From nobody Thu Apr 2 02:02:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE0373A0E01; Thu, 2 Apr 2020 02:02:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GQUrhMxEk3co; Thu, 2 Apr 2020 02:02:19 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 566C43A0DF5; Thu, 2 Apr 2020 02:02:19 -0700 (PDT) Received: from opfedar00.francetelecom.fr (unknown [xx.xx.xx.11]) by opfedar26.francetelecom.fr (ESMTP service) with ESMTP id 48tHBd4nNPzFq36; Thu, 2 Apr 2020 11:02:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1585818137; bh=zTasoeO7j0Kw+w9963lERgRnvsdQkOc0NQnkraJzj+I=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=LnR/mhkgeFHHQY1LFmfhJGkpWrcvLBE1YWiqk+NGW3nk/++Bfn7Kp45BudqbbLxU8 SLj/lwXL+YynrM3Q76hDBNL8732mHvTTUr3Sjyrt7foBagT/PMshd/J22xqqjKVC32 x/ARiYBjuQkZTqMdVlzM69qEo/zBEqIypUIshFfaGZvJPYM23DBuBw+jTw6Zo/ijGk sLbnnqlQHiwPXEBGOzA0krfN6oJF049imp+L/vDRGsblL7N4PsNQ6/V3jSadpLTQZ/ sbJbHRoxcJUqx2w9q7wC4cxVnjjNAQZYwvzScMvWMZ+kp9NH7s/Qau0hbCLCQjjpWj pkkyME+7LyAfw== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.76]) by opfedar00.francetelecom.fr (ESMTP service) with ESMTP id 48tHBd3cFlzCqkM; Thu, 2 Apr 2020 11:02:17 +0200 (CEST) From: To: "ADD Mailing list (add@ietf.org)" , "Iain Sharp (isharp@atis.org)" , Wes Hardaker CC: "draft-btw-add-home@ietf.org" Thread-Topic: New Version Notification for draft-btw-add-home-05.txt Thread-Index: AQHWCMtC0hTyTwB9DkOdAyuTlkgOWKhlhTnw Date: Thu, 2 Apr 2020 09:02:12 +0000 Message-ID: References: <158581721086.26641.8470737635145142884@ietfa.amsl.com> In-Reply-To: <158581721086.26641.8470737635145142884@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Add] TR: New Version Notification for draft-btw-add-home-05.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2020 09:02:21 -0000 SGkgYWxsLCANCg0KV2UgcHJlcGFyZWQgYW4gdXBkYXRlZCB2ZXJzaW9uIG9mIHRoZSBkcmFmdCB3 aXRoIHRoZSBmb2xsb3dpbmcgbWFpbiBjaGFuZ2VzOiANCg0KKiBVcGRhdGUgdGhlIGRpc2NvdmVy eSBtZXNzYWdlIHRvIGluZGljYXRlIHRoZSBlbmNyeXB0ZWQgRE5TIHNlcnZlciB0eXBlIChkb3Qs IGRvaCwgZXRjLikNCiogWm9vbSBvbiB0aGUgbWVjaGFuaXNtcyB0byBob3N0IGEgZm9yd2FyZGVy IGluIHRoZSBDUEU6IHJlZmluZSB0aGUgSFRUUCByZWRpcmVjdCB0ZXh0LCBhZGQgYSBuZXcgbWVj aGFuaXNtIGRyaXZlbiBieSBhIGRlZGljYXRlZCBiaXQgaW4gdGhlIGRpc2NvdmVyeSwgZGlzY3Vz cyBhdXRvLXVwZ3JhZGUgYmFzZWQgb24gZG9tYWlucyBhbmQgdGhlaXIgc3ViLWRvbWFpbnMuDQoq IEltcGxlbWVudCB0aGUgY2hhbmdlcyBkaXNjdXNzZWQgd2l0aCBJYWluIChtYWlubHkgdG8gYXZv aWQgY29uZnVzaW9uIHdpdGggbW9iaWxlL3RldGhlcmluZykuIA0KKiBDbGFyaWZ5IHRoYXQgc2Vy dmVyIHNlbGVjdGlvbiBpcyBvdXQgb2Ygc2NvcGUuIEEgcG9pbnRlciB0byBSRkM2NzMxIGlzIGFk ZGVkIHRvIGlsbHVzdHJhdGUgaG93IHRoaXMgY2FuIGJlIGRvbmUuDQoNClRoZXJlIHdhcyBhIGNv bW1lbnQgZnJvbSBXZXMgZHVyaW5nIHRoZSB2aXJ0dWFsIG1lZXRpbmc6ICJZb3Ugc3VmZmVyIHdp dGggY2FjaGVkIHF1ZXJpZXMgYWNyb3NzIHJlc29sdmVycy4iLCBidXQgd2UgZG9u4oCZdCB1bmRl cnN0YW5kIGhvdyB0aGlzIGFmZmVjdHMgdGhlIHByb3Bvc2FsIGluIHRoZSBkcmFmdC4gV2VzLCBp ZiB5b3UgY2FuIGNsYXJpZnkgeW91ciBjb21tZW50LCB0aGlzIHdvdWxkIGJlIGNvb2wuIFRoYW5r IHlvdS4NCg0KUGxlYXNlIHJldmlldyBhbmQgc2hhcmUgeW91ciBjb21tZW50cyBhbmQgc3VnZ2Vz dGlvbnMuIA0KDQpDaGVlcnMsDQpNZWQgIA0KDQotLS0tLU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS0N CkRlwqA6IGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyBbbWFpbHRvOmludGVybmV0LWRyYWZ0c0Bp ZXRmLm9yZ10gDQpFbnZvecOpwqA6IGpldWRpIDIgYXZyaWwgMjAyMCAxMDo0Nw0Kw4DCoDogQk9V Q0FEQUlSIE1vaGFtZWQgVEdJL09MTjsgVGlydW1hbGVzd2FyIFJlZGR5OyBEYW4gV2luZzsgTmVp bCBDb29rOyBUaXJ1bWFsZXN3YXIgUmVkZHkuSw0KT2JqZXTCoDogTmV3IFZlcnNpb24gTm90aWZp Y2F0aW9uIGZvciBkcmFmdC1idHctYWRkLWhvbWUtMDUudHh0DQoNCg0KQSBuZXcgdmVyc2lvbiBv ZiBJLUQsIGRyYWZ0LWJ0dy1hZGQtaG9tZS0wNS50eHQNCmhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBz dWJtaXR0ZWQgYnkgTW9oYW1lZCBCb3VjYWRhaXIgYW5kIHBvc3RlZCB0byB0aGUNCklFVEYgcmVw b3NpdG9yeS4NCg0KTmFtZToJCWRyYWZ0LWJ0dy1hZGQtaG9tZQ0KUmV2aXNpb246CTA1DQpUaXRs ZToJCUROUy1vdmVyLUhUVFBTIGFuZCBETlMtb3Zlci1UTFMgU2VydmVyIERpc2NvdmVyeSBhbmQg RGVwbG95bWVudCBDb25zaWRlcmF0aW9ucyBmb3IgSG9tZSBOZXR3b3Jrcw0KRG9jdW1lbnQgZGF0 ZToJMjAyMC0wNC0wMg0KR3JvdXA6CQlJbmRpdmlkdWFsIFN1Ym1pc3Npb24NClBhZ2VzOgkJMzAN ClVSTDogICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJh ZnQtYnR3LWFkZC1ob21lLTA1LnR4dA0KU3RhdHVzOiAgICAgICAgIGh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWJ0dy1hZGQtaG9tZS8NCkh0bWxpemVkOiAgICAgICBodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYnR3LWFkZC1ob21lLTA1DQpIdG1saXplZDog ICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1idHctYWRk LWhvbWUNCkRpZmY6ICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9 ZHJhZnQtYnR3LWFkZC1ob21lLTA1DQoNCkFic3RyYWN0Og0KICAgVGhpcyBkb2N1bWVudCBkaXNj dXNzZXMgRG9UL0RvSCBkZXBsb3ltZW50IGNvbnNpZGVyYXRpb25zIGZvciBob21lDQogICBuZXR3 b3Jrcy4gIEl0IHBhcnRpY3VsYXJseSBza2V0Y2hlcyB0aGUgcmVxdWlyZWQgc3RlcHMgdG8gdXNl IERvVC9Eb0gNCiAgIGNhcGFiaWxpdGllcyBwcm92aWRlZCBieSBsb2NhbCBuZXR3b3Jrcy4NCg0K ICAgT25lIG9mIHRoZSBnb2FscyBvZiB0aGlzIGRvY3VtZW50IGlzIHRvIGFzc2VzcyB0byB3aGF0 IGV4dGVudA0KICAgZXhpc3RpbmcgdG9vbHMgY2FuIGJlIHVzZWQgdG8gcHJvdmlkZSBhIERvVC9E b0ggc2VydmljZS4gIEFzIGFuDQogICBvdXRjb21lLCBuZXcgREhDUCBhbmQgUm91dGVyIEFkdmVy dGlzZW1lbnQgT3B0aW9ucyBhcmUgc3BlY2lmaWVkIGluDQogICBvcmRlciB0byBjb252ZXkgYSBE TlMgQXV0aGVudGljYXRpb24gRG9tYWluIE5hbWUuDQoNCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICANCg0KDQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMg ZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBh bmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KDQpUaGUgSUVURiBTZWNy ZXRhcmlhdA0KDQoNCg== From nobody Tue Apr 7 08:05:19 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 993BC3A0BBB for ; Tue, 7 Apr 2020 08:05:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gtt5lUmRktHg for ; Tue, 7 Apr 2020 08:05:16 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6E273A0BB2 for ; Tue, 7 Apr 2020 08:05:15 -0700 (PDT) Received: from opfedar01.francetelecom.fr (unknown [xx.xx.xx.2]) by opfedar23.francetelecom.fr (ESMTP service) with ESMTP id 48xW1640tWzBs7Z; Tue, 7 Apr 2020 17:05:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1586271914; bh=OTgpA0g1dpNsND1JgwW6LlltYjv5BLUh7thK+MmfseQ=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=L22ZSnD4OTY2wCHNC/F1pRGaMqD0HIovLdkdeAnonsJV8w6j0WRUIM7nlH5nBVGvS HdhDav4XPvioasMVpkEvqC26BtUWTh0ZAlXFDoNP7iFEvCalOJs2aQl6aWL9YQgNAt BFCdEiByt8y1uwPiB1NMGJFalRZ57qm9Cil431ZbpvVxHdcyDbCkEUMMLXBWyHAXrO CyKi7/lIZi8ORSNQLglndzNV7FFDEhel4uWKuLi6JpYa9RFKOwhT5fS9u8tMMj/aJD aiJc7oW3w+lNV5n/1hAkRXKKiEhvCgeqZjaIxM41Y46IJkeplYxaFLwYg5YnqX59pi Gk5M9RdJrRfUA== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.98]) by opfedar01.francetelecom.fr (ESMTP service) with ESMTP id 48xW1631TgzBrM0; Tue, 7 Apr 2020 17:05:14 +0200 (CEST) From: To: "ADD Mailing list (add@ietf.org)" CC: "draft-btw-add-ipsecme-ike@ietf.org" Thread-Topic: New Version Notification for draft-btw-add-ipsecme-ike-00.txt Thread-Index: AQHWDOyIbTZJxLeGj0KK8afUB9qxFKhtwdkw Date: Tue, 7 Apr 2020 15:05:13 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B9330314905CB@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <158627130455.4940.10283560672234804392@ietfa.amsl.com> In-Reply-To: <158627130455.4940.10283560672234804392@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Add] TR: New Version Notification for draft-btw-add-ipsecme-ike-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 15:05:18 -0000 SGkgYWxsLCANCg0KRllJLiBDb21tZW50cyBhcmUgbW9yZSB0aGFuIHdlbGNvbWUuIA0KDQpDaGVl cnMsDQpNZWQNCg0KLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tDQpEZcKgOiBpbnRlcm5ldC1k cmFmdHNAaWV0Zi5vcmcgW21haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmddIA0KRW52b3nD qcKgOiBtYXJkaSA3IGF2cmlsIDIwMjAgMTY6NTUNCsOAwqA6IERhbiBXaW5nOyBUaXJ1bWFsZXN3 YXIgUmVkZHkuSzsgVmFsZXJ5IFNteXNsb3Y7IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE47IFRp cnVtYWxlc3dhciBSZWRkeQ0KT2JqZXTCoDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBk cmFmdC1idHctYWRkLWlwc2VjbWUtaWtlLTAwLnR4dA0KDQoNCkEgbmV3IHZlcnNpb24gb2YgSS1E LCBkcmFmdC1idHctYWRkLWlwc2VjbWUtaWtlLTAwLnR4dA0KaGFzIGJlZW4gc3VjY2Vzc2Z1bGx5 IHN1Ym1pdHRlZCBieSBNb2hhbWVkIEJvdWNhZGFpciBhbmQgcG9zdGVkIHRvIHRoZQ0KSUVURiBy ZXBvc2l0b3J5Lg0KDQpOYW1lOgkJZHJhZnQtYnR3LWFkZC1pcHNlY21lLWlrZQ0KUmV2aXNpb246 CTAwDQpUaXRsZToJCUludGVybmV0IEtleSBFeGNoYW5nZSBQcm90b2NvbCBWZXJzaW9uIDIgKElL RXYyKSBDb25maWd1cmF0aW9uIGZvciBFbmNyeXB0ZWQgRE5TDQpEb2N1bWVudCBkYXRlOgkyMDIw LTA0LTA3DQpHcm91cDoJCUluZGl2aWR1YWwgU3VibWlzc2lvbg0KUGFnZXM6CQkxMg0KVVJMOiAg ICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy9kcmFmdC1idHct YWRkLWlwc2VjbWUtaWtlLTAwLnR4dA0KU3RhdHVzOiAgICAgICAgIGh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWJ0dy1hZGQtaXBzZWNtZS1pa2UvDQpIdG1saXplZDogICAg ICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWJ0dy1hZGQtaXBzZWNtZS1pa2Ut MDANCkh0bWxpemVkOiAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1s L2RyYWZ0LWJ0dy1hZGQtaXBzZWNtZS1pa2UNCg0KDQpBYnN0cmFjdDoNCiAgIFRoaXMgZG9jdW1l bnQgc3BlY2lmaWVzIGEgbmV3IEludGVybmV0IEtleSBFeGNoYW5nZSBQcm90b2NvbCBWZXJzaW9u DQogICAyIChJS0V2MikgQ29uZmlndXJhdGlvbiBQYXlsb2FkIEF0dHJpYnV0ZSBUeXBlIGZvciBl bmNyeXB0ZWQgRE5TIHN1Y2gNCiAgIGFzIEROUy1vdmVyLUhUVFBTIChEb0gpIGFuZCBETlMtb3Zl ci1UTFMgKERvVCkuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCg0KDQpQbGVhc2Ugbm90 ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBz dWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxh YmxlIGF0IHRvb2xzLmlldGYub3JnLg0KDQpUaGUgSUVURiBTZWNyZXRhcmlhdA0KDQoNCg== From nobody Thu Apr 9 23:39:05 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2D323A1867 for ; Thu, 9 Apr 2020 23:39:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QCpSk6VonM-X for ; Thu, 9 Apr 2020 23:38:58 -0700 (PDT) Received: from mail-il1-x132.google.com (mail-il1-x132.google.com [IPv6:2607:f8b0:4864:20::132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE5703A1866 for ; Thu, 9 Apr 2020 23:38:58 -0700 (PDT) Received: by mail-il1-x132.google.com with SMTP id d2so634328ilc.0 for ; Thu, 09 Apr 2020 23:38:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=3izHXKwrVYuQyR60ol6VPZZ/W4tqJvnpbRQlldmG5sA=; b=IzTrx0cMhhBfiwxwrwuisudJyC/0xWwMtPUzbBmLhiEVQSgtd/pwmbPz+2QdN5CwhF 1BtOxAp+sJHM7UsRwc7KNSSm6lA+3cvsW3MBbWZKdPrWuMJG2KpaMm+ddnV1ajTYrl0E S0wiyAn8AlR5W5b6GMyb4gpxiUXfW47uBB9G2xqD2GqlpIzpCdI6wIIIua6nMcwmIc9a LnouV8ymqTydHmiJaiZffPxJVJ3Q/vX+NYndrGDmuQ7+hR2+4ath+CK28TI+CqQKqaSK cTDF+O+9/eKJ4QPEdA+DtuIm4k2/3waFGowzxHtakxcM/YrbnMI9ARAu6i5x5ABQBqvx Fwag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=3izHXKwrVYuQyR60ol6VPZZ/W4tqJvnpbRQlldmG5sA=; b=daCWVPkPMMQF7Yuor5XabwCZppk4NBn27Gs+N8xYOCYkA1WEJMpOgMnebgzvzvkZlM Dbk2R0bk4fn8ky3/PLo8I2zj46wzkNVoMGlc3cmj87vumR6jbTE1fhlX6Roz+8O2gZFN 78uSNGkKpRNcv0hph737CCrBcLqZOXYGNKIxYoULGp7LktI7dSY3OUERaWTdSmnzHZ+N nQAgSR0F1yYbKbKhPRbLfF3BtqvutlsTNRdM778/Pin3kJrUSYVr+Er78bzcFZqbdOOm gLxJTPbycIbDSaJ3SAU1dRxoDeplbjLOvScJVaZADx6rmjQJgDxFb3ksrsnyJ3rLSsYC phFA== X-Gm-Message-State: AGi0PuYvf31HiE5o9RwPRcixkAxO/uSMxT4+oDpYKysPkTyomIFwE59/ I/7WO92DHlcHaqZ3SO9RzRXYUfAy62w9UMggun8UP8gaozdFNQ== X-Google-Smtp-Source: APiQypL6EQNK6IKDm7f3EEoy+tu+aQ83Y5p3nxyC1pD2fwL8wJZb2O1LxYTePlIUbGVHciAuKLDeuxhkXSIASpExLNY= X-Received: by 2002:a92:8c08:: with SMTP id o8mr3492527ild.123.1586500737703; Thu, 09 Apr 2020 23:38:57 -0700 (PDT) MIME-Version: 1.0 References: <158649818263.21105.15562293019640935019@ietfa.amsl.com> In-Reply-To: <158649818263.21105.15562293019640935019@ietfa.amsl.com> From: tirumal reddy Date: Fri, 10 Apr 2020 12:08:46 +0530 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e822f905a2e9fc17" Archived-At: Subject: [Add] Fwd: New Version Notification for draft-reddy-add-server-policy-selection-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Apr 2020 06:39:04 -0000 --000000000000e822f905a2e9fc17 Content-Type: text/plain; charset="UTF-8" Hi all, We prepared an updated version of https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-01 to highlight how a DNS client can cryptographically identify it is connecting to a DoT/DoH server hosted by a specific organization (e.g., ISP). It is particularly useful when the DoH/DoT server is insecurely discovered and prevents the client from connecting to a attackers server. As a reminder, it also defines a mechanism for a DNS server to communicate its filtering policy and privacy statement URL to DNS clients. This information is cryptographically signed to attest its authenticity. Cheers, -Tiru ---------- Forwarded message --------- From: Date: Fri, 10 Apr 2020 at 11:26 Subject: New Version Notification for draft-reddy-add-server-policy-selection-01.txt To: Dan Wing , Tirumaleswar Reddy.K < kondtir@gmail.com>, Michael C. Richardson , Mohamed Boucadair A new version of I-D, draft-reddy-add-server-policy-selection-01.txt has been successfully submitted by Tirumaleswar Reddy and posted to the IETF repository. Name: draft-reddy-add-server-policy-selection Revision: 01 Title: DNS Server Selection: DNS Server Information with Assertion Token Document date: 2020-04-09 Group: Individual Submission Pages: 23 URL: https://www.ietf.org/internet-drafts/draft-reddy-add-server-policy-selection-01.txt Status: https://datatracker.ietf.org/doc/draft-reddy-add-server-policy-selection/ Htmlized: https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-01 Htmlized: https://datatracker.ietf.org/doc/html/draft-reddy-add-server-policy-selection Diff: https://www.ietf.org/rfcdiff?url2=draft-reddy-add-server-policy-selection-01 Abstract: The document defines a mechanism that allows communication of DNS resolver information to DNS clients for use in selection decisions. In particular, the document defines a mechanism for a DNS server to communicate its filtering policy and privacy statement URL to DNS clients. This information is cryptographically signed to attest its authenticity. Such information is used for the selection of DNS resolvers. Typically, evaluating the DNS privacy statement, filtering policy, and the signatory, DNS clients with minimum human intervention can select the DNS server that best supports the user's desired privacy and filtering policy. This assertion is useful for DNS-over-TLS and DNS-over-HTTPS servers that are either public resolvers or are discovered in a local network. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --000000000000e822f905a2e9fc17 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

We prepared an updated version of https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-01= to highlight how a DNS client can cryptographically identify it is connect= ing to a DoT/DoH server hosted by a specific organization (e.g., ISP). It i= s particularly useful when the DoH/DoT server is insecurely discovered and = prevents the client from connecting to a attackers server.

As a remi= nder, it also defines a mechanism for a DNS server to communicate its filte= ring policy and privacy statement URL to DNS clients. This information is c= ryptographically signed to attest its authenticity.

Cheers,
-Tiru=

--= -------- Forwarded message ---------
From: <internet-drafts@ietf.org>
Date: Fri, 10 Apr 2020 at 11:26
Subject: New Version Notification = for draft-reddy-add-server-policy-selection-01.txt
To: Dan Wing <dwing-ietf@fuggles.com>, Tirum= aleswar Reddy.K <kondtir@gmail.com<= /a>>, Michael C. Richardson <mcr+ietf@sandelman.ca>, Mohamed Boucadair <mohamed.boucadair@orange.com>
=


A new version of I-D, draft-reddy-add-server-policy-selection-01.txt
has been successfully submitted by Tirumaleswar Reddy and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-reddy-add-server-policy= -selection
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A001
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS Server Selection: DNS Server I= nformation with Assertion Token
Document date:=C2=A0 2020-04-09
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 23
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-red= dy-add-server-policy-selection-01.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-reddy-add-server-polic= y-selection/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-0= 1
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-reddy-add-server-p= olicy-selection
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-reddy-add= -server-policy-selection-01

Abstract:
=C2=A0 =C2=A0The document defines a mechanism that allows communication of = DNS
=C2=A0 =C2=A0resolver information to DNS clients for use in selection decis= ions.
=C2=A0 =C2=A0In particular, the document defines a mechanism for a DNS serv= er to
=C2=A0 =C2=A0communicate its filtering policy and privacy statement URL to = DNS
=C2=A0 =C2=A0clients.=C2=A0 This information is cryptographically signed to= attest its
=C2=A0 =C2=A0authenticity.=C2=A0 Such information is used for the selection= of DNS
=C2=A0 =C2=A0resolvers.=C2=A0 Typically, evaluating the DNS privacy stateme= nt,
=C2=A0 =C2=A0filtering policy, and the signatory, DNS clients with minimum = human
=C2=A0 =C2=A0intervention can select the DNS server that best supports the = user's
=C2=A0 =C2=A0desired privacy and filtering policy.

