From nobody Sun Dec 6 10:48:39 2015 Return-Path: X-Original-To: cdni@ietf.org Delivered-To: cdni@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D87251B2A68; Sun, 6 Dec 2015 10:48:36 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151206184836.29139.24923.idtracker@ietfa.amsl.com> Date: Sun, 06 Dec 2015 10:48:36 -0800 Archived-At: Cc: cdni@ietf.org Subject: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-10.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Dec 2015 18:48:37 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Content Delivery Networks Interconnection Working Group of the IETF. Title : CDNI Control Interface / Triggers Authors : Rob Murray Ben Niven-Jenkins Filename : draft-ietf-cdni-control-triggers-10.txt Pages : 42 Date : 2015-12-06 Abstract: This document describes the part of the CDN Interconnection Control Interface that allows a CDN to trigger activity in an interconnected CDN that is configured to deliver content on its behalf. The upstream CDN can use this mechanism to request that the downstream CDN pre-positions metadata or content, or that it invalidates or purges metadata or content. The upstream CDN can monitor the status of activity that it has triggered in the downstream CDN. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-cdni-control-triggers/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-cdni-control-triggers-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-cdni-control-triggers-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Dec 6 10:49:03 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ECC31B2A61; Sun, 6 Dec 2015 10:49:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.012 X-Spam-Level: X-Spam-Status: No, score=-5.012 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GomVHTqGwe03; Sun, 6 Dec 2015 10:48:59 -0800 (PST) Received: from smtp-fr.alcatel-lucent.com (fr-hpgre-esg-01.alcatel-lucent.com [135.245.210.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DBD21B2A63; Sun, 6 Dec 2015 10:48:56 -0800 (PST) Received: from fr711usmtp1.zeu.alcatel-lucent.com (unknown [135.239.2.122]) by Websense Email Security Gateway with ESMTPS id 3EEA8F6F490EB; Sun, 6 Dec 2015 18:48:51 +0000 (GMT) Received: from FR711WXCHHUB02.zeu.alcatel-lucent.com (fr711wxchhub02.zeu.alcatel-lucent.com [135.239.2.112]) by fr711usmtp1.zeu.alcatel-lucent.com (GMO) with ESMTP id tB6Ims4c027764 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sun, 6 Dec 2015 19:48:54 +0100 Received: from FR711WXCHMBA02.zeu.alcatel-lucent.com ([169.254.2.107]) by FR711WXCHHUB02.zeu.alcatel-lucent.com ([135.239.2.112]) with mapi id 14.03.0195.001; Sun, 6 Dec 2015 19:48:54 +0100 From: "Murray, Rob (Rob)" To: Barry Leiba , "draft-ietf-cdni-control-triggers@ietf.org" Thread-Topic: AD review of draft-ietf-cdni-control-triggers-09 Thread-Index: AQHRJZ8D9/0Hw3Y/PEq5nHDFF6Eq/p6+UX4A Date: Sun, 6 Dec 2015 18:48:53 +0000 Message-ID: <12C3F8A1-A020-48C6-9C27-FFB8D460C290@alcatel-lucent.com> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151105 x-originating-ip: [135.239.27.39] Content-Type: text/plain; charset="utf-8" Content-ID: <5D345466DB7B8846AB2C3ED172B75CC2@exchange.lucent.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] AD review of draft-ietf-cdni-control-triggers-09 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Dec 2015 18:49:02 -0000 SGkgYWxsIC0gSSd2ZSBqdXN0IHN1Ym1pdHRlZCB2ZXJzaW9uICItMTAiIG9mIHRoZSB0cmlnZ2Vy cyBkb2MgdG8gYWRkcmVzcyBCYXJyeSdzIGNvbW1lbnRzIGFuZCB1cGRhdGUgcmVmcy4NCg0KQmFy cnksIHRoYW5rIHlvdSBmb3IgYWxsIHRoZSBjb21tZW50cyBhbmQgc3VnZ2VzdGVkIGZpeGVzLiBS ZXNwb25zZXMgYmVsb3csIGJ1dCBtYXliZSB3b3J0aCBub3RpbmcgdGhhdCByZWZzIHRvIFJGQ3Mg MjgxOCBhbmQgNjcwNyBhcmUgc3RpbGwgaW5mb3JtYXRpdmUgaW4gdGhpcyByZXZpc2lvbiAtIHRo ZXkncmUgaW5mb3JtYXRpb25hbCBSRkNzIHNvICJpZG5pdHMiIGRvZXNuJ3QgbGlrZSBub3JtYXRp dmUgcmVmcyB0byB0aGVtLiAoQnV0IEknbGwgbWFrZSB0aGVtIG5vcm1hdGl2ZSBpbiB0aGUgbmV4 dCByZXZpc2lvbiBpZiB5b3UgdGhpbmsgdGhhdCdzIHRoZSByaWdodCB0aGluZyB0byBkby4pIEkg aG9wZSB0aGUgc2VjdGlvbiBhYm91dCAiUGF0dGVybk1hdGNoIiBtYWtlcyBtb3JlIHNlbnNlIG5v dywgYnV0IGxldCBtZSBrbm93IGlmIG5vdC4NCg0KQ2hlZXJzLA0KUm9iLg0KDQpPbiAyMy8xMS8y MDE1LCAwMzoyOCwgImJhcnJ5bGVpYmFAZ21haWwuY29tIG9uIGJlaGFsZiBvZiBCYXJyeSBMZWli YSIgPGJhcnJ5bGVpYmFAZ21haWwuY29tIG9uIGJlaGFsZiBvZiBiYXJyeWxlaWJhQGNvbXB1dGVy Lm9yZz4gd3JvdGU6DQoNCj5NeSBhcG9sb2dpZXMgZm9yIHRoZSBsb25nIGRlbGF5IGluIGhhbmRs aW5nIHRoaXMgcHVibGljYXRpb24gcmVxdWVzdDoNCj5JJ3ZlIGhhZCBhIG1vbnRoIHN0cmFpZ2h0 IG9mIHRyYXZlbCwgaW5jbHVkaW5nIGEgbGl0dGxlIHBlcnNvbmFsDQo+dmFjYXRpb24gYXQgdGhl IGJlZ2lubmluZyBhbmQgZW5kLiAgSSdtIGJhY2sgYW5kIHJ1bm5pbmcgZnVsbCBzdGVhbSwNCj5h bmQgcmV2aWV3aW5nIHRoZSBiYWNrbG9nIG9mIHB1YmxpY2F0aW9uIHJlcXVlc3RzIGZyb20gc2V2 ZXJhbCB3b3JraW5nDQo+Z3JvdXBzLiAgVGhhbmtzIGZvciB0aGUgcGF0aWVuY2UuDQo+DQo+SSBo YXZlIGEgbnVtYmVyIG9mIGNvbW1lbnRzIGJlbG93LiAgQWxtb3N0IGFsbCBvZiB0aGVtIGFyZSBt aW5vcg0KPmVkaXRvcmlhbCB0aGluZ3MgdGhhdCB3b3VsZG4ndCBkZWxheSBsYXN0IGNhbGwsIGJ1 dCBiZWNhdXNlIHRoZXJlIGFyZQ0KPnF1aXRlIGEgZmV3IGFuZCBiZWNhdXNlIGEgY291cGxlIG9m IHRoZW0gYXJlIHRoaW5ncyBJJ20gcXVlc3Rpb25pbmcNCj4odGhlIGNvbW1lbnQgb24gIm1hdGNo LXF1ZXJ5LXN0cmluZyIgYW5kIHRoZSBvbmUgYWJvdXQgdGhlDQo+cmVmZXJlbmNlcyksIEknZCBs aWtlIHRvIGdldCB0aGUgbGlzdCByZXNvbHZlZCBhbmQgYSBuZXcgSS1EIHBvc3RlZA0KPmJlZm9y ZSBJIHJlcXVlc3QgbGFzdCBjYWxsLiAgTm9uZSBvZiBpdCdzIGEgYmlnIGRlYWwsIGFuZCB3ZSBz aG91bGQgYmUNCj5hYmxlIHRvIHRha2UgY2FyZSBvZiBpdCBxdWlja2x5Lg0KPg0KPk9mIGNvdXJz ZSwgaWYgeW91IGhhdmUgYW55IHF1ZXN0aW9ucyBhYm91dCBhbnkgb2YgbXkgY29tbWVudHMsIG9y DQo+ZGlzYWdyZWUgd2l0aCBhbnkgb2YgdGhlbSwgcGxlYXNlIGRpc2N1c3MgdGhlbSB3aXRoIG1l Lg0KPg0KPlNlY3Rpb24gMiBzdGFydHMgb2ZmIHVzaW5nICJ1Q0ROIiBhbmQgImRDRE4iLCB3aGlj aCBhcmUgbm90IGRlZmluZWQgaW4NCj42NzA3LiAgWW91IGRvIG1lbnRpb24gNzMzNiAod2hlcmUg dGhleSBhcmUgZGVmaW5lZCBpbiBhIHNvcnQgb2YgImJ5DQo+dGhlIHdheSIgbWFubmVyKSBpbiB0 aGUgSW50cm9kdWN0aW9uLCBidXQgSSdtIG5vdCBzdXJlIHJlYWRlcnMgd291bGQNCj5rbm93IHRv IGxvb2sgdGhlcmUgZm9yIHRob3NlIHRlcm1zLiAgSSBzdWdnZXN0IHRoaXMgY2hhbmdlIHRvIFNl Y3Rpb24NCj4xLjEsIGVjaG9pbmcgd2hhdCA3MzM2IGRvZXMgKGl0J3MgYSBwaXR5IHRoYXQgdGhl eSdyZSBub3QgaW4gNjcwNyk6DQo+DQo+T0xEDQo+ICAgVGhpcyBkb2N1bWVudCByZXVzZXMgdGhl IHRlcm1pbm9sb2d5IGRlZmluZWQgaW4gW1JGQzY3MDddLg0KPg0KPk5FVw0KPiAgIFRoaXMgZG9j dW1lbnQgcmV1c2VzIHRoZSB0ZXJtaW5vbG9neSBkZWZpbmVkIGluIFtSRkM2NzA3XSwgYW5kDQo+ ICAgdXNlcyAidUNETiIgYW5kICJkQ0ROIiBhcyBzaG9ydGhhbmQgZm9yICJVcHN0cmVhbSBDRE4i IGFuZA0KPiAgICJEb3duc3RyZWFtIENETiIsIHJlc3BlY3RpdmVseS4NCj4NCj5FTkQNCg0KRG9u ZS4NCg0KPg0KPi0tIFNlY3Rpb24gMiAtLQ0KPg0KPiAgIFRoZXJlIGFyZSB0d28gdHlwZXMgb2Yg Q0kvVCBDb21tYW5kLCBDSS9UIFRyaWdnZXIgQ29tbWFuZHMgYW5kIENJL1QNCj4gICBDYW5jZWwg Q29tbWFuZHMuDQo+DQo+VGhlIGNvbW1hIGlzbid0IHN0cm9uZyBlbm91Z2ggaGVyZTsgaXQgc2hv dWxkIGJlIGEgY29sb24gKCI6IikuDQo+DQo+QWxzbywgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQs IHBsZWFzZSBjaGVjayBmb3IgY29uc2lzdGVudA0KPmNhcGl0YWxpemF0aW9uIG9mIHRob3NlIHRo cmVlIHRlcm1zLiAgSSBub3RpY2VkIGF0IGxlYXN0IG9uZSBpbnN0YW5jZQ0KPm9mICJDSS9UIGNh bmNlbCBjb21tYW5kIiBpbiBTZWN0aW9uIDQuMywgYW5kIHRoZXJlIG1pZ2h0IGJlIG90aGVycy4N Cg0KRG9uZS4NCg0KPg0KPi0tIFNlY3Rpb24gNC4xIC0tDQo+DQo+ICAgVGhlIGRDRE4gdmFsaWRh dGVzIHRoZSBDSS9UIENvbW1hbmQsIGlmIGl0IGlzIG1hbGZvcm1lZCBvciB0aGUgdUNETg0KPiAg IGRvZXMgbm90IGhhdmUgc3VmZmljaWVudCBhY2Nlc3MgcmlnaHRzIGl0IE1VU1QgZWl0aGVyIHJl c3BvbmQgd2l0aCBhbg0KPiAgIGFwcHJvcHJpYXRlIDR4eCBIVFRQIGVycm9yIGNvZGUgYW5kIGEg VHJpZ2dlciBTdGF0dXMgUmVzb3VyY2UgTVVTVA0KPiAgIE5PVCBiZSBjcmVhdGVkIG9uIHRoZSBk Q0ROLCBvciBjcmVhdGUgYSAnZmFpbGVkJyBUcmlnZ2VyIFN0YXR1cw0KPiAgIFJlc291cmNlIGNv bnRhaW5pbmcgYW4gYXBwcm9wcmlhdGUgZXJyb3IgZGVzY3JpcHRpb24uDQo+DQo+VGhpcyBzdGFy dHMgd2l0aCBhIGNvbW1hIHNwbGljZSBhbmQgZ29lcyBvbiB0byBiZSBvZGRseSB3b3JkZWQuICBN YXkgSQ0KPnN1Z2dlc3QgdGhpcz86DQo+DQo+TkVXDQo+ICAgVGhlIGRDRE4gdmFsaWRhdGVzIHRo ZSBDSS9UIENvbW1hbmQuICBJZiB0aGUgY29tbWFuZCBpcyBtYWxmb3JtZWQgb3INCj4gICB0aGUg dUNETiBkb2VzIG5vdCBoYXZlIHN1ZmZpY2llbnQgYWNjZXNzIHJpZ2h0cywgdGhlIGRDRE4gTVVT VCBlaXRoZXINCj4gICByZXNwb25kIHdpdGggYW4gYXBwcm9wcmlhdGUgNHh4IEhUVFAgZXJyb3Ig Y29kZSBhbmQgbm90IGNyZWF0ZSBhDQo+ICAgVHJpZ2dlciBTdGF0dXMgUmVzb3VyY2UsIG9yIGNy ZWF0ZSBhICdmYWlsZWQnIFRyaWdnZXIgU3RhdHVzDQo+ICAgUmVzb3VyY2UgY29udGFpbmluZyBh biBhcHByb3ByaWF0ZSBlcnJvciBkZXNjcmlwdGlvbi4NCj5FTkQNCg0KRG9uZS4NCg0KPiAgIFRo ZSBIVFRQIHJlc3BvbnNlIFNIT1VMRA0KPiAgIGluY2x1ZGUgdGhlIGNvbnRlbnQgb2YgdGhlIG5l d2x5IGNyZWF0ZWQgVHJpZ2dlciBTdGF0dXMgUmVzb3VyY2UsDQo+ICAgdGhpcyBpcyByZWNvbW1l bmRlZCBwYXJ0aWN1bGFybHkgaW4gY2FzZXMgd2hlcmUgdGhlIENJL1QgVHJpZ2dlcg0KPiAgIENv bW1hbmQgaGFzIGNvbXBsZXRlZCBpbW1lZGlhdGVseS4NCj4NCj5JIGRvbid0IGxpa2UgdGhlICJy ZWNvbW1lbmRlZCBwYXJ0aWN1bGFybHkiIGFsb25nIHdpdGggdGhlICJTSE9VTEQiIC0tDQo+cmVt ZW1iZXIgdGhhdCAiU0hPVUxEIiBhbmQgIlJFQ09NTUVOREVEIiBhcmUgc3lub255bW91cyAoYW5k IHRoZXJlJ3MNCj5hbHNvIGEgY29tbWEgc3BsaWNlIGhlcmUpLiAgSSBzdWdnZXN0IHRoaXM6DQo+ DQo+TkVXDQo+ICAgVGhlIEhUVFAgcmVzcG9uc2UgU0hPVUxEDQo+ICAgaW5jbHVkZSB0aGUgY29u dGVudCBvZiB0aGUgbmV3bHkgY3JlYXRlZCBUcmlnZ2VyIFN0YXR1cyBSZXNvdXJjZS4NCj4gICBU aGlzIGlzIHBhcnRpY3VsYXJseSBpbXBvcnRhbnQgaW4gY2FzZXMgd2hlcmUgdGhlIENJL1QgVHJp Z2dlcg0KPiAgIENvbW1hbmQgaGFzIGNvbXBsZXRlZCBpbW1lZGlhdGVseS4NCj5FTkQNCj4NCj4o SWYgImltcG9ydGFudCIgaXNuJ3QgcXVpdGUgcmlnaHQsIG1heWJlICJzaWduaWZpY2FudCI/KQ0K DQpEb25lLg0KDQo+LS0gU2VjdGlvbiA0LjIgLS0NCj4NCj4gICBUbyBjaGVjayBmb3IgY2hhbmdl IGluIHN0YXR1cyBvZiBhIFRyaWdnZXIgU3RhdHVzIFJlc291cmNlIG9yDQo+ICAgY29sbGVjdGlv biBvZiBUcmlnZ2VyIFN0YXR1cyBSZXNvdXJjZXMgd2l0aG91dCByZS1mZXRjaGluZyB0aGUgd2hv bGUNCj4gICBSZXNvdXJjZSBvciBDb2xsZWN0aW9uLCBFbnRpdHkgVGFncyBTSE9VTEQgYmUgaW5j bHVkZWQgYnkgdGhlIGRDRE4NCj4gICBmb3IgdGhlIHVDRE4gdG8gdXNlIGFzIGNhY2hlIHZhbGlk YXRvcnMsIGFzIGRlZmluZWQgaW4gW1JGQzcyMzJdLg0KPg0KPlRoZSBkQ0ROIGRvZXNuJ3QgaW5j bHVkZSB0aG9zZSB0YWdzIHRvIGNoZWNrIGZvciBjaGFuZ2UgaW4gc3RhdHVzLiAgSXQNCj5pbmNs dWRlcyB0aGVtIHRvIGFsbG93IHRoZSB1Q0ROIHRvIGNoZWNrIGZvciBjaGFuZ2UgaW4gc3RhdHVz Lg0KPg0KPk5FVw0KPiAgIFRvIGFsbG93IHRoZSB1Q0ROIHRvIGNoZWNrIGZvciBjaGFuZ2UgaW4g c3RhdHVzIG9mIGEgVHJpZ2dlciBTdGF0dXMNCj4gICBSZXNvdXJjZSBvciBjb2xsZWN0aW9uIG9m IFRyaWdnZXIgU3RhdHVzIFJlc291cmNlcyB3aXRob3V0DQo+ICAgcmUtZmV0Y2hpbmcgdGhlIHdo b2xlIFJlc291cmNlIG9yIENvbGxlY3Rpb24sIHRoZSBkQ0ROIFNIT1VMRA0KPiAgIGluY2x1ZGUg RW50aXR5IFRhZ3MgZm9yIHRoZSB1Q0ROIHRvIHVzZSBhcyBjYWNoZSB2YWxpZGF0b3JzLCBhcw0K PiAgIGRlZmluZWQgaW4gW1JGQzcyMzJdLg0KPkVORA0KDQpEb25lLg0KDQo+LS0gU2VjdGlvbiA0 LjMgLS0NCj4NCj4gICBDYW5jZWxsYXRpb24gb2YgYSBDSS9UIFRyaWdnZXIgQ29tbWFuZCBpcyBv cHRpb25hbC10by1pbXBsZW1lbnQgaW4NCj4gICB0aGUgZENETi4NCj4NCj5JIHdhcyBpbml0aWFs bHkgdW5jZXJ0YWluIGFib3V0IHRoaXM6IGl0IGNvdWxkIGJlIHJlYWQgdHdvIHdheXMgKGl0DQo+ Y291bGQgYmUgcmVhZCB0byBtZWFuIHRoYXQgdGhlIGRDRE4gZG9lc24ndCBoYXZlIHRvIGltcGxl bWVudCB0aGUNCj5DYW5jZWwgQ29tbWFuZCBhdCBhbGwpLCBzbyBpdCdzIHByb2JhYmx5IGJlc3Qg dG8gYmUgY2xlYXIgKGV2ZW4gdGhvdWdoDQo+b25lIGNhbiBnZXQgdGhhdCBmcm9tIHRoZSBuZXh0 IHBhcmFncmFwaCkuDQo+DQo+TkVXDQo+ICAgVGhlIGRDRE4gaXMgcmVxdWlyZWQgdG8gYWNjZXB0 IGFuZCByZXNwb25kIHRvIHRoZSBDSS9UIENhbmNlbA0KPiAgIENvbW1hbmQsIGJ1dCB0aGUgYWN0 dWFsIGNhbmNlbGxhdGlvbiBvZiBhIENJL1QgVHJpZ2dlciBDb21tYW5kIGlzDQo+ICAgb3B0aW9u YWwtdG8taW1wbGVtZW50Lg0KPkVORA0KPg0KPk9yIHNvbWV0aGluZyBsaWtlIHRoYXQuLi4uDQoN CkRvbmUuDQoNCj4tLSBTZWN0aW9uIDQuOCAtLQ0KPlRoZSBzZWN0aW9uIHN0YXJ0cyB3aXRoICJ0 aGVyZWZvcmUiLiAgV2hhdCdzIHRoZSBhbnRlY2VkZW50IG9mDQo+InRoZXJlZm9yZSI/ICBJcyB0 aGF0IGEgdmVzdGlnZSBvZiBzb21ldGhpbmcgdGhhdCB1c2VkIHRvIGJlIHRoZXJlPw0KPlNob3Vs ZCAidGhlcmVmb3JlIiBiZSByZW1vdmVkLCBvciBzaG91bGQgc29tZXRoaW5nIGJlIHJlLXdvcmRl ZD8NCg0KSSBjYW4ndCByZW1lbWJlciB3aGVyZSBpdCBjYW1lIGZyb20sIGJ1dCBpdCdzIGdvbmUg bm93Lg0KDQo+LS0gU2VjdGlvbiA1LjIuNCAtLQ0KPg0KPiAgICAgIE5hbWU6IGNhc2Utc2Vuc2l0 aXZlDQo+DQo+ICAgICAgICAgRGVzY3JpcHRpb246IEZsYWcgaW5kaWNhdGluZyB3aGV0aGVyIG9y IG5vdCBjYXNlLXNlbnNpdGl2ZQ0KPiAgICAgICAgIG1hdGNoaW5nIHNob3VsZCBiZSB1c2VkLg0K Pg0KPiAgICAgICAgIFZhbHVlOiBPbmUgb2YgdGhlIEpTT04gdmFsdWVzICd0cnVlJyBvciAnZmFs c2UnLg0KPg0KPiAgICAgICAgIE1hbmRhdG9yeTogTm8sIGRlZmF1bHQgaXMgY2FzZS1pbnNlbnNp dGl2ZSBtYXRjaC4NCj4NCj5JIHRoaW5rIHRoaXMgaXMgcHJvcGVybHkgc3BlY2lmaWVkIGFzIGl0 IGlzLCBzbyB5b3UgY2FuIGlnbm9yZSB0aGlzDQo+Y29tbWVudCBpZiB5b3UgcHJlZmVyLCBidXQg SSdkIHJhdGhlciBzZWUgdGhlIGRlc2NyaXB0aW9ucyB3aGFjayB0aGUNCj5yZWFkZXIgaW4gdGhl IGZhY2UsIHJhdGhlciB0aGFuIG1ha2UgYW55b25lIGd1ZXNzIHdoYXQgInRydWUiIG9yDQo+ImZh