGFjZWQgd2l0aCBPU0NPUkUgc2Vj dXJpdHkgaW5wdXQgbWF0ZXJpYWxzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiog UmVmZXJyaW5nIHRvICdpZCcgYXMgc3BlY2lmaWMgaWRlbnRpZmllciwgdGhlIHRleHQgc2F5czog JnF1b3Q7YW5kIGlzIG5vdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KdXNlZCBhcyBpbnB1dCBtYXRlcmlhbCB0byBk ZXJpdmUgdGhlIGZ1bGwgT1NDT1JFIFNlY3VyaXR5IENvbnRleHQuJnF1b3Q7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTtt YXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+ DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyZuYnNwOyBUaGF0J3MgY29ycmVjdCwgYnV0IHRo ZW4gdGhlIGlkZW50aWZpZXIgaXMgbGF0ZXIgaW5jbHVkZWQgaW4gVGFibGUgMTxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQi Pg0KJnF1b3Q7T1NDT1JFX0lucHV0X01hdGVyaWFsIFBhcmFtZXRlcnMmcXVvdDsgOi0pPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQombmJzcDsgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206 MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQombmJzcDsmbmJzcDsmbmJzcDtQZXJoYXBzIGl0 J3MgZmluZSB0byBqdXN0IHJldmVydCB0byBPU0NPUkVfU2VjdXJpdHlfQ29udGV4dF9PYmplY3Qs PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQpib3RoIGZvciB0aGUgbmFtZSBvZiBUYWJsZSAxIGFuZCBpbiBkaWZmZXJl bnQgc3BvdHMgb2YgdGhlIHRleHQ/IFRoZXk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCndvdWxkIHN0aWxsIGNvbnNp ZGVyICdpZCcgYXMgT1NDT1JFIElucHV0IE1hdGVyaWFsIElkZW50aWZpZXIsIHdoaWxlPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQphbGlnbmVkIHdpdGggdGhlIHJlZ2lzdHJ5IG5hbWUgZnJvbSBTZWN0aW9uIDkuNC48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IEkgc2VlIHlvdXIgcG9pbnQsIGJ1 dCB0aGUgbmFtZSB3YXMgc291cmNlIG9mIGRpc2N1c3Npb24gYmVmb3JlIGFuZCBJJ2QgcmF0aGVy IG5vdCBnbyBiYWNrIG9uIHRoYXQuIEkgZG9uJ3QgdGhpbmsgaXQgaXMgYSBwcm9ibGVtIHRoYXQg dGhlICdpZCcgaXMgYm90aCBwYXJ0IG9mIHRoZSAmcXVvdDtPU0NPUkVfSW5wdXRfTWF0ZXJpYWwm cXVvdDsgb2JqZWN0IGFuZCBhbHNvIG5vdCBwYXJ0IG9mIHRoZSBhY3R1YWwgaW5wdXQgbWF0ZXJp YWwuIEFmdGVyIGFsbCBpdA0KIG5lZWRzIHRvIGJlIHBhcnQgb2YgdGhlIG9iamVjdCB0byBpZGVu dGlmeSBpdC4gV2hhdCBJIGRpZCBpcyB0byBjaGFuZ2UgaXRzIENCT1IgbGFiZWwgdGhvdWdoLCB0 byBoYXZlIGl0IGFzIDAsIHNpbmNlIEkgdGhpbmsgdGhhdCBtYWtlcyBtb3JlIHNlbnNlIHRoYXQg dG8gYmUgaW4gdGhlIG1pZGRsZSBvZiBvdGhlciBpbnB1dCBtYXRlcmlhbHMuIE5vdGUgdGhhdCB0 aGlzIGlzIGEgY2hhbmdlIHRoYXQgd2lsbCBhZmZlY3QgaW1wbGVtZW50YXRpb25zLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvSWYgdGhlIHJlcXVlc3QgdmVyaWZpZXMvSWYg dGhlIHJlcXVlc3QgaXMgc3VjY2Vzc2Z1bGx5IHZlcmlmaWVkPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZml4ZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNt O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0 Ij4NCiogcy91bnRpbCB0b2tlbiBleHBpcmF0aW9uL3VudGlsIHRva2VuIGRlbGV0aW9uLCBkdWUg dG8gZS5nLiBleHBpcmF0aW9uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpvciByZXZvY2F0aW9uPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTtt YXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+ DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiB0aGFua3MgZm9yIHRoaXMgY29tbWVudC4gSSBkaWQg b25seSBrZWVwIGV4cGlyYXRpb24gYXMgZXhhbXBsZSw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoz Ni4wcHQiPg0KKiBzL3RoZSBzYW1lIG9yIGRpZmZlcmVudC90aGUgc2FtZSBvciBhIGRpZmZlcmVu dCBvbmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBmaXhlZC48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBGaWd1cmUgMSBjYW4gYWxzbyBzaG93IHRo ZSBhY2hpZXZlbWVudCBvZiBtdXR1YWwgYXV0aGVudGljYXRpb24sPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4t cmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpmb2xs b3dpbmcgdGhlIE9TQ09SRSBleGNoYW5nZSBhdCB0aGUgZW5kPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCkZQOiBHb29kIHBvaW50LCBhZGRlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpTZWN0aW9uIDMuMTxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFy Z2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0K PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvb2JqZWN0LiBraWQgZmllbGQgY2Fycnlpbmcvb2JqZWN0 LCB3aXRoIHRoZSBraWQgZmllbGQgY2Fycnlpbmc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KRlA6IE9rLCBmaXhlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KU2Vj dGlvbiAzLjI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiAmcXVvdDsuLi4gcHJv ZmlsZSBuZWdvdGlhdGlvbiBjYW4gYmUgb21pdHRlZCZxdW90OyAtIEkgdGhpbmsgJnF1b3Q7cHJv ZmlsZSBzaWduYWxpbmcmcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCmJldHRlciByZWZsZWN0cyB3aGF0IG1h eSBoYXBwZW4gaGVyZSwgc2VlIGFsc28gdGhlIGJlZ2lubmluZyBvZiB0aGU8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CnBhcmFncmFwaC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBmaXhl ZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2lu LWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBzL2luIHRoZSB0aGUvaW4gdGhl PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZml4ZWQuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogcy9pbiB0aGUgJ2NuZicgcGFyYW1ldGVyIG9mIHRo ZSB0b2tlbi9pbiB0aGUgJ2NuZicgY2xhaW0gb2YgdGhlIHRva2VuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4t cmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2lu LWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZml4ZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NClNlY3Rpb24gMy4yLjE8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBJ biB0aGUgdGV4dCBlbnRyaWVzIGZvbGxvd2luZyBUYWJsZSAxLCB0aGUgQ0JPUiBpbnRlZ2VyIGxh YmVscyBuZWVkIHRvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpiZSBhbGlnbmVkIHdpdGggdGhlIENEREwgc3VtbWFy eSBhdCB0aGUgZW5kIG9mIHRoZSBzZWN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQpGUDogSSB0aGluayBpdCB3YXM/IE5vdyBJIG1vdmVkIGlkIHRvIGluZGV4IDAsIHNvIEkg c3dpdGNoZWQgdGhlIG9yZGVyIHRoZXJlIHRvby48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KKiBzL1RoaXMgcGFyYW1ldGVyIGlkZW50aWZpZXMgdGhlIE9TQ09SRV9JbnB1dF9NYXRl cmlhbC9UaGlzIHBhcmFtZXRlcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KaWRlbnRpZmllcyB0aGUgT1NDT1JFX0lu cHV0X01hdGVyaWFsIG9iamVjdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4t cmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDog SSB3aWxsIGxldCB0aGUgUkZDIGVkaXRvcnMgZGVjaWRlIG9uIHRoYXQgb25lIDopIERvbid0IHdh bnQgdG8gYmVjb21lIHRvbyB2ZXJib3NlIGlmIGl0J3Mgbm90IG5lZWRlZC48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDtt YXJnaW4tbGVmdDozNi4wcHQiPg0KKiBzL3RoZSAmcXVvdDtpZCZxdW90OyB0eXBlIGlzIGJ5dGUg c3RyaW5nL3RoZSAmcXVvdDtpZCZxdW90OyB0eXBlIGlzIGJzdHI8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1y aWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KRlA6IGFoLCBnb29kIHBvaW50LiBJIGFjdHVhbGx5IGNoYW5nZWQgYWxs IHRoZSBkZXNjcmlwdGlvbiB0byBleHRlbmQgdGhlIHR5cGUgKHNvIGJ5dGUgc3RyaW5nIGluc3Rl YWQgb2YgYnN0ciwgZXRjKSwgaW4gb3JkZXIgbm90IHRvIHVzZSBDRERMIGluIHRleHQuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogVGhpcyB2ZXJzaW9uIC0xMyBoYXMgcmVtb3Zl ZCAnY2xpZW50SWQnIGFuZCAnc2VydmVySWQnIGZyb20gVGFibGUgMTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KYW5k IHRodXMgYXMgY29kZSBwb2ludHMgZnJvbSB0aGUgJnF1b3Q7T1NDT1JFIFNlY3VyaXR5IENvbnRl eHQgUGFyYW1ldGVycyZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KcmVnaXN0cnkuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyBObyBzdHJvbmcgbmVlZCB0byBpbmNsdWRlIHRoZW0g YmFjaywgYnV0IGV2ZW4gaWYgdGhpcyBwcm9maWxlIGRvZXMgbm90PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4t cmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQp1c2Ug dGhlbSBhbmQgZG9lcyBub3Qgc2VuZCB0aGVtIG9uIHRoZSB3aXJlLCBJIHRoaW5rIHRoZXkgc3Rp bGwgYmVsb25nPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0 O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQp0byB0aGUgc2FtZSBuYW1lc3BhY2UsIHNpbmNlIHRoZXkg YXJlIGRlc2NyaXB0aXZlIG9mIGEgc2VjdXJpdHkgY29udGV4dDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJp Z2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KYW5kIGFy ZSBpbiBmYWN0IGFsc28gdXNlZCBhcyBpbnB1dCBtYXRlcmlhbCB0byBkZXJpdmUgaXQgOi0pPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBJIGFncmVlIHdpdGggdGhhdCwgYW5kIHRoaW5r IHRoZSBmaXJzdCBkcmFmdCB0byB1c2UgdGhlbSB3aWxsIHJlZ2lzdGVyIHRoZW0uIFRoZSByZWdp c3RyYXRpb24gb2YgdGhlIE9TQ09SRV9JbnB1dF9NYXRlcmlhbCBkb2VzIG5vdCBzcGVjaWZ5IGhv dyB0aGlzIG1hdGVyaWFsIGlzIHVzZWQsIHRoYXQgaXMgdXAgdG8gdGhlIGRyYWZ0IGRlc2NyaWJp bmcgdGhlIGRlcml2YXRpb24gcHJvY2Vzcywgc28gaXQgZG9lcyBub3QgbWFrZSBzZW5zZSB0bw0K IHJlZ2lzdGVyIHRoZW0gaGVyZSB3aXRob3V0IGV4cGxhaW5pbmcgdGhlIGRlcml2YXRpb24gcHJv Y2VzcyB1c2luZyB0aG9zZSBwYXJhbWV0ZXJzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQpTZWN0aW9uIDQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBzL3RoZSBS UyBhbmQgY2xpZW50IGF1dGhlbnRpY2F0ZXMgdGhlbXNlbHZlcy90aGUgUlMgYW5kIGNsaWVudDxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KYXV0aGVudGljYXRlIGVhY2ggb3RoZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KRlA6IE9rLCBmaXhlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBz L3N1Y2Nlc3NmdWxseSB2ZXJpZmllZCB0aGUgcmVzcG9uc2UgZnJvbSB0aGUgUlMvc3VjY2Vzc2Z1 bGx5IHZlcmlmaWVkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQphIHJlc3BvbnNlIGZyb20gdGhlIFJTIGFzIHByb3Rl Y3RlZCB3aXRoIHRoZSBlc3RhYmxpc2hlZCBPU0NPUkUgY29udGV4dDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjM2LjBwdCI+DQombmJzcDsmbmJzcDsgKHNpbWlsYXIgb2NjdXJyZW5jZXMgYXJlIGFs c28gbGF0ZXIgaW4gdGhlIHRleHQpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQ OiBPaywgZml4ZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NClNlY3Rpb24gNC4x PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogSW4gdGhlIGZpcnN0IHBhcmFncmFw aCwgSSBzdWdnZXN0IHRvIHJlcGhyYXNlIGFzICZxdW90O2FuZCB0aGUgcG9zdGVkPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQphY2Nlc3MgdG9rZW4gaXMgc3RpbGwgcmV0YWluZWQmcXVvdDsuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyBUaGF0IGRvZXNuJ3QgcmVxdWlyZSB0byBleHBsaWNp dGx5IG1lbnRpb24gJnF1b3Q7dmFsaWQmcXVvdDssIHNpbmNlIGFzc2VydGluZzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQi Pg0KZXNwZWNpYWxseSB2YWxpZGl0eSBjYW4gYmUgbm9uLXRyaXZpYWwgZm9yIHRoZSBjbGllbnQs IGUuZy4gaW4gY2FzZSBvZjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KVG9rZW4gcmV2b2NhdGlvbi48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNt O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0 Ij4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KJm5ic3A7Jm5ic3A7KHNpbWlsYXIgb2NjdXJyZW5jZXMgYXJlIGFs c28gbGF0ZXIgaW4gdGhlIHRleHQpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQ OiBJIGFtIG5vdCBzdXJlIGFib3V0IHRoaXMgb25lOiBJIGRvbid0IHRoaW5rIHRhbGtpbmcgYWJv dXQgJnF1b3Q7cmV0YWluaW5nJnF1b3Q7IGFuIGFjY2VzcyB0b2tlbiBpcyBwcmVjaXNlIGVub3Vn aCAoYSB0b2tlbiBtaWdodCBiZSAmcXVvdDtyZXRhaW5lZCZxdW90OyBpbiBtZW1vcnksIGJ1dCBl eHBpcmVkKS4gJnF1b3Q7VmFsaWQmcXVvdDsgdG8gbWUgc2VlbXMgbGVzcyBhbWJpZ3VvdXMuIEkg d291bGQgZXhwZWN0IGltcGxlbWVudGF0aW9ucyB0byBoYXZlIGEgd2F5IHRvIG1hcmsgdG9rZW4N CiBhcyB2YWxpZCBvciBub24gdmFsaWQgKGUuZy4gaWYgZXhwaXJlZCBvciByZXZva2VkKS4gV2hh dCB3b3VkIGJlIGRpZmZpY3VsdCBmb3IgaW1wbGVtZW50YXRpb25zIHRvIGFzc2VydCB2YWxpZGl0 eT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2lu LWxlZnQ6MzYuMHB0Ij4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBJbiB0aGUgc2Vjb25kIHBhcmFncmFwaCwg SSBzdWdnZXN0IHRvIGV4dGVuZCB0aGUgZW5kaW5nIGFzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQombmJzcDsgJnF1b3Q7Li4uIG1ha2VzIHN1cmUgdGhhdCBpdCBkb2VzIG5vdCBj b2xsaWRlIHdpdGggYW55IG9mIGl0cyBSZWNpcGllbnQgSURzPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpjdXJyZW50 bHkgdXNlZC4gVGhlc2UgaW5jbHVkZSBhbHNvIFJlY2lwaWVudCBJRHMgdXNlZCBhcyBJRDEgdmFs dWUgZm9yPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQpvbmdvaW5nIGV4ZWN1dGlvbnMgb2YgdGhpcyBwcm9maWxlLiZx dW90OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogR29vZCBwb2ludCwgSSB0 aGluayBJIGdvdCBpdC4gUmVwaHJhc2VkIGl0IHdpdGggJnF1b3Q7IG5vciB3aXRoIGFueSBvdGhl ciBpZGVudGlmaWVyIElEMSBpZiB0aGUgY2xpZW50IGlzIGV4ZWN1dGluZyB0aGlzIGV4Y2hhbmdl IHdpdGggYSBkaWZmZXJlbnQgUlMgYXQgdGhlIHNhbWUgdGltZS4mcXVvdDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KKiBzL3RoZSBjbGllbnQgTVVTVCB3cmFwIHRoZSB0b2tlbiBhbmQgTjEg aW4gYSBDQk9SIG1hcC90aGUgY2xpZW50IE1VU1Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCndyYXAgdGhlIHRva2Vu LCBOMSBhbmQgSUQxIGluIGEgQ0JPUiBtYXA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6 IE9rLCBmaXhlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBzL3VzaW5nIHRo ZSAmcXVvdDthY2Nlc3NfdG9rZW4mcXVvdDsgcGFyYW1ldGVyL3VzaW5nIHRoZSAnYWNjZXNzX3Rv a2VuJyBwYXJhbWV0ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBm aXhlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBJbiB0aGUgc2l4dGggcGFy YWdyYXBoLCB0aGUgbGFzdCBzZW50ZW5jZSBzYXlzICZxdW90Oy4uLiBhcyBkaWZmZXJlbnQ8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 MzYuMHB0Ij4NCm5vbmNlcyB3aWxsIGJlIHVzZWQuJnF1b3Q7IERvZXNuJ3QgdGhlIGNsaWVudCBh bmQgdGhlIFJTIGFsc28gbmVnb3RpYXRlIG5ldzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KSURzIGxpa2UgdGhleSBk aWQgaW4gdGhlIGZpcnN0IHBvc3Rpbmcgb2YgdGhlIHNhbWUgb3JpZ2luYWwgdG9rZW4/PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiB5ZXMsIGJ1dCB0aGUgY2xpZW50IG1pZ2h0 IGRlY2lkZSB0byByZXVzZSB0aGUgc2FtZSBJRCwgSSBkb24ndCByZWFsbHkgc2VlIGEgcHJvYmxl bSB3aXRoIHRoYXQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogSW4gdGhlIGxh c3QgcGFyYWdyYXBoOiAmcXVvdDtUaGUgY2xpZW50IE1VU1Qgb25seSBzZW5kIHRoZSBhY2Nlc3Mg dG9rZW4gaW48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCnRoZSBwYXlsb2FkLCBubyBub25jZSBvciBpZGVudGlmaWVy IGFyZSBzZW50LiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQombmJzcDsm bmJzcDsgSnVzdCB0byBiZSBzdXJlLCBjYW4geW91IGV4cGFuZCBvbiB0aGlzIHJlcXVlc3QgZm9y bWF0PyBJIHN1cHBvc2UgdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpjbGllbnQgc3RpbGwgdXNlcyBDb250ZW50 LUZvcm1hdCAmcXVvdDthcHBsaWNhdGlvbi9hY2UrY2JvciZxdW90OywganVzdCBpbmNsdWRpbmc8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCm9ubHkgdGhlICdhY2Nlc3NfdG9rZW4nIGVudHJ5IGluIHRoZSBtYXAuIENv cnJlY3Q/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBZZXMgdGhhdCBpcyBj b3JyZWN0LiBUaGUgcmVxdWVzdCBpcyB0aGUgc2FtZSBhcyBpbiBGaWd1cmUgMTAgd2l0aCB0aGUg ZXhjZXB0aW9uIHRoYXQgaXQgaXMgcHJvdGVjdGVkIHdpdGggT1NDT1JFIGFuZCB0aGF0IG5vIG5v bmNlIG5vciBpZHMgYXJlIHNlbnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiog SW4gdGhlIGxhc3QgcGFyYWdyYXBoOiAmcXVvdDsuLi4gdGhlIFJTIHdpbGwgcmVwbGFjZSB0aGUg b2xkIHRva2VuIHdpdGggdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpuZXcgb25lLCBtYWludGFpbmluZyB0aGUg c2FtZSBTZWN1cml0eSBDb250ZXh0LiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQombmJzcDsmbmJzcDsgVGhpcyByZXBsYWNlbWVudCBzdGVwIGNhbiBiZSBleHBhbmRlZCBm b3IgY2xhcml0eS4gQSBzaW1wbGUgMS10by0xPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpyZXBsYWNlbWVudCB3b3Vs ZCBvdmVyd3JpdGUgYWxzbyB0aGUgc3RvcmVkICdjbmYnIGNsYWltIGZyb20gdGhlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQpvcmlnaW5hbCB0b2tlbiwgYW1vbmcgb3RoZXIgdGhpbmdzLiBTbyBpdCBzaG91bGQgYmUg bW9yZSBhYm91dDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBw dDttYXJnaW4tbGVmdDozNi4wcHQiPg0Kc2VsZWN0aXZlbHkgcmVwbGFjaW5nIHNvbWUgaW5mb3Jt YXRpb24gb3JpZ2luYWxseSBjb21pbmcgdGhlIGZpcnN0PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6 MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQp0b2tlbiwgd2hp bGUga2VlcGluZyBzb21lIG90aGVyIGZyb20gaXQuIFdoYXQgdG8gYWN0dWFsbHkgcmVwbGFjZSBz aG91bGQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCmluY2x1ZGUsIGZvciBpbnN0YW5jZSwgaW5mb3JtYXRpb24gcmVs YXRlZCB0byBhY2Nlc3MgcmlnaHRzIChlLmcuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpzY29wZSksIGFuZCB0byB0 aGUgbmV3IHRva2VuJ3MgbGlmZXRpbWUgKGV4cCwgZXhpKS48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KRlA6IEkgYmVsaWV2ZSB3aGF0IHlvdSB3ZXJlIGNvbW1lbnRpbmcgaGVyZSAo aS5lLiB0aGUgUlMgYmVoYXZpb3IpIGlzIGFjdHVhbGx5IGRlc2NyaWJlZCBpbiBkZXRhaWxzIGlu IHNlY3Rpb24gNC4yLCBzdGFydGluZyB3aXRoICZxdW90O0lmIHRoZSBSUyByZWNlaXZlcyB0aGUg dG9rZW4gaW4gYSBPU0NPUkUgcHJvdGVjdGVkIG1lc3NhZ2UuLi4mcXVvdDsuIEkgb25seSB3YW50 IHRvIGdpdmUgdGhlIGludHVpdGlvbiBoZXJlLCBmb2N1c2luZyBtb3JlIG9uIHRoZSBjbGllbnQN CiB3aXRob3V0IGdvIGludG8gdGhlIGRldGFpbHMgb2Ygd2hhdCB0aGUgUlMgaGFzIHRvIGRvIGFz IGEgY29uc2VxdWVuY2UsIHdoaWNoIGlzIHdoeSBJIGFtIHRlbXB0ZWQgdG8gbm90IG1ha2UgYSBj aGFuZ2UgaGVyZS4gQnV0IGlmIHlvdSB0aGluayBzb21ldGhpbmcgaXMgbWlzc2luZyBmcm9tIDQu MiwgbGV0IG1lIGtub3cgYW5kIEknbGwgc2VlIGlmIHdlIGNhbiBleHBhbmQgdGhlcmUuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogV2hpbGUgcmVhZGluZyB0aGlzLCBJIHdhcyB3b25kZXJp bmcgaWYgb25lIGNvdWxkIHJlcG9zdCB0aGUgc2FtZSBmaXJzdDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJp Z2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KdG9rZW4g dG8gcmVrZXkgdGhlIE9TQ09SRSBjb250ZXh0LiBUaGlzIGlzIG1lbnRpb25lZCBhdCB0aGUgZW5k IG9mPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjM2LjBwdCI+DQpTZWN0aW9uIDQuMywgYnV0IGFudGljaXBhdGluZyB0aGUgcG9zc2li aWxpdHkgaGVyZSBhbmQgYWRkaW5nIGEgZm9yd2FyZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KcG9pbnRlciB0byBT ZWN0aW9uIDQuMyB3b3VsZCBoZWxwLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpG UDogSSBhZGRlZCBhIHBhcmFncmFwaCBpbiBzZWN0aW9uIDQuMSAoc3RhcnRpbmcgd2l0aCAmcXVv dDtUaGUgY2xpZW50IG1heSBhbHNvIGNob3NlIHRvIHJlLVBPU1QgdGhlIGFjY2VzcyB0b2tlbi4u LiZxdW90Oyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KU2VjdGlvbiA0LjEuMSBh bmQgU2VjdGlvbiA0LjEuMjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIFRoZSBm aXJzdCBzZW50ZW5jZSBjYXB0dXJlcyB0aGUgY2FzZSB3aGVyZSB0aGUgZmlyc3QgdG9rZW4gaXMg cG9zdGVkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQpvciByZS1wb3N0ZWQuIEl0IGNhbiBiZSByZXBocmFzZWQgdG8g Y292ZXIgYWxzbyB0aGUgcG9zdGluZyBvZiBhIHRva2VuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6 MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpmb3IgdXBkYXRp bmcgYWNjZXNzIHJpZ2h0cywgd2hlcmUgdGhlc2UgcGFyYW1ldGVycyBhcmUgbm90IGluY2x1ZGVk LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogT2ssIGFkZGVkIHRleHQgYXQg dGhlIGVuZCBvZiB0aGUgc2VudGVuY2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N ClNlY3Rpb24gNC4yPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogJnF1b3Q7YW55 IG9mIHRoZSBtYW5kYXRvcnkmbmJzcDsmbmJzcDsmbmJzcDsgcGFyYW1ldGVycyBmcm9tIHRoZSBB UyBvciB0aGUgaWRlbnRpZmllcikgLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NCiZuYnNwOyZuYnNwOyBJdCdzIHdvcnRoIG1ha2luZyBpdCBleHBsaWNpdCB0aGF0IHRo ZSBtZW50aW9uZWQgaWRlbnRpZmllciBpcyAnaWQnLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQpGUDogSSBhY3R1YWxseSBtZWFudCB0aGUgaWRlbnRpZmllciBpZDEuIEFkZGVkIGl0 LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvaW4gdGhlICdvc2MnL2luIHRo ZSAnb3NjJyBmaWVsZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6 MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogT2ssIGRv bmUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjM2LjBwdCI+DQombmJzcDsgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqICZxdW90Oy4uLiB0aGUgUlMg bXVzdCByZXNwb25kJnF1b3Q7IC0tLSBTaG91bGQgdGhpcyBub3QgYmUgYSBNVVNUID88bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE5vLCB0aGlzIHJlcXVpcmVtZW50IGNvbWVz IGZyb20gdGhlIGZyYW1ld29yaywgc28gaXQgaXMgbm9uIG5vcm1hdGl2ZSAodGhlIG5vcm1hdGl2 ZSBvbmUgaXMgJnF1b3Q7VGhlIFJTIE1VU1QgZm9sbG93IHRoZSBwcm9jZWR1cmVzIGRlZmluZWQg aW4gc2VjdGlvbiA1LjguMSBvZjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KJm5ic3A7Jm5ic3A7IFtJLUQuaWV0Zi1h Y2Utb2F1dGgtYXV0aHpdJnF1b3Q7KTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvaXMg ZGlmZmVyZW50IGZyb20gdGhlIGFjZV9jbGllbnRfcmVjaXBpZW50aWQvaXMgZGlmZmVyZW50IGZy b20gdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQp2YWx1ZSBzcGVjaWZpZWQgaW4gdGhlIHJlY2VpdmVkICdhY2Vf Y2xpZW50X3JlY2lwaWVudGlkJyBwYXJhbWV0ZXI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KRlA6IE9rLCBkb25lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4t cmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIFNl Y29uZCBwYXJhZ3JhcGggYWZ0ZXIgRmlndXJlIDExPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NCiZuYnNwOyZuYnNwOyAtIHMvTVVTVCBkaXNjYXJkL01VU1QgaWdub3JlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZG9uZS48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1y aWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNw OyA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2lu LWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyZuYnNwOyZuYnNwOy0gcy90aGUgJnF1b3Q7Y25mJnF1b3Q7 IHBhcmFtZXRlciBvZi90aGUgJ2NuZicgY2xhaW0gb2Y8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoz Ni4wcHQiPg0KRlA6IE9rLCBkb25lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQom bmJzcDsmbmJzcDsgLSBzL21hdGNoZXMgdGhlIE9TQ09SRSBJbnB1dC9tYXRjaGVzIHdpdGggdGhl IGlkZW50aWZpZXIgb2YgdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpPU0NPUkUgSW5wdXQ8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDtt YXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBkb25lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQombmJzcDsmbmJzcDsgLSBSZWxhdGVkIHRvIGEgcHJldmlvdXMgY29tbWVudCBh Ym91dCB0b2tlbiByZXBsYWNlbWVudCwgc29tZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KaW5mb3JtYXRpb24gaGFz IHRvIGJlIHJldGFpbmVkIGZyb20gdGhlIGZpcnN0IHRva2VuLCBhcyBub3QgcHJlc2VudCBpbjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KdGhlIG5ldyBvbmUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CkZQOiBJIGFtIG5vdCBzdXJlIGhvdyB0byBpbXBsZW1lbnQgdGhpcyBjb21tZW50IHdpdGhvdXQg bWFraW5nIGl0IHZlcnkgaGFyZCB0byByZWFkLiBJIHRydXN0IHJlYWRlcnMgYXQgdGhpcyBwb2lu dCB3aWxsIHVuZGVyc3RhbmQgd2hhdCAmcXVvdDtkaXNjYXJkIHRoZSBvbGQgdG9rZW4gYW5kIGFz c29jaWF0ZSB0aGUgbmV3IHRva2VuJnF1b3Q7IG1lYW5zLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KJm5ic3A7IDxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7LXMvaW4gdGhlICZxdW90O2NuZiZxdW90OyBw YXJhbWV0ZXIvaW4gdGhlICdjbmYnIGNsYWltPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNt O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0 Ij4NCkZQOiBPaywgZG9uZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRv bToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiZuYnNwOyA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1y aWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogSXQg Y2FuIGhhcHBlbiB0aGF0IGFsbCBpcyBmaW5lIGZvciB0aGUgUlMsIGl0IGluc3RhbGxzIHRoZSBP U0NPUkU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NClNlY3VyaXR5IENvbnRleHQsIGl0IHJlc3BvbmRzIHRvIHRoZSBj bGllbnQsIGFuZCB0aGUgcmVzcG9uc2UgZ2V0cyBsb3N0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KSW4gdGhpcyBj YXNlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQombmJzcDsmbmJzcDsgLSBBZnRl ciBhIHRpbWVvdXQgZXhwaXJhdGlvbiwgY2FuIHRoZSBjbGllbnQgc2ltcGx5IHJlcG9zdCB0aGUg c2FtZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KdG9rZW4gYXMgbWVudGlvbmVkIGF0IHRoZSBlbmQgb2YgU2VjdGlv biA0LjM/IFRoaXMgY2FuIGJlIGFub3RoZXIgcmVhc29uPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6 MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpmb3IgcmVwb3N0 aW5nIHRoZSBvcmlnaW5hbCB0b2tlbiwgdG8gbWVudGlvbiBpbiB0aGUgc2l4dGggcGFyYWdyYXBo IG9mPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjM2LjBwdCI+DQpTZWN0aW9uIDQuMS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KRlA6IFllcywgYWRkZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQombmJzcDsgPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQom bmJzcDsmbmJzcDsmbmJzcDstIFNob3VsZCB0aGUgc2VydmVyIGRlbGV0ZSB0aGUgdG9rZW4gYW5k IHRoZSBPU0NPUkUgU2VjdXJpdHkgQ29udGV4dCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207 bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCmlmIG5vdCByZWNlaXZp bmcgYW4gT1NDT1JFIHByb3RlY3RlZCByZXF1ZXN0IGZyb20gdGhlIGNsaWVudCBiZWZvcmUgYTxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KdGltZW91dCBleHBpcmVzPyBBZnRlciBhbGwsIGl0J3MgcmVhc29uYWJsZSB0 byBhc3N1bWUgdGhhdCBhIGNsaWVudDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0Kc2VuZHMgYSByZXF1ZXN0IHJpZ2h0 IGF3YXkgb3Igbm90IGxvbmcgYWZ0ZXIgdGhlIHRva2VuIHBvc3QgaXM8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCmNv bXBsZXRlZC4gSWYgdGhpcyBpcyBpbmNsdWRlZCwgaXQgd291bGQgYmUgb25lIG1vcmUgcG9pbnQg aW4gdGhlIGJ1bGxldDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KbGlzdCBmb3IgdGhlIFJTIGluIFNlY3Rpb24gNi48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KRlA6IEl0IGlzIHJlYXNvbmFibGUsIGhv d2V2ZXIgSSBkb24ndCB3YW50IHRvIGFkZCBpdCB0byBTZWN0aW9uIDYgYXMgSSBkb24ndCB3YW50 IHRvIG1ha2UgaXQgYSByZXF1aXJlbWVudCB0byB0aGUgUlMuIEl0IGlzIHVwIHRvIGFwcGxpY2F0 aW9ucyB0byBkZWZpbmUgcG9saWNpZXMgZm9yIHN1Y2ggYSB0aW1lb3V0LiBXZSBtYWtlIGl0IGNs ZWFyIHRoYXQgaXQncyBvbmx5IGFmdGVyIHRoZSBmaXJzdCBPU0NPUkUgZXhjaGFuZ2UgaGFzIGhh cHBlbmVkDQogdGhhdCBDIGFuZCBSUyBhcmUgYXNzdXJlIHRoYXQgdGhlIGV4Y2hhbmdlIHN1Y2Nl ZWRlZC4gSG93IGxvbmcgdG8gd2FpdCwgSSB0aGluayBzaG91bGQgYmUgb3V0IG9mIHNjb3BlLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KJm5ic3A7IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KU2VjdGlvbiA0LjIuMSBhbmQgNC4yLjI8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxl ZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBUaGUgZmlyc3Qgc2VudGVuY2UgY2Fw dHVyZXMgdGhlIGNhc2Ugd2hlcmUgdGhlIGZpcnN0IHRva2VuIGlzIHBvc3RlZDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQi Pg0Kb3IgcmUtcG9zdGVkLiBJdCBjYW4gYmUgcmVwaHJhc2VkIHRvIGNvdmVyIGFsc28gdGhlIHBv c3Rpbmcgb2YgYSB0b2tlbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KZm9yIHVwZGF0aW5nIGFjY2VzcyByaWdodHMs IHdoZXJlIHRoZXNlIHBhcmFtZXRlcnMgYXJlIG5vdCBpbmNsdWRlZC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBkb25lPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NClNlY3Rpb24gNC4zPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1y aWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCiogcy9T ZWNyZXQgZnJvbSB0aGUgcGFyYW1ldGVyLCByZWNlaXZlZC9TZWNyZXQgZnJvbSB0aGUgcGFyYW1l dGVyIHJlY2VpdmVkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZG9u ZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIElmIHRoZSBjbGllbnQgc3RvcHMg dGhlIGV4Y2hhbmdlLCBpdCBzaG91bGQgYWxzbyB1bmxvY2sgdGhlIElEMSB2YWx1ZTxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KcHJldmlvdXNseSBvZmZlcmVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTtt YXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+ DQpGUDogSSBiZWxpZXZlIHRoaXMgaXMgaW1wbGVtZW50YXRpb24gZGV0YWlscy4gSSB0aGluayB0 aGlzIHNob3VsZCBiZSBjb3ZlcmVkIGJ5IHRoZSBjbGFyaWZpY2F0aW9ucyBhYm92ZS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBzL3RvIFJTL3RvIHRoZSBSUzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQi Pg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0 O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogT2ssIGRvbmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVm dDozNi4wcHQiPg0KKiBUaGUgZW5kIG9mIHRoZSBsYXN0IHBhcmFncmFwaCBtZW50aW9ucyBwb3Nz aWJseSByZXBvc3RpbmcgdGhlIHNhbWU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2lu LWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCmZpcnN0IHRva2VuIHRvIHJla2V5 IHRoZSBPU0NPUkUgY29udGV4dC4gQ29uc2lzdGVudGx5IHdpdGggdGhlIGZvdXJ0aDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KcGFyYWdyYXBoIG9mIFNlY3Rpb24gNCwgSSBzdWdnZXN0IHRvIG1lbnRpb24gaGVyZSBh Z2FpbiB0aGF0IHRoaXM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTox Mi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCnJlcXVlc3QgaXMgbm90IHByb3RlY3RlZCwgc2lu Y2Ugbm90IHJlbGF0ZWQgdG8gdXBkYXRpbmcgYWNjZXNzIHJpZ2h0cy48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KRlA6IE9rLCBkb25lPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NClNlY3Rpb24gNTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9t OjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIHMvcHJv ZmlsZSwgb3RoZXIvcHJvZmlsZSwgYnV0IG90aGVyPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNt O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYu MHB0Ij4NCkZQOiBzLywvOyBpbnN0ZWFkLCBidXQgZG9uZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQpTZWN0aW9uIDY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBz L2NvbnRleHQgZXhwaXJlcy9jb250ZXh0IGV4cGlyZXMgb3IgaXMgcmV2b2tlZCZuYnNwOyZuYnNw OyAoMiBpbnN0YW5jZXMpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206 MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBBZ2Fp biwgSSBhbSBoZXNpdGFudCB0byBhZGQgcmV2b2tlZCBoZXJlLCBhcyB0aGUgZnJhbWV3b3JrIGJh cmVseSB0b3VjaGVzIG9uIHJldm9jYXRpb25zIG9mIHRva2VucywgYW5kIGV4cGxpY2l0ZWx5IHN0 YXRlcyB0aGF0IGV4cGlyYXRpb24gaXMgdGhlIG5vcm0gaW5zdGVhZC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KKiBJbiB0aGUgZm91cnRoIGJ1bGxldCBwb2ludCwgaXNuJ3QgdGhp cyBhY3R1YWxseSBmaW5lIGlmIHRoZSByZXBvc3RlZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KdG9rZW4gaXMgZXhh Y3RseSB0aGUgb3JpZ2luYWwgZmlyc3QgdG9rZW4/IEluIHRoYXQgY2FzZSwgbmV3IG5vbmNlcyAo YW5kPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdp bi1sZWZ0OjM2LjBwdCI+DQpJIGd1ZXNzIGFsc28gSURzKSBhcmUgZXhjaGFuZ2VkLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow Y207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4w cHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIu MHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogVGhpcyBpcyBmaW5lLCBidXQgaXQgbWVhbnMg dGhlIFJTIGlzIHdpc2hpbmcgdG8gcmUtZGVyaXZlIGEgbmV3IGNvbnRleHQsIHNvIHRoZSBvbGQg b25lIG11c3QgYmUgZGlzY2FyZGVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4t Ym90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJn aW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoq IEkgdGhpbmsgdGhlcmUgc2hvdWxkIGJlIG9uZSBtb3JlIGJ1bGxldCBwb2ludCBpbiB0aGUgY2xp ZW50IGxpc3QsIGZvcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0Kd2hlbiB0aGUgY2xpZW50IHJlY2VpdmVzIGJhY2sg SUQyID09IElEMSBmcm9tIHRoZSBSUywgYWZ0ZXIgaGF2aW5nPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpyZXBvc3Rl ZCB0aGUgb3JpZ2luYWwgZmlyc3QgYWNjZXNzIHRva2VuLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQooVGhpcyByZWxhdGVzIHRvIGEgcHJldmlvdXMgY29tbWVudCBmb3IgU2VjdGlv biA0LjE7IEkgdGhvdWdodCBhPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpyZXBvc3Rpbmcgb2YgdGhlIGZpcnN0IG9y aWdpbmFsIHRva2VuIGludm9sdmVzIGFuIGV4Y2hhbmdlIG9mIG5ldyBub25jZXM8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNt O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0 Ij4NCmFzIHdlbGwgYXMgb2YgbmV3IElEcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFy Z2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQi Pg0KRlA6IFdoeT8gSSBkb24ndCB1bmRlcnN0YW5kIHdoeSB0aGlzIGlzIG5vdCBhbHJlYWR5IGNv dmVyZWQuIEFoIG9rIHNvIG1heWJlIHRoaXMgaXMgbm90IHZhbGlkIGFueW1vcmU/PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBj bTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBw dCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4w cHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NClNlY3Rpb24gNzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0 OjM2LjBwdCI+DQoqIHMvdXNlY2FzZS91c2UgY2FzZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBj bTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQpGUDogT2ssIGRvbmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2lu LXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KKiBz L2ZvciBhIGNsaWVudC9mb3IgYSBzYW1lIGNsaWVudCZuYnNwOyZuYnNwOyAoMiBpbnN0YW5jZXMp PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQo8bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJv dHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCkZQOiBPaywgZG9uZSAoSSBhbSBzdXJl IHRoZSBSRkNFZGl0b3Igd2lsbCBjaGFuZ2UgdGhpcyB0byBzb21ldGhpbmcgZWxzZSB0b28gOikg KTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4t bGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQoqIEkgdGhpbmsgaXQncyBiZXR0ZXIg dG8gZXhwYW5kIEMgYW5kIENzIHRvICZxdW90O2NsaWVudCZxdW90OyBhbmQgJnF1b3Q7Y2xpZW50 cyZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDtt YXJnaW4tbGVmdDozNi4wcHQiPg0KPG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjM2LjBwdCI+DQpGUDogT2ssIGRvbmU8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGNtO21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 MzYuMHB0Ij4NCjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIDIwMjAtMTEtMDggMjM6NTEsIERhbmll bCBNaWdhdWx0IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHls ZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5IaSwmbmJzcDsgPG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5UaGlzIGVtYWlsIHN0YXJ0cyBh IFdHTEMgZm9yIHRoZSBkcmFmdCBkcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZSB1bnRpbCBN b25kYXkgTm92ZW1iZXIgMjMuIFdlIHdvdWxkIGxpa2UgdG8gc2VuZCB0aGUgZG9jdW1lbnQgYmFj ayB0byB0aGUgSUVTRyB3aXRoIHN1ZmZpY2llbnQgY29uZmlkZW5jZSwgc28gcGxlYXNlIHRha2Ug dGhlIHRpbWUgdG8gcmV2aWV3DQogaXQgY2FyZWZ1bGx5IHByb3ZpZGUgY29tbWVudHMgYW5kIGZl ZWQgYmFja3MuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5Ob3RlIHRoYXQgYWxzbyB0aGF0IHRoZSBk b2N1bWVudCAoMTMpIGlzIGJlaW5nIHJldmlld2VkIGJ5IHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0 ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+WW91 cnMsJm5ic3A7PGJyPg0KRGFuaWVsJm5ic3A7ICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PGJyPg0KWzFdIDxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdjEvdXJsP2s9 NTYxYjk1MWItMDk4MGFjMmEtNTYxYmQ1ODAtODZlMjIzN2Y1MWZiLTdlOGZmMGYyYjQ2MDI3N2Im YW1wO3E9MSZhbXA7ZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00NzYzODFjZTVhYjgmYW1wO3U9 aHR0cHMlM0ElMkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbSUyRiUz RnVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMjUyRmRvYyUy NTJGZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUlMjUyRiUyNmRhdGElM0QwNCUyNTdDMDEl MjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhkODg0 MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdDMCUy NTdDNjM3NDA0NzI3OTgwOTc0ODQ4JTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpXSWpv aU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAl MjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEREN6Y091UTdNbkJMczBoeGlIYklBaSUyNTJCMVZqQkhM QkpSemk0TjhQOVZEVjQlMjUzRCUyNnJlc2VydmVkJTNEMCI+DQpodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS88L2E+PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+LS0tLS0tLS0tLSBGb3J3 YXJkZWQgbWVzc2FnZSAtLS0tLS0tLS08YnI+DQpGcm9tOiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlu dGVybmV0LWRyYWZ0c0BpZXRmLm9yZyI+aW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPC9hPiZndDs8 YnI+DQpEYXRlOiBUdWUsIE9jdCAyNywgMjAyMCBhdCAxMjoxNCBQTTxicj4NClN1YmplY3Q6IFtB Y2VdIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLTEzLnR4dDxicj4N ClRvOiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmktZC1hbm5vdW5jZUBpZXRmLm9yZyI+aS1kLWFubm91 bmNlQGlldGYub3JnPC9hPiZndDs8YnI+DQpDYzogJmx0OzxhIGhyZWY9Im1haWx0bzphY2VAaWV0 Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT4mZ3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxicj4NCjxicj4NCjxi cj4NCkEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBvbi1saW5lIElu dGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy48YnI+DQpUaGlzIGRyYWZ0IGlzIGEgd29yayBpdGVt IG9mIHRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlvbiBmb3IgQ29uc3RyYWluZWQg RW52aXJvbm1lbnRzIFdHIG9mIHRoZSBJRVRGLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBUaXRsZSZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 OiBPU0NPUkUgUHJvZmlsZSBvZiB0aGUgQXV0aGVudGljYXRpb24gYW5kIEF1dGhvcml6YXRpb24g Zm9yIENvbnN0cmFpbmVkIEVudmlyb25tZW50cyBGcmFtZXdvcms8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgQXV0aG9ycyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDs6 IEZyYW5jZXNjYSBQYWxvbWJpbmk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgTHVkd2lnIFNlaXR6PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEfD tnJhbiBTZWxhbmRlcjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBNYXJ0 aW4gR3VubmFyc3Nvbjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBGaWxlbmFtZSZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA6IGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxl LTEzLnR4dDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBQYWdlcyZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7OiAzMjxicj4NCiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBEYXRlJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg OiAyMDIwLTEwLTI3PGJyPg0KPGJyPg0KQWJzdHJhY3Q6PGJyPg0KJm5ic3A7ICZuYnNwO1RoaXMg bWVtbyBzcGVjaWZpZXMgYSBwcm9maWxlIGZvciB0aGUgQXV0aGVudGljYXRpb24gYW5kPGJyPg0K Jm5ic3A7ICZuYnNwO0F1dGhvcml6YXRpb24gZm9yIENvbnN0cmFpbmVkIEVudmlyb25tZW50cyAo QUNFKSBmcmFtZXdvcmsuJm5ic3A7IEl0PGJyPg0KJm5ic3A7ICZuYnNwO3V0aWxpemVzIE9iamVj dCBTZWN1cml0eSBmb3IgQ29uc3RyYWluZWQgUkVTVGZ1bCBFbnZpcm9ubWVudHM8YnI+DQombmJz cDsgJm5ic3A7KE9TQ09SRSkgdG8gcHJvdmlkZSBjb21tdW5pY2F0aW9uIHNlY3VyaXR5IGFuZCBw cm9vZi1vZi1wb3NzZXNzaW9uPGJyPg0KJm5ic3A7ICZuYnNwO2ZvciBhIGtleSBvd25lZCBieSB0 aGUgY2xpZW50IGFuZCBib3VuZCB0byBhbiBPQXV0aCAyLjAgYWNjZXNzIHRva2VuLjxicj4NCjxi cj4NCjxicj4NClRoZSBJRVRGIGRhdGF0cmFja2VyIHN0YXR1cyBwYWdlIGZvciB0aGlzIGRyYWZ0 IGlzOjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5jb20vdjEvdXJsP2s9 NTc3ZGM4MzAtMDhlNmYxMDEtNTc3ZDg4YWItODZlMjIzN2Y1MWZiLTA4ODJmMzM3ZGIyYTViNGEm YW1wO3E9MSZhbXA7ZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00NzYzODFjZTVhYjgmYW1wO3U9 aHR0cHMlM0ElMkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbSUyRiUz RnVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMjUyRmRvYyUy NTJGZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUlMjUyRiUyNmRhdGElM0QwNCUyNTdDMDEl MjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhkODg0 MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdDMCUy NTdDNjM3NDA0NzI3OTgwOTc0ODQ4JTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpXSWpv aU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAl MjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEREN6Y091UTdNbkJMczBoeGlIYklBaSUyNTJCMVZqQkhM QkpSemk0TjhQOVZEVjQlMjUzRCUyNnJlc2VydmVkJTNEMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxl LzwvYT48YnI+DQo8YnI+DQpUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFi bGUgYXQ6PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/ az03NjE0OGRiNy0yOThmYjQ4Ni03NjE0Y2QyYy04NmUyMjM3ZjUxZmItNmRiN2E4NmMxYWYzOGUw MCZhbXA7cT0xJmFtcDtlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4MWNlNWFiOCZhbXA7 dT1odHRwcyUzQSUyRiUyRmV1cjAyLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tJTJG JTNGdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ0b29scy5pZXRmLm9yZyUyNTJGaHRtbCUyNTJG ZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTMlMjZkYXRhJTNEMDQlMjU3QzAxJTI1N0Nt YXJjby50aWxvY2ElMjU0MHJpLnNlJTI1N0MzMzAxODlkN2Q4MmI0OGRkMWU4ZTA4ZDg4NDM4ZjA0 MyUyNTdDNWE5ODA5Y2YwYmNiNDEzYTgzOGEwOWVjYzQwY2M5ZTglMjU3QzAlMjU3QzAlMjU3QzYz NzQwNDcyNzk4MDk4NDg0MiUyNTdDVW5rbm93biUyNTdDVFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3 TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wJTI1M0Ql MjU3QzMwMDAlMjZzZGF0YSUzRE9heEpJQ0w2QnAlMjUyRnp0NURNd1VXY3YwNHlVMDdKa3ZFSUxD TnkxN01vcXJvJTI1M0QlMjZyZXNlcnZlZCUzRDAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTM8L2E+PGJy Pg0KPGEgaHJlZj0iaHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az02YTA2ZDBh NS0zNTlkZTk5NC02YTA2OTAzZS04NmUyMjM3ZjUxZmItNjFkYjQ5MGI4Yzk5MDdmYSZhbXA7cT0x JmFtcDtlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4MWNlNWFiOCZhbXA7dT1odHRwcyUz QSUyRiUyRmV1cjAyLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tJTJGJTNGdXJsJTNE aHR0cHMlMjUzQSUyNTJGJTI1MkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyNTJGZG9jJTI1MkZodG1s JTI1MkZkcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xMyUyNmRhdGElM0QwNCUyNTdDMDEl MjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhkODg0 MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdDMCUy NTdDNjM3NDA0NzI3OTgwOTg0ODQyJTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpXSWpv aU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAl MjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEN0FjNlVkcmJINklCSWNtMiUyNTJCWVdkNGl3dWZ3SWJs djc2TnE0VnJldEpadXclMjUzRCUyNnJlc2VydmVkJTNEMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXBy b2ZpbGUtMTM8L2E+PGJyPg0KPGJyPg0KQSBkaWZmIGZyb20gdGhlIHByZXZpb3VzIHZlcnNpb24g aXMgYXZhaWxhYmxlIGF0Ojxicj4NCjxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIuZmlyZWV5ZS5j b20vdjEvdXJsP2s9NzE1OTRjM2QtMmVjMjc1MGMtNzE1OTBjYTYtODZlMjIzN2Y1MWZiLWYwYzll MDMzNDAyYWQyMDAmYW1wO3E9MSZhbXA7ZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0MS00NzYzODFj ZTVhYjgmYW1wO3U9aHR0cHMlM0ElMkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbSUyRiUzRnVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGd3d3LmlldGYub3JnJTI1MkZy ZmNkaWZmJTI1M0Z1cmwyJTI1M0RkcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xMyUyNmRh dGElM0QwNCUyNTdDMDElMjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgy YjQ4ZGQxZThlMDhkODg0MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzll OCUyNTdDMCUyNTdDMCUyNTdDNjM3NDA0NzI3OTgwOTk0ODQwJTI1N0NVbmtub3duJTI1N0NUV0Zw Ykdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhh V3dpTENKWFZDSTZNbjAlMjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEUiUyNTJCajhjbVBueWI4RFVF Y3lnQ3poT3BDSkJxUWJTOGdEYWx3U3NWWnRka3clMjUzRCUyNnJlc2VydmVkJTNEMCIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWFj ZS1vc2NvcmUtcHJvZmlsZS0xMzwvYT48YnI+DQo8YnI+DQo8YnI+DQpQbGVhc2Ugbm90ZSB0aGF0 IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNz aW9uPGJyPg0KdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJs ZSBhdCA8YSBocmVmPSJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3YxL3VybD9rPWNhMGM2 YTc0LTk1OTc1MzQ1LWNhMGMyYWVmLTg2ZTIyMzdmNTFmYi1mOGIzNDYxOWY2ZDMxYTBhJmFtcDtx PTEmYW1wO2U9NTBlNDA0ZDUtODc3MC00Y2QzLWJkNDEtNDc2MzgxY2U1YWI4JmFtcDt1PWh0dHBz JTNBJTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20lMkYlM0Z1cmwl M0RodHRwJTI1M0ElMjUyRiUyNTJGdG9vbHMuaWV0Zi5vcmclMjUyRiUyNmRhdGElM0QwNCUyNTdD MDElMjU3Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhk ODg0MzhmMDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdD MCUyNTdDNjM3NDA0NzI3OTgwOTk0ODQwJTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpX SWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZN bjAlMjUzRCUyNTdDMzAwMCUyNnNkYXRhJTNEcGVjMENsT01QSGolMjUyQnNIYSUyNTJCeURCRk92 RGo5MGFQd2xjRVVSQ2NRSTZpZ3hJJTI1M0QlMjZyZXNlcnZlZCUzRDAiIHRhcmdldD0iX2JsYW5r Ij4NCnRvb2xzLmlldGYub3JnPC9hPi48YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFs c28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9w cm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az1lYzE4MWE0MC1iMzgzMjM3MS1lYzE4NWFkYi04 NmUyMjM3ZjUxZmItMGM4MDEyZWZmZTlmOGNmOCZhbXA7cT0xJmFtcDtlPTUwZTQwNGQ1LTg3NzAt NGNkMy1iZDQxLTQ3NjM4MWNlNWFiOCZhbXA7dT1odHRwcyUzQSUyRiUyRmV1cjAyLnNhZmVsaW5r cy5wcm90ZWN0aW9uLm91dGxvb2suY29tJTJGJTNGdXJsJTNEZnRwJTI1M0ElMjUyRiUyNTJGZnRw LmlldGYub3JnJTI1MkZpbnRlcm5ldC1kcmFmdHMlMjUyRiUyNmRhdGElM0QwNCUyNTdDMDElMjU3 Q21hcmNvLnRpbG9jYSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhkODg0Mzhm MDQzJTI1N0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdDMCUyNTdD NjM3NDA0NzI3OTgxMDA0ODM0JTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpXSWpvaU1D NHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlMjUz RCUyNTdDMzAwMCUyNnNkYXRhJTNEQUpoTmVNVXJ3dUdXbktrN09hem80akZ4bTBnWDF0N2hNY0k5 SXZSSVFDayUyNTNEJTI2cmVzZXJ2ZWQlM0QwIiB0YXJnZXQ9Il9ibGFuayI+ZnRwOi8vZnRwLmll dGYub3JnL2ludGVybmV0LWRyYWZ0cy88L2E+PGJyPg0KPGJyPg0KPGJyPg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpBY2UgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFjZUBp ZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3Yx L3VybD9rPThjNjNmM2Y4LWQzZjhjYWM5LThjNjNiMzYzLTg2ZTIyMzdmNTFmYi0xMmYxOThmN2Y0 ZWFlYTM4JmFtcDtxPTEmYW1wO2U9NTBlNDA0ZDUtODc3MC00Y2QzLWJkNDEtNDc2MzgxY2U1YWI4 JmFtcDt1PWh0dHBzJTNBJTJGJTJGZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5j b20lMkYlM0Z1cmwlM0RodHRwcyUyNTNBJTI1MkYlMjUyRnd3dy5pZXRmLm9yZyUyNTJGbWFpbG1h biUyNTJGbGlzdGluZm8lMjUyRmFjZSUyNmRhdGElM0QwNCUyNTdDMDElMjU3Q21hcmNvLnRpbG9j YSUyNTQwcmkuc2UlMjU3QzMzMDE4OWQ3ZDgyYjQ4ZGQxZThlMDhkODg0MzhmMDQzJTI1N0M1YTk4 MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCUyNTdDMCUyNTdDMCUyNTdDNjM3NDA0NzI3OTgx MDA0ODM0JTI1N0NVbmtub3duJTI1N0NUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxD SlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjAlMjUzRCUyNTdDMzAwMCUy NnNkYXRhJTNEd01kdEpSZmlXdXIyZFhYWnc4ejg0dXNBWDdQOXZIY3ZoR3klMjUyQlBOSGVEVmcl MjUzRCUyNnJlc2VydmVkJTNEMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnIgY2xlYXI9ImFsbCI+ DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+LS0gPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij5EYW5pZWwgTWlnYXVsdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+RXJpY3Nz b248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnI+DQo8 YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+X19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwv cHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5BY2UgbWFpbGluZyBsaXN0PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGEgaHJlZj0i bWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxhIGhyZWY9Imh0dHBzOi8vcHJvdGVjdDIu ZmlyZWV5ZS5jb20vdjEvdXJsP2s9MWIzYTY3MDctNDRhMTVlMzYtMWIzYTI3OWMtODZlMjIzN2Y1 MWZiLWEzMjcyYTNjZDQ2MTRiZjgmYW1wO3E9MSZhbXA7ZT01MGU0MDRkNS04NzcwLTRjZDMtYmQ0 MS00NzYzODFjZTVhYjgmYW1wO3U9aHR0cHMlM0ElMkYlMkZldXIwMi5zYWZlbGlua3MucHJvdGVj dGlvbi5vdXRsb29rLmNvbSUyRiUzRnVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGd3d3LmlldGYu b3JnJTI1MkZtYWlsbWFuJTI1MkZsaXN0aW5mbyUyNTJGYWNlJTI2YW1wJTNCZGF0YSUzRDA0JTI1 N0MwMSUyNTdDbWFyY28udGlsb2NhJTI1NDByaS5zZSUyNTdDMzMwMTg5ZDdkODJiNDhkZDFlOGUw OGQ4ODQzOGYwNDMlMjU3QzVhOTgwOWNmMGJjYjQxM2E4MzhhMDllY2M0MGNjOWU4JTI1N0MwJTI1 N0MwJTI1N0M2Mzc0MDQ3Mjc5ODEwMjQ4MTglMjU3Q1Vua25vd24lMjU3Q1RXRnBiR1pzYjNkOGV5 SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJ Nk1uMCUyNTNEJTI1N0MzMDAwJTI2YW1wJTNCc2RhdGElM0RTbHBlY3VpRFh3Z29FNW9nTDhqU3F0 VU83elZ1dDdkcjFxNlZYWDh5OVo4JTI1M0QlMjZhbXAlM0JyZXNlcnZlZCUzRDAiPmh0dHBzOi8v ZXVyMDIuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUy Rnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFjZSZhbXA7YW1wO2RhdGE9MDQl N0MwMSU3Q21hcmNvLnRpbG9jYSU0MHJpLnNlJTdDMzMwMTg5ZDdkODJiNDhkZDFlOGUwOGQ4ODQz OGYwNDMlN0M1YTk4MDljZjBiY2I0MTNhODM4YTA5ZWNjNDBjYzllOCU3QzAlN0MwJTdDNjM3NDA0 NzI3OTgxMDI0ODE4JTdDVW5rbm93biU3Q1RXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFp TENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMCUzRCU3QzMwMDAmYW1w O2FtcDtzZGF0YT1TbHBlY3VpRFh3Z29FNW9nTDhqU3F0VU83elZ1dDdkcjFxNlZYWDh5OVo4JTNE JmFtcDthbXA7cmVzZXJ2ZWQ9MDwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGJyPg0KPGJy Pg0KPG86cD48L286cD48L3A+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPi0tIDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk1hcmNvIFRp bG9jYTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPlBo LkQuLCBTZW5pb3IgUmVzZWFyY2hlcjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPlJJU0UgUmVzZWFyY2ggSW5zdGl0dXRlcyBvZiBTd2VkZW48bzpwPjwv bzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5EaXZpc2lvbiBJQ1Q8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5Jc2Fmam9y ZHNnYXRhbiAyMiAvIEtpc3RhZ8OlbmdlbiAxNjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPlNFLTE2NCA0MCBLaXN0YSAoU3dlZGVuKTxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPlBob25lOiArNDYgKDApNzAg NjAgNDYgNTAxPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PGEgaHJlZj0iaHR0cHM6Ly9wcm90ZWN0Mi5maXJlZXllLmNvbS92MS91cmw/az0xZWQ2NWJj MC00MTRkNjJmMS0xZWQ2MWI1Yi04NmUyMjM3ZjUxZmItYWYyM2E5MWY2NmYyOGJmOSZhbXA7cT0x JmFtcDtlPTUwZTQwNGQ1LTg3NzAtNGNkMy1iZDQxLTQ3NjM4MWNlNWFiOCZhbXA7dT1odHRwcyUz QSUyRiUyRnd3dy5yaS5zZSUyRiI+aHR0cHM6Ly93d3cucmkuc2U8L2E+PG86cD48L286cD48L3By ZT4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_81EAD8CA2CFD429586B344C3B8676A27ericssoncom_-- From nobody Wed Dec 9 01:12:37 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C4DB3A0F39; Wed, 9 Dec 2020 01:12:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.119 X-Spam-Level: X-Spam-Status: No, score=-2.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=um.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fYv96VnNQPAc; Wed, 9 Dec 2020 01:12:33 -0800 (PST) Received: from mx02.puc.rediris.es (outbound6sev.lav.puc.rediris.es [130.206.19.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3BA83A0F0C; Wed, 9 Dec 2020 01:12:32 -0800 (PST) Received: from xenon44.um.es (xenon44.um.es [155.54.212.171]) by mx02.puc.rediris.es with ESMTP id 0B99CPbp021756-0B99CPbq021756; Wed, 9 Dec 2020 10:12:25 +0100 Received: from localhost (localhost [127.0.0.1]) by xenon44.um.es (Postfix) with ESMTP id CCB8120307; Wed, 9 Dec 2020 10:12:25 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon44.um.es Received: from xenon44.um.es ([127.0.0.1]) by localhost (xenon44.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id CIi5cFzplWi7; Wed, 9 Dec 2020 10:12:25 +0100 (CET) Received: from MacBook-Pro-de-Dan-2.local (unknown [217.113.247.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: dan.garcia@um.es) by xenon44.um.es (Postfix) with ESMTPSA id 4D8D7200BE; Wed, 9 Dec 2020 10:12:23 +0100 (CET) To: josh.howlett@gmail.com, =?UTF-8?B?J0fDtnJhbiBTZWxhbmRlcic=?= , 'Laurent Toutain' , 'Daniel Migault' Cc: 'EMU WG' , core@ietf.org, ace@ietf.org References: <20201117234700.GR39170@kduck.mit.edu> <0d6901d6ccb0$bd4c6860$37e53920$@gmail.com> From: Dan Garcia Message-ID: <0d537843-9a32-1c5b-daee-fe3491f20f6a@um.es> Date: Wed, 9 Dec 2020 10:12:22 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 MIME-Version: 1.0 In-Reply-To: <0d6901d6ccb0$bd4c6860$37e53920$@gmail.com> Content-Type: multipart/alternative; boundary="------------D13B39E4D9006B8CDFA0DAFA" Content-Language: en-US X-FEAS-SPF: spf-result=pass, ip=155.54.212.171, helo=xenon44.um.es, mailFrom=dan.garcia@um.es Authentication-Results: mx02.puc.rediris.es; spf=pass (rediris.es: domain of dan.garcia@um.es designates 155.54.212.171 as permitted sender) smtp.mailfrom=dan.garcia@um.es X-FE-Policy-ID: 2:15:0:SYSTEM DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=um.es; s=DKIM; c=relaxed/relaxed; h=subject:to:cc:references:from:message-id:date:mime-version:content-type; bh=rGai90grn8HPwXUmb7cAgJ2fi/ZF8hOA5Dy5aKijN+w=; b=BlqofvlpRsnyLtUr/07cdZd1R+e3IZm14O8uMQIAozgOySSIC1il0lfI0UZ+GagQVjdpR93S4W3M oKAbx7a4kYdnETqvQZjCvmD820vkxqAXhkUf+1w0DiM9QOhFVrYTYLN6yFE/6Meau3SUSrgnmO2l trM19Ix96iYxR81oS5S+Q/FmLtxbL6IKY2HX4JnaWFnHQc97/GK8FvsZYzY8gr3bxEVpWATzbLT6 llIUR6202ZUuIRxtVGS/eyslymFPmkyG681m6LbNclc4yJJbMKhGZj2DSNvcptPQ3EHIc+O1wFVZ iHrJc/9TCPiuYHnTnhSF2OtgwHK3L1S7yGMbOw== Archived-At: Subject: Re: [Ace] [Emu] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 09:12:37 -0000 This is a multi-part message in MIME format. --------------D13B39E4D9006B8CDFA0DAFA Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Hi Josh, Thanks for the support. At first sight, I would say that, from the perspective of a very constrained devices and networks, it would be better to directly design an EAP lower-layer based on CoAP without introducing any intermediate layer. Best Regards, Dan. On 7/12/20 16:50, josh.howlett@gmail.com wrote: > > I support this; although I am curious in Dans opinion as to whether > GSS on top of CoAP is also worth considering, as a way of leveraging > the GSS EAP and other mechanisms (such as Kerberos). > > Josh > > *From:*Emu *On Behalf Of *Gran Selander > *Sent:* 07 December 2020 14:08 > *To:* Laurent Toutain ; Daniel > Migault > *Cc:* EMU WG ; core@ietf.org WG (core@ietf.org) > ; ace@ietf.org > *Subject:* Re: [Emu] [core] [Ace] Proposed charter for ACE (EAP over > CoAP?) > > +1. > > (The recently updated ACE charter should cover this work.) > > Gran > > On 2020-12-03, 20:03, "core" > wrote: > > Hi, > > I think it is important to have EAP on top of CoAP, as Dan said it fit > well with the last charter item. > > Laurent > > On Thu, Dec 3, 2020 at 2:20 PM Daniel Migault > > wrote: > > CCing emu, core > > It seems ACE to me that ACE could be home for such a document. I am > wondering if emu core or any other WG believe there is a better place > for it. > > Regarding ACE I am wondering what is the WG opinion about adding this > item to the ACE charter. > > Yours, > > Daniel > > ________________________________________ > > From: Ace > on > behalf of Dan Garcia > > > Sent: Thursday, December 3, 2020 6:10 AM > > To: ace@ietf.org > > > Subject: [Ace] Proposed charter for ACE (EAP over CoAP?) > > Dear all: > > Regarding the new charter, since ACE is considering the definition of > CoAP transport for CMPv2 > (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00 > ), > we were wondering whethere it could also consider specifying EAP > (Extensible Authentication Protocol) over CoAP. > > In this sense, we proposed this some time ago and we have > implementations about this. > > https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 > > > https://www.mdpi.com/1424-8220/16/3/358 > > > https://www.mdpi.com/1424-8220/17/11/2646 > > > The usage of CoAP can provide a very light and link-layer independent > (we even tested in LoRa networks) EAP lower-layer (transport for EAP) > suitable for IoT enviroment. We believe this would be really useful > since EAP provides flexibility for the authentication and it is a > well-known protocol. > > Therefore, we would like to propose the following modification to the > charter: > > "The Working Group will examine how to use Constrained Application > Protocol (CoAP) as a transport medium for certificate enrollment > protocols, such as EST and CMPv2, as well as a transport for > authentication protocols such as EAP, and standardize them as needed." > > This modification does not necessarily mean the adoption of our draft. > After all, we completely understand that this would happen only if > there is an interest in the WG. Nevertheless, we would like to avoid > that the charter is a barrier later if there is interest in the WG to > work in this transport of EAP over CoAP: > > Any opinion about this? > > Best Regards. > > El 18/11/2020 a las 8:08, Daniel Migault escribi: > > Hi, > > Please find the proposed charter we agreed on during the interim > meeting. If you would like to propose any change, please use the > following URL by November 25: > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > > > Yours, > > Daniel > > The Authentication and Authorization for Constrained Environments > (ace) WG has defined a standardized solution framework for > authentication and authorization to enable authorized access to > resources identified by a URI and hosted on a resource server in > constrained environments. > > The access to the resource is mediated by an authorization server, > which is not considered to be constrained. > > Profiles of this framework for application to security protocols > commonly used in constrained environments, including CoAP+DTLS and > CoAP+OSCORE, have also been standardized.The Working Group is > charged with maintenance of the framework and existing profiles > thereof, and may undertake work to specify profiles of the framework > for additional secure communications protocols and for additional > support services providing authorized access to crypto keys (that are > not necessarily limited to constrained endpoints, though the focus > remains on deployment in ecosystems with a substantial portion of > constrained devices). > > In addition to the ongoing maintenance work, the Working Group will > extend the framework as needed for applicability to group > communications, with initial focus on (D)TLS and (Group) OSCORE as the > underlying group communication security protocols. The Working Group > will standardize procedures for requesting and distributing group > keying material using the ACE framework as well as appropriated > management interfaces. > > The Working Group will standardize a format for expressing > authorization information for a given authenticated principal as > received from an authorization manager. > > The Working Group will examine how to use Constrained Application > Protocol (CoAP) as a transport medium for certificate enrollment > protocols, such as EST and CMPv2, and standardize as needed. > > On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: > > Thanks for updating the draft charter at [1], Daniel! > > I note that Michael raised the question of whether some other group might > > also be interested in working on CMP-over-coap, so the IESG will be > sure to > > discuss that if CMP is still in the draft ACE charter when it goes to the > > IESG for review. > > -Ben > > On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: > > > Thank you all for the feed backs. For the purpose of driving the charter > > > discussion at the IETf 109, I have added the comments into the proposed > > > text [1]. > > > > > > My current understanding is that it seems beneficial to add CMPv2 > over CoAP > > > in the charter. I am happy to be contradicted. > > > * I have not seen a clear cut to do one or the other. > > > * EST and CMPv2 are two protocols that can be used for enrollment or > cert > > > management while addressing different cases / needs / situations -- > maybe > > > we can clarify that point. I can see leveraging the existing CMP > > > infrastructure, but it seems that is not the only one. > > > * I am not convinced that not having CMP over CoAP will not prevent its > > > deployment and as such I prefer to have it standardized - this might > be a > > > personal thought. > > > * Adding any piece of work require cycles, but it seems to me that > CPM will > > > not have a major impact on the WG progress. The work will probably > include > > > other WG such a LAMPS. > > > > > > Yours, > > > Daniel > > > > > > [1] > > > > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > > > > > > > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: > > > > > > > Hi Goran, > > > > > > > > I added the text to the charter we will discuss later. > > > > > > > > Yours, > > > > Daniel > > > > > > > > On Fri, Nov 13, 2020 at 10:26 AM Gran Selander < > > > > goran.selander@ericsson.com > > wrote: > > > > > > > >> Hi Daniel, > > > >> > > > >> > > > >> > > > >> Heres another input to the charter. > > > >> > > > >> > > > >> > > > >> The current group key management solutions addresses the problem of > > > >> authorized access to group keys and public keys of group members. > > > >> > > > >> > > > >> > > > >> A related problem is authorized access of public keys of other > devices > > > >> not necessarily part of a security group, in the sense of sharing a > > > >> symmetric key used to protect group messages. > > > >> > > > >> > > > >> > > > >> Authorized access to raw public keys serves an important function in > > > >> constrained settings where public key certificates may not be > feasible due > > > >> to the incurred overhead, e.g. for when authenticating using EDHOC > > > >> (draft-ietf-lake-edhoc). > > > >> > > > >> This functionality is thus a subset of what is already supported, but > > > >> since the current solution is geared towards groups a different > solution > > > >> may be needed (although it is probably possible to reuse parts > from the > > > >> existing schemes for provisioning and requesting public keys). > > > >> > > > >> > > > >> > > > >> With this in mind, I propose the following change (highlighted in > > > >> boldface below): > > > >> > > > >> > > > >> > > > >> OLD > > > >> > > > >> The Working Group is charged with maintenance of the framework and > > > >> existing profiles thereof, and may undertake work to specify > profiles of > > > >> the framework for additional secure communications protocols > (that are not > > > >> necessarily limited to constrained endpoints, though the focus > remains on > > > >> deployment ecosystems with a substantial portion of constrained > devices). > > > >> > > > >> > > > >> > > > >> NEW > > > >> > > > >> The Working Group is charged with maintenance of the framework and > > > >> existing profiles thereof, and may undertake work to specify > profiles of > > > >> the framework for additional secure communications protocols *and > **for > > > >> additional **support services **providing* *authorized access to > crypto* *keys > > > >> *(that are not necessarily limited to constrained endpoints, > though the > > > >> focus remains on deployment ecosystems with a substantial portion of > > > >> constrained devices). > > > >> > > > >> > > > >> > > > >> Gran > > > >> > > > >> > > > >> > > > >> > > > >> > > > >> > > > >> > > > >> On 2020-10-15, 19:50, "Ace" > wrote: > > > >> > > > >> Hi, > > > >> > > > >> I would like to start the charter discussion. Here is a draft of a > > > >> proposed charter [1]. > > > >> > > > >> > > > >> > > > >> It seems to be that additional discussion is needed with regard > to the > > > >> last paragraph related certificate management. In particular the > discussion > > > >> might revive a discussion that happened in 2017 [2] - when I was not > > > >> co-chair of ACE -and considered other expired work such as [3]. > Please make > > > >> this discussion constructive on this thread. > > > >> > > > >> > > > >> > > > >> The fundamental question is whether we need certificate management at > > > >> this stage. If the answer is yes, and we have multiple proposals, > it would > > > >> be good to clarify the position of the different proposals and > evaluate > > > >> whether a selection is needed or not before validating the charter. > > > >> > > > >> > > > >> > > > >> Please provide your inputs on the mailing list before October 30. Of > > > >> course for minor edits, you may suggest them directly on the > google doc. > > > >> > > > >> > > > >> > > > >> Yours, > > > >> > > > >> Daniel > > > >> > > > >> > > > >> > > > >> [1] > > > >> > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY/edit?usp=sharing > > > > > > >> < > > > >> > https://protect2.fireeye.com/v1/url?k=4f3d9c3b-118c475b-4f3ddca0-86e2237f51fb-627e48b069462d70&q=1&e=6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing > > > > > >> > > > >> > > > >> [2] > > > >> > https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/ > > > > >> > > > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > > > > >> > > > >> > > > >> > > > >> -- > > > >> > > > >> Daniel Migault > > > >> > > > >> > > > >> > > > >> Ericsson > > > >> > > > > > > > > > > > > -- > > > > Daniel Migault > > > > Ericsson > > > > > > > > > > > > > -- > > > Daniel Migault > > > Ericsson > > > _______________________________________________ > > > Ace mailing list > > > Ace@ietf.org > > > https://www.ietf.org/mailman/listinfo/ace > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://www.ietf.org/mailman/listinfo/ace > > > -- > > Daniel Migault > > Ericsson > > _______________________________________________ > > Ace mailing list > > Ace@ietf.orghttps > ://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > > core mailing list > > core@ietf.org > > https://www.ietf.org/mailman/listinfo/core > > > -- > > Laurent Toutain > > +--- VoIP (recommended) ---+----------- Tlcom Bretagne -----------+ > > | Tel: +33 2 22 06 8156| Tel: + 33 2 99 12 7026 | > Visit :| Mob: +33 6 800 75 > 900|| > > | Fax: +33 2 22 06 8445| Fax: +33 2 99 12 7030| > http://class.touta.in > > > > | Laurent@Touta.in | > Laurent.Toutain@Telecom-Bretagne.eu > | > > +--------------------------+----------------------------------------+ > > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu --------------D13B39E4D9006B8CDFA0DAFA Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