=C2=A0 =C2=A0This assertion is useful for DNS-over-TLS and DNS-over-HTTPS s= ervers
=C2=A0 =C2=A0that are either public resolvers or are discovered in a local<= br> =C2=A0 =C2=A0network.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--000000000000e822f905a2e9fc17-- From nobody Fri Apr 10 01:22:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B2493A19BE; Fri, 10 Apr 2020 01:22:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JtgSV4CBVext; Fri, 10 Apr 2020 01:22:35 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 241E43A19BC; Fri, 10 Apr 2020 01:22:35 -0700 (PDT) Received: from opfednr06.francetelecom.fr (unknown [xx.xx.xx.70]) by opfednr26.francetelecom.fr (ESMTP service) with ESMTP id 48z9x51tsyz100l; Fri, 10 Apr 2020 10:22:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1586506953; bh=SiUYVLKk40y8oKbJXYAR90q/5wQGEZEMzKZGRqUD7c0=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=Kif9hDlfs86AIxdOdZ0X4E7zptSc9sW6PyMlauboZL6Gz/SVlEwe3zJOKHdKYNlGC ollAmUAhQwTP0P1wir3f0K9Tpgg1FY3kWUzeCxOqNhpFgykBzflRqGjhvI3M1T+Umc UAk8LhUdxXxSLE3KU3q6UR2QdUFK1KdifDBLaAtmISbdbUNFPaxHiYKBiWPOBu5gDg 5gOsWikVvus7dX9xmRbx2BYzYZzpkSGLdCYfRK835mL1c7s9kWzokUeg2XwvlZORO3 VPLmurRA6Jm6bSF2kppxd4fFaqvq05eeTaomv2qf2Xq52bofumV8ovZlZbSTuT11Ig TudDQ545tIpTw== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.48]) by opfednr06.francetelecom.fr (ESMTP service) with ESMTP id 48z9x50fwkzDq81; Fri, 10 Apr 2020 10:22:33 +0200 (CEST) From: To: Paul Hoffman CC: "doh@ietf.org" , "ADD Mailing list (add@ietf.org)" , "Murray S. Kucherawy" , Barry Leiba Thread-Topic: draft-btw-add-rfc8484-clarification (was RE: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033)) Thread-Index: AdYPESzD+Ibf1Z6GSfOomhoX3E7YjA== Date: Fri, 10 Apr 2020 08:22:31 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B93303149307D@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Add] draft-btw-add-rfc8484-clarification (was RE: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033)) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Apr 2020 08:22:36 -0000 Hi Paul, Barry, all, (+add wg as I guess the draft should be discussed there) We prepared a document to clarify the redirection issue: https://datatracke= r.ietf.org/doc/draft-btw-add-rfc8484-clarification/=20 The document specifies also how redirection can be done in DoH.=20 Cheers, Med > -----Message d'origine----- > De=A0: Paul Hoffman [mailto:paul.hoffman@icann.org] > Envoy=E9=A0: mardi 31 mars 2020 16:48 > =C0=A0: BOUCADAIR Mohamed TGI/OLN > Cc=A0: doh@ietf.org; David Lawrence; Ben Schwartz; Patrick McManus; > Murray S. Kucherawy; Barry Leiba; RFC Editor > Objet=A0: Re: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033) >=20 > On Mar 31, 2020, at 2:03 AM, mohamed.boucadair@orange.com wrote: > > I'm now more puzzled about the intent of the document with regards > to redirection: >=20 > That's fine, and you are not alone. But the proper resolution of that > puzzlement is not an erratum, it is a document update. >=20 > --Paul Hoffman From nobody Fri Apr 10 17:23:26 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E7243A135E for ; Fri, 10 Apr 2020 17:23:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VibCoPoEqKTb for ; Fri, 10 Apr 2020 17:23:23 -0700 (PDT) Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CBCE3A135D for ; Fri, 10 Apr 2020 17:23:23 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id v5so4036243wrp.12 for ; Fri, 10 Apr 2020 17:23:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZmZv+g3oRTdE1Y2mwW54ttJ/tkCQoyWVQNM3D7V00pM=; b=C176MYlWYd8hC+U2Vt3CDi2DPlGfNhYzHEja52SFldByb5jX3w6paRBgyLyFZB1Nyv Hyg/5xp7iywnL7r37TPqeV7DsGgr4DfCzdZNAq4bq5y8kRu2OJx+h9le4oE7r+jR163o i3Lmh/LifNoe3hZM1LZiTXFVRtaBZ/LgrYrcF8rlGpo8yaDgLuFhPcVb6RFA2hCAlQzT azXBf8DZeD/wQwNlY7inDH8UUF0aNuULh8/LKc2nyNT3SvAXqB18OsUzpzzuzq4iudS9 /OLzmR6FuwhHdlWYHfzcj+0+U6P5TOcMIvJMSIpoP59Ar4M/6vzMF1vZMYZRIRbZ6sSp cYhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZmZv+g3oRTdE1Y2mwW54ttJ/tkCQoyWVQNM3D7V00pM=; b=RN5WXp+uBzlm3rt/bCzGrb6latqCpfYg7I6bhiHg5jOZqqzdgB+3XE/AQW6f7ybzDW 9A2cnYW83Qb8H2D2wXjzSlVVMKcBBEyVjlZu8jiC67RrTSPLnfjybSC0lSRUdweukHn2 66tZLqZGTOyuIKFukHMgsoO88kyzhXgxYpYx4a6X4QQRaSbeBsVrE5EQbJTuTpLTsAOU FImMRA5xPTguRXKpwnAPXaV6qa4MQkoAdtFQrcEsUnWuh9mIybPszOrxqio4MovL/kjQ /pfn4RiOumizz3FUQ7XEwgiT32GQiVVMkJG0HRnUvCvbv//Ex1DYLY27eX6N5DpBwYkk Qk5g== X-Gm-Message-State: AGi0PuYwiHRjHxvMRxMl0lkgBqFUaGxXZoWHDtj3Qjq2Ums65jjjYTAp Sc7S8UDRSi+iJ98l0x7U5gEFlwUebx1M5n1A3nXg6A== X-Google-Smtp-Source: APiQypLAnd/Nw7EHUlA32TMhyawEby+NAznnGR9VEfPJcY98xw7RADfuPsTzuZf2IXVO7jMY0G12RZ0TN1o9P63SZls= X-Received: by 2002:adf:e7c6:: with SMTP id e6mr6853101wrn.159.1586564600972; Fri, 10 Apr 2020 17:23:20 -0700 (PDT) MIME-Version: 1.0 References: <787AE7BB302AE849A7480A190F8B93303149307D@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: <787AE7BB302AE849A7480A190F8B93303149307D@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> From: Ben Schwartz Date: Fri, 10 Apr 2020 20:23:09 -0400 Message-ID: To: mohamed.boucadair@orange.com Cc: Paul Hoffman , "Murray S. Kucherawy" , "doh@ietf.org" , "ADD Mailing list (add@ietf.org)" , Barry Leiba Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000007e8c7505a2f8db62" Archived-At: Subject: Re: [Add] draft-btw-add-rfc8484-clarification (was RE: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033)) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Apr 2020 00:23:25 -0000 --0000000000007e8c7505a2f8db62 Content-Type: multipart/alternative; boundary="000000000000749ce405a2f8dbc9" --000000000000749ce405a2f8dbc9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On venue: ADD is not chartered for core protocol development work, and DoH is shutting down, so I think the correct venue is probably DNSOP. However, you should also get input from HTTPBIS, where there is expertise on HTTP semantics. On the draft: * The draft introduces new MUST-level requirements, so I don't think it can reasonably be called a clarification. Sending DNS records in a 3XX response body, for example, is a novel construction. * I would remove the HTTP/2 PUSH version of the proposal, which seems more complicated without much benefit, and I would make the 3XX response body optional. If the response body is absent, clients SHOULD resolve the target hostname in the same way that they resolved the original DoH server hostname, or fail if this is not possible. * I think RFC 8484 is pretty clear on the main point in question: HTTP redirection applies in the usual way, whatever that might be. Don't trust DoH URIs from strangers. * In practice, redirection may have been given little attention because it doesn't necessarily give us the behavior we want. For a GET request (where DoH encodes the query in the URI), a redirect only applies to that specific query. A server that is trying to refer users to a different server would have to redirect each DoH GET individually -- not a recipe for good performance. Permanent redirects for all those queries would also bloat the client's HTTP cache. Alt-Svc, in contrast, would allow relocating the whole origin, which seems closer to the intended behavior. For POST, all queries share a URI, so permanent redirects might work OK. However, clients are permitted to convert POST to GET (dropping the body) when encountering a 302 redirect, so only a 308 will work. However, as noted in RFC 7238: "initial use of status code 308 will be restricted to cases where the server has sufficient confidence in the client's understanding the new code" Perhaps support for 308 is now sufficiently universal that DoH servers can safely rely on it, but I would recommend checking with HTTPBIS. * Despite all these concerns, I'm glad to see interest in improving DoH, and I agree that a way to offer an updated DoH URI template would be nice. If we can't find an elegant solution using redirects, we can find another way, e.g. an HTTP response header containing the new template. On Fri, Apr 10, 2020 at 4:22 AM wrote: > Hi Paul, Barry, all, > > (+add wg as I guess the draft should be discussed there) > > We prepared a document to clarify the redirection issue: > https://datatracker.ietf.org/doc/draft-btw-add-rfc8484-clarification/ > > The document specifies also how redirection can be done in DoH. > > Cheers, > Med > > > -----Message d'origine----- > > De : Paul Hoffman [mailto:paul.hoffman@icann.org] > > Envoy=C3=A9 : mardi 31 mars 2020 16:48 > > =C3=80 : BOUCADAIR Mohamed TGI/OLN > > Cc : doh@ietf.org; David Lawrence; Ben Schwartz; Patrick McManus; > > Murray S. Kucherawy; Barry Leiba; RFC Editor > > Objet : Re: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033) > > > > On Mar 31, 2020, at 2:03 AM, mohamed.boucadair@orange.com wrote: > > > I'm now more puzzled about the intent of the document with regards > > to redirection: > > > > That's fine, and you are not alone. But the proper resolution of that > > puzzlement is not an erratum, it is a document update. > > > > --Paul Hoffman > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000749ce405a2f8dbc9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On venue: ADD is not chartered for core protocol developme= nt work, and DoH is shutting down, so I think the correct venue is probably= DNSOP.=C2=A0 However, you should also get input from HTTPBIS, where there = is expertise on HTTP semantics.

On the draft:
= * The draft introduces new MUST-level requirements, so I don't think it= can reasonably be called a clarification.=C2=A0 Sending DNS records in a 3= XX response body, for example, is a novel construction.

* I would remove the HTTP/2 PUSH version of the proposal, which seems= more complicated without much benefit, and I would make the 3XX response b= ody optional.=C2=A0 If the response body is absent, clients SHOULD resolve = the target hostname in the same way that they resolved the original DoH ser= ver hostname, or fail if this is not possible.

* I think RFC 8484 is pretty clear on the main point in question: H= TTP redirection applies in the usual way,=C2=A0whatever that might be.=C2= =A0 Don't trust DoH URIs from strangers.

* In = practice, redirection may have been given little attention because it doesn= 't necessarily give us the behavior we want.=C2=A0 For a GET request (w= here DoH encodes the query in the URI), a redirect only applies to that spe= cific query.=C2=A0 A server that is trying to refer users to a different se= rver would have to redirect each DoH GET individually -- not a recipe for g= ood performance.=C2=A0 Permanent redirects for all those queries would also= bloat the client's HTTP cache.=C2=A0 Alt-Svc, in contrast, would allow= =C2=A0relocating the whole origin, which seems closer to the intended behav= ior.

For POST, all queries share a URI, so permane= nt redirects might work OK.=C2=A0 However, clients are permitted to convert= POST to GET (dropping the body) when encountering a 302 redirect, so only = a 308 will work.=C2=A0 However, as noted in RFC 7238:
=C2=A0 =C2= =A0"initial use of status code 308 will be restricted to cases
= =C2=A0 =C2=A0where the server has sufficient confidence in the client's=
=C2=A0 =C2=A0understanding the new code"

Perhap= s support for 308 is now sufficiently universal that DoH servers can safely= rely on it, but I would recommend checking with HTTPBIS.

* Despite all these concerns, I'm glad to see interest in impro= ving DoH, and I agree that a way to offer an updated DoH URI template would= be nice.=C2=A0 If we can't find an elegant solution using redirects, w= e can find another way, e.g. an HTTP response header containing the new tem= plate.

On Fri, Apr 10, 2020 at 4:22 AM <mohamed.boucadair@orange.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">Hi Paul, Barry, all,

(+add wg as I guess the draft should be discussed there)

We prepared a document to clarify the redirection issue: https://datatracker.ietf.org/doc/draft-btw-add-rf= c8484-clarification/

The document specifies also how redirection can be done in DoH.

Cheers,
Med

> -----Message d'origine-----
> De=C2=A0: Paul Hoffman [mailto:paul.hoffman@icann.org]
> Envoy=C3=A9=C2=A0: mardi 31 mars 2020 16:48
> =C3=80=C2=A0: BOUCADAIR Mohamed TGI/OLN
> Cc=C2=A0: doh@ietf.o= rg; David Lawrence; Ben Schwartz; Patrick McManus;
> Murray S. Kucherawy; Barry Leiba; RFC Editor
> Objet=C2=A0: Re: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033= )
>
> On Mar 31, 2020, at 2:03 AM, mohamed.boucadair@orange.com wrote:
> > I'm now more puzzled about the intent of the document with re= gards
> to redirection:
>
> That's fine, and you are not alone. But the proper resolution of t= hat
> puzzlement is not an erratum, it is a document update.
>
> --Paul Hoffman