bHNlIiBjb3JyZXNwb25kIHRvOg0KPg0KPk5FVw0KPiAgICAgIE5hbWU6IGNhc2Utc2Vuc2l0aXZl DQo+DQo+ICAgICAgICAgRGVzY3JpcHRpb246IEZsYWcgaW5kaWNhdGluZyB3aGV0aGVyIG9yIG5v dCBjYXNlLXNlbnNpdGl2ZQ0KPiAgICAgICAgIG1hdGNoaW5nIHNob3VsZCBiZSB1c2VkLg0KPg0K PiAgICAgICAgIFZhbHVlOiBPbmUgb2YgdGhlIEpTT04gdmFsdWVzICd0cnVlJyAodGhlIG1hdGNo aW5nIGlzIGNhc2UtDQo+ICAgICAgICAgc2Vuc2l0aXZlKSBvciAnZmFsc2UnICh0aGUgbWF0Y2hp bmcgaXMgY2FzZS1pbnNlbnNpdGl2ZSkuDQo+DQo+ICAgICAgICAgTWFuZGF0b3J5OiBObywgZGVm YXVsdCBpcyAnZmFsc2UnLCBhIGNhc2UtaW5zZW5zaXRpdmUgbWF0Y2guDQo+RU5EDQoNCkRvbmUu DQoNCj4gICAgICBOYW1lOiBtYXRjaC1xdWVyeS1zdHJpbmcNCj4NCj4gICAgICAgICBEZXNjcmlw dGlvbjogRmxhZyBpbmRpY2F0aW5nIHdoZXRoZXIgb3Igbm90IHRoZSBxdWVyeSBzdHJpbmcNCj4g ICAgICAgICBzaG91bGQgYmUgaW5jbHVkZWQgaW4gdGhlIHBhdHRlcm4gbWF0Y2guDQo+DQo+SSBk b24ndCB1bmRlcnN0YW5kIHdoYXQgdGhpcyBtZWFuczsgc29ycnkuICBDYW4geW91IGV4cGxhaW4/ DQoNClRoZSBwYXR0ZXJuIG1hdGNoIGlzIGFsd2F5cyBhZ2FpbnN0IGEgVVJJLCBidXQgdGhhdCB3 YXNuJ3Qgc3RhdGVkLiBUaGUgInF1ZXJ5IHN0cmluZyIgcmVmZXJyZWQgdG8gdGhlIHF1ZXJ5IHBh cnQgb2YgdGhlIFVSSS4NCg0KSSd2ZSBjaGFuZ2VkIHRoZSBmaXJzdCBwYXJhZ3JhcGggb2YgdGhl IHNlY3Rpb24gZnJvbToNCg0KICAgIEEgUGF0dGVybiBNYXRjaCBjb25zaXN0cyBvZiBhIHN0cmlu ZyBwYXR0ZXJuIHRvIG1hdGNoLCBhbmQNCiAgICBmbGFncyBkZXNjcmliaW5nIHRoZSB0eXBlIG9m IG1hdGNoLg0KDQpUbzoNCg0KICAgIEEgUGF0dGVybiBNYXRjaCBjb25zaXN0cyBvZiBhIHN0cmlu ZyBwYXR0ZXJuIHRvIG1hdGNoDQogICAgYWdhaW5zdCBhIFVSSSwgYW5kIGZsYWdzIGRlc2NyaWJp bmcgdGhlIHR5cGUgb2YgbWF0Y2guDQoNClRoZSBkZXNjcmlwdGlvbiBmb3IgInBhdHRlcm4iIGZy b206DQoNCiAgICBEZXNjcmlwdGlvbjogQSBwYXR0ZXJuIGZvciBzdHJpbmcgbWF0Y2hpbmcuDQoN ClRvOg0KDQogICAgRGVzY3JpcHRpb246IEEgcGF0dGVybiBmb3IgVVJJIG1hdGNoaW5nLg0KDQpB bmQgdGhlIGRlc2NyaXB0aW9uIG9mIG1hdGNoLXF1ZXJ5LXN0cmluZyBmcm9tOg0KDQogICAgRGVz Y3JpcHRpb246IEZsYWcgaW5kaWNhdGluZyB3aGV0aGVyIG9yIG5vdCB0aGUgcXVlcnkgc3RyaW5n DQogICAgc2hvdWxkIGJlIGluY2x1ZGVkIGluIHRoZSBwYXR0ZXJuIG1hdGNoLg0KDQogICAgVmFs dWU6IE9uZSBvZiB0aGUgSlNPTiB2YWx1ZXMgJ3RydWUnIG9yICdmYWxzZScuDQoNCiAgICBNYW5k YXRvcnk6IE5vLCBkZWZhdWx0IGlzIG5vdCB0byBpbmNsdWRlIHRoZSBxdWVyeSBzdHJpbmcgaW4N CiAgICB0aGUgcGF0dGVybiBtYXRjaC4NCg0KDQpUbzoNCg0KICAgIERlc2NyaXB0aW9uOiBGbGFn IGluZGljYXRpbmcgd2hldGhlciBvciBub3QgdGhlIHF1ZXJ5IHBhcnQNCiAgICBvZiB0aGUgVVJJ IHNob3VsZCBiZSBpbmNsdWRlZCBpbiB0aGUgcGF0dGVybiBtYXRjaC4NCg0KICAgIFZhbHVlOiBP bmUgb2YgdGhlIEpTT04gdmFsdWVzICd0cnVlJyAodGhlIGZ1bGwgVVJJIGluY2x1ZGluZw0KICAg IHRoZSBxdWVyeSBwYXJ0IHNob3VsZCBiZSBjb21wYXJlZCBhZ2FpbnN0IHRoZSBnaXZlbiBwYXR0 ZXJuKSwNCiAgICBvciAnZmFsc2UnICh0aGUgcXVlcnkgcGFydCBvZiB0aGUgVVJJIHNob3VsZCBi ZSBkcm9wcGVkIGJlZm9yZQ0KICAgIGNvbXBhcmlzb24gd2l0aCB0aGUgZ2l2ZW4gcGF0dGVybiku DQoNCiAgICBNYW5kYXRvcnk6IE5vLCBkZWZhdWx0IGlzICdmYWxzZScsIHRoZSBxdWVyeSBwYXJ0 IG9mIHRoZSBVUkkNCiAgICBzaG91bGQgYmUgZHJvcHBlZCBiZWZvcmUgY29tcGFyaXNvbiB3aXRo IHRoZSBnaXZlbiBwYXR0ZXJuLg0KDQoNCkRvZXMgdGhhdCBhZGRyZXNzIHRoZSBwcm9ibGVtPw0K DQo+LS0gU2VjdGlvbiA1LjIuNSAtLQ0KPg0KPiAgIEEgSlNPTiBudW1iZXIsIHNlY29uZHMgc2lu Y2UgdGhlIFVOSVggZXBvY2guDQo+DQo+QmVjYXVzZSB5b3UgZG9uJ3QgaGF2ZSBhIHJlZmVyZW5j ZSBjaXRlZCBoZXJlLCBpdCdkIGJlIGdvb2QgdG8gc2F5DQo+d2hhdCB0aGUgVU5JWCBlcG9jaCBp cy4gIEV2ZW4gd2l0aCBhIHJlZmVyZW5jZSwgaXQncyBlYXN5IHRvIHNheSBpdCwNCj5hbmQgaXQg YXZvaWRzIG1ha2luZyB0aGUgcmVhZGVyIGxvb2sgaXQgdXA6DQo+DQo+TkVXDQo+ICAgQSBKU09O IG51bWJlciwgc2Vjb25kcyBzaW5jZSB0aGUgVU5JWCBlcG9jaCwgMDA6MDA6MDAgVVRDDQo+ICAg b24gMSBKYW51YXJ5IDE5NzAuDQo+RU5EDQoNCkRvbmUuDQoNCj4tLSBTZWN0aW9uIDYgLS0NCj5U aGFua3MgZm9yIHRoZSBjb21wcmVoZW5zaXZlIGV4YW1wbGVzOyBJIHRoaW5rIHRoYXQncyB2ZXJ5 IHVzZWZ1bC4NCj4NCj5JJ20gbm90IHN1cmUgaG93IG11Y2ggaXQgbWF0dGVycyAoSSdtIHN1cmUg c29tZSBwaWNreSBwZXJzb24gd2lsbA0KPnN1Ym1pdCBlcnJhdGEgcmVwb3J0cyksIGJ1dCBJIGRv bid0IGdldCB0aGUgc2FtZSBjb250ZW50LWxlbmd0aCB2YWx1ZXMNCj50aGF0IHlvdSBkbyBvbiBh bnkgb2YgdGhlIGV4YW1wbGVzLiAgUGxlYXNlIGJlIHN1cmUgdGhlIGNvbnRlbnQtbGVuZ3RoDQo+ dmFsdWVzIG1hdGNoIHRoZSBkYXRhIGFzIGluZGVudGVkIGFuZCB3aXRoIGFsbCBkaXNwbGF5ZWQg d2hpdGVzcGFjZSwNCj53aXRoIGFzc3VtcHRpb24gb2Yge0NSLExGfSBhdCB0aGUgZW5kIG9mIGVh Y2ggbGluZS4NCg0KVGhlIGV4YW1wbGVzIGFyZSBhbGwgZ2VuZXJhdGVkIGJ5IGEgc2ltdWxhdG9y IG9mIHRoZSBpbnRlcmZhY2UgdGhhdCBydW5zIHVuZGVyIHRoZSBQeXRob24gVHdpc3RlZCB3ZWIg c2VydmVyIC0gc28gaXQgZ2VuZXJhdGVzIHRoZSBDb250ZW50LUxlbmd0aCBoZWFkZXJzIGZvciBt ZS4NCg0KQnV0IFB5dGhvbidzIEpTT04gZW5jb2RlciAvIHByZXR0eS1wcmludGVyIHdhcyBwdXR0 aW5nIHdoaXRlc3BhY2Ugb24gdGhlIGVuZCBvZiBzb21lIGxpbmVzLCB3aGljaCB3YXMgaW52aXNp YmxlIGluIHRoZSBkcmFmdC4gU28gSSd2ZSBzdHJpcHBlZCB0aGF0IHdoaXRlc3BhY2UgYmVmb3Jl IHB1dHRpbmcgaXQgaW4gdGhlIHJlc3BvbnNlLCBhbmQgcmUtZ2VuZXJhdGVkIHRoZSBleGFtcGxl cy4NCg0KVGhlIEpTT04gaW4gdGhlIG1lc3NhZ2UgYm9keSBkb2Vzbid0IGhhdmUgKG9yIG5lZWQp IENSTEYgbGluZS1lbmRpbmdzLCB3aGl0ZXNwYWNlIGlzbid0IHNpZ25pZmljYW50IGluIEpTT04u IEhUVFAgaGVhZGVycyBkb24ndCBjb250cmlidXRlIHRvIHRoZSBDb250ZW50LUxlbmd0aC4NCg0K TGV0IG1lIGtub3cgaWYgeW91IHN0aWxsIHNlZSBhbnl0aGluZyBkb2RneS4NCg0KPi0tIFJlZmVy ZW5jZXMgLS0NCj5JIHRoaW5rIHRocmVlIHJlZmVyZW5jZXMgbmVlZCB0byBiZSBtb3ZlZCBmcm9t IGluZm9ybWF0aXZlIHRvIG5vcm1hdGl2ZToNCj4tIFJGQyAyODE4IGlzIHRoZSBzdWJqZWN0IG9m IGEgTVVTVCBpbiBTZWN0aW9uIDguMQ0KPi0gUkZDIDY3MDcgcHJvdmlkZXMgbmVjZXNzYXJ5IHRl cm1pbm9sb2d5DQoNCiJpZG5pdHMiIGRvZXNuJ3QgbGlrZSBub3JtYXRpdmUgcmVmZXJlbmNlcyB0 byBpbmZvcm1hdGlvbmFsIFJGQ3MsIHdoaWNoIG1ha2VzIHNlbnNlIEkgZ3Vlc3MgLi4uIHNvIEkn dmUgbGVmdCB0aGVtIGFsb25lLg0KDQo+LSBkcmFmdC1ncmVldmVuYm9zY2gtYXBwc2F3Zy1jYm9y LWNkZGwgZGVmaW5lcyB0aGUgZm9ybWFsIGxhbmd1YWdlDQo+dXNlZCBpbiBTZWN0aW9uIDUuMw0K Pg0KPklmIHlvdSBkaXNhZ3JlZSwgcGxlYXNlIHRlbGwgbWUgd2h5Lg0KPg0KPk9mIGNvdXJzZSwg dGhhdCBtZWFucyB0aGF0IGRyYWZ0LWdyZWV2ZW5ib3NjaC1hcHBzYXdnLWNib3ItY2RkbCB3aWxs DQo+YmxvY2sgcHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudCB1bnRpbCBpdCdzIHJlYWR5Lg0K DQpUZXh0IGZyb20gc2VjdGlvbiA1LjMgbW92ZWQgdG8gYSBub24tbm9ybWF0aXZlIGFwcGVuZGl4 LCBhcyBkaXNjdXNzZWQgb24gdGhlIGxpc3QuIChTbyByZWYgbm90IG1hZGUgbm9ybWF0aXZlLikN Cg0KPg0KPi0tDQo+QmFycnkNCg== From nobody Mon Dec 7 07:12:46 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BFD61A6F84; Mon, 7 Dec 2015 07:12:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.278 X-Spam-Level: X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fPoQ0mFbF1M4; Mon, 7 Dec 2015 07:12:43 -0800 (PST) Received: from mail-vk0-x233.google.com (mail-vk0-x233.google.com [IPv6:2607:f8b0:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 086011A6F80; Mon, 7 Dec 2015 07:12:43 -0800 (PST) Received: by vkbs1 with SMTP id s1so103956590vkb.1; Mon, 07 Dec 2015 07:12:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=dVLr/1v8wAbIupdeVucUPXdQGQwurFF9r0FJXNVJBpY=; b=q4xxtfdw4fwbQhNT30G18qXgGYT5z8tpiPprAx1qyOfRK7wj6yZKSZc4R1va4CBeea qcROBysJjSXvGkiHlrVFQZ8K4j5huYaXiSDJo3nPOsIeKv6yRx8HM94Bqj9SadCH2nLz Iwnk/mG/m3ZmDWkRrR9wnoHlN12qlIeJSU1/JpJV9zyqOtxznHISF9huxMw0tfT+75Eq H2A54T3jdnTylpl0QYjiBVF0RQ6QrhUAGkM3XavPC2Spn3BGxP1dQYK5QlVTqWBceDHy FwfL/oZ0K3QnazRftIS5jFo1XOXZWwCjuWsw8UWS1ExmP3HIy6M8giSxCcECRUToFYkl tzag== MIME-Version: 1.0 X-Received: by 10.31.188.200 with SMTP id m191mr21917169vkf.102.1449501162129; Mon, 07 Dec 2015 07:12:42 -0800 (PST) Sender: barryleiba@gmail.com Received: by 10.31.182.211 with HTTP; Mon, 7 Dec 2015 07:12:42 -0800 (PST) In-Reply-To: <12C3F8A1-A020-48C6-9C27-FFB8D460C290@alcatel-lucent.com> References: <12C3F8A1-A020-48C6-9C27-FFB8D460C290@alcatel-lucent.com> Date: Mon, 7 Dec 2015 10:12:42 -0500 X-Google-Sender-Auth: t-AHMkECQmoJbZZH5K-u2ToBmJM Message-ID: From: Barry Leiba To: "Murray, Rob (Rob)" Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "cdni@ietf.org" , "draft-ietf-cdni-control-triggers@ietf.org" Subject: Re: [CDNi] AD review of draft-ietf-cdni-control-triggers-09 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 15:12:44 -0000 Hi, Rob, and thanks for addressing my comments. Unnecessary stuff trimmed here: >> Name: match-query-string >> >> Description: Flag indicating whether or not the query string >> should be included in the pattern match. >> >>I don't understand what this means; sorry. Can you explain? > > The pattern match is always against a URI, but that wasn't stated. > The "query string" referred to the query part of the URI. Ahhhh, yes, I see. Your suggested change is good; thanks. >>I'm not sure how much it matters (I'm sure some picky person will >>submit errata reports), but I don't get the same content-length values >>that you do on any of the examples. Please be sure the content-length >>values match the data as indented and with all displayed whitespace, >>with assumption of {CR,LF} at the end of each line. > > The examples are all generated by a simulator of the interface that > runs under the Python Twisted web server - so it generates the > Content-Length headers for me. > > But Python's JSON encoder / pretty-printer was putting whitespace > on the end of some lines, which was invisible in the draft. So I've > stripped that whitespace before putting it in the response, and > re-generated the examples. Great thanks. > The JSON in the message body doesn't have (or need) CRLF > line-endings, whitespace isn't significant in JSON. Right, but if CRLFs are included, their presence counts in the content length. And there are line breaks included in the draft, so a reader would assume those are sent on the wire in the HTTP transaction. But I'm OK either way. If you're satisfied that the content-length values are correct, I'm not going to push on it. >>-- References -- >>I think three references need to be moved from informative to normative: >>- RFC 2818 is the subject of a MUST in Section 8.1 >>- RFC 6707 provides necessary terminology > > "idnits" doesn't like normative references to informational RFCs, which > makes sense I guess ... so I've left them alone. IDnits is a tool, not a policy, and it's OK to have IDnits call something out, if that "something" is the right thing to do. Here, it's the right thing to do, and if we ultimately make them normative then I have to call that out during last call (that's what IDnits is reminding us of). So please make them normative now, and I'll make sure the last call notice lists them. Barry From nobody Mon Dec 7 07:22:13 2015 Return-Path: X-Original-To: cdni@ietf.org Delivered-To: cdni@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FC9A1A7D81; Mon, 7 Dec 2015 07:22:11 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151207152211.31711.72043.idtracker@ietfa.amsl.com> Date: Mon, 07 Dec 2015 07:22:11 -0800 Archived-At: Cc: cdni@ietf.org Subject: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-11.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 15:22:11 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Content Delivery Networks Interconnection Working Group of the IETF. Title : CDNI Control Interface / Triggers Authors : Rob Murray Ben Niven-Jenkins Filename : draft-ietf-cdni-control-triggers-11.txt Pages : 42 Date : 2015-12-07 Abstract: This document describes the part of the CDN Interconnection Control Interface that allows a CDN to trigger activity in an interconnected CDN that is configured to deliver content on its behalf. The upstream CDN can use this mechanism to request that the downstream CDN pre-positions metadata or content, or that it invalidates or purges metadata or content. The upstream CDN can monitor the status of activity that it has triggered in the downstream CDN. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-cdni-control-triggers/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-cdni-control-triggers-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-cdni-control-triggers-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Dec 7 07:23:48 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D42CF1A8025; Mon, 7 Dec 2015 07:23:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.911 X-Spam-Level: X-Spam-Status: No, score=-6.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PiM0Bw_rwq3S; Mon, 7 Dec 2015 07:23:45 -0800 (PST) Received: from smtp-fr.alcatel-lucent.com (fr-hpgre-esg-01.alcatel-lucent.com [135.245.210.