Hi Josh,

Thanks for the support.

At first sight, I would say that, from the perspective of a very constrained devices and networks, it would be better to directly design an EAP lower-layer based on CoAP without introducing any intermediate layer.


Best Regards,
Dan.

On 7/12/20 16:50, josh.howlett@gmail.com wrote:

I support this; although I am curious in Dans opinion as to whether GSS on top of CoAP is also worth considering, as a way of leveraging the GSS EAP and other mechanisms (such as Kerberos).

Josh

From: Emu <emu-bounces@ietf.org> On Behalf Of Gran Selander
Sent: 07 December 2020 14:08
To: Laurent Toutain <Laurent.Toutain@telecom-bretagne.eu>; Daniel Migault <daniel.migault=40ericsson.com@dmarc.ietf.org>
Cc: EMU WG <emu@ietf.org>; core@ietf.org WG (core@ietf.org) <core@ietf.org>; ace@ietf.org
Subject: Re: [Emu] [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

+1.

(The recently updated ACE charter should cover this work.)

Gran

On 2020-12-03, 20:03, "core" <core-bounces@ietf.org> wrote:

Hi,

I think it is important to have EAP on top of CoAP, as Dan said it fit well with the last charter item.

Laurent

On Thu, Dec 3, 2020 at 2:20 PM Daniel Migault <daniel.migault=40ericsson.com@dmarc.ietf.org> wrote:

CCing emu, core

It seems ACE to me that ACE could be home for such a document. I am wondering if emu core or any other WG believe there is a better place for it.

Regarding ACE I am wondering what is the WG opinion about adding this item to the ACE charter.

Yours,

Daniel

________________________________________

From: Ace <ace-bounces@ietf.org> on behalf of Dan Garcia <dan.garcia@um.es>

Sent: Thursday, December 3, 2020 6:10 AM

Subject: [Ace] Proposed charter for ACE (EAP over CoAP?)

Dear all:

Regarding the new charter, since ACE is considering the definition of CoAP transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensible Authentication Protocol) over CoAP.

In this sense, we proposed this some time ago and we have implementations about this.

The usage of CoAP can provide a very light and link-layer independent (we even tested in LoRa networks) EAP lower-layer (transport for EAP) suitable for IoT enviroment. We believe this would be really useful since EAP provides flexibility for the authentication and it is a well-known protocol.

Therefore, we would like to propose the following modification to the charter:

"The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and standardize them as needed."

This modification does not necessarily mean the adoption of our draft. After all, we completely understand that this would happen only if there is an interest in the WG. Nevertheless, we would like to avoid that the charter is a barrier later if there is interest in the WG to work in this transport of EAP over CoAP:

Any opinion about this?

Best Regards.

El 18/11/2020 a las 8:08, Daniel Migault escribi:

Hi,

Please find the proposed charter we agreed on during the interim meeting. If you would like to propose any change, please use the following URL by November 25:

Yours,

Daniel

The Authentication and Authorization for Constrained Environments (ace) WG has defined a standardized solution framework for authentication and authorization to enable authorized access to resources identified by a URI and hosted on a resource server in constrained environments.

The access to the resource is mediated by an authorization server, which is not considered to be constrained.

Profiles of this framework for application to security protocols commonly used in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have also been standardized.The Working Group is charged with maintenance of the framework and existing profiles thereof, and may undertake work to specify profiles of the framework for additional secure communications protocols and for additional support services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the focus remains on deployment in ecosystems with a substantial portion of constrained devices).

In addition to the ongoing maintenance work, the Working Group will extend the framework as needed for applicability to group communications, with initial focus on (D)TLS and (Group) OSCORE as the underlying group communication security protocols. The Working Group will standardize procedures for requesting and distributing group keying material using the ACE framework as well as appropriated management interfaces.

The Working Group will standardize a format for expressing authorization information for a given authenticated principal as received from an authorization manager.

The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, and standardize as needed.

On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk <kaduk@mit.edu> wrote:

Thanks for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might

also be interested in working on CMP-over-coap, so the IESG will be sure to

discuss that if CMP is still in the draft ACE charter when it goes to the

IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:

> Thank you all for the feed backs. For the purpose of driving the charter

> discussion at the IETf 109, I have added the comments into the proposed

> text [1].

>

> My current understanding is that it seems beneficial to add CMPv2 over CoAP

> in the charter. I am happy to be contradicted.

> * I have not seen a clear cut to do one or the other.

> * EST and CMPv2 are two protocols that can be used for enrollment or cert

> management while addressing different cases / needs / situations -- maybe

> we can clarify that point. I can see leveraging the existing CMP

> infrastructure, but it seems that is not the only one.

> * I am not convinced that not having CMP over CoAP will not prevent its

> deployment and as such I prefer to have it standardized - this might be a

> personal thought.

> * Adding any piece of work require cycles, but it seems to me that CPM will

> not have a major impact on the WG progress. The work will probably include

> other WG such a LAMPS.

>

> Yours,

> Daniel

>

> [1]

>

> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> wrote:

>

> > Hi Goran,

> >

> > I added the text to the charter we will discuss later.

> >

> > Yours,

> > Daniel

> >

> > On Fri, Nov 13, 2020 at 10:26 AM Gran Selander <

> >

> >> Hi Daniel,

> >>

> >>

> >>

> >> Heres another input to the charter.

> >>

> >>

> >>

> >> The current group key management solutions addresses the problem of

> >> authorized access to group keys and public keys of group members.

> >>

> >>

> >>

> >> A related problem is authorized access of public keys of other devices

> >> not necessarily part of a security group, in the sense of sharing a

> >> symmetric key used to protect group messages.

> >>

> >>

> >>

> >> Authorized access to raw public keys serves an important function in

> >> constrained settings where public key certificates may not be feasible due

> >> to the incurred overhead, e.g. for when authenticating using EDHOC

> >> (draft-ietf-lake-edhoc).

> >>

> >> This functionality is thus a subset of what is already supported, but

> >> since the current solution is geared towards groups a different solution

> >> may be needed (although it is probably possible to reuse parts from the

> >> existing schemes for provisioning and requesting public keys).

> >>

> >>

> >>

> >> With this in mind, I propose the following change (highlighted in

> >> boldface below):

> >>

> >>

> >>

> >> OLD

> >>

> >> The Working Group is charged with maintenance of the framework and

> >> existing profiles thereof, and may undertake work to specify profiles of

> >> the framework for additional secure communications protocols (that are not

> >> necessarily limited to constrained endpoints, though the focus remains on

> >> deployment ecosystems with a substantial portion of constrained devices).

> >>

> >>

> >>

> >> NEW

> >>

> >> The Working Group is charged with maintenance of the framework and

> >> existing profiles thereof, and may undertake work to specify profiles of

> >> the framework for additional secure communications protocols *and **for

> >> additional **support services **providing* *authorized access to crypto* *keys

> >> *(that are not necessarily limited to constrained endpoints, though the

> >> focus remains on deployment ecosystems with a substantial portion of

> >> constrained devices).

> >>

> >>

> >>

> >> Gran

> >>

> >>

> >>

> >>

> >>

> >>

> >>

> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> wrote:

> >>

> >> Hi,

> >>

> >> I would like to start the charter discussion. Here is a draft of a

> >> proposed charter [1].

> >>

> >>

> >>

> >> It seems to be that additional discussion is needed with regard to the

> >> last paragraph related certificate management. In particular the discussion

> >> might revive a discussion that happened in 2017 [2] - when I was not

> >> co-chair of ACE -and considered other expired work such as [3]. Please make

> >> this discussion constructive on this thread.

> >>

> >>

> >>

> >> The fundamental question is whether we need certificate management at

> >> this stage. If the answer is yes, and we have multiple proposals, it would

> >> be good to clarify the position of the different proposals and evaluate

> >> whether a selection is needed or not before validating the charter.

> >>

> >>

> >>

> >> Please provide your inputs on the mailing list before October 30. Of

> >> course for minor edits, you may suggest them directly on the google doc.