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000749ce405a2f8dbc9-- --0000000000007e8c7505a2f8db62 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAGuEkclHdvQz4ddwMbsMFgwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDAxMDcwODIyMjJaFw0yMDA3MDUwODIyMjJaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwrwIVY3rOZp1Papu Yl53bMQ2H713K9788lbE9itKEL7tJAJO7GqZGRbfxPUVRRDYPntAf+j0JZZOvf9Ye6uN12SNW+v1 V0o5YeXtXMpNOkprr0v0v7qc80yhbq8RIIiX4usDJwuDGbcL/VKnlCTDPRp+VWUB8rkaqObapi/F BGiPWXBqiT36W5opr6eJjUHuGiqzmK/1lCXMZSn6n3wkkbnonFsF5G4kfie+n/DDNd1hlqd06bzB rCnToS+BV/Y9BroXiOjVWJnMe/8Rce7zA8Dzr0kU+gacBArnMiDyCvUGjngbASU7VaIPJBc/zBzI L5QoeUAfgEJcGvFIEJUUIwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQU+WKCBtTdknJDbiAjMsikOsbLHoAwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQA2eHjHcJ8kaiqDQGv7TdNEBFiDI8omlzpnnuQFciHkWhkfi3mQwuuZ IQIHd+JNpV0TQ8TqMNAr4YSPWOjwTd3UNxm+qghV3KC9j/Ygq39OzUlqxWv2lFH8mGFpbview2GI xZWXTCRbeod3ZevhC0lOUVVx4NCHe5yWSwjEpZHUilSnjyqN7ssC0eYQBylFOf2xVxu1JB8Xewgw Vk/DeOzsapxxjiuw2UZsDZbtVJvEx/C34GkACLR4Lm0k6O5ujAiDBkyy2nklxLhmKb9fyiH51B3j oRE8y99FJOCHoye9E/P2tK12x9w9ZeF07eWAdX3OkhTne1DitwLidojuyFm9MYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhABrhJHJR3b0M+HXcDG7DBYMA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCBqyl0BqAgNkc/JcHC6X5B69sq6ASkZgOvDRedcRUz9dTAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA0MTEwMDIzMjFaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAEp2ZUbKFjyB6XPiKttPkilZZ3Zumjk25+/ydsyDkGO2/Y+Trdhkx6es5qRJtxOhLk9jjkftU cjEo8ERDguEpHyBOvcRMMUwxvD9h74LSxUWBLLJn9b7nEwWNrb5TKT+pzv6fN8MtQiyVi2di1GEy GIE/R0TatN0f6Vypu4+GMM0X57LTrBbWDTZS4Ym7QR3PMqImJICzKVoj1pqwG1faORpOzznFWc1x 9syL7FDUyR9w3OkrnQdF031fz3q3T4bUZzMBPofxZWAQJM3g1cheXmjQ27exuG7jHA6JzDHZUMJh USPnmh5k4/PIlFPIFOP7bUEW3q+T44hj2tNnk2eOig== --0000000000007e8c7505a2f8db62-- From nobody Fri Apr 17 06:18:00 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BDBA3A0863; Fri, 17 Apr 2020 06:17:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j1Kq_G1MQiY3; Fri, 17 Apr 2020 06:17:56 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBB033A085B; Fri, 17 Apr 2020 06:17:55 -0700 (PDT) Received: from opfednr04.francetelecom.fr (unknown [xx.xx.xx.68]) by opfednr25.francetelecom.fr (ESMTP service) with ESMTP id 493c8f3kfzzCqq1; Fri, 17 Apr 2020 15:17:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1587129474; bh=NKZWVcyYLQVfogfVMkLkBn5YiFGys3b11EKOoxRyNrI=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=e8dIbl3+itX8+OaXKe4FWrFbWKaJFaVrkvTOx1/uM8jZz45XAokn+Ax37vifr0RxZ gM10KDcEGVgCK8kHyFm/i0r98CPkNJ/TYFLqr7QbMV2Ivk0R0WVWq/ZZedQuwcDJED +mpprJfUMxX9c4aEZngQxFoj5qS+xWCO1nsJ9aEL5puNu1w5NppaAR1uZBIW9rNTU8 mEgYupOquM1SrmkdLGSHV3Y9GNI/sfGxe5ZNu9cAs7LUqgaktrrgzcd2S7q81si4iQ oUDjlqym3VDp/s42ZpPQmhjB/js3jYoiGcU80IgQrEjENJ3NhcruPHQdHApzj6lGV+ PsmwANa8uzyJw== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.95]) by opfednr04.francetelecom.fr (ESMTP service) with ESMTP id 493c8f2x2Nz1xp6; Fri, 17 Apr 2020 15:17:54 +0200 (CEST) From: To: Ben Schwartz CC: Paul Hoffman , "Murray S. Kucherawy" , "doh@ietf.org" , "ADD Mailing list (add@ietf.org)" , Barry Leiba Thread-Topic: [Add] draft-btw-add-rfc8484-clarification (was RE: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033)) Thread-Index: AQHWD5dpk/sKBgVZCU+oagEvki87gqh9TrpQ Date: Fri, 17 Apr 2020 13:17:50 +0000 Message-ID: <9ebcb06a-a4b8-486c-bd71-464e750a7cae@OPEXCAUBM24.corporate.adroot.infra.ftgroup> References: <787AE7BB302AE849A7480A190F8B93303149307D@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: multipart/alternative; boundary="_000_9ebcb06aa4b8486cbd71464e750a7caeOPEXCAUBM24corporateadr_" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] draft-btw-add-rfc8484-clarification (was RE: [Doh] [Ext] [Technical Errata Reported] RFC8484 (6033)) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Apr 2020 13:17:59 -0000 --_000_9ebcb06aa4b8486cbd71464e750a7caeOPEXCAUBM24corporateadr_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQpBbGwgZ29vZCBwb2ludHMuIFRoYW5rIHlvdS4NCg0KV2UgdXBkYXRlZCB0aGUg ZHJhZnQgdG8gdGFrZSBpbnRvIGFjY291bnQgeW91ciBjb21tZW50cyBhbmQgc3VnZ2VzdGlvbnM6 DQoNCg0KwrcgICAgICAgICBXZSBtb3ZlZCB0aGUgU2VydmVyIFB1c2ggcHJvcG9zYWwgdG8gYW4g YXBwZW5kaXguIFdlIHByZWZlciB0byBoYXZlIHRoZXJlIHRvIGlsbHVzdHJhdGUgaG93IHRoYXQg a2luZCBvZiBkZXNpZ24gaXMgY29tcGxleC4gV2UgYWRkZWQgc29tZSB0ZXh0IHRvIGV4cGxhaW4g dGhhdC4NCg0KwrcgICAgICAgICBXZSBzdGlsbCBtYWludGFpbiDigJxNVVNU4oCdIGZvciByZXR1 cm5pbmcgYm90aCBBL0FBQUEgaW4gYSByZWRpcmVjdCBlc3BlY2lhbGx5IHdoZW4gdGhlIERvSCBz ZXJ2aWNlIGlzIGF2YWlsYWJsZSBpbiBhbm90aGVyIGxvY2F0aW9uLiBXZSBtYWludGFpbiB0aGF0 IGxhbmd1YWdlIGJlY2F1c2UgRG81MyBtYXkgbm90IGJlIHBvc3NpYmxlIGluIHNvbWUgY29uZmln dXJhdGlvbnMgKGFuIGV4YW1wbGUgaXMgcHJvdmlkZSBpbiB0aGUgZHJhZnQpLiBXZSBtYXkgcmV2 aXNpdCB0aGUgbGFuZ3VhZ2UgYXMgYSBmdW5jdGlvbiBvZiBob3cgd2Ugc29sdmUgdGhlIGlzc3Vl IHdlIGRpc2N1c3MgaW4gU2VjdGlvbiA2Lg0KDQrCtyAgICAgICAgIFdlIGFsc28gdXBkYXRlZCBT ZWN0aW9uIDYgdG8gZGlzY3VzcyB3aHkgQWx0LVN2YyBpcyBub3QgYW4gb3B0aW9uIGluIHNvbWUg cmVkaXJlY3Qgc2NlbmFyaW9zLiBXZSBhbHNvIGRlc2NyaWJlIGEgcHJvcG9zYWwgdXNpbmcgR0VU IHRvIGhvcGVmdWxseSBhdm9pZCBzb21lIG9mIHRoZSBpc3N1ZXMgeW91IHJhaXNlZC4NCg0Kwrcg ICAgICAgICBXZSB3aWxsIHNlbmQgYSBub3RlIHRvIGh0dHBiaXMgYW5kIGRuc29wIFdHcyBmb3Ig bW9yZSBmZWVkYmFjaywgYnV0IEkgZG8gdGhpbmsgdGhhdCBzb21lIGFzcGVjdHMgZGlzY3Vzc2Vk IGluIHRoZSBkcmFmdCBiZWxvbmcgdG8gYWRkIGFzIHdlbGwuDQoNClRoZSB1cGRhdGVkIHZlcnNp b24gaXMgYXZhaWxhYmxlIGF0OiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYnR3 LWFkZC1yZmM4NDg0LWNsYXJpZmljYXRpb24tMDENCg0KQ29tbWVudHMgYW5kIHN1Z2dlc3Rpb25z IGFyZSBtb3JlIHRoYW4gd2VsY29tZS4NCg0KQ2hlZXJzLA0KTWVkDQoNCkRlIDogQmVuIFNjaHdh cnR6IFttYWlsdG86YmVtYXNjQGdvb2dsZS5jb21dDQpFbnZvecOpIDogc2FtZWRpIDExIGF2cmls IDIwMjAgMDI6MjMNCsOAIDogQk9VQ0FEQUlSIE1vaGFtZWQgVEdJL09MTg0KQ2MgOiBQYXVsIEhv ZmZtYW47IE11cnJheSBTLiBLdWNoZXJhd3k7IGRvaEBpZXRmLm9yZzsgQUREIE1haWxpbmcgbGlz dCAoYWRkQGlldGYub3JnKTsgQmFycnkgTGVpYmENCk9iamV0IDogUmU6IFtBZGRdIGRyYWZ0LWJ0 dy1hZGQtcmZjODQ4NC1jbGFyaWZpY2F0aW9uICh3YXMgUkU6IFtEb2hdIFtFeHRdIFtUZWNobmlj YWwgRXJyYXRhIFJlcG9ydGVkXSBSRkM4NDg0ICg2MDMzKSkNCg0KT24gdmVudWU6IEFERCBpcyBu b3QgY2hhcnRlcmVkIGZvciBjb3JlIHByb3RvY29sIGRldmVsb3BtZW50IHdvcmssIGFuZCBEb0gg aXMgc2h1dHRpbmcgZG93biwgc28gSSB0aGluayB0aGUgY29ycmVjdCB2ZW51ZSBpcyBwcm9iYWJs eSBETlNPUC4gIEhvd2V2ZXIsIHlvdSBzaG91bGQgYWxzbyBnZXQgaW5wdXQgZnJvbSBIVFRQQklT LCB3aGVyZSB0aGVyZSBpcyBleHBlcnRpc2Ugb24gSFRUUCBzZW1hbnRpY3MuDQoNCk9uIHRoZSBk cmFmdDoNCiogVGhlIGRyYWZ0IGludHJvZHVjZXMgbmV3IE1VU1QtbGV2ZWwgcmVxdWlyZW1lbnRz LCBzbyBJIGRvbid0IHRoaW5rIGl0IGNhbiByZWFzb25hYmx5IGJlIGNhbGxlZCBhIGNsYXJpZmlj YXRpb24uICBTZW5kaW5nIEROUyByZWNvcmRzIGluIGEgM1hYIHJlc3BvbnNlIGJvZHksIGZvciBl eGFtcGxlLCBpcyBhIG5vdmVsIGNvbnN0cnVjdGlvbi4NCg0KKiBJIHdvdWxkIHJlbW92ZSB0aGUg SFRUUC8yIFBVU0ggdmVyc2lvbiBvZiB0aGUgcHJvcG9zYWwsIHdoaWNoIHNlZW1zIG1vcmUgY29t cGxpY2F0ZWQgd2l0aG91dCBtdWNoIGJlbmVmaXQsIGFuZCBJIHdvdWxkIG1ha2UgdGhlIDNYWCBy ZXNwb25zZSBib2R5IG9wdGlvbmFsLiAgSWYgdGhlIHJlc3BvbnNlIGJvZHkgaXMgYWJzZW50LCBj bGllbnRzIFNIT1VMRCByZXNvbHZlIHRoZSB0YXJnZXQgaG9zdG5hbWUgaW4gdGhlIHNhbWUgd2F5 IHRoYXQgdGhleSByZXNvbHZlZCB0aGUgb3JpZ2luYWwgRG9IIHNlcnZlciBob3N0bmFtZSwgb3Ig ZmFpbCBpZiB0aGlzIGlzIG5vdCBwb3NzaWJsZS4NCg0KKiBJIHRoaW5rIFJGQyA4NDg0IGlzIHBy ZXR0eSBjbGVhciBvbiB0aGUgbWFpbiBwb2ludCBpbiBxdWVzdGlvbjogSFRUUCByZWRpcmVjdGlv biBhcHBsaWVzIGluIHRoZSB1c3VhbCB3YXksIHdoYXRldmVyIHRoYXQgbWlnaHQgYmUuICBEb24n dCB0cnVzdCBEb0ggVVJJcyBmcm9tIHN0cmFuZ2Vycy4NCg0KKiBJbiBwcmFjdGljZSwgcmVkaXJl Y3Rpb24gbWF5IGhhdmUgYmVlbiBnaXZlbiBsaXR0bGUgYXR0ZW50aW9uIGJlY2F1c2UgaXQgZG9l c24ndCBuZWNlc3NhcmlseSBnaXZlIHVzIHRoZSBiZWhhdmlvciB3ZSB3YW50LiAgRm9yIGEgR0VU IHJlcXVlc3QgKHdoZXJlIERvSCBlbmNvZGVzIHRoZSBxdWVyeSBpbiB0aGUgVVJJKSwgYSByZWRp cmVjdCBvbmx5IGFwcGxpZXMgdG8gdGhhdCBzcGVjaWZpYyBxdWVyeS4gIEEgc2VydmVyIHRoYXQg aXMgdHJ5aW5nIHRvIHJlZmVyIHVzZXJzIHRvIGEgZGlmZmVyZW50IHNlcnZlciB3b3VsZCBoYXZl IHRvIHJlZGlyZWN0IGVhY2ggRG9IIEdFVCBpbmRpdmlkdWFsbHkgLS0gbm90IGEgcmVjaXBlIGZv ciBnb29kIHBlcmZvcm1hbmNlLiAgUGVybWFuZW50IHJlZGlyZWN0cyBmb3IgYWxsIHRob3NlIHF1 ZXJpZXMgd291bGQgYWxzbyBibG9hdCB0aGUgY2xpZW50J3MgSFRUUCBjYWNoZS4gIEFsdC1TdmMs IGluIGNvbnRyYXN0LCB3b3VsZCBhbGxvdyByZWxvY2F0aW5nIHRoZSB3aG9sZSBvcmlnaW4sIHdo aWNoIHNlZW1zIGNsb3NlciB0byB0aGUgaW50ZW5kZWQgYmVoYXZpb3IuDQoNCkZvciBQT1NULCBh bGwgcXVlcmllcyBzaGFyZSBhIFVSSSwgc28gcGVybWFuZW50IHJlZGlyZWN0cyBtaWdodCB3b3Jr IE9LLiAgSG93ZXZlciwgY2xpZW50cyBhcmUgcGVybWl0dGVkIHRvIGNvbnZlcnQgUE9TVCB0byBH RVQgKGRyb3BwaW5nIHRoZSBib2R5KSB3aGVuIGVuY291bnRlcmluZyBhIDMwMiByZWRpcmVjdCwg c28gb25seSBhIDMwOCB3aWxsIHdvcmsuICBIb3dldmVyLCBhcyBub3RlZCBpbiBSRkMgNzIzODoN CiAgICJpbml0aWFsIHVzZSBvZiBzdGF0dXMgY29kZSAzMDggd2lsbCBiZSByZXN0cmljdGVkIHRv IGNhc2VzDQogICB3aGVyZSB0aGUgc2VydmVyIGhhcyBzdWZmaWNpZW50IGNvbmZpZGVuY2UgaW4g dGhlIGNsaWVudCdzDQogICB1bmRlcnN0YW5kaW5nIHRoZSBuZXcgY29kZSINCg0KUGVyaGFwcyBz dXBwb3J0IGZvciAzMDggaXMgbm93IHN1ZmZpY2llbnRseSB1bml2ZXJzYWwgdGhhdCBEb0ggc2Vy dmVycyBjYW4gc2FmZWx5IHJlbHkgb24gaXQsIGJ1dCBJIHdvdWxkIHJlY29tbWVuZCBjaGVja2lu ZyB3aXRoIEhUVFBCSVMuDQoNCiogRGVzcGl0ZSBhbGwgdGhlc2UgY29uY2VybnMsIEknbSBnbGFk IHRvIHNlZSBpbnRlcmVzdCBpbiBpbXByb3ZpbmcgRG9ILCBhbmQgSSBhZ3JlZSB0aGF0IGEgd2F5 IHRvIG9mZmVyIGFuIHVwZGF0ZWQgRG9IIFVSSSB0ZW1wbGF0ZSB3b3VsZCBiZSBuaWNlLiAgSWYg d2UgY2FuJ3QgZmluZCBhbiBlbGVnYW50IHNvbHV0aW9uIHVzaW5nIHJlZGlyZWN0cywgd2UgY2Fu IGZpbmQgYW5vdGhlciB3YXksIGUuZy4gYW4gSFRUUCByZXNwb25zZSBoZWFkZXIgY29udGFpbmlu ZyB0aGUgbmV3IHRlbXBsYXRlLg0KDQpPbiBGcmksIEFwciAxMCwgMjAyMCBhdCA0OjIyIEFNIDxt b2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tPG1haWx0bzptb2hhbWVkLmJvdWNhZGFpckBvcmFu Z2UuY29tPj4gd3JvdGU6DQpIaSBQYXVsLCBCYXJyeSwgYWxsLA0KDQooK2FkZCB3ZyBhcyBJIGd1 ZXNzIHRoZSBkcmFmdCBzaG91bGQgYmUgZGlzY3Vzc2VkIHRoZXJlKQ0KDQpXZSBwcmVwYXJlZCBh IGRvY3VtZW50IHRvIGNsYXJpZnkgdGhlIHJlZGlyZWN0aW9uIGlzc3VlOiBodHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1idHctYWRkLXJmYzg0ODQtY2xhcmlmaWNhdGlvbi8N Cg0KVGhlIGRvY3VtZW50IHNwZWNpZmllcyBhbHNvIGhvdyByZWRpcmVjdGlvbiBjYW4gYmUgZG9u ZSBpbiBEb0guDQoNCkNoZWVycywNCk1lZA0KDQo+IC0tLS0tTWVzc2FnZSBkJ29yaWdpbmUtLS0t LQ0KPiBEZSA6IFBhdWwgSG9mZm1hbiBbbWFpbHRvOnBhdWwuaG9mZm1hbkBpY2Fubi5vcmc8bWFp bHRvOnBhdWwuaG9mZm1hbkBpY2Fubi5vcmc+XQ0KPiBFbnZvecOpIDogbWFyZGkgMzEgbWFycyAy MDIwIDE2OjQ4DQo+IMOAIDogQk9VQ0FEQUlSIE1vaGFtZWQgVEdJL09MTg0KPiBDYyA6IGRvaEBp ZXRmLm9yZzxtYWlsdG86ZG9oQGlldGYub3JnPjsgRGF2aWQgTGF3cmVuY2U7IEJlbiBTY2h3YXJ0 ejsgUGF0cmljayBNY01hbnVzOw0KPiBNdXJyYXkgUy4gS3VjaGVyYXd5OyBCYXJyeSBMZWliYTsg UkZDIEVkaXRvcg0KPiBPYmpldCA6IFJlOiBbRG9oXSBbRXh0XSBbVGVjaG5pY2FsIEVycmF0YSBS ZXBvcnRlZF0gUkZDODQ4NCAoNjAzMykNCj4NCj4gT24gTWFyIDMxLCAyMDIwLCBhdCAyOjAzIEFN LCBtb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tPG1haWx0bzptb2hhbWVkLmJvdWNhZGFpckBv cmFuZ2UuY29tPiB3cm90ZToNCj4gPiBJJ20gbm93IG1vcmUgcHV6emxlZCBhYm91dCB0aGUgaW50 ZW50IG9mIHRoZSBkb2N1bWVudCB3aXRoIHJlZ2FyZHMNCj4gdG8gcmVkaXJlY3Rpb246DQo+DQo+ IFRoYXQncyBmaW5lLCBhbmQgeW91IGFyZSBub3QgYWxvbmUuIEJ1dCB0aGUgcHJvcGVyIHJlc29s dXRpb24gb2YgdGhhdA0KPiBwdXp6bGVtZW50IGlzIG5vdCBhbiBlcnJhdHVtLCBpdCBpcyBhIGRv Y3VtZW50IHVwZGF0ZS4NCj4NCj4gLS1QYXVsIEhvZmZtYW4NCg0KLS0NCkFkZCBtYWlsaW5nIGxp c3QNCkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCg== --_000_9ebcb06aa4b8486cbd71464e750a7caeOPEXCAUBM24corporateadr_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAgMDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3Nl LTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNv Tm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQ YXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1h cmdpbi1yaWdodDowY207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0 Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Iiwi c2VyaWYiOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcwLjg1 cHQgNzAuODVwdCA3MC44NXB0IDcwLjg1cHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlz dC1pZDoxNTY1MDA1OTQ7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxh dGUtaWRzOjE4Njk1MDU4NTggLTE1NTg1NDE1OTQgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkg Njc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6 bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDoyOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDA6bGV2 ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyIs InNlcmlmIjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLCJzZXJpZiI7fQ0K QGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Iiwic2VyaWYiO30NCkBsaXN0IGwwOmxl dmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDo2MDgyNDIxMTc7DQoJbXNvLWxpc3QtdHlwZTpoeWJy aWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjUxODA1MjY2MiAtMTU1ODU0MTU5NCA2NzY5ODY5 MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2 NzY5ODY5Mzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjI7DQoJbXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7DQoJbXNvLWZhcmVhc3Qt Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Iiwic2VyaWYiO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZl bDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyIsInNlcmlmIjt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVs OA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLCJz ZXJpZiI7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyDQoJe21zby1saXN0LWlkOjE4MzQ2Mzk5NzU7 DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjEwODk3NDM5 MjAgLTE1NTg1NDE1OTQgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2 OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDI6bGV2ZWwxDQoJe21zby1s ZXZlbC1zdGFydC1hdDoyOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDI6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyIsInNlcmlmIjt9DQpAbGlz dCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDI6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLCJzZXJpZiI7fQ0KQGxpc3QgbDI6bGV2ZWw2 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Iiwic2VyaWYiO30NCkBsaXN0IGwyOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4t Ym90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssJnF1b3Q7c2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+SGkgQmVuLA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDssJnF1b3Q7c2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+QWxsIGdvb2QgcG9pbnRzLiBU aGFuayB5b3UuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OywmcXVvdDtzZXJpZiZx dW90Oztjb2xvcjojMUY0OTdEIj5XZSB1cGRhdGVkIHRoZSBkcmFmdCB0byB0YWtlIGludG8gYWNj b3VudCB5b3VyIGNvbW1lbnRzIGFuZCBzdWdnZXN0aW9uczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxm bzMiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OlN5bWJvbDtjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdu b3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3Nw YW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDs7Y29s b3I6IzFGNDk3RCI+V2UgbW92ZWQgdGhlIFNlcnZlciBQdXNoIHByb3Bvc2FsIHRvIGFuIGFwcGVu ZGl4LiBXZSBwcmVmZXIgdG8gaGF2ZSB0aGVyZSB0byBpbGx1c3RyYXRlIGhvdyB0aGF0IGtpbmQg b2YgZGVzaWduIGlzIGNvbXBsZXguIFdlIGFkZGVkIHNvbWUgdGV4dCB0byBleHBsYWluDQogdGhh dC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0OmwwIGxldmVsMSBsZm8zIj48IVtpZiAh c3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpT eW1ib2w7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+wrc8c3Bh biBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0Qi PldlIHN0aWxsIG1haW50YWluIOKAnE1VU1TigJ0gZm9yIHJldHVybmluZyBib3RoIEEvQUFBQSBp biBhIHJlZGlyZWN0IGVzcGVjaWFsbHkgd2hlbiB0aGUgRG9IIHNlcnZpY2UgaXMgYXZhaWxhYmxl IGluIGFub3RoZXIgbG9jYXRpb24uIFdlIG1haW50YWluIHRoYXQNCiBsYW5ndWFnZSBiZWNhdXNl IERvNTMgbWF5IG5vdCBiZSBwb3NzaWJsZSBpbiBzb21lIGNvbmZpZ3VyYXRpb25zIChhbiBleGFt cGxlIGlzIHByb3ZpZGUgaW4gdGhlIGRyYWZ0KS4gV2UgbWF5IHJldmlzaXQgdGhlIGxhbmd1YWdl IGFzIGEgZnVuY3Rpb24gb2YgaG93IHdlIHNvbHZlIHRoZSBpc3N1ZSB3ZSBkaXNjdXNzIGluIFNl Y3Rpb24gNi4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMyI+ PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6U3ltYm9sO2NvbG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUi PsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjoj MUY0OTdEIj5XZSBhbHNvIHVwZGF0ZWQgU2VjdGlvbiA2IHRvIGRpc2N1c3Mgd2h5IEFsdC1TdmMg aXMgbm90IGFuIG9wdGlvbiBpbiBzb21lIHJlZGlyZWN0IHNjZW5hcmlvcy4gV2UgYWxzbyBkZXNj cmliZSBhIHByb3Bvc2FsIHVzaW5nIEdFVCB0byBob3BlZnVsbHkgYXZvaWQNCiBzb21lIG9mIHRo ZSBpc3N1ZXMgeW91IHJhaXNlZC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0OmwwIGxl dmVsMSBsZm8zIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpTeW1ib2w7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1s aXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw Ow0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LCZxdW90O3NlcmlmJnF1 b3Q7O2NvbG9yOiMxRjQ5N0QiPldlIHdpbGwgc2VuZCBhIG5vdGUgdG8gaHR0cGJpcyBhbmQgZG5z b3AgV0dzIGZvciBtb3JlIGZlZWRiYWNrLCBidXQgSSBkbyB0aGluayB0aGF0IHNvbWUgYXNwZWN0 cyBkaXNjdXNzZWQgaW4gdGhlIGRyYWZ0IGJlbG9uZyB0byBhZGQgYXMgd2VsbC4NCjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LCZxdW90O3Nlcmlm JnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0Qi PlRoZSB1cGRhdGVkIHZlcnNpb24gaXMgYXZhaWxhYmxlIGF0Og0KPGEgaHJlZj0iaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWJ0dy1hZGQtcmZjODQ4NC1jbGFyaWZpY2F0aW9uLTAx Ij5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYnR3LWFkZC1yZmM4NDg0LWNsYXJp ZmljYXRpb24tMDE8L2E+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OywmcXVvdDtz ZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5Db21tZW50cyBhbmQgc3VnZ2VzdGlvbnMgYXJlIG1v cmUgdGhhbiB3ZWxjb21lLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LCZxdW90O3Nl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjojMUY0 OTdEIj5NZWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OywmcXVvdDtzZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVl IDEuNXB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBj bSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlm JnF1b3Q7Ij5EZSZuYnNwOzo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4g QmVuIFNjaHdhcnR6IFttYWlsdG86YmVtYXNjQGdvb2dsZS5jb21dDQo8YnI+DQo8Yj5FbnZvecOp Jm5ic3A7OjwvYj4gc2FtZWRpIDExIGF2cmlsIDIwMjAgMDI6MjM8YnI+DQo8Yj7DgCZuYnNwOzo8 L2I+IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE48YnI+DQo8Yj5DYyZuYnNwOzo8L2I+IFBhdWwg SG9mZm1hPC9zcGFuPjxzcGFuIGxhbmc9IkZSIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+bjsgTXVy cmF5IFMuIEt1Y2hlcmF3eTsgZG9oQGlldGYub3JnOyBBREQgTWFpbGluZyBsaXN0IChhZGRAaWV0 Zi5vcmcpOyBCYXJyeSBMZWliYTxicj4NCjxiPk9iamV0Jm5ic3A7OjwvYj4gUmU6IFtBZGRdIGRy YWZ0LWJ0dy1hZGQtcmZjODQ4NC1jbGFyaWZpY2F0aW9uICh3YXMgUkU6IFtEb2hdIFtFeHRdIFtU ZWNobmljYWwgRXJyYXRhIFJlcG9ydGVkXSBSRkM4NDg0ICg2MDMzKSk8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gdmVudWU6IEFERCBpcyBu b3QgY2hhcnRlcmVkIGZvciBjb3JlIHByb3RvY29sIGRldmVsb3BtZW50IHdvcmssIGFuZCBEb0gg aXMgc2h1dHRpbmcgZG93biwgc28gSSB0aGluayB0aGUgY29ycmVjdCB2ZW51ZSBpcyBwcm9iYWJs eSBETlNPUC4mbmJzcDsgSG93ZXZlciwgeW91IHNob3VsZCBhbHNvIGdldCBpbnB1dCBmcm9tIEhU VFBCSVMsIHdoZXJlIHRoZXJlIGlzIGV4cGVydGlzZSBvbiBIVFRQIHNlbWFudGljcy48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIHRoZSBkcmFmdDo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogVGhlIGRy YWZ0IGludHJvZHVjZXMgbmV3IE1VU1QtbGV2ZWwgcmVxdWlyZW1lbnRzLCBzbyBJIGRvbid0IHRo aW5rIGl0IGNhbiByZWFzb25hYmx5IGJlIGNhbGxlZCBhIGNsYXJpZmljYXRpb24uJm5ic3A7IFNl bmRpbmcgRE5TIHJlY29yZHMgaW4gYSAzWFggcmVzcG9uc2UgYm9keSwgZm9yIGV4YW1wbGUsIGlz IGEgbm92ZWwgY29uc3RydWN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4qIEkgd291bGQgcmVtb3ZlIHRoZSBIVFRQLzIgUFVTSCB2ZXJz aW9uIG9mIHRoZSBwcm9wb3NhbCwgd2hpY2ggc2VlbXMgbW9yZSBjb21wbGljYXRlZCB3aXRob3V0 IG11Y2ggYmVuZWZpdCwgYW5kIEkgd291bGQgbWFrZSB0aGUgM1hYIHJlc3BvbnNlIGJvZHkgb3B0 aW9uYWwuJm5ic3A7IElmIHRoZSByZXNwb25zZSBib2R5IGlzIGFic2VudCwgY2xpZW50cyBTSE9V TEQgcmVzb2x2ZSB0aGUgdGFyZ2V0IGhvc3RuYW1lIGluDQogdGhlIHNhbWUgd2F5IHRoYXQgdGhl eSByZXNvbHZlZCB0aGUgb3JpZ2luYWwgRG9IIHNlcnZlciBob3N0bmFtZSwgb3IgZmFpbCBpZiB0 aGlzIGlzIG5vdCBwb3NzaWJsZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+KiBJIHRoaW5rIFJGQyA4NDg0IGlzIHByZXR0eSBjbGVhciBvbiB0 aGUgbWFpbiBwb2ludCBpbiBxdWVzdGlvbjogSFRUUCByZWRpcmVjdGlvbiBhcHBsaWVzIGluIHRo ZSB1c3VhbCB3YXksJm5ic3A7d2hhdGV2ZXIgdGhhdCBtaWdodCBiZS4mbmJzcDsgRG9uJ3QgdHJ1 c3QgRG9IIFVSSXMgZnJvbSBzdHJhbmdlcnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogSW4gcHJhY3RpY2UsIHJlZGlyZWN0aW9uIG1heSBo YXZlIGJlZW4gZ2l2ZW4gbGl0dGxlIGF0dGVudGlvbiBiZWNhdXNlIGl0IGRvZXNuJ3QgbmVjZXNz YXJpbHkgZ2l2ZSB1cyB0aGUgYmVoYXZpb3Igd2Ugd2FudC4mbmJzcDsgRm9yIGEgR0VUIHJlcXVl c3QgKHdoZXJlIERvSCBlbmNvZGVzIHRoZSBxdWVyeSBpbiB0aGUgVVJJKSwgYSByZWRpcmVjdCBv bmx5IGFwcGxpZXMgdG8gdGhhdCBzcGVjaWZpYyBxdWVyeS4mbmJzcDsgQQ0KIHNlcnZlciB0aGF0 IGlzIHRyeWluZyB0byByZWZlciB1c2VycyB0byBhIGRpZmZlcmVudCBzZXJ2ZXIgd291bGQgaGF2 ZSB0byByZWRpcmVjdCBlYWNoIERvSCBHRVQgaW5kaXZpZHVhbGx5IC0tIG5vdCBhIHJlY2lwZSBm b3IgZ29vZCBwZXJmb3JtYW5jZS4mbmJzcDsgUGVybWFuZW50IHJlZGlyZWN0cyBmb3IgYWxsIHRo b3NlIHF1ZXJpZXMgd291bGQgYWxzbyBibG9hdCB0aGUgY2xpZW50J3MgSFRUUCBjYWNoZS4mbmJz cDsgQWx0LVN2YywgaW4gY29udHJhc3QsIHdvdWxkDQogYWxsb3cmbmJzcDtyZWxvY2F0aW5nIHRo ZSB3aG9sZSBvcmlnaW4sIHdoaWNoIHNlZW1zIGNsb3NlciB0byB0aGUgaW50ZW5kZWQgYmVoYXZp b3IuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkZvciBQT1NULCBhbGwgcXVlcmllcyBzaGFyZSBhIFVSSSwgc28gcGVybWFuZW50IHJlZGlyZWN0 cyBtaWdodCB3b3JrIE9LLiZuYnNwOyBIb3dldmVyLCBjbGllbnRzIGFyZSBwZXJtaXR0ZWQgdG8g Y29udmVydCBQT1NUIHRvIEdFVCAoZHJvcHBpbmcgdGhlIGJvZHkpIHdoZW4gZW5jb3VudGVyaW5n IGEgMzAyIHJlZGlyZWN0LCBzbyBvbmx5IGEgMzA4IHdpbGwgd29yay4mbmJzcDsgSG93ZXZlciwg YXMgbm90ZWQgaW4gUkZDIDcyMzg6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7JnF1b3Q7aW5pdGlhbCB1c2Ugb2Ygc3RhdHVz IGNvZGUgMzA4IHdpbGwgYmUgcmVzdHJpY3RlZCB0byBjYXNlczxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7d2hlcmUgdGhlIHNlcnZlciBo YXMgc3VmZmljaWVudCBjb25maWRlbmNlIGluIHRoZSBjbGllbnQnczxicj4NCiZuYnNwOyAmbmJz cDt1bmRlcnN0YW5kaW5nIHRoZSBuZXcgY29kZSZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGVyaGFwcyBzdXBwb3J0IGZvciAzMDggaXMgbm93IHN1 ZmZpY2llbnRseSB1bml2ZXJzYWwgdGhhdCBEb0ggc2VydmVycyBjYW4gc2FmZWx5IHJlbHkgb24g aXQsIGJ1dCBJIHdvdWxkIHJlY29tbWVuZCBjaGVja2luZyB3aXRoIEhUVFBCSVMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogRGVzcGl0ZSBh bGwgdGhlc2UgY29uY2VybnMsIEknbSBnbGFkIHRvIHNlZSBpbnRlcmVzdCBpbiBpbXByb3Zpbmcg RG9ILCBhbmQgSSBhZ3JlZSB0aGF0IGEgd2F5IHRvIG9mZmVyIGFuIHVwZGF0ZWQgRG9IIFVSSSB0 ZW1wbGF0ZSB3b3VsZCBiZSBuaWNlLiZuYnNwOyBJZiB3ZSBjYW4ndCBmaW5kIGFuIGVsZWdhbnQg c29sdXRpb24gdXNpbmcgcmVkaXJlY3RzLCB3ZSBjYW4gZmluZCBhbm90aGVyIHdheSwgZS5nLiBh bg0KIEhUVFAgcmVzcG9uc2UgaGVhZGVyIGNvbnRhaW5pbmcgdGhlIG5ldyB0ZW1wbGF0ZS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJp LCBBcHIgMTAsIDIwMjAgYXQgNDoyMiBBTSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1vaGFtZWQuYm91 Y2FkYWlyQG9yYW5nZS5jb20iPm1vaGFtZWQuYm91Y2FkYWlyQG9yYW5nZS5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkhpIFBhdWwsIEJhcnJ5LCBhbGwsPGJyPg0KPGJyPg0KKCYjNDM7YWRkIHdnIGFzIEkg Z3Vlc3MgdGhlIGRyYWZ0IHNob3VsZCBiZSBkaXNjdXNzZWQgdGhlcmUpPGJyPg0KPGJyPg0KV2Ug cHJlcGFyZWQgYSBkb2N1bWVudCB0byBjbGFyaWZ5IHRoZSByZWRpcmVjdGlvbiBpc3N1ZTogPGEg aHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtYnR3LWFkZC1yZmM4 NDg0LWNsYXJpZmljYXRpb24vIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1idHctYWRkLXJmYzg0ODQtY2xhcmlmaWNhdGlvbi88L2E+IDxi cj4NCjxicj4NClRoZSBkb2N1bWVudCBzcGVjaWZpZXMgYWxzbyBob3cgcmVkaXJlY3Rpb24gY2Fu IGJlIGRvbmUgaW4gRG9ILiA8YnI+DQo8YnI+DQpDaGVlcnMsPGJyPg0KTWVkPGJyPg0KPGJyPg0K Jmd0OyAtLS0tLU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS08YnI+DQomZ3Q7IERlJm5ic3A7OiBQYXVs IEhvZmZtYW4gW21haWx0bzo8YSBocmVmPSJtYWlsdG86cGF1bC5ob2ZmbWFuQGljYW5uLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPnBhdWwuaG9mZm1hbkBpY2Fubi5vcmc8L2E+XTxicj4NCiZndDsgRW52 b3nDqSZuYnNwOzogbWFyZGkgMzEgbWFycyAyMDIwIDE2OjQ4PGJyPg0KJmd0OyDDgCZuYnNwOzog Qk9VQ0FEQUlSIE1vaGFtZWQgVEdJL09MTjxicj4NCiZndDsgQ2MmbmJzcDs6IDxhIGhyZWY9Im1h aWx0bzpkb2hAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5kb2hAaWV0Zi5vcmc8L2E+OyBEYXZp ZCBMYXdyZW5jZTsgQmVuIFNjaHdhcnR6OyBQYXRyaWNrIE1jTWFudXM7PGJyPg0KJmd0OyBNdXJy YXkgUy4gS3VjaGVyYXd5OyBCYXJyeSBMZWliYTsgUkZDIEVkaXRvcjxicj4NCiZndDsgT2JqZXQm bmJzcDs6IFJlOiBbRG9oXSBbRXh0XSBbVGVjaG5pY2FsIEVycmF0YSBSZXBvcnRlZF0gUkZDODQ4 NCAoNjAzMyk8YnI+DQomZ3Q7IDxicj4NCiZndDsgT24gTWFyIDMxLCAyMDIwLCBhdCAyOjAzIEFN LCA8YSBocmVmPSJtYWlsdG86bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPg0KbW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbTwvYT4gd3JvdGU6PGJyPg0KJmd0 OyAmZ3Q7IEknbSBub3cgbW9yZSBwdXp6bGVkIGFib3V0IHRoZSBpbnRlbnQgb2YgdGhlIGRvY3Vt ZW50IHdpdGggcmVnYXJkczxicj4NCiZndDsgdG8gcmVkaXJlY3Rpb246PGJyPg0KJmd0OyA8YnI+ DQomZ3Q7IFRoYXQncyBmaW5lLCBhbmQgeW91IGFyZSBub3QgYWxvbmUuIEJ1dCB0aGUgcHJvcGVy IHJlc29sdXRpb24gb2YgdGhhdDxicj4NCiZndDsgcHV6emxlbWVudCBpcyBub3QgYW4gZXJyYXR1 bSwgaXQgaXMgYSBkb2N1bWVudCB1cGRhdGUuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IC0tUGF1bCBI b2ZmbWFuPGJyPg0KPGJyPg0KLS0gPGJyPg0KQWRkIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9 Im1haWx0bzpBZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BZGRAaWV0Zi5vcmc8L2E+PGJy Pg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwv YT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_9ebcb06aa4b8486cbd71464e750a7caeOPEXCAUBM24corporateadr_-- From nobody Fri Apr 24 09:45:50 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5C863A0F69 for ; Fri, 24 Apr 2020 09:45:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LfwpN3tVUft4 for ; Fri, 24 Apr 2020 09:45:41 -0700 (PDT) Received: from ppa3.lax.icann.org (ppa3.lax.icann.org [192.0.33.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FC433A0F47 for ; Fri, 24 Apr 2020 09:45:32 -0700 (PDT) Received: from PFE112-CA-1.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) by ppa3.lax.icann.org (8.16.0.42/8.16.0.42) with ESMTPS id 03OGjVvM025384 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Fri, 24 Apr 2020 16:45:31 GMT Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 24 Apr 2020 09:45:29 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1497.006; Fri, 24 Apr 2020 09:45:29 -0700 From: Paul Hoffman To: ADD Mailing list Thread-Topic: Drafts on upgrading stub-to-resolver communication to encrypted Thread-Index: AQHWGlfDK8eYheQJ4EC4wbCFDoXkXg== Date: Fri, 24 Apr 2020 16:45:29 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: multipart/signed; boundary="Apple-Mail=_038EFDFC-19CE-4149-9D00-6C2A210D8231"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-24_08:2020-04-24, 2020-04-24 signatures=0 Archived-At: Subject: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 16:45:50 -0000 --Apple-Mail=_038EFDFC-19CE-4149-9D00-6C2A210D8231 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Greetings again. We have just published two drafts, = draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address the = easier problem that this WG wanted to tackle, namely how a stub can = upgrade from plain DNS to encrypted DNS for the resolver it is currently = using. The method in draft-pp-add-stub-upgrade is quite simple, but it = includes all of the variables that we have heard in the discussion over = the last year. The format in draft-pp-add-resinfo is the minimum needed = for stub upgrade, but will also possibly be useful for the more = difficult discovery protocols being discussed in the WG. Please let us know if you find these documents useful for the discussion = of direct upgrade instead of discovery. Also, please let us know if we = have missed any salient points. If so, we could ask the chairs to make = these into WG documents. --Paul Hoffman and Puneet Sood https://datatracker.ietf.org/doc/draft-pp-add-stub-upgrade/ Name: draft-pp-add-stub-upgrade Revision: 00 Title: Upgrading Communication from Stub Resolvers to DoT or = DoH Document date: 2020-04-24 Group: Individual Submission Pages: 7 Abstract: This document describes methods for a DNS stub resolver to upgrade its communications with a known recursive resolver to include encrytion using DoT or DoH. This protocol is designed for the scenario where the stub resolver already has the IP address of the recursive resolver. Other protocols under develpment address scenarios where the stub resolver wants to discover recursive resolvers that use DoT or DoH. This document does not cover such discovery. https://datatracker.ietf.org/doc/draft-pp-add-resinfo/ Name: draft-pp-add-resinfo Revision: 00 Title: DNS Resolver Information Self-publication Document date: 2020-04-24 Group: Individual Submission Pages: 9 Abstract: This document describes methods for DNS resolvers to self-publish information about themselves. The information is returned as a JSON object. The names in this object are defined in an IANA registry that allows for light-weight registration. Applications and operating systems can use the methods defined here to get the information from resolvers in order to make choices about how to send future queries to those resolvers. --Apple-Mail=_038EFDFC-19CE-4149-9D00-6C2A210D8231 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMjAwNDI0MTY0NTI5WjAvBgkqhkiG9w0BCQQxIgQgqRK9s7BnPd8NX48YdQsFZtiFgfpk LvpuAZfkwdBxzLswgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBACIwKzagwEWqQszlQ0zY+5X2jAEPOsipndQP39kJz1/n IG5Duj59JZe/FCweJ+GTET8ZT7EWd3kWAJzRfhehFVXPfGDk8d6XJfJQYAz1OWMnZlZvUoElfpCv IWYe3+EVZh0+VlVxehELEDJsxugMMy+cwb23zVx2GWl7lVyk2DbVPeogpex3vLeVHkiAalhtW5bu zjpNi1ycoJgJOHwCbd72URiOIzf2t05LBXDnQUbKLdqWP2Kvqe7BGXL7NKiDpl0VDJLJDVBh2I81 JnRUsx0QJBd2sAG/NUQKCt7RaxbyfwNidGYMKK9kDPUrZu22vXUkJAFCe0svKzFPg2QzgEIAAAAA AAA= --Apple-Mail=_038EFDFC-19CE-4149-9D00-6C2A210D8231-- From nobody Fri Apr 24 11:09:19 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6D233A1155 for ; Fri, 24 Apr 2020 11:09:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1ukafuOGQ6c for ; Fri, 24 Apr 2020 11:09:15 -0700 (PDT) Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83DCB3A1151 for ; Fri, 24 Apr 2020 11:09:15 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id j2so12023762wrs.9 for ; Fri, 24 Apr 2020 11:09:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EpTGwIqDLZdt9DjcPKbmoTmV93rJUfVsG2+cTvzb57s=; b=K2s3ahSoEgAWVHoTq9dHtZCEtvsS7KOhiXIkkFwSmk2Fp8YR31hAOZHHRmWk+xK81o ya8ApmQ6j6D4jdi9bY651DYn/ss/JyG0ieDUey+yvdFq1F0bDx6BSt72qigeVphUsay+ zFrrGpsF6FI/QxUhQfoZh8q3yZqJ+S9v3b3CfY9LEm3Fmcf1I4jxrHorH+WiCJZHKOrH W4OdqOg45luN7FOOn0T7gjUH+ZS75iIBz+n0EiY7pJ4nQcQgcVKa/MnkbMTG7GAvC62s i1ZN+KPqXzo3gdNgy/vMV97dMMHT60NNofyaXct3a5ZN5W47Dotv2658aYGLxfEi79vy 40iA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EpTGwIqDLZdt9DjcPKbmoTmV93rJUfVsG2+cTvzb57s=; b=U2xOVHp6boP4D98G5BktpD/IDGzEgaXaLxgVDIq4IZYC92l59VwXA3Y27IVSL2QqOs 5KEtNzgDG4h+oUJpFkbRhleEshpjPsxb54h1pFaOgUrs1pcKY7lz1KV6uTpKG0RitAzJ QGh6XYrifON2z6eO9qEVMCe+zRL3ZTaNCcT5MGWQCD3ZmmTS5DQ6oBCqUXgyorYS5kaw j37nIl3z/c3L2JYUnepBT7xqgtqT2mwfc/ebnLIfDjT9WunZ+DKH260AyhKwdt81QjCl N2r9cRDGLEZ7IeSwdTDMu6kWKe4djPCbRUc/0KSjwlU2Pd9v/qOfWSx8MxnJVwyU9j44 5TDQ== X-Gm-Message-State: AGi0PuYTgC9plc9oLj3fQpGiQqfCRWPCXSE4wTq6rY2W7E0vHNgtxMSu 2YBwGatN90z96wJ+JT9dnDfERTWdZzctC0zhq9L3c9jR X-Google-Smtp-Source: APiQypL1lBV8S9FiJDAzufmaeY6sxiQ3gZLO8jmKZvjOa+LCBDhRcVKv+5Lxcz0TPy/ECtESjnpGnGn+ZKsOwr9m0Xk= X-Received: by 2002:adf:cd12:: with SMTP id w18mr12642274wrm.177.1587751753594; Fri, 24 Apr 2020 11:09:13 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Fri, 24 Apr 2020 14:09:01 -0400 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000004cd63b05a40d4339" Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 18:09:18 -0000 --0000000000004cd63b05a40d4339 Content-Type: multipart/alternative; boundary="0000000000004401a505a40d4385" --0000000000004401a505a40d4385 Content-Type: text/plain; charset="UTF-8" Thanks for the updated drafts. I think RESINFO is the most promising path for resolver upgrade, and I'd like to see it implemented. The one major change I suggest is to remove the entire HTTPS mechanism from the RESINFO draft. This mechanism creates a great deal of complexity, doesn't follow good practices for HTTPS, and doesn't obviously enable any additional use cases. Having multiple competing mechanisms also makes interoperability less likely. If "in-band" RESINFO proves insufficient, an HTTPS-based mechanism could always be added in a later draft. On Fri, Apr 24, 2020 at 12:46 PM Paul Hoffman wrote: > Greetings again. We have just published two drafts, > draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address the easier > problem that this WG wanted to tackle, namely how a stub can upgrade from > plain DNS to encrypted DNS for the resolver it is currently using. The > method in draft-pp-add-stub-upgrade is quite simple, but it includes all of > the variables that we have heard in the discussion over the last year. The > format in draft-pp-add-resinfo is the minimum needed for stub upgrade, but > will also possibly be useful for the more difficult discovery protocols > being discussed in the WG. > > Please let us know if you find these documents useful for the discussion > of direct upgrade instead of discovery. Also, please let us know if we have > missed any salient points. If so, we could ask the chairs to make these > into WG documents. > > --Paul Hoffman and Puneet Sood > > https://datatracker.ietf.org/doc/draft-pp-add-stub-upgrade/ > > Name: draft-pp-add-stub-upgrade > Revision: 00 > Title: Upgrading Communication from Stub Resolvers to DoT or DoH > Document date: 2020-04-24 > Group: Individual Submission > Pages: 7 > > Abstract: > This document describes methods for a DNS stub resolver to upgrade > its communications with a known recursive resolver to include > encrytion using DoT or DoH. This protocol is designed for the > scenario where the stub resolver already has the IP address of the > recursive resolver. > > Other protocols under develpment address scenarios where the stub > resolver wants to discover recursive resolvers that use DoT or DoH. > This document does not cover such discovery. > > > https://datatracker.ietf.org/doc/draft-pp-add-resinfo/ > > Name: draft-pp-add-resinfo > Revision: 00 > Title: DNS Resolver Information Self-publication > Document date: 2020-04-24 > Group: Individual Submission > Pages: 9 > > Abstract: > This document describes methods for DNS resolvers to self-publish > information about themselves. The information is returned as a JSON > object. The names in this object are defined in an IANA registry > that allows for light-weight registration. Applications and > operating systems can use the methods defined here to get the > information from resolvers in order to make choices about how to send > future queries to those resolvers. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000004401a505a40d4385 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the updated drafts.=C2=A0 I think RESINFO is th= e most promising path for resolver upgrade, and I'd like to see it impl= emented.