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 292EF1A7021; Mon, 7 Dec 2015 07:23:45 -0800 (PST) Received: from fr711usmtp1.zeu.alcatel-lucent.com (unknown [135.239.2.122]) by Websense Email Security Gateway with ESMTPS id B4880F5DA6062; Mon, 7 Dec 2015 15:23:40 +0000 (GMT) Received: from FR711WXCHHUB02.zeu.alcatel-lucent.com (fr711wxchhub02.zeu.alcatel-lucent.com [135.239.2.112]) by fr711usmtp1.zeu.alcatel-lucent.com (GMO) with ESMTP id tB7FNfgI008053 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 7 Dec 2015 16:23:42 +0100 Received: from FR711WXCHMBA02.zeu.alcatel-lucent.com ([169.254.2.107]) by FR711WXCHHUB02.zeu.alcatel-lucent.com ([135.239.2.112]) with mapi id 14.03.0195.001; Mon, 7 Dec 2015 16:23:41 +0100 From: "Murray, Rob (Rob)" To: Barry Leiba Thread-Topic: AD review of draft-ietf-cdni-control-triggers-09 Thread-Index: AQHRJZ8D9/0Hw3Y/PEq5nHDFF6Eq/p6+UX4AgAFV8ACAAAMRgA== Date: Mon, 7 Dec 2015 15:23:41 +0000 Message-ID: <81F0E44E-BB12-489C-AE26-1723143C4D86@alcatel-lucent.com> References: <12C3F8A1-A020-48C6-9C27-FFB8D460C290@alcatel-lucent.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151105 x-originating-ip: [135.239.27.41] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Cc: "cdni@ietf.org" , "draft-ietf-cdni-control-triggers@ietf.org" Subject: Re: [CDNi] AD review of draft-ietf-cdni-control-triggers-09 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 15:23:47 -0000 VGhhbmtzIEJhcnJ5IC0gSSd2ZSBub3JtYXRpdmVpZmllZCB0aG9zZSByZWZzIGFuZCBwdWJsaXNo ZWQgIi0xMSIuDQoNClJvYi4NCg0KDQoNCg0KT24gMDcvMTIvMjAxNSwgMTU6MTIsICJiYXJyeWxl aWJhQGdtYWlsLmNvbSBvbiBiZWhhbGYgb2YgQmFycnkgTGVpYmEiIDxiYXJyeWxlaWJhQGdtYWls LmNvbSBvbiBiZWhhbGYgb2YgYmFycnlsZWliYUBjb21wdXRlci5vcmc+IHdyb3RlOg0KDQo+SGks IFJvYiwgYW5kIHRoYW5rcyBmb3IgYWRkcmVzc2luZyBteSBjb21tZW50cy4gIFVubmVjZXNzYXJ5 IHN0dWZmIHRyaW1tZWQgaGVyZToNCj4NCj4+PiAgICAgIE5hbWU6IG1hdGNoLXF1ZXJ5LXN0cmlu Zw0KPj4+DQo+Pj4gICAgICAgICBEZXNjcmlwdGlvbjogRmxhZyBpbmRpY2F0aW5nIHdoZXRoZXIg b3Igbm90IHRoZSBxdWVyeSBzdHJpbmcNCj4+PiAgICAgICAgIHNob3VsZCBiZSBpbmNsdWRlZCBp biB0aGUgcGF0dGVybiBtYXRjaC4NCj4+Pg0KPj4+SSBkb24ndCB1bmRlcnN0YW5kIHdoYXQgdGhp cyBtZWFuczsgc29ycnkuICBDYW4geW91IGV4cGxhaW4/DQo+Pg0KPj4gVGhlIHBhdHRlcm4gbWF0 Y2ggaXMgYWx3YXlzIGFnYWluc3QgYSBVUkksIGJ1dCB0aGF0IHdhc24ndCBzdGF0ZWQuDQo+PiBU aGUgInF1ZXJ5IHN0cmluZyIgcmVmZXJyZWQgdG8gdGhlIHF1ZXJ5IHBhcnQgb2YgdGhlIFVSSS4N Cj4NCj5BaGhoaCwgeWVzLCBJIHNlZS4gIFlvdXIgc3VnZ2VzdGVkIGNoYW5nZSBpcyBnb29kOyB0 aGFua3MuDQo+DQo+Pj5JJ20gbm90IHN1cmUgaG93IG11Y2ggaXQgbWF0dGVycyAoSSdtIHN1cmUg c29tZSBwaWNreSBwZXJzb24gd2lsbA0KPj4+c3VibWl0IGVycmF0YSByZXBvcnRzKSwgYnV0IEkg ZG9uJ3QgZ2V0IHRoZSBzYW1lIGNvbnRlbnQtbGVuZ3RoIHZhbHVlcw0KPj4+dGhhdCB5b3UgZG8g b24gYW55IG9mIHRoZSBleGFtcGxlcy4gIFBsZWFzZSBiZSBzdXJlIHRoZSBjb250ZW50LWxlbmd0 aA0KPj4+dmFsdWVzIG1hdGNoIHRoZSBkYXRhIGFzIGluZGVudGVkIGFuZCB3aXRoIGFsbCBkaXNw bGF5ZWQgd2hpdGVzcGFjZSwNCj4+PndpdGggYXNzdW1wdGlvbiBvZiB7Q1IsTEZ9IGF0IHRoZSBl bmQgb2YgZWFjaCBsaW5lLg0KPj4NCj4+IFRoZSBleGFtcGxlcyBhcmUgYWxsIGdlbmVyYXRlZCBi eSBhIHNpbXVsYXRvciBvZiB0aGUgaW50ZXJmYWNlIHRoYXQNCj4+IHJ1bnMgdW5kZXIgdGhlIFB5 dGhvbiBUd2lzdGVkIHdlYiBzZXJ2ZXIgLSBzbyBpdCBnZW5lcmF0ZXMgdGhlDQo+PiBDb250ZW50 LUxlbmd0aCBoZWFkZXJzIGZvciBtZS4NCj4+DQo+PiBCdXQgUHl0aG9uJ3MgSlNPTiBlbmNvZGVy IC8gcHJldHR5LXByaW50ZXIgd2FzIHB1dHRpbmcgd2hpdGVzcGFjZQ0KPj4gb24gdGhlIGVuZCBv ZiBzb21lIGxpbmVzLCB3aGljaCB3YXMgaW52aXNpYmxlIGluIHRoZSBkcmFmdC4gU28gSSd2ZQ0K Pj4gc3RyaXBwZWQgdGhhdCB3aGl0ZXNwYWNlIGJlZm9yZSBwdXR0aW5nIGl0IGluIHRoZSByZXNw b25zZSwgYW5kDQo+PiByZS1nZW5lcmF0ZWQgdGhlIGV4YW1wbGVzLg0KPg0KPkdyZWF0IHRoYW5r cy4NCj4NCj4+IFRoZSBKU09OIGluIHRoZSBtZXNzYWdlIGJvZHkgZG9lc24ndCBoYXZlIChvciBu ZWVkKSBDUkxGDQo+PiBsaW5lLWVuZGluZ3MsIHdoaXRlc3BhY2UgaXNuJ3Qgc2lnbmlmaWNhbnQg aW4gSlNPTi4NCj4NCj5SaWdodCwgYnV0IGlmIENSTEZzIGFyZSBpbmNsdWRlZCwgdGhlaXIgcHJl c2VuY2UgY291bnRzIGluIHRoZSBjb250ZW50DQo+bGVuZ3RoLiAgQW5kIHRoZXJlIGFyZSBsaW5l IGJyZWFrcyBpbmNsdWRlZCBpbiB0aGUgZHJhZnQsIHNvIGEgcmVhZGVyDQo+d291bGQgYXNzdW1l IHRob3NlIGFyZSBzZW50IG9uIHRoZSB3aXJlIGluIHRoZSBIVFRQIHRyYW5zYWN0aW9uLg0KPg0K PkJ1dCBJJ20gT0sgZWl0aGVyIHdheS4gIElmIHlvdSdyZSBzYXRpc2ZpZWQgdGhhdCB0aGUgY29u dGVudC1sZW5ndGgNCj52YWx1ZXMgYXJlIGNvcnJlY3QsIEknbSBub3QgZ29pbmcgdG8gcHVzaCBv biBpdC4NCj4NCj4+Pi0tIFJlZmVyZW5jZXMgLS0NCj4+PkkgdGhpbmsgdGhyZWUgcmVmZXJlbmNl cyBuZWVkIHRvIGJlIG1vdmVkIGZyb20gaW5mb3JtYXRpdmUgdG8gbm9ybWF0aXZlOg0KPj4+LSBS RkMgMjgxOCBpcyB0aGUgc3ViamVjdCBvZiBhIE1VU1QgaW4gU2VjdGlvbiA4LjENCj4+Pi0gUkZD IDY3MDcgcHJvdmlkZXMgbmVjZXNzYXJ5IHRlcm1pbm9sb2d5DQo+Pg0KPj4gImlkbml0cyIgZG9l c24ndCBsaWtlIG5vcm1hdGl2ZSByZWZlcmVuY2VzIHRvIGluZm9ybWF0aW9uYWwgUkZDcywgd2hp Y2gNCj4+IG1ha2VzIHNlbnNlIEkgZ3Vlc3MgLi4uIHNvIEkndmUgbGVmdCB0aGVtIGFsb25lLg0K Pg0KPklEbml0cyBpcyBhIHRvb2wsIG5vdCBhIHBvbGljeSwgYW5kIGl0J3MgT0sgdG8gaGF2ZSBJ RG5pdHMgY2FsbA0KPnNvbWV0aGluZyBvdXQsIGlmIHRoYXQgInNvbWV0aGluZyIgaXMgdGhlIHJp Z2h0IHRoaW5nIHRvIGRvLiAgSGVyZSwNCj5pdCdzIHRoZSByaWdodCB0aGluZyB0byBkbywgYW5k IGlmIHdlIHVsdGltYXRlbHkgbWFrZSB0aGVtIG5vcm1hdGl2ZQ0KPnRoZW4gSSBoYXZlIHRvIGNh bGwgdGhhdCBvdXQgZHVyaW5nIGxhc3QgY2FsbCAodGhhdCdzIHdoYXQgSURuaXRzIGlzDQo+cmVt aW5kaW5nIHVzIG9mKS4NCj4NCj5TbyBwbGVhc2UgbWFrZSB0aGVtIG5vcm1hdGl2ZSBub3csIGFu ZCBJJ2xsIG1ha2Ugc3VyZSB0aGUgbGFzdCBjYWxsDQo+bm90aWNlIGxpc3RzIHRoZW0uDQo+DQo+ QmFycnkNCg== From nobody Mon Dec 7 08:28:31 2015 Return-Path: X-Original-To: cdni@ietf.org Delivered-To: cdni@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 88FC01B38B3; Mon, 7 Dec 2015 08:28:27 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <20151207162827.3443.14045.idtracker@ietfa.amsl.com> Date: Mon, 07 Dec 2015 08:28:27 -0800 Archived-At: Cc: cdni@ietf.org, barryleiba@gmail.com, draft-ietf-cdni-control-triggers@ietf.org, cdni-chairs@ietf.org Subject: [CDNi] Last Call: (CDNI Control Interface / Triggers) to Proposed Standard X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Reply-To: ietf@ietf.org List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 16:28:27 -0000 The IESG has received a request from the Content Delivery Networks Interconnection WG (cdni) to consider the following document: - 'CDNI Control Interface / Triggers' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2015-12-21. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document describes the part of the CDN Interconnection Control Interface that allows a CDN to trigger activity in an interconnected CDN that is configured to deliver content on its behalf. The upstream CDN can use this mechanism to request that the downstream CDN pre-positions metadata or content, or that it invalidates or purges metadata or content. The upstream CDN can monitor the status of activity that it has triggered in the downstream CDN. Reviewers should note the following downward references (see RFC 3967): - RFC 6707 is used as a reference for CDNI terminology. - RFC 2818 is used as a reference for HTTP over TLS. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-cdni-control-triggers/ Once IESG discussion begins, it can be tracked via https://datatracker.ietf.org/doc/draft-ietf-cdni-control-triggers/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Dec 8 01:24:48 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 306C91A9252 for ; Tue, 8 Dec 2015 01:24:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YRzzaa3AW14w for ; Tue, 8 Dec 2015 01:24:44 -0800 (PST) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7E221A92B4 for ; Tue, 8 Dec 2015 01:24:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=15003; q=dns/txt; s=iport; t=1449566684; x=1450776284; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=ooArPKZxYelgRoPR1L7TqB6/tG+cucZfN9IPSaJBg58=; b=PYD15UHLAip4ShDtrzqPUtEw3mWLGStiBQAa9uBxWWKm2ZXiTnecGA7M RmD9Czd/aA3l1ejQBl+uNXYQ6k2XpTOpTA0SXRZeUtw338rIZpYr++P/p Me6gVJJgo1kNbr8aK4VYzHm5glFaSYoI+/uCRWf4Ox2Bd+n4mO4GFAi0Y M=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BTBABZoGZW/5pdJa1egzpTbgauO45LK?= =?us-ascii?q?wENgW4XAQuFawKBQDgUAQEBAQEBAYEKhDQBAQEEAQEBaxcEAgEZAwEBASgHJws?= =?us-ascii?q?UCQgCBBOILw3BFwEBAQEBAQEBAQEBAQEBAQEBAQEBARiGVYIOhQiCYQ0JgxWBF?= =?us-ascii?q?QWSd4NqAYEDhCmID4FbSYN6jXOIWwERDgEBQoJEgUByAYRngQcBAQE?= X-IronPort-AV: E=Sophos;i="5.20,398,1444694400"; d="scan'208,217";a="214508894" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Dec 2015 09:24:43 +0000 Received: from XCH-RCD-017.cisco.com (xch-rcd-017.cisco.com [173.37.102.27]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id tB89OhMJ020124 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 8 Dec 2015 09:24:43 GMT Received: from xch-rcd-020.cisco.com (173.37.102.30) by XCH-RCD-017.cisco.com (173.37.102.27) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Tue, 8 Dec 2015 03:24:43 -0600 Received: from xch-rcd-020.cisco.com ([173.37.102.30]) by XCH-RCD-020.cisco.com ([173.37.102.30]) with mapi id 15.00.1104.009; Tue, 8 Dec 2015 03:24:43 -0600 From: "Francois Le Faucheur (flefauch)" To: "" Thread-Topic: End of Working Group Last Call on draft-ietf-cdni-footprint-capabilities-semantics-09.txt Thread-Index: AQHRMZpFv+SKWopflE+W5pP4hbmotw== Date: Tue, 8 Dec 2015 09:24:43 +0000 Message-ID: <0AB339F0-A6E5-4FAF-8650-267EDDBA5479@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.155.24] Content-Type: multipart/alternative; boundary="_000_0AB339F0A6E54FAF8650267EDDBA5479ciscocom_" MIME-Version: 1.0 Archived-At: Subject: [CDNi] End of Working Group Last Call on draft-ietf-cdni-footprint-capabilities-semantics-09.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2015 09:24:47 -0000 --_000_0AB339F0A6E54FAF8650267EDDBA5479ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, This closes the Working Group Last Call on draft-ietf-cdni-footprint-capabi= lities-semantics-09.txt. If you have remaining concerns/comments, send them asap. Cheers Francois On 23 Nov 2015, at 11:48, Francois Le Faucheur (flefauch) > wrote: Hello, This starts a 2-week Working Group Last Call on draft-ietf-cdni-footprint-c= apabilities-semantics-09.txt. The Last Call will end on 7 December. For memory, this is in line with the plan agreed in Yokohama (i.e. go to W= GLC on the next rev addressing the few remaining open items identified duri= ng the meeting). Cheers Francois Begin forwarded message: From: Kevin Ma J > Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-footprint-capabilities-sema= ntics-09.txt Date: 4 November 2015 06:22:45 CET To: "cdni@ietf.org" > Hi all, As mentioned in the CDNI session this morning, this is the update to the F= CI semantics draft: - removed c-ip-anonymizing - updated the security considerations - made RFC5226 a normative reference At this point (as an author), we believe that the document is complete and= ready for WG last call. thanx! -- Kevin J. Ma -----Original Message----- From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of internet- drafts@ietf.org Sent: Wednesday, November 04, 2015 12:16 AM To: i-d-announce@ietf.org Cc: cdni@ietf.org Subject: [CDNi] I-D Action: draft-ietf-cdni-footprint-capabilities- semantics-09.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Content Delivery Networks Interconnection Working Group of the IETF. Title : CDNI Request Routing: Footprint and Capabilities Semantics Authors : Jan Seedorf Jon Peterson Stefano Previdi Ray van Brandenburg Kevin J. Ma Filename : draft-ietf-cdni-footprint-capabilities-semantics- 09.txt Pages : 21 Date : 2015-11-03 Abstract: This document captures the semantics of the "Footprint and Capabilities Advertisement" part of the CDNI Request Routing interface, i.e., the desired meaning of "Footprint" and "Capabilities" in the CDNI context, and what the "Footprint and Capabilities Advertisement Interface (FCI)" offers within CDNI. The document also provides guidelines for the CDNI FCI protocol. It further defines a Base Advertisement Object, the necessary registries for capabilities and footprints, and guidelines how these registries may be extended in the future. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-cdni-footprint-capabilities- semantics/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-cdni-footprint-capabilities- semantics-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-footprint-capabilities- semantics-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_0AB339F0A6E54FAF8650267EDDBA5479ciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable
Hello,