> >>

> >>

> >>

> >> Yours,

> >>

> >> Daniel

> >>

> >>

> >>

> >> [1]

> >> <

> >>

> >>

> >> [2]

> >>

> >>

> >>

> >>

> >> --

> >>

> >> Daniel Migault

> >>

> >>

> >>

> >> Ericsson

> >>

> >

> >

> > --

> > Daniel Migault

> > Ericsson

> >

>

>

> --

> Daniel Migault

> Ericsson

> _______________________________________________

> Ace mailing list

_______________________________________________

Ace mailing list

--

Daniel Migault

Ericsson

_______________________________________________

Ace mailing list

Ace@ietf.orghttps://www.ietf.org/mailman/listinfo/ace

_______________________________________________

core mailing list

--

Laurent Toutain

+--- VoIP (recommended) ---+----------- Tlcom Bretagne -----------+

| Tel: +33 2 22 06 8156| Tel: + 33 2 99 12 7026 | Visit :| Mob: +33 6 800 75 900||

+--------------------------+----------------------------------------+


_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu
--------------D13B39E4D9006B8CDFA0DAFA-- From nobody Wed Dec 9 03:46:20 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 610683A0658; Wed, 9 Dec 2020 03:46:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.119 X-Spam-Level: X-Spam-Status: No, score=-2.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=um.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YidiCvJBEEhX; Wed, 9 Dec 2020 03:46:16 -0800 (PST) Received: from mx02.puc.rediris.es (outbound4sev.lav.puc.rediris.es [130.206.19.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3BCE3A074B; Wed, 9 Dec 2020 03:46:02 -0800 (PST) Received: from xenon42.um.es (xenon42.um.es [155.54.212.169]) by mx02.puc.rediris.es with ESMTP id 0B9Bjxm6013240-0B9Bjxm7013240; Wed, 9 Dec 2020 12:45:59 +0100 Received: from localhost (localhost [127.0.0.1]) by xenon42.um.es (Postfix) with ESMTP id 6A55720076; Wed, 9 Dec 2020 12:45:59 +0100 (CET) X-Virus-Scanned: by antispam in UMU at xenon42.um.es Received: from xenon42.um.es ([127.0.0.1]) by localhost (xenon42.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id oo1HUmQ_W-tB; Wed, 9 Dec 2020 12:45:59 +0100 (CET) Received: from [156.35.171.42] (unknown [156.35.171.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: dan.garcia@um.es) by xenon42.um.es (Postfix) with ESMTPSA id C846720A7D; Wed, 9 Dec 2020 12:45:57 +0100 (CET) To: Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> From: Dan Garcia Message-ID: <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> Date: Wed, 9 Dec 2020 12:45:56 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 MIME-Version: 1.0 In-Reply-To: <24523.1607378991@localhost> Content-Type: multipart/alternative; boundary="------------90636A2252E88A18749BC547" Content-Language: es-ES X-FEAS-SPF: spf-result=pass, ip=155.54.212.169, helo=xenon42.um.es, mailFrom=dan.garcia@um.es Authentication-Results: mx02.puc.rediris.es; spf=pass (rediris.es: domain of dan.garcia@um.es designates 155.54.212.169 as permitted sender) smtp.mailfrom=dan.garcia@um.es X-FE-Policy-ID: 2:15:0:SYSTEM DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=um.es; s=DKIM; c=relaxed/relaxed; h=subject:to:references:from:message-id:date:mime-version:content-type; bh=tHpbdjHn76FBnGsB0vLS2A1+onJtTV7cLkabrBjyyT0=; b=IBubtEs1ioN8BqhEJRmDy/DWZMUrZ4cSlBswAQ8friuwxEx67hWgylwtpD5T+Ko+0ZvBIL+2HFCx ea/joAuPc2QqPQLdne52YiJ5AE2faD8T7sd8ccL+VgkLwU7D7VWWMjrhstXGJ2BmlAiVfAah/lXK v5kskklaf0eaVJ+QZdxkiTJ1iWX2b66fX3htE73ouXi6hc5/ziQqaj0wIa1jPmd1+JDYx3zXVQo4 YZi2ZSpUmYChReUUrMK4/gHKa4yRJ03/+HPuMy7nDQjzeCbTXENxFDDhcmYZaQodMswEeBMapVpQ OfLaauoKFeyoDnE0W5t8xN9cQYL2MHq7yfujkw== Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 11:46:19 -0000 This is a multi-part message in MIME format. --------------90636A2252E88A18749BC547 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit  Hi Michael, EAP can be used in the context of IoT for authentication. To transport EAP from the IoT device we need a light EAP lower-layer. This would be CoAP. Morover, according to EAP key management framework, keys are exported to protect the link and the EAP lower-layer itself. So yes, OSCORE could be used for that kind of protection.  Another aspect, it is that the use case we consider is the case where an IoT device is trying to access a security domain under the control of a “controller” that is connected to a backend AAA infrastructure, which acts as EAP authenticator.  Best Regards. El 07/12/2020 a las 23:09, Michael Richardson escribió: > Could someone point to a use case for "EAP over CoAP" please? > Is the goal to key an OSCORE context, or what? > > -- > ] Never tell me the odds! | ipv6 mesh networks [ > ] Michael Richardson, Sandelman Software Works | IoT architect [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --------------90636A2252E88A18749BC547 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

 Hi Michael,

EAP can be used in the context of IoT for authentication. To transport EAP from the IoT device we need a light EAP lower-layer. This would be CoAP. Morover, according to EAP key management framework, keys are exported to protect the link and the EAP lower-layer itself. So yes, OSCORE could be used for that kind of protection.

 Another aspect, it is that the use case we consider is the case where an IoT device is trying to access a security domain under the control of a “controller” that is connected to a backend AAA infrastructure, which acts as EAP authenticator.

 Best Regards.

El 07/12/2020 a las 23:09, Michael Richardson escribió:
Could someone point to a use case for "EAP over CoAP" please?
Is the goal to key an OSCORE context, or what?

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [



_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--------------90636A2252E88A18749BC547-- From nobody Wed Dec 9 04:12:26 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EE2E3A1414 for ; Wed, 9 Dec 2020 04:12:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ackl-io.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V5NygJYTUS3k for ; Wed, 9 Dec 2020 04:12:19 -0800 (PST) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 525453A1403 for ; Wed, 9 Dec 2020 04:12:19 -0800 (PST) Received: by mail-io1-xd2c.google.com with SMTP id o8so1429218ioh.0 for ; Wed, 09 Dec 2020 04:12:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ackl-io.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IdwS2AYxqUbqCTETYcXGfH39TpPXB5KtlYgyptLZ+NU=; b=lbG0wr5WfAKXKli7CENaSBFrnf+KM4POhagUT8vLm2dX2AcXVdEFBxPQsuvPRhzZLT Sov4eCKIAisS1HIK3EfqDSswAgQnOhBdSG2iAFpjGAdjn7K9PjSHRWRhYBZkXYuszpYk r5GJcsdZNlKSn9OL4oDF9LCrd/yPeCvYOAbdNZhA3jD1mDEV4hsPTkqUI61bRcaS+1OA He5JxGKK7a/42nYeJFUIpjxEkdrPvQKHpxgs0Ls220AZOjXfJ0ByzCIuWB4FjuleoYLt yIgRTNLdpgHO9f6Lf1HkZhiVRSrEJCvICeK74v4oIvJ+06K9DZmadMAZVLimNswS5QI+ YCOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IdwS2AYxqUbqCTETYcXGfH39TpPXB5KtlYgyptLZ+NU=; b=d+nGN8AQSa7Ww1XaOZAH1a2JoLcoCyuPgd3IageTLEFqRWsxiGsM/BWjCHFcQgEjgl D/2WlFJJDckwp9PRIWdw/YcYjuKeR9lYalRkBcDZUNsLGmR+Zl146+bWwAR3JNcuAGAQ RnhY3D6miVPRUT1/9cHwmeGp6NIfQ/ZphDgJzV2calqjW+tkZnByOAInA8tOdVy2t11U QgV/QR7NY3rXjMl/Vb4C9JUbXwdqDQ009LSd8Srne/VsrNAJWP7N4sKARLweN216mxhD saaP/8bYeho4ziCWL1l7dFrTe2A//wifoAlblw1VDuhllQ9+MFJ+rFLHeV8XlIiLGNw0 e1NA== X-Gm-Message-State: AOAM530kyd2w5r3EVWj3gMgbkrEuAar7pFjZAprMzAsxngzPSZSbgzww Pei4Mohr4qwZFXVqxXvFQvDxG8o5SBLXleoW9N4scw== X-Google-Smtp-Source: ABdhPJwJrHlQkjJYxxUoLKGn4EGOVzQt48jprs932YT2YtgMkbmfceMexO2ZMFbFC++SCEzu/xPFnD5y84aSHHPwONs= X-Received: by 2002:a5e:a614:: with SMTP id q20mr2493946ioi.198.1607515938109; Wed, 09 Dec 2020 04:12:18 -0800 (PST) MIME-Version: 1.0 References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> In-Reply-To: <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> From: Alexander Pelov Date: Wed, 9 Dec 2020 13:12:06 +0100 Message-ID: To: Dan Garcia Cc: Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" Content-Type: multipart/alternative; boundary="000000000000764e5505b606f89b" Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 12:12:21 -0000 --000000000000764e5505b606f89b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear all, I support the inclusion of EAP-over-CoAP to the charter. We've done work on this particular item in the past, and we've identified the need for it in many places.. but unfortunately the draft didn't have a proper "home" and things never advanced much. Use-cases we've seen include places where EAP is a MUST, there is support for CoAP, but no support for the specific FOO technology. I am confident that it will bring value to the IOT ecosystem and that ACE is the right home for this draft. Cheers, Alexander On Wed, Dec 9, 2020 at 12:46 PM Dan Garcia wrote: > Hi Michael, > > EAP can be used in the context of IoT for authentication. To transport EA= P > from the IoT device we need a light EAP lower-layer. This would be CoAP. > Morover, according to EAP key management framework, keys are exported to > protect the link and the EAP lower-layer itself. So yes, OSCORE could be > used for that kind of protection. > > Another aspect, it is that the use case we consider is the case where an > IoT device is trying to access a security domain under the control of a > =E2=80=9Ccontroller=E2=80=9D that is connected to a backend AAA infrastru= cture, which acts > as EAP authenticator. > > Best Regards. > El 07/12/2020 a las 23:09, Michael Richardson escribi=C3=B3: > > Could someone point to a use case for "EAP over CoAP" please? > Is the goal to key an OSCORE context, or what? > > -- > ] Never tell me the odds! | ipv6 mesh netwo= rks [ > ] Michael Richardson, Sandelman Software Works | IoT architec= t [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails= [ > > > > _______________________________________________ > Ace mailing listAce@ietf.orghttps://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --000000000000764e5505b606f89b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Dear all,

I support the inclusion of EA= P-over-CoAP to the charter.

We've done work o= n this particular=C2=A0item in the past, and we've identified the need = for it in many places.. but unfortunately the draft didn't have a prope= r "home" and things never advanced much. Use-cases we've seen= include places where EAP is a MUST, there is support for CoAP, but no supp= ort for the specific FOO technology.=C2=A0

I am co= nfident that it will bring value to the IOT ecosystem and that ACE is the r= ight home for this draft.

Cheers,
Alexan= der


On Wed, Dec 9, 2020 at 12:46 PM Dan Garcia <dan.garcia@um.es> wrote:
=20 =20 =20

=C2=A0Hi Michael,

EAP can be used in the context of IoT for authentication. To transport EAP from the IoT device we need a light EAP lower-layer. This would be CoAP. Morover, according to EAP key management framework, keys are exported to protect the link and the EAP lower-layer itself. So yes, OSCORE could be used for that kind of protection.

=C2=A0Another aspect, it is that the use case we consider is the case where an IoT device is trying to access a security domain under the control of a =E2=80=9Ccontroller=E2=80=9D that is connected to a = backend AAA infrastructure, which acts as EAP authenticator.

=C2=A0Best Regards.

El 07/12/2020 a las 23:09, Michael Richardson escribi=C3=B3:
Could someone point to a use case for "EAP over CoAP" =
please?
Is the goal to key an OSCORE context, or what?

--
]               Never tell me the odds!                 | ipv6 mesh network=
s [
]   Michael Richardson, Sandelman Software Works        |    IoT architect =
  [
]     mcr@sandelman.c=
a  http://www.sa=
ndelman.ca/        |   ruby on rails    [



_______________________________________________
Ace mailing list
Ace@ietf.org
htt=
ps://www.ietf.org/mailman/listinfo/ace
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--000000000000764e5505b606f89b-- From nobody Wed Dec 9 05:29:01 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA0263A1662; Wed, 9 Dec 2020 05:28:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZuP1SbdYUrh5; Wed, 9 Dec 2020 05:28:58 -0800 (PST) Received: from prometheus.amsuess.com (alt.prometheus.amsuess.com [IPv6:2a01:4f8:190:3064::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F25523A165F; Wed, 9 Dec 2020 05:28:56 -0800 (PST) Received: from poseidon-mailhub.amsuess.com (unknown [IPv6:2a02:b18:c13b:8010:a800:ff:fede:b1bd]) by prometheus.amsuess.com (Postfix) with ESMTPS id 42040405E4; Wed, 9 Dec 2020 14:28:54 +0100 (CET) Received: from poseidon-mailbox.amsuess.com (poseidon-mailbox.amsuess.com [IPv6:2a02:b18:c13b:8010:a800:ff:fede:b1bf]) by poseidon-mailhub.amsuess.com (Postfix) with ESMTP id 222A3AB; Wed, 9 Dec 2020 14:28:49 +0100 (CET) Received: from hephaistos.amsuess.com (unknown [IPv6:2a02:b18:c13b:8010:c33c:d942:e648:1b58]) by poseidon-mailbox.amsuess.com (Postfix) with ESMTPSA id A74F3121; Wed, 9 Dec 2020 14:28:48 +0100 (CET) Received: (nullmailer pid 3020821 invoked by uid 1000); Wed, 09 Dec 2020 13:28:48 -0000 Date: Wed, 9 Dec 2020 14:28:48 +0100 From: Christian =?iso-8859-1?Q?Ams=FCss?= To: Daniel Migault Cc: Dan Garcia , "ace@ietf.org" , EMU WG , "core@ietf.org WG (core@ietf.org)" Message-ID: References: <20201117234700.GR39170@kduck.mit.edu> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Qltm+pjmcyrMM91l" Content-Disposition: inline In-Reply-To: Archived-At: Subject: Re: [Ace] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 13:29:00 -0000 --Qltm+pjmcyrMM91l Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hello ACE, On Thu, Dec 03, 2020 at 01:20:08PM +0000, Daniel Migault wrote: > It seems ACE to me that ACE could be home for such a document. I am > wondering if emu core or any other WG believe there is a better place > for it. If nothing else, I'd be curious to see EAP-over-CoAP this sketched out; interactions with NOOB. (The "film a blinking LED to get mutual authentication" sounds particularly promising). Care would need to be taken to follow CoRE best practices (not that we'd have a good set of standard recommendations, but at least on concrete points we usually manage consensus), both because anything built on CoAP coming from the IETF will be seen as something of a reference example, and also to leverage its full optimization potential. CCs to core when this is put on the agenda for ACE interims might be a good idea. Go for it :-) Christian --=20 Es ist nicht deine Schuld, dass die Welt ist, wie sie ist -- es w=E4r' nur deine Schuld, wenn sie so bleibt. (You are not to blame for the state of the world, but you would be if that state persisted.) -- Die =C4rzte --Qltm+pjmcyrMM91l Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEECM1tElX6OodcH7CWOY0REtOkveEFAl/Q0Q0ACgkQOY0REtOk veH64RAAqrDBPD3rh/Ujl06z8ndBwoMCbAklVaDx+iGUga/P5xJ6QiN133BLNuf6 GnDqgFkYpYM13z0ULDpwMqXQn5hVs4Ra968ewqba91PgM7zRT4FEi5xU1CimAJia A/nF0iMTRComEXjLMP49lxdGFz0K3vWobk0ZcFTS2TImOQw9H7DHJyCpd6hRLIur 7TCnfl/K8TAg6qUEKdhNYdKphfN3YSZ1YFUU17rbtFo2N+ScYexeQtOoLYBcN8/c udhxjzMN5M3Rb0xW3nqElCjHK1YQ3h/05ZU4TrkK+f6s7aclwkjeflHK2ekIeVwG kW90fztJLlP3JwZ5Kfm8TD0u2uV0ivB+oY7AONLk4HdSw8sMB+86ep3kXzNZfcnT 55Cq/Od9MgiM0oNTxyHbjcd3lhWFhSUaYJNjB5YIFgfYJAPB+Bp6iclqtxnDzJT0 IZzzfkOaWeaYE5oOhofN83uLdcgI3vNlTtrM73jSwq3NnRt8YSgjhlqtst/EE8vn U5AilXQcYST/WMdSAaD88Vm90YCae6hIyz5X4hvHOprHWPo4P+xdSPUXZzlLOKDw 4DA/SRvZqepBGoReb3TUYTfrr2eYz7RobX/7bC0WaLvjQPtMtdr11rQDUwz1zxTl IseBmdYekIFDU7r+KZYG84QHHfps0ihxH4qsOt6+91iWUr5dFOI= =Sj7O -----END PGP SIGNATURE----- --Qltm+pjmcyrMM91l-- From nobody Wed Dec 9 05:52:11 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F22E3A15E9; Wed, 9 Dec 2020 05:52:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s6xLbY-f1nTv; Wed, 9 Dec 2020 05:52:06 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAFB03A167C; Wed, 9 Dec 2020 05:52:05 -0800 (PST) Received: from [192.168.217.120] (p548dca87.dip0.t-ipconnect.de [84.141.202.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4Crdl76FkgzyWv; Wed, 9 Dec 2020 14:52:03 +0100 (CET) Content-Type: multipart/signed; boundary="Apple-Mail=_0E56D933-F6F9-4C22-BE79-E15E6BAC0107"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\)) From: Carsten Bormann In-Reply-To: Date: Wed, 9 Dec 2020 14:52:03 +0100 Cc: Daniel Migault , "core@ietf.org WG (core@ietf.org)" , EMU WG , "ace@ietf.org" X-Mao-Original-Outgoing-Id: 629214722.587876-387e36a6e484afc88c7f36bee508ba06 Content-Transfer-Encoding: quoted-printable Message-Id: <09BDBA0F-9D18-4780-BAE5-BA7BE4405AA2@tzi.org> References: <20201117234700.GR39170@kduck.mit.edu> To: =?utf-8?Q?Christian_Ams=C3=BCss?= X-Mailer: Apple Mail (2.3608.120.23.2.4) Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 13:52:10 -0000 --Apple-Mail=_0E56D933-F6F9-4C22-BE79-E15E6BAC0107 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 2020-12-09, at 14:28, Christian Ams=C3=BCss = wrote: >=20 > follow CoRE best practices Indeed; for instance, we =E2=80=9CRESTified=E2=80=9D documents in ACE = before (and they not just became ideologically correct, but also plain = better). Gr=C3=BC=C3=9Fe, Carsten --Apple-Mail=_0E56D933-F6F9-4C22-BE79-E15E6BAC0107 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIzBAEBCAAdFiEEcr05t4NZlx5Xee/8VkscnDT509sFAl/Q1oIACgkQVkscnDT5 09vlvA/+L5IkPsKbuOh4pGPFInY2UoW9NPXxUlkw3NfVXuMQhkRPmUt3J+OUwpUv fOn1K5ebH/jjcWtS214ZBGbJWixIWn/2iDkVUUqfKLJ/Fn0GapRWX6KTmL+uMXLv z/NkIsjIP/wulPZbHbqMzw8upyz68T5OcT//SolkdkmJKXdAN0LMFutWem8kCG17 GjxJX47ZW8XfkNmWs6c8Rd/6wD41PjsCCu7nGQHRYeiys/CkY83jR21FMAbid2Gm GVcWY85DWKz9VbOCAkia41Msaj/z86m+i/byZDXcKT4rle+BiB3kmGDubBCWAJtQ FXLdahMgvlXTiE6RBqzTUGphlzdPZbXFzs0/sOWq5HHJJ5AzAlryyc8qimoXr2T3 c2mjKKlH1Sbw05QPPvZzYKcJ0UwRYPKrHm/MwdTr/ZqnRYGAspZFyURu6VdcMDNS bb5YUmlEjr4X/T9O96jyO4xl1Yx/6x9DmzEDuLKfHWyzQ2vd7SqpHhK9rziOWIwl KDxs2owITUWOQU5fSgINU8WmalNYu3MfG1LeuViPmfTRJC1UZVA+M02wPRlQ+Hn7 +w7Z+6R4Mip0xSxR07FR+3pTWxVYwLQkvxDVtIcRlN62KKCAS81HsVIjep2Q3yjU XfUJDyFRlF0HZKdl9qZqYXdlgGd0SxWBFI7YVkw2o8e2veHeVHc= =4EMO -----END PGP SIGNATURE----- --Apple-Mail=_0E56D933-F6F9-4C22-BE79-E15E6BAC0107-- From nobody Wed Dec 9 08:27:01 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB5A3A0EC0; Wed, 9 Dec 2020 08:26:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.8 X-Spam-Level: X-Spam-Status: No, score=-2.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ri.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UpvkfZeZ88Bi; Wed, 9 Dec 2020 08:26:53 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150084.outbound.protection.outlook.com [40.107.15.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72F063A0EC4; Wed, 9 Dec 2020 08:26:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EhAM139Eh6y4yEx/DWpK5fVIGIb6QgrNwchoEMRIPIM+be2HmtQ4W+9rPmZjBdnorWVtEBZGWUSJvSCq9/6/Ybh5Z4+cQZ2b0zqo+8H/gHQOURXCi8FuWghWmGt6hWzsgacg/V9n3M5/iwCHoZOayqEiMZ4uTc48ntHhLTlhqISGSSEakZPZ9x/65MvU+44lbQBy0g4wwyrLD5dx8L/VVFOTRvwdGju6AHf/tAXrFlRWqlOqC2tbHBCGQXyEeDDsODlr8BhR9Tx4qGm2TXJO7SIABKWTFXlynDNAlCZhq2CFFN7u9jm6l7T965LUfyjrZ88Q73RbA/Lj84Z23vsjPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g8cjKVmSi4TjcWHMJ/xiC3MUWFrWawCX6t/tKiyIwRc=; b=dqAy5CoVxQiDCryCp/ZqiFZx77ymzYsanYdF2Dt8geSnZxxsD9jTy32Hw5ztrB7POH6IeP1FcEsrTgwlRwH8DRAAXsIgvFbLozuE9YoJitXT8UQZERgE+hxNR5ohOoMrf5O2J9TymUCKfK9QyCU5Sdm6QktXtRXW6OprIPi1QsUYHqy3rmU0Ap7FQ2uAdLLaKkbSJb/6L+n8I73PLFhvSHKkWG9aH3xKAj4KOKgBBHk2nLpdIdO93DzVUkqzXKNsAiTdg1GU8dW5qDvpOCDj2AtoTEOH4kSjnkisYLxIb+/PhlNAiEkX6IBam0MS7IkBOAKtRmk0zup81J8h2RUdyA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ri.se; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g8cjKVmSi4TjcWHMJ/xiC3MUWFrWawCX6t/tKiyIwRc=; b=Urc9TQWQQXCp1zHl+2frjrvuGqvsgLU7AU/AJZ77s/pjNkXMY/HBUhTk1/8ZML+CjTblfIBhCDgsvu0toUlrdwkrS5WfiIrZ6qfT5NKn5xDYEcpOTf554U8Zg2SR+i/klsOhCdnuLuzBXjIwVj6yxd7gBoSeEwpqSc/rQXQfG/k= Authentication-Results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=ri.se; Received: from DB8P189MB1032.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:16e::14) by DB8P189MB1032.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:16e::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.17; Wed, 9 Dec 2020 16:26:48 +0000 Received: from DB8P189MB1032.EURP189.PROD.OUTLOOK.COM ([fe80::c906:d500:5041:56fd]) by DB8P189MB1032.EURP189.PROD.OUTLOOK.COM ([fe80::c906:d500:5041:56fd%9]) with mapi id 15.20.3632.023; Wed, 9 Dec 2020 16:26:48 +0000 To: Francesca Palombini , "draft-ietf-ace-oscore-profile@ietf.org" , Ace Wg References: <160381525062.27226.4156909974711721360@ietfa.amsl.com> <02a1d3ce-071b-e35a-104f-333e54458d4a@ri.se> <81EAD8CA-2CFD-4295-86B3-44C3B8676A27@ericsson.com> From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: <06e9b352-567d-5071-009a-670eabbb9390@ri.se> Date: Wed, 9 Dec 2020 17:26:45 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 In-Reply-To: <81EAD8CA-2CFD-4295-86B3-44C3B8676A27@ericsson.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="KTipmymRcJF3Sr6o85Ru6DCn8SbB5JF7I" X-Originating-IP: [31.13.191.167] X-ClientProxiedBy: HE1PR0501CA0026.eurprd05.prod.outlook.com (2603:10a6:3:1a::36) To DB8P189MB1032.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:16e::14) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.2.8] (31.13.191.167) by HE1PR0501CA0026.eurprd05.prod.outlook.com (2603:10a6:3:1a::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.12 via Frontend Transport; Wed, 9 Dec 2020 16:26:47 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 3c89a925-9f20-43df-74a5-08d89c5f3a1c X-MS-TrafficTypeDiagnostic: DB8P189MB1032: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: pgaVGxKF7f/Kym75g7LO+J3ht43bwvOEgx/4xKG8/dRkqkpbC/Ii0hLGv75xo569BYoqgUY1bX1hkTk4jU9C0wZlNLvGJKVaiUlM577fSS2+KupU3e7w0XPvVzmY9psAooUFAASJITaF4LyYfg3htlHALFF6yrL2eIfydZdTWAtqBlI7EPlCN9UDFznS6SJxwUXl5tX2z5hnfr6ZJlWuF4u73BCF8ZE1tjw8xit7emgq4/IVigD46eI4p+eY9DnzIkhD/QsHYCrDXHGFsSJK4RJOkHCpEzJwm5zJHg8H8qVEHNkw+FjXQ5AYuDVM4xU0nyjK2Ul5K9vnuOzb3Y9fk3flXCTXRy7g3/B5TCFCVGBPKezrv9N40pLObU6C5x5c0AoNJpevimfmxtus+nob3/naaSZSKCvTaYWLGdlowRBdQhcsnJA6GTqtKIGmENyzQQ+xZK131cQ8ks8YZg7G7IEazr7IsIzjIA7++KksDPbhRnVO0kmj2jaqq7K/nq7nosIenltgUuWj6lL0Q38xEg== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB8P189MB1032.EURP189.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(376002)(366004)(136003)(346002)(6486002)(166002)(26005)(8676002)(36756003)(66574015)(83380400001)(235185007)(30864003)(31686004)(956004)(966005)(52116002)(110136005)(16576012)(34490700003)(2616005)(2906002)(66556008)(4001150100001)(186003)(5660300002)(21480400003)(53546011)(45080400002)(508600001)(66476007)(31696002)(44832011)(8936002)(16526019)(33964004)(66946007)(86362001)(45980500001)(43740500002)(579004)(559001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?TkRuZFA0NE1zWmRHZjh3dTQrTW9DT0RtTklZbzUyamlKbXBjSHFBOE9TQ0Fx?= =?utf-8?B?NzFnOGxsQzY5Q0xsMWtBcXpWQ1hpZWNHSG1hWjlkSzNrcEJuc05DaTFodDBS?= =?utf-8?B?SUVkamRHTE0xYjNBYkwwcU4wcERIQkpXeHo5Q244NDRiWHQvRzRHL2NvdnMz?= =?utf-8?B?MEtFWnZ6YmtlN3NtTjB6QWQ1cktKZ1JzOVh0bnpCWnlxNjJSKzZKRmh2TUtT?= =?utf-8?B?RVV1TEZVTXcxcld6V0hWTWRXWUhjcExlSy9tWXYrTEpENENDZm5nbmtSUXVy?= =?utf-8?B?ZjgwdkkvaG1peFpuM2hBUFJaSHV4WmJRclpuRHMrZmJUcXNseDE3WHl1N09R?= =?utf-8?B?TCtKZlU3WUNTT29pSVRkVnZneWsxWUZBdFlidFBGSi9ISTV4NzZvYm01OEVL?= =?utf-8?B?bjc1V1Q1eGxMdmNwaEZNMkJFaFg5R2VLQ09ta1JHcEJkd2NNYjh2WkxoSlV1?= =?utf-8?B?d1FGb0s0MjZoMHJ5eUMyRHR6SmQ2MHMvVmVhd2c4NFArcFRrYmh6NXNxeTBL?= =?utf-8?B?aWNONVNZczZQRE9FNVlBQTNSQnJoOUpxNGIvZDJldUdHdEJyelRuQk4rRUFx?= =?utf-8?B?THZuYW9iK3dHRzNNTUdiZm0xVFdFTEpKKzA0SVFJUzE2QXk0c2lpa2M0N2JN?= =?utf-8?B?SjR3N2JBa0pFZjFIOGx6KzVIMjBuWEpGbW9NMWNWWGd5WWdWV1A0ZFFGQ2Z0?= =?utf-8?B?N3RkdXBVZ3FQY3NKN212UHJ0OGI1cGc3RlhGVzkrVlNkNFpCQXR3Y0ljV3ky?= =?utf-8?B?UmtIbHZoZzhnak5SUlIwajVSR1F3Y2plMi9zWWVNdG5jS2NWVjN1TUpwQWFq?= =?utf-8?B?ZlpIenlEQVZma1VIKzRhM3VQK0h4dU00TklGSHhXVmlQem8xN2dObk9GSjBC?= =?utf-8?B?Yi9RTG5QYW9ZTFJNNUpWM1dTNG5uakJsVU5YMnVaM0JOYkRUeTdlYytKdDFk?= =?utf-8?B?eEMxbmJUMXpQYUtqTFJiajM3N1hoeHptQWZtcFdhazRMVEhQb2lpMk5WVTFU?= =?utf-8?B?UWhwUHhtWkNGbmp5SkpmNTFKSDZpWlEyNFMwZ25USFBSMWtLemcvNlYwOExS?= =?utf-8?B?UXF0enJOYTM1clhwUVdXVlRiUVQ5czNMYVF2V295VmppR0VHaW9BZkw0c0dy?= =?utf-8?B?RVRJM0tUZUpXM0RaK3Bwbjh3djlidnZ4bE4rNDJ4RlFkVUJSVCsvb3loVi9k?= =?utf-8?B?MDZjQld3NWM5aytkMDdZK1NWM2J4VjJ2QmtYUzRRNzZUUWlHV1NVL2VGd0sr?= =?utf-8?B?WnRtYjdWb2IwUWl6cDFOM290T0drT3BNb1BYOHFmSDRQSHNaRG82UjJFaG5v?= =?utf-8?Q?pDPhO5gf0vdRwsJe7dVd5Yl7yOrnbaXDwU?= X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-AuthSource: DB8P189MB1032.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Dec 2020 16:26:48.2510 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-Network-Message-Id: 3c89a925-9f20-43df-74a5-08d89c5f3a1c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: IEMnDrSlNOnxaMDhy3CxV/6HE6t2xs6uWUBHjS2i7HOtGQ2PwwVtbcnHQydIKOpBcS2JUJ4EZLIsLZMo0NvzNg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8P189MB1032 Archived-At: Subject: Re: [Ace] WGLC draft-ietf-ace-oscore-profile-13.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 16:26:59 -0000 --KTipmymRcJF3Sr6o85Ru6DCn8SbB5JF7I Content-Type: multipart/mixed; boundary="ydUl9RVJn6Zuq61nxqee7XUuU60dUiBC0" --ydUl9RVJn6Zuq61nxqee7XUuU60dUiBC0 Content-Type: multipart/alternative; boundary="------------C8A22E9E661E0BEF4400FF6B" Content-Language: en-US This is a multi-part message in MIME format. --------------C8A22E9E661E0BEF4400FF6B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Francesca, Thank you for taking care of the review! I think the commits in the PR address all my comments. Best, /Marco On 2020-12-08 16:42, Francesca Palombini wrote: > > Hi Marco, > > =C2=A0 > > Thanks, very helpful as always! I have implemented all the comments in > this PR https://github.com/ace-wg/ace-oscore-profile/pull/44 > > , if you give me the OK I can merge and upload a new submission. Happy > to see that the comments were about clarifications and editorials. > > =C2=A0 > > Inline detailed answers. > > =C2=A0 > > Thanks again! > Francesca > > =C2=A0 > > *From: *Marco Tiloca > *Date: *Thursday, 19 November 2020 at 17:04 > *To: *, Ace Wg > *Subject: *Re: [Ace] WGLC draft-ietf-ace-oscore-profile-13.txt > *Resent from: * > *Resent to: *Francesca Palombini , > , G=C3=B6ran Selander > , > *Resent date: *Thu, 19 Nov 2020 08:03:54 -0800 (PST) > > =C2=A0 > > Hello OSCORE profile authors and ACE, > > Please, find below some WGLC comments. Hope it helps! > > Best, > /Marco > > > > Section 1 > > =C2=A0 > > * s/is not done by a/is not achieved through a > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * s/after the first OSCORE exchange/after the first message exchange > > using OSCORE > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > Section 2 > > =C2=A0 > > * "This specific identifier, encoded as a byte string, is assigned by > > the AS to be unique in the sets of its OSCORE Security Contexts ..." > > =C2=A0 > > =C2=A0=C2=A0 To avoid confusion, it's probably better to say "unique am= ong the > > issued sets of OSCORE input material", since the AS can have actual > > OSCORE Security Contexts it uses to communicate with Clients or Resourc= e > > Servers. > > =C2=A0 > > FP: Ok, fixed. Replaced with OSCORE security input materials > > =C2=A0 > > * Referring to 'id' as specific identifier, the text says: "and is not > > used as input material to derive the full OSCORE Security Context." > > =C2=A0 > > =C2=A0=C2=A0 That's correct, but then the identifier is later included = in Table 1 > > "OSCORE_Input_Material Parameters" :-) > > =C2=A0 > > =C2=A0=C2=A0=C2=A0Perhaps it's fine to just revert to OSCORE_Security_C= ontext_Object, > > both for the name of Table 1 and in different spots of the text? They > > would still consider 'id' as OSCORE Input Material Identifier, while > > aligned with the registry name from Section 9.4. > > =C2=A0 > > FP: I see your point, but the name was source of discussion before and > I'd rather not go back on that. I don't think it is a problem that the > 'id' is both part of the "OSCORE_Input_Material" object and also not > part of the actual input material. After all it needs to be part of > the object to identify it. What I did is to change its CBOR label > though, to have it as 0, since I think that makes more sense that to > be in the middle of other input materials. Note that this is a change > that will affect implementations. > > =C2=A0 > > * s/If the request verifies/If the request is successfully verified > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * s/until token expiration/until token deletion, due to e.g. expiration= > > or revocation > > =C2=A0 > > FP: thanks for this comment. I did only keep expiration as example, > > =C2=A0 > > * s/the same or different/the same or a different one > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * Figure 1 can also show the achievement of mutual authentication, > > following the OSCORE exchange at the end > > =C2=A0 > > FP: Good point, added. > > =C2=A0 > > =C2=A0 > > Section 3.1 > > =C2=A0 > > * s/object. kid field carrying/object, with the kid field carrying > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > Section 3.2 > > =C2=A0 > > * "... profile negotiation can be omitted" - I think "profile signaling= " > > better reflects what may happen here, see also the beginning of the > > paragraph. > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * s/in the the/in the > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * s/in the 'cnf' parameter of the token/in the 'cnf' claim of the token= > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > Section 3.2.1 > > =C2=A0 > > * In the text entries following Table 1, the CBOR integer labels need t= o > > be aligned with the CDDL summary at the end of the section. > > =C2=A0 > > FP: I think it was? Now I moved id to index 0, so I switched the order > there too. > > =C2=A0 > > * s/This parameter identifies the OSCORE_Input_Material/This parameter > > identifies the OSCORE_Input_Material object > > =C2=A0 > > FP: I will let the RFC editors decide on that one :) Don't want to > become too verbose if it's not needed. > > =C2=A0 > > * s/the "id" type is byte string/the "id" type is bstr > > =C2=A0 > > FP: ah, good point. I actually changed all the description to extend > the type (so byte string instead of bstr, etc), in order not to use > CDDL in text. > > =C2=A0 > > * This version -13 has removed 'clientId' and 'serverId' from Table 1 > > and thus as code points from the "OSCORE Security Context Parameters" > > registry. > > =C2=A0 > > =C2=A0 No strong need to include them back, but even if this profile do= es not > > use them and does not send them on the wire, I think they still belong > > to the same namespace, since they are descriptive of a security context= > > and are in fact also used as input material to derive it :-) > > FP: I agree with that, and think the first draft to use them will > register them. The registration of the OSCORE_Input_Material does not > specify how this material is used, that is up to the draft describing > the derivation process, so it does not make sense to register them > here without explaining the derivation process using those parameters. > > =C2=A0 > > Section 4 > > =C2=A0 > > * s/the RS and client authenticates themselves/the RS and client > > authenticate each other > > =C2=A0 > > FP: Ok, fixed. > > * s/successfully verified the response from the RS/successfully verifie= d > > a response from the RS as protected with the established OSCORE context= > > =C2=A0 > > =C2=A0=C2=A0 (similar occurrences are also later in the text) > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > Section 4.1 > > =C2=A0 > > * In the first paragraph, I suggest to rephrase as "and the posted > > access token is still retained". > > =C2=A0 > > =C2=A0 That doesn't require to explicitly mention "valid", since assert= ing > > especially validity can be non-trivial for the client, e.g. in case of > > Token revocation. > > =C2=A0=C2=A0(similar occurrences are also later in the text) > > =C2=A0 > > FP: I am not sure about this one: I don't think talking about > "retaining" an access token is precise enough (a token might be > "retained" in memory, but expired). "Valid" to me seems less > ambiguous. I would expect implementations to have a way to mark token > as valid or non valid (e.g. if expired or revoked). What woud be > difficult for implementations to assert validity? > > * In the second paragraph, I suggest to extend the ending as: > > =C2=A0 > > =C2=A0 "... makes sure that it does not collide with any of its Recipie= nt IDs > > currently used. These include also Recipient IDs used as ID1 value for > > ongoing executions of this profile." > > =C2=A0 > > FP: Good point, I think I got it. Rephrased it with " nor with any > other identifier ID1 if the client is executing this exchange with a > different RS at the same time." > > * s/the client MUST wrap the token and N1 in a CBOR map/the client MUST= > > wrap the token, N1 and ID1 in a CBOR map > > FP: Ok, fixed. > > =C2=A0 > > * s/using the "access_token" parameter/using the 'access_token' paramet= er > > =C2=A0 > > FP: Ok, fixed. > > =C2=A0 > > * In the sixth paragraph, the last sentence says "... as different > > nonces will be used." Doesn't the client and the RS also negotiate new > > IDs like they did in the first posting of the same original token? > > =C2=A0 > > FP: yes, but the client might decide to reuse the same ID, I don't > really see a problem with that. > > =C2=A0 > > * In the last paragraph: "The client MUST only send the access token in= > > the payload, no nonce or identifier are sent." > > =C2=A0 > > =C2=A0=C2=A0 Just to be sure, can you expand on this request format? I = suppose the > > client still uses Content-Format "application/ace+cbor", just including= > > only the 'access_token' entry in the map. Correct? > > =C2=A0 > > FP: Yes that is correct. The request is the same as in Figure 10 with > the exception that it is protected with OSCORE and that no nonce nor > ids are sent. > > =C2=A0 > > * In the last paragraph: "... the RS will replace the old token with th= e > > new one, maintaining the same Security Context." > > =C2=A0 > > =C2=A0=C2=A0 This replacement step can be expanded for clarity. A simpl= e 1-to-1 > > replacement would overwrite also the stored 'cnf' claim from the > > original token, among other things. So it should be more about > > selectively replacing some information originally coming the first > > token, while keeping some other from it. What to actually replace shoul= d > > include, for instance, information related to access rights (e.g. > > scope), and to the new token's lifetime (exp, exi). > > =C2=A0 > > FP: I believe what you were commenting here (i.e. the RS behavior) is > actually described in details in section 4.2, starting with "If the RS > receives the token in a OSCORE protected message...". I only want to > give the intuition here, focusing more on the client without go into > the details of what the RS has to do as a consequence, which is why I > am tempted to not make a change here. But if you think something is > missing from 4.2, let me know and I'll see if we can expand there. > > * While reading this, I was wondering if one could repost the same firs= t > > token to rekey the OSCORE context. This is mentioned at the end of > > Section 4.3, but anticipating the possibility here and adding a forward= > > pointer to Section 4.3 would help. > > =C2=A0 > > FP: I added a paragraph in section 4.1 (starting with "The client may > also chose to re-POST the access token...") > > =C2=A0 > > Section 4.1.1 and Section 4.1.2 > > =C2=A0 > > * The first sentence captures the case where the first token is posted > > or re-posted. It can be rephrased to cover also the posting of a token > > for updating access rights, where these parameters are not included. > > =C2=A0 > > FP: Ok, added text at the end of the sentence. > > =C2=A0 > > Section 4.2 > > =C2=A0 > > * "any of the mandatory=C2=A0=C2=A0=C2=A0 parameters from the AS or the= identifier) ..." > > =C2=A0 > > =C2=A0=C2=A0 It's worth making it explicit that the mentioned identifie= r is 'id'. > > =C2=A0 > > FP: I actually meant the identifier id1. Added it. > > =C2=A0 > > * s/in the 'osc'/in the 'osc' field > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > * "... the RS must respond" --- Should this not be a MUST ? > > =C2=A0 > > FP: No, this requirement comes from the framework, so it is non > normative (the normative one is "The RS MUST follow the procedures > defined in section 5.8.1 of > > =C2=A0=C2=A0 [I-D.ietf-ace-oauth-authz]") > > * s/is different from the ace_client_recipientid/is different from the > > value specified in the received 'ace_client_recipientid' parameter > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > * Second paragraph after Figure 11 > > =C2=A0 > > =C2=A0=C2=A0 - s/MUST discard/MUST ignore > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > =C2=A0=C2=A0=C2=A0- s/the "cnf" parameter of/the 'cnf' claim of > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > =C2=A0=C2=A0 - s/matches the OSCORE Input/matches with the identifier o= f the > > OSCORE Input > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > =C2=A0=C2=A0 - Related to a previous comment about token replacement, s= ome > > information has to be retained from the first token, as not present in > > the new one. > > =C2=A0 > > FP: I am not sure how to implement this comment without making it very > hard to read. I trust readers at this point will understand what > "discard the old token and associate the new token" means. > > =C2=A0 > > =C2=A0=C2=A0=C2=A0-s/in the "cnf" parameter/in the 'cnf' claim > > =C2=A0 > > FP: Ok, done. > > =C2=A0 > > * It can happen that all is fine for the RS, it installs the OSCORE > > Security Context, it responds to the client, and the response gets lost= =2E > > In this case: > > =C2=A0 > > =C2=A0=C2=A0 - After a timeout expiration, can the client simply repost= the same > > token as mentioned at the end of Section 4.3? This can be another reaso= n > > for reposting the original token, to mention in the sixth paragraph of > > Section 4.1. > > =C2=A0 > > FP: Yes, added. > > =C2=A0 > > =C2=A0=C2=A0=C2=A0- Should the server delete the token and the OSCORE S= ecurity Context, > > if not receiving an OSCORE protected request from the client before a > > timeout expires? After all, it's reasonable to assume that a client > > sends a request right away or not long after the token post is > > completed. If this is included, it would be one more point in the bulle= t > > list for the RS in Section 6. > > =C2=A0 > > FP: It is reasonable, however I don't want to add it to Section 6 as I > don't want to make it a requirement to the RS. It is up to > applications to define policies for such a timeout. We make it clear > that it's only after the first OSCORE exchange has happened that C and > RS are assure that the exchange succeeded. How long to wait, I think > should be out of scope. > > =C2=A0 > > Section 4.2.1 and 4.2.2 > > =C2=A0 > > * The first sentence captures the case where the first token is posted > > or re-posted. It can be rephrased to cover also the posting of a token > > for updating access rights, where these parameters are not included. > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > Section 4.3 > > =C2=A0 > > * s/Secret from the parameter, received/Secret from the parameter recei= ved > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > * If the client stops the exchange, it should also unlock the ID1 value= > > previously offered. > > =C2=A0 > > FP: I believe this is implementation details. I think this should be > covered by the clarifications above. > > =C2=A0 > > * s/to RS/to the RS > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > * The end of the last paragraph mentions possibly reposting the same > > first token to rekey the OSCORE context. Consistently with the fourth > > paragraph of Section 4, I suggest to mention here again that this > > request is not protected, since not related to updating access rights. > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > Section 5 > > =C2=A0 > > * s/profile, other/profile, but other > > =C2=A0 > > FP: s/,/; instead, but done > > =C2=A0 > > Section 6 > > =C2=A0 > > * s/context expires/context expires or is revoked=C2=A0=C2=A0 (2 instan= ces) > > =C2=A0 > > FP: Again, I am hesitant to add revoked here, as the framework barely > touches on revocations of tokens, and explicitely states that > expiration is the norm instead. > > =C2=A0 > > * In the fourth bullet point, isn't this actually fine if the reposted > > token is exactly the original first token? In that case, new nonces (an= d > > I guess also IDs) are exchanged. > > =C2=A0 > > FP: This is fine, but it means the RS is wishing to re-derive a new > context, so the old one must be discarded. > > =C2=A0 > > * I think there should be one more bullet point in the client list, for= > > when the client receives back ID2 =3D=3D ID1 from the RS, after having > > reposted the original first access token. > > =C2=A0 > > (This relates to a previous comment for Section 4.1; I thought a > > reposting of the first original token involves an exchange of new nonce= s > > as well as of new IDs) > > =C2=A0 > > FP: Why? I don't understand why this is not already covered. Ah ok so > maybe this is not valid anymore? > > =C2=A0 > > Section 7 > > =C2=A0 > > * s/usecase/use case > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > * s/for a client/for a same client=C2=A0=C2=A0 (2 instances) > > =C2=A0 > > FP: Ok, done (I am sure the RFCEditor will change this to something > else too :) ) > > =C2=A0 > > * I think it's better to expand C and Cs to "client" and "clients" > > =C2=A0 > > FP: Ok, done > > =C2=A0 > > On 2020-11-08 23:51, Daniel Migault wrote: > > Hi,=C2=A0 > > =C2=A0 > > This email starts a WGLC for the draft > draft-ietf-ace-oscore-profile until Monday November 23. We would > like to send the document back to the IESG with sufficient > confidence, so please take the time to review it carefully provide > comments and feed backs. > > Note that also that the document (13) is being reviewed by the > security directorate. > > =C2=A0 > > Yours,=C2=A0 > Daniel=C2=A0 =C2=A0 > > > [1] > https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ > > > =C2=A0 > > ---------- Forwarded message --------- > From: > > Date: Tue, Oct 27, 2020 at 12:14 PM > Subject: [Ace] I-D Action: draft-ietf-ace-oscore-profile-13.txt > To: > > Cc: > > > > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Authentication and Authorization > for Constrained Environments WG of the IETF. > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0: OSCORE Profile of the Authentication and > Authorization for Constrained Environments Framework > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= : Francesca Palombini > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 Ludwig Seitz > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 G=C3=B6ran Selander > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 Martin Gunnarsson > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : d= raft-ietf-ace-oscore-profile-13.txt > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0: 32 > =C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 : 2020-10-27 > > Abstract: > =C2=A0 =C2=A0This memo specifies a profile for the Authentication a= nd > =C2=A0 =C2=A0Authorization for Constrained Environments (ACE) frame= work.=C2=A0 It > =C2=A0 =C2=A0utilizes Object Security for Constrained RESTful Envir= onments > =C2=A0 =C2=A0(OSCORE) to provide communication security and proof-o= f-possession > =C2=A0 =C2=A0for a key owned by the client and bound to an OAuth 2.= 0 access > token. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ > > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-ace-oscore-profile-13 > > https://datatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile= -13 > > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-oscore-profile-1= 3 > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at > tools.ietf.org > . > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > > > =C2=A0 > > --=20 > > Daniel Migault > > Ericsson > > > > _______________________________________________ > > Ace mailing list > > Ace@ietf.org > > https://eur02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2= Fwww.ietf.org%2Fmailman%2Flistinfo%2Face&data=3D04%7C01%7Cmarco.tiloc= a%40ri.se%7C330189d7d82b48dd1e8e08d88438f043%7C5a9809cf0bcb413a838a09ecc4= 0cc9e8%7C0%7C0%7C637404727981024818%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wL= jAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3D= SlpecuiDXwgoE5ogL8jSqtUO7zVut7dr1q6VXX8y9Z8%3D&reserved=3D0 > > > > --=20 > Marco Tiloca > Ph.D., Senior Researcher > =C2=A0 > RISE Research Institutes of Sweden > Division ICT > Isafjordsgatan 22 / Kistag=C3=A5ngen 16 > SE-164 40 Kista (Sweden) > =C2=A0 > Phone: +46 (0)70 60 46 501 > https://www.ri.se > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://eur02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww= =2Eietf.org%2Fmailman%2Flistinfo%2Face&data=3D04%7C01%7Cmarco.tiloca%= 40ri.se%7Cd4ee5984b023490a0e4a08d89b8fead7%7C5a9809cf0bcb413a838a09ecc40c= c9e8%7C0%7C0%7C637430389720972812%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA= wMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3Drr= 8CAJby1Nbe7VD2Hyl%2FxhrfQ8wU4SwB21y%2B06NdP2U%3D&reserved=3D0 --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --------------C8A22E9E661E0BEF4400FF6B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Francesca,