The=C2=A0one major change I suggest is to remov= e the entire HTTPS mechanism from the RESINFO draft.=C2=A0 This mechanism c= reates a great deal of complexity, doesn't follow good practices for HT= TPS, and doesn't obviously enable any additional use cases.=C2=A0 Havin= g multiple competing mechanisms also makes interoperability less likely.

If "in-band" RESINFO proves insufficient, = an HTTPS-based mechanism could always be added in a later draft.

On Fr= i, Apr 24, 2020 at 12:46 PM Paul Hoffman <paul.hoffman@icann.org> wrote:
Greetings again. We have just published t= wo drafts, draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address t= he easier problem that this WG wanted to tackle, namely how a stub can upgr= ade from plain DNS to encrypted DNS for the resolver it is currently using.= The method in draft-pp-add-stub-upgrade is quite simple, but it includes a= ll of the variables that we have heard in the discussion over the last year= . The format in draft-pp-add-resinfo is the minimum needed for stub upgrade= , but will also possibly be useful for the more difficult discovery protoco= ls being discussed in the WG.

Please let us know if you find these documents useful for the discussion of= direct upgrade instead of discovery. Also, please let us know if we have m= issed any salient points. If so, we could ask the chairs to make these into= WG documents.

--Paul Hoffman and Puneet Sood

https://datatracker.ietf.org/doc/draft-pp= -add-stub-upgrade/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-stub-upgrade
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Upgrading Communication from Stub = Resolvers to DoT or DoH
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7

Abstract:
=C2=A0 This document describes methods for a DNS stub resolver to upgrade =C2=A0 its communications with a known recursive resolver to include
=C2=A0 encrytion using DoT or DoH.=C2=A0 This protocol is designed for the<= br> =C2=A0 scenario where the stub resolver already has the IP address of the =C2=A0 recursive resolver.

=C2=A0 Other protocols under develpment address scenarios where the stub =C2=A0 resolver wants to discover recursive resolvers that use DoT or DoH.<= br> =C2=A0 This document does not cover such discovery.


https://datatracker.ietf.org/doc/draft-pp-add-= resinfo/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-resinfo
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS Resolver Information Self-publ= ication
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9

Abstract:
=C2=A0 This document describes methods for DNS resolvers to self-publish =C2=A0 information about themselves.=C2=A0 The information is returned as a= JSON
=C2=A0 object.=C2=A0 The names in this object are defined in an IANA regist= ry
=C2=A0 that allows for light-weight registration.=C2=A0 Applications and =C2=A0 operating systems can use the methods defined here to get the
=C2=A0 information from resolvers in order to make choices about how to sen= d
=C2=A0 future queries to those resolvers.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000004401a505a40d4385-- --0000000000004cd63b05a40d4339 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAGuEkclHdvQz4ddwMbsMFgwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDAxMDcwODIyMjJaFw0yMDA3MDUwODIyMjJaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwrwIVY3rOZp1Papu Yl53bMQ2H713K9788lbE9itKEL7tJAJO7GqZGRbfxPUVRRDYPntAf+j0JZZOvf9Ye6uN12SNW+v1 V0o5YeXtXMpNOkprr0v0v7qc80yhbq8RIIiX4usDJwuDGbcL/VKnlCTDPRp+VWUB8rkaqObapi/F BGiPWXBqiT36W5opr6eJjUHuGiqzmK/1lCXMZSn6n3wkkbnonFsF5G4kfie+n/DDNd1hlqd06bzB rCnToS+BV/Y9BroXiOjVWJnMe/8Rce7zA8Dzr0kU+gacBArnMiDyCvUGjngbASU7VaIPJBc/zBzI L5QoeUAfgEJcGvFIEJUUIwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQU+WKCBtTdknJDbiAjMsikOsbLHoAwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQA2eHjHcJ8kaiqDQGv7TdNEBFiDI8omlzpnnuQFciHkWhkfi3mQwuuZ IQIHd+JNpV0TQ8TqMNAr4YSPWOjwTd3UNxm+qghV3KC9j/Ygq39OzUlqxWv2lFH8mGFpbview2GI xZWXTCRbeod3ZevhC0lOUVVx4NCHe5yWSwjEpZHUilSnjyqN7ssC0eYQBylFOf2xVxu1JB8Xewgw Vk/DeOzsapxxjiuw2UZsDZbtVJvEx/C34GkACLR4Lm0k6O5ujAiDBkyy2nklxLhmKb9fyiH51B3j oRE8y99FJOCHoye9E/P2tK12x9w9ZeF07eWAdX3OkhTne1DitwLidojuyFm9MYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhABrhJHJR3b0M+HXcDG7DBYMA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCB+rdTPRJBJOZLjH1d+J/eeGNUN0aQ7Wndnjb5z/yg7zjAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA0MjQxODA5MTRaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAktEx3+aeHsSaIIZIS2Xti7KiGFengtfQAvLzTNksjvonhTIe5I2HfOXJOMtq6y/u02JhgA7g 9S3n3YavSmUW30UdfJ8/z1apVweqiEhA23aVHPSDZhResVGl8IHV0UyiEtLroCEu3RljHaIQsOBS NyA1ukv1OxZlKITj4wpQUwp0uq1T3yMzRxwiBtG0PPmN6Qk/HS3DkHrqMaioqlTFJu0EUq+6aGMu 8Wansw+p4HDvg+g/FGwSc0KvAJoJz7PI6Ulzl8h52/VFcAjSXxD4UfnBWwoPhTT0r+biSQwceGcy idjWAdJHn6R9DVr4NG0R/oqhQt5qE4BWOwxpx6yKhg== --0000000000004cd63b05a40d4339-- From nobody Fri Apr 24 11:39:44 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61EE33A0860 for ; Fri, 24 Apr 2020 11:39:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id shXmQZKLcEC4 for ; Fri, 24 Apr 2020 11:39:34 -0700 (PDT) Received: from ppa5.dc.icann.org (ppa5.dc.icann.org [192.0.46.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 363E83A0861 for ; Fri, 24 Apr 2020 11:39:24 -0700 (PDT) Received: from PFE112-CA-2.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) by ppa5.dc.icann.org (8.16.0.42/8.16.0.42) with ESMTPS id 03OIdKo6030688 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 24 Apr 2020 18:39:21 GMT Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 24 Apr 2020 11:39:18 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1497.006; Fri, 24 Apr 2020 11:39:18 -0700 From: Paul Hoffman To: Ben Schwartz CC: ADD Mailing list Thread-Topic: [Ext] [Add] Drafts on upgrading stub-to-resolver communication to encrypted Thread-Index: AQHWGmeppMeNpmlQsEy+0Y8tvSTcyA== Date: Fri, 24 Apr 2020 18:39:18 +0000 Message-ID: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: multipart/signed; boundary="Apple-Mail=_E69B0AD6-B418-4F7F-B2FF-B41EB454D19E"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-24_09:2020-04-24, 2020-04-24 signatures=0 Archived-At: Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 18:39:43 -0000 --Apple-Mail=_E69B0AD6-B418-4F7F-B2FF-B41EB454D19E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Apr 24, 2020, at 11:09 AM, Ben Schwartz = wrote: >=20 > Thanks for the updated drafts. I think RESINFO is the most promising = path for resolver upgrade, and I'd like to see it implemented. >=20 > The one major change I suggest is to remove the entire HTTPS mechanism = from the RESINFO draft. This mechanism creates a great deal of = complexity, doesn't follow good practices for HTTPS, and doesn't = obviously enable any additional use cases. Having multiple competing = mechanisms also makes interoperability less likely. The additional use case that was brought up in earlier work is that a = stub that wants to do DoH. - It does not need to know how to make requests for a new DNS RRtype - It can use HTTPS as it knows it - It can get a response that can be authenticated I understand the desire not to allow unauthenticated HTTPS because of = best practices. We can remove that from the draft, but then implementers = will likely go ahead and implement it anyway but without guidance about = the results. Note that we are only talking about unauthenticated HTTPS = *for this one use*, not in general. > If "in-band" RESINFO proves insufficient, an HTTPS-based mechanism = could always be added in a later draft. Some people said it was insufficient because of inability to = authenticate. --Paul Hoffman= --Apple-Mail=_E69B0AD6-B418-4F7F-B2FF-B41EB454D19E Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMjAwNDI0MTgzOTE4WjAvBgkqhkiG9w0BCQQxIgQge0sSRzUURNkamVYIuORpATS9MeFt L0agdLWvEoZAsVgwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBAAs1dvUigXrqVukqaqQNiy1nT4alJH9nTJQLf+xtztVA MsyASQDb2OTSUpFKgRS/Pd/kyrZx4LCELJ+p6gWSF5K4TxR8xt06kkFvhAgURoW2CIa1gad99Lbo jvoD0Zkhmp1J/51nwbc2jGpwvmfHOAnmztzz47SRSApz3ncxzGCmGHo9dXUFBDLxptLE+e5FxSQb so8yAzrmKIbTldSgmsfjUgGCmGSNToLKANouYJKaXSqPqdlgg46rTfaZ4LSp18pFkPMuYrxgXmGr 7gIQfKIB7b/AiNLe+6/ylpgyJS19bbGFGb2tVoUuVPqihdI7xK1lkoIQb2wfQeEX20Ugb8EAAAAA AAA= --Apple-Mail=_E69B0AD6-B418-4F7F-B2FF-B41EB454D19E-- From nobody Fri Apr 24 11:54:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B19BD3A078F for ; Fri, 24 Apr 2020 11:54:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b-esx70RbBHC for ; Fri, 24 Apr 2020 11:54:32 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC1EE3A077F for ; Fri, 24 Apr 2020 11:54:31 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id y4so11053136ljn.7 for ; Fri, 24 Apr 2020 11:54:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wcOA2bLRxv9rlimobMq0xVI4sTKfoWUat8Qtw+usTTY=; b=TL8a52J76fUrs752BDcQGufivT2iuiHlcDSfBrs754M3sP3T6/ZXyCVpAEnnt7x9oV fyT+pQGun+uC4XyNDraVe5u2Kc6yEYvakl577Lrf/0zfGpFoZFH6AZODEz0plnHcmgHC KNdR08jvJRzhMaUNB2kSTZbhV3cyZwyMCdTEqBQyLIN6ObAe2hDQqWLUA8T39BCemv1Z xQI/YfHhFhRWGnJ3qR3gYAMMCSLjWK7oViyAT8jJhA9O5/8UwXPw48n7o2Msf/GlG2EP 4WEdinsSKy8N0Cq091t/OymqGzlsmtzVdWW/uYi0Hl3rESLA3cm8vv3iWAtaUcl+7LXA G0hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wcOA2bLRxv9rlimobMq0xVI4sTKfoWUat8Qtw+usTTY=; b=XPPGU0ijo536IX7u17wLwRJopow24euCs61d+6ZX6GF4h9FSLxBpn61mZL9bs9d2wi FCUDayy+TVKDXVV2NFUpF2EhfWrmK87ck7b00AfIWwdjMVA1/vrBFhFfoSYM4+M775V9 RIXfoAJ+i/OOdDWUjWYiw7omds9W7AhVXPlXlumi6U/1ChUipOZ8aZB5Z1kUhhOUjBX3 Ln614d/E2q5RjtrwXKURPrZxEGsClsT3VAlgrmEawQnZ9mA5wsJXmduMLpqnNLIDES7u jvYC6NdYvM77rJq0c/GowvDyUDg48b1G9f+yVtGGxVbFLTcZVFVzpn85e5uHEXWCsH9p cMPA== X-Gm-Message-State: AGi0PuYLXs1I+MqQmgJuuuDrpl8Lfyz72J0ve/bXpfeEfdYJ/P+kkKQ4 10Xr85S0YETtAohd2Xv6y8SBM/fvP2MJWSFKb0+k7Gp4Kxk= X-Google-Smtp-Source: APiQypI0Q7UdXs8fETPFRROJaS/xk5bwyHvoWYf5CtamOVuf6LGrn9XWW5kBQXRmEVgVMdS2pdNTZqZVQedeQKGsdR8= X-Received: by 2002:a2e:87d3:: with SMTP id v19mr6423814ljj.176.1587754470039; Fri, 24 Apr 2020 11:54:30 -0700 (PDT) MIME-Version: 1.0 References: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> In-Reply-To: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> From: Eric Rescorla Date: Fri, 24 Apr 2020 11:53:53 -0700 Message-ID: To: Paul Hoffman Cc: Ben Schwartz , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002d812e05a40de56f" Archived-At: Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 18:54:36 -0000 --0000000000002d812e05a40de56f Content-Type: text/plain; charset="UTF-8" On Fri, Apr 24, 2020 at 11:40 AM Paul Hoffman wrote: > On Apr 24, 2020, at 11:09 AM, Ben Schwartz 40google.com@dmarc.ietf.org> wrote: > > > > Thanks for the updated drafts. I think RESINFO is the most promising > path for resolver upgrade, and I'd like to see it implemented. > > > > The one major change I suggest is to remove the entire HTTPS mechanism > from the RESINFO draft. This mechanism creates a great deal of complexity, > doesn't follow good practices for HTTPS, and doesn't obviously enable any > additional use cases. Having multiple competing mechanisms also makes > interoperability less likely. > > The additional use case that was brought up in earlier work is that a stub > that wants to do DoH. > - It does not need to know how to make requests for a new DNS RRtype > - It can use HTTPS as it knows it > - It can get a response that can be authenticated > > I understand the desire not to allow unauthenticated HTTPS because of best > practices. We can remove that from the draft, but then implementers will > likely go ahead and implement it anyway but without guidance about the > results. Note that we are only talking about unauthenticated HTTPS *for > this one use*, not in general. > > > If "in-band" RESINFO proves insufficient, an HTTPS-based mechanism could > always be added in a later draft. > > Some people said it was insufficient because of inability to authenticate. > But the HTTPS mechanism is unauthenticated as well. And even if people do use IP certs, then they mechanism by which they get the IP is largely unauthenticated. I agree with Ben; this mechanism should be removed. -Ekr > --Paul Hoffman-- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002d812e05a40de56f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Apr 24, 2020 at 11:40 AM Paul= Hoffman <paul.hoffman@icann.o= rg> wrote:
40google.com@dmarc.ietf.org= > wrote:
>
> Thanks for the updated drafts.=C2=A0 I think RESINFO is the most promi= sing path for resolver upgrade, and I'd like to see it implemented.
>
> The one major change I suggest is to remove the entire HTTPS mechanism= from the RESINFO draft.=C2=A0 This mechanism creates a great deal of compl= exity, doesn't follow good practices for HTTPS, and doesn't obvious= ly enable any additional use cases.=C2=A0 Having multiple competing mechani= sms also makes interoperability less likely.

The additional use case that was brought up in earlier work is that a stub = that wants to do DoH.
- It does not need to know how to make requests for a new DNS RRtype
- It can use HTTPS as it knows it
- It can get a response that can be authenticated

I understand the desire not to allow unauthenticated HTTPS because of best = practices. We can remove that from the draft, but then implementers will li= kely go ahead and implement it anyway but without guidance about the result= s. Note that we are only talking about unauthenticated HTTPS *for this one = use*, not in general.

> If "in-band" RESINFO proves insufficient, an HTTPS-based mec= hanism could always be added in a later draft.

Some people said it was insufficient because of inability to authenticate.<= br>

But the HTTPS mechanism is unauthentica= ted as well. And even if people do use IP certs, then they mechanism by whi= ch they get the IP is largely unauthenticated.

I a= gree with Ben; this=C2=A0 mechanism should be removed.