This closes the Working Group Last Call on draft-ietf-= cdni-footprint-capabilities-semantics-09.txt.
If you have remaining concerns/comments, send them asap.

Cheers

Francois


On 23 Nov 2015, at 11:48, Francois Le Faucheur (flefauch) &= lt;flefauch@cisco.com&= gt; wrote:

Hello,

This starts a 2-week Working Group Last Call on draft-= ietf-cdni-footprint-capabilities-semantics-09.txt.

The Last Call will end on 7 December.

 For memory, this is in line with the plan agreed in Y= okohama (i.e. go to WGLC on the next rev addressing the few remaining open = items identified during the meeting).

Cheers

Francois



Begin forwarded message:

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Subject: Re: [CDNi] I-D Action: dr= aft-ietf-cdni-footprint-capabilities-semantics-09.txt
Date: 4 November 2015 06:22:45 CET
To: "cdni@ietf.org" <cdni@ietf.org>

Hi all,

 As mentioned in the CDNI session this morning, this is the update to = the FCI semantics draft:

 - removed c-ip-anonymizing
 - updated the security considerations
 - made RFC5226 a normative reference

 At this point (as an author), we believe that the document is complet= e and ready for WG last call.

thanx!

--  Kevin J. Ma

-----Original Message-----
From: CDNi [mailto:cdni= -bounces@ietf.org] On Behalf Of internet-
drafts@ietf.org
Sent: Wednesday, November 04, 2015 12:16 AM
To: i-d-announce@ietf.o= rg
Cc: cdni@ietf.org
Subject: [CDNi] I-D Action: draft-ietf-cdni-footprint-capabilities-
semantics-09.txt


A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Content Delivery Networks
Interconnection Working Group of the IETF.

       Title     &nb= sp;     : CDNI Request Routing: Footprint and Capa= bilities
Semantics
       Authors     &= nbsp;   : Jan Seedorf
            &nb= sp;            = Jon Peterson
            &nb= sp;            = Stefano Previdi
            &nb= sp;            = Ray van Brandenburg
            &nb= sp;            = Kevin J. Ma
Filename &n= bsp;      : draft-ietf-cdni-footprint-capabil= ities-semantics-
09.txt
Pages  = ;         : 21
Date  =           : 2015-11-03
Abstract:
  This document captures the semantics of the "Footprint and=
  Capabilities Advertisement" part of the CDNI Request Routi= ng
  interface, i.e., the desired meaning of "Footprint" a= nd
  "Capabilities" in the CDNI context, and what the &quo= t;Footprint and
  Capabilities Advertisement Interface (FCI)" offers within = CDNI.  The
  document also provides guidelines for the CDNI FCI protocol. &n= bsp;It
  further defines a Base Advertisement Object, the necessary regi= stries
  for capabilities and footprints, and guidelines how these regis= tries
  may be extended in the future.



The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-footp= rint-capabilities-
semantics/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-cdni-footprint-capab= ilities-
semantics-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni= -footprint-capabilities-
semantics-09


Please note that it may take a couple of minutes from the time of
submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.o= rg/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://w= ww.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://w= ww.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

--_000_0AB339F0A6E54FAF8650267EDDBA5479ciscocom_-- From nobody Tue Dec 8 02:36:12 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F3B61ACD6F for ; Tue, 8 Dec 2015 02:36:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h5X6cPDk7cPC for ; Tue, 8 Dec 2015 02:36:10 -0800 (PST) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03D721ACD6A for ; Tue, 8 Dec 2015 02:36:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1429; q=dns/txt; s=iport; t=1449570969; x=1450780569; h=from:to:subject:date:message-id:mime-version; bh=H1F8vFvJkOO7XvGgEeE9QOZvDGs1rsWh4uv8vzgWYZ8=; b=V0e3+FKh/8F4YThz6sVUKzxEDhHzn5gi1wU3+UejlwUcX0Cl44h0NbYe H52+cCu90H+aKYdrtezLaEPginux0n+DF6VqDCQzqCj9TOL9n655ruC7q /kUb/bOY5GlVHLygN65rc9wErsg/diTUvn2asFmgLEswkspJN3nAg0UH8 s=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CGAgAwsWZW/5JdJa1YBoM6U3SuPYxcg?= =?us-ascii?q?hoBDVAKgRQhhW2BRTgUAQEBAQEBAYEKhCsQgQsBCwF0JwSIQg2gLaBsAQEBAQE?= =?us-ascii?q?FAQEBAQEBAQEBFgSGVYIOhQiCMD6DHoEVBZJ3g2oBjTuBW4RDlk4BHwEBQoQEh?= =?us-ascii?q?VqBBwEBAQ?= X-IronPort-AV: E=Sophos; i="5.20,399,1444694400"; d="scan'208,217"; a="51441028" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Dec 2015 10:36:09 +0000 Received: from XCH-RCD-020.cisco.com (xch-rcd-020.cisco.com [173.37.102.30]) by rcdn-core-10.cisco.com (8.14.5/8.14.5) with ESMTP id tB8Aa91C015607 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 8 Dec 2015 10:36:09 GMT Received: from xch-rcd-020.cisco.com (173.37.102.30) by XCH-RCD-020.cisco.com (173.37.102.30) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Tue, 8 Dec 2015 04:36:08 -0600 Received: from xch-rcd-020.cisco.com ([173.37.102.30]) by XCH-RCD-020.cisco.com ([173.37.102.30]) with mapi id 15.00.1104.009; Tue, 8 Dec 2015 04:36:08 -0600 From: "Francois Le Faucheur (flefauch)" To: "" Thread-Topic: Yokohama CDNI WG draft Minutes Uploaded Thread-Index: AQHRMaQ/2+4LjxllkUucGZZf8ll2ow== Date: Tue, 8 Dec 2015 10:36:08 +0000 Message-ID: <765CBE57-067B-47A6-8042-99B65586054C@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.55.155.24] Content-Type: multipart/alternative; boundary="_000_765CBE57067B47A6804299B65586054Cciscocom_" MIME-Version: 1.0 Archived-At: Subject: [CDNi] Yokohama CDNI WG draft Minutes Uploaded X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2015 10:36:11 -0000 --_000_765CBE57067B47A6804299B65586054Cciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, Draft minutes have been uploaded: https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni Please pass on comments/corrections as needed. Sorry for the unusual delay. Francois --_000_765CBE57067B47A6804299B65586054Cciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: <730980F2846F5342BA5CEF826567FB5C@emea.cisco.com> Content-Transfer-Encoding: quoted-printable
Folks,

Draft minutes have been uploaded:
https://www.ietf.org/proceedings/94/minutes/minutes= -94-cdni

Please pass on comments/corrections as needed.

Sorry for the unusual delay.

Francois
--_000_765CBE57067B47A6804299B65586054Cciscocom_-- From nobody Tue Dec 8 11:47:14 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A49C1A1F02 for ; Tue, 8 Dec 2015 11:47:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.8 X-Spam-Level: X-Spam-Status: No, score=0.8 tagged_above=-999 required=5 tests=[BAYES_50=0.8] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x5SMHVIPJTyx for ; Tue, 8 Dec 2015 11:47:10 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id 12F591A1EFC for ; Tue, 8 Dec 2015 11:47:09 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a6OE7-0006Gc-SW for cdni@ietf.org; Tue, 08 Dec 2015 19:47:08 +0000 From: Ben Niven-Jenkins Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: Date: Tue, 8 Dec 2015 19:47:07 +0000 To: "" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Subject: [CDNi] Question on c-groupid & CDNI logging X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2015 19:47:12 -0000 CDNI logging authors, I was reading the text for c-groupid in -20 of the CDNI logging draft = and if I=E2=80=99ve understood correctly, the two CDNs setup a shared = key which they rotate. c-groupid is encrypted using the shared key at = the time the log line is generated (not when the log is transferred = between CDNs? I=E2=80=99m guessing as the draft doesn=E2=80=99t say), = which ties key rotation to log event generation, which is fine, but how = do the CDNs synchronise their keys (how does a uCDN know the dCDN has = rotated keys)? Or do they rely on agreeing for example =E2=80=9Cwe will start with key = X at 21:00 UTC and rotate every 30 mins=E2=80=9D (or whatever) and rely = on the two CDNs being time sync=E2=80=99d (or the uCDN trying multiple = keys for times around the rotation interval)? The draft says this, but I=E2=80=99m not sure I know what it means At the agreed-upon lifetime, a new key is used, indicated by prefixing the key with a special character such as exclamation point. In this way, shorter lifetimes can be used as needed. Does that mean that ! is a =E2=80=9Creserved=E2=80=9D character within = the element (are reserved characters really reserved or agreed out of = band between the CDNs?) and used to signal =E2=80=9CI=E2=80=99ve rotated = keys=E2=80=9D? If a Surrogate is offline for a period of time, how does it indicate = that it has rotated keys multiple times? I=E2=80=99m also guessing you don=E2=80=99t really mean =E2=80=9Cprefixing= the key=E2=80=9D, I think you mean =E2=80=9Cprefixing the element=E2=80=9D= ? Thanks Ben From nobody Tue Dec 8 14:06:35 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA0651A916C for ; Tue, 8 Dec 2015 14:06:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AovviDQ8l5yr for ; Tue, 8 Dec 2015 14:06:32 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id BF77B1A916A for ; Tue, 8 Dec 2015 14:06:32 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.7]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a6QOz-0000Ir-NQ for cdni@ietf.org; Tue, 08 Dec 2015 22:06:31 +0000 From: Ben Niven-Jenkins Content-Type: multipart/alternative; boundary=Apple-Mail-EE9BDE2B-F51E-441D-BCF8-D15E0C836C46 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Message-Id: Date: Tue, 8 Dec 2015 22:06:28 +0000 To: cdni@ietf.org X-Mailer: iPhone Mail (13B143) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Subject: [CDNi] Yokohama minutes & URI signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2015 22:06:34 -0000 --Apple-Mail-EE9BDE2B-F51E-441D-BCF8-D15E0C836C46 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable I see in the minutes from yokohama a suggestion to use a similar anonymising= technique for the ip address in a signed uri as that used for c-groupid in t= he logging draft.=20 That would mean encrypting the ip address with a shared secret and then hash= ing it with the same (or a different) shared secret.=20 If we're going to have to have encryption for the ip address, we might as we= ll just encrypt the whole URI Signing Package (or whatever it's called) and n= ot bother with hashing.=20 It also made me wonder whether following logging would mean (according to th= e spec) the csp & ucdn doing the pick random alternate bytes dance which mak= es me wonder whether we should have that level of detail of how to generate a= key/etc in the logging draft (& presumably repeated in the uri signing draf= t) or whether we should just say something along the lines of "pick a good k= ey" with a reference to general best practice for picking a good key? (I wasn't in the discussions but all this dancing to protect privacy feels a= bit like giving ourselves a ready brek glow[1] that we're doing something b= ut i suspect it'll largely be ignored in reality given signed uris are preva= lent in the wild without all this privacy protection and i can't see what th= e incentive to csps is to change to something more complicated) Ben [1] http://youtu.be/r06VyTzLLmE= --Apple-Mail-EE9BDE2B-F51E-441D-BCF8-D15E0C836C46 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I see in the minutes from yokohama a sugges= tion to use a similar anonymising technique for the ip address in a signed u= ri as that used for c-groupid in the logging draft. 
That would mean encrypting the ip address with a shared secret a= nd then hashing it with the same (or a different) shared secret. 
=

If we're going to have to have encryption for the ip add= ress, we might as well just encrypt the whole URI Signing Package (or whatev= er it's called) and not bother with hashing. 

= It also made me wonder whether following logging would mean (according to th= e spec) the csp & ucdn doing the pick random alternate bytes dance which= makes me wonder whether we should have that level of detail of how to gener= ate a key/etc in the logging draft (& presumably repeated in the uri sig= ning draft) or whether we should just say something along the lines of "pick= a good key" with a reference to general best practice for picking a good ke= y?

(I wasn't in the discussions but all this dancin= g to protect privacy feels a bit like giving ourselves a ready brek glow[1] t= hat we're doing something but i suspect it'll largely be ignored in reality g= iven signed uris are prevalent in the wild without all this privacy protecti= on and i can't see what the incentive to csps is to change to something more= complicated)