Thank you for taking care of the review! I think the commits in the PR address all my comments.

Best,
/Marco

On 2020-12-08 16:42, Francesca Palombini wrote:

Hi Marco,

=C2=A0

Thanks, very helpful as always! I have implemented all the comments in this PR https://github.com/ace-wg/ace-osco= re-profile/pull/44 , if you give me the OK I can merge and upload a new submission. Happy to see that the comments were about clarifications and editorials.

=C2=A0

Inline detailed answers.

=C2=A0

Thanks again!
Francesca

=C2=A0

From: Mar= co Tiloca <marco.tiloca@ri.se>
Date: Thursday, 19 November 2020 at 17:04
To: <draft-ietf-ace-oscore-profi= le@ietf.org>, Ace Wg <ace@ietf.org>
Subject: Re: [Ace] WGLC draft-ietf-ace-oscore-profile-13.txt
Resent from: <alias-bounces@ietf.org>
= Resent to: Francesca Palombini <francesca.palombini@ericsson.com>, <ludwig.seitz@combitech.se>, G=C3=B6ran Selan= der <goran.selander@ericsson.com>, <martin.gunnarsson@ri.se>
Resent date: Thu, 19 Nov 2020 08:03:54 -0800 (PST)

=C2=A0=

Hello OSCORE profile authors and ACE,

Please, find below some WGLC comments. Hope it helps!

Best,
/Marco



Section 1

=C2=A0

* s/is not done by a/is not achieved through a

=C2=A0

FP: Ok, fixed.

=C2=A0

* s/after the first OSCORE exchange/after the first message exchange

using OSCORE

=C2=A0

FP: Ok, fixed.

=C2=A0

Section 2

=C2=A0

* "This specific identifier, encoded as a byte string, is assigned by

the AS to be unique in the sets of its OSCORE Security Contexts ..."

=C2=A0

=C2=A0=C2=A0 To avoid confusion, it's probably better to say "unique among the

issued sets of OSCORE input material", since the AS can have actual

OSCORE Security Contexts it uses to communicate with Clients or Resource

Servers.

=C2=A0

FP: Ok, fixed. Replaced with OSCORE security input materials

=C2=A0

* Referring to 'id' as specific identifier, the text says: "and is not

used as input material to derive the full OSCORE Security Context."<= o:p>

=C2=A0

=C2=A0=C2=A0 That's correct, but then the identifier is later included in Table 1

"OSCORE_Input_Material Parameters" :-)

=C2=A0

=C2=A0=C2=A0=C2=A0Perhaps it's fine to just revert to OSCORE_Security_Context_Object,

both for the name of Table 1 and in different spots of the text? They

would still consider 'id' as OSCORE Input Material Identifier, while<= o:p>

aligned with the registry name from Section 9.4.

=C2=A0

FP: I see your point, but the name was source of discussion before and I'd rather not go back on that. I don't think it is a problem that the 'id' is both part of the "OSCORE_Input_Material" object and also not part of the actual input material. After all it needs to be part of the object to identify it. What I did is to change its CBOR label though, to have it as 0, since I think that makes more sense that to be in the middle of other input materials. Note that this is a change that will affect implementations.

=C2=A0

* s/If the request verifies/If the request is successfully verified

=C2=A0

FP: Ok, fixed.

=C2=A0

* s/until token expiration/until token deletion, due to e.g. expiration

or revocation

=C2=A0

FP: thanks for this comment. I did only keep expiration as example,

=C2=A0

* s/the same or different/the same or a different one<= /p>

=C2=A0

FP: Ok, fixed.

=C2=A0

* Figure 1 can also show the achievement of mutual authentication,

following the OSCORE exchange at the end

=C2=A0

FP: Good point, added.

=C2=A0

=C2=A0

Section 3.1

=C2=A0

* s/object. kid field carrying/object, with the kid field carrying

=C2=A0

FP: Ok, fixed.

=C2=A0

Section 3.2

=C2=A0

* "... profile negotiation can be omitted" - I think "profile signaling"

better reflects what may happen here, see also the beginning of the

paragraph.

=C2=A0

FP: Ok, fixed.

=C2=A0

* s/in the the/in the

=C2=A0

FP: Ok, fixed.

=C2=A0

* s/in the 'cnf' parameter of the token/in the 'cnf' claim of the token

=C2=A0

FP: Ok, fixed.

=C2=A0

Section 3.2.1

=C2=A0

* In the text entries following Table 1, the CBOR integer labels need to

be aligned with the CDDL summary at the end of the section.

=C2=A0

FP: I think it was? Now I moved id to index 0, so I switched the order there too.

=C2=A0

* s/This parameter identifies the OSCORE_Input_Material/This parameter

identifies the OSCORE_Input_Material object

=C2=A0

FP: I will let the RFC editors decide on that one :) Don't want to become too verbose if it's not needed.

=C2=A0

* s/the "id" type is byte string/the "id" type is bstr=

=C2=A0

FP: ah, good point. I actually changed all the description to extend the type (so byte string instead of bstr, etc), in order not to use CDDL in text.

=C2=A0

* This version -13 has removed 'clientId' and 'serverId' from Table 1

and thus as code points from the "OSCORE Security Context Parameters"

registry.

=C2=A0

=C2=A0 No strong need to include them back, but even if this profile does not

use them and does not send them on the wire, I think they still belong

to the same namespace, since they are descriptive of a security context

and are in fact also used as input material to derive it :-)

FP: I agree with that, and think the first draft to use them will register them. The registration of the OSCORE_Input_Material does not specify how this material is used, that is up to the draft describing the derivation process, so it does not make sense to register them here without explaining the derivation process using those parameters.

=C2=A0

Section 4

=C2=A0

* s/the RS and client authenticates themselves/the RS and client<= o:p>

authenticate each other

=C2=A0

FP: Ok, fixed.

* s/successfully verified the response from the RS/successfully verified

a response from the RS as protected with the established OSCORE context

=C2=A0

=C2=A0=C2=A0 (similar occurrences are also later in the text)

=

=C2=A0

FP: Ok, fixed.

=C2=A0

Section 4.1

=C2=A0

* In the first paragraph, I suggest to rephrase as "and the posted

access token is still retained".

=C2=A0

=C2=A0 That doesn't require to explicitly mention "valid", since asserting

especially validity can be non-trivial for the client, e.g. in case of

Token revocation.

=C2=A0=C2=A0(similar occurrences are also later in the text)

=C2=A0

FP: I am not sure about this one: I don't think talking about "retaining" an access token is precise enough (a token might be "retained" in memory, but expired). "Valid" to me seems less ambiguous. I would expect implementations to have a way to mark token as valid or non valid (e.g. if expired or revoked). What woud be difficult for implementations to assert validity?

* In the second paragraph, I suggest to extend the ending as:

=C2=A0

=C2=A0 "... makes sure that it does not collide with any of its Recipient IDs

currently used. These include also Recipient IDs used as ID1 value for

ongoing executions of this profile."

=C2=A0

FP: Good point, I think I got it. Rephrased it with " nor with any other identifier ID1 if the client is executing this exchange with a different RS at the same time."

* s/the client MUST wrap the token and N1 in a CBOR map/the client MUST

wrap the token, N1 and ID1 in a CBOR map

FP: Ok, fixed.

=C2=A0

* s/using the "access_token" parameter/using the 'access_token' parameter

=C2=A0

FP: Ok, fixed.

=C2=A0

* In the sixth paragraph, the last sentence says "... as different

nonces will be used." Doesn't the client and the RS also negotiate new

IDs like they did in the first posting of the same original token?<= o:p>

=C2=A0

FP: yes, but the client might decide to reuse the same ID, I don't really see a problem with that.

=C2=A0

* In the last paragraph: "The client MUST only send the access token in

the payload, no nonce or identifier are sent."

=C2=A0

=C2=A0=C2=A0 Just to be sure, can you expand on this request format? I suppose the

client still uses Content-Format "application/ace+cbor", just including

only the 'access_token' entry in the map. Correct?

=C2=A0

FP: Yes that is correct. The request is the same as in Figure 10 with the exception that it is protected with OSCORE and that no nonce nor ids are sent.

=C2=A0

* In the last paragraph: "... the RS will replace the old token with the

new one, maintaining the same Security Context."

=C2=A0

=C2=A0=C2=A0 This replacement step can be expanded for clarity. A simple 1-to-1

replacement would overwrite also the stored 'cnf' claim from the=

original token, among other things. So it should be more about

selectively replacing some information originally coming the first

token, while keeping some other from it. What to actually replace should

include, for instance, information related to access rights (e.g.

scope), and to the new token's lifetime (exp, exi).

=C2=A0

FP: I believe what you were commenting here (i.e. the RS behavior) is actually described in details in section 4.2, starting with "If the RS receives the token in a OSCORE protected message...". I only want to give the intuition here, focusing more on the client without go into the details of what the RS has to do as a consequence, which is why I am tempted to not make a change here. But if you think something is missing from 4.2, let me know and I'll see if we can expand there.

* While reading this, I was wondering if one could repost the same first

token to rekey the OSCORE context. This is mentioned at the end of

Section 4.3, but anticipating the possibility here and adding a forward

pointer to Section 4.3 would help.

=C2=A0

FP: I added a paragraph in section 4.1 (starting with "The client may also chose to re-POST the access token...")

=C2=A0

Section 4.1.1 and Section 4.1.2

=C2=A0

* The first sentence captures the case where the first token is posted

or re-posted. It can be rephrased to cover also the posting of a token

for updating access rights, where these parameters are not included.

=C2=A0

FP: Ok, added text at the end of the sentence.

=C2=A0

Section 4.2

=C2=A0

* "any of the mandatory=C2=A0=C2=A0=C2=A0 parameters from the AS = or the identifier) ..."

=C2=A0

=C2=A0=C2=A0 It's worth making it explicit that the mentioned identifier is 'id'.

=C2=A0

FP: I actually meant the identifier id1. Added it.

=C2=A0

* s/in the 'osc'/in the 'osc' field

=C2=A0

FP: Ok, done.

=C2=A0

* "... the RS must respond" --- Should this not be a MUST ?<= /o:p>

=C2=A0

FP: No, this requirement comes from the framework, so it is non normative (the normative one is "The RS MUST follow the procedures defined in section 5.8.1 of

=C2=A0=C2=A0 [I-D.ietf-ace-oauth-authz]")

* s/is different from the ace_client_recipientid/is different from the

value specified in the received 'ace_client_recipientid' parameter

=C2=A0

FP: Ok, done.

=C2=A0

* Second paragraph after Figure 11

=C2=A0

=C2=A0=C2=A0 - s/MUST discard/MUST ignore

=C2=A0

FP: Ok, done.

=C2=A0

=C2=A0=C2=A0=C2=A0- s/the "cnf" parameter of/the 'cnf' claim of

=C2=A0

FP: Ok, done.

=C2=A0

=C2=A0=C2=A0 - s/matches the OSCORE Input/matches with the identifier of the

OSCORE Input

=C2=A0

FP: Ok, done.

=C2=A0

=C2=A0=C2=A0 - Related to a previous comment about token replacement, some

information has to be retained from the first token, as not present in=

the new one.

=C2=A0

FP: I am not sure how to implement this comment without making it very hard to read. I trust readers at this point will understand what "discard the old token and associate the new token" means.

=C2=A0

=C2=A0=C2=A0=C2=A0-s/in the "cnf" parameter/in the 'cnf' claim

=C2=A0

FP: Ok, done.

=C2=A0

* It can happen that all is fine for the RS, it installs the OSCORE

Security Context, it responds to the client, and the response gets lost.

In this case:

=C2=A0

=C2=A0=C2=A0 - After a timeout expiration, can the client simply repost the same

token as mentioned at the end of Section 4.3? This can be another reason

for reposting the original token, to mention in the sixth paragraph of

Section 4.1.

=C2=A0

FP: Yes, added.

=C2=A0

=C2=A0=C2=A0=C2=A0- Should the server delete the token and the OSCORE Security Context,

if not receiving an OSCORE protected request from the client before a

timeout expires? After all, it's reasonable to assume that a client

sends a request right away or not long after the token post is

completed. If this is included, it would be one more point in the bullet

list for the RS in Section 6.

=C2=A0

FP: It is reasonable, however I don't want to add it to Section 6 as I don't want to make it a requirement to the RS. It is up to applications to define policies for such a timeout. We make it clear that it's only after the first OSCORE exchange has happened that C and RS are assure that the exchange succeeded. How long to wait, I think should be out of scope.

=C2=A0

Section 4.2.1 and 4.2.2

=C2=A0

* The first sentence captures the case where the first token is posted

or re-posted. It can be rephrased to cover also the posting of a token

for updating access rights, where these parameters are not included.

=C2=A0

FP: Ok, done

=C2=A0

Section 4.3

=C2=A0

* s/Secret from the parameter, received/Secret from the parameter received

=C2=A0

FP: Ok, done

=C2=A0

* If the client stops the exchange, it should also unlock the ID1 value

previously offered.

=C2=A0

FP: I believe this is implementation details. I think this should be covered by the clarifications above.

=C2=A0

* s/to RS/to the RS

=C2=A0

FP: Ok, done

=C2=A0

* The end of the last paragraph mentions possibly reposting the same

first token to rekey the OSCORE context. Consistently with the fourth

paragraph of Section 4, I suggest to mention here again that this

request is not protected, since not related to updating access rights.<= o:p>

=C2=A0

FP: Ok, done

=C2=A0

Section 5

=C2=A0

* s/profile, other/profile, but other

=C2=A0

FP: s/,/; instead, but done

=C2=A0

Section 6

=C2=A0

* s/context expires/context expires or is revoked=C2=A0=C2=A0 (2 instances)

=C2=A0

FP: Again, I am hesitant to add revoked here, as the framework barely touches on revocations of tokens, and explicitely states that expiration is the norm instead.

=C2=A0

* In the fourth bullet point, isn't this actually fine if the reposted

token is exactly the original first token? In that case, new nonces (and

I guess also IDs) are exchanged.

=C2=A0

FP: This is fine, but it means the RS is wishing to re-derive a new context, so the old one must be discarded.

=C2=A0

* I think there should be one more bullet point in the client list, for

when the client receives back ID2 =3D=3D ID1 from the RS, after havi= ng

reposted the original first access token.

=C2=A0

(This relates to a previous comment for Section 4.1; I thought a=

reposting of the first original token involves an exchange of new nonces<= o:p>

as well as of new IDs)

=C2=A0

FP: Why? I don't understand why this is not already covered. Ah ok so maybe this is not valid anymore?

=C2=A0

Section 7

=C2=A0

* s/usecase/use case

=C2=A0

FP: Ok, done

=C2=A0

* s/for a client/for a same client=C2=A0=C2=A0 (2 instances)=

=C2=A0

FP: Ok, done (I am sure the RFCEditor will change this to something else too :) )

=C2=A0

* I think it's better to expand C and Cs to "client" and "clients"

=C2=A0

FP: Ok, done

=C2=A0

On 2020-11-= 08 23:51, Daniel Migault wrote:

Hi,=C2=A0=

=C2= =A0

This em= ail starts a WGLC for the draft draft-ietf-ace-oscore-profile until Monday November 23. We would like to send the document back to the IESG with sufficient confidence, so please take the time to review it carefully provide comments and feed backs.<= /p>

Note th= at also that the document (13) is being reviewed by the security directorate.

=C2= =A0

Yours,=C2= =A0
Daniel=C2=A0 =C2=A0


[1] https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/<= /o:p>

=C2=A0




A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0: OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0: Francesca Palombini
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Ludwig Seitz
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 G=C3=B6ran Selander
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Martin Gunnarsson
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0= =C2=A0 : draft-ietf-ace-oscore-profile-13.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0: 32
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 : 2020-10-27

Abstract:
=C2=A0 =C2=A0This memo specifies a profile for the Authentication and
=C2=A0 =C2=A0Authorization for Constrained Environments= (ACE) framework.=C2=A0 It
=C2=A0 =C2=A0utilizes Object Security for Constrained R= ESTful Environments
=C2=A0 =C2=A0(OSCORE) to provide communication security= and proof-of-possession
=C2=A0 =C2=A0for a key owned by the client and bound to= an OAuth 2.0 access token.


The IETF datatracker status page for this draft is:
= https://da= tatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/

There are also htmlized versions available at:
https://to= ols.ietf.org/html/draft-ietf-ace-oscore-profile-13
https://da= tatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile-13

A diff from the previous version is available at:
https://ww= w.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-oscore-profile-13


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.= ietf.org/internet-drafts/


_______________________________________________
Ace mailing list
Ace@ietf.org
https://ww= w.ietf.org/mailman/listinfo/ace


= =C2=A0

--

D= aniel Migault

E= ricsson



_____________________________=
__________________
Ace mailing list
          
Ace@ietf.org

          
https://eur02.safelinks.protect=
ion.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2F=
ace&amp;data=3D04%7C01%7Cmarco.tiloca%40ri.se%7C330189d7d82b48dd1e8e0=
8d88438f043%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C6374047279810248=
18%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik=
1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=3DSlpecuiDXwgoE5ogL8jSqtUO7zVut=
7dr1q6VXX8y9Z8%3D&amp;reserved=3D0

        



-- 
Marco Tiloca
Ph.D., Senior Researcher
=C2=A0
RISE Research Institutes of Swe=
den
Division ICT
Isafjordsgatan 22 / Kistag=C3=A5=
ngen 16
SE-164 40 Kista (Sweden)
=C2=A0
Phone: +46 (0)70 60 46 501=

https://www.ri.se

____________________________=
___________________
Ace mailing list
Ace@ie=
tf.org
https://eur02.safelinks.prot=
ection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo=
%2Face&amp;data=3D04%7C01%7Cmarco.tiloca%40ri.se%7Cd4ee5984b023490a0e=
4a08d89b8fead7%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C6374303897209=
72812%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI=
6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=3Drr8CAJby1Nbe7VD2Hyl%2Fxhrf=
Q8wU4SwB21y%2B06NdP2U%3D&amp;reserved=3D0


--=20
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistag=C3=A5ngen 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www=
=2Eri.se
--------------C8A22E9E661E0BEF4400FF6B-- --ydUl9RVJn6Zuq61nxqee7XUuU60dUiBC0-- --KTipmymRcJF3Sr6o85Ru6DCn8SbB5JF7I Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl/Q+sUACgkQ7iZktA5Y 2kPt7wgAhxd2FKjqYY71LQoVRjGJBWcl0edVja1I/KaouEN0dfxFCAipdbPwm3pK W09bI9uL7tvbva4vSkFWpL1gkYe03d/lKmoT9Fym877pSUua7rKaW+oaOrMZI6LD EXYdh5s/6lpv4DEVXUA+Rhp4SIOUbI63PbbXXVaJ3Fu8vNdYgt+UbXYQPDclEZR8 gnT9I6rPH9ipVru0l/bg07QVR85VPaRm4IMwvx+sWQYn0X+1Ce6d+LSUsidca/d0 yfSKHJPW3DznSbsa+UeRBEod1/3u7tnGNpxz04qVMR3QLW1b4UbkzHNYQYPm0wdr aw5BRtmbhH7Pa1052rSVT8U42OmSfg== =7xyx -----END PGP SIGNATURE----- --KTipmymRcJF3Sr6o85Ru6DCn8SbB5JF7I-- From nobody Wed Dec 9 10:56:01 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3648E3A16F9; Wed, 9 Dec 2020 10:55:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ck3Y2vIcFDeB; Wed, 9 Dec 2020 10:55:51 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C68D83A16F8; Wed, 9 Dec 2020 10:55:49 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 75E76389B6; Wed, 9 Dec 2020 13:58:04 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 63AalG54iDPk; Wed, 9 Dec 2020 13:57:59 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id CA4E23897F; Wed, 9 Dec 2020 13:57:59 -0500 (EST) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 45DEA4CE; Wed, 9 Dec 2020 13:55:44 -0500 (EST) From: Michael Richardson To: Dan Garcia , EMU WG , "core\@ietf.org WG \(core\@ietf.org\)" , "ace\@ietf.org" In-Reply-To: <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2020 18:55:53 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dan Garcia wrote: > EAP can be used in the context of IoT for authentication. But, to what end? 1) If it is onboarding a new device, then there is no connectivity until af= ter authentication. so you can't use CoAP, you have to use 802.1x, or some equivalent, or create a system such as draft-ietf-6tisch-minimal-security. Which does use CoAP and OSCORE already. 2) If it for application authentication, then you need to use EAP to setup MSK for later use by a context. We do this in IKEv2, (D)TLS already. So the only left would be OSCORE, yet you write "could", as if it was an af= terthought. Tell me what is your application? What will be impossible if we don't do this work? =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl/RHbAACgkQgItw+93Q 3WUncggAtcaOylWEfd+IfdxcoXv2Lx97ZXXqQnCfrzofphRr/6hTgWymyfAURfbc AB+QQ3FVx7hMeqaGEt+kD0fNKxnZ73/5HyvfIjHajjz08lMc4CToZ41HEke7RN9Q kzeplxiOX64CqE+vzRBtWqAW0yAo7pV32BOHWrr3N9o2h9NVlMhw1zrMnZapArDQ g82zwn5TeUhejSpMkejaPJJlamI+eXrDAMkyZKl4pqK8UWp+lKO5Gbdvrur5ciRr rAN5p8hYwSRx8261FeCTaVcGV10EIc0HZD79wcOMMCVnn3cTbM27Rll9CY2HDNoB MazLl3K5ST5Hk1PyvtTgUq0amSMM3g== =p9mi -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Dec 10 01:04:53 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D6123A0B5C; Thu, 10 Dec 2020 01:04:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=unioviedo.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9M3mWrLhlLFZ; Thu, 10 Dec 2020 01:04:41 -0800 (PST) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2057.outbound.protection.outlook.com [40.107.22.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 830FE3A0BD4; Thu, 10 Dec 2020 01:04:33 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lOrH+iC6zsTINTnEGc2R1JLVBKRbbw3fAy8Z+J81CEy5EVB31J+3RxKamqHjg9cVtRTMZPpJwpC+1o9/eD1ANCcQRflz8/cqCI2TLdBZw3G//Ocsakot8Ba0C9dU/cc16Oqkf5lNYTm0gAFCtM47ov9TMZotD394EFmWy9OpZsd/5yscJT2o2U4LRiCiv3g9wwraTotRfqF/N2dgFI0K2T5IW+U7Gkf3+7t9dko9IyFIN1EjBL0oz9g4DTj0jpfdGAcTfDZD8W/lKQBWWK0IbOQMKnwo3U23buVBa86w7+eaaS+KXxTNG9bTx8Sfhm12chGrn5nYltrDTvWCtO5buw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OnfGbTkulmuLihmoksCO/OLgtd+sfEb2/TAQC55Zlu0=; b=OuyHdwAyiKBwNnLpJ7JAxKLqEEsPRe4fHVVvYFiZkvSK4WGHPQ3pMDZFPQTJdOReHQiVDKpUQdVeFcyqTminxhfDYoC5jnRGPFAirdoc11gngUOebUhKefQCvtrJD43XpYMMocrdmXgWl8fX165c6m4TdkBGhPJDay1jehjdH2A3wdDLf3pgXZD0Tj0T2b33KH8y/r786KRXxFjLsMe2ouqknKyGBI/QOF/Gv9ilzdaSf/UnN5XmErk7XNgBAVfJ8WdjDpIAVVWDgFeFcJ+tkmOUXnh8qAkEoglhFhE6AgyGc4+N43oJJdIIh3W6Bk482i1MlzsZsHsBYDoShFWh6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=uniovi.es; dmarc=pass action=none header.from=uniovi.es; dkim=pass header.d=uniovi.es; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unioviedo.onmicrosoft.com; s=selector2-unioviedo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OnfGbTkulmuLihmoksCO/OLgtd+sfEb2/TAQC55Zlu0=; b=xM7ALbuqMJ4vw9cXMMtB7FgHAg3ZM/VzsD3O+eEFllMFtJqaZ7qyUG8mvKHsnkzmen9XKRAga1DPjgnMhcYIWijsrAfwLUq5jtzFTQrTwpE9FyjJkXCjFu4foqc3s6oEELomLwiWqy1IFPd4MRzptBE6A3bClbN+kjEG2Gi68R4= Authentication-Results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=uniovi.es; Received: from AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) by AM0PR08MB3442.eurprd08.prod.outlook.com (2603:10a6:208:d7::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.21; Thu, 10 Dec 2020 09:04:30 +0000 Received: from AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd]) by AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd%7]) with mapi id 15.20.3654.012; Thu, 10 Dec 2020 09:04:30 +0000 To: Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> <2923.1607540144@localhost> From: Dan Garcia Message-ID: <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> Date: Thu, 10 Dec 2020 10:04:28 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 In-Reply-To: <2923.1607540144@localhost> Content-Type: multipart/alternative; boundary="------------2CC5B6F2F9AC00C1F41295BD" Content-Language: en-US X-Originating-IP: [217.113.247.231] X-ClientProxiedBy: MR2P264CA0038.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500::26) To AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from MacBook-Pro-de-Dan-2.local (217.113.247.231) by MR2P264CA0038.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.21 via Frontend Transport; Thu, 10 Dec 2020 09:04:30 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 334aa923-eabf-4ee8-c107-08d89cea9af3 X-MS-TrafficTypeDiagnostic: AM0PR08MB3442: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: S2Yi7b6yueEBsKGHbEb+ce5vUltyn2p3X1QQpEe4sogOUNn2c67CGTb/PSppw6TfZI3FiPlvpkKVhEG6aihoNdhsdUhMf9/qkwhxIWWfPeVFI28j2SaGe7eLfIlPYeVY0YXgaoYnOP36L8VBA9uYs3FVhH8PRwhi578TiCwcvFDlJoGHauVmqZLCtqlad6BhS3y82LAbCylYHtuxijHnsylFqEF1/VlsrGnJYufJBayjmySLw/CFTkwpZpSQCLkmlzLbUWwItf0JDjeU5+CVoSfksI9iaobUTYkDkX//rIq2S6BbKt3dYhDo0SQAzvjZD6QB4ZKv9m7hXx9M97cqgWvmrHUc1s1oucuSigSqjv1A/eXsU+iuBhUu16Oye5iZd6iPfsQt/2h5i/iL3hXjvOl5ihyYFotu4rY6Ez/sTmE= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3940.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(366004)(346002)(136003)(786003)(508600001)(66946007)(8936002)(66556008)(36756003)(956004)(31696002)(66574015)(110136005)(83380400001)(86362001)(66476007)(2616005)(186003)(2906002)(8676002)(16526019)(52116002)(33964004)(26005)(6506007)(53546011)(6486002)(31686004)(6512007)(5660300002)(45980500001)(43740500002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?SGZBdzZiVHhqRGd5VHNxOW9POWlRU3lUTSs0UUt0dy9uZkNOMVRCc3BBTjZz?= =?utf-8?B?bXBvdndRMkl1V1BQYUJBYjZ3ekdNOXBmYUlUcDI0bmFFRDZhaXloeWl4d3lv?= =?utf-8?B?eEpQUzNheWFKOHE2QmdJVDBEN1QyelJkNTU4T3gza3ByZTRLWmRZVUQyR25R?= =?utf-8?B?YU11eS9XcmRkZlhQeldjTHF6UlB6YUE5a3VMaUdOTFRiVk5xL0VCaHIxTGkz?= =?utf-8?B?ZkRDV0l4MytyZjVZTWNRbllFUWdPNEQ2SU9hUnJQZEMzOFVibEQxZW9yYU5u?= =?utf-8?B?TFpFVEhTVnVZNFFSRDlNVjJLZTd2MTlpanI2YXpLWWFVTTJ2NHpSTUtnVkZD?= =?utf-8?B?SHh6cUpvdk5xQms3RURvN3RxakFoOFhSR2dZZThhV1p4RXFqWEE1WEtmR1ox?= =?utf-8?B?ZVRGeXpMb0JwdWUxeENYTnU1OVZCbGF0eUY2czFBa2s4Njh4WCs5eHF1VVdo?= =?utf-8?B?UzEzZUViVnZVT2UyaUxnL0ZqbGlMQkhhTnZsbi81NUU3emZCWWtHOUVnTC9q?= =?utf-8?B?RGYwcjljc1lNaE1nVzF5VFhsbmtCa3dXNC9TMzRpQWwwaGJtQUZzVkVEeWFk?= =?utf-8?B?SE9zMVhsYTRBaW8xTmdDdHB2cTNRcHFBTGZiSFd4eHFJbVMrck1GdGgyK0po?= =?utf-8?B?MUw0dWxMc2kwQWhGYmRrWWxuc05iSE5qYWYwUkI5TC9UNktibDRtUHoxZ3da?= =?utf-8?B?QWkvSHZwOWRlK0h6aGYyUHpXd25qeFZoOVlqUnU2OUo2Z3h1VFdRRGVDNVBl?= =?utf-8?B?NnBReDFVNEtoS3o0SEJZcDd2M0luYzFLZWZrd2lYaXlORnJ0QW0wclVhQUhT?= =?utf-8?B?dVFHYzVubE5ndGJra2JYWWo3dUhZUFFqdGZNdUdOdGI3ei9pM0p4aXlNTzB0?= =?utf-8?B?alJnL2hrcDdKUUtmcFFCMmZiN1NHTE0ySVBPUXN5akYzQldwK0RhbFoyVlVr?= =?utf-8?B?STdURFdUeExicjc1enRtYjZpdnQvUXVlZ3FxUnNRU2pZakZYUXZBR2pUTzQr?= =?utf-8?B?QkswTEk5aDZvZ1VOTTRQc0h0aEN1ODljNnlibnRwM0RmNjFUSUZzL0wzSVRa?= =?utf-8?B?RGNHYlNuUktSTjREckxxUEg0Z0x5SEtGOEl0QjBoZnJMaHZaWUV5OWptdHZn?= =?utf-8?B?dkhPRFNtL29pN0VwR0ZRZzhpK3RKOHdhUVlkL05YT3AyNVFEN1c5QnF2VDQx?= =?utf-8?B?b0Y4V1dZMEtHS2c2MWdaZ3RVMXkxcGxCeG9Qc0pleFlyRlAyQnlUZmRyWm1o?= =?utf-8?B?Um92Smp4ZTVkQUw2d1JsYktSeGVOTmdscWFNalpQTzJvQnpMenlpMUo5VDhJ?= =?utf-8?Q?4O9mN+TakpnFSlGeNgkGAWHJV3OV99lb85?= X-OriginatorOrg: uniovi.es X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2020 09:04:30.7752 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 05ea74a3-92c5-4c31-978a-925c3c799cd0 X-MS-Exchange-CrossTenant-Network-Message-Id: 334aa923-eabf-4ee8-c107-08d89cea9af3 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rcxUgXGXEw3qEBLvXbYQLkHrfxaYmfPcCzA+LugC9B0TMYqCFUE6iFWxXz9BBeUNl87Il3S3vPFLiXxerBctow== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3442 X-MS-Exchange-CrossPremises-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossPremises-AuthAs: Internal X-MS-Exchange-CrossPremises-AuthMechanism: 06 X-MS-Exchange-CrossPremises-Mapi-Admin-Submission: X-MS-Exchange-CrossPremises-MessageSource: StoreDriver X-MS-Exchange-CrossPremises-BCC: X-MS-Exchange-CrossPremises-OriginalClientIPAddress: 217.113.247.231 X-MS-Exchange-CrossPremises-TransportTrafficType: Email X-MS-Exchange-CrossPremises-Antispam-ScanContext: DIR:Originating; SFV:NSPM; SKIP:0; X-MS-Exchange-CrossPremises-SCL: 1 X-MS-Exchange-CrossPremises-Processed-By-Journaling: Journal Agent X-OrganizationHeadersPreserved: AM0PR08MB3442.eurprd08.prod.outlook.com Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 09:04:44 -0000 --------------2CC5B6F2F9AC00C1F41295BD Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit  Hi Michael, "/1) .../" For onboarding a new device, where there is no connectivity after authentication, you propose to use 802.1X, which is an EAP lower layer. EAP over CoAP is in fact a proposal for a application level EAP lower layer that overcomes the limitation that 802.1X works on an inferior layer, hence, giving the possibility to perform the network authentication through nodes. This idea is not new, in fact, you have PANA, another EAP lower layer that works on top of UDP. As you comment , draft-ietf-6tisch-minimal-security - offers minimal security and has several deficiencies that can be solved by using EAP and AAA infrastructures. Regarding your second point "/2) If it for application authentication, then you need to use EAP to setup MSK for later use by a context. We do this in IKEv2, (D)TLS already./" Our proposal is to define an EAP lower layer that is specifically designed for constrained devices and networks. The setup of the MSK for later use, is what the EAP KMF does, and  this key material is used to run a security association protocol, that could be DTLS or OSCORE.  That is why it is not an afterthought as you say. I wrote could, because is one of the possibilities. That is another benefit of using EAP. With respect to do this with IKEv2, EAP already has an EAP method for IKE. Why limit the options when EAP gives you more. What will you do if the specific network does not support running IKEv2 due to severe constrains in the network or any other reason? That is why I believe the flexibility EAP gives you is worth considering. Best Regards, Dan. On 9/12/20 19:55, Michael Richardson wrote: > Dan Garcia wrote: > > EAP can be used in the context of IoT for authentication. > > But, to what end? > > 1) If it is onboarding a new device, then there is no connectivity until after authentication. > so you can't use CoAP, you have to use 802.1x, or some equivalent, or > create a system such as draft-ietf-6tisch-minimal-security. > Which does use CoAP and OSCORE already. > > 2) If it for application authentication, then you need to use EAP to setup > MSK for later use by a context. > We do this in IKEv2, (D)TLS already. > > So the only left would be OSCORE, yet you write "could", as if it was an afterthought. > > Tell me what is your application? What will be impossible if we don't do > this work? > > -- > Michael Richardson . o O ( IPv6 IøT consulting ) > Sandelman Software Works Inc, Ottawa and Worldwide > > > > --------------2CC5B6F2F9AC00C1F41295BD Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

 Hi Michael,


"1) ..."

For onboarding a new device, where there is no connectivity after authentication, you propose to use 802.1X, which is an EAP lower layer. EAP over CoAP is in fact a proposal for a application level EAP lower layer that overcomes the limitation that 802.1X works on an inferior layer, hence, giving the possibility to perform the network authentication through nodes.

This idea is not new, in fact, you have PANA, another EAP lower layer that works on top of UDP.

As you comment , draft-ietf-6tisch-minimal-security - offers minimal security and has several deficiencies that can be solved by using EAP and AAA infrastructures.