=
-Ekr


--Paul Hoffman--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002d812e05a40de56f-- From nobody Fri Apr 24 12:08:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9788A3A07F7 for ; Fri, 24 Apr 2020 12:08:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=evequefou.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DEcSrl-2mIOt for ; Fri, 24 Apr 2020 12:08:31 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680105.outbound.protection.outlook.com [40.107.68.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B8823A07E3 for ; Fri, 24 Apr 2020 12:08:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dLUvMmcQR6nM+Ln7/KsrCdDPjQFnmThh8A1F5tlR6MGf8DoniJcqTZOrMxuD+Ac/E9wfnv4ES0TNZXCZJKX9b4EYUtrETthOHXwg8Wo4b+xLS09wD2K0Jcgeli/LpT2Xeng4h0NtT1NjkEEgnNM6y7j2IbYbmMiJKPV0X/J6HCXMlvfW3ZTqwWpVZfTHyhRGXK1jYahUgC3Kq040TwkUz9XdHYXl3pNavlAHnM7aYuJwuFl91FJOqsSsCSNRF+NWUaVot/q4nAQ9sZ3gYbGYcQCfR07rmj4YnLPNeBsOdim42kla+arU3QQmzyFt0qUlu1ZWs8DL+gP4R9ig/z0ytQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4/5UUmcR0ul3n8I93fL37wytzwM1F1FhXpJGGPmYiF0=; b=oC3KYARIa/PJmzt00MKl2DdXD94/vFqG45s4ff3Dz7UB1RBmyECX5Unrf4Q9zCbQ/ChPvw5isDzMvGYvb1NVORvoj7EFkuPpf/WXMVKztGnb3ckXR7Zn4G7Md13KVXXEIP5yq0g4IK4EC5bFc3hW101EH+RkTBD9cMHH6/7Fbts5FCDMw9iYzJZO39fAEHsCOKTY8lRh57ERXGb0v2iTkQXTbjsEMPXwxxU6eFGLu7egCTdiZ5jdWAbj520vCWQZ1C+33i/s4CfsI0yt4fxatFFSa7ROTnVmEpsql/E9OrOthrmG3QUsW7FFUqUsgq4gKjc3UzleWFhvgaE5An/0ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=evequefou.be; dmarc=pass action=none header.from=evequefou.be; dkim=pass header.d=evequefou.be; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evequefou.onmicrosoft.com; s=selector2-evequefou-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4/5UUmcR0ul3n8I93fL37wytzwM1F1FhXpJGGPmYiF0=; b=DvZ6aviplVoBFPGuTDaUGxArFH+vgT1Lro/wOVJvE4XAOcJ37SytRnMWKJYg7CAeoehVAEbq+vuMhy+sJiFv1qmh5tKqs9/5mdDdnHF5ekpYQvukIhCafet1wxKfwO2e+P3xpRP/h6SHSGDYF8Qvhv5siSwlRtPl+xaqwR197dU= Received: from CH2PR22MB2086.namprd22.prod.outlook.com (2603:10b6:610:8c::8) by CH2PR22MB1813.namprd22.prod.outlook.com (2603:10b6:610:87::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2921.29; Fri, 24 Apr 2020 19:08:28 +0000 Received: from CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::5d05:3b25:6510:2a3d]) by CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::5d05:3b25:6510:2a3d%3]) with mapi id 15.20.2937.020; Fri, 24 Apr 2020 19:08:28 +0000 From: Mike Bishop To: Ben Schwartz , Paul Hoffman CC: ADD Mailing list Thread-Topic: [Add] Drafts on upgrading stub-to-resolver communication to encrypted Thread-Index: AQHWGlfDK8eYheQJ4EC4wbCFDoXkXqiIki2AgAAJh5A= Date: Fri, 24 Apr 2020 19:08:27 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mbishop@evequefou.be; x-originating-ip: [2600:2b00:930c:7701:19c4:8529:2c6c:fb0a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: dad7489e-bc7d-47e0-ce80-08d7e882defa x-ms-traffictypediagnostic: CH2PR22MB1813: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 03838E948C x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR22MB2086.namprd22.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10019020)(39830400003)(396003)(366004)(136003)(346002)(376002)(66946007)(316002)(9686003)(52536014)(66446008)(55016002)(66556008)(6506007)(53546011)(64756008)(81156014)(8676002)(8936002)(71200400001)(966005)(7696005)(5660300002)(110136005)(86362001)(76116006)(33656002)(66476007)(2906002)(186003)(508600001)(4326008); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: evequefou.be does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: SppIEgRo9AKyug3P+tq+GSI66jvzi5OiDMU26+AwmloWg+LE4+MyIFdv4nfEkP4uI/zsnWdxm+FA43ODjtE2XMyZz6Z+Nigd8kKIoeWQalT8IwAbk1TH791h3acpLsyFACgplR0s796kJ0LoiLCa1fN2p9j0EaACCM9x7VD5sVCsMzkPOWaqRvrh76Yj/7GF4UzjOVAAdcEt4E0xLybsVu8UBZyJFPl9WZofURJxpgh0j6NkYrAUHSvH8R9aKdOGEGfPEzxhvY15NYRw0ZGYt/zsxJgP8mPiYJ0O3tlGvhWPwqeH8ZetKFTIm8eBW6VRQW0CmTYIGwXAhTBEX9CuH+8a97t94WCzDeix0XU08OV1JPr5HpTSuecOj93gbApvP1rgbl5r9BAnG0ijT6sZLhOF7PzMp1C2+t57F5Y9Lakk7lKqVjmAPv//s5cb/nDUInQp50sfBRgFWeH8YzKhruSZw95R2SkfruClWOQwxTgJwD9lM7exOo52mv7SjylWcSQSApksM0GyEELqimEdzQ== x-ms-exchange-antispam-messagedata: pGxVaURQsAQSErh1UAFKb+44iPJv2eNPYI9Kh0+CKIRjyCFYbOLmGBj1XgwL5TwwTk2CcMI1cY2l6O8TqBfciNumjQ+zSYbHU/oXoIjIcQmpNGKS0Kb6aDy4cNN17fEMDgp6dM7lZ7Q0UWee9MxccQbaAkmS01jgqtPZvpJ2dWXVzk3GINagWOmX2XirKTBaUilttOugFu6x3V1yrlmS6mFn9wsRaXA/rqatOybNR7UkyOsq+jN9UMmHD3c9Wrn1+KB1oteLyydYEHYLgsE33QDsUbK+1o9WsUyIUijfagQJr0JCyv1Z+5iMH3V35P9yev/yZgdITIt3wDxyhgIa/k2wVxI4qplwppoUN9ReGVB6+n1PXsNxbZwlD0D1i8GbjKSiOb4pbpj5Szd7RN77iZQ4Clt0M+D6+burLhedY+gUpENyFL5KjBTwNh60btBmO5wgbs6LKKXcr2HNX4nValmcZ38ME/ExLdTK43VF3ED6AzvvMG48kuGbQ7u7nhtRDt1e7/imzCArQK5zFHrYr2sFKgT6dwiYwdvP2970HbtRQzgvyg3PxFYIte65wLFejAOty7wsGZdgq8Gmhk7QcvyZucnQ32JSeROWAi9ZjPfGUTV5uC2wCyIGzAlSkHReFVuTE5fNp7yF25E6dt//i/haqW+M8aYwdbQIXKQ82Opq7gjZmXB2cjIS1+GYVSWGRwTzcKXI/nZdkRrzzPy4zDZioLnbKAZeHNPXlsiJGNgfomD45lVcaeewFby6cgFWzHONyGmG8z2V/ibHgXfdEm1npqyDhf4YG7MJYPTwTp3EK0wu0O6PMhKJKUZlm74mz70BHC6kfmOkuMV/k/FNy3eR7OWRiYTCNeA7mONN+2H8lW9marlbcEI6zzYihVaR x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR22MB2086EA09411710ABB3FAE13ADAD00CH2PR22MB2086namp_" MIME-Version: 1.0 X-OriginatorOrg: evequefou.be X-MS-Exchange-CrossTenant-Network-Message-Id: dad7489e-bc7d-47e0-ce80-08d7e882defa X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2020 19:08:27.9032 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +plmB/pViLhO/0rLPX0Ryg8PGltXWUQyCaFAN65XCY7D93WgzL7ThBcL1hcobIAlKCNs+h/FDcsJFo1V0SDpvw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR22MB1813 Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 19:08:35 -0000 --_000_CH2PR22MB2086EA09411710ABB3FAE13ADAD00CH2PR22MB2086namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhbHNvIHRoaW5rIFJFU0lORk8gbG9va3MgcHJvbWlzaW5nLiAgUHVibGlzaGluZyBEb1QgYW5k L29yIERvSCBlbmRwb2ludHMgb24gdGhhdCByZXNvbHZlciBzZWVtcyB0aGUgb2J2aW91cyBuZXh0 IHN0ZXAsIGFuZCBJIHdhcyBzdXJwcmlzZWQgdGhhdCB0aGUgZG9jdW1lbnQgZGlkbuKAmXQgZGVm aW5lIGVsZW1lbnRzIHRvIGRlY2xhcmUgdGhvc2UgY2FwYWJpbGl0aWVzLiAgVGhlIEROUyByZWNv cmQgcGllY2Ugc2VlbXMgdXNlZnVsIGZvciByZWN1cnNpdmUtdG8tYXV0aG9yaXRhdGl2ZSBhcyB3 ZWxsLiAgSWYgd2UgcGVybWl0IFJFU0lORk8gcmVjb3JkcyBmb3Igb3RoZXIgbmFtZXMsIGFuIGF1 dGhvcml0YXRpdmUgZGVsZWdhdGlvbiBjb3VsZCBwYXNzIGFsb25nIHRoZSBSRVNJTkZPIG9mIHRo ZSBuYW1lIHNlcnZlciBpdOKAmXMgZGVsZWdhdGluZyB0by4NCg0KVGhlIGF0dHJhY3Rpb25zIG9m IHRoZSBIVFRQUyBvcHRpb24gYXJlIG11bHRpcGxlLCBwYXJ0aWN1bGFybHkgZm9yIHN0dWItdG8t cmVzb2x2ZXIuICBPbmUgaXMgYSB3YXkgdG8gdmFsaWRhdGUgdGhlIGNvbm5lY3Rpb24gdG8gdGhl IHJlc29sdmVyIHRoYXQgeW91IHRoaW5rIHlvdeKAmXJlIHRhbGtpbmcgdG8sIG9mIGNvdXJzZS4g IFJlbW92aW5nIHRoZSBIVFRQUyBvcHRpb24gbWVhbnMgeW914oCZcmUganVzdCB0cnlpbmcgdGhl IGVuZHBvaW50cyBhbmQgc2VlaW5nIGlmIHRoZXkgd29yaywgd2hpY2ggaXMgc3ViLW9wdGltYWwu ICBGdXJ0aGVyLCBpZiAoYXMgc2VlbXMgbGlrZWx5KSB0aGUgRG9IIGVuZHBvaW50IGlzIGF0IHRo ZSBzYW1lIGhvc3QgYW5kIHBvcnQsIHlvdeKAmXZlIGFscmVhZHkgZXN0YWJsaXNoZWQgYW4gSFRU UFMgc2Vzc2lvbiB3aGljaCBjb3VsZCBiZSB1c2VkIHRvIHBlcmZvcm0gRG9ILCBhcyBkZXNjcmli ZWQgaW4gc3R1Yi11cGdyYWRlLiAgSXQgYWxzbyBlbmFibGVzIHlvdSB0byBwcm9iZSBhIERvSCBV UkkgeW914oCZdmUgcmVjZWl2ZWQgZWxzZXdoZXJlIHRvIGVuc3VyZSB0aGF0IHRoZSBzZXJ2ZXIg YWN0dWFsbHkgaW50ZW5kcyB0byBvZmZlciBEb0ggYXQgdGhhdCBVUkk7IHdoaWxlIHlvdeKAmWQg ZXhwZWN0IGEgRG9IIHJlcXVlc3QgdG8gZmFpbCBpZiBub3QsIGVzdGFibGlzaGluZyBjb25zZW50 IGlzIGdlbmVyYWxseSBhIGdvb2QgaWRlYS4gIEnigJlkIGJlIGluY2xpbmVkIHRvIGtlZXAgaXQs IGFsbCB0b2xkLg0KDQpGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYg T2YgQmVuIFNjaHdhcnR6DQpTZW50OiBGcmlkYXksIEFwcmlsIDI0LCAyMDIwIDI6MDkgUE0NClRv OiBQYXVsIEhvZmZtYW4gPHBhdWwuaG9mZm1hbkBpY2Fubi5vcmc+DQpDYzogQUREIE1haWxpbmcg bGlzdCA8YWRkQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBZGRdIERyYWZ0cyBvbiB1cGdyYWRp bmcgc3R1Yi10by1yZXNvbHZlciBjb21tdW5pY2F0aW9uIHRvIGVuY3J5cHRlZA0KDQpUaGFua3Mg Zm9yIHRoZSB1cGRhdGVkIGRyYWZ0cy4gIEkgdGhpbmsgUkVTSU5GTyBpcyB0aGUgbW9zdCBwcm9t aXNpbmcgcGF0aCBmb3IgcmVzb2x2ZXIgdXBncmFkZSwgYW5kIEknZCBsaWtlIHRvIHNlZSBpdCBp bXBsZW1lbnRlZC4NCg0KVGhlIG9uZSBtYWpvciBjaGFuZ2UgSSBzdWdnZXN0IGlzIHRvIHJlbW92 ZSB0aGUgZW50aXJlIEhUVFBTIG1lY2hhbmlzbSBmcm9tIHRoZSBSRVNJTkZPIGRyYWZ0LiAgVGhp cyBtZWNoYW5pc20gY3JlYXRlcyBhIGdyZWF0IGRlYWwgb2YgY29tcGxleGl0eSwgZG9lc24ndCBm b2xsb3cgZ29vZCBwcmFjdGljZXMgZm9yIEhUVFBTLCBhbmQgZG9lc24ndCBvYnZpb3VzbHkgZW5h YmxlIGFueSBhZGRpdGlvbmFsIHVzZSBjYXNlcy4gIEhhdmluZyBtdWx0aXBsZSBjb21wZXRpbmcg bWVjaGFuaXNtcyBhbHNvIG1ha2VzIGludGVyb3BlcmFiaWxpdHkgbGVzcyBsaWtlbHkuDQoNCklm ICJpbi1iYW5kIiBSRVNJTkZPIHByb3ZlcyBpbnN1ZmZpY2llbnQsIGFuIEhUVFBTLWJhc2VkIG1l Y2hhbmlzbSBjb3VsZCBhbHdheXMgYmUgYWRkZWQgaW4gYSBsYXRlciBkcmFmdC4NCg0KT24gRnJp LCBBcHIgMjQsIDIwMjAgYXQgMTI6NDYgUE0gUGF1bCBIb2ZmbWFuIDxwYXVsLmhvZmZtYW5AaWNh bm4ub3JnPG1haWx0bzpwYXVsLmhvZmZtYW5AaWNhbm4ub3JnPj4gd3JvdGU6DQpHcmVldGluZ3Mg YWdhaW4uIFdlIGhhdmUganVzdCBwdWJsaXNoZWQgdHdvIGRyYWZ0cywgZHJhZnQtcHAtYWRkLXN0 dWItdXBncmFkZSBhbmQgZHJhZnQtcHAtYWRkLXJlc2luZm8sIHRvIGFkZHJlc3MgdGhlIGVhc2ll ciBwcm9ibGVtIHRoYXQgdGhpcyBXRyB3YW50ZWQgdG8gdGFja2xlLCBuYW1lbHkgaG93IGEgc3R1 YiBjYW4gdXBncmFkZSBmcm9tIHBsYWluIEROUyB0byBlbmNyeXB0ZWQgRE5TIGZvciB0aGUgcmVz b2x2ZXIgaXQgaXMgY3VycmVudGx5IHVzaW5nLiBUaGUgbWV0aG9kIGluIGRyYWZ0LXBwLWFkZC1z dHViLXVwZ3JhZGUgaXMgcXVpdGUgc2ltcGxlLCBidXQgaXQgaW5jbHVkZXMgYWxsIG9mIHRoZSB2 YXJpYWJsZXMgdGhhdCB3ZSBoYXZlIGhlYXJkIGluIHRoZSBkaXNjdXNzaW9uIG92ZXIgdGhlIGxh c3QgeWVhci4uIFRoZSBmb3JtYXQgaW4gZHJhZnQtcHAtYWRkLXJlc2luZm8gaXMgdGhlIG1pbmlt dW0gbmVlZGVkIGZvciBzdHViIHVwZ3JhZGUsIGJ1dCB3aWxsIGFsc28gcG9zc2libHkgYmUgdXNl ZnVsIGZvciB0aGUgbW9yZSBkaWZmaWN1bHQgZGlzY292ZXJ5IHByb3RvY29scyBiZWluZyBkaXNj dXNzZWQgaW4gdGhlIFdHLg0KDQpQbGVhc2UgbGV0IHVzIGtub3cgaWYgeW91IGZpbmQgdGhlc2Ug ZG9jdW1lbnRzIHVzZWZ1bCBmb3IgdGhlIGRpc2N1c3Npb24gb2YgZGlyZWN0IHVwZ3JhZGUgaW5z dGVhZCBvZiBkaXNjb3ZlcnkuIEFsc28sIHBsZWFzZSBsZXQgdXMga25vdyBpZiB3ZSBoYXZlIG1p c3NlZCBhbnkgc2FsaWVudCBwb2ludHMuIElmIHNvLCB3ZSBjb3VsZCBhc2sgdGhlIGNoYWlycyB0 byBtYWtlIHRoZXNlIGludG8gV0cgZG9jdW1lbnRzLg0KDQotLVBhdWwgSG9mZm1hbiBhbmQgUHVu ZWV0IFNvb2QNCg0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcHAtYWRk LXN0dWItdXBncmFkZS8NCg0KTmFtZTogICAgICAgICAgIGRyYWZ0LXBwLWFkZC1zdHViLXVwZ3Jh ZGUNClJldmlzaW9uOiAgICAgICAwMA0KVGl0bGU6ICAgICAgICAgIFVwZ3JhZGluZyBDb21tdW5p Y2F0aW9uIGZyb20gU3R1YiBSZXNvbHZlcnMgdG8gRG9UIG9yIERvSA0KRG9jdW1lbnQgZGF0ZTog IDIwMjAtMDQtMjQNCkdyb3VwOiAgICAgICAgICBJbmRpdmlkdWFsIFN1Ym1pc3Npb24NClBhZ2Vz OiAgICAgICAgICA3DQoNCkFic3RyYWN0Og0KICBUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyBtZXRo b2RzIGZvciBhIEROUyBzdHViIHJlc29sdmVyIHRvIHVwZ3JhZGUNCiAgaXRzIGNvbW11bmljYXRp b25zIHdpdGggYSBrbm93biByZWN1cnNpdmUgcmVzb2x2ZXIgdG8gaW5jbHVkZQ0KICBlbmNyeXRp b24gdXNpbmcgRG9UIG9yIERvSC4gIFRoaXMgcHJvdG9jb2wgaXMgZGVzaWduZWQgZm9yIHRoZQ0K ICBzY2VuYXJpbyB3aGVyZSB0aGUgc3R1YiByZXNvbHZlciBhbHJlYWR5IGhhcyB0aGUgSVAgYWRk cmVzcyBvZiB0aGUNCiAgcmVjdXJzaXZlIHJlc29sdmVyLg0KDQogIE90aGVyIHByb3RvY29scyB1 bmRlciBkZXZlbHBtZW50IGFkZHJlc3Mgc2NlbmFyaW9zIHdoZXJlIHRoZSBzdHViDQogIHJlc29s dmVyIHdhbnRzIHRvIGRpc2NvdmVyIHJlY3Vyc2l2ZSByZXNvbHZlcnMgdGhhdCB1c2UgRG9UIG9y IERvSC4NCiAgVGhpcyBkb2N1bWVudCBkb2VzIG5vdCBjb3ZlciBzdWNoIGRpc2NvdmVyeS4NCg0K DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wcC1hZGQtcmVzaW5mby8N Cg0KTmFtZTogICAgICAgICAgIGRyYWZ0LXBwLWFkZC1yZXNpbmZvDQpSZXZpc2lvbjogICAgICAg MDANClRpdGxlOiAgICAgICAgICBETlMgUmVzb2x2ZXIgSW5mb3JtYXRpb24gU2VsZi1wdWJsaWNh dGlvbg0KRG9jdW1lbnQgZGF0ZTogIDIwMjAtMDQtMjQNCkdyb3VwOiAgICAgICAgICBJbmRpdmlk dWFsIFN1Ym1pc3Npb24NClBhZ2VzOiAgICAgICAgICA5DQoNCkFic3RyYWN0Og0KICBUaGlzIGRv Y3VtZW50IGRlc2NyaWJlcyBtZXRob2RzIGZvciBETlMgcmVzb2x2ZXJzIHRvIHNlbGYtcHVibGlz aA0KICBpbmZvcm1hdGlvbiBhYm91dCB0aGVtc2VsdmVzLiAgVGhlIGluZm9ybWF0aW9uIGlzIHJl dHVybmVkIGFzIGEgSlNPTg0KICBvYmplY3QuICBUaGUgbmFtZXMgaW4gdGhpcyBvYmplY3QgYXJl IGRlZmluZWQgaW4gYW4gSUFOQSByZWdpc3RyeQ0KICB0aGF0IGFsbG93cyBmb3IgbGlnaHQtd2Vp Z2h0IHJlZ2lzdHJhdGlvbi4gIEFwcGxpY2F0aW9ucyBhbmQNCiAgb3BlcmF0aW5nIHN5c3RlbXMg Y2FuIHVzZSB0aGUgbWV0aG9kcyBkZWZpbmVkIGhlcmUgdG8gZ2V0IHRoZQ0KICBpbmZvcm1hdGlv biBmcm9tIHJlc29sdmVycyBpbiBvcmRlciB0byBtYWtlIGNob2ljZXMgYWJvdXQgaG93IHRvIHNl bmQNCiAgZnV0dXJlIHF1ZXJpZXMgdG8gdGhvc2UgcmVzb2x2ZXJzLg0KDQotLQ0KQWRkIG1haWxp bmcgbGlzdA0KQWRkQGlldGYub3JnPG1haWx0bzpBZGRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZA0K --_000_CH2PR22MB2086EA09411710ABB3FAE13ADAD00CH2PR22MB2086namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5JIGFsc28gdGhpbmsgUkVTSU5GTyBsb29rcyBwcm9taXNpbmcuJm5ic3A7IFB1Ymxp c2hpbmcgRG9UIGFuZC9vciBEb0ggZW5kcG9pbnRzIG9uIHRoYXQgcmVzb2x2ZXIgc2VlbXMgdGhl IG9idmlvdXMgbmV4dCBzdGVwLCBhbmQgSSB3YXMgc3VycHJpc2VkIHRoYXQgdGhlIGRvY3VtZW50 IGRpZG7igJl0IGRlZmluZSBlbGVtZW50cyB0byBkZWNsYXJlIHRob3NlIGNhcGFiaWxpdGllcy4m bmJzcDsgVGhlIEROUyByZWNvcmQgcGllY2Ugc2VlbXMNCiB1c2VmdWwgZm9yIHJlY3Vyc2l2ZS10 by1hdXRob3JpdGF0aXZlIGFzIHdlbGwuJm5ic3A7IElmIHdlIHBlcm1pdCBSRVNJTkZPIHJlY29y ZHMgZm9yIG90aGVyIG5hbWVzLCBhbiBhdXRob3JpdGF0aXZlIGRlbGVnYXRpb24gY291bGQgcGFz cyBhbG9uZyB0aGUgUkVTSU5GTyBvZiB0aGUgbmFtZSBzZXJ2ZXIgaXTigJlzIGRlbGVnYXRpbmcg dG8uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBhdHRyYWN0aW9ucyBvZiB0aGUgSFRUUFMg b3B0aW9uIGFyZSBtdWx0aXBsZSwgcGFydGljdWxhcmx5IGZvciBzdHViLXRvLXJlc29sdmVyLiZu YnNwOyBPbmUgaXMgYSB3YXkgdG8gdmFsaWRhdGUgdGhlIGNvbm5lY3Rpb24gdG8gdGhlIHJlc29s dmVyIHRoYXQgeW91IHRoaW5rIHlvdeKAmXJlIHRhbGtpbmcgdG8sIG9mIGNvdXJzZS4mbmJzcDsg UmVtb3ZpbmcgdGhlIEhUVFBTIG9wdGlvbiBtZWFucyB5b3XigJlyZSBqdXN0IHRyeWluZw0KIHRo ZSBlbmRwb2ludHMgYW5kIHNlZWluZyBpZiB0aGV5IHdvcmssIHdoaWNoIGlzIHN1Yi1vcHRpbWFs LiZuYnNwOyBGdXJ0aGVyLCBpZiAoYXMgc2VlbXMgbGlrZWx5KSB0aGUgRG9IIGVuZHBvaW50IGlz IGF0IHRoZSBzYW1lIGhvc3QgYW5kIHBvcnQsIHlvdeKAmXZlIGFscmVhZHkgZXN0YWJsaXNoZWQg YW4gSFRUUFMgc2Vzc2lvbiB3aGljaCBjb3VsZCBiZSB1c2VkIHRvIHBlcmZvcm0gRG9ILCBhcyBk ZXNjcmliZWQgaW4gc3R1Yi11cGdyYWRlLiZuYnNwOyBJdCBhbHNvDQogZW5hYmxlcyB5b3UgdG8g cHJvYmUgYSBEb0ggVVJJIHlvdeKAmXZlIHJlY2VpdmVkIGVsc2V3aGVyZSB0byBlbnN1cmUgdGhh dCB0aGUgc2VydmVyIGFjdHVhbGx5IGludGVuZHMgdG8gb2ZmZXIgRG9IIGF0IHRoYXQgVVJJOyB3 aGlsZSB5b3XigJlkIGV4cGVjdCBhIERvSCByZXF1ZXN0IHRvIGZhaWwgaWYgbm90LCBlc3RhYmxp c2hpbmcgY29uc2VudCBpcyBnZW5lcmFsbHkgYSBnb29kIGlkZWEuJm5ic3A7IEnigJlkIGJlIGlu Y2xpbmVkIHRvIGtlZXAgaXQsIGFsbCB0b2xkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gQWRkICZsdDthZGQtYm91bmNlc0Bp ZXRmLm9yZyZndDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NCkJlbiBTY2h3YXJ0ejxicj4NCjxiPlNl bnQ6PC9iPiBGcmlkYXksIEFwcmlsIDI0LCAyMDIwIDI6MDkgUE08YnI+DQo8Yj5Ubzo8L2I+IFBh dWwgSG9mZm1hbiAmbHQ7cGF1bC5ob2ZmbWFuQGljYW5uLm9yZyZndDs8YnI+DQo8Yj5DYzo8L2I+ IEFERCBNYWlsaW5nIGxpc3QgJmx0O2FkZEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gUmU6IFtBZGRdIERyYWZ0cyBvbiB1cGdyYWRpbmcgc3R1Yi10by1yZXNvbHZlciBjb21tdW5p Y2F0aW9uIHRvIGVuY3J5cHRlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5UaGFua3MgZm9yIHRoZSB1cGRhdGVkIGRyYWZ0cy4mbmJzcDsgSSB0aGluayBSRVNJTkZPIGlz IHRoZSBtb3N0IHByb21pc2luZyBwYXRoIGZvciByZXNvbHZlciB1cGdyYWRlLCBhbmQgSSdkIGxp a2UgdG8gc2VlIGl0IGltcGxlbWVudGVkLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VGhlJm5ic3A7b25lIG1ham9yIGNoYW5nZSBJIHN1Z2dlc3QgaXMgdG8g cmVtb3ZlIHRoZSBlbnRpcmUgSFRUUFMgbWVjaGFuaXNtIGZyb20gdGhlIFJFU0lORk8gZHJhZnQu Jm5ic3A7IFRoaXMgbWVjaGFuaXNtIGNyZWF0ZXMgYSBncmVhdCBkZWFsIG9mIGNvbXBsZXhpdHks IGRvZXNuJ3QgZm9sbG93IGdvb2QgcHJhY3RpY2VzIGZvciBIVFRQUywgYW5kIGRvZXNuJ3Qgb2J2 aW91c2x5IGVuYWJsZSBhbnkgYWRkaXRpb25hbCB1c2UNCiBjYXNlcy4mbmJzcDsgSGF2aW5nIG11 bHRpcGxlIGNvbXBldGluZyBtZWNoYW5pc21zIGFsc28gbWFrZXMgaW50ZXJvcGVyYWJpbGl0eSBs ZXNzIGxpa2VseS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SWYgJnF1b3Q7aW4tYmFuZCZxdW90OyBSRVNJTkZPIHByb3ZlcyBpbnN1ZmZpY2ll bnQsIGFuIEhUVFBTLWJhc2VkIG1lY2hhbmlzbSBjb3VsZCBhbHdheXMgYmUgYWRkZWQgaW4gYSBs YXRlciBkcmFmdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gRnJpLCBBcHIgMjQsIDIwMjAgYXQgMTI6NDYgUE0gUGF1bCBIb2ZmbWFuICZs dDs8YSBocmVmPSJtYWlsdG86cGF1bC5ob2ZmbWFuQGljYW5uLm9yZyI+cGF1bC5ob2ZmbWFuQGlj YW5uLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+R3JlZXRpbmdzIGFnYWluLiBXZSBoYXZlIGp1c3QgcHVi bGlzaGVkIHR3byBkcmFmdHMsIGRyYWZ0LXBwLWFkZC1zdHViLXVwZ3JhZGUgYW5kIGRyYWZ0LXBw LWFkZC1yZXNpbmZvLCB0byBhZGRyZXNzIHRoZSBlYXNpZXIgcHJvYmxlbSB0aGF0IHRoaXMgV0cg d2FudGVkIHRvIHRhY2tsZSwgbmFtZWx5IGhvdyBhIHN0dWIgY2FuIHVwZ3JhZGUgZnJvbSBwbGFp biBETlMgdG8gZW5jcnlwdGVkIEROUyBmb3IgdGhlIHJlc29sdmVyDQogaXQgaXMgY3VycmVudGx5 IHVzaW5nLiBUaGUgbWV0aG9kIGluIGRyYWZ0LXBwLWFkZC1zdHViLXVwZ3JhZGUgaXMgcXVpdGUg c2ltcGxlLCBidXQgaXQgaW5jbHVkZXMgYWxsIG9mIHRoZSB2YXJpYWJsZXMgdGhhdCB3ZSBoYXZl IGhlYXJkIGluIHRoZSBkaXNjdXNzaW9uIG92ZXIgdGhlIGxhc3QgeWVhci4uIFRoZSBmb3JtYXQg aW4gZHJhZnQtcHAtYWRkLXJlc2luZm8gaXMgdGhlIG1pbmltdW0gbmVlZGVkIGZvciBzdHViIHVw Z3JhZGUsIGJ1dCB3aWxsDQogYWxzbyBwb3NzaWJseSBiZSB1c2VmdWwgZm9yIHRoZSBtb3JlIGRp ZmZpY3VsdCBkaXNjb3ZlcnkgcHJvdG9jb2xzIGJlaW5nIGRpc2N1c3NlZCBpbiB0aGUgV0cuPGJy Pg0KPGJyPg0KUGxlYXNlIGxldCB1cyBrbm93IGlmIHlvdSBmaW5kIHRoZXNlIGRvY3VtZW50cyB1 c2VmdWwgZm9yIHRoZSBkaXNjdXNzaW9uIG9mIGRpcmVjdCB1cGdyYWRlIGluc3RlYWQgb2YgZGlz Y292ZXJ5LiBBbHNvLCBwbGVhc2UgbGV0IHVzIGtub3cgaWYgd2UgaGF2ZSBtaXNzZWQgYW55IHNh bGllbnQgcG9pbnRzLiBJZiBzbywgd2UgY291bGQgYXNrIHRoZSBjaGFpcnMgdG8gbWFrZSB0aGVz ZSBpbnRvIFdHIGRvY3VtZW50cy48YnI+DQo8YnI+DQotLVBhdWwgSG9mZm1hbiBhbmQgUHVuZWV0 IFNvb2Q8YnI+DQo8YnI+DQo8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2Rv Yy9kcmFmdC1wcC1hZGQtc3R1Yi11cGdyYWRlLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBwLWFkZC1zdHViLXVwZ3JhZGUvPC9hPjxicj4N Cjxicj4NCk5hbWU6Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtkcmFm dC1wcC1hZGQtc3R1Yi11cGdyYWRlPGJyPg0KUmV2aXNpb246Jm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7MDA8YnI+DQpUaXRsZTombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFVw Z3JhZGluZyBDb21tdW5pY2F0aW9uIGZyb20gU3R1YiBSZXNvbHZlcnMgdG8gRG9UIG9yIERvSDxi cj4NCkRvY3VtZW50IGRhdGU6Jm5ic3A7IDIwMjAtMDQtMjQ8YnI+DQpHcm91cDombmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEluZGl2aWR1YWwgU3VibWlzc2lvbjxicj4NClBhZ2Vz OiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgNzxicj4NCjxicj4NCkFic3RyYWN0 Ojxicj4NCiZuYnNwOyBUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyBtZXRob2RzIGZvciBhIEROUyBz dHViIHJlc29sdmVyIHRvIHVwZ3JhZGU8YnI+DQombmJzcDsgaXRzIGNvbW11bmljYXRpb25zIHdp dGggYSBrbm93biByZWN1cnNpdmUgcmVzb2x2ZXIgdG8gaW5jbHVkZTxicj4NCiZuYnNwOyBlbmNy eXRpb24gdXNpbmcgRG9UIG9yIERvSC4mbmJzcDsgVGhpcyBwcm90b2NvbCBpcyBkZXNpZ25lZCBm b3IgdGhlPGJyPg0KJm5ic3A7IHNjZW5hcmlvIHdoZXJlIHRoZSBzdHViIHJlc29sdmVyIGFscmVh ZHkgaGFzIHRoZSBJUCBhZGRyZXNzIG9mIHRoZTxicj4NCiZuYnNwOyByZWN1cnNpdmUgcmVzb2x2 ZXIuPGJyPg0KPGJyPg0KJm5ic3A7IE90aGVyIHByb3RvY29scyB1bmRlciBkZXZlbHBtZW50IGFk ZHJlc3Mgc2NlbmFyaW9zIHdoZXJlIHRoZSBzdHViPGJyPg0KJm5ic3A7IHJlc29sdmVyIHdhbnRz IHRvIGRpc2NvdmVyIHJlY3Vyc2l2ZSByZXNvbHZlcnMgdGhhdCB1c2UgRG9UIG9yIERvSC48YnI+ DQombmJzcDsgVGhpcyBkb2N1bWVudCBkb2VzIG5vdCBjb3ZlciBzdWNoIGRpc2NvdmVyeS48YnI+ DQo8YnI+DQo8YnI+DQo8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9k cmFmdC1wcC1hZGQtcmVzaW5mby8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1wcC1hZGQtcmVzaW5mby88L2E+PGJyPg0KPGJyPg0KTmFtZTom bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO2RyYWZ0LXBwLWFkZC1yZXNp bmZvPGJyPg0KUmV2aXNpb246Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7MDA8YnI+DQpUaXRs ZTombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEROUyBSZXNvbHZlciBJbmZvcm1h dGlvbiBTZWxmLXB1YmxpY2F0aW9uPGJyPg0KRG9jdW1lbnQgZGF0ZTombmJzcDsgMjAyMC0wNC0y NDxicj4NCkdyb3VwOiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgSW5kaXZpZHVh bCBTdWJtaXNzaW9uPGJyPg0KUGFnZXM6Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyA5PGJyPg0KPGJyPg0KQWJzdHJhY3Q6PGJyPg0KJm5ic3A7IFRoaXMgZG9jdW1lbnQgZGVzY3Jp YmVzIG1ldGhvZHMgZm9yIEROUyByZXNvbHZlcnMgdG8gc2VsZi1wdWJsaXNoPGJyPg0KJm5ic3A7 IGluZm9ybWF0aW9uIGFib3V0IHRoZW1zZWx2ZXMuJm5ic3A7IFRoZSBpbmZvcm1hdGlvbiBpcyBy ZXR1cm5lZCBhcyBhIEpTT048YnI+DQombmJzcDsgb2JqZWN0LiZuYnNwOyBUaGUgbmFtZXMgaW4g dGhpcyBvYmplY3QgYXJlIGRlZmluZWQgaW4gYW4gSUFOQSByZWdpc3RyeTxicj4NCiZuYnNwOyB0 aGF0IGFsbG93cyBmb3IgbGlnaHQtd2VpZ2h0IHJlZ2lzdHJhdGlvbi4mbmJzcDsgQXBwbGljYXRp b25zIGFuZDxicj4NCiZuYnNwOyBvcGVyYXRpbmcgc3lzdGVtcyBjYW4gdXNlIHRoZSBtZXRob2Rz IGRlZmluZWQgaGVyZSB0byBnZXQgdGhlPGJyPg0KJm5ic3A7IGluZm9ybWF0aW9uIGZyb20gcmVz b2x2ZXJzIGluIG9yZGVyIHRvIG1ha2UgY2hvaWNlcyBhYm91dCBob3cgdG8gc2VuZDxicj4NCiZu YnNwOyBmdXR1cmUgcXVlcmllcyB0byB0aG9zZSByZXNvbHZlcnMuPGJyPg0KPGJyPg0KLS0gPGJy Pg0KQWRkIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBZGRAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj5BZGRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CH2PR22MB2086EA09411710ABB3FAE13ADAD00CH2PR22MB2086namp_-- From nobody Fri Apr 24 12:16:50 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ED6F3A0860 for ; Fri, 24 Apr 2020 12:16:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.719 X-Spam-Level: X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.82, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=evequefou.