Ben

[1] = ;http://youtu.be/r06VyTzLLmE= --Apple-Mail-EE9BDE2B-F51E-441D-BCF8-D15E0C836C46-- From nobody Wed Dec 9 06:52:23 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C00F1B2C3B for ; Wed, 9 Dec 2015 06:52:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.8 X-Spam-Level: X-Spam-Status: No, score=0.8 tagged_above=-999 required=5 tests=[BAYES_50=0.8] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2s-g0VjOfaDx for ; Wed, 9 Dec 2015 06:52:19 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id A10D21B2C30 for ; Wed, 9 Dec 2015 06:51:45 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a6g5n-000Ahx-NO for cdni@ietf.org; Wed, 09 Dec 2015 14:51:44 +0000 From: Ben Niven-Jenkins Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: Date: Wed, 9 Dec 2015 14:51:42 +0000 To: "" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Subject: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 14:52:21 -0000 Ray, I was reading draft-brandenburg-cdni-uri-signing-for-has-01 section = 5.4.1 and I see under 6.B. that the draft requires a new public/private = key to be generated every time a new token is generated? I=E2=80=99m = assuming this is a copy & paste error from the section on creating the = initial key? Assuming you don=E2=80=99t intend to have a new public/private key = generated for each signed token in the chain, something that occurred to = me is that the draft introduces a subtle change to the responsibilities = of the CDN / exposure of the CSP for asymmetric signatures. Today a CSP generates a token and a CDN validates it. The = uri-signing-for-has draft allows the CDN to create a token for itself. = In the past the CDN could always have done that anyway with a shared key = but couldn=E2=80=99t with an asymmetric signature because the CDN never = had access to the private key. uri-sgning-for-has requires the CDN to = have the private key in order to created chained tokens. That might not = be a problem for CSPs but it=E2=80=99s probably worth calling out = somewhere in the draft that ui-signing-for-has required the CDN to have = the private key whereas ietf-signed-uris draft does not. Ben From nobody Wed Dec 9 07:00:16 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 187361AC3DB for ; Wed, 9 Dec 2015 07:00:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wG0nq7sVwOog for ; Wed, 9 Dec 2015 07:00:13 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B98731A92FD for ; Wed, 9 Dec 2015 07:00:12 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-e6-566841f648c0 Received: from EUSAAHC007.ericsson.se (Unknown_Domain [147.117.188.93]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id 59.61.32102.6F148665; Wed, 9 Dec 2015 16:00:07 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC007.ericsson.se ([147.117.188.93]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 10:00:10 -0500 From: Kevin Ma J To: Ben Niven-Jenkins , "cdni@ietf.org" Thread-Topic: [CDNi] Yokohama minutes & URI signing Thread-Index: AQHRMgS5UKG6O48HpEeATpl6OZhViZ7Cve9A Date: Wed, 9 Dec 2015 15:00:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.12] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0C5C6eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphkeLIzCtJLcpLzFFi42KZXLonVve7Y0aYwZX5bBYLzk1gs3g6+w+r A5PHkiU/mTx+Xp/EGMAUxWWTkpqTWZZapG+XwJVxf9F3poJ5FRVPJnxhamBsKO1i5OSQEDCR +LjjByOELSZx4d56ti5GLg4hgSOMEucWf2WCcJYxSszuXMAGUsUmoCXx+OtfJhBbRCBIYvPE HhYQW1jASKKx9yZ7FyMHUNxYYsL1NIgSI4nVh96BlbAIqEjMPnQdbBmvgK/E/paVrCC2kICb xJPL/WAjOQXcJdouN4HVMwId9P3UGrA4s4C4xK0n85kgDhWQWLLnPDOELSrx8vE/VghbSWLO 62vMICcwC+RLfOuth1glKHFy5hOWCYwis5BMmoVQNQtJFURYU2L9Ln2IakWJKd0P2SFsDYnW OXPZkcUXMLKvYuQoLS7IyU03MtzECIybYxJsjjsY9/Z6HmIU4GBU4uH9kJAeJsSaWFZcmXuI UYKDWUmEV8c2I0yINyWxsiq1KD++qDQntfgQozQHi5I4LyMDA4OQQHpiSWp2ampBahFMlomD U6qBcdMaW/l40e1fnnvpsO3Va1bful5+73EPr6Z5k257/+t9+My08m2WWA6Tvhejg0GZcoQR 91zN+lXKzqtVPtRk9677EN2nnP0zcI6e8pM6nlXRZwS5HepfpZ/bWZ91IeXCMps9tufzCh3W PNT0zONhnduzxWubkodwq9S6XYJbj02/e0bp5bZwJZbijERDLeai4kQAHmsgFpcCAAA= Archived-At: Subject: Re: [CDNi] Yokohama minutes & URI signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 15:00:15 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0C5C6eusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQogIChhcyBhbiBpbmRpdmlkdWFsKQ0KDQo+IFRoYXQgd291bGQgbWVhbiBlbmNy eXB0aW5nIHRoZSBpcCBhZGRyZXNzIHdpdGggYSBzaGFyZWQgc2VjcmV0IGFuZCB0aGVuIGhhc2hp bmcgaXQgd2l0aCB0aGUgc2FtZSAob3IgYSBkaWZmZXJlbnQpIHNoYXJlZCBzZWNyZXQuDQoNCiAg Q29ycmVjdC4gIFdlIGRpc2N1c3NlZCB1c2luZyB0aGUgc2FtZSBzaGFyZWQgc2VjcmV0IChvciBw cml2YXRlIGtleSkuDQoNCj4gd2UgbWlnaHQgYXMgd2VsbCBqdXN0IGVuY3J5cHQgdGhlIHdob2xl IFVSSSBTaWduaW5nIFBhY2thZ2UgKG9yIHdoYXRldmVyIGl0J3MgY2FsbGVkKSBhbmQgbm90IGJv dGhlciB3aXRoIGhhc2hpbmcuDQoNCiAgVGhlIHRoaW5raW5nIGhlcmUgd2FzIHRoYXQsIGZvciB0 aG9zZSB3aG8gZG8gbm90IGNhcmUgdG8gdXNlIHRoZSBDSVAgSUUsIHRoZXkgd291bGRuJ3QgaGF2 ZSB0byBib3RoZXIgd2l0aCBlbmNyeXB0aW9uIG9yIGtleSBtYW5hZ2VtZW50Lg0KDQo+IHdoZXRo ZXIgd2Ugc2hvdWxkIGp1c3Qgc2F5IHNvbWV0aGluZyBhbG9uZyB0aGUgbGluZXMgb2YgInBpY2sg YSBnb29kIGtleSIgd2l0aCBhIHJlZmVyZW5jZSB0byBnZW5lcmFsIGJlc3QgcHJhY3RpY2UgZm9y IHBpY2tpbmcgYSBnb29kIGtleQ0KDQogIFdlIHByb2JhYmx5IHNob3VsZC4gIFNvbWV0aGluZyBh Ym91dCByYW5kb21uZXNzIGFuZCBob3cgb2Z0ZW4gdG8gcm90YXRlIGtleXM/DQoNCj4gYnV0IGkg c3VzcGVjdCBpdCdsbCBsYXJnZWx5IGJlIGlnbm9yZWQgaW4gcmVhbGl0eSBnaXZlbiBzaWduZWQg dXJpcyBhcmUgcHJldmFsZW50IGluIHRoZSB3aWxkIHdpdGhvdXQgYWxsIHRoaXMgcHJpdmFjeSBw cm90ZWN0aW9uIGFuZCBpIGNhbid0IHNlZSB3aGF0IHRoZSBpbmNlbnRpdmUgdG8gY3NwcyBpcyB0 byBjaGFuZ2UgdG8gc29tZXRoaW5nIG1vcmUgY29tcGxpY2F0ZWQNCg0KICBJIGRvbid0IGRpc2Fn cmVlIHdpdGggdGhpcyBzdGF0ZW1lbnQsIGJ1dCBJIHRoaW5rIHRoZSBnZW5lcmFsIHB1c2ggZm9y IHByaXZhY3kgd2l0aGluIElFVEYgcHJvdG9jb2xzIHdpbGwgcHJvYmFibHkgcmVxdWlyZSB1cyB0 byBwdXQgc29tZXRoaW5nIGluIHRoZSBzcGVjLg0KDQotLSAgS2V2aW4gSi4gTWENCg0KRnJvbTog Q0ROaSBbbWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJlbiBOaXZl bi1KZW5raW5zDQpTZW50OiBUdWVzZGF5LCBEZWNlbWJlciAwOCwgMjAxNSA1OjA2IFBNDQpUbzog Y2RuaUBpZXRmLm9yZw0KU3ViamVjdDogW0NETmldIFlva29oYW1hIG1pbnV0ZXMgJiBVUkkgc2ln bmluZw0KDQpJIHNlZSBpbiB0aGUgbWludXRlcyBmcm9tIHlva29oYW1hIGEgc3VnZ2VzdGlvbiB0 byB1c2UgYSBzaW1pbGFyIGFub255bWlzaW5nIHRlY2huaXF1ZSBmb3IgdGhlIGlwIGFkZHJlc3Mg aW4gYSBzaWduZWQgdXJpIGFzIHRoYXQgdXNlZCBmb3IgYy1ncm91cGlkIGluIHRoZSBsb2dnaW5n IGRyYWZ0Lg0KDQpUaGF0IHdvdWxkIG1lYW4gZW5jcnlwdGluZyB0aGUgaXAgYWRkcmVzcyB3aXRo IGEgc2hhcmVkIHNlY3JldCBhbmQgdGhlbiBoYXNoaW5nIGl0IHdpdGggdGhlIHNhbWUgKG9yIGEg ZGlmZmVyZW50KSBzaGFyZWQgc2VjcmV0Lg0KDQpJZiB3ZSdyZSBnb2luZyB0byBoYXZlIHRvIGhh dmUgZW5jcnlwdGlvbiBmb3IgdGhlIGlwIGFkZHJlc3MsIHdlIG1pZ2h0IGFzIHdlbGwganVzdCBl bmNyeXB0IHRoZSB3aG9sZSBVUkkgU2lnbmluZyBQYWNrYWdlIChvciB3aGF0ZXZlciBpdCdzIGNh bGxlZCkgYW5kIG5vdCBib3RoZXIgd2l0aCBoYXNoaW5nLg0KDQpJdCBhbHNvIG1hZGUgbWUgd29u ZGVyIHdoZXRoZXIgZm9sbG93aW5nIGxvZ2dpbmcgd291bGQgbWVhbiAoYWNjb3JkaW5nIHRvIHRo ZSBzcGVjKSB0aGUgY3NwICYgdWNkbiBkb2luZyB0aGUgcGljayByYW5kb20gYWx0ZXJuYXRlIGJ5 dGVzIGRhbmNlIHdoaWNoIG1ha2VzIG1lIHdvbmRlciB3aGV0aGVyIHdlIHNob3VsZCBoYXZlIHRo YXQgbGV2ZWwgb2YgZGV0YWlsIG9mIGhvdyB0byBnZW5lcmF0ZSBhIGtleS9ldGMgaW4gdGhlIGxv Z2dpbmcgZHJhZnQgKCYgcHJlc3VtYWJseSByZXBlYXRlZCBpbiB0aGUgdXJpIHNpZ25pbmcgZHJh ZnQpIG9yIHdoZXRoZXIgd2Ugc2hvdWxkIGp1c3Qgc2F5IHNvbWV0aGluZyBhbG9uZyB0aGUgbGlu ZXMgb2YgInBpY2sgYSBnb29kIGtleSIgd2l0aCBhIHJlZmVyZW5jZSB0byBnZW5lcmFsIGJlc3Qg cHJhY3RpY2UgZm9yIHBpY2tpbmcgYSBnb29kIGtleT8NCg0KKEkgd2Fzbid0IGluIHRoZSBkaXNj dXNzaW9ucyBidXQgYWxsIHRoaXMgZGFuY2luZyB0byBwcm90ZWN0IHByaXZhY3kgZmVlbHMgYSBi aXQgbGlrZSBnaXZpbmcgb3Vyc2VsdmVzIGEgcmVhZHkgYnJlayBnbG93WzFdIHRoYXQgd2UncmUg ZG9pbmcgc29tZXRoaW5nIGJ1dCBpIHN1c3BlY3QgaXQnbGwgbGFyZ2VseSBiZSBpZ25vcmVkIGlu IHJlYWxpdHkgZ2l2ZW4gc2lnbmVkIHVyaXMgYXJlIHByZXZhbGVudCBpbiB0aGUgd2lsZCB3aXRo b3V0IGFsbCB0aGlzIHByaXZhY3kgcHJvdGVjdGlvbiBhbmQgaSBjYW4ndCBzZWUgd2hhdCB0aGUg aW5jZW50aXZlIHRvIGNzcHMgaXMgdG8gY2hhbmdlIHRvIHNvbWV0aGluZyBtb3JlIGNvbXBsaWNh dGVkKQ0KDQpCZW4NCg0KWzFdIGh0dHA6Ly95b3V0dS5iZS9yMDZWeVR6TExtRQ0K --_000_A419F67F880AB2468214E154CB8A556206C0C5C6eusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIg Lz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxh bmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+SGkgQmVuLDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7 IChhcyBhbiBpbmRpdmlkdWFsKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpUaGF0IHdvdWxkIG1lYW4gZW5jcnlw dGluZyB0aGUgaXAgYWRkcmVzcyB3aXRoIGEgc2hhcmVkIHNlY3JldCBhbmQgdGhlbiBoYXNoaW5n IGl0IHdpdGggdGhlIHNhbWUgKG9yIGEgZGlmZmVyZW50KSBzaGFyZWQgc2VjcmV0LiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsg Q29ycmVjdC4mbmJzcDsgV2UgZGlzY3Vzc2VkIHVzaW5nIHRoZSBzYW1lIHNoYXJlZCBzZWNyZXQg KG9yIHByaXZhdGUga2V5KS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZndDsgPC9zcGFuPg0Kd2UgbWlnaHQgYXMgd2VsbCBqdXN0IGVu Y3J5cHQgdGhlIHdob2xlIFVSSSBTaWduaW5nIFBhY2thZ2UgKG9yIHdoYXRldmVyIGl0J3MgY2Fs bGVkKSBhbmQgbm90IGJvdGhlciB3aXRoIGhhc2hpbmcuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7IFRoZSB0 aGlua2luZyBoZXJlIHdhcyB0aGF0LCBmb3IgdGhvc2Ugd2hvIGRvIG5vdCBjYXJlIHRvIHVzZSB0 aGUgQ0lQIElFLCB0aGV5IHdvdWxkbid0IGhhdmUgdG8gYm90aGVyIHdpdGggZW5jcnlwdGlvbiBv ciBrZXkgbWFuYWdlbWVudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZndDsgPC9zcGFuPg0Kd2hldGhlciB3ZSBzaG91bGQganVzdCBz YXkgc29tZXRoaW5nIGFsb25nIHRoZSBsaW5lcyBvZiAmcXVvdDtwaWNrIGEgZ29vZCBrZXkmcXVv dDsgd2l0aCBhIHJlZmVyZW5jZSB0byBnZW5lcmFsIGJlc3QgcHJhY3RpY2UgZm9yIHBpY2tpbmcg YSBnb29kIGtleTxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyBXZSBwcm9iYWJseSBzaG91bGQuJm5ic3A7IFNv bWV0aGluZyBhYm91dCByYW5kb21uZXNzIGFuZCBob3cgb2Z0ZW4gdG8gcm90YXRlIGtleXM/PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m Z3Q7IDwvc3Bhbj4NCmJ1dCBpIHN1c3BlY3QgaXQnbGwgbGFyZ2VseSBiZSBpZ25vcmVkIGluIHJl YWxpdHkgZ2l2ZW4gc2lnbmVkIHVyaXMgYXJlIHByZXZhbGVudCBpbiB0aGUgd2lsZCB3aXRob3V0 IGFsbCB0aGlzIHByaXZhY3kgcHJvdGVjdGlvbiBhbmQgaSBjYW4ndCBzZWUgd2hhdCB0aGUgaW5j ZW50aXZlIHRvIGNzcHMgaXMgdG8gY2hhbmdlIHRvIHNvbWV0aGluZyBtb3JlIGNvbXBsaWNhdGVk PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7IEkgZG9uJ3QgZGlzYWdyZWUgd2l0aCB0aGlzIHN0YXRlbWVudCwg YnV0IEkgdGhpbmsgdGhlIGdlbmVyYWwgcHVzaCBmb3IgcHJpdmFjeSB3aXRoaW4gSUVURiBwcm90 b2NvbHMgd2lsbCBwcm9iYWJseSByZXF1aXJlIHVzIHRvIHB1dCBzb21ldGhpbmcgaW4gdGhlIHNw ZWMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4tLSZuYnNwOyBLZXZpbiBKLiBNYTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiBDRE5pIFttYWlsdG86Y2RuaS1i b3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5CZW4gTml2ZW4tSmVua2luczxi cj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBEZWNlbWJlciAwOCwgMjAxNSA1OjA2IFBNPGJyPg0K PGI+VG86PC9iPiBjZG5pQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFtDRE5pXSBZb2tv aGFtYSBtaW51dGVzICZhbXA7IFVSSSBzaWduaW5nPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBzZWUgaW4gdGhlIG1pbnV0ZXMgZnJvbSB5b2tvaGFtYSBh IHN1Z2dlc3Rpb24gdG8gdXNlIGEgc2ltaWxhciBhbm9ueW1pc2luZyB0ZWNobmlxdWUgZm9yIHRo ZSBpcCBhZGRyZXNzIGluIGEgc2lnbmVkIHVyaSBhcyB0aGF0IHVzZWQgZm9yIGMtZ3JvdXBpZCBp biB0aGUgbG9nZ2luZyBkcmFmdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoYXQgd291bGQgbWVhbiBlbmNyeXB0aW5nIHRoZSBpcCBhZGRyZXNz IHdpdGggYSBzaGFyZWQgc2VjcmV0IGFuZCB0aGVuIGhhc2hpbmcgaXQgd2l0aCB0aGUgc2FtZSAo b3IgYSBkaWZmZXJlbnQpIHNoYXJlZCBzZWNyZXQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHdlJ3JlIGdvaW5nIHRvIGhhdmUg dG8gaGF2ZSBlbmNyeXB0aW9uIGZvciB0aGUgaXAgYWRkcmVzcywgd2UgbWlnaHQgYXMgd2VsbCBq dXN0IGVuY3J5cHQgdGhlIHdob2xlIFVSSSBTaWduaW5nIFBhY2thZ2UgKG9yIHdoYXRldmVyIGl0 J3MgY2FsbGVkKSBhbmQgbm90IGJvdGhlciB3aXRoIGhhc2hpbmcuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IGFsc28gbWFkZSBt ZSB3b25kZXIgd2hldGhlciBmb2xsb3dpbmcgbG9nZ2luZyB3b3VsZCBtZWFuIChhY2NvcmRpbmcg dG8gdGhlIHNwZWMpIHRoZSBjc3AgJmFtcDsgdWNkbiBkb2luZyB0aGUgcGljayByYW5kb20gYWx0 ZXJuYXRlIGJ5dGVzIGRhbmNlIHdoaWNoIG1ha2VzIG1lIHdvbmRlciB3aGV0aGVyIHdlIHNob3Vs ZCBoYXZlIHRoYXQgbGV2ZWwgb2YgZGV0YWlsIG9mIGhvdyB0byBnZW5lcmF0ZSBhIGtleS9ldGMN CiBpbiB0aGUgbG9nZ2luZyBkcmFmdCAoJmFtcDsgcHJlc3VtYWJseSByZXBlYXRlZCBpbiB0aGUg dXJpIHNpZ25pbmcgZHJhZnQpIG9yIHdoZXRoZXIgd2Ugc2hvdWxkIGp1c3Qgc2F5IHNvbWV0aGlu ZyBhbG9uZyB0aGUgbGluZXMgb2YgJnF1b3Q7cGljayBhIGdvb2Qga2V5JnF1b3Q7IHdpdGggYSBy ZWZlcmVuY2UgdG8gZ2VuZXJhbCBiZXN0IHByYWN0aWNlIGZvciBwaWNraW5nIGEgZ29vZCBrZXk/ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPihJ IHdhc24ndCBpbiB0aGUgZGlzY3Vzc2lvbnMgYnV0IGFsbCB0aGlzIGRhbmNpbmcgdG8gcHJvdGVj dCBwcml2YWN5IGZlZWxzIGEgYml0IGxpa2UgZ2l2aW5nIG91cnNlbHZlcyBhIHJlYWR5IGJyZWsg Z2xvd1sxXSB0aGF0IHdlJ3JlIGRvaW5nIHNvbWV0aGluZyBidXQgaSBzdXNwZWN0IGl0J2xsIGxh cmdlbHkgYmUgaWdub3JlZCBpbiByZWFsaXR5IGdpdmVuIHNpZ25lZCB1cmlzIGFyZSBwcmV2YWxl bnQgaW4NCiB0aGUgd2lsZCB3aXRob3V0IGFsbCB0aGlzIHByaXZhY3kgcHJvdGVjdGlvbiBhbmQg aSBjYW4ndCBzZWUgd2hhdCB0aGUgaW5jZW50aXZlIHRvIGNzcHMgaXMgdG8gY2hhbmdlIHRvIHNv bWV0aGluZyBtb3JlIGNvbXBsaWNhdGVkKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WzFdJm5ic3A7PGEgaHJlZj0iaHR0cDovL3lvdXR1LmJl L3IwNlZ5VHpMTG1FIj5odHRwOi8veW91dHUuYmUvcjA2VnlUekxMbUU8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A419F67F880AB2468214E154CB8A556206C0C5C6eusaamb103erics_-- From nobody Wed Dec 9 08:27:44 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 895291ACCD9 for ; Wed, 9 Dec 2015 08:27:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.116 X-Spam-Level: X-Spam-Status: No, score=-2.116 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mX72YERWIWgn for ; Wed, 9 Dec 2015 08:27:40 -0800 (PST) Received: from fromintoutb.tno.nl (fromintoutb.tno.nl [134.221.1.27]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 739F41ACDA4 for ; Wed, 9 Dec 2015 08:26:40 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.20,404,1444687200"; d="scan'208";a="8677921" Received: from exc-cashub01.tsn.tno.nl (HELO mail.tno.nl) ([134.221.225.220]) by mailhost1b.tno.nl with ESMTP; 09 Dec 2015 17:26:28 +0100 Received: from EXC-MBX03.tsn.tno.nl ([fe80::e969:1300:fb9f:7e12]) by EXC-CASHUB01.tsn.tno.nl ([fe80::b855:be6:1aa8:4d0f%13]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 17:26:28 +0100 From: "Brandenburg, R. (Ray) van" To: Ben Niven-Jenkins , "" Thread-Topic: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 Thread-Index: AQHRMpE9snEG1azLLU+hJiWtSuTSHp7C15GA Date: Wed, 9 Dec 2015 16:26:27 +0000 Message-ID: <39F63763-F4DA-4AD2-AA8B-ED7B5200CB89@tno.nl> References: In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151105 x-originating-ip: [134.221.225.191] Content-Type: text/plain; charset="utf-8" Content-ID: <9D9614365CBA7149A05CD18A3D6CD73E@tno.nl> MIME-Version: 1.0 Content-Transfer-Encoding: base64 Archived-At: Subject: Re: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 16:27:42 -0000 SGkgQmVuLA0KDQpUaGFua3MgZm9yIHRoZSByZXZpZXchDQoNClNlZSBteSBjb21tZW50cyBiZWxv dy4NCg0KDQoNCg0KDQpPbiAwOS8xMi8xNSAxNTo1MSwgIkNETmkgb24gYmVoYWxmIG9mIEJlbiBO aXZlbi1KZW5raW5zIiA8Y2RuaS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBiZW5Abml2 ZW4tamVua2lucy5jby51az4gd3JvdGU6DQoNCj5SYXksDQo+DQo+SSB3YXMgcmVhZGluZyBkcmFm dC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci1oYXMtMDEgc2VjdGlvbiA1LjQuMSBh bmQgSSBzZWUgdW5kZXIgNi5CLiB0aGF0IHRoZSBkcmFmdCByZXF1aXJlcyBhIG5ldyBwdWJsaWMv cHJpdmF0ZSBrZXkgdG8gYmUgZ2VuZXJhdGVkIGV2ZXJ5IHRpbWUgYSBuZXcgdG9rZW4gaXMgZ2Vu ZXJhdGVkPyBJ4oCZbSBhc3N1bWluZyB0aGlzIGlzIGEgY29weSAmIHBhc3RlIGVycm9yIGZyb20g dGhlIHNlY3Rpb24gb24gY3JlYXRpbmcgdGhlIGluaXRpYWwga2V5Pw0KDQpZZXMsIHRoYXQncyBh biBlcnJvciwgeW91IHNob3VsZCBvbmx5IGhhdmUgdG8gZ2VuZXJhdGUgdGhlIGtleSBwYWlyIG9u Y2UuIE5vdyB0aGF0IEkgdGhpbmsgYWJvdXQgaXQsIEkgdGhpbmsgd2Ugc2hvdWxkIHJlbW92ZSB0 aGlzIGxpbmUgZnJvbSB0byB0aGUgbWFpbiBVUkkgc2lnbmluZyBzcGVjIGFzIHdlbGwuIA0KDQo+ DQo+QXNzdW1pbmcgeW91IGRvbuKAmXQgaW50ZW5kIHRvIGhhdmUgYSBuZXcgcHVibGljL3ByaXZh dGUga2V5IGdlbmVyYXRlZCBmb3IgZWFjaCBzaWduZWQgdG9rZW4gaW4gdGhlIGNoYWluLCBzb21l dGhpbmcgdGhhdCBvY2N1cnJlZCB0byBtZSBpcyB0aGF0IHRoZSBkcmFmdCBpbnRyb2R1Y2VzIGEg c3VidGxlIGNoYW5nZSB0byB0aGUgcmVzcG9uc2liaWxpdGllcyBvZiB0aGUgQ0ROIC8gZXhwb3N1 cmUgb2YgdGhlIENTUCBmb3IgYXN5bW1ldHJpYyBzaWduYXR1cmVzLg0KPg0KPlRvZGF5IGEgQ1NQ IGdlbmVyYXRlcyBhIHRva2VuIGFuZCBhIENETiB2YWxpZGF0ZXMgaXQuIFRoZSB1cmktc2lnbmlu Zy1mb3ItaGFzIGRyYWZ0IGFsbG93cyB0aGUgQ0ROIHRvIGNyZWF0ZSBhIHRva2VuIGZvciBpdHNl bGYuIEluIHRoZSBwYXN0IHRoZSBDRE4gY291bGQgYWx3YXlzIGhhdmUgZG9uZSB0aGF0IGFueXdh eSB3aXRoIGEgc2hhcmVkIGtleSBidXQgY291bGRu4oCZdCB3aXRoIGFuIGFzeW1tZXRyaWMgc2ln bmF0dXJlIGJlY2F1c2UgdGhlIENETiBuZXZlciBoYWQgYWNjZXNzIHRvIHRoZSBwcml2YXRlIGtl eS4gdXJpLXNnbmluZy1mb3ItaGFzIHJlcXVpcmVzIHRoZSBDRE4gdG8gaGF2ZSB0aGUgcHJpdmF0 ZSBrZXkgaW4gb3JkZXIgdG8gY3JlYXRlZCBjaGFpbmVkIHRva2Vucy4gVGhhdCBtaWdodCBub3Qg YmUgYSBwcm9ibGVtIGZvciBDU1BzIGJ1dCBpdOKAmXMgcHJvYmFibHkgd29ydGggY2FsbGluZyBv dXQgc29tZXdoZXJlIGluIHRoZSBkcmFmdCB0aGF0IHVpLXNpZ25pbmctZm9yLWhhcyByZXF1aXJl ZCB0aGUgQ0ROIHRvIGhhdmUgdGhlIHByaXZhdGUga2V5IHdoZXJlYXMgaWV0Zi1zaWduZWQtdXJp cyBkcmFmdCBkb2VzIG5vdC4NCg0KSG1tLCBnb29kIHBvaW50LiBJbiBwcmFjdGljZSwgSSBhc3N1 bWUgdGhlIENETiB3b3VsZCBub3QgdXNlIHRoZSBDU1AncyBwcml2YXRlIGtleSBidXQgdXNlIGFu IGludGVybmFsIG9uZSBmb3Igc3Vic2VxdWVudCB0b2tlbnMsIGJ1dCB5b3UncmUgcmlnaHQgdGhh dCB3ZSBzaG91bGQgY2FsbCB0aGlzIG91dCBzb21ld2hlcmUuIEluIGFueSBjYXNlLCBJIGV4cGVj dCB0aGUgdXNlIG9mIGFzeW1tZXRyaWMga2V5cyBmb3IgY2hhaW5lZCB0b2tlbnMgd291bGQgb25s eSBiZSBiZW5lZmljaWFsIGluIHZlcnkgc3BlY2lmaWMgY2lyY3Vtc3RhbmNlIGFueXdheS4gDQoN ClRoYW5rcyBhZ2Fpbi4NCg0KUmF5DQoNCj4NCj5CZW4NCj4NCj5fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPkNETmkgbWFpbGluZyBsaXN0DQo+Q0ROaUBp ZXRmLm9yZw0KPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KVGhp cyBtZXNzYWdlIG1heSBjb250YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZv ciB5b3UuIElmIHlvdSBhcmUgbm90IHRoZSBhZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdh cyBzZW50IHRvIHlvdSBieSBtaXN0YWtlLCB5b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhl IHNlbmRlciBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkg Zm9yIHRoZSBjb250ZW50IG9mIHRoaXMgZS1tYWlsLCBmb3IgdGhlIG1hbm5lciBpbiB3aGljaCB5 b3UgdXNlIGl0IGFuZCBmb3IgZGFtYWdlIG9mIGFueSBraW5kIHJlc3VsdGluZyBmcm9tIHRoZSBy aXNrcyBpbmhlcmVudCB0byB0aGUgZWxlY3Ryb25pYyB0cmFuc21pc3Npb24gb2YgbWVzc2FnZXMu Cg== From nobody Wed Dec 9 09:27:39 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B87371A0204 for ; Wed, 9 Dec 2015 09:27:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ghdOJwzIUJLG for ; Wed, 9 Dec 2015 09:27:35 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id 52B991A026A for ; Wed, 9 Dec 2015 09:27:17 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a6iWJ-000B1k-4Y; Wed, 09 Dec 2015 17:27:16 +0000 Content-Type: multipart/alternative; boundary="Apple-Mail=_2BE00804-7F32-4646-9BB7-D891A835BFB1" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: Date: Wed, 9 Dec 2015 17:27:12 +0000 Message-Id: <638609BA-4196-41C8-8830-B03A423C3B3A@niven-jenkins.co.uk> References: To: Kevin Ma J X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Yokohama minutes & URI signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 17:27:37 -0000 --Apple-Mail=_2BE00804-7F32-4646-9BB7-D891A835BFB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Kevin, > On 9 Dec 2015, at 15:00, Kevin Ma J wrote: >=20 > Hi Ben, > =20 > (as an individual) > =20 > > That would mean encrypting the ip address with a shared secret and = then hashing it with the same (or a different) shared secret.=20 > =20 > Correct. We discussed using the same shared secret (or private = key). > =20 > > we might as well just encrypt the whole URI Signing Package (or = whatever it's called) and not bother with hashing. > =20 > The thinking here was that, for those who do not care to use the CIP = IE, they wouldn't have to bother with encryption or key management. I hadn=E2=80=99t considered that scenario when I wrote my mail. They'd = save having to do the encryption. They wouldn=E2=80=99t have to do = (secure) key management but they=E2=80=99d still have to do (secure) = secret management if they were using a shared secret instead of = asymmetric signatures. Honestly I don=E2=80=99t know whether saving the encryption is a = meaningful saving or not. My gut says sticking to one solution for = everything is better just because it leaves fewer special cases for = people to get wrong. The number of implementers for this is potentially = much larger than the other CDNI specs because the CSP also has to = implement the signed uri spec to generate the tokens in the first place. =20 > > whether we should just say something along the lines of "pick a good = key" with a reference to general best practice for picking a good key > =20 > We probably should. Something about randomness and how often to = rotate keys? I=E2=80=99m not a security expert so I=E2=80=99m not sure. Whoever = suggest the current text is probably the expert to ask. My concern is we = end up with lots of documents each specifying the same thing (possibly = in slightly different ways unless someone keeps a good eye to make sure = they=E2=80=99re perfectly aligned) rather than a reference able source = that all the documents can refer to. [It=E2=80=99s probably off-topic for this group, but while I=E2=80=99m = sensitive to privacy concerns it feels like we=E2=80=99re being hit with = a hammer to address =E2=80=9Cprivacy=E2=80=9D while operating in an = environment without good general guidance being documented (or at least = referenced if they do exist) so everyone (not just in CDNI) is = reinventing the wheel for themselves.] =20 > > but i suspect it'll largely be ignored in reality given signed uris = are prevalent in the wild without all this privacy protection and i = can't see what the incentive to csps is to change to something more = complicated > =20 > I don't disagree with this statement, but I think the general push = for privacy within IETF protocols will probably require us to put = something in the spec. I=E2=80=99m sure it will. C=E2=80=99est la vie. =20 Ben =20 > =20 > -- Kevin J. Ma > =20 > From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Ben = Niven-Jenkins > Sent: Tuesday, December 08, 2015 5:06 PM > To: cdni@ietf.org > Subject: [CDNi] Yokohama minutes & URI signing > =20 > I see in the minutes from yokohama a suggestion to use a similar = anonymising technique for the ip address in a signed uri as that used = for c-groupid in the logging draft.=20 > =20 > That would mean encrypting the ip address with a shared secret and = then hashing it with the same (or a different) shared secret.=20 > =20 > If we're going to have to have encryption for the ip address, we might = as well just encrypt the whole URI Signing Package (or whatever it's = called) and not bother with hashing.=20 > =20 > It also made me wonder whether following logging would mean (according = to the spec) the csp & ucdn doing the pick random alternate bytes dance = which makes me wonder whether we should have that level of detail of how = to generate a key/etc in the logging draft (& presumably repeated in the = uri signing draft) or whether we should just say something along the = lines of "pick a good key" with a reference to general best practice for = picking a good key? > =20 > (I wasn't in the discussions but all this dancing to protect privacy = feels a bit like giving ourselves a ready brek glow[1] that we're doing = something but i suspect it'll largely be ignored in reality given signed = uris are prevalent in the wild without all this privacy protection and i = can't see what the incentive to csps is to change to something more = complicated) > =20 > Ben > =20 > [1] http://youtu.be/r06VyTzLLmE --Apple-Mail=_2BE00804-7F32-4646-9BB7-D891A835BFB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Kevin,