Regarding your second point

"2) If it for application authentication, then you need to use EAP to setup MSK for later use by a context. We do this in IKEv2, (D)TLS already."

Our proposal is to define an EAP lower layer that is specifically designed for constrained devices and networks. The setup of the MSK for later use, is what the EAP KMF does, and  this key material is used to run a security association protocol, that could be DTLS or OSCORE.  That is why it is not an afterthought as you say. I wrote could, because is one of the possibilities. That is another benefit of using EAP.

With respect to do this with IKEv2, EAP already has an EAP method for IKE. Why limit the options when EAP gives you more. What will you do if the specific network does not support running IKEv2 due to severe constrains in the network or any other reason?

That is why I believe the flexibility EAP gives you is worth considering.

Best Regards,
Dan.



On 9/12/20 19:55, Michael Richardson wrote:
Dan Garcia <dan.garcia@um.es> wrote:
    > EAP can be used in the context of IoT for authentication.

But, to what end?

1) If it is onboarding a new device, then there is no connectivity until after authentication.
   so you can't use CoAP, you have to use 802.1x, or some equivalent, or
   create a system such as draft-ietf-6tisch-minimal-security.
   Which does use CoAP and OSCORE already.

2) If it for application authentication, then you need to use EAP to setup
   MSK for later use by a context.
   We do this in IKEv2, (D)TLS already.

So the only left would be OSCORE, yet you write "could", as if it was an afterthought.

Tell me what is your application?  What will be impossible if we don't do
this work?

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide
--------------2CC5B6F2F9AC00C1F41295BD-- From nobody Thu Dec 10 02:06:57 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B5683A0C0D for ; Thu, 10 Dec 2020 02:06:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.087 X-Spam-Level: X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X_d_qNX0ljP2 for ; Thu, 10 Dec 2020 02:06:52 -0800 (PST) Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BA9A3A0C06 for ; Thu, 10 Dec 2020 02:06:52 -0800 (PST) Received: by mail-wr1-x435.google.com with SMTP id i9so4829533wrc.4 for ; Thu, 10 Dec 2020 02:06:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=jceX21/QwqIXsAOzfHcrViyc5tWVqKvGca+cs6S9Nfo=; b=MecW5Pg7v9747wDuJYvw4d0IY3fc6dD3ZWKxx5lw/YBLVT9UntsgkQNJlWLNO97aDQ 8MGC4FE5irWjV7jHaTY5bvgNVNfsxMXeHm/O/m9luJim8Q9TpBVX7C6Wo8p1Yhq7nxb+ UFtvVS/n9FblLG870hmIg6OBW3TiPubX8+7iFw3zCnxZJRNgR4iWEotCK41chqfFk4C/ bYA86MsCdp2WEJpsL+Y8R2l9GezvQyX9rbQgss42Dsmn1yuca2uDTiiu0A0YAO2SAYuO TKpgE4FGP7+VkX7x1gWAf4A7LbrcznFEw9VKQyOgLMPXs+JO9/LfybUN5SeoA7+Ioh1Q hxZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=jceX21/QwqIXsAOzfHcrViyc5tWVqKvGca+cs6S9Nfo=; b=Aj5Dkvi6XzVV7+pUBEJ8wX0G5BwyRcymT+WZFygsWwsj4C/Y+XCvDLnJh+HVTPy2Rr LlWQzD28lqjs4nw/AbAdQ3moanuy+nmYdTWjp36sN1VD1BeP7DKi//VaALt/5poSCrwy m7asxiqeu8XG0oPtyrbbp8IRNJRV4nBRMQNnF99Lu4iJte8rlciFbzVu5IYiDsgSxsAC 4r6YDN/UE+9g+oAb2Ey3bnE22gtbQuB3i3wgT6QabFTqopLIHyJV7LgOshvzy9R+Rnyo Kug9UsWTPEh+c1ifNyQMdsuFYTrtwu/QP2YSRCOBat7IbYk3s0C24qnFpUdfYpkdsI0A Ekdg== X-Gm-Message-State: AOAM533HxOpmq5c1fw+miKydDfU+wmKJINkXyJtve22MN6Z4Uo0TkABH GEBDkogy/I4eZZ8M5qZMviM= X-Google-Smtp-Source: ABdhPJwphvc5owH9adTR0DbNe93kVWEGCNVtUrW0g/0zvO7wI13rycTZslc3W35CdjWn9QvvwefiZA== X-Received: by 2002:a05:6000:1d1:: with SMTP id t17mr7528543wrx.164.1607594810445; Thu, 10 Dec 2020 02:06:50 -0800 (PST) Received: from ?IPv6:2a01:e0a:170:d730:650f:50f1:7d5e:fd24? ([2a01:e0a:170:d730:650f:50f1:7d5e:fd24]) by smtp.gmail.com with ESMTPSA id r13sm8344682wrm.25.2020.12.10.02.06.49 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Dec 2020 02:06:49 -0800 (PST) From: Georgios PAPADOPOULOS Message-Id: <0C9136E1-4D56-4056-9888-4B2FF958430D@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_99D53534-2F0A-4D11-9076-4FAA8007FF09" Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.20.0.2.21\)) Date: Thu, 10 Dec 2020 11:06:48 +0100 In-Reply-To: Cc: ace@ietf.org To: Dan Garcia References: <20201117234700.GR39170@kduck.mit.edu> X-Mailer: Apple Mail (2.3654.20.0.2.21) Archived-At: Subject: Re: [Ace] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 10:06:56 -0000 --Apple-Mail=_99D53534-2F0A-4D11-9076-4FAA8007FF09 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dear all, +1, I'd be curious to see EAP-over-CoAP. +1, It seems to me that ACE could be home for such a document. Best, Giorgos > On 3 Dec 2020, at 12:10, Dan Garcia wrote: >=20 > Dear all: >=20 > Regarding the new charter, since ACE is considering the definition of = CoAP transport for CMPv2 = (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00 = ), = we were wondering whethere it could also consider specifying EAP = (Extensible Authentication Protocol) over CoAP. >=20 > In this sense, we proposed this some time ago and we have = implementations about this. >=20 > https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06 = > https://www.mdpi.com/1424-8220/16/3/358 = > https://www.mdpi.com/1424-8220/17/11/2646 = >=20 > The usage of CoAP can provide a very light and link-layer independent = (we even tested in LoRa networks) EAP lower-layer (transport for EAP) = suitable for IoT enviroment. We believe this would be really useful = since EAP provides flexibility for the authentication and it is a = well-known protocol. >=20 > Therefore, we would like to propose the following modification to the = charter: >=20 > "The Working Group will examine how to use Constrained Application = Protocol (CoAP) as a transport medium for certificate enrollment = protocols, such as EST and CMPv2, as well as a transport for = authentication protocols such as EAP, and standardize them as needed." >=20 > This modification does not necessarily mean the adoption of our draft. = After all, we completely understand that this would happen only if there = is an interest in the WG. Nevertheless, we would like to avoid that the = charter is a barrier later if there is interest in the WG to work in = this transport of EAP over CoAP: >=20 > Any opinion about this? >=20 > Best Regards. >=20 > El 18/11/2020 a las 8:08, Daniel Migault escribi=C3=B3: >> Hi,=20 >>=20 >> Please find the proposed charter we agreed on during the interim = meeting. If you would like to propose any change, please use the = following URL by November 25: >>=20 >> = https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXho= DiptY/edit?usp=3Dsharing = >>=20 >> Yours,=20 >> Daniel >>=20 >> The Authentication and Authorization for Constrained Environments = (ace) WG has defined a standardized solution framework for = authentication and authorization to enable authorized access to = resources identified by a URI and hosted on a resource server in = constrained environments.=20 >> The access to the resource is mediated by an authorization server, = which is not considered to be constrained. >>=20 >> Profiles of this framework for application to security protocols = commonly used in constrained environments, including CoAP+DTLS and = CoAP+OSCORE, have also been standardized. The Working Group is charged = with maintenance of the framework and existing profiles thereof, and may = undertake work to specify profiles of the framework for additional = secure communications protocols and for additional support services = providing authorized access to crypto keys (that are not necessarily = limited to constrained endpoints, though the focus remains on deployment = in ecosystems with a substantial portion of constrained devices). >>=20 >> In addition to the ongoing maintenance work, the Working Group will = extend the framework as needed for applicability to group = communications, with initial focus on (D)TLS and (Group) OSCORE as the = underlying group communication security protocols. The Working Group = will standardize procedures for requesting and distributing group keying = material using the ACE framework as well as appropriated management = interfaces.=20 >>=20 >> The Working Group will standardize a format for expressing = authorization information for a given authenticated principal as = received from an authorization manager.=20 >>=20 >> The Working Group will examine how to use Constrained Application = Protocol (CoAP) as a transport medium for certificate enrollment = protocols, such as EST and CMPv2, and standardize as needed. >>=20 >>=20 >> On Tue, Nov 17, 2020 at 6:47 PM Benjamin Kaduk > wrote: >> Thanks for updating the draft charter at [1], Daniel! >>=20 >> I note that Michael raised the question of whether some other group = might >> also be interested in working on CMP-over-coap, so the IESG will be = sure to >> discuss that if CMP is still in the draft ACE charter when it goes to = the >> IESG for review. >>=20 >> -Ben >>=20 >> On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote: >> > Thank you all for the feed backs. For the purpose of driving the = charter >> > discussion at the IETf 109, I have added the comments into the = proposed >> > text [1]. >> >=20 >> > My current understanding is that it seems beneficial to add CMPv2 = over CoAP >> > in the charter. I am happy to be contradicted. >> > * I have not seen a clear cut to do one or the other. >> > * EST and CMPv2 are two protocols that can be used for enrollment = or cert >> > management while addressing different cases / needs / situations -- = maybe >> > we can clarify that point. I can see leveraging the existing CMP >> > infrastructure, but it seems that is not the only one. >> > * I am not convinced that not having CMP over CoAP will not prevent = its >> > deployment and as such I prefer to have it standardized - this = might be a >> > personal thought. >> > * Adding any piece of work require cycles, but it seems to me that = CPM will >> > not have a major impact on the WG progress. The work will probably = include >> > other WG such a LAMPS. >> >=20 >> > Yours, >> > Daniel >> >=20 >> > [1] >> > = https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXho= DiptY/edit?usp=3Dsharing = >> >=20 >> > On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault > wrote: >> >=20 >> > > Hi Goran, >> > > >> > > I added the text to the charter we will discuss later. >> > > >> > > Yours, >> > > Daniel >> > > >> > > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran Selander < >> > > goran.selander@ericsson.com > = wrote: >> > > >> > >> Hi Daniel, >> > >> >> > >> >> > >> >> > >> Here=E2=80=99s another input to the charter. >> > >> >> > >> >> > >> >> > >> The current group key management solutions addresses the problem = of >> > >> authorized access to group keys and public keys of group = members. >> > >> >> > >> >> > >> >> > >> A related problem is authorized access of public keys of other = devices >> > >> not necessarily part of a security group, in the sense of = sharing a >> > >> symmetric key used to protect group messages. >> > >> >> > >> >> > >> >> > >> Authorized access to raw public keys serves an important = function in >> > >> constrained settings where public key certificates may not be = feasible due >> > >> to the incurred overhead, e.g. for when authenticating using = EDHOC >> > >> (draft-ietf-lake-edhoc). >> > >> >> > >> This functionality is thus a subset of what is already = supported, but >> > >> since the current solution is geared towards groups a different = solution >> > >> may be needed (although it is probably possible to reuse parts = from the >> > >> existing schemes for provisioning and requesting public keys). >> > >> >> > >> >> > >> >> > >> With this in mind, I propose the following change (highlighted = in >> > >> boldface below): >> > >> >> > >> >> > >> >> > >> OLD >> > >> >> > >> The Working Group is charged with maintenance of the framework = and >> > >> existing profiles thereof, and may undertake work to specify = profiles of >> > >> the framework for additional secure communications protocols = (that are not >> > >> necessarily limited to constrained endpoints, though the focus = remains on >> > >> deployment ecosystems with a substantial portion of constrained = devices). >> > >> >> > >> >> > >> >> > >> NEW >> > >> >> > >> The Working Group is charged with maintenance of the framework = and >> > >> existing profiles thereof, and may undertake work to specify = profiles of >> > >> the framework for additional secure communications protocols = *and **for >> > >> additional **support services **providing* *authorized access to = crypto* *keys >> > >> *(that are not necessarily limited to constrained endpoints, = though the >> > >> focus remains on deployment ecosystems with a substantial = portion of >> > >> constrained devices). >> > >> >> > >> >> > >> >> > >> G=C3=B6ran >> > >> >> > >> >> > >> >> > >> >> > >> >> > >> >> > >> >> > >> On 2020-10-15, 19:50, "Ace" > wrote: >> > >> >> > >> Hi, >> > >> >> > >> I would like to start the charter discussion. Here is a draft of = a >> > >> proposed charter [1]. >> > >> >> > >> >> > >> >> > >> It seems to be that additional discussion is needed with regard = to the >> > >> last paragraph related certificate management. In particular the = discussion >> > >> might revive a discussion that happened in 2017 [2] - when I was = not >> > >> co-chair of ACE -and considered other expired work such as [3]. = Please make >> > >> this discussion constructive on this thread. >> > >> >> > >> >> > >> >> > >> The fundamental question is whether we need certificate = management at >> > >> this stage. If the answer is yes, and we have multiple = proposals, it would >> > >> be good to clarify the position of the different proposals and = evaluate >> > >> whether a selection is needed or not before validating the = charter. >> > >> >> > >> >> > >> >> > >> Please provide your inputs on the mailing list before October = 30. Of >> > >> course for minor edits, you may suggest them directly on the = google doc. >> > >> >> > >> >> > >> >> > >> Yours, >> > >> >> > >> Daniel >> > >> >> > >> >> > >> >> > >> [1] >> > >> = https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXho= DiptY/edit?usp=3Dsharing = >> > >> < >> > >> = https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3ddca0-86e2237= f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1af-c94637953dc5&u=3D= https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1RtxUSvUeBdZWoQkjSj2c3DtR8D= uBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing = > >> > >> >> > >> >> > >> [2] >> > >> = https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-201710191300/= = >> > >> >> > >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ = >> > >> >> > >> >> > >> >> > >> -- >> > >> >> > >> Daniel Migault >> > >> >> > >> >> > >> >> > >> Ericsson >> > >> >> > > >> > > >> > > -- >> > > Daniel Migault >> > > Ericsson >> > > >> >=20 >> >=20 >> > --=20 >> > Daniel Migault >> > Ericsson >>=20 >> > _______________________________________________ >> > Ace mailing list >> > Ace@ietf.org >> > https://www.ietf.org/mailman/listinfo/ace = >>=20 >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace = >>=20 >>=20 >> --=20 >> Daniel Migault >> Ericsson >>=20 >>=20 >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace = > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --Apple-Mail=_99D53534-2F0A-4D11-9076-4FAA8007FF09 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Dear = all,

+1, I'd be = curious to see EAP-over-CoAP.
+1, It seems to me = that ACE could be home for such a document.

Best,
Giorgos

On 3 Dec 2020, at 12:10, Dan Garcia <dan.garcia@um.es> = wrote:

=20 =20

Dear all:

Regarding the new charter, since ACE is considering the definition of CoAP transport for CMPv2 (https://tools.ietf.org/html/draft-msahni-ace-cmpv2-coap-transport-00), we were wondering whethere it could also consider specifying EAP (Extensible Authentication Protocol) over CoAP.

In this sense, we proposed this some time ago and we have implementations about this.

https://datatracker.ietf.org/doc/html/draft-marin-ace-wg-coap-eap-06
https://www.mdpi.com/1424= -8220/16/3/358
https://www.mdpi.com/14= 24-8220/17/11/2646

The usage of CoAP can provide a very light and link-layer independent (we even tested in LoRa networks) EAP lower-layer (transport for EAP) suitable for IoT enviroment. We believe this would be really useful since EAP provides flexibility for the authentication and it is a well-known protocol.

Therefore, we would like to propose the following modification to the charter:

"The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, as well as a = transport for authentication protocols such as EAP, and standardize them as needed."

This modification does not necessarily mean the adoption of our draft. After all, we completely understand that this would happen only if there is an interest in the WG. Nevertheless, we would like to avoid that the charter is a barrier later if there is interest in the WG to work in this transport of EAP over CoAP:

Any opinion about this?

Best Regards.

El 18/11/2020 a las 8:08, Daniel Migault escribi=C3=B3:
Hi, 

Please find the proposed charter we agreed on = during the interim meeting. If you would like to propose any change, please use the following URL by November 25:

https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY/edit?usp=3Dsharing

Yours, 
Daniel

The Authentication and Authorization for Constrained = Environments (ace) WG has defined a standardized solution framework for = authentication and authorization to enable authorized access to = resources identified by a URI and hosted on a resource server in = constrained environments. 
The access to the resource is mediated by an authorization = server, which is not considered to be constrained.

Profiles of this framework for application to security = protocols commonly used in constrained environments, including CoAP+DTLS = and CoAP+OSCORE, have also been standardized.  The Working Group is = charged with maintenance of the framework and existing profiles thereof, = and may undertake work to specify profiles of the framework for = additional secure communications protocols and for additional = support services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, = though the focus remains on deployment in ecosystems with a substantial = portion of constrained devices).

In addition to the ongoing maintenance work, the Working = Group will extend the framework as needed for applicability to group = communications, with initial focus on (D)TLS and (Group) OSCORE as the = underlying group communication security protocols. The Working Group = will standardize procedures for requesting and distributing group keying = material using the ACE framework as well as appropriated management = interfaces. 

The Working Group will standardize a format for expressing = authorization information for a given authenticated principal as = received from an authorization manager. 

The Working Group will examine how to use Constrained = Application Protocol (CoAP) as a transport medium for certificate = enrollment protocols, such as EST and CMPv2, and standardize as = needed.


On Tue, Nov 17, 2020 at = 6:47 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
Thanks for updating the draft charter at [1], Daniel!

I note that Michael raised the question of whether some other group might
also be interested in working on CMP-over-coap, so the IESG will be sure to
discuss that if CMP is still in the draft ACE charter when it goes to the
IESG for review.

-Ben

On Tue, Nov 17, 2020 at 06:16:48PM -0500, Daniel Migault wrote:
> Thank you all for the feed backs. For the purpose of driving the charter
> discussion at the IETf 109, I have added the comments into the proposed
> text [1].
>
> My current understanding is that it seems beneficial to add CMPv2 over CoAP
> in the charter. I am happy to be contradicted.
> * I have not seen a clear cut to do one or the = other.
> * EST and CMPv2 are two protocols that can be used for enrollment or cert
> management while addressing different cases / needs / situations -- maybe
> we can clarify that point. I can see leveraging the existing CMP
> infrastructure, but it seems that is not the only = one.
> * I am not convinced that not having CMP over CoAP will not prevent its
> deployment and as such I prefer to have it standardized - this might be a
> personal thought.
> * Adding any piece of work require cycles, but it seems to me that CPM will
> not have a major impact on the WG progress. The work will probably include
> other WG such a LAMPS.
>
> Yours,
> Daniel
>
> [1]
> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY/edit?usp=3Dsharing
>
> On Tue, Nov 17, 2020 at 6:02 PM Daniel Migault <mglt.ietf@gmail.com> = wrote:
>
> > Hi Goran,
> >
> > I added the text to the charter we will discuss later.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Nov 13, 2020 at 10:26 AM G=C3=B6ran = Selander <
> > goran.selander@ericsson.com> wrote:
> >
> >> Hi Daniel,
> >>
> >>
> >>
> >> Here=E2=80=99s another input to the = charter.
> >>
> >>
> >>
> >> The current group key management solutions addresses the problem of
> >> authorized access to group keys and public keys of group members.
> >>
> >>
> >>
> >> A related problem is authorized access of public keys of other devices
> >> not necessarily part of a security group, in the sense of sharing a
> >> symmetric key used to protect group = messages.
> >>
> >>
> >>
> >> Authorized access to raw public keys serves an important function in
> >> constrained settings where public key certificates may not be feasible due
> >> to the incurred overhead, e.g. for when authenticating using EDHOC
> >> (draft-ietf-lake-edhoc).
> >>
> >> This functionality is thus a subset of what is already supported, but
> >> since the current solution is geared towards groups a different solution
> >> may be needed (although it is probably possible to reuse parts from the
> >> existing schemes for provisioning and requesting public keys).
> >>
> >>
> >>
> >> With this in mind, I propose the following change (highlighted in
> >> boldface below):
> >>
> >>
> >>
> >> OLD
> >>
> >> The Working Group is charged with maintenance of the framework and
> >> existing profiles thereof, and may undertake work to specify profiles of
> >> the framework for additional secure communications protocols (that are not
> >> necessarily limited to constrained endpoints, though the focus remains on
> >> deployment ecosystems with a substantial portion of constrained devices).
> >>
> >>
> >>
> >> NEW
> >>
> >> The Working Group is charged with maintenance of the framework and
> >> existing profiles thereof, and may undertake work to specify profiles of
> >> the framework for additional secure communications protocols *and **for
> >> additional **support services **providing* *authorized access to crypto* *keys
> >> *(that are not necessarily limited to constrained endpoints, though the
> >> focus remains on deployment ecosystems with a substantial portion of
> >> constrained devices).
> >>
> >>
> >>
> >> G=C3=B6ran
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> On 2020-10-15, 19:50, "Ace" <ace-bounces@ietf.org> = wrote:
> >>
> >> Hi,
> >>
> >> I would like to start the charter discussion. Here is a draft of a
> >> proposed charter [1].
> >>
> >>
> >>
> >> It seems to be that additional discussion is needed with regard to the
> >> last paragraph related certificate management. In particular the discussion
> >> might revive a discussion that happened in 2017 [2] - when I was not
> >> co-chair of ACE -and considered other expired work such as [3]. Please make
> >> this discussion constructive on this = thread.
> >>
> >>
> >>
> >> The fundamental question is whether we need certificate management at
> >> this stage. If the answer is yes, and we have multiple proposals, it would
> >> be good to clarify the position of the different proposals and evaluate
> >> whether a selection is needed or not before validating the charter.
> >>
> >>
> >>
> >> Please provide your inputs on the mailing list before October 30. Of
> >> course for minor edits, you may suggest them directly on the google doc.
> >>
> >>
> >>
> >> Yours,
> >>
> >> Daniel
> >>
> >>
> >>
> >> [1]
> >> https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8Du= BwPM2BnBXhoDiptY/edit?usp=3Dsharing
> >> <
> >> https://protect2.fireeye.com/v1/url?k=3D4f3d9c3b-118c475b-4f3dd= ca0-86e2237f51fb-627e48b069462d70&q=3D1&e=3D6924b2a6-e7e5-4ec1-a1a= f-c94637953dc5&u=3Dhttps%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1Rtx= USvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXhoDiptY%2Fedit%3Fusp%3Dsharing> > >>
> >>
> >> [2]
> >> https://datatracker.ietf.org/doc/minutes-interim-2017-ace-03-20= 1710191300/
> >>
> >> [3] https://datatracker.ietf.org/doc/draft-selander-ace-eals/ > >>
> >>
> >>
> >> --
> >>
> >> Daniel Migault
> >>
> >>
> >>
> >> Ericsson
> >>
> >
> >
> > --
> > Daniel Migault
> > Ericsson
> >
>
>
> --
> Daniel Migault
> Ericsson

> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
= Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/ace
_______________________________________________
Ace = mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

= --Apple-Mail=_99D53534-2F0A-4D11-9076-4FAA8007FF09-- From nobody Thu Dec 10 09:43:58 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C8563A1176; Thu, 10 Dec 2020 09:43:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id piPLSEqU9LQv; Thu, 10 Dec 2020 09:43:39 -0800 (PST) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A3E53A118B; Thu, 10 Dec 2020 09:43:37 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.78,408,1599516000"; d="scan'208,217";a="482302572" Received: from adsl-bb22-l204.crnagora.net (HELO [192.168.1.86]) ([95.155.22.204]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/AES256-GCM-SHA384; 10 Dec 2020 18:43:35 +0100 User-Agent: Microsoft-MacOutlook/10.11.0.180909 Date: Thu, 10 Dec 2020 18:43:32 +0100 From: =?UTF-8?B?TWFsacWhYQ==?= =?UTF-8?B?IFZ1xI1pbmnEhw==?= To: Dan Garcia , Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" Message-ID: Thread-Topic: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> <2923.1607540144@localhost> <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> In-Reply-To: <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3690470615_868860928" Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 17:43:49 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3690470615_868860928 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Dan, =20 Could you be more specific on the point below, what deficiencies do you hav= e in mind? =20 Mali=C5=A1a=20 =20 From: core on behalf of Dan Garcia Date: Thursday 10 December 2020 at 10:06 To: Michael Richardson , EMU WG , "cor= e@ietf.org WG (core@ietf.org)" , "ace@ietf.org" Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) =20 As you comment , draft-ietf-6tisch-minimal-security - offers minimal securi= ty and has several deficiencies that can be solved by using EAP and AAA infr= astructures.=20 --B_3690470615_868860928 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Hi Dan,

 

Could you be more specific on the point below, what= deficiencies do you have in mind?

<= span lang=3DEN-US> 

Mali=C5=A1a

=  

From: core <core-bounce= s@ietf.org> on behalf of Dan Garcia <garciadan@uniovi.es>
Dat= e: Thursday 10 December 2020 at 10:06
To: Michael Richardson <mcr+ietf@sandelman.ca&g= t;, EMU WG <emu@ietf.org>, "core@ietf.org WG (core@ietf.org)"= ; <core@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

<= o:p> 

= As you comment , draft-ietf-6tisch-minimal-security - offers minimal securit= y and has several deficiencies that can be solved by using EAP and AAA infra= structures. =

--B_3690470615_868860928-- From nobody Fri Dec 11 09:41:40 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B69FE3A0D39; Fri, 11 Dec 2020 09:41:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=unioviedo.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n4ct2Jxz-mpd; Fri, 11 Dec 2020 09:41:32 -0800 (PST) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2080.outbound.protection.outlook.com [40.107.22.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A11F3A0D37; Fri, 11 Dec 2020 09:41:32 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZnYJCUzVFCRzlA/bsk11gp7Ol3V6lYUPV7ORd3tA3kk8QfJUGPSGKiq/JkssfabAab3N5EVQ5RFsritd12vZZqwJtdAsV2r4HvWAcqvQrH4XAoZzHsazi8X00ZDDXhb28B9gR6oZdj4NkGd8czjjh2f2Xnxkq/QQbbthLQvBcOo24P3OflR65uPO8lrHpxUHZtS+vbEdS81SGMpS+f5ii9qm3DLTqlWsdMB6EiyqZHRex2cDCkr/tCZ9LkbnyfvRjSgUckA2PQGDPdvK2YPSBAh2ibzKSltU+/PDNDGwQzBqHXjNoUddV8maFIS46Hjr5ZI5hUuGU4Ws5glKeOA0Rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vrysoN34OwpEJixfuOsex4iM5AeGJPP6GjEsqrqi4UM=; b=WTt83fMt5k1PrLcsOuxCTnr/pj9DGqAScUdCQWPHFrsQ+N95XP10OWGrvVQUWelBUZS3ptswP0uwhVH7rPSGdwLZvMKLExeAkyN/dsAz4Rsptmj4z/wg41AGjYecJE6D5DXkmQ7ywoahUx4qKcvwSGLre6S3NA5J7gLUCGXwaFvciR38x3VYtfaiXZN6vnNtY+Eg3ZyA9Q3mAl20SoNSXOt8TuMR9XXGVRItWTcHDqyKTrOhIYkguXHU1lvLe6Qql+OU47kl/ZCgHNrYJmJWbMZfZk34HkgRaJRe83ANvzZbwu8n8v39RxD1cib8bhF/D47CyxKiZTCRdEAh4xj79g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=uniovi.es; dmarc=pass action=none header.from=uniovi.es; dkim=pass header.d=uniovi.es; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unioviedo.onmicrosoft.com; s=selector2-unioviedo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vrysoN34OwpEJixfuOsex4iM5AeGJPP6GjEsqrqi4UM=; b=OCNlajE7tYNB4Lza0aCf1YRj/+MdOLlX/8q5fM15fwDwdx/aR/k9J2elzoO6M3ILNIn77ByvJ0G/h8RUZqGy5moOn1WQ3Z92LN6xTwTLSeA7l1eMcCYbkYZ6uvCKcpgbRPAe3FH2a0pXADLhtCcHfXUNC0neqlC8nWOU9mxU7O0= Authentication-Results: uniovi.es; dkim=none (message not signed) header.d=none;uniovi.es; dmarc=none action=none header.from=uniovi.es; Received: from AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) by AM0PR08MB4417.eurprd08.prod.outlook.com (2603:10a6:208:13f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.20; Fri, 11 Dec 2020 17:41:29 +0000 Received: from AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd]) by AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd%7]) with mapi id 15.20.3654.012; Fri, 11 Dec 2020 17:41:29 +0000 Cc: garciadan@uniovi.es To: =?UTF-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= , Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> <2923.1607540144@localhost> <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> From: Dan Garcia Carrillo Message-ID: <1fdb134e-54a1-1937-fdd6-3d226c89aea7@uniovi.es> Date: Fri, 11 Dec 2020 18:41:27 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A06EE6867811146F2926CFCF" Content-Language: es-ES X-Originating-IP: [192.145.124.84] X-ClientProxiedBy: MRXP264CA0040.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500:14::28) To AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.5.0.2] (192.145.124.84) by MRXP264CA0040.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500:14::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.21 via Frontend Transport; Fri, 11 Dec 2020 17:41:28 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 333c9aeb-320d-4913-672d-08d89dfbfe0d X-MS-TrafficTypeDiagnostic: AM0PR08MB4417: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 0UkVSidqNgXEgTY0Seyvi38+52fiVOkWHfYK1CU0iX+OLc8HXH1N3/pr34p/FCmRtE7NG+u+hiGaoROKIt35gX+l7Mb64JS0xlMX/Gs9VX5cdNOyCUvFwtGsugN30rB8Tb5l86+u6PuUYevX2hZJZEZTJkveQLv3UTCCc3ni/zGLo1HXAXZPTr3PFqvAtJ1RxEfofAAHPEZxSCSS3Q4anwAeXvAC+mGBZbcfv2a648Agr8UlIBns9/q+waBVKWOq1GMm6DQD4KMlJOpJHNxcevSL5xc/0G7rTjmYfRjFNh534JivbJK2RcE5K5AjdVm4VIM4tZ7JJOKcclTmLtByEyv7B83C55ujnV3wP8Py6RD1vKwUqqPlblpUx9DkuWt13Ws1VVLVBWiOKGtOfOppRJLFwk9i5HzkoxWmMFrTsUY= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3940.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(346002)(396003)(136003)(39860400002)(366004)(66946007)(6486002)(16576012)(66556008)(31686004)(956004)(5660300002)(86362001)(33964004)(31696002)(786003)(66476007)(107886003)(83380400001)(316002)(26005)(4326008)(8676002)(478600001)(186003)(52116002)(36756003)(66574015)(2906002)(2616005)(8936002)(16526019)(110136005)(43740500002)(45980500001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?Y0cyQlQ1eVJFM1VEWXBwMUtBdUF0MGFWZVh4YzQzbzJiRk14Y0RkMU9VNG5P?= =?utf-8?B?V0g1cEo4ZkR6YnRmQzM4ZTlYUzF3V3dlNkdNSDNOODJlSGJzOFZ2UXNIeDBQ?= =?utf-8?B?WnM0VEY2MWlCWjRpTW5FbmFtWFBYQjdrbThjWDkwMmRqZGN2eEgzbWtoNDlj?= =?utf-8?B?c1VsVTkvS2wxZlpYZFdIOWp6c3ZwMi9RRmk5YmdQTVBQREdBL0pPb1dSSmdC?= =?utf-8?B?dytlQzNoK1ZwK2hxc3dQc2pIQUdqSFVseWVoblQ2V0xPemNvemlTTjlqR1Nz?= =?utf-8?B?Q08yUmkyWDg2bm9XUE1JRUpXT2s3bk1YbDl3NGFFSXRzL3l1VUN6R28wcUgw?= =?utf-8?B?dUFoNStxYVRIL1pwa3gyeGlKWStlTUozUFMxL3J4aDB5RXBmSWJreWVKT3BN?= =?utf-8?B?bHhTTmNQNkt4ZGE3T05ab0pqV0gvTHlVK2svWUZ0YWdUdGNKMzh0Q1BKclNT?= =?utf-8?B?YTFQZ1VEWTBOaHNVd3g1TnZuRWZ0NVBsRE9aeURldFVYVFU0VFU1aWdvc08v?= =?utf-8?B?QU5YNWV3ckhVZ1JyTm1XQkRpN1hpYkpvS0ZyVlVEUG56TWt3RzA4MkpFQzJ5?= =?utf-8?B?WE5tNFZ6NUx1Nm5Ialo1bTBzelUrN05lSEFpQ3hRc2xPb1RJVndXZjlYR21M?= =?utf-8?B?VGduMzhpKzFtaFZiOUlyTE1jaVExWVNXcXZibEx2Rlo4NVFqdWpnTkZqYTA3?= =?utf-8?B?QVBpbGkwWjBndkpnNG5ScWdtOFJBRDZ1TkcxaThwNTZCOGd3V0JMbGxGbE9a?= =?utf-8?B?bkZZMEhLekMrRjNmQjNhVWhtZkhsYkVxQWh3ZktsNlBlRUxvSVIxeDFGUUZJ?= =?utf-8?B?cW81dnRleHV1VDduMFd5anBzaG1GS2ZrczhqYlF0blQ3Y0F2UEhuWDhqWUNp?= =?utf-8?B?di9nRTkwMGZHa3dmb3dNWENoUnJ6Szh0Z2ZmWlpETkxOTElydkpkdEhoRUU1?= =?utf-8?B?YlY5REYrV2tLWHBSUVhrZU53NVEyNlN6Q1RZbFk4L3BpY1BmOHZEV2kxSExo?= =?utf-8?B?ellGMUxpazRTSzM2dk51aEZNVG0xRzJDRkRkd1RibTlhVlcyV1pLUm8rUXpM?= =?utf-8?B?a2htSTFsTnorR3FJZjlWVThYelNJa2tXNTlLd1l6SFRzZ2VtWERmSmJFQWww?= =?utf-8?B?a29NRWI3QXVJNzFzUXFHSzI1YTVLTHkyOWhuTE8zOEV3VTF6Y1BUQkJSWHhr?= =?utf-8?B?TFQ5c1pzYWF4RGpieWh6ZE9oelB6UjhCZWxBR1ptK0Z2ekcwT21IT1Q1bnhr?= =?utf-8?B?Zk55bUlhVmlLNjRVazRJNEU3T0pXSjRpbXVlMUFHblI5b3kxRC84dVlpZnlt?= =?utf-8?Q?tHRGztBiFgHsU9fMP/YKlnx+MfR3ItP4iv?= X-OriginatorOrg: uniovi.es X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Dec 2020 17:41:29.7068 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 05ea74a3-92c5-4c31-978a-925c3c799cd0 X-MS-Exchange-CrossTenant-Network-Message-Id: 333c9aeb-320d-4913-672d-08d89dfbfe0d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: psitBhu88BrlQNBTbC/MULy4HgUC9bs1uDGyT+bigkAmlUjBON9GcE4vkM+ivubYumu5g514HKcCnf+yJDgkNw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB4417 X-MS-Exchange-CrossPremises-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossPremises-AuthAs: Internal X-MS-Exchange-CrossPremises-AuthMechanism: 06 X-MS-Exchange-CrossPremises-Mapi-Admin-Submission: X-MS-Exchange-CrossPremises-MessageSource: StoreDriver X-MS-Exchange-CrossPremises-BCC: X-MS-Exchange-CrossPremises-OriginalClientIPAddress: 192.145.124.84 X-MS-Exchange-CrossPremises-TransportTrafficType: Email X-MS-Exchange-CrossPremises-Antispam-ScanContext: DIR:Originating; SFV:NSPM; SKIP:0; X-MS-Exchange-CrossPremises-SCL: 1 X-MS-Exchange-CrossPremises-Processed-By-Journaling: Journal Agent X-OrganizationHeadersPreserved: AM0PR08MB4417.eurprd08.prod.outlook.com Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2020 17:41:35 -0000 --------------A06EE6867811146F2926CFCF Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Mališa, My intention was not to turn this conversation into a criticism of your work. “deficiencies” was not the most appropriate word. What we had in mind was a way of providing authentication  to the variety of IoT devices with different capabilities, limitations or different types of supported credentials. A way of doing that is to provide different authentication methods. Since in IoT there are different technologies we looked for a link-layer independent solution. Additionally, since some technologies are very constrained, we needed a very constrained protocol to carry out the process. EAP provides flexible authentication, and it has EAP Key Management Framework which is well specified and working for many years, from which you can generate generate a fresh pre-shared key (MSK) dynamically. This is even possible if you do not want to interact with AAA infrastructures running EAP in standalone mode. Having said this, another thing that we looked into was to give support to large scale deployments. We can ease this process with EAP and its interaction with a AAA infrastructure, which gains relevance in Industrial IoT and 5G. All these characteristics can be provided by the use of EAP, if we of course have a lightweight EAP lower layer to transport EAP from the IoT device. Then we considered the usage of CoAP as EAP lower-layer. In this sense, we saw minimal security did not fit our view (no potential interaction with AAA , flexible authentication, fresh generation of PSK).  In fact,  the provisioning of the PSK was out of scope. At some level, we could even consider the work complementary. EAP over CoAP could be a way of providing the PSK for the work of minimal security. Best Regards, Dan. El 10/12/2020 a las 18:43, Mališa Vučinić escribió: > > Hi Dan, > > Could you be more specific on the point below, what deficiencies do > you have in mind? > > Mališa > > *From: *core on behalf of Dan Garcia > > *Date: *Thursday 10 December 2020 at 10:06 > *To: *Michael Richardson , EMU WG > , "core@ietf.org WG (core@ietf.org)" , > "ace@ietf.org" > *Subject: *Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) > > As you comment , draft-ietf-6tisch-minimal-security - offers minimal > security and has several deficiencies that can be solved by using EAP > and AAA infrastructures. > --------------A06EE6867811146F2926CFCF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Mališa,

My intention was not to turn this conversation into a criticism of your work. “deficiencies” was not the most appropriate word.

What we had in mind was a way of providing authentication  to the variety of IoT devices with different capabilities, limitations or different types of supported credentials. A way of doing that is to provide different authentication methods. Since in IoT there are different technologies we looked for a link-layer independent solution. Additionally, since some technologies are very constrained, we needed a very constrained protocol to carry out the process.

EAP provides flexible authentication, and it has EAP Key Management Framework which is well specified and working for many years, from which you can generate generate a fresh pre-shared key (MSK) dynamically. This is even possible if you do not want to interact with AAA infrastructures running EAP in standalone mode.  Having said this, another thing that we looked into was to give support to large scale deployments. We can ease this process with EAP and its interaction with a AAA infrastructure, which gains relevance in Industrial IoT and 5G.

All these characteristics can be provided by the use of EAP, if we of course have a lightweight EAP lower layer to transport EAP from the IoT device. Then we considered the usage of CoAP as EAP lower-layer.

In this sense, we saw minimal security did not fit our view (no potential interaction with AAA , flexible authentication, fresh generation of PSK).  In fact,  the provisioning of the PSK was out of scope.

At some level, we could even consider the work complementary. EAP over CoAP could be a way of providing the PSK for the work of minimal security.


Best Regards,
Dan.

El 10/12/2020 a las 18:43, Mališa Vučinić escribió:

Hi Dan,

 

Could you be more specific on the point below, what deficiencies do you have in mind?

 

Mališa

 

From: core <core-bounces@ietf.org> on behalf of Dan Garcia <garciadan@uniovi.es>
Date: Thursday 10 December 2020 at 10:06
To: Michael Richardson <mcr+ietf@sandelman.ca>, EMU WG <emu@ietf.org>, "core@ietf.org WG (core@ietf.org)" <core@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

 

As you comment , draft-ietf-6tisch-minimal-security - offers minimal security and has several deficiencies that can be solved by using EAP and AAA infrastructures. 