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ICkg3m4ZZG6p for ; Fri, 24 Apr 2020 12:16:40 -0700 (PDT) Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2126.outbound.protection.outlook.com [40.107.243.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EF583A0865 for ; Fri, 24 Apr 2020 12:16:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bZ1hoxeE4dkNNxAycS+UTTmwJp0PSa+TF8Y2LC2+MLGxReUWOJ5rThQyXFv9mWyOScjBLIJMBS+cprmIaBPsTPKEXggqGLZ6TobVgTGgltVJYIwHmihSVSpwryoM/scQfphms33urHgVekQtwVRBSn4Xv+wDyu+bFOWt0kSjbDSEwtlxavrhhFDNl2KChJWqbWtvrWRILXKMCWC+f2k/KmKyK+PDwttyMLXo6DwF6DnzHrsWH0pycw77wYPjNTavCzUeKv8IGBHblzOWVEvyBxsAY+UjFaDwDRwJyjzW5PzXnBdYSnj9XElhH+GlYy/kQgmMLHbHB0Goj0F1B99J6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6fQyfduq5cRimxwwGrAKqUJ0IWyacZVDZ/GdfNcz1lg=; b=bY92m/g7vw4yrE6goY6Ex4ISVGm3wXWIMQSa3a9So4KUDjT1SHDzsa1Vw+r2AFmNa4sk+sNWo8sEUyYnfoemWINPt7vv2aTQMfWlnd+O23jdn5YNPKFLpENbm5y9RnGuUajJ45amsdDvclvYV4uj2IDqK/1uCle8nQBF0Wr2xzb7FetVziv1RCHbRTv+WSepXWXFDrzsrvCre5GzdHLRrcVgdVJLDODQ3+tYQuFOZDm77Jx/JvQH+/zcQOnZXVQebqEIu1Euz86y+qKnsxvV3PeO78o8/ArmWle7ycjeS5g6KEln1eScnhp/ZftxBP2c4xDY0PNenQcoQMZLUVfKgg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=evequefou.be; dmarc=pass action=none header.from=evequefou.be; dkim=pass header.d=evequefou.be; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evequefou.onmicrosoft.com; s=selector2-evequefou-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6fQyfduq5cRimxwwGrAKqUJ0IWyacZVDZ/GdfNcz1lg=; b=B3MJGPBXNAkeYm9Tq5/qUdjB52mAIEQpQzyuJRMhI5Dce7Yvgh4QdTjarBEb/SlgksmiwW77tc45V8eGatBYLxzQSFiPHgVTZFVE4pjV1L/yWvxrN17EHei5KxjOfPPyF1/pgiLFSJCAkoAIVmaOh6BFs7y80Ebauwe4S9ROoXA= Received: from CH2PR22MB2086.namprd22.prod.outlook.com (2603:10b6:610:8c::8) by CH2PR22MB1832.namprd22.prod.outlook.com (2603:10b6:610:83::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.22; Fri, 24 Apr 2020 19:16:37 +0000 Received: from CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::5d05:3b25:6510:2a3d]) by CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::5d05:3b25:6510:2a3d%3]) with mapi id 15.20.2937.020; Fri, 24 Apr 2020 19:16:37 +0000 From: Mike Bishop To: Eric Rescorla , Paul Hoffman CC: Ben Schwartz , ADD Mailing list Thread-Topic: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted Thread-Index: AQHWGmfVik3Q5xqgsU+By9s+OQW8lKiInpaAgAAEWKA= Date: Fri, 24 Apr 2020 19:16:37 +0000 Message-ID: References: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mbishop@evequefou.be; x-originating-ip: [2600:2b00:930c:7701:19c4:8529:2c6c:fb0a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e629ba5e-e444-4d8e-350a-08d7e88402a0 x-ms-traffictypediagnostic: CH2PR22MB1832: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 03838E948C x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR22MB2086.namprd22.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(136003)(396003)(39830400003)(346002)(376002)(366004)(81156014)(7696005)(53546011)(6506007)(86362001)(8936002)(8676002)(2906002)(52536014)(33656002)(4326008)(9686003)(110136005)(71200400001)(55016002)(316002)(66476007)(66946007)(66446008)(66556008)(64756008)(54906003)(966005)(5660300002)(508600001)(186003)(76116006); DIR:OUT; SFP:1102; received-spf: None (protection.outlook.com: evequefou.be does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: d9/rgK+v4ImNvNBfeh9e38/kq+g5BEwxckZ87PYppVZ2p8R1VsHLUNCniJtCTUsXtCePnXl7z1nWIHdf0zIMWJBGY1COrnfBAQO5RCqailGLBkjAPl9/gQ0pQoWYga0unx0A7iYn4qC3paDV/K/txoNkqDz2XrwWiK8Z2jqDpm0/P1SRVbMCs99gI9096nSEKf4Uyze12996XE7P/oiIQqO6zhSV9prRyUDjQJh7Shuotea5RuvI8ChwTxeIsWKQLXHr/fio3T38GrKuF7repNItJUnMHf0/cQbbrbuv78pZca8Akfs/7xYGTi/dMT7LzYqhMas+CFUQJuAe9+t0/78+u708o5jT0Fx28zAXq/tlQI1FKd9lTGkWEqHwVBt44Hn4lPE8JXJTjAZ3jQCZph8WkoErNx3LDunZgj3SppYIlSGhiHEqVMNoMzXfnKOSmF/1PFDfdOLrvfZRz1Y8j75+gAd9jWhDlOTTPCphD8zSBaXG08+AVdwghTCwZ/rl77MXeoHFlOnJORoAwY8DfA== x-ms-exchange-antispam-messagedata: IiuPuBwJ2oJq08RJOmYmmDah6g9NHKTdVj22CYfl7bnUtsf5oc1epJTkW6CLvUsQTPgRpYv7G8e5xdTw52P1ZSlYh/DtkVXqxY1p1ECf/QjFBglhKbCKQdXseDuyjakn5ZkK8MXaXQgX1eWL2g6UnhgFFXNUXCorpi2x671hDULqvzC5XKg1iHHlBwCnq0JgwN4av7kOKTEKwoctF0rvCUjhwJObffukAwKrX2esP/mQmU8nfbAZsZtlvBmErklJguQr2OUKKNrr5UcLRGAs/prSC75V3IV3fGjpUn/ajjlw4SUM1HJYWDcHn/yxsPBap86gztACIKr/2zvLtzyQbgGPWyaVXdsBnfPVBWTRLx5E6yYjHQ7cRboXry8Ukj9AbVfXOGGkEd7lrM3ZSTyJxB/LLZpYz5M1i9KC3thCkZPSe30iZkvlhWPJNhXT6qJak0Kv6ZZn6jqwyEhPEXsjp+3AAxVaWNZIiOkRi3Nb4TesFwALeDzrRSOsjMOLi1ARkGcbeA7PO6LO/DaaIWrwIl0RSJIpy3qauphsj04vitzkvC7QAOYHxMhytsbfFAJ/3sJd0vHtqrHuh1QPhzB5v2UUNvAqHLkVbKoBUcXhCXgXzTEqEe5ZDq0w9JsPI6kjcviMbqcirPBcgoYrGhK9EWuwqso2rnV140jKKftGY2ErzVaKe2EWPWlerTbsTX8Sm7kF6Z8YcgtVI3KEyWClRhrCztP73+rK48z9ziztfux/Sr5O8RLQPdYEFGaSNXXYnIRBuCuT68Pu1aUvVY7kGgSqr93yz9mhQnoOZo9n1mivI0vZxg6npYIMSde4DAevmJI7aKAsjMJROAkEA+QxFLXtmuTPTqI9Yd3AzdyIE7Wwzn0jsLN0lKeL8Y5JJs9e x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR22MB208610A6E15C3953EB3EEA58DAD00CH2PR22MB2086namp_" MIME-Version: 1.0 X-OriginatorOrg: evequefou.be X-MS-Exchange-CrossTenant-Network-Message-Id: e629ba5e-e444-4d8e-350a-08d7e88402a0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2020 19:16:37.2281 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mSsxUX4z84rjEG3MmSmnCAL7hK+2F06VUlfAs478ip/9sjDre6oaFSbVV6MdIaZTPkRnyBdJNHdzMZFwfWyIQw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR22MB1832 Archived-At: Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 19:16:42 -0000 --_000_CH2PR22MB208610A6E15C3953EB3EEA58DAD00CH2PR22MB2086namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGlqYWNraW5nIGEgY29ubmVjdGlvbiByZXF1aXJlcyBiZWluZyBhYmxlIHRvIHN1YnZlcnQgY29u bmVjdGlvbnMgZnJvbSB0aGF0IGNsaWVudCBhbmQgc3Bvb2YgdGhlIGRlc3RpbmF0aW9uIElQIGFk ZHJlc3MuICBHZXR0aW5nIGFuIElQIGNlcnRpZmljYXRlIHdvdWxkIHJlcXVpcmUgZG9pbmcgdGhh dCwgbm90IGZyb20gb25lIGNsaWVudOKAmXMgdmFudGFnZSwgYnV0IGZyb20gZXZlcnkgdmFudGFn ZSB0aGUgQ0EgY2hvb3NlcyB0byB0ZXN0IGZyb20uICBJZiB0aGUgQ0EgdGVzdHMgZnJvbSBtdWx0 aXBsZSB2YW50YWdlIHBvaW50cywgdGhlIElQIGNlcnRpZmljYXRlIGlzIGEgc3Ryb25nZXIgYXNz ZXJ0aW9uIHRoYW4gc2ltcGx5IGJlaW5nIGFibGUgdG8gYWNjZXB0IHlvdXIgY29ubmVjdGlvbi4N Cg0KQnV0IGxldOKAmXMgc2F5IHdlIHJlbW92ZSB0aGUgSFRUUFMgcGF0aC4gIFdoYXQgZG8gd2Ug ZG8gaW5zdGVhZD8gIERvNTMgaXMgdW5lbmNyeXB0ZWQgYW5kIGp1c3QgYXMgdW5hdXRoZW50aWNh dGVkLiAgU3BlY3VsYXRpdmUgRG9UIGlzIGp1c3QgYXMgdW5hdXRoZW50aWNhdGVkLCBzaW5jZSBl aXRoZXIgeW914oCZbGwgdmFsaWRhdGUgYWdhaW5zdCBhbiBJUCBjZXJ0aWZpY2F0ZSBvciB0YWtl IHdoYXRldmVyIGNlcnRpZmljYXRlIGlzIHRoZXJlLiAgRm9yIHRoZSB0aW1lIGJlaW5nLCBhbGwg Ym9vdHN0cmFwcGluZyByZXF1aXJlcyBhbiBlbGVtZW50IG9mIHRydXN0LiAgSSBkb27igJl0IGRp c3B1dGUgdGhlIHdlYWtuZXNzZXMgeW91IHBvaW50IG91dDsgSSBzaW1wbHkgZG9u4oCZdCBzZWUg dGhhdCB3ZeKAmXZlIGZvdW5kIGEgYmV0dGVyIGFsdGVybmF0aXZlLg0KDQpGcm9tOiBBZGQgPGFk ZC1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgRXJpYyBSZXNjb3JsYQ0KU2VudDogRnJp ZGF5LCBBcHJpbCAyNCwgMjAyMCAyOjU0IFBNDQpUbzogUGF1bCBIb2ZmbWFuIDxwYXVsLmhvZmZt YW5AaWNhbm4ub3JnPg0KQ2M6IEJlbiBTY2h3YXJ0eiA8YmVtYXNjPTQwZ29vZ2xlLmNvbUBkbWFy Yy5pZXRmLm9yZz47IEFERCBNYWlsaW5nIGxpc3QgPGFkZEBpZXRmLm9yZz4NClN1YmplY3Q6IFJl OiBbQWRkXSBbRXh0XSBEcmFmdHMgb24gdXBncmFkaW5nIHN0dWItdG8tcmVzb2x2ZXIgY29tbXVu aWNhdGlvbiB0byBlbmNyeXB0ZWQNCg0KDQoNCk9uIEZyaSwgQXByIDI0LCAyMDIwIGF0IDExOjQw IEFNIFBhdWwgSG9mZm1hbiA8cGF1bC5ob2ZmbWFuQGljYW5uLm9yZzxtYWlsdG86cGF1bC5ob2Zm bWFuQGljYW5uLm9yZz4+IHdyb3RlOg0KT24gQXByIDI0LCAyMDIwLCBhdCAxMTowOSBBTSwgQmVu IFNjaHdhcnR6IDxiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGdv b2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCj4NCj4gVGhhbmtzIGZvciB0aGUgdXBk YXRlZCBkcmFmdHMuICBJIHRoaW5rIFJFU0lORk8gaXMgdGhlIG1vc3QgcHJvbWlzaW5nIHBhdGgg Zm9yIHJlc29sdmVyIHVwZ3JhZGUsIGFuZCBJJ2QgbGlrZSB0byBzZWUgaXQgaW1wbGVtZW50ZWQu DQo+DQo+IFRoZSBvbmUgbWFqb3IgY2hhbmdlIEkgc3VnZ2VzdCBpcyB0byByZW1vdmUgdGhlIGVu dGlyZSBIVFRQUyBtZWNoYW5pc20gZnJvbSB0aGUgUkVTSU5GTyBkcmFmdC4gIFRoaXMgbWVjaGFu aXNtIGNyZWF0ZXMgYSBncmVhdCBkZWFsIG9mIGNvbXBsZXhpdHksIGRvZXNuJ3QgZm9sbG93IGdv b2QgcHJhY3RpY2VzIGZvciBIVFRQUywgYW5kIGRvZXNuJ3Qgb2J2aW91c2x5IGVuYWJsZSBhbnkg YWRkaXRpb25hbCB1c2UgY2FzZXMuICBIYXZpbmcgbXVsdGlwbGUgY29tcGV0aW5nIG1lY2hhbmlz bXMgYWxzbyBtYWtlcyBpbnRlcm9wZXJhYmlsaXR5IGxlc3MgbGlrZWx5Lg0KDQpUaGUgYWRkaXRp b25hbCB1c2UgY2FzZSB0aGF0IHdhcyBicm91Z2h0IHVwIGluIGVhcmxpZXIgd29yayBpcyB0aGF0 IGEgc3R1YiB0aGF0IHdhbnRzIHRvIGRvIERvSC4NCi0gSXQgZG9lcyBub3QgbmVlZCB0byBrbm93 IGhvdyB0byBtYWtlIHJlcXVlc3RzIGZvciBhIG5ldyBETlMgUlJ0eXBlDQotIEl0IGNhbiB1c2Ug SFRUUFMgYXMgaXQga25vd3MgaXQNCi0gSXQgY2FuIGdldCBhIHJlc3BvbnNlIHRoYXQgY2FuIGJl IGF1dGhlbnRpY2F0ZWQNCg0KSSB1bmRlcnN0YW5kIHRoZSBkZXNpcmUgbm90IHRvIGFsbG93IHVu YXV0aGVudGljYXRlZCBIVFRQUyBiZWNhdXNlIG9mIGJlc3QgcHJhY3RpY2VzLiBXZSBjYW4gcmVt b3ZlIHRoYXQgZnJvbSB0aGUgZHJhZnQsIGJ1dCB0aGVuIGltcGxlbWVudGVycyB3aWxsIGxpa2Vs eSBnbyBhaGVhZCBhbmQgaW1wbGVtZW50IGl0IGFueXdheSBidXQgd2l0aG91dCBndWlkYW5jZSBh Ym91dCB0aGUgcmVzdWx0cy4gTm90ZSB0aGF0IHdlIGFyZSBvbmx5IHRhbGtpbmcgYWJvdXQgdW5h dXRoZW50aWNhdGVkIEhUVFBTICpmb3IgdGhpcyBvbmUgdXNlKiwgbm90IGluIGdlbmVyYWwuDQoN Cj4gSWYgImluLWJhbmQiIFJFU0lORk8gcHJvdmVzIGluc3VmZmljaWVudCwgYW4gSFRUUFMtYmFz ZWQgbWVjaGFuaXNtIGNvdWxkIGFsd2F5cyBiZSBhZGRlZCBpbiBhIGxhdGVyIGRyYWZ0Lg0KDQpT b21lIHBlb3BsZSBzYWlkIGl0IHdhcyBpbnN1ZmZpY2llbnQgYmVjYXVzZSBvZiBpbmFiaWxpdHkg dG8gYXV0aGVudGljYXRlLg0KDQpCdXQgdGhlIEhUVFBTIG1lY2hhbmlzbSBpcyB1bmF1dGhlbnRp Y2F0ZWQgYXMgd2VsbC4gQW5kIGV2ZW4gaWYgcGVvcGxlIGRvIHVzZSBJUCBjZXJ0cywgdGhlbiB0 aGV5IG1lY2hhbmlzbSBieSB3aGljaCB0aGV5IGdldCB0aGUgSVAgaXMgbGFyZ2VseSB1bmF1dGhl bnRpY2F0ZWQuDQoNCkkgYWdyZWUgd2l0aCBCZW47IHRoaXMgIG1lY2hhbmlzbSBzaG91bGQgYmUg cmVtb3ZlZC4NCg0KLUVrcg0KDQoNCi0tUGF1bCBIb2ZmbWFuLS0NCkFkZCBtYWlsaW5nIGxpc3QN CkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9hZGQNCg== --_000_CH2PR22MB208610A6E15C3953EB3EEA58DAD00CH2PR22MB2086namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IaWphY2tpbmcgYSBjb25uZWN0aW9uIHJlcXVpcmVzIGJlaW5nIGFibGUgdG8gc3Vi dmVydCBjb25uZWN0aW9ucyBmcm9tIHRoYXQgY2xpZW50IGFuZCBzcG9vZiB0aGUgZGVzdGluYXRp b24gSVAgYWRkcmVzcy4mbmJzcDsgR2V0dGluZyBhbiBJUCBjZXJ0aWZpY2F0ZSB3b3VsZCByZXF1 aXJlIGRvaW5nIHRoYXQsIG5vdCBmcm9tIG9uZSBjbGllbnTigJlzIHZhbnRhZ2UsIGJ1dCBmcm9t IGV2ZXJ5IHZhbnRhZ2UgdGhlIENBIGNob29zZXMNCiB0byB0ZXN0IGZyb20uJm5ic3A7IElmIHRo ZSBDQSB0ZXN0cyBmcm9tIG11bHRpcGxlIHZhbnRhZ2UgcG9pbnRzLCB0aGUgSVAgY2VydGlmaWNh dGUgaXMgYSBzdHJvbmdlciBhc3NlcnRpb24gdGhhbiBzaW1wbHkgYmVpbmcgYWJsZSB0byBhY2Nl cHQgeW91ciBjb25uZWN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CdXQgbGV04oCZcyBz YXkgd2UgcmVtb3ZlIHRoZSBIVFRQUyBwYXRoLiZuYnNwOyBXaGF0IGRvIHdlIGRvIGluc3RlYWQ/ Jm5ic3A7IERvNTMgaXMgdW5lbmNyeXB0ZWQgYW5kIGp1c3QgYXMgdW5hdXRoZW50aWNhdGVkLiZu YnNwOyBTcGVjdWxhdGl2ZSBEb1QgaXMganVzdCBhcyB1bmF1dGhlbnRpY2F0ZWQsIHNpbmNlIGVp dGhlciB5b3XigJlsbCB2YWxpZGF0ZSBhZ2FpbnN0IGFuIElQIGNlcnRpZmljYXRlIG9yIHRha2Ug d2hhdGV2ZXIgY2VydGlmaWNhdGUNCiBpcyB0aGVyZS4mbmJzcDsgRm9yIHRoZSB0aW1lIGJlaW5n LCBhbGwgYm9vdHN0cmFwcGluZyByZXF1aXJlcyBhbiBlbGVtZW50IG9mIHRydXN0LiZuYnNwOyBJ IGRvbuKAmXQgZGlzcHV0ZSB0aGUgd2Vha25lc3NlcyB5b3UgcG9pbnQgb3V0OyBJIHNpbXBseSBk b27igJl0IHNlZSB0aGF0IHdl4oCZdmUgZm91bmQgYSBiZXR0ZXIgYWx0ZXJuYXRpdmUuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9i PiBBZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2YgPC9iPg0K RXJpYyBSZXNjb3JsYTxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIEFwcmlsIDI0LCAyMDIwIDI6 NTQgUE08YnI+DQo8Yj5Ubzo8L2I+IFBhdWwgSG9mZm1hbiAmbHQ7cGF1bC5ob2ZmbWFuQGljYW5u Lm9yZyZndDs8YnI+DQo8Yj5DYzo8L2I+IEJlbiBTY2h3YXJ0eiAmbHQ7YmVtYXNjPTQwZ29vZ2xl LmNvbUBkbWFyYy5pZXRmLm9yZyZndDs7IEFERCBNYWlsaW5nIGxpc3QgJmx0O2FkZEBpZXRmLm9y ZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBZGRdIFtFeHRdIERyYWZ0cyBvbiB1cGdy YWRpbmcgc3R1Yi10by1yZXNvbHZlciBjb21tdW5pY2F0aW9uIHRvIGVuY3J5cHRlZDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIEFwciAyNCwgMjAyMCBh dCAxMTo0MCBBTSBQYXVsIEhvZmZtYW4gJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsLmhvZmZtYW5A aWNhbm4ub3JnIj5wYXVsLmhvZmZtYW5AaWNhbm4ub3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxl ZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBBcHIg MjQsIDIwMjAsIGF0IDExOjA5IEFNLCBCZW4gU2Nod2FydHogJmx0O2JlbWFzYz08YSBocmVmPSJt YWlsdG86NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBnb29n bGUuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IFRoYW5rcyBmb3IgdGhlIHVwZGF0ZWQgZHJhZnRzLiZuYnNwOyBJIHRoaW5rIFJFU0lORk8gaXMg dGhlIG1vc3QgcHJvbWlzaW5nIHBhdGggZm9yIHJlc29sdmVyIHVwZ3JhZGUsIGFuZCBJJ2QgbGlr ZSB0byBzZWUgaXQgaW1wbGVtZW50ZWQuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFRoZSBvbmUgbWFq b3IgY2hhbmdlIEkgc3VnZ2VzdCBpcyB0byByZW1vdmUgdGhlIGVudGlyZSBIVFRQUyBtZWNoYW5p c20gZnJvbSB0aGUgUkVTSU5GTyBkcmFmdC4mbmJzcDsgVGhpcyBtZWNoYW5pc20gY3JlYXRlcyBh IGdyZWF0IGRlYWwgb2YgY29tcGxleGl0eSwgZG9lc24ndCBmb2xsb3cgZ29vZCBwcmFjdGljZXMg Zm9yIEhUVFBTLCBhbmQgZG9lc24ndCBvYnZpb3VzbHkgZW5hYmxlIGFueSBhZGRpdGlvbmFsIHVz ZSBjYXNlcy4mbmJzcDsgSGF2aW5nIG11bHRpcGxlDQogY29tcGV0aW5nIG1lY2hhbmlzbXMgYWxz byBtYWtlcyBpbnRlcm9wZXJhYmlsaXR5IGxlc3MgbGlrZWx5Ljxicj4NCjxicj4NClRoZSBhZGRp dGlvbmFsIHVzZSBjYXNlIHRoYXQgd2FzIGJyb3VnaHQgdXAgaW4gZWFybGllciB3b3JrIGlzIHRo YXQgYSBzdHViIHRoYXQgd2FudHMgdG8gZG8gRG9ILjxicj4NCi0gSXQgZG9lcyBub3QgbmVlZCB0 byBrbm93IGhvdyB0byBtYWtlIHJlcXVlc3RzIGZvciBhIG5ldyBETlMgUlJ0eXBlPGJyPg0KLSBJ dCBjYW4gdXNlIEhUVFBTIGFzIGl0IGtub3dzIGl0PGJyPg0KLSBJdCBjYW4gZ2V0IGEgcmVzcG9u c2UgdGhhdCBjYW4gYmUgYXV0aGVudGljYXRlZDxicj4NCjxicj4NCkkgdW5kZXJzdGFuZCB0aGUg ZGVzaXJlIG5vdCB0byBhbGxvdyB1bmF1dGhlbnRpY2F0ZWQgSFRUUFMgYmVjYXVzZSBvZiBiZXN0 IHByYWN0aWNlcy4gV2UgY2FuIHJlbW92ZSB0aGF0IGZyb20gdGhlIGRyYWZ0LCBidXQgdGhlbiBp bXBsZW1lbnRlcnMgd2lsbCBsaWtlbHkgZ28gYWhlYWQgYW5kIGltcGxlbWVudCBpdCBhbnl3YXkg YnV0IHdpdGhvdXQgZ3VpZGFuY2UgYWJvdXQgdGhlIHJlc3VsdHMuIE5vdGUgdGhhdCB3ZSBhcmUg b25seSB0YWxraW5nDQogYWJvdXQgdW5hdXRoZW50aWNhdGVkIEhUVFBTICpmb3IgdGhpcyBvbmUg dXNlKiwgbm90IGluIGdlbmVyYWwuPGJyPg0KPGJyPg0KJmd0OyBJZiAmcXVvdDtpbi1iYW5kJnF1 b3Q7IFJFU0lORk8gcHJvdmVzIGluc3VmZmljaWVudCwgYW4gSFRUUFMtYmFzZWQgbWVjaGFuaXNt IGNvdWxkIGFsd2F5cyBiZSBhZGRlZCBpbiBhIGxhdGVyIGRyYWZ0Ljxicj4NCjxicj4NClNvbWUg cGVvcGxlIHNhaWQgaXQgd2FzIGluc3VmZmljaWVudCBiZWNhdXNlIG9mIGluYWJpbGl0eSB0byBh dXRoZW50aWNhdGUuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5CdXQgdGhlIEhUVFBTIG1lY2hhbmlzbSBpcyB1bmF1dGhlbnRpY2F0 ZWQgYXMgd2VsbC4gQW5kIGV2ZW4gaWYgcGVvcGxlIGRvIHVzZSBJUCBjZXJ0cywgdGhlbiB0aGV5 IG1lY2hhbmlzbSBieSB3aGljaCB0aGV5IGdldCB0aGUgSVAgaXMgbGFyZ2VseSB1bmF1dGhlbnRp Y2F0ZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkkgYWdyZWUgd2l0aCBCZW47IHRoaXMmbmJzcDsgbWVjaGFuaXNtIHNob3VsZCBiZSByZW1v dmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4tRWtyPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCi0tUGF1bCBIb2ZmbWFuLS0gPGJyPg0KQWRkIG1haWxpbmcgbGlzdDxi cj4NCjxhIGhyZWY9Im1haWx0bzpBZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BZGRAaWV0 Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9hZGQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FkZDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CH2PR22MB208610A6E15C3953EB3EEA58DAD00CH2PR22MB2086namp_-- From nobody Fri Apr 24 12:29:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF7113A08D2 for ; Fri, 24 Apr 2020 12:29:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C_w3KQDoYPzj for ; Fri, 24 Apr 2020 12:29:17 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B98BD3A08C7 for ; Fri, 24 Apr 2020 12:29:16 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id g4so11184002ljl.2 for ; Fri, 24 Apr 2020 12:29:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=L5B1dHnuL3ET6RMiDpjA6ob5zGZHRBLZghpen2/1UA8=; b=BwOttvQTKG6yGyFcQ/slWumG0iF2x/nnCi0P/PlpkMgdTI6fRX4YRxbWfx1QouB5W/ tz0mUwOCi/fCqHbzrAEpPQlMwpE3UCBnJhHwQM4NBt0QRpFxhQvCJiDyMTPD0A6f+wJT J9Z3ibR5ycVdPWEp8rDnKSEJ1zfs8wZv2m06Ra7z4RXPS71Rou1iG70VPZlZ6keSKvLD wHdwIA53A6/8hAaWUV0TJyJj470b6+8U+fJ8GYehBo9OmI41X+nO7vjesWCT8G9mzMf/ nJQ2uWZMwUlVjGQmjv9R8ZM1kEjkbimDNRWj+46Jp+0n6VnN+14vxOgs5EpzZAuCA+6l AWbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=L5B1dHnuL3ET6RMiDpjA6ob5zGZHRBLZghpen2/1UA8=; b=Q8k+y2SA+wFK4BAcnd6d8dcO3y9RFv2KdCyYCDHMNnngACpII17r5Nw7CiKRjyE/52 PTEXCjrz8zAuBfA/f18Qd9RVMfOkzc3e3/5H7gkTg4rQoZLA+LZqvluJQSgSTI6zYXZw epo260/HhJN1TPdYp9hRG0HIG9IljEnOpTalMLRTLG/x5GPzfoD10ecfsFd/PszJsCc7 FRzFf1Zp0N/xE2IzIeLuHCg8FqHf1THuyrfyah2rsGoFmmRfGCxvhXvGeZcao7h7T/1M D/D+pPldNItnZsSsJ5I1CVQrrV5ADcPV1I/FTCAQid4NMWzcBxu7seZbP+EF1VYP5AOq KBbQ== X-Gm-Message-State: AGi0PuZK9oIQQigvRn16AMYB6rV89on512lMKpdAPy9Io5/8isExqUXJ JQVLlEl2Ww46/UvSNAXBU8V7duySyZBS+fPrdshZAA== X-Google-Smtp-Source: APiQypKQ1rHrkKZvZEaYM6SWQvnvwW2MioWKLWCDjYSBeWK0Gcht8JSyrmfIw8HWeNlU9Y1hSQzMIlHf8soApNhGw+8= X-Received: by 2002:a2e:9dcd:: with SMTP id x13mr6501599ljj.120.1587756554796; Fri, 24 Apr 2020 12:29:14 -0700 (PDT) MIME-Version: 1.0 References: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> In-Reply-To: From: Eric Rescorla Date: Fri, 24 Apr 2020 12:28:38 -0700 Message-ID: To: Mike Bishop Cc: Paul Hoffman , Ben Schwartz , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000007058c405a40e6181" Archived-At: Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 19:29:20 -0000 --0000000000007058c405a40e6181 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Apr 24, 2020 at 12:16 PM Mike Bishop wrote: > Hijacking a connection requires being able to subvert connections from > that client and spoof the destination IP address. > My assumption was that you would forge the DHCP message that gave the client the IP. Getting an IP certificate would require doing that, not from one client=E2= =80=99s > vantage, but from every vantage the CA chooses to test from. If the CA > tests from multiple vantage points, the IP certificate is a stronger > assertion than simply being able to accept your connection. > Agreed. But let=E2=80=99s say we remove the HTTPS path. What do we do instead? Do= 53 is > unencrypted and just as unauthenticated. Speculative DoT is just as > unauthenticated, since either you=E2=80=99ll validate against an IP certi= ficate or > take whatever certificate is there. For the time being, all bootstrappin= g > requires an element of trust. I don=E2=80=99t dispute the weaknesses you= point > out; I simply don=E2=80=99t see that we=E2=80=99ve found a better alterna= tive. > Oh, I agree with that. My proposal is that we just admit that this is unauthenticated and live with it until we have an E2E story. -Ekr > > *From:* Add *On Behalf Of * Eric Rescorla > *Sent:* Friday, April 24, 2020 2:54 PM > *To:* Paul Hoffman > *Cc:* Ben Schwartz ; ADD Mailing li= st > > *Subject:* Re: [Add] [Ext] Drafts on upgrading stub-to-resolver > communication to encrypted > > > > > > > > On Fri, Apr 24, 2020 at 11:40 AM Paul Hoffman > wrote: > > On Apr 24, 2020, at 11:09 AM, Ben Schwartz 40google.com@dmarc.ietf.org> wrote: > > > > Thanks for the updated drafts. I think RESINFO is the most promising > path for resolver upgrade, and I'd like to see it implemented. > > > > The one major change I suggest is to remove the entire HTTPS mechanism > from the RESINFO draft. This mechanism creates a great deal of complexit= y, > doesn't follow good practices for HTTPS, and doesn't obviously enable any > additional use cases. Having multiple competing mechanisms also makes > interoperability less likely. > > The additional use case that was brought up in earlier work is that a stu= b > that wants to do DoH. > - It does not need to know how to make requests for a new DNS RRtype > - It can use HTTPS as it knows it > - It can get a response that can be authenticated > > I understand the desire not to allow unauthenticated HTTPS because of bes= t > practices. We can remove that from the draft, but then implementers will > likely go ahead and implement it anyway but without guidance about the > results. Note that we are only talking about unauthenticated HTTPS *for > this one use*, not in general. > > > If "in-band" RESINFO proves insufficient, an HTTPS-based mechanism coul= d > always be added in a later draft. > > Some people said it was insufficient because of inability to authenticate= . > > > > But the HTTPS mechanism is unauthenticated as well. And even if people do > use IP certs, then they mechanism by which they get the IP is largely > unauthenticated. > > > > I agree with Ben; this mechanism should be removed. > > > > -Ekr > > > > > --Paul Hoffman-- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > --0000000000007058c405a40e6181 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Apr 24, 2020 at 12:16 PM Mike= Bishop <mbishop@evequefou.be> wrote:

Hijacking a connection requires being able to subver= t connections from that client and spoof the destination IP address.=C2=A0<= /p>




Getting an IP certificate would require doing that, not f= rom one client=E2=80=99s vantage, but from every vantage the CA chooses to test from.=C2=A0 If the CA tests from multiple vantage points, the IP c= ertificate is a stronger assertion than simply being able to accept your co= nnection.


Agr= eed.


But let=E2=80=99s say we remove the= HTTPS path.=C2=A0 What do we do instead?=C2=A0 Do53 is unencrypted and jus= t as unauthenticated.=C2=A0 Speculative DoT is just as unauthenticated, sin= ce either you=E2=80=99ll validate against an IP certificate or take whateve= r certificate is there.=C2=A0 For the time being, all bootstrapping requires an element = of trust.=C2=A0 I don=E2=80=99t dispute the weaknesses you point out; I sim= ply don=E2=80=99t see that we=E2=80=99ve found a better alternative.


Oh, I agree with that. My proposa= l is that we just admit that this is unauthenticated and live with it until= we have an E2E story.

-Ekr

=C2=A0

From: Add <add-bounces@ietf.org> On Behalf Of Eric Rescorla
Sent: Friday, April 24, 2020 2:54 PM
To: Paul Hoffman <paul.hoffman@icann.org>
Cc: Ben Schwartz <bemasc=3D40google.com@dmarc.ietf.org>; ADD Mailing= list <add@ietf.org>
Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver commun= ication to encrypted

=C2=A0

=C2=A0

=C2=A0

On Apr 24, 2020, at 11:09 AM, Ben Schwartz <bemas= c=3D40goog= le.com@dmarc.ietf.org> wrote:
>
> Thanks for the updated drafts.=C2=A0 I think RESINFO is the most promi= sing path for resolver upgrade, and I'd like to see it implemented.
>
> The one major change I suggest is to remove the entire HTTPS mechanism= from the RESINFO draft.=C2=A0 This mechanism creates a great deal of compl= exity, doesn't follow good practices for HTTPS, and doesn't obvious= ly enable any additional use cases.=C2=A0 Having multiple competing mechanisms also makes interoperability less likely.

The additional use case that was brought up in earlier work is that a stub = that wants to do DoH.
- It does not need to know how to make requests for a new DNS RRtype
- It can use HTTPS as it knows it
- It can get a response that can be authenticated

I understand the desire not to allow unauthenticated HTTPS because of best = practices. We can remove that from the draft, but then implementers will li= kely go ahead and implement it anyway but without guidance about the result= s. Note that we are only talking about unauthenticated HTTPS *for this one use*, not in general.

> If "in-band" RESINFO proves insufficient, an HTTPS-based mec= hanism could always be added in a later draft.

Some people said it was insufficient because of inability to authenticate.<= u>

=C2=A0

But the HTTPS mechanism is unauthenticated as well. = And even if people do use IP certs, then they mechanism by which they get t= he IP is largely unauthenticated.

=C2=A0

I agree with Ben; this=C2=A0 mechanism should be rem= oved.

=C2=A0

-Ekr

=C2=A0


--Paul Hoffman--
Add mailing list
Add@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/add

--0000000000007058c405a40e6181-- From nobody Fri Apr 24 16:13:11 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D89A3A0F58 for ; Fri, 24 Apr 2020 16:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XOoIDYTHmFft for ; Fri, 24 Apr 2020 16:13:07 -0700 (PDT) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C42363A0F5B for ; Fri, 24 Apr 2020 16:13:06 -0700 (PDT) Received: by mail-wr1-x42d.google.com with SMTP id s10so13262528wrr.0 for ; Fri, 24 Apr 2020 16:13:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9BuxwhC3/wF3T3JR5G/1MBo7d99OyEjkc60uc7WnIuo=; b=BaTU7jF9q0/QY67NSB7S9iqV8CZQrlCGUcv/Wqs6AWAwoOmPrx/s9p3eznwNzlSy3+ tysHNHIMHawjzw97GL5DzqgI8AQ693N7ELGYr5rCqsDPXFJiYIdiXppQULrM4VrVtO4O U+m5ngSuM8VMXSShseLrHVRyAHCHlmjtjFprOkWuAy/LCBouRwU8gSvIdsLsE3xVosTh qhWjjpogud5UXw2ma49DclYa8EgaAReMSis0LH2GNZvkh+gjKj/TO5HSPWvMrAeDckmq Aze0fMXy/IQaEX7cgRJl9ggiAb4J72mgKTIC7f0g0n3hoNZ4VjSQaFCrdfEFBFLn2lUl +bvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9BuxwhC3/wF3T3JR5G/1MBo7d99OyEjkc60uc7WnIuo=; b=a5A0vvoGWNEnUrTq9fYN+87TDoPycx6frz4/yhk98sTrwfrbTPLegNm/rmXAFAldcD 8XRmlpfjEOAUJ3ta0P75vVJlTmIi2dF71HmOqr/b7S1xGWOxMtvg5CK6vPv31J/0pEF+ WQZCHKIoUHQb/UZ7PJFl0B/mnO9yK5Lnl3sPeOx2HP+kKeyMoaWSXaA11TvmPIQnYdBZ ggUdcaovT3kynk+QIoBgQMa6OP3yo3ywYroE0qWaFKkFlFd+AEc6raVYlV0NVwe+hOO4 tBIaNFpUZqjohljhd4ONR9yTC5s5DsaR8BbiSBIGs2BDXnLDIp/2P/UsEx9zfKpobvBm J08Q== X-Gm-Message-State: AGi0PuZcExNVgBBHxrvFpdtgbuSn7DLsTOqEJxSMXz7byuqB5N5/8xr2 NaIYOmQJAdJy6H7T92Oa2if2IsXMO0994hgTb4j+3Q== X-Google-Smtp-Source: APiQypJVjRYB6Er2nTGJ8bHmR7bzH1ozEv0DRisyLSCwqn/qW1JWH+tL1c4cO21r9OVolfpMFg9xj/dMmpxGAOGFxcE= X-Received: by 2002:a5d:6a8b:: with SMTP id s11mr13582853wru.258.1587769984728; Fri, 24 Apr 2020 16:13:04 -0700 (PDT) MIME-Version: 1.0 References: <57727489-B6E3-40A4-9E72-79EB78AC671C@icann.org> In-Reply-To: From: Ben Schwartz Date: Fri, 24 Apr 2020 19:12:52 -0400 Message-ID: To: Eric Rescorla Cc: Mike Bishop , Paul Hoffman , ADD Mailing list Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000f69ba805a411812c" Archived-At: Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Apr 2020 23:13:09 -0000 --000000000000f69ba805a411812c Content-Type: multipart/alternative; boundary="000000000000ed197905a41181ca" --000000000000ed197905a41181ca Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Maintaining authentication where it already exists is important. Introducing authentication where it does not exist is at best difficult. Currently, any client that identifies its DNS server by IP address has no authentication, whether or not that IP address is known to the user. I don't think we should try to fix that in this draft, especially if it adds complexity. As an example of authenticated servers, the only way for an Android user to explicitly activate DNS over TLS is to specify a server by hostname. (IP addresses are not allowed). That's a case where authentication exists, and RESINFO maintains it correctly. With RESINFO, a DNS client on Android could use the validated DoT channel to discover corresponding DoH endpoints securely. I think this is likely to be the pattern of the future. In cases where stub resolvers (or forwarders) are intended to use secure DNS, the server will be specified with a hostname, not just an IP address. On Fri, Apr 24, 2020 at 3:29 PM Eric Rescorla wrote: > > > On Fri, Apr 24, 2020 at 12:16 PM Mike Bishop wrote= : > >> Hijacking a connection requires being able to subvert connections from >> that client and spoof the destination IP address. >> > > My assumption was that you would forge the DHCP message that gave the > client the IP. > > > Getting an IP certificate would require doing that, not from one client= =E2=80=99s >> vantage, but from every vantage the CA chooses to test from. If the CA >> tests from multiple vantage points, the IP certificate is a stronger >> assertion than simply being able to accept your connection. >> > > Agreed. > > > But let=E2=80=99s say we remove the HTTPS path. What do we do instead? = Do53 is >> unencrypted and just as unauthenticated. Speculative DoT is just as >> unauthenticated, since either you=E2=80=99ll validate against an IP cert= ificate or >> take whatever certificate is there. For the time being, all bootstrappi= ng >> requires an element of trust. I don=E2=80=99t dispute the weaknesses yo= u point >> out; I simply don=E2=80=99t see that we=E2=80=99ve found a better altern= ative. >> > > Oh, I agree with that. My proposal is that we just admit that this is > unauthenticated and live with it until we have an E2E story. > > -Ekr > > >> >> *From:* Add *On Behalf Of * Eric Rescorla >> *Sent:* Friday, April 24, 2020 2:54 PM >> *To:* Paul Hoffman >> *Cc:* Ben Schwartz ; ADD Mailing >> list >> *Subject:* Re: [Add] [Ext] Drafts on upgrading stub-to-resolver >> communication to encrypted >> >> >> >> >> >> >> >> On Fri, Apr 24, 2020 at 11:40 AM Paul Hoffman >> wrote: >> >> On Apr 24, 2020, at 11:09 AM, Ben Schwartz > 40google.com@dmarc.ietf.org> wrote: >> > >> > Thanks for the updated drafts. I think RESINFO is the most promising >> path for resolver upgrade, and I'd like to see it implemented. >> > >> > The one major change I suggest is to remove the entire HTTPS mechanism >> from the RESINFO draft. This mechanism creates a great deal of complexi= ty, >> doesn't follow good practices for HTTPS, and doesn't obviously enable an= y >> additional use cases. Having multiple competing mechanisms also makes >> interoperability less likely. >> >> The additional use case that was brought up in earlier work is that a >> stub that wants to do DoH. >> - It does not need to know how to make requests for a new DNS RRtype >> - It can use HTTPS as it knows it >> - It can get a response that can be authenticated >> >> I understand the desire not to allow unauthenticated HTTPS because of >> best practices. We can remove that from the draft, but then implementers >> will likely go ahead and implement it anyway but without guidance about = the >> results. Note that we are only talking about unauthenticated HTTPS *for >> this one use*, not in general. >> >> > If "in-band" RESINFO proves insufficient, an HTTPS-based mechanism >> could always be added in a later draft. >> >> Some people said it was insufficient because of inability to authenticat= e. >> >> >> >> But the HTTPS mechanism is unauthenticated as well. And even if people d= o >> use IP certs, then they mechanism by which they get the IP is largely >> unauthenticated. >> >> >> >> I agree with Ben; this mechanism should be removed. >> >> >> >> -Ekr >> >> >> >> >> --Paul Hoffman-- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> >> --000000000000ed197905a41181ca Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Maintaining authentication where it already exists is= important.=C2=A0 Introducing authentication where it does not exist is at = best difficult.

Currently, any client that identif= ies its=C2=A0DNS server by IP address has no authentication, whether or not= that IP address is known to the user.=C2=A0 I don't think we should tr= y to fix that in this draft, especially if it adds complexity.

As an example of authenticated servers= , the only way for an Android user to explicitly activate DNS over TLS is t= o specify a server by hostname.=C2=A0 (IP addresses are not allowed).=C2=A0= That's a case where authentication exists,=C2=A0and RESINFO maintains = it correctly.=C2=A0 With RESINFO, a DNS client on Android could use the val= idated DoT channel to discover corresponding DoH endpoints securely.
<= div dir=3D"ltr">
I think this is likely to be the pattern of = the future.=C2=A0 In cases where stub resolvers (or forwarders) are intende= d to use secure DNS, the server will be specified with a hostname, not just= an IP address.

On Fri, Apr 24, 2020 at 3:29 PM Eric Rescorla <= ;ekr@rtfm.com> wrote:


On Fri, Apr 24, 2020 at 12:16 PM Mike Bishop <mbishop@evequefou.be> wrote:=

Hijacking a connection requires being able to subver= t connections from that client and spoof the destination IP address.=C2=A0<= /p>


My assumption was that you = would forge the DHCP message that gave the client the IP.


Getting an IP certificate would r= equire doing that, not from one client=E2=80=99s vantage, but from every va= ntage the CA chooses to test from.=C2=A0 If the CA tests from multiple vantage points, the IP c= ertificate is a stronger assertion than simply being able to accept your co= nnection.


Agr= eed.


But let=E2= =80=99s say we remove the HTTPS path.=C2=A0 What do we do instead?=C2=A0 Do= 53 is unencrypted and just as unauthenticated.=C2=A0 Speculative DoT is jus= t as unauthenticated, since either you=E2=80=99ll validate against an IP ce= rtificate or take whatever certificate is there.=C2=A0 For the time being, all bootstrapping requires an element = of trust.=C2=A0 I don=E2=80=99t dispute the weaknesses you point out; I sim= ply don=E2=80=99t see that we=E2=80=99ve found a better alternative.


Oh, I agree with that. My proposa= l is that we just admit that this is unauthenticated and live with it until= we have an E2E story.

-Ekr

=C2=A0

From: Add <add-bounces@ietf.org> On Behalf Of Eric Rescorla
Sent: Friday, April 24, 2020 2:54 PM
To: Paul Hoffman <paul.hoffman@icann.org>
Cc: Ben Schwartz <bemasc=3D40google.com@dmarc.ietf.org>; ADD Mailing= list <add@ietf.org>
Subject: Re: [Add] [Ext] Drafts on upgrading stub-to-resolver commun= ication to encrypted

=C2=A0

=C2=A0

=C2=A0

On Apr 24, 2020, at 11:09 AM, Ben Schwartz <bemas= c=3D40goog= le.com@dmarc.ietf.org> wrote:
>
> Thanks for the updated drafts.=C2=A0 I think RESINFO is the most promi= sing path for resolver upgrade, and I'd like to see it implemented.
>
> The one major change I suggest is to remove the entire HTTPS mechanism= from the RESINFO draft.=C2=A0 This mechanism creates a great deal of compl= exity, doesn't follow good practices for HTTPS, and doesn't obvious= ly enable any additional use cases.=C2=A0 Having multiple competing mechanisms also makes interoperability less likely.

The additional use case that was brought up in earlier work is that a stub = that wants to do DoH.
- It does not need to know how to make requests for a new DNS RRtype
- It can use HTTPS as it knows it
- It can get a response that can be authenticated

I understand the desire not to allow unauthenticated HTTPS because of best = practices. We can remove that from the draft, but then implementers will li= kely go ahead and implement it anyway but without guidance about the result= s. Note that we are only talking about unauthenticated HTTPS *for this one use*, not in general.

> If "in-band" RESINFO proves insufficient, an HTTPS-based mec= hanism could always be added in a later draft.

Some people said it was insufficient because of inability to authenticate.<= u>

=C2=A0

But the HTTPS mechanism is unauthenticated as well. = And even if people do use IP certs, then they mechanism by which they get t= he IP is largely unauthenticated.

=C2=A0

I agree with Ben; this=C2=A0 mechanism should be rem= oved.

=C2=A0

-Ekr

=C2=A0


--Paul Hoffman--
Add mailing list
Add@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/add

--000000000000ed197905a41181ca-- --000000000000f69ba805a411812c Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAGuEkclHdvQz4ddwMbsMFgwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDAxMDcwODIyMjJaFw0yMDA3MDUwODIyMjJaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwrwIVY3rOZp1Papu Yl53bMQ2H713K9788lbE9itKEL7tJAJO7GqZGRbfxPUVRRDYPntAf+j0JZZOvf9Ye6uN12SNW+v1 V0o5YeXtXMpNOkprr0v0v7qc80yhbq8RIIiX4usDJwuDGbcL/VKnlCTDPRp+VWUB8rkaqObapi/F BGiPWXBqiT36W5opr6eJjUHuGiqzmK/1lCXMZSn6n3wkkbnonFsF5G4kfie+n/DDNd1hlqd06bzB rCnToS+BV/Y9BroXiOjVWJnMe/8Rce7zA8Dzr0kU+gacBArnMiDyCvUGjngbASU7VaIPJBc/zBzI L5QoeUAfgEJcGvFIEJUUIwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQU+WKCBtTdknJDbiAjMsikOsbLHoAwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQA2eHjHcJ8kaiqDQGv7TdNEBFiDI8omlzpnnuQFciHkWhkfi3mQwuuZ IQIHd+JNpV0TQ8TqMNAr4YSPWOjwTd3UNxm+qghV3KC9j/Ygq39OzUlqxWv2lFH8mGFpbview2GI xZWXTCRbeod3ZevhC0lOUVVx4NCHe5yWSwjEpZHUilSnjyqN7ssC0eYQBylFOf2xVxu1JB8Xewgw Vk/DeOzsapxxjiuw2UZsDZbtVJvEx/C34GkACLR4Lm0k6O5ujAiDBkyy2nklxLhmKb9fyiH51B3j oRE8y99FJOCHoye9E/P2tK12x9w9ZeF07eWAdX3OkhTne1DitwLidojuyFm9MYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhABrhJHJR3b0M+HXcDG7DBYMA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCDJnkH7VzMaEO/XnucJwjPVUorAc70w1Cc474BJ/DHNdDAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA0MjQyMzEzMDVaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAlyUx1WUvl3BFgK6kEvPqXqij1i6GdwPXTQNRK9LMAjJOLB1IbkIYhxH41P8IMSzYXGoHzVWA Agd6eZWpaAtLwM//HroBB9w7iOPyh9RIASoFoSefnS8jEGduJ9fHh4fqbD8Pa8+Whb4FgSeXj2e6 6WqR7KvwsirxkIhJ98nWxmLiE0XOMHbDdBPdG57GlEp9jMeHc7oa1IqOZILAhaXs07JjMwRoW8RB EHUsXbwoMr1/casyhbcYj/xKd1Ubh0RaklkIm6C1y4CUKSEi/1WFXD/yWmJPFQX6a01zqJuzFhmX hZ1X/2is4lnZgq0YPqo9JwEuslubhW4Kqj/A+cLbRw== --000000000000f69ba805a411812c-- From nobody Mon Apr 27 07:55:29 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DD2F3A0C29 for ; Mon, 27 Apr 2020 07:55:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CHKnqPTAYol6 for ; Mon, 27 Apr 2020 07:55:25 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADD693A0C28 for ; Mon, 27 Apr 2020 07:55:23 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx4.open-xchange.com (Postfix) with ESMTPS id BC4C36A267; Mon, 27 Apr 2020 16:55:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1587999319; bh=KOk7q5CJIkFb2jBANNdEu9jNw8s9sDZPeuVKV7A2mFs=; h=Date:From:To:In-Reply-To:References:Subject:From; b=0BL92FKmJouVS1glGRMJXIbD02mWSNqh8hgzNPUmWO+3nRZp+2yH3364Y4gYNRyDs sHKt6jvPpdzV5JWZ40P9xoKKcpebcnVjHJdSODTNvC1NT78aSvQd9cUTuW+xkIOl8L aZ7JyBe22wG6rNDPy0JEeYFXbkN8NLRODWtUXJHOBhdOO6f1QtXbo2+IcM0OILLsi5 tKng/Cw6rgF27mek4WpnIzCOy0wJV2Ofvu/ineIhWudVaTxIdI//EL6ccknn/d/QDY z1i7jczgDidrvdZxcmqrCWYK5lHQiPocRJBEvcO90EXtc8H4SBjUg0t8L7aV38BZhP uJLQ27zRW4PlA== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id AD6D83C0536; Mon, 27 Apr 2020 16:55:19 +0200 (CEST) Date: Mon, 27 Apr 2020 16:55:19 +0200 (CEST) From: Vittorio Bertola To: Paul Hoffman , ADD Mailing list Message-ID: <227920378.4548.1587999319612@appsuite-gw2.open-xchange.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Apr 2020 14:55:27 -0000 > Il 24/04/2020 18:45 Paul Hoffman ha scritto: > > Please let us know if you find these documents useful for the discussion of direct upgrade instead of discovery. Also, please let us know if we have missed any salient points. If so, we could ask the chairs to make these into WG documents. Thanks for doing this and I support adoption at least for the resinfo draft. On the resinfo draft, I want to support other comments saying that the HTTP-based mechanism should be removed. As an implementer, having two alternative methods means that you possibly have to implement and maintain both, doubling the work and the potential number of issues. I get the point that some clients already speak HTTPS and so why not use it, but there is the other point that all resolvers must speak DNS, so using DNS is the easiest path to widespread implementation on the server side. Not all resolvers will support DoH, so they would have to implement and run an HTTP server just to answer possible discovery queries, since there is no guarantee that even a client willing to speak DoT or DNS will not use the HTTP-based discovery mechanism. Even resolver platforms that implement DoH are often doing so by adding a separate layer of front-end HTTP termination servers that convert the messages into DNS queries to the actual resolver, so the resolver itself does not run an HTTP server over its own IP address (the one that the user's system already knows and that would go into the well-known URI), and would have to add one just to this purpose. Moreover, while the DNS-based mechanism can work with forwarders, including home network CPEs, the HTTP-based one would end up making the request not to the actual resolver but to the CPE. This would entail modifying all CPEs (which is a daunting task that takes years in most big operator environments) and having them relay the HTTP request in some way to the resolver platform (which needs to be implemented). The DNS-based mechanism, instead, is much more straightforward - it automatically follows the same path that the queries will follow, and so it will reach the correct resolver. Thanks for removing the reverse IP address in the queried domain name, which created problems in the CPE scenario above. I would still like to hear opinions on the classic "new RRTYPE vs TXT record" discussion, as I do not know whether adopting a new RRTYPE would hinder quick support, while TXT records can safely work right now almost in any scenario. Regarding the second draft: I think it would benefit from a presentation before commenting. Anyway, I was a bit surprised by the fact that it seems to prescribe an algorithm (though configurable) for clients to decide which transport to use. I would rather expect a mechanism that allows clients to retrieve a known unencrypted resolver's equivalent DoT and/or DoH endpoints, through any of the methods supported in draft-resinfo (though, as I said, I really hope we will just end up with the DNS one), and then, what the client does with that information is none of our business. Anyway, thanks for the work and I look forward to more discussion. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Apr 28 07:19:48 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 160FC3A160E for ; Tue, 28 Apr 2020 07:19:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4LfeSWGxnM6F for ; Tue, 28 Apr 2020 07:19:44 -0700 (PDT) Received: from mail-il1-x133.google.com (mail-il1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9E573A1612 for ; Tue, 28 Apr 2020 07:19:43 -0700 (PDT) Received: by mail-il1-x133.google.com with SMTP id c16so20407902ilr.3 for ; Tue, 28 Apr 2020 07:19:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3vqew5Q/iEeP5Lj1GMCgeq4K2zTQr24duAP1jruCf3c=; b=jwW3H1himS7opxxMRcyIdj4tO3Lm+GXG4CGS20HuB+9PTOcI099XkNM+Hl/jsy6/7/ PUwJbwyxIOT9mtea9DTbSYQjWiOEGi4XjES6RwRc/Ve7XiPjDlWvn3gHCsYTgVZqL+tW vksmxu11z48xbaNlRbn5eUhtQB35rATcCnU8lCMcXK7rfOKaSKpKeqdbbTBFh04poWUW /qMF4WNsygaSCBb+CXu3BBlBJwWTjroli58ejnJbd77L/D9gbmr3/AFmiRqojAl/4xpr R0JigQEGT3CAzXYbGNWVEUfxqGZZv+l/XfN9lCkaUTk1MUiOndIfixj/MkuFQAGE+e1s 4eyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3vqew5Q/iEeP5Lj1GMCgeq4K2zTQr24duAP1jruCf3c=; b=t0iznEYjDdD0XfVGnjHI1ChvcKMr/JB4jQgc9KQZChGP7QUJuaS7yFbUE+APnI6iUH fvvvDztlJ8Z3h95KAIvX/+DE03SUknX1utlwKs1fbSlUwejKwg2XHNiNQ7WerDsUnBR5 yE7hRCV5ZGuoiOOusDnf1FEFX7YIQtBB63kRFRbV5Qx17fcIQpK19BDKvvQlP3wm/xXz IpnBsg/M3ssvAqUa7hFtScf6iKWDCTWqhIkjTPz59mSGqLjtHz7rAdKVTzuVjbhY4avT VIfm2g0bmat7cL+7p7lXwI7El4RVj5y051N8RcnhTOPcip9eb0RwZbaNb5ocakvs1FST WdQQ== X-Gm-Message-State: AGi0PuYFwyU0HosXreEyAnpdqiPzCK8JcYHG1M0f/YbFAfhiNXrhXqWp 3IH6PM0NriYRUXk4XAuUQRNENj0bbLIDldnGL4G6ZdLz10I= X-Google-Smtp-Source: APiQypJAarjhZISbw0PMYX15iQwOXRXPeoC8J0LK6dXSEdMbBkz5n0Gsc73tPDow9ku0JsiTZU5Zlit0QhUo9NHoZUw= X-Received: by 2002:a05:6e02:4cd:: with SMTP id f13mr26820300ils.300.1588083583165; Tue, 28 Apr 2020 07:19:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: tirumal reddy Date: Tue, 28 Apr 2020 19:49:30 +0530 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d92af005a45a8578" Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 14:19:46 -0000 --000000000000d92af005a45a8578 Content-Type: text/plain; charset="UTF-8" Are you planning to replace https://tools.ietf.org/html/draft-ietf-dnsop-resolver-information-01 with draft-pp-add-resinfo ? -Tiru On Fri, 24 Apr 2020 at 22:16, Paul Hoffman wrote: > Greetings again. We have just published two drafts, > draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address the easier > problem that this WG wanted to tackle, namely how a stub can upgrade from > plain DNS to encrypted DNS for the resolver it is currently using. The > method in draft-pp-add-stub-upgrade is quite simple, but it includes all of > the variables that we have heard in the discussion over the last year. The > format in draft-pp-add-resinfo is the minimum needed for stub upgrade, but > will also possibly be useful for the more difficult discovery protocols > being discussed in the WG. > > Please let us know if you find these documents useful for the discussion > of direct upgrade instead of discovery. Also, please let us know if we have > missed any salient points. If so, we could ask the chairs to make these > into WG documents. > > --Paul Hoffman and Puneet Sood > > https://datatracker.ietf.org/doc/draft-pp-add-stub-upgrade/ > > Name: draft-pp-add-stub-upgrade > Revision: 00 > Title: Upgrading Communication from Stub Resolvers to DoT or DoH > Document date: 2020-04-24 > Group: Individual Submission > Pages: 7 > > Abstract: > This document describes methods for a DNS stub resolver to upgrade > its communications with a known recursive resolver to include > encrytion using DoT or DoH. This protocol is designed for the > scenario where the stub resolver already has the IP address of the > recursive resolver. > > Other protocols under develpment address scenarios where the stub > resolver wants to discover recursive resolvers that use DoT or DoH. > This document does not cover such discovery. > > > https://datatracker.ietf.org/doc/draft-pp-add-resinfo/ > > Name: draft-pp-add-resinfo > Revision: 00 > Title: DNS Resolver Information Self-publication > Document date: 2020-04-24 > Group: Individual Submission > Pages: 9 > > Abstract: > This document describes methods for DNS resolvers to self-publish > information about themselves. The information is returned as a JSON > object. The names in this object are defined in an IANA registry > that allows for light-weight registration. Applications and > operating systems can use the methods defined here to get the > information from resolvers in order to make choices about how to send > future queries to those resolvers. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000d92af005a45a8578 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 24 Apr 202= 0 at 22:16, Paul Hoffman <paul= .hoffman@icann.org> wrote:
Greetings again. We have just published two drafts, draft= -pp-add-stub-upgrade and draft-pp-add-resinfo, to address the easier proble= m that this WG wanted to tackle, namely how a stub can upgrade from plain D= NS to encrypted DNS for the resolver it is currently using. The method in d= raft-pp-add-stub-upgrade is quite simple, but it includes all of the variab= les that we have heard in the discussion over the last year. The format in = draft-pp-add-resinfo is the minimum needed for stub upgrade, but will also = possibly be useful for the more difficult discovery protocols being discuss= ed in the WG.