On 9 Dec 2015, at 15:00, Kevin = Ma J <kevin.j.ma@ericsson.com> wrote:

Hi = Ben,
 
  = (as an individual)
 
> That would mean = encrypting the ip address with a shared secret and then hashing it with = the same (or a different) shared secret. 
 
  = Correct.  We discussed using the same shared secret (or private = key).
 
> we might as well = just encrypt the whole URI Signing Package (or whatever it's called) and = not bother with hashing.
 
  The thinking here was = that, for those who do not care to use the CIP IE, they wouldn't have to = bother with encryption or key = management.

I hadn=E2=80=99t considered that scenario when I = wrote my mail. They'd save having to do the encryption. They wouldn=E2=80=99= t have to do (secure) key management but they=E2=80=99d still have to do = (secure) secret management if they were using a shared secret instead of = asymmetric signatures.

Honestly I = don=E2=80=99t know whether saving the encryption is a meaningful saving = or not. My gut says sticking to one solution for everything is better = just because it leaves fewer special cases for people to get wrong. The = number of implementers for this is potentially much larger than the = other CDNI specs because the CSP also has to implement the signed uri = spec to generate the tokens in the first place.
 
> whether we should = just say something along the lines of "pick a good key" with a reference = to general best practice for picking a good key
 
  We probably should.  Something about randomness = and how often to rotate keys?

I=E2=80=99m not a security expert so I=E2=80=99m not = sure. Whoever suggest the current text is probably the expert to ask. My = concern is we end up with lots of documents each specifying the same = thing (possibly in slightly different ways unless someone keeps a good = eye to make sure they=E2=80=99re perfectly aligned) rather than a = reference able source that all the documents can refer to.

[It=E2=80=99s probably off-topic for this group, = but while I=E2=80=99m sensitive to privacy concerns it feels like = we=E2=80=99re being hit with a hammer to address =E2=80=9Cprivacy=E2=80=9D= while operating in an environment without good general guidance being = documented (or at least referenced if they do exist) so everyone (not = just in CDNI) is reinventing the wheel for themselves.]
 
> but i suspect it'll = largely be ignored in reality given signed uris are prevalent in the = wild without all this privacy protection and i can't see what the = incentive to csps is to change to something more complicated
 
  I don't disagree with this statement, but I think the = general push for privacy within IETF protocols will probably require us = to put something in the spec.

I=E2=80=99m sure it will. C=E2=80=99est la = vie.
 
Ben
 
 
--  Kevin J. Ma
 
From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf = Of Ben = Niven-Jenkins
Sent: Tuesday, December 08, 2015 = 5:06 PM
To: cdni@ietf.org
Subject: [CDNi] Yokohama minutes = & URI signing
 
I see in the minutes from yokohama a = suggestion to use a similar anonymising technique for the ip address in = a signed uri as that used for c-groupid in the logging draft. 
 
That would mean encrypting the ip address = with a shared secret and then hashing it with the same (or a different) = shared secret. 
 
If we're going to have to have encryption for the ip = address, we might as well just encrypt the whole URI Signing Package (or = whatever it's called) and not bother with hashing. 
 
It also made me wonder whether following = logging would mean (according to the spec) the csp & ucdn doing the = pick random alternate bytes dance which makes me wonder whether we = should have that level of detail of how to generate a key/etc in the = logging draft (& presumably repeated in the uri signing draft) or = whether we should just say something along the lines of "pick a good = key" with a reference to general best practice for picking a good = key?
 
(I wasn't in the discussions but all this dancing to = protect privacy feels a bit like giving ourselves a ready brek glow[1] = that we're doing something but i suspect it'll largely be ignored in = reality given signed uris are prevalent in the wild without all this = privacy protection and i can't see what the incentive to csps is to = change to something more complicated)
 