--> --------------A06EE6867811146F2926CFCF-- From nobody Fri Dec 11 10:45:32 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A35893A0DD7; Fri, 11 Dec 2020 10:45:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.917 X-Spam-Level: X-Spam-Status: No, score=-1.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYLXTXad5Cfe; Fri, 11 Dec 2020 10:45:28 -0800 (PST) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 222BB3A0DCE; Fri, 11 Dec 2020 10:45:26 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.78,412,1599516000"; d="scan'208,217";a="367395883" Received: from adsl-bb22-l204.crnagora.net (HELO [192.168.1.86]) ([95.155.22.204]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/AES256-GCM-SHA384; 11 Dec 2020 19:45:24 +0100 User-Agent: Microsoft-MacOutlook/10.11.0.180909 Date: Fri, 11 Dec 2020 19:45:21 +0100 From: =?UTF-8?B?TWFsacWhYQ==?= =?UTF-8?B?IFZ1xI1pbmnEhw==?= To: Dan Garcia Carrillo , Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" Message-ID: <6C717866-759B-4544-BA04-50D623CF9EFE@inria.fr> Thread-Topic: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> <2923.1607540144@localhost> <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> <1fdb134e-54a1-1937-fdd6-3d226c89aea7@uniovi.es> In-Reply-To: <1fdb134e-54a1-1937-fdd6-3d226c89aea7@uniovi.es> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3690560724_1158425664" Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2020 18:45:31 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3690560724_1158425664 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hi Dan, =20 Thanks for the clarification regarding minimal-security. The points that yo= u mention below, e.g. flexible authentication or the fresh generation of the= PSK, were never in the design scope of our work.=20 =20 While I fail to understand what exactly do you plan on using EAP-over-CoAP = for, I do not object on this work being done in ACE if you are willing to sp= end cycles on it. I do have reservations on the lightweight aspect of this, = however, considering that the sequence diagram that you depict in Fig. 2 in = draft-marin-ace-wg-coap-eap-06 spans 3 pages and consumes 2 round trips just= to get things started! Surely, we can do better? =20 Mali=C5=A1a =20 From: Dan Garcia Carrillo Date: Friday 11 December 2020 at 18:41 To: Mali=C5=A1a Vu=C4=8Dini=C4=87 , Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" = , "ace@ietf.org" Cc: Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) =20 Hi Mali=C5=A1a,=20 My intention was not to turn this conversation into a criticism of your wor= k. =E2=80=9Cdeficiencies=E2=80=9D was not the most appropriate word. What we had in mind was a way of providing authentication to the variety o= f IoT devices with different capabilities, limitations or different types of= supported credentials. A way of doing that is to provide different authenti= cation methods. Since in IoT there are different technologies we looked for = a link-layer independent solution. Additionally, since some technologies are= very constrained, we needed a very constrained protocol to carry out the pr= ocess. EAP provides flexible authentication, and it has EAP Key Management Framewo= rk which is well specified and working for many years, from which you can ge= nerate generate a fresh pre-shared key (MSK) dynamically. This is even possi= ble if you do not want to interact with AAA infrastructures running EAP in s= tandalone mode. Having said this, another thing that we looked into was to = give support to large scale deployments. We can ease this process with EAP a= nd its interaction with a AAA infrastructure, which gains relevance in Indus= trial IoT and 5G.=20 All these characteristics can be provided by the use of EAP, if we of cours= e have a lightweight EAP lower layer to transport EAP from the IoT device. T= hen we considered the usage of CoAP as EAP lower-layer. In this sense, we saw minimal security did not fit our view (no potential i= nteraction with AAA , flexible authentication, fresh generation of PSK). In= fact, the provisioning of the PSK was out of scope.=20 At some level, we could even consider the work complementary. EAP over CoAP= could be a way of providing the PSK for the work of minimal security.=20 Best Regards, Dan. El 10/12/2020 a las 18:43, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3: Hi Dan, =20 Could you be more specific on the point below, what deficiencies do you hav= e in mind? =20 Mali=C5=A1a=20 =20 From: core on behalf of Dan Garcia Date: Thursday 10 December 2020 at 10:06 To: Michael Richardson , EMU WG , "cor= e@ietf.org WG (core@ietf.org)" , "ace@ietf.org" Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) =20 As you comment , draft-ietf-6tisch-minimal-security - offers minimal securi= ty and has several deficiencies that can be solved by using EAP and AAA infr= astructures.=20 --> --B_3690560724_1158425664 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Hi Dan,

 

Thanks for the clarification regarding minimal-secu= rity. The points that you mention below, e.g. flexible authentication or the= fresh generation of the PSK, were never in the design scope of our work.

 

While I fail to understand what = exactly do you plan on using EAP-over-CoAP for, I do not object on this work= being done in ACE if you are willing to spend cycles on it. I do have reser= vations on the lightweight aspect of this, however, considering that the seq= uence diagram that you depict in Fig. 2 in draft-marin-ace-wg-coap-eap-06 sp= ans 3 pages and consumes 2 round trips just to get things started! Surely, w= e can do better?

 

Mali=C5=A1a

 

From: Dan Garcia Carri= llo <garciadan@uniovi.es>
Date: Friday 11 December 2020 at 1= 8:41
To: Mali=C5=A1a Vu=C4=8Dini=C4=87 <malisa.vucinic@inria.fr>, Michael Richardson <mcr+ietf@= sandelman.ca>, EMU WG <emu@ietf.org>, "core@ietf.org WG (core@= ietf.org)" <core@ietf.org>, "ace@ietf.org" <ace@ietf= .org>
Cc: <garciadan@uniovi.es>
Subject: Re: [c= ore] [Ace] Proposed charter for ACE (EAP over CoAP?)

 

=

Hi Mali=C5=A1a,

My intention was not= to turn this conversation into a criticism of your work. =E2=80=9Cdeficiencies=E2=80=9D= was not the most appropriate word.

What we had in mind was a way of = providing authentication  to the variety of IoT devices with different = capabilities, limitations or different types of supported credentials. A way= of doing that is to provide different authentication methods. Since in IoT = there are different technologies we looked for a link-layer independent solu= tion. Additionally, since some technologies are very constrained, we needed = a very constrained protocol to carry out the process.

EAP provides fl= exible authentication, and it has EAP Key Management Framework which is well= specified and working for many years, from which you can generate generate = a fresh pre-shared key (MSK) dynamically. This is even possible if you do no= t want to interact with AAA infrastructures running EAP in standalone mode.&= nbsp; Having said this, another thing that we looked into was to give suppor= t to large scale deployments. We can ease this process with EAP and its inte= raction with a AAA infrastructure, which gains relevance in Industrial IoT a= nd 5G.

All these characteristics can be provided by the use of EAP, = if we of course have a lightweight EAP lower layer to transport EAP from the= IoT device. Then we considered the usage of CoAP as EAP lower-layer.
In this sense, we saw minimal security did not fit our view (no potential i= nteraction with AAA , flexible authentication, fresh generation of PSK).&nbs= p; In fact,  the provisioning of the PSK was out of scope.

At s= ome level, we could even consider the work complementary. EAP over CoAP coul= d be a way of providing the PSK for the work of minimal security.

Best Regards,
Dan.

El 10/12/2020 a las 18:43, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3:

Hi Dan,=

&nb= sp;

Could you be more specific on the point below, what deficiencies= do you have in mind?

 

Mali=C5=A1a

 

= From: core = <core-bounces@ietf.org> on = behalf of Dan Garcia <garciadan@unio= vi.es>
Date: Thursday 10 December 2020 at 10:06
To: <= /b>Michael Richardson <mcr+ietf@sandelman.ca>, EMU WG= <emu@ietf.org>, "core@ietf.org WG (core@ietf.org)" <core@ietf.org>, "ace@ietf.org" <= ;ace@ietf.org>
Subject: Re: [core] [Ace] Proposed charter f= or ACE (EAP over CoAP?)

 

As you comment , draft-ietf-6tisch-minimal-securi= ty - offers minimal security and has several deficiencies that can be solved= by using EAP and AAA infrastructures.&nbs= p;

-->

--B_3690560724_1158425664-- From nobody Sat Dec 12 09:37:08 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEA0D3A1232; Sat, 12 Dec 2020 09:37:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=unioviedo.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y78cxsIZpt6s; Sat, 12 Dec 2020 09:36:58 -0800 (PST) Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2084.outbound.protection.outlook.com [40.107.22.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C6ED3A0D3F; Sat, 12 Dec 2020 09:36:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=V5Htx3BetrBIdL+ze9kQpzNhDkccFjEE4Y/1ikpELWug7KTIcbJmwKhyOqfzQKD/RXStMc789Ab0KZwCOiNn8+iAfiXr7/Lu3Sh9ymcX1V68NBKI4PiXz9A/xE0NPojTmkW0KQHPmVJmHU3OtDfksFBRy0yVXViAdu5BGu/ka/eaCur8u4veutJL4cGcJgBlvmlAWKEzTJFTDVz5+3/pk5dSZifGBbTEM9ORRCHKsT6rbtodsJ6889jS7Y/vL4jS9xGp5FRLL9MQ89vR8RLD4G6qBe8pLIVwaaRjrZdL/E7G3qMd3pRSgkw5m5jQSzK5gjpbqyN98GfEvzYqGi5TZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DvMb+P8VVPM+6YHiGWdMi4ZTT8I620GN/HDN//devZM=; b=WMigQAdtH8/gGa6dxe6HbY90lB42364nlrEbxzDemqD1lqIMmZ/76/shH1ECv4j0NO+DzuLfNFW66od91Y8iVVy+vk4wf+gCeeY2PqtGao6MSMLNuCYS5d3wl4YhocnExeIUfflIl1fB8xeML3o5QWv8nc3fBlukvPNAxRYoMdrgqUIHRbSuzJH5aGXaoev1ygeIdDovDzwJ/D3T8dS4LZ4/Wm5gvvtYjMnbaUWzrCLQj9yBMpKkZv58O08FtORvMZ2mLLbCwTQdW0VJrpo8mjmXXgbGvKG9mxyEaFk1uFrCBXxypfZKID7RDukbniQJKZ2hD6VzA2RCU99L/OmwQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=uniovi.es; dmarc=pass action=none header.from=uniovi.es; dkim=pass header.d=uniovi.es; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unioviedo.onmicrosoft.com; s=selector2-unioviedo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DvMb+P8VVPM+6YHiGWdMi4ZTT8I620GN/HDN//devZM=; b=ExFS6CgVJZEm/aSfP/UmFTV8x5E798tBX/ROJ0m0Z7H/W/xhzaEgljzs7COoIfLfKh7bLZYzXUOPpIyS+RDVzdEzidXtgItwTyexUxE2H9MYcMegV+9g2Yt+vH6PbgCV7BDkjCF+LwCeRWfPnibpiwSOvvrCI6pYM/usrCaBIFY= Authentication-Results: uniovi.es; dkim=none (message not signed) header.d=none;uniovi.es; dmarc=none action=none header.from=uniovi.es; Received: from AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) by AM0PR08MB3748.eurprd08.prod.outlook.com (2603:10a6:208:fb::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.13; Sat, 12 Dec 2020 17:36:55 +0000 Received: from AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd]) by AM0PR08MB3940.eurprd08.prod.outlook.com ([fe80::9c65:30a3:58fe:e6dd%7]) with mapi id 15.20.3654.019; Sat, 12 Dec 2020 17:36:55 +0000 Cc: garciadan@uniovi.es To: =?UTF-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= , Michael Richardson , EMU WG , "core@ietf.org WG (core@ietf.org)" , "ace@ietf.org" References: <20201117234700.GR39170@kduck.mit.edu> <24523.1607378991@localhost> <3a4e4b59-3712-7eb9-23b2-8160ad14b6aa@um.es> <2923.1607540144@localhost> <62dad652-8acd-0890-36cd-f7aacde19de2@uniovi.es> <1fdb134e-54a1-1937-fdd6-3d226c89aea7@uniovi.es> <6C717866-759B-4544-BA04-50D623CF9EFE@inria.fr> From: Dan Garcia Carrillo Message-ID: <238e2b03-a9b3-918a-2a9b-fbb66b84ddbf@uniovi.es> Date: Sat, 12 Dec 2020 18:36:53 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.5.1 In-Reply-To: <6C717866-759B-4544-BA04-50D623CF9EFE@inria.fr> Content-Type: multipart/alternative; boundary="------------80C24DC785D13739DD6EBAE8" Content-Language: es-ES X-Originating-IP: [156.35.171.42] X-ClientProxiedBy: MRXP264CA0030.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500:14::18) To AM0PR08MB3940.eurprd08.prod.outlook.com (2603:10a6:208:124::19) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [156.35.171.42] (156.35.171.42) by MRXP264CA0030.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500:14::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.17 via Frontend Transport; Sat, 12 Dec 2020 17:36:54 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 978b4392-f75d-419e-a253-08d89ec484cf X-MS-TrafficTypeDiagnostic: AM0PR08MB3748: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1051; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: y0vzrle3ceEIdhRhHmJCFb/3ovkWZODo8qZQWHWWEysdmpoH5V3yIIS6iGp8DoUcruin1gvNzREem306KNN/lZwxVr3zmhBoHrztJGuZrbYjjRp6+HFPbPnivYUpOQ9PG95iy6zwVjS/1u/v7lfokars7VVDvTzxM8lVAS1i6p/JJQJpBxHELbKK7BxzcX5e9kq+l9+wpM+UHljNALItqBEEMzG0eEkZ8T4+nXjUtiY0gxUBAITWvh1u3eOWkoYsN2iGXB55/+J5duKApVgbN7yrv4GVPLVshBa9Mq+hsu5ndC/3IkO9X6gdv7N1KsxyZ7Fzj2QEdgDYfmxxuSURSW+5RK4anynb4c/3RRWZioLAxSmUA5STXyQMHLKeGu2C69BisqU3Y2eSbjdHC5eA0XwShey0mkXaXUldlmKDup+6KKKMTfDOr19EnCKBSpkI X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3940.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(39850400004)(366004)(376002)(346002)(136003)(396003)(83380400001)(2906002)(36756003)(786003)(956004)(478600001)(16526019)(186003)(8936002)(316002)(31686004)(26005)(86362001)(33964004)(2616005)(8676002)(31696002)(66476007)(107886003)(52116002)(4326008)(66574015)(6486002)(6706004)(66556008)(5660300002)(110136005)(66946007)(16576012)(3940600001)(45980500001)(43740500002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?eXRQc1MwUk1CTlJKdWpVdkxIaHhzQVRqamhVU0ZWVWE3MG02UXVuRVBLVDdi?= =?utf-8?B?NGovR1VLLzdacHNwYUtrWjQyM29oRjZaK3prcXQwSXRjblBrbnFjalVKRnp5?= =?utf-8?B?UUE0NVZEQkhUUWdjVFlCRkFwNzdjUldROTVWMStPVFd6SG9uWmNwR2h2QkZK?= =?utf-8?B?MHZ1L0ZlRVJudHl5a0ZST0pxMU5kZVZJdWpsSmFjZThDOFdDdjBFb3k3OFpu?= =?utf-8?B?akt3OWhJMkpPR1Y5dndvL21UUGUrdjRpajVaN28wVVBvTk5mMXhCcXg3dWQy?= =?utf-8?B?S3I1QVNoWjIwYjZCcTFZdGVmb0J2cmlXV1JkQWJRUmpyWDZjSmNnaERrVllz?= =?utf-8?B?SGhwUlhnZFE0ZHpsaEpKUnloOUU1NDBiNEtsN0V6RXpPYkVIK2twZTNnbzNn?= =?utf-8?B?UW1kczNyaGFndTY2d1hKdHNCT2s3a3JJRFE1RE13bXowWjgvSlZqcmNRaDZj?= =?utf-8?B?dTN1Z2M0SWZYVndRQUhmWUJsczJMamJac2ExSjhPdExVZ2c4NFRJd2xFQXAw?= =?utf-8?B?dHh5aDlCd1VmNlh0Sm9hcGdTeUxMaTcya2hyT1czRU1mUFgyS1pHeGxZUmsx?= =?utf-8?B?eGRlYlJaZ0FseDZvSTBQZnRjQWdqRTlvdjJnR2Vua1FWaXREN29ER216cktw?= =?utf-8?B?REgwdEVQYml4VGJ6WUdkRzZqdkRLOUp5bkNxdHh2clBxV0Uvbk9IdHQ4bHcy?= =?utf-8?B?NWREdWpJb1FlUGFJTzhSQjJxZFRtUzk3MWlLdHZQYUoybUpXMXZKL3drWGFt?= =?utf-8?B?SE4za2MxSVlicXVEU2JJdFFMZXRpWURuclFGMTg3ZGZwU2YwMEtPd3lSallP?= =?utf-8?B?SjQxd1lWc0k2OHpuSFR5eVRVYjF3TGZkUjFzeDRteWFMK3JuOGZBNmpPMHcv?= =?utf-8?B?VlNzQmFhaGZhMU5xSDhMcXduTUNYbEx5UlhMc3NWeFpwa1phSWRtZkszV1h3?= =?utf-8?B?NTlkbGlVcTE1Y29zb3o3TGtHVEtGTHZaY3oyOWF6NDU5dklCSUx4cEN0UEdB?= =?utf-8?B?cE5KMi9QR3JPeG5pbnNBN0ZTYTgrY2Q4NDdBd2tnSS9WWjFHcG5rMituSnpX?= =?utf-8?B?eDc4TVBvNTVQMmlTWURublRWZFdKQXJzUVhrTGV5Uk1PcnArUG9mdzhuVloz?= =?utf-8?B?cHkrSVZVbFkxMnY1eVZqbmFhUDlKaEVBeVhGb0owYWVIZkp6SWp3L1VSRnEy?= =?utf-8?B?WU5QeUNtQjBteFBVM3FZQTBGaHhsK1VDT1ZDVWVlV0hsck1pdXcwb3p3K05i?= =?utf-8?B?UWFmZnY2aGxEM1RLTzVpRTRnQ1djMk4zOHBjNU9wVXVDREVyaUNxMGprc0w3?= =?utf-8?Q?j+6rJLcRGVjKGQQsIUI565YjbUijulJx0k?= X-OriginatorOrg: uniovi.es X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2020 17:36:55.0854 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 05ea74a3-92c5-4c31-978a-925c3c799cd0 X-MS-Exchange-CrossTenant-Network-Message-Id: 978b4392-f75d-419e-a253-08d89ec484cf X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rBPVj4C4rTBXUm+BUCNf4AhPux/i5ndUh+rdTJSrXBxb1Gt8qjHaP0J8WEkXt+/e5KFOc+zEBn7g8tPzqg4gAw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3748 X-MS-Exchange-CrossPremises-AuthSource: AM0PR08MB3940.eurprd08.prod.outlook.com X-MS-Exchange-CrossPremises-AuthAs: Internal X-MS-Exchange-CrossPremises-AuthMechanism: 06 X-MS-Exchange-CrossPremises-Mapi-Admin-Submission: X-MS-Exchange-CrossPremises-MessageSource: StoreDriver X-MS-Exchange-CrossPremises-BCC: X-MS-Exchange-CrossPremises-OriginalClientIPAddress: 156.35.171.42 X-MS-Exchange-CrossPremises-TransportTrafficType: Email X-MS-Exchange-CrossPremises-Antispam-ScanContext: DIR:Originating; SFV:NSPM; SKIP:0; X-MS-Exchange-CrossPremises-SCL: 1 X-MS-Exchange-CrossPremises-Processed-By-Journaling: Journal Agent X-OrganizationHeadersPreserved: AM0PR08MB3748.eurprd08.prod.outlook.com Archived-At: Subject: Re: [Ace] [core] Proposed charter for ACE (EAP over CoAP?) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Dec 2020 17:37:03 -0000 --------------80C24DC785D13739DD6EBAE8 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Mališa, El 11/12/2020 a las 19:45, Mališa Vučinić escribió: > > Hi Dan, > > Thanks for the clarification regarding minimal-security. The points > that you mention below, e.g. flexible authentication or the fresh > generation of the PSK, were never in the design scope of our work. > > While I fail to understand what exactly do you plan on using > EAP-over-CoAP for, I do not object on this work being done in ACE if > you are willing to spend cycles on it. I do have reservations on the > lightweight aspect of this, however, considering that the sequence > diagram that you depict in Fig. 2 in draft-marin-ace-wg-coap-eap-06 > spans 3 pages and consumes 2 round trips just to get things started! > Surely, we can do better? > Yes, we will submit an updated version of the draft. Best Regards, Dan > Mališa > > *From: *Dan Garcia Carrillo > *Date: *Friday 11 December 2020 at 18:41 > *To: *Mališa Vučinić , Michael Richardson > , EMU WG , "core@ietf.org WG > (core@ietf.org)" , "ace@ietf.org" > *Cc: * > *Subject: *Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) > > Hi Mališa, > > My intention was not to turn this conversation into a criticism of > your work. “deficiencies” was not the most appropriate word. > > What we had in mind was a way of providing authentication  to the > variety of IoT devices with different capabilities, limitations or > different types of supported credentials. A way of doing that is to > provide different authentication methods. Since in IoT there are > different technologies we looked for a link-layer independent > solution. Additionally, since some technologies are very constrained, > we needed a very constrained protocol to carry out the process. > > EAP provides flexible authentication, and it has EAP Key Management > Framework which is well specified and working for many years, from > which you can generate generate a fresh pre-shared key (MSK) > dynamically. This is even possible if you do not want to interact with > AAA infrastructures running EAP in standalone mode.  Having said this, > another thing that we looked into was to give support to large scale > deployments. We can ease this process with EAP and its interaction > with a AAA infrastructure, which gains relevance in Industrial IoT and > 5G. > > All these characteristics can be provided by the use of EAP, if we of > course have a lightweight EAP lower layer to transport EAP from the > IoT device. Then we considered the usage of CoAP as EAP lower-layer. > > In this sense, we saw minimal security did not fit our view (no > potential interaction with AAA , flexible authentication, fresh > generation of PSK).  In fact,  the provisioning of the PSK was out of > scope. > > At some level, we could even consider the work complementary. EAP over > CoAP could be a way of providing the PSK for the work of minimal > security. > > > Best Regards, > Dan. > > El 10/12/2020 a las 18:43, Mališa Vučinić escribió: > > Hi Dan, > > Could you be more specific on the point below, what deficiencies > do you have in mind? > > Mališa > > *From: *core > on behalf of Dan Garcia > > *Date: *Thursday 10 December 2020 at 10:06 > *To: *Michael Richardson > , EMU WG > , "core@ietf.org WG (core@ietf.org)" > > , "ace@ietf.org" > > *Subject: *Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) > > As you comment , draft-ietf-6tisch-minimal-security - offers > minimal security and has several deficiencies that can be solved > by using EAP and AAA infrastructures. > > --> > --------------80C24DC785D13739DD6EBAE8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Mališa,


El 11/12/2020 a las 19:45, Mališa Vučinić escribió:

Hi Dan,

 

Thanks for the clarification regarding minimal-security. The points that you mention below, e.g. flexible authentication or the fresh generation of the PSK, were never in the design scope of our work.

 

While I fail to understand what exactly do you plan on using EAP-over-CoAP for, I do not object on this work being done in ACE if you are willing to spend cycles on it. I do have reservations on the lightweight aspect of this, however, considering that the sequence diagram that you depict in Fig. 2 in draft-marin-ace-wg-coap-eap-06 spans 3 pages and consumes 2 round trips just to get things started! Surely, we can do better?

Yes, we will submit an updated version of the draft.

Best Regards,

Dan

 

Mališa

 

From: Dan Garcia Carrillo <garciadan@uniovi.es>
Date: Friday 11 December 2020 at 18:41
To: Mališa Vučinić <malisa.vucinic@inria.fr>, Michael Richardson <mcr+ietf@sandelman.ca>, EMU WG <emu@ietf.org>, "core@ietf.org WG (core@ietf.org)" <core@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Cc: <garciadan@uniovi.es>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

 

Hi Mališa,

My intention was not to turn this conversation into a criticism of your work. “deficiencies” was not the most appropriate word.

What we had in mind was a way of providing authentication  to the variety of IoT devices with different capabilities, limitations or different types of supported credentials. A way of doing that is to provide different authentication methods. Since in IoT there are different technologies we looked for a link-layer independent solution. Additionally, since some technologies are very constrained, we needed a very constrained protocol to carry out the process.

EAP provides flexible authentication, and it has EAP Key Management Framework which is well specified and working for many years, from which you can generate generate a fresh pre-shared key (MSK) dynamically. This is even possible if you do not want to interact with AAA infrastructures running EAP in standalone mode.  Having said this, another thing that we looked into was to give support to large scale deployments. We can ease this process with EAP and its interaction with a AAA infrastructure, which gains relevance in Industrial IoT and 5G.

All these characteristics can be provided by the use of EAP, if we of course have a lightweight EAP lower layer to transport EAP from the IoT device. Then we considered the usage of CoAP as EAP lower-layer.

In this sense, we saw minimal security did not fit our view (no potential interaction with AAA , flexible authentication, fresh generation of PSK).  In fact,  the provisioning of the PSK was out of scope.

At some level, we could even consider the work complementary. EAP over CoAP could be a way of providing the PSK for the work of minimal security.


Best Regards,
Dan.

El 10/12/2020 a las 18:43, Mališa Vučinić escribió:

Hi Dan,

 

Could you be more specific on the point below, what deficiencies do you have in mind?

 

Mališa

 

From: core <core-bounces@ietf.org> on behalf of Dan Garcia <garciadan@uniovi.es>
Date: Thursday 10 December 2020 at 10:06
To: Michael Richardson <mcr+ietf@sandelman.ca>, EMU WG <emu@ietf.org>, "core@ietf.org WG (core@ietf.org)" <core@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

 

As you comment , draft-ietf-6tisch-minimal-security - offers minimal security and has several deficiencies that can be solved by using EAP and AAA infrastructures. 