Please let us know if you find these documents useful for the discussion of= direct upgrade instead of discovery. Also, please let us know if we have m= issed any salient points. If so, we could ask the chairs to make these into= WG documents.

--Paul Hoffman and Puneet Sood

https://datatracker.ietf.org/doc/draft-pp= -add-stub-upgrade/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-stub-upgrade
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Upgrading Communication from Stub = Resolvers to DoT or DoH
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7

Abstract:
=C2=A0 This document describes methods for a DNS stub resolver to upgrade =C2=A0 its communications with a known recursive resolver to include
=C2=A0 encrytion using DoT or DoH.=C2=A0 This protocol is designed for the<= br> =C2=A0 scenario where the stub resolver already has the IP address of the =C2=A0 recursive resolver.

=C2=A0 Other protocols under develpment address scenarios where the stub =C2=A0 resolver wants to discover recursive resolvers that use DoT or DoH.<= br> =C2=A0 This document does not cover such discovery.


https://datatracker.ietf.org/doc/draft-pp-add-= resinfo/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-resinfo
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS Resolver Information Self-publ= ication
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9

Abstract:
=C2=A0 This document describes methods for DNS resolvers to self-publish =C2=A0 information about themselves.=C2=A0 The information is returned as a= JSON
=C2=A0 object.=C2=A0 The names in this object are defined in an IANA regist= ry
=C2=A0 that allows for light-weight registration.=C2=A0 Applications and =C2=A0 operating systems can use the methods defined here to get the
=C2=A0 information from resolvers in order to make choices about how to sen= d
=C2=A0 future queries to those resolvers.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000d92af005a45a8578-- From nobody Tue Apr 28 07:59:29 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B2E63A1701 for ; Tue, 28 Apr 2020 07:59:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qDAWZ9Sa-oBF for ; Tue, 28 Apr 2020 07:59:19 -0700 (PDT) Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com [IPv6:2a00:1450:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1DB43A16A9 for ; Tue, 28 Apr 2020 07:59:15 -0700 (PDT) Received: by mail-wr1-x433.google.com with SMTP id x18so25004136wrq.2 for ; Tue, 28 Apr 2020 07:59:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WmNPZGnDm0SzHy3LOEe0KTpJGlHHcN2CimRnnMMvSrs=; b=Ew1rBMKvbEDDEj5/E55urHyXHUyZlqIEBbAskbJkyyFsvDFd0OsPv9Bg1w1bSAFwZw lAioGfpuoHxU3nnNJtKGiVJrBcxDh4z64m7es1a3FjMBDsWgue6qhhpzIO16C0C7ZDBN CDwGFzuar7HfXW+5CnAO6qaCWqtdNH8aJeGhXn08C7NzprPMU1DD0LvAIMM5mxIAG1Fn V6aERyaBcaKz6ZPmLuqbwyfDQlRFS5g79KAbiL7OgURQTYZmPstbU3+OLSxd70l9qU3c LmrYwthEVB8MHH/DWTjHH2or0NhQUw5pYlK+xBIalJs1xhb9TMVnC0IcX8DAkw82HHiz dpjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WmNPZGnDm0SzHy3LOEe0KTpJGlHHcN2CimRnnMMvSrs=; b=uCXuW5ZdnGGhiUIXMDVJGhkB+z5XzHStQ0eLVDQ4EDOaQD/gZwSRx6WKkURtXF6B4s 3323r/7gifuy/pypLoxF+BFqRHYsCB8ZJbgx/E9pquVJGXs70EB7r8O6TVISjx/JBmv/ jtjdBlgh7uAfwBFZcEBCX7WC31dLaijfVgKoyNNU/KmkYjAMcQriSiEQq/LOBlOfI2jj AvtNaskdvaJgftg5XFeI2vG1hUaNouYg17gBT1hGp5utNsLp7VsfKiKYaY2vO4Pq4+v2 ObPXlkGuGfdEkk6qH7doT3B1eL4sdFulW8hrWP7FEvePbIKBleXKIbAYeREvyd5uVYgp M+Ow== X-Gm-Message-State: AGi0PuY1RgJU1BPaAZJxxnL1WuqS35lyS0oRAxengsKS6ZyjLD25wHYl SqZXaiBl++skckUMR463CKltfEKVdRNasInfzF9QBps6C3g= X-Google-Smtp-Source: APiQypLwTlCC6UTqNGod3p/lmZtVSemQzuu0ZglGVlQFdI3GczKe/R7KF63ssvQg+HVVHDdRQpQC+Rrj4hwTc8pLXZs= X-Received: by 2002:adf:e58e:: with SMTP id l14mr32156839wrm.186.1588085953595; Tue, 28 Apr 2020 07:59:13 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Orth Date: Tue, 28 Apr 2020 10:59:02 -0400 Message-ID: To: ADD Mailing list Cc: Paul Hoffman Content-Type: multipart/alternative; boundary="000000000000237ab805a45b13bc" Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 14:59:28 -0000 --000000000000237ab805a45b13bc Content-Type: text/plain; charset="UTF-8" I generally support both documents and would support ADD adoption. Re draft-pp-add-stub-upgrade: I do worry that it goes a little bit too far into "policy" in laying out a specific algorithm, even if it's full of options to allow clients to choose their own behavior. Might be better if framed more explicitly as a "descriptive example" rather than the prescriptive way to implement it. But I find the draft overall helpful just for clearly laying out both the opportunistic DoT and the DoH resinfo tag. Re draft-pp-add-resinfo: Definitely think this is the best overall draft we have for the common problem of retrieving resolver information. I'm personally conflicted on the HTTP-based mechanism. Others have made some solid arguments against it already in this thread, but I would be sad to lose our best option for a secure mechanism. It's correct that the DNS IP address typically comes from insecure DHCP, but in many cases that is only exposed on the limited local network or maybe the IP was set on the machine rather than using DHCP, so the resinfo messages could sometimes (often?) have a much bigger exposure. Then again, since the internet seems not quite ready for CAs to widely give certs for IP addresses, maybe it would be best to remove it from this draft and create a new draft in the future once the mechanism becomes more viable. On Tue, Apr 28, 2020 at 10:19 AM tirumal reddy wrote: > Are you planning to replace > https://tools.ietf.org/html/draft-ietf-dnsop-resolver-information-01 with > draft-pp-add-resinfo ? > > -Tiru > > On Fri, 24 Apr 2020 at 22:16, Paul Hoffman > wrote: > >> Greetings again. We have just published two drafts, >> draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address the easier >> problem that this WG wanted to tackle, namely how a stub can upgrade from >> plain DNS to encrypted DNS for the resolver it is currently using. The >> method in draft-pp-add-stub-upgrade is quite simple, but it includes all of >> the variables that we have heard in the discussion over the last year. The >> format in draft-pp-add-resinfo is the minimum needed for stub upgrade, but >> will also possibly be useful for the more difficult discovery protocols >> being discussed in the WG. >> >> Please let us know if you find these documents useful for the discussion >> of direct upgrade instead of discovery. Also, please let us know if we have >> missed any salient points. If so, we could ask the chairs to make these >> into WG documents. >> >> --Paul Hoffman and Puneet Sood >> >> https://datatracker.ietf.org/doc/draft-pp-add-stub-upgrade/ >> >> Name: draft-pp-add-stub-upgrade >> Revision: 00 >> Title: Upgrading Communication from Stub Resolvers to DoT or DoH >> Document date: 2020-04-24 >> Group: Individual Submission >> Pages: 7 >> >> Abstract: >> This document describes methods for a DNS stub resolver to upgrade >> its communications with a known recursive resolver to include >> encrytion using DoT or DoH. This protocol is designed for the >> scenario where the stub resolver already has the IP address of the >> recursive resolver. >> >> Other protocols under develpment address scenarios where the stub >> resolver wants to discover recursive resolvers that use DoT or DoH. >> This document does not cover such discovery. >> >> >> https://datatracker.ietf.org/doc/draft-pp-add-resinfo/ >> >> Name: draft-pp-add-resinfo >> Revision: 00 >> Title: DNS Resolver Information Self-publication >> Document date: 2020-04-24 >> Group: Individual Submission >> Pages: 9 >> >> Abstract: >> This document describes methods for DNS resolvers to self-publish >> information about themselves. The information is returned as a JSON >> object. The names in this object are defined in an IANA registry >> that allows for light-weight registration. Applications and >> operating systems can use the methods defined here to get the >> information from resolvers in order to make choices about how to send >> future queries to those resolvers. >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000237ab805a45b13bc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I generally support both documents and would support ADD a= doption.

Re=C2=A0draft-pp-add-stub-upgrade: I do worry t= hat it goes a little bit too far into "policy" in laying out a sp= ecific algorithm, even if it's full of options to allow clients to choo= se their own behavior.=C2=A0 Might be better if framed more explicitly as a= "descriptive example" rather than the prescriptive way to implem= ent it.=C2=A0 But I find the draft overall helpful just for clearly laying = out both the opportunistic DoT and the DoH resinfo tag.

Re=C2=A0draft-pp-add-resinfo: Definitely think this is the best overa= ll draft we have for the common problem of retrieving resolver information.= =C2=A0 I'm personally conflicted on the HTTP-based mechanism.=C2=A0 Oth= ers have made some solid arguments against it already in this thread, but I= would be sad to lose our best option for a secure mechanism.=C2=A0 It'= s correct that the DNS IP address typically comes from insecure DHCP, but i= n many cases that is only exposed on the limited local network or maybe the= IP was set on the machine rather than using DHCP, so the resinfo messages = could sometimes (often?) have a much bigger exposure.=C2=A0 Then again, sin= ce the internet seems not quite ready for CAs to widely give certs for IP a= ddresses, maybe it would be best to remove it from this draft and create a = new draft in the future once the mechanism becomes more viable.
=
On Tue= , Apr 28, 2020 at 10:19 AM tirumal reddy <kondtir@gmail.com> wrote:
Are you planning to replace= =20 https://tools.ietf.org/html/draft-ietf-dnsop-resolv= er-information-01 with=20 draft-pp-add-resinfo ?

-Tiru

On Fri, 24 Apr 202= 0 at 22:16, Paul Hoffman <paul..hoffman@icann.org> wrote:
Greetings again. We have just publishe= d two drafts, draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to addres= s the easier problem that this WG wanted to tackle, namely how a stub can u= pgrade from plain DNS to encrypted DNS for the resolver it is currently usi= ng. The method in draft-pp-add-stub-upgrade is quite simple, but it include= s all of the variables that we have heard in the discussion over the last y= ear. The format in draft-pp-add-resinfo is the minimum needed for stub upgr= ade, but will also possibly be useful for the more difficult discovery prot= ocols being discussed in the WG.

Please let us know if you find these documents useful for the discussion of= direct upgrade instead of discovery. Also, please let us know if we have m= issed any salient points. If so, we could ask the chairs to make these into= WG documents.

--Paul Hoffman and Puneet Sood

https://datatracker.ietf.org/doc/draft-pp= -add-stub-upgrade/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-stub-upgrade
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Upgrading Communication from Stub = Resolvers to DoT or DoH
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7

Abstract:
=C2=A0 This document describes methods for a DNS stub resolver to upgrade =C2=A0 its communications with a known recursive resolver to include
=C2=A0 encrytion using DoT or DoH.=C2=A0 This protocol is designed for the<= br> =C2=A0 scenario where the stub resolver already has the IP address of the =C2=A0 recursive resolver.

=C2=A0 Other protocols under develpment address scenarios where the stub =C2=A0 resolver wants to discover recursive resolvers that use DoT or DoH.<= br> =C2=A0 This document does not cover such discovery.


https://datatracker.ietf.org/doc/draft-pp-add-= resinfo/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-resinfo
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS Resolver Information Self-publ= ication
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9

Abstract:
=C2=A0 This document describes methods for DNS resolvers to self-publish =C2=A0 information about themselves.=C2=A0 The information is returned as a= JSON
=C2=A0 object.=C2=A0 The names in this object are defined in an IANA regist= ry
=C2=A0 that allows for light-weight registration.=C2=A0 Applications and =C2=A0 operating systems can use the methods defined here to get the
=C2=A0 information from resolvers in order to make choices about how to sen= d
=C2=A0 future queries to those resolvers.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000237ab805a45b13bc-- From nobody Tue Apr 28 08:06:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D1F73A168F for ; Tue, 28 Apr 2020 08:06:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xlaOOe-BSgJF for ; Tue, 28 Apr 2020 08:06:02 -0700 (PDT) Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDADC3A168B for ; Tue, 28 Apr 2020 08:06:01 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id j2so25053886wrs.9 for ; Tue, 28 Apr 2020 08:06:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=h8VA6tH6apjFglyzL28IshL+HXKBpsvH8Jq0BRRMKrQ=; b=Tt2qh76LPw9nFhqAqpxNP+WxVdBzHkmvoZWT/DHgKf+fxnd24gyKwV6OVQkoOgPqPA ihziR9EELTXjEE5n4zGd1H8gQb6uHRl2/hjXmdb9HgYc4hmVZCBXNIAciBYmWkzcQUmd weysHPIEYvmH6hhWjHDRkLs0rGgViCGt6FSvg3YIFeo5hbHyLveunyI9vNoTubAcznDs /4Av0IMmy2r+Ct4TnAM3dFdCvfwdgz+edKmovzFkT+lKyQhgW/yk5axxjammXbrhCPxo ASI4/9GFCg4p2/N8ZV+U3bhC1vEuwZ5nMkqgqRw2Uj6plUMW3MIcl+taBUwz+f0ISZnm QevQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=h8VA6tH6apjFglyzL28IshL+HXKBpsvH8Jq0BRRMKrQ=; b=PdQ4kFj97RvUSQhHOf0wiP1s75LFp7LsMdcDteCF2fhrTTQrJoU1OLn8Rpeg+NcVki QwEYmQqJY+BdissP0nmH2Vg/pJTFvCLJ6eGTutKBANjcuTDcRY/hyViNOFE+Kuhj376t W8pKHb3Ul455FqR54EJct+ay++0bA2DTX5n7Y8Rg4ubL/+xbMuEyRsyF8KNW5xtxBI1K jqYPpF5zH3RYUcDd6YMdUlmdmwBEfu0l2r+/NWuq0jyVhmWs6nbL6FKfssyj99LUFz4c jgiWCeROBStftzrMMyaxnsojDOXrWDxUJu7uN7UYraGlltkkd0DsmxYlnNn+s+6KIgpX Dzgg== X-Gm-Message-State: AGi0PubV4tA0HDe4qeiWd3j6xbZq6J/daZL01GVSaUCjOPz4ZHcwerpd zjv2WjJliyr6YpOgP8CNDF1JK5sGfE1HktyyGKUn3gdk X-Google-Smtp-Source: APiQypIUZvsJ33HKApSwP0psy00UxBlLClWUl+wgedg2w6Uhw07wzXdgAjwW4aeU9yzxNgVKgnKc/xZYuXeKXgr4THM= X-Received: by 2002:adf:f450:: with SMTP id f16mr33565517wrp.346.1588086359838; Tue, 28 Apr 2020 08:05:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Orth Date: Tue, 28 Apr 2020 11:05:48 -0400 Message-ID: To: ADD Mailing list Cc: Paul Hoffman Content-Type: multipart/alternative; boundary="0000000000005a4ec805a45b2b4b" Archived-At: Subject: Re: [Add] Drafts on upgrading stub-to-resolver communication to encrypted X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 15:06:05 -0000 --0000000000005a4ec805a45b2b4b Content-Type: text/plain; charset="UTF-8" And another point regarding DNS vs HTTP mechanisms: Is there any concerns regarding clients with DoH/DoT stubs but that rely on getaddrinfo() from the system for Classic DNS? Would HTTP be more palatable for those clients? Then again, if a client has a full DoH/DoT implementation, maybe easier for them to add a Classic DNS implementation than it would be for many recursives to add an HTTPS server. On Tue, Apr 28, 2020 at 10:59 AM Eric Orth wrote: > I generally support both documents and would support ADD adoption. > > Re draft-pp-add-stub-upgrade: I do worry that it goes a little bit too far > into "policy" in laying out a specific algorithm, even if it's full of > options to allow clients to choose their own behavior. Might be better if > framed more explicitly as a "descriptive example" rather than the > prescriptive way to implement it. But I find the draft overall helpful > just for clearly laying out both the opportunistic DoT and the DoH resinfo > tag. > > Re draft-pp-add-resinfo: Definitely think this is the best overall draft > we have for the common problem of retrieving resolver information. I'm > personally conflicted on the HTTP-based mechanism. Others have made some > solid arguments against it already in this thread, but I would be sad to > lose our best option for a secure mechanism. It's correct that the DNS IP > address typically comes from insecure DHCP, but in many cases that is only > exposed on the limited local network or maybe the IP was set on the machine > rather than using DHCP, so the resinfo messages could sometimes (often?) > have a much bigger exposure. Then again, since the internet seems not > quite ready for CAs to widely give certs for IP addresses, maybe it would > be best to remove it from this draft and create a new draft in the future > once the mechanism becomes more viable. > > On Tue, Apr 28, 2020 at 10:19 AM tirumal reddy wrote: > >> Are you planning to replace >> https://tools.ietf.org/html/draft-ietf-dnsop-resolver-information-01 >> with draft-pp-add-resinfo ? >> >> -Tiru >> >> On Fri, 24 Apr 2020 at 22:16, Paul Hoffman > > wrote: >> >>> Greetings again. We have just published two drafts, >>> draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to address the easier >>> problem that this WG wanted to tackle, namely how a stub can upgrade from >>> plain DNS to encrypted DNS for the resolver it is currently using. The >>> method in draft-pp-add-stub-upgrade is quite simple, but it includes all of >>> the variables that we have heard in the discussion over the last year. The >>> format in draft-pp-add-resinfo is the minimum needed for stub upgrade, but >>> will also possibly be useful for the more difficult discovery protocols >>> being discussed in the WG. >>> >>> Please let us know if you find these documents useful for the discussion >>> of direct upgrade instead of discovery. Also, please let us know if we have >>> missed any salient points. If so, we could ask the chairs to make these >>> into WG documents. >>> >>> --Paul Hoffman and Puneet Sood >>> >>> https://datatracker.ietf.org/doc/draft-pp-add-stub-upgrade/ >>> >>> Name: draft-pp-add-stub-upgrade >>> Revision: 00 >>> Title: Upgrading Communication from Stub Resolvers to DoT or DoH >>> Document date: 2020-04-24 >>> Group: Individual Submission >>> Pages: 7 >>> >>> Abstract: >>> This document describes methods for a DNS stub resolver to upgrade >>> its communications with a known recursive resolver to include >>> encrytion using DoT or DoH. This protocol is designed for the >>> scenario where the stub resolver already has the IP address of the >>> recursive resolver. >>> >>> Other protocols under develpment address scenarios where the stub >>> resolver wants to discover recursive resolvers that use DoT or DoH. >>> This document does not cover such discovery. >>> >>> >>> https://datatracker.ietf.org/doc/draft-pp-add-resinfo/ >>> >>> Name: draft-pp-add-resinfo >>> Revision: 00 >>> Title: DNS Resolver Information Self-publication >>> Document date: 2020-04-24 >>> Group: Individual Submission >>> Pages: 9 >>> >>> Abstract: >>> This document describes methods for DNS resolvers to self-publish >>> information about themselves. The information is returned as a JSON >>> object. The names in this object are defined in an IANA registry >>> that allows for light-weight registration. Applications and >>> operating systems can use the methods defined here to get the >>> information from resolvers in order to make choices about how to send >>> future queries to those resolvers. >>> >>> -- >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add >>> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > --0000000000005a4ec805a45b2b4b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
And another point regarding DNS vs HTTP mechanisms: Is the= re any concerns regarding clients with DoH/DoT stubs but that rely on getad= drinfo() from the system for Classic DNS? Would HTTP be more palatable for = those clients? Then again, if a client has a full DoH/DoT implementation, m= aybe easier for them to add a Classic DNS implementation than it would be f= or many recursives to add an HTTPS server.

On Tue, Apr 28, 2020 at 10:59 AM = Eric Orth <ericorth@google.com> wrote:
I generally support both documents and would support ADD adop= tion.

Re=C2=A0draft-pp-add-stub-upgrade: I do worry that= it goes a little bit too far into "policy" in laying out a speci= fic algorithm, even if it's full of options to allow clients to choose = their own behavior.=C2=A0 Might be better if framed more explicitly as a &q= uot;descriptive example" rather than the prescriptive way to implement= it.=C2=A0 But I find the draft overall helpful just for clearly laying out= both the opportunistic DoT and the DoH resinfo tag.

Re=C2=A0draft-pp-add-resinfo: Definitely think this is the best overall = draft we have for the common problem of retrieving resolver information.=C2= =A0 I'm personally conflicted on the HTTP-based mechanism.=C2=A0 Others= have made some solid arguments against it already in this thread, but I wo= uld be sad to lose our best option for a secure mechanism.=C2=A0 It's c= orrect that the DNS IP address typically comes from insecure DHCP, but in m= any cases that is only exposed on the limited local network or maybe the IP= was set on the machine rather than using DHCP, so the resinfo messages cou= ld sometimes (often?) have a much bigger exposure.=C2=A0 Then again, since = the internet seems not quite ready for CAs to widely give certs for IP addr= esses, maybe it would be best to remove it from this draft and create a new= draft in the future once the mechanism becomes more viable.
On Tue, A= pr 28, 2020 at 10:19 AM tirumal reddy <kondtir@gmail.com> wrote:
Are you planni= ng to replace=20 https://tools.ietf.org/html/draft-ietf-dnsop-resolv= er-information-01 with=20 draft-pp-add-resinfo ?

-Tiru

On Fri, 24 Apr 202= 0 at 22:16, Paul Hoffman <paul..hoffman@icann.org> wrote:
Greetings again. We have just publishe= d two drafts, draft-pp-add-stub-upgrade and draft-pp-add-resinfo, to addres= s the easier problem that this WG wanted to tackle, namely how a stub can u= pgrade from plain DNS to encrypted DNS for the resolver it is currently usi= ng. The method in draft-pp-add-stub-upgrade is quite simple, but it include= s all of the variables that we have heard in the discussion over the last y= ear. The format in draft-pp-add-resinfo is the minimum needed for stub upgr= ade, but will also possibly be useful for the more difficult discovery prot= ocols being discussed in the WG.

Please let us know if you find these documents useful for the discussion of= direct upgrade instead of discovery. Also, please let us know if we have m= issed any salient points. If so, we could ask the chairs to make these into= WG documents.

--Paul Hoffman and Puneet Sood

https://datatracker.ietf.org/doc/draft-pp= -add-stub-upgrade/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-stub-upgrade
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Upgrading Communication from Stub = Resolvers to DoT or DoH
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7

Abstract:
=C2=A0 This document describes methods for a DNS stub resolver to upgrade =C2=A0 its communications with a known recursive resolver to include
=C2=A0 encrytion using DoT or DoH.=C2=A0 This protocol is designed for the<= br> =C2=A0 scenario where the stub resolver already has the IP address of the =C2=A0 recursive resolver.

=C2=A0 Other protocols under develpment address scenarios where the stub =C2=A0 resolver wants to discover recursive resolvers that use DoT or DoH.<= br> =C2=A0 This document does not cover such discovery.


https://datatracker.ietf.org/doc/draft-pp-add-= resinfo/

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-pp-add-resinfo
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS Resolver Information Self-publ= ication
Document date:=C2=A0 2020-04-24
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9

Abstract:
=C2=A0 This document describes methods for DNS resolvers to self-publish =C2=A0 information about themselves.=C2=A0 The information is returned as a= JSON
=C2=A0 object.=C2=A0 The names in this object are defined in an IANA regist= ry
=C2=A0 that allows for light-weight registration.=C2=A0 Applications and =C2=A0 operating systems can use the methods defined here to get the
=C2=A0 information from resolvers in order to make choices about how to sen= d
=C2=A0 future queries to those resolvers.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000005a4ec805a45b2b4b--