Ben
 
[1] http://youtu.be/r06VyTzLLmE

= --Apple-Mail=_2BE00804-7F32-4646-9BB7-D891A835BFB1-- From nobody Wed Dec 9 09:29:01 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CE311A0338 for ; Wed, 9 Dec 2015 09:28:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t6V66K8rbQ1e for ; Wed, 9 Dec 2015 09:28:57 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.145]) by ietfa.amsl.com (Postfix) with ESMTP id 3269C1A0204 for ; Wed, 9 Dec 2015 09:28:57 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a6iXw-0001oz-6y; Wed, 09 Dec 2015 17:28:56 +0000 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: <87B3E8C2-A530-427E-8F22-39DB88A13DE0@niven-jenkins.co.uk> Date: Wed, 9 Dec 2015 17:28:55 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <39F63763-F4DA-4AD2-AA8B-ED7B5200CB89@tno.nl> <87B3E8C2-A530-427E-8F22-39DB88A13DE0@niven-jenkins.co.uk> To: "Brandenburg, R. (Ray) van" X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: "" Subject: Re: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 17:28:59 -0000 (I realised I=E2=80=99d only sent my response below to Ray & not the = entire WG). Ben > On 9 Dec 2015, at 17:11, Ben Niven-Jenkins = wrote: >=20 > Hi Ray, >=20 >> On 9 Dec 2015, at 16:26, Brandenburg, R. (Ray) van = wrote: >> On 09/12/15 15:51, "CDNi on behalf of Ben Niven-Jenkins" = wrote: >>> Assuming you don=E2=80=99t intend to have a new public/private key = generated for each signed token in the chain, something that occurred to = me is that the draft introduces a subtle change to the responsibilities = of the CDN / exposure of the CSP for asymmetric signatures. >>>=20 >>> Today a CSP generates a token and a CDN validates it. The = uri-signing-for-has draft allows the CDN to create a token for itself. = In the past the CDN could always have done that anyway with a shared key = but couldn=E2=80=99t with an asymmetric signature because the CDN never = had access to the private key. uri-sgning-for-has requires the CDN to = have the private key in order to created chained tokens. That might not = be a problem for CSPs but it=E2=80=99s probably worth calling out = somewhere in the draft that ui-signing-for-has required the CDN to have = the private key whereas ietf-signed-uris draft does not. >>=20 >> Hmm, good point. In practice, I assume the CDN would not use the = CSP's private key but use an internal one for subsequent tokens, but = you're right that we should call this out somewhere. In any case, I = expect the use of asymmetric keys for chained tokens would only be = beneficial in very specific circumstance anyway.=20 >=20 > If the CDN uses an internal key, what happens if a subsequent request = from the client goes to a different CDN? E.g. DNS based request routing = where the client does a DNS lookup per segment (which is how the iOS = client behaves AFAIK) and the results returned in DNS change (the uCDN = picks a different dCDN or the CSP is using a CDN selector for example). >=20 > Ben >=20 From nobody Wed Dec 9 10:06:59 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D35901A0372 for ; Wed, 9 Dec 2015 10:06:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dPspuu_sk9HR for ; Wed, 9 Dec 2015 10:06:54 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 596F11B2B41 for ; Wed, 9 Dec 2015 10:06:54 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-72-56686d492f9f Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 1E.75.06940.94D68665; Wed, 9 Dec 2015 19:04:57 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 13:06:52 -0500 From: Kevin Ma J To: Ben Niven-Jenkins Thread-Topic: [CDNi] Yokohama minutes & URI signing Thread-Index: AQHRMgS5UKG6O48HpEeATpl6OZhViZ7Cve9AgAB/hgD//7NOgA== Date: Wed, 9 Dec 2015 18:06:52 +0000 Message-ID: References: <638609BA-4196-41C8-8830-B03A423C3B3A@niven-jenkins.co.uk> In-Reply-To: <638609BA-4196-41C8-8830-B03A423C3B3A@niven-jenkins.co.uk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.11] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0CF95eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAIsWRmVeSWpSXmKPExsUyuXRPuK5nbkaYwfE/EhYLzk1gs3g6+w+r A5PHkiU/mTx+Xp/EGMAUxWWTkpqTWZZapG+XwJXxa+ICpoIzXxgr+uf9Ym1gnPKOsYuRk0NC wERiw5stLBC2mMSFe+vZuhi5OIQEjjBKnH91ghXCWcYocfvldnaQKjYBLYnHX/8ydTFycIgI 6Et0HCsGCTMLKEtsad4LNlRYwEiisfcmO0SJscSE62kgYREBJ4lzR46xgtgsAioS6y8sYQEp 4RXwlejflQqx6TijRMuFL2wgcU4Bd4n/lytAyhmBTvt+ag0TxCZxiVtP5jNBnCwgsWTPeWYI W1Ti5eN/rBC2ksTH3/PBLmAWyJeYMD8JJMwrIChxcuYTlgmMorOQTJqFUDULSRVEWFNi/S59 iGpFiSndD9khbA2J1jlz2ZHFFzCyr2LkKC0uyMlNNzLYxAiMp2MSbLo7GO9P9zzEKMDBqMTD +yEhPUyINbGsuDL3EKMEB7OSCG+Nb0aYEG9KYmVValF+fFFpTmrxIUZpDhYlcV5GBgYGIYH0 xJLU7NTUgtQimCwTB6dUA+MS+ale6cUH1z6VMgmW/bXW+cLDm4ej+Iur+0qOz/TL12F+93PP qxLHv5evf5sbuKY5/WHs1gNOi8KXeE6WlApzmvlxw84EkYU3OpbqfJA/euX1rC3Fmj8N09j+ KE/fsnWVauRF1qTCxLqdn96HrpnB8Hd54g3G5hUqrTkRxkWms9Pi7m+cuEZFiaU4I9FQi7mo OBEApe0p5aMCAAA= Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Yokohama minutes & URI signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 18:06:58 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0CF95eusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQo+IEhvbmVzdGx5IEkgZG9u4oCZdCBrbm93IHdoZXRoZXIgc2F2aW5nIHRoZSBl bmNyeXB0aW9uIGlzIGEgbWVhbmluZ2Z1bCBzYXZpbmcgb3Igbm90LiBNeSBndXQgc2F5cyBzdGlj a2luZyB0byBvbmUgc29sdXRpb24gZm9yIGV2ZXJ5dGhpbmcgaXMgYmV0dGVyIGp1c3QgYmVjYXVz ZSBpdCBsZWF2ZXMgZmV3ZXIgc3BlY2lhbCBjYXNlcyBmb3IgcGVvcGxlIHRvIGdldCB3cm9uZy4N Cg0KICBUaGlzIGlzIGEgZmFpciBwb2ludC4gIE1vc3QgZm9sa3MgaW1wbGVtZW50aW5nIHRoaXMg d2lsbCBwcm9iYWJseSBoYXZlIGFjY2VzcyB0byBhIGdvb2QgY3J5cHRvIGxpYnJhcnk/DQoNCj4g VGhlIG51bWJlciBvZiBpbXBsZW1lbnRlcnMgZm9yIHRoaXMgaXMgcG90ZW50aWFsbHkgbXVjaCBs YXJnZXIgdGhhbiB0aGUgb3RoZXIgQ0ROSSBzcGVjcyBiZWNhdXNlIHRoZSBDU1AgYWxzbyBoYXMg dG8gaW1wbGVtZW50IHRoZSBzaWduZWQgdXJpIHNwZWMgdG8gZ2VuZXJhdGUgdGhlIHRva2VucyBp biB0aGUgZmlyc3QgcGxhY2UuDQoNCiAgQWdyZWVkLiAgTVBFRyBsaWFpc29uIC0gY2FzZSBpbiBw b2ludC4NCg0KPiBNeSBjb25jZXJuIGlzIHdlIGVuZCB1cCB3aXRoIGxvdHMgb2YgZG9jdW1lbnRz IGVhY2ggc3BlY2lmeWluZyB0aGUgc2FtZSB0aGluZyAocG9zc2libHkgaW4gc2xpZ2h0bHkgZGlm ZmVyZW50IHdheXMgdW5sZXNzIHNvbWVvbmUga2VlcHMgYSBnb29kIGV5ZSB0byBtYWtlIHN1cmUg dGhleeKAmXJlIHBlcmZlY3RseSBhbGlnbmVkKSByYXRoZXIgdGhhbiBhIHJlZmVyZW5jZSBhYmxl IHNvdXJjZSB0aGF0IGFsbCB0aGUgZG9jdW1lbnRzIGNhbiByZWZlciB0by4NCg0KICBJdCdzIGEg dmFsaWQgY29uY2Vybi4gIEkgZG9uJ3Qga25vdyBpZiB0aGUgc2VjZGlyIHJldmlldyB3aWxsIGhl bHAgd2l0aCB0aGlzOyB1bmZvcnR1bmF0ZWx5IHRoZXNlIGNyeXB0by9wcml2YWN5IGlzc3VlcyBh cmUgYWxsIG1vdmluZyB0YXJnZXRzLiAgVGhlIHRocmVhdCBtb2RlbHMgZm9yIGxvZ2dpbmcgSVBz IGFuZCBsb2dnaW5nIFVSSXMgd2l0aCB0b2tlbnMgdGhhdCBjb250YWluIElQcyBhcmUgYXJndWFi bHkgZGlmZmVyZW50LCBidXQgSSBzdXBwb3NlIHRoZSBzYW1lIGVuY3J5cHRpb24gc2NoZW1lIGNv dWxkIGJlIHVzZWQgdG8gcHJvdGVjdCBib3RoLiAgSXMgdGhpcyBhbiBBRC1sZXZlbCBxdWVzdGlv biAoYmVjYXVzZSBwcm90ZWN0aW5nIElQIGFkZHJlc3NlcywgZnJvbSBhIHByaXZhY3kgcGVyc3Bl Y3RpdmUsIGRvZXMgZ28gYmV5b25kIENETkkpPw0KDQp0aGFueC4NCg0KLS0gIEtldmluIEouIE1h DQoNCkZyb206IEJlbiBOaXZlbi1KZW5raW5zIFttYWlsdG86YmVuQG5pdmVuLWplbmtpbnMuY28u dWtdDQpTZW50OiBXZWRuZXNkYXksIERlY2VtYmVyIDA5LCAyMDE1IDEyOjI3IFBNDQpUbzogS2V2 aW4gTWEgSg0KQ2M6IGNkbmlAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQ0ROaV0gWW9rb2hhbWEg bWludXRlcyAmIFVSSSBzaWduaW5nDQoNCkhpIEtldmluLA0KDQpPbiA5IERlYyAyMDE1LCBhdCAx NTowMCwgS2V2aW4gTWEgSiA8a2V2aW4uai5tYUBlcmljc3Nvbi5jb208bWFpbHRvOmtldmluLmou bWFAZXJpY3Nzb24uY29tPj4gd3JvdGU6DQoNCkhpIEJlbiwNCg0KICAoYXMgYW4gaW5kaXZpZHVh bCkNCg0KPiBUaGF0IHdvdWxkIG1lYW4gZW5jcnlwdGluZyB0aGUgaXAgYWRkcmVzcyB3aXRoIGEg c2hhcmVkIHNlY3JldCBhbmQgdGhlbiBoYXNoaW5nIGl0IHdpdGggdGhlIHNhbWUgKG9yIGEgZGlm ZmVyZW50KSBzaGFyZWQgc2VjcmV0Lg0KDQogIENvcnJlY3QuICBXZSBkaXNjdXNzZWQgdXNpbmcg dGhlIHNhbWUgc2hhcmVkIHNlY3JldCAob3IgcHJpdmF0ZSBrZXkpLg0KDQo+IHdlIG1pZ2h0IGFz IHdlbGwganVzdCBlbmNyeXB0IHRoZSB3aG9sZSBVUkkgU2lnbmluZyBQYWNrYWdlIChvciB3aGF0 ZXZlciBpdCdzIGNhbGxlZCkgYW5kIG5vdCBib3RoZXIgd2l0aCBoYXNoaW5nLg0KDQogIFRoZSB0 aGlua2luZyBoZXJlIHdhcyB0aGF0LCBmb3IgdGhvc2Ugd2hvIGRvIG5vdCBjYXJlIHRvIHVzZSB0 aGUgQ0lQIElFLCB0aGV5IHdvdWxkbid0IGhhdmUgdG8gYm90aGVyIHdpdGggZW5jcnlwdGlvbiBv ciBrZXkgbWFuYWdlbWVudC4NCg0KSSBoYWRu4oCZdCBjb25zaWRlcmVkIHRoYXQgc2NlbmFyaW8g d2hlbiBJIHdyb3RlIG15IG1haWwuIFRoZXknZCBzYXZlIGhhdmluZyB0byBkbyB0aGUgZW5jcnlw dGlvbi4gVGhleSB3b3VsZG7igJl0IGhhdmUgdG8gZG8gKHNlY3VyZSkga2V5IG1hbmFnZW1lbnQg YnV0IHRoZXnigJlkIHN0aWxsIGhhdmUgdG8gZG8gKHNlY3VyZSkgc2VjcmV0IG1hbmFnZW1lbnQg aWYgdGhleSB3ZXJlIHVzaW5nIGEgc2hhcmVkIHNlY3JldCBpbnN0ZWFkIG9mIGFzeW1tZXRyaWMg c2lnbmF0dXJlcy4NCg0KSG9uZXN0bHkgSSBkb27igJl0IGtub3cgd2hldGhlciBzYXZpbmcgdGhl IGVuY3J5cHRpb24gaXMgYSBtZWFuaW5nZnVsIHNhdmluZyBvciBub3QuIE15IGd1dCBzYXlzIHN0 aWNraW5nIHRvIG9uZSBzb2x1dGlvbiBmb3IgZXZlcnl0aGluZyBpcyBiZXR0ZXIganVzdCBiZWNh dXNlIGl0IGxlYXZlcyBmZXdlciBzcGVjaWFsIGNhc2VzIGZvciBwZW9wbGUgdG8gZ2V0IHdyb25n LiBUaGUgbnVtYmVyIG9mIGltcGxlbWVudGVycyBmb3IgdGhpcyBpcyBwb3RlbnRpYWxseSBtdWNo IGxhcmdlciB0aGFuIHRoZSBvdGhlciBDRE5JIHNwZWNzIGJlY2F1c2UgdGhlIENTUCBhbHNvIGhh cyB0byBpbXBsZW1lbnQgdGhlIHNpZ25lZCB1cmkgc3BlYyB0byBnZW5lcmF0ZSB0aGUgdG9rZW5z IGluIHRoZSBmaXJzdCBwbGFjZS4NCg0KPiB3aGV0aGVyIHdlIHNob3VsZCBqdXN0IHNheSBzb21l dGhpbmcgYWxvbmcgdGhlIGxpbmVzIG9mICJwaWNrIGEgZ29vZCBrZXkiIHdpdGggYSByZWZlcmVu Y2UgdG8gZ2VuZXJhbCBiZXN0IHByYWN0aWNlIGZvciBwaWNraW5nIGEgZ29vZCBrZXkNCg0KICBX ZSBwcm9iYWJseSBzaG91bGQuICBTb21ldGhpbmcgYWJvdXQgcmFuZG9tbmVzcyBhbmQgaG93IG9m dGVuIHRvIHJvdGF0ZSBrZXlzPw0KDQpJ4oCZbSBub3QgYSBzZWN1cml0eSBleHBlcnQgc28gSeKA mW0gbm90IHN1cmUuIFdob2V2ZXIgc3VnZ2VzdCB0aGUgY3VycmVudCB0ZXh0IGlzIHByb2JhYmx5 IHRoZSBleHBlcnQgdG8gYXNrLiBNeSBjb25jZXJuIGlzIHdlIGVuZCB1cCB3aXRoIGxvdHMgb2Yg ZG9jdW1lbnRzIGVhY2ggc3BlY2lmeWluZyB0aGUgc2FtZSB0aGluZyAocG9zc2libHkgaW4gc2xp Z2h0bHkgZGlmZmVyZW50IHdheXMgdW5sZXNzIHNvbWVvbmUga2VlcHMgYSBnb29kIGV5ZSB0byBt YWtlIHN1cmUgdGhleeKAmXJlIHBlcmZlY3RseSBhbGlnbmVkKSByYXRoZXIgdGhhbiBhIHJlZmVy ZW5jZSBhYmxlIHNvdXJjZSB0aGF0IGFsbCB0aGUgZG9jdW1lbnRzIGNhbiByZWZlciB0by4NCg0K W0l04oCZcyBwcm9iYWJseSBvZmYtdG9waWMgZm9yIHRoaXMgZ3JvdXAsIGJ1dCB3aGlsZSBJ4oCZ bSBzZW5zaXRpdmUgdG8gcHJpdmFjeSBjb25jZXJucyBpdCBmZWVscyBsaWtlIHdl4oCZcmUgYmVp bmcgaGl0IHdpdGggYSBoYW1tZXIgdG8gYWRkcmVzcyDigJxwcml2YWN54oCdIHdoaWxlIG9wZXJh dGluZyBpbiBhbiBlbnZpcm9ubWVudCB3aXRob3V0IGdvb2QgZ2VuZXJhbCBndWlkYW5jZSBiZWlu ZyBkb2N1bWVudGVkIChvciBhdCBsZWFzdCByZWZlcmVuY2VkIGlmIHRoZXkgZG8gZXhpc3QpIHNv IGV2ZXJ5b25lIChub3QganVzdCBpbiBDRE5JKSBpcyByZWludmVudGluZyB0aGUgd2hlZWwgZm9y IHRoZW1zZWx2ZXMuXQ0KDQoNCj4gYnV0IGkgc3VzcGVjdCBpdCdsbCBsYXJnZWx5IGJlIGlnbm9y ZWQgaW4gcmVhbGl0eSBnaXZlbiBzaWduZWQgdXJpcyBhcmUgcHJldmFsZW50IGluIHRoZSB3aWxk IHdpdGhvdXQgYWxsIHRoaXMgcHJpdmFjeSBwcm90ZWN0aW9uIGFuZCBpIGNhbid0IHNlZSB3aGF0 IHRoZSBpbmNlbnRpdmUgdG8gY3NwcyBpcyB0byBjaGFuZ2UgdG8gc29tZXRoaW5nIG1vcmUgY29t cGxpY2F0ZWQNCg0KICBJIGRvbid0IGRpc2FncmVlIHdpdGggdGhpcyBzdGF0ZW1lbnQsIGJ1dCBJ IHRoaW5rIHRoZSBnZW5lcmFsIHB1c2ggZm9yIHByaXZhY3kgd2l0aGluIElFVEYgcHJvdG9jb2xz IHdpbGwgcHJvYmFibHkgcmVxdWlyZSB1cyB0byBwdXQgc29tZXRoaW5nIGluIHRoZSBzcGVjLg0K DQpJ4oCZbSBzdXJlIGl0IHdpbGwuIEPigJllc3QgbGEgdmllLg0KDQpCZW4NCg0KDQoNCi0tICBL ZXZpbiBKLiBNYQ0KDQpGcm9tOiBDRE5pIFttYWlsdG86Y2RuaS1ib3VuY2VzQGlldGYub3JnXSBP biBCZWhhbGYgT2YgQmVuIE5pdmVuLUplbmtpbnMNClNlbnQ6IFR1ZXNkYXksIERlY2VtYmVyIDA4 LCAyMDE1IDU6MDYgUE0NClRvOiBjZG5pQGlldGYub3JnPG1haWx0bzpjZG5pQGlldGYub3JnPg0K U3ViamVjdDogW0NETmldIFlva29oYW1hIG1pbnV0ZXMgJiBVUkkgc2lnbmluZw0KDQpJIHNlZSBp biB0aGUgbWludXRlcyBmcm9tIHlva29oYW1hIGEgc3VnZ2VzdGlvbiB0byB1c2UgYSBzaW1pbGFy IGFub255bWlzaW5nIHRlY2huaXF1ZSBmb3IgdGhlIGlwIGFkZHJlc3MgaW4gYSBzaWduZWQgdXJp IGFzIHRoYXQgdXNlZCBmb3IgYy1ncm91cGlkIGluIHRoZSBsb2dnaW5nIGRyYWZ0Lg0KDQpUaGF0 IHdvdWxkIG1lYW4gZW5jcnlwdGluZyB0aGUgaXAgYWRkcmVzcyB3aXRoIGEgc2hhcmVkIHNlY3Jl dCBhbmQgdGhlbiBoYXNoaW5nIGl0IHdpdGggdGhlIHNhbWUgKG9yIGEgZGlmZmVyZW50KSBzaGFy ZWQgc2VjcmV0Lg0KDQpJZiB3ZSdyZSBnb2luZyB0byBoYXZlIHRvIGhhdmUgZW5jcnlwdGlvbiBm b3IgdGhlIGlwIGFkZHJlc3MsIHdlIG1pZ2h0IGFzIHdlbGwganVzdCBlbmNyeXB0IHRoZSB3aG9s ZSBVUkkgU2lnbmluZyBQYWNrYWdlIChvciB3aGF0ZXZlciBpdCdzIGNhbGxlZCkgYW5kIG5vdCBi b3RoZXIgd2l0aCBoYXNoaW5nLg0KDQpJdCBhbHNvIG1hZGUgbWUgd29uZGVyIHdoZXRoZXIgZm9s bG93aW5nIGxvZ2dpbmcgd291bGQgbWVhbiAoYWNjb3JkaW5nIHRvIHRoZSBzcGVjKSB0aGUgY3Nw ICYgdWNkbiBkb2luZyB0aGUgcGljayByYW5kb20gYWx0ZXJuYXRlIGJ5dGVzIGRhbmNlIHdoaWNo IG1ha2VzIG1lIHdvbmRlciB3aGV0aGVyIHdlIHNob3VsZCBoYXZlIHRoYXQgbGV2ZWwgb2YgZGV0 YWlsIG9mIGhvdyB0byBnZW5lcmF0ZSBhIGtleS9ldGMgaW4gdGhlIGxvZ2dpbmcgZHJhZnQgKCYg cHJlc3VtYWJseSByZXBlYXRlZCBpbiB0aGUgdXJpIHNpZ25pbmcgZHJhZnQpIG9yIHdoZXRoZXIg d2Ugc2hvdWxkIGp1c3Qgc2F5IHNvbWV0aGluZyBhbG9uZyB0aGUgbGluZXMgb2YgInBpY2sgYSBn b29kIGtleSIgd2l0aCBhIHJlZmVyZW5jZSB0byBnZW5lcmFsIGJlc3QgcHJhY3RpY2UgZm9yIHBp Y2tpbmcgYSBnb29kIGtleT8NCg0KKEkgd2Fzbid0IGluIHRoZSBkaXNjdXNzaW9ucyBidXQgYWxs IHRoaXMgZGFuY2luZyB0byBwcm90ZWN0IHByaXZhY3kgZmVlbHMgYSBiaXQgbGlrZSBnaXZpbmcg b3Vyc2VsdmVzIGEgcmVhZHkgYnJlayBnbG93WzFdIHRoYXQgd2UncmUgZG9pbmcgc29tZXRoaW5n IGJ1dCBpIHN1c3BlY3QgaXQnbGwgbGFyZ2VseSBiZSBpZ25vcmVkIGluIHJlYWxpdHkgZ2l2ZW4g c2lnbmVkIHVyaXMgYXJlIHByZXZhbGVudCBpbiB0aGUgd2lsZCB3aXRob3V0IGFsbCB0aGlzIHBy aXZhY3kgcHJvdGVjdGlvbiBhbmQgaSBjYW4ndCBzZWUgd2hhdCB0aGUgaW5jZW50aXZlIHRvIGNz cHMgaXMgdG8gY2hhbmdlIHRvIHNvbWV0aGluZyBtb3JlIGNvbXBsaWNhdGVkKQ0KDQpCZW4NCg0K WzFdIGh0dHA6Ly95b3V0dS5iZS9yMDZWeVR6TExtRQ0KDQo= --_000_A419F67F880AB2468214E154CB8A556206C0CF95eusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29BY2V0YXRlLCBsaS5Nc29BY2V0 YXRlLCBkaXYuTXNvQWNldGF0ZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxl LWxpbms6IkJhbGxvb24gVGV4dCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206 LjAwMDFwdDsNCglmb250LXNpemU6OC4wcHQ7DQoJZm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMt c2VyaWYiO30NCnNwYW4uYXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFw cGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkJhbGxvb25UZXh0Q2hhcg0KCXttc28tc3R5bGUt