-->

--> --------------80C24DC785D13739DD6EBAE8-- From nobody Mon Dec 14 00:48:19 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A6BE83A0D25; Mon, 14 Dec 2020 00:48:14 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.23.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <160793569464.18419.15019250928855569100@ietfa.amsl.com> Date: Mon, 14 Dec 2020 00:48:14 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2020 08:48:15 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework Authors : Francesca Palombini Ludwig Seitz Göran Selander Martin Gunnarsson Filename : draft-ietf-ace-oscore-profile-14.txt Pages : 33 Date : 2020-12-14 Abstract: This memo specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. It utilizes Object Security for Constrained RESTful Environments (OSCORE) to provide communication security and proof-of-possession for a key owned by the client and bound to an OAuth 2.0 access token. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oscore-profile-14 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile-14 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oscore-profile-14 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Dec 14 01:58:32 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72FDD3A0EA8 for ; Mon, 14 Dec 2020 01:58:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.202 X-Spam-Level: X-Spam-Status: No, score=-0.202 tagged_above=-999 required=5 tests=[DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwjT9GPJ-2Fz for ; Mon, 14 Dec 2020 01:58:30 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60041.outbound.protection.outlook.com [40.107.6.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04D213A0E8F for ; Mon, 14 Dec 2020 01:58:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ITdcqELXJnu5KblkwfugTU+pCyjFbswbSeSCbt0glqZ6w3rSVCenZSrVVNRlu2/rPEYPO2cZK4qb34shpFbkOyPLcN+Yy0QU+hJXfNWhIpmaAI5P7reKgPkldamvxp1XWiRTEBl3AWuoCma58VuNGUfiNRcUcjw5yAg4kigATyGl3GDZcEx7bGu5UWIIshPLudYKyPxR62B9AEY2l/dAkpEv2h6Tg7k/rUnVLoIfV1jGcfiLCGk4e9yB6QzJV5hO5YZvT5/hG0t8vzFA38xWvgYYaJHjxNiH0YaJ+C7Y6m142OnzSMoXfOo94VE7Z9qJTpoKVANV/mdg6CcoXsEc2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2FrLm7447QYCZKoin2ZpPS6hr6zckB9MKQAVjTsh+ig=; b=ZXMg0silDVVNOsoiiAjca1HzIPfzAzRZ5Ik8zPRxj/xhqWNCw9tKihDcmnNobuwMZb/6HPO670bud/ISQa4rJTwF4AVeysLNVAg2TbYeO38GNilL0Q1SlihQKmvT1QQgIwoNPEwr5SS4NsPeP97NZ/35dv6DrLyLg8x4EG4m77eUztqB/kXw0mDYk3UdA5yAXHJ4f/rG1InRD+6tQTl8vCkMqbj8vO5grS35H39ripxUAiZ3CfZ820XCYv7VHuaprLV6H9QfnXrlBjzR42P6MetxJbE4wAjn4kUAXNEuHmJobzlK+lqab27huDrSGG633fxTZEJI1QBMXZKgxPtbfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2FrLm7447QYCZKoin2ZpPS6hr6zckB9MKQAVjTsh+ig=; b=fS+aSpbZRLqbyGdht9/ygba3CvVQbvdl5cYiy72GftetketQfzXihRRJoQZiTKidD+z0LTxhRRqb/xR5R7PiyC7BFQgGOjZwBjmLAP2IC72s9wTWP1CvmalgyDyib31ZpSpCMFaOMtdbMhGjyHuy02L7kdLBrCRnHruxRmUxSXU= Received: from VI1PR07MB4477.eurprd07.prod.outlook.com (2603:10a6:803:74::33) by VI1PR07MB4096.eurprd07.prod.outlook.com (2603:10a6:803:2c::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3676.12; Mon, 14 Dec 2020 09:58:22 +0000 Received: from VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2]) by VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2%6]) with mapi id 15.20.3676.015; Mon, 14 Dec 2020 09:58:21 +0000 From: Francesca Palombini To: "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt Thread-Index: AQHW0fX/km93Yz6f80i7eO56+sm9o6n2bCaA Date: Mon, 14 Dec 2020 09:58:21 +0000 Message-ID: <1752F003-99AA-47F6-9B1A-9B493F07DC7D@ericsson.com> References: <160793569464.18419.15019250928855569100@ietfa.amsl.com> In-Reply-To: <160793569464.18419.15019250928855569100@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.42.20101102 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:1ba8:147a:c100:b9e3:8294:872b:37d3] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ed0049d5-03dc-44d6-86c7-08d8a016ca7d x-ms-traffictypediagnostic: VI1PR07MB4096: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: RQbJsRfgFBbgL2PI4a9q3lGqx0VXwGUJ+dPirD6ZRrkuPXaCMDEXCL19Ws3mXVfjiNRQn2E8hP3HNY6BHY0XXjf/lhkftFX/TMpZ4CjhOTM/s9SEa/wm5kFZKjiAErI9kNqkdqZ+sx0C8kG9lslt4WDRCKYNFB7Ebsn4QCiohY8rcfEgsFL7KXeR9G7Ie1o1qMNFOOsVWNKisJigE3sd5lQDg+k/LMQI96jra9V0jF61tgo/w+DhTHRSdpINueaShR6iA4Ajm58zj+53D7xp95up2A3Q2eLYhfSkzQSYnZHB55hdzYVt+09viRGOLq8Uc6T0J6ou6jTE+vStpnacfGVQxQ+4cpoMzl/D6siZw5D2vs3lpBdJOcCap3A1ciItfvNx7LlJLpDuK/iaSmBmnwYFyPH/vQVljUq+eAcc7wsvCUg5/J28u1njIqINL4MtJyOVmjXYVHY4M0BOX8auw4trdcs8tFvhPzTAJdf5jj4/wOK4qbVvYtFYamFvGJ7v x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI1PR07MB4477.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(366004)(376002)(136003)(396003)(346002)(66476007)(83380400001)(33656002)(6512007)(316002)(71200400001)(8676002)(2616005)(4001150100001)(2906002)(36756003)(66574015)(186003)(66946007)(76116006)(44832011)(86362001)(64756008)(66556008)(6506007)(8936002)(66446008)(6916009)(91956017)(966005)(5660300002)(6486002)(478600001)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?bDNVVHM5V09iSS95dThkcEtHaU5QU3UzSE45YjkrK0g2UnM4QWRFQXJGSTZw?= =?utf-8?B?UkNMTnVFelNWTlcvY2s2YmVqRGk0Z1Z2bXZvUFFTV2tUQ1ZzWFhjMGVNMlpy?= =?utf-8?B?aENBaGNCNzBBcEV6N2F2Q0t1QWt6Tk5mRWhRNVV6ajBLamdEWGIzL3E2czZh?= =?utf-8?B?RWVPd2NjZm4rQi9CdTg2aDBZZ2JYSnhxd21taG1QbENpTlBEUkNVOHpNUHFo?= =?utf-8?B?dDUwbHBqWC9KaXdoZG80ZWYrY0krS0pVL3hueHpjZkR4VkVoSmFjMlJBVnVi?= =?utf-8?B?cG5QV3AxN1NVakIvZEZjV2ZUZ2creHUxdGE2Z1pyUWVmUzRzc053TDVNY0hL?= =?utf-8?B?NnI5SExYRnFnZGxGeTRHSXBIQ3BQU3hDKzFDZUk4TW9zWlYzNUg5eFNEMENW?= =?utf-8?B?VnJyRk56VTExbmxVOHNhQ0JrT3RnMlBvZ3R1djJ6WktBVGdzUjhQSi8xaVVm?= =?utf-8?B?ZEk2c1F1RW9UWU1NY2IybjVENWtXNkVtNlA4KzZUV0ZZc2l4cEw0eFY5RGh2?= =?utf-8?B?Wm5lck9VeFF0WEgwamxTYjhMd1BTQ29qN0ZVTVdOYjNHY2VtSFBTMzRoRCtz?= =?utf-8?B?TzgwV3NJTno0Wm5kS0kxdlpZN012VjZBSWM4VzdSQVRNazF2b3F5VlU1Zkg5?= =?utf-8?B?cHg1bmY5NUJXUTdYOHd0VDJ5WFgrM1NaRWxZN1BaWVp4ZjRyenNvK2JDcTV5?= =?utf-8?B?MVRiQzM5ZGg2dzUwQWpwaG1GSDhxZGV2TG11M3hheXVJdXVtd2plV0x5cHY2?= =?utf-8?B?SGpKZkY4YVd1ZW93YlZEMnJIQnAvamh4N3RKMWFUcXB4d24wbVlhRjY5TjBn?= =?utf-8?B?NTJBMlZaZVNDNHUyb1hPeE1WZTZueDI2OUFVQkVjdldBZ080TWJlMnRPcG1D?= =?utf-8?B?alJVMncwYzhFUGpEN1o2SWh4OW1JVVFyU0wxVnNaeVdOUzNBcFB2V0lYRjF0?= =?utf-8?B?K0hzS0hNTFMxUElrUkZtL3N0YXNYWGF5Y255UERINW9xNEdkdXJmRDZaVGYx?= =?utf-8?B?cUwrdllCd3ZIOG11SjY4ejdBbFF1Z1JCZDlSajgveWNEb2VOcUtHYUx4OUNN?= =?utf-8?B?bWhrbi9nTGxzd3BtYlcrTjZEZWpQNjBqY2hZaXlLWTZ0WjU3MEZSSlM4ckIz?= =?utf-8?B?aUhVTG5sbS9BQktUZm91NzY2aWZLRjZLQ1ljemc5T3lUbW9pN3hPMHBmdTVk?= =?utf-8?B?Y1FtNDlNVWpjbzY3NDJ1bUhEbDIvdzhiMGFuS3ZiR0wvb2tXSUd1QXFsNGd1?= =?utf-8?B?MC81cnpIUExvZncyV3h6c1U5S2xwczduMndvQThLNDNVY09GTnpmTTg4V29h?= =?utf-8?B?SkNKcEFPN1dlOHpmMEZWOGJEVFNIdHdYaXR4WW5LMGZjZUR3QVlLZzVlS3hT?= =?utf-8?B?VzdvUkIxVlR3b3B3R1QxemVFQmZlTzVFMUwxeUNQQ3J5NDMwalpkRHlJMGZW?= =?utf-8?Q?WKCsbil5?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: VI1PR07MB4477.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ed0049d5-03dc-44d6-86c7-08d8a016ca7d X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2020 09:58:21.9014 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: znNB5W5rSOCbkq6cebsDzp8T5dAZJizQRf/LzoHafLVw1XEhwuqVSDPqQj8XsKOWeImNTbH8PqHQu4xyo6SVLHoCv3w1Jm02BygJ8jbwS4NMnzRusWsp2TN2HuJKJGb/ X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB4096 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2020 09:58:31 -0000 SGkgYWxsLA0KDQpUaGlzIHVwZGF0ZSBhbnN3ZXJzIE1hcmNvJ3MgbGF0ZXN0IHJldmlldyAodGhh bmtzIE1hcmNvISksIGFuc3dlcmluZyBhbGwgY29tbWVudHMgcmVjZWl2ZWQgYXMgV0dMQy4NCg0K VGhhbmtzLA0KRnJhbmNlc2NhDQoNCu+7v09uIDE0LzEyLzIwMjAsIDA5OjQ5LCAiQWNlIG9uIGJl aGFsZiBvZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmciIDxhY2UtYm91bmNlc0BpZXRmLm9yZyBv biBiZWhhbGYgb2YgaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPiB3cm90ZToNCg0KDQogICAgQSBO ZXcgSW50ZXJuZXQtRHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQt RHJhZnRzIGRpcmVjdG9yaWVzLg0KICAgIFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhl IEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9u bWVudHMgV0cgb2YgdGhlIElFVEYuDQoNCiAgICAgICAgICAgIFRpdGxlICAgICAgICAgICA6IE9T Q09SRSBQcm9maWxlIG9mIHRoZSBBdXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlvbiBmb3Ig Q29uc3RyYWluZWQgRW52aXJvbm1lbnRzIEZyYW1ld29yaw0KICAgICAgICAgICAgQXV0aG9ycyAg ICAgICAgIDogRnJhbmNlc2NhIFBhbG9tYmluaQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgTHVkd2lnIFNlaXR6DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHw7ZyYW4gU2Vs YW5kZXINCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1hcnRpbiBHdW5uYXJzc29uDQog ICAgCUZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLTE0LnR4 dA0KICAgIAlQYWdlcyAgICAgICAgICAgOiAzMw0KICAgIAlEYXRlICAgICAgICAgICAgOiAyMDIw LTEyLTE0DQoNCiAgICBBYnN0cmFjdDoNCiAgICAgICBUaGlzIG1lbW8gc3BlY2lmaWVzIGEgcHJv ZmlsZSBmb3IgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZA0KICAgICAgIEF1dGhvcml6YXRpb24gZm9y IENvbnN0cmFpbmVkIEVudmlyb25tZW50cyAoQUNFKSBmcmFtZXdvcmsuICBJdA0KICAgICAgIHV0 aWxpemVzIE9iamVjdCBTZWN1cml0eSBmb3IgQ29uc3RyYWluZWQgUkVTVGZ1bCBFbnZpcm9ubWVu dHMNCiAgICAgICAoT1NDT1JFKSB0byBwcm92aWRlIGNvbW11bmljYXRpb24gc2VjdXJpdHkgYW5k IHByb29mLW9mLXBvc3Nlc3Npb24NCiAgICAgICBmb3IgYSBrZXkgb3duZWQgYnkgdGhlIGNsaWVu dCBhbmQgYm91bmQgdG8gYW4gT0F1dGggMi4wIGFjY2VzcyB0b2tlbi4NCg0KDQogICAgVGhlIElF VEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUv DQoNCiAgICBUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6DQog ICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9m aWxlLTE0DQogICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1p ZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xNA0KDQogICAgQSBkaWZmIGZyb20gdGhlIHByZXZpb3Vz IHZlcnNpb24gaXMgYXZhaWxhYmxlIGF0Og0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2Rp ZmY/dXJsMj1kcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xNA0KDQoNCiAgICBQbGVhc2Ug bm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBv ZiBzdWJtaXNzaW9uDQogICAgdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJl IGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCg0KICAgIEludGVybmV0LURyYWZ0cyBhcmUg YWxzbyBhdmFpbGFibGUgYnkgYW5vbnltb3VzIEZUUCBhdDoNCiAgICBmdHA6Ly9mdHAuaWV0Zi5v cmcvaW50ZXJuZXQtZHJhZnRzLw0KDQoNCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KICAgIEFjZSBtYWlsaW5nIGxpc3QNCiAgICBBY2VAaWV0Zi5v cmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZQ0KDQo= From nobody Mon Dec 14 07:32:46 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2635E3A0E28; Mon, 14 Dec 2020 07:32:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5lZmXX6fib2U; Mon, 14 Dec 2020 07:32:42 -0800 (PST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D26293A0D05; Mon, 14 Dec 2020 07:32:41 -0800 (PST) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 0BEFWWxJ002710 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 14 Dec 2020 10:32:37 -0500 Date: Mon, 14 Dec 2020 07:32:31 -0800 From: Benjamin Kaduk To: Francesca Palombini Cc: "ace@ietf.org" Message-ID: <20201214153231.GE64351@kduck.mit.edu> References: <160793569464.18419.15019250928855569100@ietfa.amsl.com> <1752F003-99AA-47F6-9B1A-9B493F07DC7D@ericsson.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1752F003-99AA-47F6-9B1A-9B493F07DC7D@ericsson.com> Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2020 15:32:44 -0000 Thanks, Francesca! It looks like the CBOR label values have gotten out of sync between Table 1 and the prose. (The IANA Considerations just refer to Table 1, so I think that Section 3.2.1 is the only thing that needs to be kept in sync.) -Ben On Mon, Dec 14, 2020 at 09:58:21AM +0000, Francesca Palombini wrote: > Hi all, > > This update answers Marco's latest review (thanks Marco!), answering all comments received as WGLC. > > Thanks, > Francesca > > On 14/12/2020, 09:49, "Ace on behalf of internet-drafts@ietf.org" wrote: > > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. > > Title : OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework > Authors : Francesca Palombini > Ludwig Seitz > Göran Selander > Martin Gunnarsson > Filename : draft-ietf-ace-oscore-profile-14.txt > Pages : 33 > Date : 2020-12-14 > > Abstract: > This memo specifies a profile for the Authentication and > Authorization for Constrained Environments (ACE) framework. It > utilizes Object Security for Constrained RESTful Environments > (OSCORE) to provide communication security and proof-of-possession > for a key owned by the client and bound to an OAuth 2.0 access token. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-ace-oscore-profile-14 > https://datatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile-14 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oscore-profile-14 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace From nobody Mon Dec 14 07:46:24 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DD3A3A100C for ; Mon, 14 Dec 2020 07:46:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.202 X-Spam-Level: X-Spam-Status: No, score=-0.202 tagged_above=-999 required=5 tests=[DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W6Kk_osb9vGk for ; Mon, 14 Dec 2020 07:46:20 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60057.outbound.protection.outlook.com [40.107.6.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42C823A100A for ; Mon, 14 Dec 2020 07:46:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JvPhsgYVSk0lAIy69ehLNZ2WfEL+lxTGS42INaaxa/sbbkGd9R+O6mmU29kQMmeLJ1ZO9BihKRQC2X/dtKg9P9x7vE1wqFmQSJF2u0Lt7Ayaxm1h8Qw7l8soJ3qG6B1RXOfW72vLrm8llY8nd6U2oONI92tZ50tb950mqQwjKS9BSbBr6I61PzxwvxydhcG+0EFuk+lg4TaYsMw+gNgSdHNaQt+W/ibTSuKXOzpOoZfZWT1GY7Ys9JPdeIvpC0FznnnzgYqXG+LAdPOzGooxIUtcfu3lIh2VMOpODJ4EtiRWpqN1bF2tPHSwoc6ibSCxT8vLMGVatHghj4Qa9+PS2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Z8+8KMZPqgbbgJ4uibHyMlpezDsoqmSY/rdq3YvCw1U=; b=DNIRKu0scB27/mDiDGOdIVZcY7ih5LY3Neg0bGF3vqkzwx2biZPxKlXGTgXkAGWtbvFxJTkajmkHxaBYRTbMAtlFtxKPOKMOLSTg/BPuLaaHfNgl8BCZ+XIPiGh7mobFMjK5Af6FbSM7vsd95O/wF1ODiPIJixJEYiAiCNH/u/6hnlGTXancvi8qVa/9ARnlk1DVUglwyAac+xrZN04OPR5x0SWWIMB1hEAzBLFAFVinUbqsDV3g6hJvPAkyj+2eWlRn24p+2n3dlRiivp6fbvRYgZzbU9jr7zYfRtIqlRZN0NJChuEWCeOH7CHskbU3AZ3QTs/L/Ss0f1KsdV1KWg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Z8+8KMZPqgbbgJ4uibHyMlpezDsoqmSY/rdq3YvCw1U=; b=rIDNx7Ja0YPtVancl46ta5uLCjVjNDJ8NOCbytVoeyi15CNJDizDNnOScQoyS46vysi0wnlw3ITjs2JCyJHjerTNBSnd5j/JaTEj4vIizxqkdwcv5OUrSOTkD8LtWkTcBZHZ0ApB1bOAh/RmSmZ0p/zelnaAaMCUfoZdyhLw694= Received: from VI1PR07MB4477.eurprd07.prod.outlook.com (2603:10a6:803:74::33) by VI1PR07MB4368.eurprd07.prod.outlook.com (2603:10a6:802:5c::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3676.9; Mon, 14 Dec 2020 15:46:18 +0000 Received: from VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2]) by VI1PR07MB4477.eurprd07.prod.outlook.com ([fe80::4957:ef58:c6d5:9aa2%6]) with mapi id 15.20.3676.015; Mon, 14 Dec 2020 15:46:17 +0000 From: Francesca Palombini To: Benjamin Kaduk CC: "ace@ietf.org" Thread-Topic: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt Thread-Index: AQHW0fX/km93Yz6f80i7eO56+sm9o6n2bCaAgABMmoCAABScgA== Date: Mon, 14 Dec 2020 15:46:17 +0000 Message-ID: <07C849A7-2821-4FAE-A5F5-817195C5B03F@ericsson.com> References: <160793569464.18419.15019250928855569100@ietfa.amsl.com> <1752F003-99AA-47F6-9B1A-9B493F07DC7D@ericsson.com> <20201214153231.GE64351@kduck.mit.edu> In-Reply-To: <20201214153231.GE64351@kduck.mit.edu> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.43.20110804 authentication-results: mit.edu; dkim=none (message not signed) header.d=none;mit.edu; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:1ba8:147a:c100:b9e3:8294:872b:37d3] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3d9c1ef1-f60d-47fa-4aa1-08d8a047658a x-ms-traffictypediagnostic: VI1PR07MB4368: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: wUBn3GOEf8x6DEbDh6/SY5QznZfhkfrwV2hdTYrKrwvcHDPeCOsA9yEGzzDlbXBB5JFB18Vi267DgLRZctkSREWNLQ40kuw/Nbmunvtt+RRoiPAoi6KXUQCNiXaxPZwkmemnwpHKDPHhRal8RNp9GiZ/Rh7ZcvwDKbXcckA1ELX9XlZovPWEt785hUQD9vayScsHFG/dEConaynaHD/z/Gd9bCG45ubIKi08PugdRfor4qVziSmEJhsyUU+bhcbCNN/+Yp2y6gkCn3AJrjsK5xC14GvsRla2YVe3Xh3OHf2ioZz9SmPDPraGtDVacr5G2oWC/UpPk9BBVt5bwqnHCmsHMYXoz5YTzWusUiEyBn062SeqsVmCe5xQdzBEWK8kc2GKG3E+u3PiUaV/3l/CTCGrHxoIwsKiYYKRYzzS1/dppVDpyaB12DRR5dHfU2N+OX5jt/9VB5deZsV14AJEakA9UEieBCt0u5rIqyrMGX1xsd9iTAPiq/rHhrdeF6b3YIkUhgIeI13kI6sQL/1A5w== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VI1PR07MB4477.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(366004)(376002)(346002)(396003)(39860400002)(966005)(66946007)(66556008)(66476007)(4001150100001)(186003)(2616005)(2906002)(53546011)(6512007)(33656002)(66446008)(8676002)(76116006)(91956017)(316002)(6486002)(8936002)(5660300002)(44832011)(71200400001)(4326008)(478600001)(6916009)(6506007)(66574015)(36756003)(86362001)(64756008)(83380400001)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?WExQajA2ZURJcFpxTHMvdVJOR1BPTEpobDViTXFIbDBBL085QkRRTnVkK1RL?= =?utf-8?B?dUV3R3JZU2FhczBuSXM0MXJZQlhlRmVlQVMxVGcxR1FnY01OYzlRR2FZa0Mx?= =?utf-8?B?T0pESnNYVDNuc1pUSWJjVUt6dDZweVFTUlVBc3E5QTJMdFlSaG5aOTRqMVhX?= =?utf-8?B?aEZxNXBGNGU0K25BNVR6QXdnZW10OTF4Zzh5angxcmhFVFNKYWFaVEFyUWFF?= =?utf-8?B?bnlHQXJuZkdoUDFRaDF0eDVzM1J5KzNyT0JKd296UGxCSmpKRmIrbmZ5c1lw?= =?utf-8?B?TnhTTUtXQTRZUGRrRDBMa1U0M01YZVpRV0wySGEyWndLM0FHU2p3eW54OUY0?= =?utf-8?B?UktxZk56cGhLQVNxb3piWG9ZNkkzRXJIZWFuYVFiMDZOazYxb1dxbTcxZXdn?= =?utf-8?B?UlF4dTJrWEhrN2pKRnZ1VXhoeTVKOUppZE1LZDdneTMyL0ZPam9VODhxTkFo?= =?utf-8?B?T1E5eXRRNmhhdTh6NmpLVE9zRXhsb0dsOUZHaU93M2FVSHJYY3BrKzZCNGlF?= =?utf-8?B?cXAxQktOK2ozcjBSOEMwcE9NMjIwTWpSaS91ZC9PWGtaRlR2eXM5bk8wODJi?= =?utf-8?B?MkFERnpoRmhHVFdHSm9pNk8rT3FmVDhnYmFmU1dENkRuLzBOclhEWDUwZUZi?= =?utf-8?B?TDNRSXhlTjFnUHZKMVpGeFQ1bXZUTlR3MGtZRmhXWTNLVThBVFBhV2NQenA0?= =?utf-8?B?SnFGSHFadVRrVlJ3RkFUckZPalYzT2YvTGcwL1VKWFRvQWFwWDF5YVgwN2hl?= =?utf-8?B?WUd6V2k1Yys4STNqY01GMitVaDFtVXdlR25UR3NJUnlxQjJNTGUrTGVFSGhK?= =?utf-8?B?V05zTEd5WC9EL3dhUTNjWUtjRmxuZ1JSNVI2a3YvQXl3Z0wzUWlwYmVXN0RG?= =?utf-8?B?Qk85QjQ5Z0I1LzhBQXUxb2grRitRMnN4UEwvSmFhSU5KMEU1a1d4Qkd3N3hn?= =?utf-8?B?NVpwR1NxTlRCMVdOMVRJWTBZVk1Zd0Yzdzl4VmJhdzE0RlB6MGsrR2JoM29S?= =?utf-8?B?dnN3S0Y5dFZSYVc2U1NISGdaVkdUVFl1MzhDRHRuQnBFcGpvMUtGb2JNaml5?= =?utf-8?B?QStOVGN5UHNjRVA3ckJiSDN6MDVuUnA3R2doNWFLOE5HMzVLQXB0UWlrZXZO?= =?utf-8?B?ZmpObGNHMnlFVmlxY0ZSeklyUVVMQ3B3alB2Vk5NazJYZUV4Ulk1SWduenBw?= =?utf-8?B?UFVRTW1VY2F1VlhMUFRtS0pNNDhOQXlwVG05SHk0bFd2V0EyVGZDdnc1UXFZ?= =?utf-8?B?WFkrVTdmbkNUSWVqdGNFK3JBb2gzcDJHcmlTR1dJQ2RFVmZmUVYwZmZHTlg0?= =?utf-8?B?RG4zbldkcktHNzRYTisyZ082LzIxMGtLdEwrRG5zYTduVjFINWNwSWFpUnRp?= =?utf-8?B?bk5wT0hSekF5L0ZQTmZRd0hlSXA2aDIvS01iRWdWY1Q2NG5CVjUzaUViVkI4?= =?utf-8?Q?siyYa0Oj?= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <17F72D634F397244A9A267FCE13EF78B@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: VI1PR07MB4477.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3d9c1ef1-f60d-47fa-4aa1-08d8a047658a X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2020 15:46:17.8529 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: szmfedD93Ff3xnGm2u/t5PFzUzMnJ6uDAIJZpiYDdXCL/N8119chYryDNvgVzcGYD1mvOMD/t8/cmQQx4KcNBbRsTqhLm2aENOsHaAFuuA0rEUxnVGDY6LrB6+AP4sb4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB4368 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oscore-profile-14.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2020 15:46:22 -0000 QWgsIG9mIGNvdXJzZSwgdGhleSBhcmUgaW5kZWVkIG91dCBvZiBzeW5jLCB0aGFuayB5b3UgZm9y IG5vdGljaW5nISBJIGFtIGZpeGluZyBpdCBhbHJlYWR5IGluIHRoZSBnaXRodWIsIGJ1dCBJIGFt IHRoaW5raW5nIG9mIHdhaXRpbmcgZm9yIERhbmllbCdzIGdvIGFoZWFkIGJlZm9yZSBzdWJtaXR0 aW5nIG9uZSBtb3JlIHZlcnNpb24sIHNlZSBpZiBoZSB3YW50ZWQgdG8gcmV2aWV3IG9uZSBsYXN0 IHRpbWUuDQoNCkZyYW5jZXNjYQ0KDQrvu79PbiAxNC8xMi8yMDIwLCAxNjozMiwgIkJlbmphbWlu IEthZHVrIiA8a2FkdWtAbWl0LmVkdT4gd3JvdGU6DQoNCiAgICBUaGFua3MsIEZyYW5jZXNjYSEN Cg0KICAgIEl0IGxvb2tzIGxpa2UgdGhlIENCT1IgbGFiZWwgdmFsdWVzIGhhdmUgZ290dGVuIG91 dCBvZiBzeW5jIGJldHdlZW4gVGFibGUgMQ0KICAgIGFuZCB0aGUgcHJvc2UuICAoVGhlIElBTkEg Q29uc2lkZXJhdGlvbnMganVzdCByZWZlciB0byBUYWJsZSAxLCBzbyBJIHRoaW5rDQogICAgdGhh dCBTZWN0aW9uIDMuMi4xIGlzIHRoZSBvbmx5IHRoaW5nIHRoYXQgbmVlZHMgdG8gYmUga2VwdCBp biBzeW5jLikNCg0KICAgIC1CZW4NCg0KICAgIE9uIE1vbiwgRGVjIDE0LCAyMDIwIGF0IDA5OjU4 OjIxQU0gKzAwMDAsIEZyYW5jZXNjYSBQYWxvbWJpbmkgd3JvdGU6DQogICAgPiBIaSBhbGwsDQog ICAgPiANCiAgICA+IFRoaXMgdXBkYXRlIGFuc3dlcnMgTWFyY28ncyBsYXRlc3QgcmV2aWV3ICh0 aGFua3MgTWFyY28hKSwgYW5zd2VyaW5nIGFsbCBjb21tZW50cyByZWNlaXZlZCBhcyBXR0xDLg0K ICAgID4gDQogICAgPiBUaGFua3MsDQogICAgPiBGcmFuY2VzY2ENCiAgICA+IA0KICAgID4gT24g MTQvMTIvMjAyMCwgMDk6NDksICJBY2Ugb24gYmVoYWxmIG9mIGludGVybmV0LWRyYWZ0c0BpZXRm Lm9yZyIgPGFjZS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBpbnRlcm5ldC1kcmFmdHNA aWV0Zi5vcmc+IHdyb3RlOg0KICAgID4gDQogICAgPiANCiAgICA+ICAgICBBIE5ldyBJbnRlcm5l dC1EcmFmdCBpcyBhdmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGly ZWN0b3JpZXMuDQogICAgPiAgICAgVGhpcyBkcmFmdCBpcyBhIHdvcmsgaXRlbSBvZiB0aGUgQXV0 aGVudGljYXRpb24gYW5kIEF1dGhvcml6YXRpb24gZm9yIENvbnN0cmFpbmVkIEVudmlyb25tZW50 cyBXRyBvZiB0aGUgSUVURi4NCiAgICA+IA0KICAgID4gICAgICAgICAgICAgVGl0bGUgICAgICAg ICAgIDogT1NDT1JFIFByb2ZpbGUgb2YgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0 aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgRnJhbWV3b3JrDQogICAgPiAgICAgICAg ICAgICBBdXRob3JzICAgICAgICAgOiBGcmFuY2VzY2EgUGFsb21iaW5pDQogICAgPiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBMdWR3aWcgU2VpdHoNCiAgICA+ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEfDtnJhbiBTZWxhbmRlcg0KICAgID4gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgTWFydGluIEd1bm5hcnNzb24NCiAgICA+ICAgICAJRmlsZW5hbWUgICAgICAg IDogZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTQudHh0DQogICAgPiAgICAgCVBhZ2Vz ICAgICAgICAgICA6IDMzDQogICAgPiAgICAgCURhdGUgICAgICAgICAgICA6IDIwMjAtMTItMTQN CiAgICA+IA0KICAgID4gICAgIEFic3RyYWN0Og0KICAgID4gICAgICAgIFRoaXMgbWVtbyBzcGVj aWZpZXMgYSBwcm9maWxlIGZvciB0aGUgQXV0aGVudGljYXRpb24gYW5kDQogICAgPiAgICAgICAg QXV0aG9yaXphdGlvbiBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1lbnRzIChBQ0UpIGZyYW1ld29y ay4gIEl0DQogICAgPiAgICAgICAgdXRpbGl6ZXMgT2JqZWN0IFNlY3VyaXR5IGZvciBDb25zdHJh aW5lZCBSRVNUZnVsIEVudmlyb25tZW50cw0KICAgID4gICAgICAgIChPU0NPUkUpIHRvIHByb3Zp ZGUgY29tbXVuaWNhdGlvbiBzZWN1cml0eSBhbmQgcHJvb2Ytb2YtcG9zc2Vzc2lvbg0KICAgID4g ICAgICAgIGZvciBhIGtleSBvd25lZCBieSB0aGUgY2xpZW50IGFuZCBib3VuZCB0byBhbiBPQXV0 aCAyLjAgYWNjZXNzIHRva2VuLg0KICAgID4gDQogICAgPiANCiAgICA+ICAgICBUaGUgSUVURiBk YXRhdHJhY2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczoNCiAgICA+ICAgICBodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmls ZS8NCiAgICA+IA0KICAgID4gICAgIFRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2 YWlsYWJsZSBhdDoNCiAgICA+ICAgICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTQNCiAgICA+ICAgICBodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLTE0DQogICAg PiANCiAgICA+ICAgICBBIGRpZmYgZnJvbSB0aGUgcHJldmlvdXMgdmVyc2lvbiBpcyBhdmFpbGFi bGUgYXQ6DQogICAgPiAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0 LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLTE0DQogICAgPiANCiAgICA+IA0KICAgID4gICAgIFBs ZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0 aW1lIG9mIHN1Ym1pc3Npb24NCiAgICA+ICAgICB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBh bmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KICAgID4gDQogICAgPiAg ICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBhbHNvIGF2YWlsYWJsZSBieSBhbm9ueW1vdXMgRlRQIGF0 Og0KICAgID4gICAgIGZ0cDovL2Z0cC5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvDQogICAgPiAN CiAgICA+IA0KICAgID4gICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQogICAgPiAgICAgQWNlIG1haWxpbmcgbGlzdA0KICAgID4gICAgIEFjZUBpZXRm Lm9yZw0KICAgID4gICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNl DQogICAgPiANCiAgICA+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQogICAgPiBBY2UgbWFpbGluZyBsaXN0DQogICAgPiBBY2VAaWV0Zi5vcmcNCiAgICA+ IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlDQoNCg== From nobody Mon Dec 14 09:00:30 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A204E3A08C5; Mon, 14 Dec 2020 09:00:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.187 X-Spam-Level: X-Spam-Status: No, score=-0.187 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RVoMFuXcBfac; Mon, 14 Dec 2020 09:00:23 -0800 (PST) Received: from mail-ua1-x930.google.com (mail-ua1-x930.google.com [IPv6:2607:f8b0:4864:20::930]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31EAB3A08D4; Mon, 14 Dec 2020 09:00:23 -0800 (PST) Received: by mail-ua1-x930.google.com with SMTP id s23so5679555uaq.10; Mon, 14 Dec 2020 09:00:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rQAnvdj/QI+sFitpvnp/PZr2uJQyILU7lCsbTiCEuik=; b=tkgAkrBzvSgBcchTUc5FnWdyJdp5pYCuh+9ayQRAGCi3M7ABo9WPsSxyUYt4YByZTV +aKzkiFdKGUFYCzKhlaJtfWHtsSeOFANROL+hoYcrF8Djn6o4g94M3ae8YcMypCVzoNU 9e4VnbxuEBq5otyJ8sn/MSYoHmKS7O25U1hRK7a5BSq0STfWLR754E7xTgviKVXUktTq DpTQWN/l5EBrQ4VxhSDjlkVDTY4OhI6Qqxs0NoD0S7tsxUEfRhkbO4HgJG/ue3XRLscx jcAHXwxynXaMP5Zoel1oQD0xzoPeuyrear8TsIxAcrCmwDVEVVs26/XYHKAl+1bxJfO1 bUlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rQAnvdj/QI+sFitpvnp/PZr2uJQyILU7lCsbTiCEuik=; b=oa1veA2eX28JQvKE4PgP64lTkfGPZAWJCiTofncllmbLzKS+ZNcPh8iZPAdokfbovW 7Y5BN6OkuGdapsBEd1gmqQDmCCad+k2ANeFp16SNcoAVMQyIxkzqMFXzyaAglV1CrEzy Ls/+wkCe+q2nKfekH6jT1SvH647VT4iUdzWQI953LREF34bYHNA3K+kIeerj6KFEuyqA iN6EW0fIG66dXeSkiMsq+u7C37JIFUTQa6xcRAW0tAZ+YxtjTvW1g7P5uGEqtF0beFc6 vpJICEAWwgjWqV+CR3/Au0TptKOqCZm5/rjuYQJmA3Cv+qnIVf9SM2M75amArfQ5R1Wl gx0A== X-Gm-Message-State: AOAM531EjkNcDjKkk2sqFGh4x8bY2V7j+LPZ1Wo5fBlj7/mpNieAT/IZ 6NCY87YAzj/j8bayLMSI3xut75875cdtVBFxuefb64kGXrs= X-Google-Smtp-Source: ABdhPJy6l86p8FhJo2m7g8CO8G3oTyQXjLIBPoHtMwLGg8KRukBUpF6VJBV0GcI8JDRl6D0Ft0rt5dYgGrkiLOA18QI= X-Received: by 2002:ab0:244f:: with SMTP id g15mr24281731uan.80.1607965222087; Mon, 14 Dec 2020 09:00:22 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Daniel Migault Date: Mon, 14 Dec 2020 12:00:10 -0500 Message-ID: To: Benjamin Kaduk Cc: Ace Wg , SPASM , anima@ietf.org, iotops@ietf.org Content-Type: multipart/alternative; boundary="000000000000dfb20a05b66f9357" Archived-At: Subject: Re: [Ace] ACE new charter X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2020 17:00:26 -0000 --000000000000dfb20a05b66f9357 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Ben, The current proposed charter for ACE is as follows. As soon as the charter is validated by the IESG, we will start call for adoption - at least for the CMPv2 and EAP items. The IESG may find useful that CMPv2 work may also be hosted in LAMPS (which revisits CMPv2), ANIMA ( which defines CMPv2 as an alternative to EST) or IOTOPS. However, the discussion started in LAMPS and it was suggested ACE would be more appropriated [1] and the current proposed charter has been circulating on the lamps, anima, iotops mailing list and no concerns have been raised. We will however make sure , these related WG are informed of our progress. EAP work has been coordinated with EMU. In any case, if the work is being considered in ACE, we will make sure the corresponding WG will follow the progress. [1] https://mailarchive.ietf.org/arch/msg/spasm/uyYCf5sMcxg6xoQFcbe1sPxqVLw= / Yours, Daniel """ The Authentication and Authorization for Constrained Environments (ace) WG has defined a standardized solution framework for authentication and authorization to enable authorized access to resources identified by a URI and hosted on a resource server in constrained environments. The access to the resource is mediated by an authorization server, which is not considered to be constrained. Profiles of this framework for application to security protocols commonly used in constrained environments, including CoAP+DTLS and CoAP+OSCORE, have also been standardized. The Working Group is charged with maintenance of the framework and existing profiles thereof, and may undertake work to specify profiles of the framework for additional secure communications protocols and for additional support services providing authorized access to crypto keys (that are not necessarily limited to constrained endpoints, though the focus remains on deployment in ecosystems with a substantial portion of constrained devices). In addition to the ongoing maintenance work, the Working Group will extend the framework as needed for applicability to group communications, with initial focus on (D)TLS and (Group) OSCORE as the underlying group communication security protocols. The Working Group will standardize procedures for requesting and distributing group keying material using the ACE framework as well as appropriated management interfaces. The Working Group will standardize a format for expressing authorization information for a given authenticated principal as received from an authorization manager. The Working Group will examine how to use Constrained Application Protocol (CoAP) as a transport medium for certificate enrollment protocols, such as EST and CMPv2, as well as a transport for authentication protocols such as EAP, and standardize as needed. """ Yours, Daniel On Sat, Dec 12, 2020 at 12:37 PM Dan Garcia Carrillo wrote: > Hi Mali=C5=A1a, > > > El 11/12/2020 a las 19:45, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3: > > Hi Dan, > > > > Thanks for the clarification regarding minimal-security. The points that > you mention below, e.g. flexible authentication or the fresh generation o= f > the PSK, were never in the design scope of our work. > > > > While I fail to understand what exactly do you plan on using EAP-over-CoA= P > for, I do not object on this work being done in ACE if you are willing to > spend cycles on it. I do have reservations on the lightweight aspect of > this, however, considering that the sequence diagram that you depict in > Fig. 2 in draft-marin-ace-wg-coap-eap-06 spans 3 pages and consumes 2 rou= nd > trips just to get things started! Surely, we can do better? > > Yes, we will submit an updated version of the draft. > > Best Regards, > > Dan > > > > Mali=C5=A1a > > > > *From: *Dan Garcia Carrillo > *Date: *Friday 11 December 2020 at 18:41 > *To: *Mali=C5=A1a Vu=C4=8Dini=C4=87 , Michael Ri= chardson > , EMU WG > , "core@ietf.org WG (core@ietf.org)" > , > "ace@ietf.org" > *Cc: * > *Subject: *Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) > > > > Hi Mali=C5=A1a, > > My intention was not to turn this conversation into a criticism of your > work. =E2=80=9Cdeficiencies=E2=80=9D was not the most appropriate word. > > What we had in mind was a way of providing authentication to the variety > of IoT devices with different capabilities, limitations or different type= s > of supported credentials. A way of doing that is to provide different > authentication methods. Since in IoT there are different technologies we > looked for a link-layer independent solution. Additionally, since some > technologies are very constrained, we needed a very constrained protocol = to > carry out the process. > > EAP provides flexible authentication, and it has EAP Key Management > Framework which is well specified and working for many years, from which > you can generate generate a fresh pre-shared key (MSK) dynamically. This = is > even possible if you do not want to interact with AAA infrastructures > running EAP in standalone mode. Having said this, another thing that we > looked into was to give support to large scale deployments. We can ease > this process with EAP and its interaction with a AAA infrastructure, whic= h > gains relevance in Industrial IoT and 5G. > > All these characteristics can be provided by the use of EAP, if we of > course have a lightweight EAP lower layer to transport EAP from the IoT > device. Then we considered the usage of CoAP as EAP lower-layer. > > In this sense, we saw minimal security did not fit our view (no potential > interaction with AAA , flexible authentication, fresh generation of PSK). > In fact, the provisioning of the PSK was out of scope. > > At some level, we could even consider the work complementary. EAP over > CoAP could be a way of providing the PSK for the work of minimal security= . > > > Best Regards, > Dan. > > El 10/12/2020 a las 18:43, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3: > > Hi Dan, > > > > Could you be more specific on the point below, what deficiencies do you > have in mind? > > > > Mali=C5=A1a > > > > *From: *core on behalf of > Dan Garcia > *Date: *Thursday 10 December 2020 at 10:06 > *To: *Michael Richardson , > EMU WG , "core@ietf.org WG (core@ietf.org)" > , > "ace@ietf.org" > *Subject: *Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?) > > > > As you comment , draft-ietf-6tisch-minimal-security - offers minimal > security and has several deficiencies that can be solved by using EAP and > AAA infrastructures. > > --> > > -->_______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --=20 Daniel Migault Ericsson On Mon, Dec 7, 2020 at 1:22 PM Daniel Migault wrote: > Hi, > > The ACE WG though you might be interested in knowing that the current ACE > charter considers, among other things, working on CMPv2 over CoAP. The > current charter can be found here [1]. > If you think the work should be done in another WG, please let us know > before Friday December 11, so we can move the charter forward. > > Yours, > Daniel > > [1] > https://docs.google.com/document/d/1RtxUSvUeBdZWoQkjSj2c3DtR8DuBwPM2BnBXh= oDiptY/edit?usp=3Dsharing > > -- > Daniel Migault > Ericsson > --=20 Daniel Migault Ericsson --000000000000dfb20a05b66f9357 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Ben,=C2=A0

The current pr= oposed charter for ACE is as follows. As soon as the charter is validated b= y the=C2=A0IESG, we will=C2=A0start call=C2=A0for adoption - at least for t= he CMPv2 and EAP items.=C2=A0


The IES= G may find useful that CMPv2 work may also be hosted in LAMPS (which revisi= ts CMPv2), ANIMA ( which defines CMPv2 as an alternative to EST) or IOTOPS.= =C2=A0

Howe= ver, the discussion started in LAMPS and it was suggested ACE would be more= appropriated [1] and the current proposed charter has been circulating on = the lamps, anima, iotops mailing list and no concerns have been raised.=C2= =A0We will however make sure , these related WG are informed of our progres= s.


EAP work has been coordinated with EMU= . In any case, if the work is being considered in ACE, we will make sure th= e corresponding WG will follow the progress.


[1] https://mailarchive.ietf.org/arch/msg/s= pasm/uyYCf5sMcxg6xoQFcbe1sPxqVLw/

=
Yours,=C2=A0
Daniel

"""

The Authentication and = Authorization for Constrained Environments (ace) WG has defined a standardi= zed solution framework for authentication and authorization to enable autho= rized access to resources identified by a URI and hosted on a resource serv= er in constrained environments.=C2=A0

The access to the resource is mediated by an authori= zation server, which is not considered to be constrained.


Profiles of this framework f= or application to security protocols commonly used in constrained environme= nts, including CoAP+DTLS and CoAP+OSCORE, have also been standardized.=C2= =A0 The Working Group is charged with maintenance of the framework and exis= ting profiles thereof, and may undertake work to specify profiles of the fr= amework for additional secure communications protocols and for additional support services providing authorized access t= o crypto keys (tha= t are not necessarily limited to constrained endpoints, though the focus re= mains on deployment in ecosystems with a substantial portion of constrained= devices).


= In addition to the ongoing maintenance work, the Working Group will extend = the framework as needed for applicability to group communications, with ini= tial focus on (D)TLS and (Group) OSCORE as the underlying group communicati= on security protocols. The Working Group will standardize procedures for re= questing and distributing group keying material using the ACE framework as = well as appropriated management interfaces.=C2=A0


The Working Group will standardize a= format for expressing authorization information for a given authenticated = principal as received from an authorization manager.=C2=A0


The Working Group will exam= ine how to use Constrained Application Protocol (CoAP) as a transport mediu= m for certificate enrollment protocols, such as EST and CMPv2, as well as a= transport for authentication protocols such as EAP, and standardize as nee= ded.=C2=A0

"""

Yo= urs,=C2=A0
Daniel

=C2=A0

On Sat, Dec 12, 2020 at= 12:37 PM Dan Garcia Carrillo <ga= rciadan@uniovi.es> wrote:
=20

Hi Mali=C5=A1a,


El 11/12/2020 a las 19:45, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3:
=20 =20 =20

Hi Dan,

=C2=A0

Thanks for the clarification regarding minimal-security. The points that you mention below, e.g. flexible authentication or the fresh generation of the PSK, were never in the design scope of our work.

=C2=A0

While I fail to understand what exactly do you plan on using EAP-over-CoAP for, I do not object on this work being done in ACE if you are willing to spend cycles on it. I do have reservations on the lightweight aspect of this, however, considering that the sequence diagram that you depict in Fig. 2 in draft-marin-ace-wg-coap-eap-06 spans 3 pages and consumes 2 round trips just to get things started! Surely, we can do better?

Yes, we will submit an updated version of the draft.

Best Regards,

Dan

=C2=A0

Mali=C5=A1a

=C2=A0

From: Dan = Garcia Carrillo <= garciadan@uniovi.es>
Date: Friday 11 December 2020 at 18:41
To: Mali=C5=A1a Vu=C4=8Dini=C4=87 <malisa.vucinic@<= /span>inria.fr>, Michael Richardson <mcr+ietf@sandelman.ca>, EMU WG <emu@iet= f.org>, "core@ietf.org WG (core@ietf.org)" <core@i= etf.org>, "ac= e@ietf.org" <= ace@ietf.org>
Cc: <garciadan@uniovi.es>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

=C2=A0

Hi Mali=C5=A1a,

My intention was not to turn this conversation into a criticism of your work. =E2=80=9Cdeficiencies=E2=80=9D was not th= e most appropriate word.

What we had in mind was a way of providing authentication=C2=A0 t= o the variety of IoT devices with different capabilities, limitations or different types of supported credentials. A way of doing that is to provide different authentication methods. Since in IoT there are different technologies we looked for a link-layer independent solution. Additionally, since some technologies are very constrained, we needed a very constrained protocol to carry out the process.

EAP provides flexible authentication, and it has EAP Key Management Framework which is well specified and working for many years, from which you can generate generate a fresh pre-shared key (MSK) dynamically. This is even possible if you do not want to interact with AAA infrastructures running EAP in standalone mode.=C2=A0 Having said this, another thing that we looked into was to give support to large scale deployments. We can ease this process with EAP and its interaction with a AAA infrastructure, which gains relevance in Industrial IoT and 5G.

All these characteristics can be provided by the use of EAP, if we of course have a lightweight EAP lower layer to transport EAP from the IoT device. Then we considered the usage of CoAP as EAP lower-layer.

In this sense, we saw minimal security did not fit our view (no potential interaction with AAA , flexible authentication, fresh generation of PSK).=C2=A0 In fact,=C2=A0 the provisioning o= f the PSK was out of scope.

At some level, we could even consider the work complementary. EAP over CoAP could be a way of providing the PSK for the work of minimal security.


Best Regards,
Dan.

El 10/12/2020 a las 18:43, Mali=C5=A1a Vu=C4=8Dini=C4=87 escribi=C3=B3:

Hi Dan,

=C2=A0

Could you be more specific on the point below, what deficiencies do you have in mind?

=C2=A0

Mali=C5=A1a

=C2=A0

From: co= re <core-boun= ces@ietf.org> on behalf of Dan Garcia <garciadan@uniovi.es>
Date: Thursday 10 December 2020 at 10:06
To: Michael Ri= chardson = <mcr+ietf@sandelman.ca>, EMU WG &l= t;emu@ietf.org>, "core@ietf.org WG (core@ietf.org)" <core@ietf.org>, "ace@ietf.org" <ace@i= etf.org>
Subject: Re: [core] [Ace] Proposed charter for ACE (EAP over CoAP?)

=C2=A0=

As you comment , draft-ietf-6tisch-minimal-security - offers minimal security and has several deficiencies that can be solved by using EAP and AAA infrastructures.=C2=A0<= /u>

--><= /u>

-->_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson

On Mon, Dec 7, 2020 at 1:22 PM Daniel Migault= <mglt.ietf@gmail.com> wro= te:
Hi,=C2=A0

The ACE WG though you might be interested= in knowing that the current ACE charter considers, among other=C2=A0things= , working on CMPv2 over CoAP. The current charter can be found here [1].=C2= =A0
If you think the work should=C2=A0be done in another WG, plea= se let us know before Friday December 11, so we can move the charter forwar= d.=C2=A0

Yours,=C2=A0
Daniel=C2=A0


--
Daniel Migault
Ericsson
--000000000000dfb20a05b66f9357-- From nobody Thu Dec 17 14:49:48 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 327EA3A074E; Thu, 17 Dec 2020 14:49:47 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <160824538715.7287.2616747957594971317@ietfa.amsl.com> Date: Thu, 17 Dec 2020 14:49:47 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-09.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Dec 2020 22:49:47 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Message Queuing Telemetry Transport (MQTT)-TLS profile of Authentication and Authorization for Constrained Environments (ACE) Framework Authors : Cigdem Sengul Anthony Kirby Filename : draft-ietf-ace-mqtt-tls-profile-09.txt Pages : 33 Date : 2020-12-17 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in a Message Queuing Telemetry Transport (MQTT)-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and MQTT server (broker) authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-09 https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Dec 17 14:51:56 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35E563A07F0; Thu, 17 Dec 2020 14:51:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MIOQWfKO8LEL; Thu, 17 Dec 2020 14:51:54 -0800 (PST) Received: from mail-ua1-x92c.google.com (mail-ua1-x92c.google.com [IPv6:2607:f8b0:4864:20::92c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7944C3A0755; Thu, 17 Dec 2020 14:51:54 -0800 (PST) Received: by mail-ua1-x92c.google.com with SMTP id y26so203062uan.5; Thu, 17 Dec 2020 14:51:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=beDwVcezcJX6Foaxndc+ZzvELseaOj/rA4EwBIjpYRw=; b=pah1uj54DLwtPjkCVo7UAj5pbVNRXwTcGe+8kfvlvTsI78t7I4Qx9jxevuno725g7v Ze7biq6ntN3lvtz70bRXuaad0e8Yj/rxU4DCbHDByZURroCB/bw3syvQ2CLmxm2uODTF jybRkFP7vYMtIjrmCEH9qSG7XLQPWTeb+mtBaSivId26u0QMGfJqfe5lJCTe4jZbwSIS jR8rTIj7yimzTx3GWuGp27myNyk/y1+6Z6PajsJnTQVSzghFNsZeS9KSM9cjlPRi0Xw6 QgcQK+UTjVpifwJucUib57mm11B9cBNfxY2t7fRutmR7F0jjSapob022ZBUdF5XoCgKn h4gQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=beDwVcezcJX6Foaxndc+ZzvELseaOj/rA4EwBIjpYRw=; b=RI/d7KSjkRG9f58Ta7gmSN1JIRn63XkYm8rYCcG+Yp8bxNMRRg8Z+G+NFM+ol6F18K UcK1UbRNHFQDpV9AM38CAi1uezaetQhFAPladZcOAlaBc263psW161M51XZ7GuQateUQ MbP4AvjGBImc8Tf1YgRMZVtlKnBwen3qzgBeb+9fT/AQrYqsMZjL5gePaU+oKQAZSFzN NG2IjFtbyL434ZNm1pfbAcbTt+im64JKGajSAIfUryx5tPnOIiiqFnSoJFhnX7nGko0C nfOoVQ9p0gm7jYkOfJ9jZROs/MI+o1gMoegxCiJykkNrrpFPAUM6qN0QcaOsjjldUlzg /QoQ== X-Gm-Message-State: AOAM530yyMzzVbawfBd+ShyaWeLg0VcI0q9Jbg+OxXqQihKO9WjD8qTx gJQ5g1ugpozKDk07nprXKbgITTjEr3QRedjFEKHtVzTrSTY= X-Google-Smtp-Source: ABdhPJz7mza8JfPA5UCpslz1CUMB4qpS1Mixk0bV9LOs3/6QBxLfTTPmErC1g6ZXYREKDGUI5BkNWS7z2uBQyBA3NQY= X-Received: by 2002:ab0:61c8:: with SMTP id m8mr1399777uan.84.1608245513271; Thu, 17 Dec 2020 14:51:53 -0800 (PST) MIME-Version: 1.0 References: <160824538715.7287.2616747957594971317@ietfa.amsl.com> In-Reply-To: <160824538715.7287.2616747957594971317@ietfa.amsl.com> From: Cigdem Sengul Date: Thu, 17 Dec 2020 22:51:42 +0000 Message-ID: To: Ace Wg Cc: i-d-announce@ietf.org Content-Type: multipart/alternative; boundary="00000000000087bc5a05b6b0d697" Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-09.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Dec 2020 22:51:56 -0000 --00000000000087bc5a05b6b0d697 Content-Type: text/plain; charset="UTF-8" Hello Ace, This is the latest version, which I believe would address all the ones Daniel listed in his e-mail around spacing and references. @Daniel, apologies for taking so long. Kind regards, --Cigdem On Thu, Dec 17, 2020 at 10:49 PM wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Authentication and Authorization for > Constrained Environments WG of the IETF. > > Title : Message Queuing Telemetry Transport (MQTT)-TLS > profile of Authentication and Authorization for Constrained Environments > (ACE) Framework > Authors : Cigdem Sengul > Anthony Kirby > Filename : draft-ietf-ace-mqtt-tls-profile-09.txt > Pages : 33 > Date : 2020-12-17 > > Abstract: > This document specifies a profile for the ACE (Authentication and > Authorization for Constrained Environments) framework to enable > authorization in a Message Queuing Telemetry Transport (MQTT)-based > publish-subscribe messaging system. Proof-of-possession keys, bound > to OAuth2.0 access tokens, are used to authenticate and authorize > MQTT Clients. The protocol relies on TLS for confidentiality and > MQTT server (broker) authentication. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-09 > https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-09 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-09 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > --00000000000087bc5a05b6b0d697 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Ace,=C2=A0

This is the latest ver= sion, which I believe would address all the ones Daniel listed=C2=A0
<= div>in his e-mail around spacing and references.=C2=A0

=
@Daniel, apologies for taking so long.=C2=A0

=
Kind regards,=C2=A0
--Cigdem

<= /div>
O= n Thu, Dec 17, 2020 at 10:49 PM <internet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Authentication and Authorization for Const= rained Environments WG of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Message Queuing Telemetry Transport (MQTT)-TLS profile of Authentication a= nd Authorization for Constrained Environments (ACE) Framework
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Cigd= em Sengul
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Anthony Kirby
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-ace-mqtt-tls-profile-09.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 33
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2020-12-17

Abstract:
=C2=A0 =C2=A0This document specifies a profile for the ACE (Authentication = and
=C2=A0 =C2=A0Authorization for Constrained Environments) framework to enabl= e
=C2=A0 =C2=A0authorization in a Message Queuing Telemetry Transport (MQTT)-= based
=C2=A0 =C2=A0publish-subscribe messaging system.=C2=A0 Proof-of-possession = keys, bound
=C2=A0 =C2=A0to OAuth2.0 access tokens, are used to authenticate and author= ize
=C2=A0 =C2=A0MQTT Clients.=C2=A0 The protocol relies on TLS for confidentia= lity and
=C2=A0 =C2=A0MQTT server (broker) authentication.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/dr= aft-ietf-ace-mqtt-tls-profile/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf= -ace-mqtt-tls-profile-09
https://datatracker.ietf.org= /doc/html/draft-ietf-ace-mqtt-tls-profile-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?u= rl2=3Ddraft-ietf-ace-mqtt-tls-profile-09


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
--00000000000087bc5a05b6b0d697-- From nobody Thu Dec 17 18:30:10 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9EFF3A0CFE; Thu, 17 Dec 2020 18:30:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QdXESFnry-Am; Thu, 17 Dec 2020 18:30:07 -0800 (PST) Received: from mail-ua1-x933.google.com (mail-ua1-x933.google.com [IPv6:2607:f8b0:4864:20::933]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFF4E3A0CE5; Thu, 17 Dec 2020 18:30:06 -0800 (PST) Received: by mail-ua1-x933.google.com with SMTP id 17so359274uaq.4; Thu, 17 Dec 2020 18:30:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KtEkDvPsJZSd235elbEYJ6eu47PeAsBrGcz6sXLt0Qo=; b=s0cD5hCrv7CFAvHJoksj8h5U0Wd/Xbg774yPfoIgeBXnJeu9T8mtKWej/OFJlN19sz 0+xeVyXUdyXS8GKeT2QW/DhLTR81TsiWEU04BJONxaaGqb32p1Gjbb5N+hHS07jvpyOl zXMKoXCTNX3SFOM2Y+kMcH1XTg5+OVXi4cVjnjCazSK30W+wQXO7by84iUZowZr2Gf0P ssWSwa8NSPMueG5UNkvHnkDpN1MN+xbFk4dY22w9BVFb4zoiE7+we9iAFP/LmqiHKDxl rhVN4FHFBGcvre5+hnFOoLmZ3fBFpM2l8k3tI5OmXpYI0B2uIKHh+c3yt8GfGphDhYw8 5jlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KtEkDvPsJZSd235elbEYJ6eu47PeAsBrGcz6sXLt0Qo=; b=iF0z2yeVwr0dGAHa3oHtJMdJtCaKI3s/G7HeE3M01EgegH4bsOi5zmvqzyw3fSxly5 cvHiE3DapjEi2/sYEyJpniusmh0fFwTNPRYKMKQ7vN5XFhC4Cw9/ldFmFQc0C475q/1s fVjg7Uo8PGm+jp8R++QdcSRJ4PYqeI/OZC4/KTHqOsicQKWpBlL2w3qOMZ1JcjrpT1PQ IKngUqps6d5iH1M6voYIUem9zO7wW1rLE65geCwwrhN2gGeHDmKk+yBTkUx0uRARHILq k5piEj7YAO/ww7JkqPljnJNnimIO5KQjIweDTea9Cr8rBuULmFHHbLP66NCjT4tqkdw/ 25/Q== X-Gm-Message-State: AOAM5330OXZr59ZClV/CfFBKmg1R538bXXgIUvsxJ4lkAf6Gnq0u3fA+ 5hwta6BYlfRovAdlKLL2pRGiMpXt7loK8C4gS9M= X-Google-Smtp-Source: ABdhPJyJ4fnec3R6+j9K9WIb0xIPl5Y6ROANP8+DdDAwS6V2YrmzN3e2/KT8WBWVRaa4sMarTj4AZydw0qDrQMbYstE= X-Received: by 2002:a9f:324a:: with SMTP id y10mr2040210uad.68.1608258605864; Thu, 17 Dec 2020 18:30:05 -0800 (PST) MIME-Version: 1.0 References: <160824538715.7287.2616747957594971317@ietfa.amsl.com> In-Reply-To: From: Daniel Migault Date: Thu, 17 Dec 2020 21:29:54 -0500 Message-ID: To: Cigdem Sengul Cc: Ace Wg , i-d-announce@ietf.org Content-Type: multipart/alternative; boundary="000000000000e8dbc705b6b3e202" Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-09.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2020 02:30:10 -0000 --000000000000e8dbc705b6b3e202 Content-Type: text/plain; charset="UTF-8" Hi Cigdem, Thanks for uploading the new version. It however appears to me that two references have been updated in December. * RFC8949 has been published and obsoletes RFC 7049. I would suggest to update the reference. * draft-ietf-cose-x509-07 has also a version 08 being published - thought this latest update is more a detail, but since we are here, why not doing it. Feel free to run the Nits [1] to check I am not missing anything. Thanks! Yours, Daniel [1] https://www.ietf.org/tools/idnits Yours, Daniel On Thu, Dec 17, 2020 at 5:52 PM Cigdem Sengul wrote: > Hello Ace, > > This is the latest version, which I believe would address all the ones > Daniel listed > in his e-mail around spacing and references. > > @Daniel, apologies for taking so long. > > > Kind regards, > --Cigdem > > > On Thu, Dec 17, 2020 at 10:49 PM wrote: > >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> This draft is a work item of the Authentication and Authorization for >> Constrained Environments WG of the IETF. >> >> Title : Message Queuing Telemetry Transport (MQTT)-TLS >> profile of Authentication and Authorization for Constrained Environments >> (ACE) Framework >> Authors : Cigdem Sengul >> Anthony Kirby >> Filename : draft-ietf-ace-mqtt-tls-profile-09.txt >> Pages : 33 >> Date : 2020-12-17 >> >> Abstract: >> This document specifies a profile for the ACE (Authentication and >> Authorization for Constrained Environments) framework to enable >> authorization in a Message Queuing Telemetry Transport (MQTT)-based >> publish-subscribe messaging system. Proof-of-possession keys, bound >> to OAuth2.0 access tokens, are used to authenticate and authorize >> MQTT Clients. The protocol relies on TLS for confidentiality and >> MQTT server (broker) authentication. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ >> >> There are also htmlized versions available at: >> https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-09 >> https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-09 >> >> A diff from the previous version is available at: >> https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-09 >> >> >> Please note that it may take a couple of minutes from the time of >> submission >> until the htmlized version and diff are available at tools.ietf.org. >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >> > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > -- Daniel Migault Ericsson --000000000000e8dbc705b6b3e202 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Cigdem,=C2=A0

Thanks for uploa= ding the new version. It however appears to me that two references have bee= n updated in December.=C2=A0
* RFC8949 has been published and obsoletes= RFC 7049. I would=C2=A0suggest to update the reference.=C2=A0
* draft-ietf-cose-x509-07 has also a version 08 being published - th= ought this latest update is more a detail, but since we are here, why not d= oing it.=C2=A0

Feel free to run the Nits= [1] to check I am not missing anything.

Thanks!

Yours,=C2=A0
Daniel
[1]=C2=A0https://www.ietf.org/tools/idni= ts

Yours,=C2=A0
Daniel
On Thu, = Dec 17, 2020 at 5:52 PM Cigdem Sengul <cigdem.sengul@gmail.com> wrote:
Hello Ace,=C2=A0

=
This is the latest version, which I believe would address all th= e ones Daniel listed=C2=A0
in his e-mail around spacing and refer= ences.=C2=A0

@Daniel, apologies for taking so long= .=C2=A0


Kind regards,=C2=A0
--Cigdem


On Thu, Dec 17, 2020 at 10:49 PM <internet-drafts@iet= f.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Authentication and Authorization for Const= rained Environments WG of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Message Queuing Telemetry Transport (MQTT)-TLS profile of Authentication a= nd Authorization for Constrained Environments (ACE) Framework
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Cigd= em Sengul
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Anthony Kirby
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-ace-mqtt-tls-profile-09.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 33
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2020-12-17

Abstract:
=C2=A0 =C2=A0This document specifies a profile for the ACE (Authentication = and
=C2=A0 =C2=A0Authorization for Constrained Environments) framework to enabl= e
=C2=A0 =C2=A0authorization in a Message Queuing Telemetry Transport (MQTT)-= based
=C2=A0 =C2=A0publish-subscribe messaging system.=C2=A0 Proof-of-possession = keys, bound
=C2=A0 =C2=A0to OAuth2.0 access tokens, are used to authenticate and author= ize
=C2=A0 =C2=A0MQTT Clients.=C2=A0 The protocol relies on TLS for confidentia= lity and
=C2=A0 =C2=A0MQTT server (broker) authentication.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/dr= aft-ietf-ace-mqtt-tls-profile/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf= -ace-mqtt-tls-profile-09
https://datatracker.ietf.org= /doc/html/draft-ietf-ace-mqtt-tls-profile-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?u= rl2=3Ddraft-ietf-ace-mqtt-tls-profile-09


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace


--
Daniel Migault
Ericsson
--000000000000e8dbc705b6b3e202-- From nobody Fri Dec 18 07:05:33 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAF463A0811 for ; Fri, 18 Dec 2020 07:05:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.503 X-Spam-Level: X-Spam-Status: No, score=0.503 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FORGED_GMAIL_RCVD=1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ig9e3Y49yDUm for ; Fri, 18 Dec 2020 07:05:29 -0800 (PST) Received: from NAM04-DM6-obe.outbound.protection.outlook.com (mail-dm6nam08on2086.outbound.protection.outlook.com [40.107.102.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D86EB3A045E for ; Fri, 18 Dec 2020 07:05:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gaXK9qoGt6u/euThOPIxgz4vMxEfkpnDA/NogCxIhGjk4wnHBuW9T81S3jOTQDJYgyEhoHNQwrb4te++NR1g/PNrjSv+GUm4N80cAFu+6fz1YDNiSNUQ5xyiWhuleSMGFyRidRPg69YBqC0x1d3KL08/cB7ELNYyA30KE3gNDbuzfrHBJxP3yYzuXhRF/iPMSvwrkvsywiQgyOViyE5yZJSGOUVOo4Q0o15Wv4Xix+SxSpi/0+23kF2r1aCpy7Ua2LFbYvryWADjdOaDhQqC/lrdOQmofADlAFVci3H9NP3caQ7eaBPkcP0qnmeOttNn9ypUzlr2usVH1E1R1DvwNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Z5gCdtq4lPQE+JKXJeNGJeqlg3BBOx5QtHSiP5UAl1Y=; b=HdAwq6c93RnGVEMQf2AJVWv46c8ly4DFBMqYZtDjedUFzGX7M5HsZrmE7c/9VO0OwJD8tw/o73mKuW/LQeayuMpav89hJYUWcVildk1A1lCZBeOXXwYIxuKvRzJZRaWdYFkKt0OBsFmQyxmd7nHMkc3OB6nCtVkSbZz3zkATONuaFrqN2tXl1+TnVBcFV1u9Uj/QGaJ86KZ6RTeWmxoIKKmU9183ekMGMTE6E9y2wX/b8bofPEoLe8PpLyXNNoXVQz1XttSZShDjXuKtQixLh9DlcsmewajEZsFz8VRRKOTilySOVTo/msxpIg5FxS1lMPKzZPSGkxTHGcFQrJ15HA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=gmail.com; dkim=pass header.d=gmail.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.onmicrosoft.com; s=selector1-ericsson-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Z5gCdtq4lPQE+JKXJeNGJeqlg3BBOx5QtHSiP5UAl1Y=; b=hbSp2eygn94QOsY9WzPfIUiUdDV3CkfeLZXk0QRbVInL/s3pNEe1Say6eMZifM4MApB93JkGGU2yCzE6ftLBvqjRYWu9C4B3gUMn5GqIkIj8rOa8o0fcF86hDTgFwyF3h1JxdhgRtQVlxtrg1q0CN2ZbJhbHKlgwHgNm139TMI8= Received: from DM6PR15MB2379.namprd15.prod.outlook.com (2603:10b6:5:8a::16) by DM6PR15MB2219.namprd15.prod.outlook.com (2603:10b6:5:86::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3654.13; Fri, 18 Dec 2020 15:05:22 +0000 Received: from DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::31fd:dc5c:cee5:6331]) by DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::31fd:dc5c:cee5:6331%6]) with mapi id 15.20.3676.025; Fri, 18 Dec 2020 15:05:21 +0000 From: "mglt.biz@gmail.com" To: "ace@ietf.org" Thread-Topic: Planning ACE interim meetings for 2021 Thread-Index: AdbVTzMOOPj0zkQsTUiN7fTfcC1rFQ== Sender: Daniel Migault Date: Fri, 18 Dec 2020 15:05:21 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-publictraffictype: Email authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=gmail.com; x-ms-exchange-messagesentrepresentingtype: 2 x-ms-exchange-meetingforward-message: Forward x-ms-exchange-calendar-series-instance-id: BAAAAIIA4AB0xbcQGoLgCAAAAAAAAAAAAAAAAAAAAAAAAAAAMgAAAHZDYWwtVWlkAQAAADdrYjN1MnFoM2tkNG5namZnNTd0N3Q1ZHZhQGdvb2dsZS5jb20A x-originating-ip: [96.22.11.129] x-ms-office365-filtering-correlation-id: cee21530-600e-4e46-dbfa-08d8a366574c x-ms-traffictypediagnostic: DM6PR15MB2219:MeetingMessage x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 2 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 54Rq2q1AoJLJFiNHX7muBxjVXLotnGopbbpr+y+jBZqMog/b+H2vxgIFq7GLDNhWCPW9FkEqheIKJNqMHikXp/f+m1hsbhGuNy96A+XK7V4aXJWJQniajX0UFa0t/KTyZcEPshbZxWvoPh89axIPbuWNbV9o4cB3TNRTlHzlZYeaekRrBjKBswSx5qXUFDu2mDJvF+8g7DaAHDn0VhJEZDDy9rAkJ1M+HE2hDCnwhHzw6v9aXpx2meyey9HNkfdLF/WYRIuC0w/CsYv9PZwjOVjYS3hxF3dRm5GkgyWfSzz/dpN0RFTO1dY+nEzMi0Uk/nHbcRNkW0CiDKbWX1M3vg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR15MB2379.namprd15.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(136003)(346002)(366004)(396003)(376002)(2906002)(7846003)(82202003)(76116006)(6916009)(316002)(76482006)(4744005)(186003)(26005)(7696005)(66476007)(66946007)(52536014)(64756008)(99936003)(66616009)(8676002)(66446008)(66556008)(55016002)(71200400001)(9326002)(42882007)(83380400001)(478600001)(6506007)(5660300002)(9686003)(73392003)(8936002)(83170400001)(33656002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?b2QrSURSTStBc2I3VnROMkI5MXRmNUtmS3RTM012d3NsZzFrTXp6WE9aNUZM?= =?utf-8?B?TlI2TnlYVGRxZE8zYlZvMWI0N0JPQTR0MU9GNjRGTnRlbDZocERFSS9BN1BK?= =?utf-8?B?cndUbXZRR1U3cW14YXBlTnFnS1psTnlZV21TbTIvZEJSYUFLVkUwSTVtSisy?= =?utf-8?B?N1FHS00wcVpISHZXb1RQbGpKNDF3SlgraFJyWmJidGRUL2t5QW1scFc0NEVL?= =?utf-8?B?bEY4QzNxZlpHSjBaeGdaQmlTL3pHVWhXYm1iaFBBUzRGSHowaU5Hc0F2L2pU?= =?utf-8?B?M1B6TXBMSXE3d1NjS2VqWllzMUkyNGp2WWxRcmszbDhYK0JyVWc2eWx4cllY?= =?utf-8?B?d0g5SWwwa1VOcS9XTUJLZkxLaXF0OGZoNnRzeDRHVnZnNE5TV3docTB3Unh1?= =?utf-8?B?Uko2SWplRnNVSUV2RmNvUzk1aFdMY2NhOE02cEcyUGFlUzU5ZXkwYmVybXZQ?= =?utf-8?B?SkJxUjRmb1V3d1Y3M2RMeVJmR0lDMEJMc0JkWlpxbWU2aHgrMFdtanpLZ3g2?= =?utf-8?B?WFJuQzNnVVhZbDVhcGVRWnNoY1BwTmZ0NlFwZEt6dmdyazh4NzhFREtkbGh6?= =?utf-8?B?WWE5L2xiK09vRk15cU9CVXNrSXZxU0RtZ1B0MXlhOUhyS3hSMzBUZ3RtNGdO?= =?utf-8?B?L29pQjZPTzdpTWZsbC90cEc1ZWZUNWt2dzRiL3hoNTNTWlgvTXZFa1BvWGZt?= =?utf-8?B?MjdvVTdJU01TMVF6Mi80ZmcrLy9XTzRROW5DdTlzMHNWd3R1UGRCTEdGaEli?= =?utf-8?B?cGRGNElBbU9YTU42SnQ3RXM3cHRobHFqME5xL3lDelNxSkJva0U0VWtmVThk?= =?utf-8?B?TkxkcWJVa1l0bXMrOVIzNkpLNEdrL25QYWJWTjFtSlNjaWNkRTd1L1NmQ2pJ?= =?utf-8?B?VFNjRzRXRmdEMFJvWlVmcDRUVUlLcmlBM1YrYVhUYUVXREgvM1JJTXcvYTdt?= =?utf-8?B?Z0VGbzB2dGpJSTlObGhhdG1BdWtZRGU0M1V1bktVdUVMSkg0TVJYajNTc2hJ?= =?utf-8?B?Vm0xSjFabHR1ck9NdmIrMnZvUzhWMjhxc0NESm1ZY2tFaUdlbjEvcEFPK3Ri?= =?utf-8?B?THNJNFA4aFpESE03SlQrNkh6Mzcwc0RXVTd5bGl1amtMekswOWZidk5pU3U5?= =?utf-8?B?UDFiMkVrdlI3UHJIV3BPQ0hSWFJyNmRkMDZMRDJKOVI4dUZDcTVGRkE1Z3V0?= =?utf-8?B?OWFFemVGSHVJZ3g5Z3ZFYXpTenpBYWhCRzJoZ1JrTmRNeVNMK3l4d24wd3Ax?= =?utf-8?B?VEh0UVhyMmozbHV5TUxCU2FlUzNvT1N5bllCemxCYzRKUkhQdmtxRDcvV2hL?= =?utf-8?Q?+GL89spO590WA=3D?= x-ms-exchange-transport-forked: True Content-Type: multipart/mixed; boundary="_005_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR15MB2379.namprd15.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: cee21530-600e-4e46-dbfa-08d8a366574c X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Dec 2020 15:05:21.8312 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tx+2TfEP2Aghbppx5uQoSghNwvbI9jVvYWzHiWBxUzodzL1Ojdxrz8CLOn+1msr7XtNi6Nrf772w7rNGhzVZA1b0JTPCM0Yyf/3nuS8uC5Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR15MB2219 Archived-At: Subject: [Ace] Planning ACE interim meetings for 2021 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2020 15:05:32 -0000 --_005_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_ Content-Type: multipart/alternative; boundary="_000_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_" --_000_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkkgYW0gd29uZGVyaW5nIGlmIHRoZSBmb2xsb3dpbmcgdGltZSBzbG90cyBhcmUgY29u dmVuaWVudCB0byB0aGUgV0cgZm9yIEFDRSBpbnRlcmltIG1lZXRpbmdzLiBVbmxlc3MgaXQgcmVh bGx5IGRvZXMgbm90IHdvcmsgSSBpbnRlbmQgdG8gcmVxdWVzdCBhIHdlYmV4IHJlcXVlc3QgbmV4 dCB3ZWVrIG9uIFR1ZXNkYXkgMjIuDQoNClRoZSBpbnRlcmltIG1lZXRpbmcgdGFrZSBwbGFjZSBh dCB0aGUgc2FtZSB0aW1lIHNsb3QgYXMgY29yZSBtZWV0aW5ncyAoYnV0IGRpZmZlcmVudCB3ZWVr cykgYW5kIG9jY3VycyBvbiBhIG1vbnRobHkgYmFzZSBmcm9tIDEwYW0gdG8gMTFhbSBvbiB0aGUg c2Vjb25kIFRodXJzZGF5IChFU1QpIHN0YXJ0aW5nIEphbnVhcnkgMTQuDQoNClBsZWFzZSBzZWUg dGhlIGF0dGFjaGVkIGljcyB0byBzZWUgYWxsIGRhdGVzLiBCdXQgdGhlIGV4cGVjdGVkIGRhdGVz IGFyZToNCg0KICAqICAgSmFudWFyeSAxNA0KICAqICAgRmVicnVhcnkgMTENCiAgKiAgIEFwcmls IDgNCiAgKiAgIE1heSAxMw0KICAqICAgSnVuZSAxMA0KICAqICAgSnVseSDigJMgaWYgbmVlZCBh cyBJRVRGMTExIGlzIG9uIEp1bHkgMjQuDQoNCllvdXJzLA0KRGFuaWVsDQoNCg0KDQo= --_000_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxl ZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHls ZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBp bjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVm aW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjIyMjgzNjUwNjsNCgltc28tbGlz dC10ZW1wbGF0ZS1pZHM6MTI5OTE5ODc4Mjt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxDQoJe21zby1saXN0 LWlkOjc1OTMyODY1MzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6NzE3MjU5MjA4IDU5NTIyMzE2MCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5 ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMTpsZXZl bDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpD YWxpYnJpO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2 ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21h cmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSwgPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgYW0gd29uZGVyaW5nIGlmIHRoZSBmb2xsb3dpbmcgdGltZSBzbG90cyBh cmUgY29udmVuaWVudCB0byB0aGUgV0cgZm9yIEFDRSBpbnRlcmltIG1lZXRpbmdzLiBVbmxlc3Mg aXQgcmVhbGx5IGRvZXMgbm90IHdvcmsgSSBpbnRlbmQgdG8gcmVxdWVzdCBhIHdlYmV4IHJlcXVl c3QgbmV4dCB3ZWVrIG9uIFR1ZXNkYXkgMjIuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBp bnRlcmltIG1lZXRpbmcgdGFrZSBwbGFjZSBhdCB0aGUgc2FtZSB0aW1lIHNsb3QgYXMgY29yZSBt ZWV0aW5ncyAoYnV0IGRpZmZlcmVudCB3ZWVrcykgYW5kIG9jY3VycyBvbiBhIG1vbnRobHkgYmFz ZSBmcm9tIDEwYW0gdG8gMTFhbSBvbiB0aGUgc2Vjb25kIFRodXJzZGF5IChFU1QpIHN0YXJ0aW5n IEphbnVhcnkgMTQuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGxlYXNlIHNlZSB0aGUgYXR0 YWNoZWQgaWNzIHRvIHNlZSBhbGwgZGF0ZXMuIEJ1dCB0aGUgZXhwZWN0ZWQgZGF0ZXMgYXJlOjxv OnA+PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgdHlwZT0iZGlzYyI+DQo8 bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxp c3Q6bDEgbGV2ZWwxIGxmbzMiPkphbnVhcnkgMTQ8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwxIGxldmVs MSBsZm8zIj5GZWJydWFyeSAxMTxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPkFw cmlsIDg8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwxIGxldmVsMSBsZm8zIj5NYXkgMTM8bzpwPjwvbzpw PjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGlu O21zby1saXN0OmwxIGxldmVsMSBsZm8zIj5KdW5lIDEwPG86cD48L286cD48L2xpPjxsaSBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMSBs ZXZlbDEgbGZvMyI+SnVseSDigJMgaWYgbmVlZCBhcyBJRVRGMTExIGlzIG9uIEp1bHkgMjQuPG86 cD48L286cD48L2xpPjwvdWw+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjI1aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WW91 cnMsIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGFuaWVsPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIxIiBj ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiIHN1bW1hcnk9IiIgd2lkdGg9IjEwMCUiIHN0 eWxlPSJ3aWR0aDoxMDAuMCU7YmFja2dyb3VuZDp3aGl0ZTtib3JkZXItdG9wOjEuMHB0O2JvcmRl ci1sZWZ0OjEuMHB0O2JvcmRlci1ib3R0b206MS41cHQ7Ym9yZGVyLXJpZ2h0OjEuNXB0O2JvcmRl ci1jb2xvcjojQ0NDQ0NDO2JvcmRlci1zdHlsZTpzb2xpZCI+DQo8dGJvZHk+DQo8dHI+DQo8dGQg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0NDQ0NDQyAxLjBwdDtiYWNrZ3Jv dW5kOiNGNkY2RjY7cGFkZGluZzo0LjBwdCA0LjBwdCA0LjBwdCA0LjBwdCI+DQo8cD48c3BhbiBz dHlsZT0iZm9udC1zaXplOjguNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6Izg4ODg4OCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC90ZD4N CjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_ Content-Type: text/calendar; charset="utf-8"; method=REQUEST Content-Transfer-Encoding: base64 QkVHSU46VkNBTEVOREFSDQpNRVRIT0Q6UkVRVUVTVA0KUFJPRElEOk1pY3Jvc29mdCBFeGNoYW5n ZSBTZXJ2ZXIgMjAxMA0KVkVSU0lPTjoyLjANCkJFR0lOOlZUSU1FWk9ORQ0KVFpJRDpBbWVyaWNh L1Rvcm9udG8NCkJFR0lOOlNUQU5EQVJEDQpEVFNUQVJUOjE2MDEwMTAxVDAyMDAwMA0KVFpPRkZT RVRGUk9NOi0wNDAwDQpUWk9GRlNFVFRPOi0wNTAwDQpSUlVMRTpGUkVRPVlFQVJMWTtJTlRFUlZB TD0xO0JZREFZPTFTVTtCWU1PTlRIPTExDQpFTkQ6U1RBTkRBUkQNCkJFR0lOOkRBWUxJR0hUDQpE VFNUQVJUOjE2MDEwMTAxVDAyMDAwMA0KVFpPRkZTRVRGUk9NOi0wNTAwDQpUWk9GRlNFVFRPOi0w NDAwDQpSUlVMRTpGUkVRPVlFQVJMWTtJTlRFUlZBTD0xO0JZREFZPTJTVTtCWU1PTlRIPTMNCkVO RDpEQVlMSUdIVA0KRU5EOlZUSU1FWk9ORQ0KQkVHSU46VkVWRU5UDQpPUkdBTklaRVI7Q049bWds dC5iaXpAZ21haWwuY29tO1NFTlQtQlk9Im1haWx0bzpkYW5pZWwubWlnYXVsdEBlcmljc3Nvbi5j b20iOg0KIG1haWx0bzptZ2x0LmJpekBnbWFpbC5jb20NCkFUVEVOREVFO1JPTEU9UkVRLVBBUlRJ Q0lQQU5UO1BBUlRTVEFUPU5FRURTLUFDVElPTjtSU1ZQPVRSVUU7Q049YWNlQGlldGYubw0KIHJn Om1haWx0bzphY2VAaWV0Zi5vcmcNCkFUVEFDSDpDSUQ6REY0N0VGNUY4M0VGM0E0REE2QTQzRDZD OEZBNTc2NzVAbmFtcHJkMTUucHJvZC5vdXRsb29rLmNvbQ0KREVTQ1JJUFRJT047TEFOR1VBR0U9 ZW4tVVM6SGlcLFxuXG5JIGFtIHdvbmRlcmluZyBpZiB0aGUgZm9sbG93aW5nIHRpbWUgc2xvDQog dHMgYXJlIGNvbnZlbmllbnQgdG8gdGhlIFdHIGZvciBBQ0UgaW50ZXJpbSBtZWV0aW5ncy4gVW5s ZXNzIGl0IHJlYWxseSBkb2UNCiBzIG5vdCB3b3JrIEkgaW50ZW5kIHRvIHJlcXVlc3QgYSB3ZWJl eCByZXF1ZXN0IG5leHQgd2VlayBvbiBUdWVzZGF5IDIyLlxuXA0KIG5UaGUgaW50ZXJpbSBtZWV0 aW5nIHRha2UgcGxhY2UgYXQgdGhlIHNhbWUgdGltZSBzbG90IGFzIGNvcmUgbWVldGluZ3MgKGJ1 DQogdCBkaWZmZXJlbnQgd2Vla3MpIGFuZCBvY2N1cnMgb24gYSBtb250aGx5IGJhc2UgZnJvbSAx MGFtIHRvIDExYW0gb24gdGhlIHMNCiBlY29uZCBUaHVyc2RheSAoRVNUKSBzdGFydGluZyBKYW51 YXJ5IDE0LlxuXG5QbGVhc2Ugc2VlIHRoZSBhdHRhY2hlZCBpY3MgdA0KIG8gc2VlIGFsbCBkYXRl cy4gQnV0IHRoZSBleHBlY3RlZCBkYXRlcyBhcmU6XG5cbiAgKiAgIEphbnVhcnkgMTRcbiAgKiAg IEZlDQogYnJ1YXJ5IDExXG4gICogICBBcHJpbCA4XG4gICogICBNYXkgMTNcbiAgKiAgIEp1bmUg MTBcbiAgKiAgIEp1bHkg4oCTIGlmIG4NCiBlZWQgYXMgSUVURjExMSBpcyBvbiBKdWx5IDI0Llxu XG5Zb3Vyc1wsXG5EYW5pZWxcblxuXG5cbg0KUlJVTEU6RlJFUT1NT05USExZO0lOVEVSVkFMPTE7 QllEQVk9MlRIDQpVSUQ6N2tiM3UycWgza2Q0bmdqZmc1N3Q3dDVkdmFAZ29vZ2xlLmNvbQ0KU1VN TUFSWTtMQU5HVUFHRT1lbi1VUzpQbGFubmluZyBBQ0UgaW50ZXJpbSBtZWV0aW5ncyBmb3IgMjAy MQ0KRFRTVEFSVDtUWklEPUFtZXJpY2EvVG9yb250bzoyMDIxMDExNFQxMDAwMDANCkRURU5EO1Ra SUQ9QW1lcmljYS9Ub3JvbnRvOjIwMjEwMTE0VDExMDAwMA0KQ0xBU1M6UFVCTElDDQpQUklPUklU WTo1DQpEVFNUQU1QOjIwMjAxMjE4VDE0NDkzMloNClRSQU5TUDpPUEFRVUUNClNUQVRVUzpDT05G SVJNRUQNClNFUVVFTkNFOjANCkxPQ0FUSU9OO0xBTkdVQUdFPWVuLVVTOg0KWC1NSUNST1NPRlQt Q0RPLUFQUFQtU0VRVUVOQ0U6MA0KWC1NSUNST1NPRlQtQ0RPLU9XTkVSQVBQVElEOi03MDIzNzc1 NzYNClgtTUlDUk9TT0ZULUNETy1CVVNZU1RBVFVTOlRFTlRBVElWRQ0KWC1NSUNST1NPRlQtQ0RP LUlOVEVOREVEU1RBVFVTOkJVU1kNClgtTUlDUk9TT0ZULUNETy1BTExEQVlFVkVOVDpGQUxTRQ0K WC1NSUNST1NPRlQtQ0RPLUlNUE9SVEFOQ0U6MQ0KWC1NSUNST1NPRlQtQ0RPLUlOU1RUWVBFOjEN ClgtTUlDUk9TT0ZULURPTk9URk9SV0FSRE1FRVRJTkc6RkFMU0UNClgtTUlDUk9TT0ZULURJU0FM TE9XLUNPVU5URVI6RkFMU0UNClgtTUlDUk9TT0ZULUxPQ0FUSU9OUzpbXQ0KQkVHSU46VkFMQVJN DQpERVNDUklQVElPTjpSRU1JTkRFUg0KVFJJR0dFUjtSRUxBVEVEPVNUQVJUOi1QVDE1TQ0KQUNU SU9OOkRJU1BMQVkNCkVORDpWQUxBUk0NCkVORDpWRVZFTlQNCkVORDpWQ0FMRU5EQVINCg== --_000_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_-- --_005_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_ Content-Type: application/ics; name="invite.ics" Content-Description: invite.ics Content-Disposition: attachment; filename="invite.ics"; size=1891; creation-date="Fri, 18 Dec 2020 14:49:47 GMT"; modification-date="Fri, 18 Dec 2020 14:49:47 GMT" Content-ID: Content-Transfer-Encoding: base64 QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vR29vZ2xlIEluYy8vR29vZ2xlIENhbGVuZGFyIDcw LjkwNTQvL0VODQpWRVJTSU9OOjIuMA0KQ0FMU0NBTEU6R1JFR09SSUFODQpNRVRIT0Q6UkVRVUVT VA0KQkVHSU46VlRJTUVaT05FDQpUWklEOkFtZXJpY2EvVG9yb250bw0KWC1MSUMtTE9DQVRJT046 QW1lcmljYS9Ub3JvbnRvDQpCRUdJTjpEQVlMSUdIVA0KVFpPRkZTRVRGUk9NOi0wNTAwDQpUWk9G RlNFVFRPOi0wNDAwDQpUWk5BTUU6RURUDQpEVFNUQVJUOjE5NzAwMzA4VDAyMDAwMA0KUlJVTEU6 RlJFUT1ZRUFSTFk7QllNT05USD0zO0JZREFZPTJTVQ0KRU5EOkRBWUxJR0hUDQpCRUdJTjpTVEFO REFSRA0KVFpPRkZTRVRGUk9NOi0wNDAwDQpUWk9GRlNFVFRPOi0wNTAwDQpUWk5BTUU6RVNUDQpE VFNUQVJUOjE5NzAxMTAxVDAyMDAwMA0KUlJVTEU6RlJFUT1ZRUFSTFk7QllNT05USD0xMTtCWURB WT0xU1UNCkVORDpTVEFOREFSRA0KRU5EOlZUSU1FWk9ORQ0KQkVHSU46VkVWRU5UDQpEVFNUQVJU O1RaSUQ9QW1lcmljYS9Ub3JvbnRvOjIwMjEwMTE0VDEwMDAwMA0KRFRFTkQ7VFpJRD1BbWVyaWNh L1Rvcm9udG86MjAyMTAxMTRUMTEwMDAwDQpSUlVMRTpGUkVRPU1PTlRITFk7QllEQVk9MlRIDQpE VFNUQU1QOjIwMjAxMjE4VDE0NDkzMloNCk9SR0FOSVpFUjtDTj1tZ2x0LmJpekBnbWFpbC5jb206 bWFpbHRvOm1nbHQuYml6QGdtYWlsLmNvbQ0KVUlEOjdrYjN1MnFoM2tkNG5namZnNTd0N3Q1ZHZh QGdvb2dsZS5jb20NCkFUVEVOREVFO0NVVFlQRT1JTkRJVklEVUFMO1JPTEU9UkVRLVBBUlRJQ0lQ QU5UO1BBUlRTVEFUPU5FRURTLUFDVElPTjtSU1ZQPQ0KIFRSVUU7Q049ZGFuaWVsLm1pZ2F1bHRA ZXJpY3Nzb24uY29tO1gtTlVNLUdVRVNUUz0wOm1haWx0bzpkYW5pZWwubWlnYXVsdEBlcg0KIGlj c3Nvbi5jb20NCkFUVEVOREVFO0NVVFlQRT1JTkRJVklEVUFMO1JPTEU9UkVRLVBBUlRJQ0lQQU5U O1BBUlRTVEFUPUFDQ0VQVEVEO1JTVlA9VFJVRQ0KIDtDTj1tZ2x0LmJpekBnbWFpbC5jb207WC1O VU0tR1VFU1RTPTA6bWFpbHRvOm1nbHQuYml6QGdtYWlsLmNvbQ0KWC1NSUNST1NPRlQtQ0RPLU9X TkVSQVBQVElEOi03MDIzNzc1NzYNCkNSRUFURUQ6MjAyMDEyMThUMTQzMDMzWg0KREVTQ1JJUFRJ T046LTo6fjp+Ojp+On46fjp+On46fjp+On46fjp+On46fjp+On46fjp+On46fjp+On46fjp+On46 fjp+On46fjp+DQogOn46fjp+On46fjp+On46fjo6fjp+OjotXG5QbGVhc2UgZG8gbm90IGVkaXQg dGhpcyBzZWN0aW9uIG9mIHRoZSBkZXNjcmlwdGlvDQogbi5cblxuVGhpcyBldmVudCBoYXMgYSB2 aWRlbyBjYWxsLlxuSm9pbjogaHR0cHM6Ly9tZWV0Lmdvb2dsZS5jb20vcXp3LWptaW8tDQogdWFp XG5cblZpZXcgeW91ciBldmVudCBhdCBodHRwczovL2NhbGVuZGFyLmdvb2dsZS5jb20vY2FsZW5k YXIvZXZlbnQ/YWN0aW9uDQogPVZJRVcmZWlkPU4ydGlNM1V5Y1dnemEyUTBibWRxWm1jMU4zUTNk RFZrZG1FZ1pHRnVhV1ZzTG0xcFoyRjFiSFJBWlhKcFkzTnpiDQogMjR1WTI5dCZ0b2s9TVRnamJX ZHNkQzVpYVhwQVoyMWhhV3d1WTI5dE1tVXhNV1ZsTWpJeFpEYzFZV1U0T0RGbVkyUXpZamxrTmpS DQoga1lXVmlNMlJrTURrNE1EZzVNUSZjdHo9QW1lcmljYSUyRlRvcm9udG8maGw9ZW4mZXM9MS5c bi06On46fjo6fjp+On46fjp+On46DQogfjp+On46fjp+On46fjp+On46fjp+On46fjp+On46fjp+ On46fjp+On46fjp+On46fjp+On46fjp+On46On46fjo6LQ0KTEFTVC1NT0RJRklFRDoyMDIwMTIx OFQxNDQ5MzFaDQpMT0NBVElPTjoNClNFUVVFTkNFOjANClNUQVRVUzpDT05GSVJNRUQNClNVTU1B Ulk6QUNFIGludGVyaW0gbWVldGluZ3MNClRSQU5TUDpPUEFRVUUNCkVORDpWRVZFTlQNCkVORDpW Q0FMRU5EQVINCg== --_005_DM6PR15MB237928ADDB0915E1509D4327E3C30DM6PR15MB2379namp_-- From nobody Fri Dec 18 07:14:38 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 91C013A0844; Fri, 18 Dec 2020 07:14:33 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <160830447354.26925.5730240685072371288@ietfa.amsl.com> Date: Fri, 18 Dec 2020 07:14:33 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-10.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2020 15:14:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Message Queuing Telemetry Transport (MQTT)-TLS profile of Authentication and Authorization for Constrained Environments (ACE) Framework Authors : Cigdem Sengul Anthony Kirby Filename : draft-ietf-ace-mqtt-tls-profile-10.txt Pages : 33 Date : 2020-12-18 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in a Message Queuing Telemetry Transport (MQTT)-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and MQTT server (broker) authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-10 https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Dec 18 07:45:51 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E4D153A090D; Fri, 18 Dec 2020 07:45:48 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Daniel Migault via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Cc: Daniel Migault , ace-chairs@ietf.org, ace@ietf.org, daniel.migault@ericsson.com, iesg-secretary@ietf.org Message-ID: <160830634891.31723.5730968636743148072@ietfa.amsl.com> Date: Fri, 18 Dec 2020 07:45:48 -0800 Archived-At: Subject: [Ace] Publication has been requested for draft-ietf-ace-mqtt-tls-profile-10 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2020 15:45:49 -0000 Daniel Migault has requested publication of draft-ietf-ace-mqtt-tls-profile-10 as Proposed Standard on behalf of the ACE working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ From nobody Tue Dec 22 12:21:51 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B75743A126D; Tue, 22 Dec 2020 12:21:48 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: ace-chairs@ietf.org, ace@ietf.org, kaduk@mit.edu, mglt.ietf@gmail.com X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160866850873.4805.107729846438970617@ietfa.amsl.com> Date: Tue, 22 Dec 2020 12:21:48 -0800 Archived-At: Subject: [Ace] ace - New Meeting Session Request for IETF 110 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 20:21:49 -0000 A new meeting session request has just been submitted by Daniel Migault, a Chair of the ace working group. --------------------------------------------------------- Working Group Name: Authentication and Authorization for Constrained Environments Area Name: Security Area Session Requester: Daniel Migault Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 40 Conflicts to Avoid: Chair Conflict: calext core dots sfc tls add saag dnsop homenet ipsecme dprive cfrg suit rats People who must be present: Daniel Migault Benjamin Kaduk Resources Requested: Special Requests: --------------------------------------------------------- From nobody Tue Dec 22 12:28:25 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 157DA3A128C; Tue, 22 Dec 2020 12:28:23 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: ace-chairs@ietf.org, ace@ietf.org, kaduk@mit.edu, mglt.ietf@gmail.com X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160866890307.5504.13403511759499405529@ietfa.amsl.com> Date: Tue, 22 Dec 2020 12:28:23 -0800 Archived-At: Subject: [Ace] ace - Update to a Meeting Session Request for IETF 110 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 20:28:23 -0000 An update to a meeting session request has just been submitted by Daniel Migault, a Chair of the ace working group. --------------------------------------------------------- Working Group Name: Authentication and Authorization for Constrained Environments Area Name: Security Area Session Requester: Daniel Migault Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 40 Conflicts to Avoid: Chair Conflict: calext core dots sfc tls add saag dnsop homenet ipsecme dprive cfrg suit rats drip People who must be present: Daniel Migault Benjamin Kaduk Resources Requested: Special Requests: --------------------------------------------------------- From nobody Tue Dec 22 14:59:12 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E334A3A1272; Tue, 22 Dec 2020 14:59:09 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867794981.11923.10417596474841205601@ietfa.amsl.com> Date: Tue, 22 Dec 2020 14:59:09 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-01-14 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 22:59:10 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-01-14 from 10:00 to 11:00 America/New_York (15:00 to 16:00 UTC). Agenda: ACE interim meeting Hosted by Daniel Migault https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 Thursday, Jan 14, 2021 4:00 pm | 1 hour | (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Occurs the second Thursday of every month effective 1/14/2021 until 7/8/2021 from 10:00 AM to 11:00 AM, (UTC-05:00) Eastern Time (US & Canada) Meeting number: 178 918 7327 Password: RbPSgiDG676 630b07621fef4d6aaf415a240c688145_20210114T150000Z Join by video system Dial 1789187327@ietf.webex.com You can also dial 173.243.2.68 and enter your meeting number. Join by phone 1-650-479-3208 Call-in toll number (US/Canada) Access code: 178 918 7327 Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 From nobody Tue Dec 22 14:59:40 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D716A3A1310; Tue, 22 Dec 2020 14:59:28 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867796884.32205.8346812944727019729@ietfa.amsl.com> Date: Tue, 22 Dec 2020 14:59:28 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-02-11 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 22:59:35 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-02-11 from 10:00 to 11:00 America/New_York (15:00 to 16:00 UTC). Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 From nobody Tue Dec 22 14:59:46 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1764B3A1324; Tue, 22 Dec 2020 14:59:38 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867797806.8030.16534976479297380258@ietfa.amsl.com> Date: Tue, 22 Dec 2020 14:59:38 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-04-08 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 22:59:45 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-04-08 from 10:00 to 11:00 America/New_York (14:00 to 15:00 UTC). Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 From nobody Tue Dec 22 14:59:54 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DE4BC3A1347; Tue, 22 Dec 2020 14:59:45 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867798588.2654.4162476882834520620@ietfa.amsl.com> Date: Tue, 22 Dec 2020 14:59:45 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-05-13 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 22:59:53 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-05-13 from 10:00 to 11:00 America/New_York (14:00 to 15:00 UTC). Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 From nobody Tue Dec 22 15:00:00 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 890A13A1323; Tue, 22 Dec 2020 14:59:52 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867799251.15147.14159532292612408899@ietfa.amsl.com> Date: Tue, 22 Dec 2020 14:59:52 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-06-10 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 22:59:59 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-06-10 from 10:00 to 11:00 America/New_York (14:00 to 15:00 UTC). Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31 From nobody Tue Dec 22 15:01:00 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 25BF33A14BB; Tue, 22 Dec 2020 15:00:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160867804913.32205.15138669865831528307@ietfa.amsl.com> Date: Tue, 22 Dec 2020 15:00:49 -0800 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2021-07-08 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2020 23:00:56 -0000 The Authentication and Authorization for Constrained Environments (ace) WG will hold a virtual interim meeting on 2021-07-08 from 10:00 to 11:00 America/New_York (14:00 to 15:00 UTC). Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mc48894d33bb1c5d7d226c77348caba31