bmFtZToiQmFsbG9vbiBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IjsNCglmb250LWZhbWlseToiVGFob21hIiwic2Fucy1z ZXJpZiI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVw bHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+SGkgQmVuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpIb25lc3RseSBJIGRvbuKA mXQga25vdyB3aGV0aGVyIHNhdmluZyB0aGUgZW5jcnlwdGlvbiBpcyBhIG1lYW5pbmdmdWwgc2F2 aW5nIG9yIG5vdC4gTXkgZ3V0IHNheXMgc3RpY2tpbmcgdG8gb25lIHNvbHV0aW9uIGZvciBldmVy eXRoaW5nIGlzIGJldHRlciBqdXN0IGJlY2F1c2UgaXQgbGVhdmVzIGZld2VyIHNwZWNpYWwgY2Fz ZXMgZm9yIHBlb3BsZSB0byBnZXQgd3JvbmcuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7IFRoaXMgaXMgYSBm YWlyIHBvaW50LiZuYnNwOyBNb3N0IGZvbGtzIGltcGxlbWVudGluZyB0aGlzIHdpbGwgcHJvYmFi bHkgaGF2ZSBhY2Nlc3MgdG8gYSBnb29kIGNyeXB0byBsaWJyYXJ5PzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpU aGUgbnVtYmVyIG9mIGltcGxlbWVudGVycyBmb3IgdGhpcyBpcyBwb3RlbnRpYWxseSBtdWNoIGxh cmdlciB0aGFuIHRoZSBvdGhlciBDRE5JIHNwZWNzIGJlY2F1c2UgdGhlIENTUCBhbHNvIGhhcyB0 byBpbXBsZW1lbnQgdGhlIHNpZ25lZCB1cmkgc3BlYyB0byBnZW5lcmF0ZSB0aGUgdG9rZW5zIGlu IHRoZSBmaXJzdCBwbGFjZS48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgQWdyZWVkLiZuYnNwOyBNUEVHIGxp YWlzb24gLSBjYXNlIGluIHBvaW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpNeSBjb25jZXJuIGlzIHdlIGVu ZCB1cCB3aXRoIGxvdHMgb2YgZG9jdW1lbnRzIGVhY2ggc3BlY2lmeWluZyB0aGUgc2FtZSB0aGlu ZyAocG9zc2libHkgaW4gc2xpZ2h0bHkgZGlmZmVyZW50IHdheXMgdW5sZXNzIHNvbWVvbmUga2Vl cHMgYSBnb29kIGV5ZSB0byBtYWtlIHN1cmUgdGhleeKAmXJlIHBlcmZlY3RseSBhbGlnbmVkKSBy YXRoZXIgdGhhbiBhIHJlZmVyZW5jZSBhYmxlIHNvdXJjZSB0aGF0IGFsbCB0aGUgZG9jdW1lbnRz IGNhbiByZWZlciB0by48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgSXQncyBhIHZhbGlkIGNvbmNlcm4uJm5i c3A7IEkgZG9uJ3Qga25vdyBpZiB0aGUgc2VjZGlyIHJldmlldyB3aWxsIGhlbHAgd2l0aCB0aGlz OyB1bmZvcnR1bmF0ZWx5IHRoZXNlIGNyeXB0by9wcml2YWN5IGlzc3VlcyBhcmUgYWxsIG1vdmlu ZyB0YXJnZXRzLiZuYnNwOyBUaGUgdGhyZWF0IG1vZGVscyBmb3IgbG9nZ2luZyBJUHMNCiBhbmQg bG9nZ2luZyBVUklzIHdpdGggdG9rZW5zIHRoYXQgY29udGFpbiBJUHMgYXJlIGFyZ3VhYmx5IGRp ZmZlcmVudCwgYnV0IEkgc3VwcG9zZSB0aGUgc2FtZSBlbmNyeXB0aW9uIHNjaGVtZSBjb3VsZCBi ZSB1c2VkIHRvIHByb3RlY3QgYm90aC4mbmJzcDsgSXMgdGhpcyBhbiBBRC1sZXZlbCBxdWVzdGlv biAoYmVjYXVzZSBwcm90ZWN0aW5nIElQIGFkZHJlc3NlcywgZnJvbSBhIHByaXZhY3kgcGVyc3Bl Y3RpdmUsIGRvZXMgZ28gYmV5b25kIENETkkpPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+dGhhbnguPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tLSZuYnNwOyBLZXZpbiBKLiBN YTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDsiPiBCZW4gTml2ZW4tSmVua2lucyBbbWFpbHRvOmJlbkBuaXZlbi1qZW5raW5z LmNvLnVrXQ0KPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgRGVjZW1iZXIgMDksIDIwMTUg MTI6MjcgUE08YnI+DQo8Yj5Ubzo8L2I+IEtldmluIE1hIEo8YnI+DQo8Yj5DYzo8L2I+IGNkbmlA aWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtDRE5pXSBZb2tvaGFtYSBtaW51dGVz ICZhbXA7IFVSSSBzaWduaW5nPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SGkgS2V2aW4sPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gOSBEZWMgMjAxNSwgYXQgMTU6MDAsIEtldmluIE1hIEogJmx0OzxhIGhyZWY9 Im1haWx0bzprZXZpbi5qLm1hQGVyaWNzc29uLmNvbSI+a2V2aW4uai5tYUBlcmljc3Nvbi5jb208 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij5IaSBCZW4sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgKGFzIGFuIGluZGl2aWR1YWwpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mZ3Q7 PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj5U aGF0IHdvdWxkIG1lYW4gZW5jcnlwdGluZyB0aGUgaXAgYWRkcmVzcyB3aXRoIGEgc2hhcmVkIHNl Y3JldCBhbmQgdGhlbiBoYXNoaW5nIGl0IHdpdGggdGhlIHNhbWUgKG9yIGEgZGlmZmVyZW50KSBz aGFyZWQgc2VjcmV0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgQ29ycmVj dC4mbmJzcDsgV2UgZGlzY3Vzc2VkIHVzaW5nIHRoZSBzYW1lIHNoYXJlZCBzZWNyZXQgKG9yIHBy aXZhdGUga2V5KS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZndDs8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPndlIG1pZ2h0IGFz IHdlbGwganVzdCBlbmNyeXB0IHRoZSB3aG9sZSBVUkkgU2lnbmluZyBQYWNrYWdlIChvciB3aGF0 ZXZlciBpdCdzIGNhbGxlZCkgYW5kIG5vdCBib3RoZXIgd2l0aCBoYXNoaW5nLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgVGhlIHRoaW5raW5nIGhlcmUgd2FzIHRoYXQsIGZvciB0aG9z ZSB3aG8gZG8gbm90IGNhcmUgdG8gdXNlIHRoZSBDSVAgSUUsIHRoZXkgd291bGRuJ3QgaGF2ZSB0 byBib3RoZXIgd2l0aCBlbmNyeXB0aW9uIG9yIGtleSBtYW5hZ2VtZW50Ljwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JIGhhZG7igJl0IGNvbnNpZGVyZWQgdGhhdCBzY2VuYXJpbyB3aGVuIEkg d3JvdGUgbXkgbWFpbC4gVGhleSdkIHNhdmUgaGF2aW5nIHRvIGRvIHRoZSBlbmNyeXB0aW9uLiBU aGV5IHdvdWxkbuKAmXQgaGF2ZSB0byBkbyAoc2VjdXJlKSBrZXkgbWFuYWdlbWVudCBidXQgdGhl eeKAmWQgc3RpbGwgaGF2ZSB0byBkbyAoc2VjdXJlKSBzZWNyZXQgbWFuYWdlbWVudCBpZiB0aGV5 IHdlcmUgdXNpbmcgYSBzaGFyZWQgc2VjcmV0DQogaW5zdGVhZCBvZiBhc3ltbWV0cmljIHNpZ25h dHVyZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkhvbmVzdGx5IEkgZG9u4oCZdCBrbm93IHdoZXRoZXIgc2F2aW5nIHRoZSBlbmNyeXB0aW9u IGlzIGEgbWVhbmluZ2Z1bCBzYXZpbmcgb3Igbm90LiBNeSBndXQgc2F5cyBzdGlja2luZyB0byBv bmUgc29sdXRpb24gZm9yIGV2ZXJ5dGhpbmcgaXMgYmV0dGVyIGp1c3QgYmVjYXVzZSBpdCBsZWF2 ZXMgZmV3ZXIgc3BlY2lhbCBjYXNlcyBmb3IgcGVvcGxlIHRvIGdldCB3cm9uZy4gVGhlIG51bWJl ciBvZiBpbXBsZW1lbnRlcnMNCiBmb3IgdGhpcyBpcyBwb3RlbnRpYWxseSBtdWNoIGxhcmdlciB0 aGFuIHRoZSBvdGhlciBDRE5JIHNwZWNzIGJlY2F1c2UgdGhlIENTUCBhbHNvIGhhcyB0byBpbXBs ZW1lbnQgdGhlIHNpZ25lZCB1cmkgc3BlYyB0byBnZW5lcmF0ZSB0aGUgdG9rZW5zIGluIHRoZSBm aXJzdCBwbGFjZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mZ3Q7PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj53aGV0aGVyIHdlIHNob3Vs ZCBqdXN0IHNheSBzb21ldGhpbmcgYWxvbmcgdGhlIGxpbmVzIG9mICZxdW90O3BpY2sgYSBnb29k IGtleSZxdW90OyB3aXRoIGEgcmVmZXJlbmNlIHRvIGdlbmVyYWwgYmVzdCBwcmFjdGljZSBmb3Ig cGlja2luZw0KIGEgZ29vZCBrZXk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7IFdlIHBy b2JhYmx5IHNob3VsZC4mbmJzcDsgU29tZXRoaW5nIGFib3V0IHJhbmRvbW5lc3MgYW5kIGhvdyBv ZnRlbiB0byByb3RhdGUga2V5cz88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0gbm90IGEgc2VjdXJpdHkgZXhw ZXJ0IHNvIEnigJltIG5vdCBzdXJlLiBXaG9ldmVyIHN1Z2dlc3QgdGhlIGN1cnJlbnQgdGV4dCBp cyBwcm9iYWJseSB0aGUgZXhwZXJ0IHRvIGFzay4gTXkgY29uY2VybiBpcyB3ZSBlbmQgdXAgd2l0 aCBsb3RzIG9mIGRvY3VtZW50cyBlYWNoIHNwZWNpZnlpbmcgdGhlIHNhbWUgdGhpbmcgKHBvc3Np Ymx5IGluIHNsaWdodGx5IGRpZmZlcmVudCB3YXlzIHVubGVzcyBzb21lb25lDQoga2VlcHMgYSBn b29kIGV5ZSB0byBtYWtlIHN1cmUgdGhleeKAmXJlIHBlcmZlY3RseSBhbGlnbmVkKSByYXRoZXIg dGhhbiBhIHJlZmVyZW5jZSBhYmxlIHNvdXJjZSB0aGF0IGFsbCB0aGUgZG9jdW1lbnRzIGNhbiBy ZWZlciB0by48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+W0l04oCZcyBwcm9iYWJseSBvZmYtdG9waWMgZm9yIHRoaXMgZ3JvdXAsIGJ1dCB3aGls ZSBJ4oCZbSBzZW5zaXRpdmUgdG8gcHJpdmFjeSBjb25jZXJucyBpdCBmZWVscyBsaWtlIHdl4oCZ cmUgYmVpbmcgaGl0IHdpdGggYSBoYW1tZXIgdG8gYWRkcmVzcyDigJxwcml2YWN54oCdIHdoaWxl IG9wZXJhdGluZyBpbiBhbiBlbnZpcm9ubWVudCB3aXRob3V0IGdvb2QgZ2VuZXJhbCBndWlkYW5j ZSBiZWluZyBkb2N1bWVudGVkIChvciBhdA0KIGxlYXN0IHJlZmVyZW5jZWQgaWYgdGhleSBkbyBl eGlzdCkgc28gZXZlcnlvbmUgKG5vdCBqdXN0IGluIENETkkpIGlzIHJlaW52ZW50aW5nIHRoZSB3 aGVlbCBmb3IgdGhlbXNlbHZlcy5dPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxicj4NCjxicj4NCjxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mZ3Q7PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj5idXQg aSBzdXNwZWN0IGl0J2xsIGxhcmdlbHkgYmUgaWdub3JlZCBpbiByZWFsaXR5IGdpdmVuIHNpZ25l ZCB1cmlzIGFyZSBwcmV2YWxlbnQgaW4gdGhlIHdpbGQgd2l0aG91dCBhbGwgdGhpcyBwcml2YWN5 IHByb3RlY3Rpb24NCiBhbmQgaSBjYW4ndCBzZWUgd2hhdCB0aGUgaW5jZW50aXZlIHRvIGNzcHMg aXMgdG8gY2hhbmdlIHRvIHNvbWV0aGluZyBtb3JlIGNvbXBsaWNhdGVkPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyBJIGRvbid0IGRpc2FncmVlIHdpdGggdGhpcyBzdGF0ZW1lbnQsIGJ1 dCBJIHRoaW5rIHRoZSBnZW5lcmFsIHB1c2ggZm9yIHByaXZhY3kgd2l0aGluIElFVEYgcHJvdG9j b2xzIHdpbGwgcHJvYmFibHkgcmVxdWlyZSB1cyB0byBwdXQgc29tZXRoaW5nIGluIHRoZSBzcGVj Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J 4oCZbSBzdXJlIGl0IHdpbGwuIEPigJllc3QgbGEgdmllLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxicj4NCjxicj4NCjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+LS0mbmJzcDsgS2V2aW4gSi4gTWE8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4mbmJzcDs8 L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5DRE5pDQogWzxhIGhyZWY9 Im1haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5vcmciPm1haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5v cmc8L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48 Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PC9iPkJlbiBOaXZlbi1KZW5raW5zPGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlR1ZXNkYXksIERlY2VtYmVyIDA4 LCAyMDE1IDU6MDYgUE08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpjZG5pQGlldGYub3JnIj5jZG5p QGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5bQ0ROaV0gWW9rb2hhbWEgbWludXRlcyAmYW1wOyBV Ukkgc2lnbmluZzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgc2VlIGluIHRoZSBtaW51dGVzIGZyb20g eW9rb2hhbWEgYSBzdWdnZXN0aW9uIHRvIHVzZSBhIHNpbWlsYXIgYW5vbnltaXNpbmcgdGVjaG5p cXVlIGZvciB0aGUgaXAgYWRkcmVzcyBpbiBhIHNpZ25lZCB1cmkgYXMgdGhhdCB1c2VkIGZvciBj LWdyb3VwaWQgaW4gdGhlIGxvZ2dpbmcgZHJhZnQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGF0IHdvdWxkIG1lYW4gZW5jcnlwdGluZyB0aGUgaXAgYWRkcmVzcyB3aXRoIGEgc2hhcmVkIHNl Y3JldCBhbmQgdGhlbiBoYXNoaW5nIGl0IHdpdGggdGhlIHNhbWUgKG9yIGEgZGlmZmVyZW50KSBz aGFyZWQgc2VjcmV0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB3ZSdyZSBn b2luZyB0byBoYXZlIHRvIGhhdmUgZW5jcnlwdGlvbiBmb3IgdGhlIGlwIGFkZHJlc3MsIHdlIG1p Z2h0IGFzIHdlbGwganVzdCBlbmNyeXB0IHRoZSB3aG9sZSBVUkkgU2lnbmluZyBQYWNrYWdlIChv ciB3aGF0ZXZlciBpdCdzIGNhbGxlZCkgYW5kIG5vdCBib3RoZXIgd2l0aCBoYXNoaW5nLiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBhbHNvIG1hZGUgbWUgd29uZGVyIHdoZXRo ZXIgZm9sbG93aW5nIGxvZ2dpbmcgd291bGQgbWVhbiAoYWNjb3JkaW5nIHRvIHRoZSBzcGVjKSB0 aGUgY3NwICZhbXA7IHVjZG4gZG9pbmcgdGhlIHBpY2sgcmFuZG9tIGFsdGVybmF0ZSBieXRlcyBk YW5jZSB3aGljaCBtYWtlcyBtZSB3b25kZXIgd2hldGhlciB3ZSBzaG91bGQgaGF2ZSB0aGF0IGxl dmVsIG9mIGRldGFpbCBvZiBob3cgdG8gZ2VuZXJhdGUgYSBrZXkvZXRjDQogaW4gdGhlIGxvZ2dp bmcgZHJhZnQgKCZhbXA7IHByZXN1bWFibHkgcmVwZWF0ZWQgaW4gdGhlIHVyaSBzaWduaW5nIGRy YWZ0KSBvciB3aGV0aGVyIHdlIHNob3VsZCBqdXN0IHNheSBzb21ldGhpbmcgYWxvbmcgdGhlIGxp bmVzIG9mICZxdW90O3BpY2sgYSBnb29kIGtleSZxdW90OyB3aXRoIGEgcmVmZXJlbmNlIHRvIGdl bmVyYWwgYmVzdCBwcmFjdGljZSBmb3IgcGlja2luZyBhIGdvb2Qga2V5PzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4oSSB3YXNuJ3QgaW4gdGhlIGRpc2N1c3Npb25zIGJ1dCBhbGwgdGhpcyBk YW5jaW5nIHRvIHByb3RlY3QgcHJpdmFjeSBmZWVscyBhIGJpdCBsaWtlIGdpdmluZyBvdXJzZWx2 ZXMgYSByZWFkeSBicmVrIGdsb3dbMV0gdGhhdCB3ZSdyZSBkb2luZyBzb21ldGhpbmcgYnV0IGkg c3VzcGVjdCBpdCdsbCBsYXJnZWx5IGJlIGlnbm9yZWQgaW4gcmVhbGl0eSBnaXZlbiBzaWduZWQg dXJpcyBhcmUgcHJldmFsZW50IGluDQogdGhlIHdpbGQgd2l0aG91dCBhbGwgdGhpcyBwcml2YWN5 IHByb3RlY3Rpb24gYW5kIGkgY2FuJ3Qgc2VlIHdoYXQgdGhlIGluY2VudGl2ZSB0byBjc3BzIGlz IHRvIGNoYW5nZSB0byBzb21ldGhpbmcgbW9yZSBjb21wbGljYXRlZCk8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+QmVuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlsxXSZuYnNwOzxhIGhy ZWY9Imh0dHA6Ly95b3V0dS5iZS9yMDZWeVR6TExtRSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+aHR0cDovL3lvdXR1LmJlL3IwNlZ5VHpMTG1FPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_A419F67F880AB2468214E154CB8A556206C0CF95eusaamb103erics_-- From nobody Wed Dec 9 11:03:13 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A2CF1B2D36 for ; Wed, 9 Dec 2015 11:03:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ctLfJmPam-ui for ; Wed, 9 Dec 2015 11:03:08 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C4711AC3E7 for ; Wed, 9 Dec 2015 11:03:01 -0800 (PST) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.15.0.59/8.15.0.59) with SMTP id tB9J2s4J002981; Wed, 9 Dec 2015 14:02:56 -0500 Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 1yp6xthy48-14 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 09 Dec 2015 14:02:56 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.186]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0158.001; Wed, 9 Dec 2015 14:02:44 -0500 From: "Peterson, Jon" To: Kevin Ma J , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Sd6BAt8jKfVkKtIgZAGUcIrZ5tCBuAgAD6vYCAABV5AIAAj6oA///nZQCAAUd4gP//9hmAgAel+oCACDRggIAHlXwAgB6cjICAHU4xgA== Date: Wed, 9 Dec 2015 19:02:43 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.182] Content-Type: multipart/alternative; boundary="_000_D28DAF8A1753CFjonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-12-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1507310000 definitions=main-1512090313 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 19:03:11 -0000 --_000_D28DAF8A1753CFjonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider=92s content will be deli= vered by CDNs other than the CDN with which the Content Provider has a dire= ct business relationship. Therefore, while CDNI does not introduce any new = technical requirements on dCDNs when establishing TLS sessions, Content Pro= viders may be less willing to have their private key shared with dCDNs than= they are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_D28DAF8A1753CFjonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <74F29CD9D962AB409E60BCFFA4885817@neustar.biz> Content-Transfer-Encoding: quoted-printable

While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target needs to be able to successfully c= omplete the TLS handshake" but it still does not say why you would eve= n need to note that, which is what I've been asking for. I've tried to add = a second sentence to it below, and I also modified the rest of the paragraph a bit.

In all thr= ee of the above cases, either HTTP or HTTPS could be used to connect to the= Redirection Target. When HTTPS is used to connect to the uCDN, if the= uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User Agent, then the new target&= nbsp;domain name may not match the domain in the URL dereferenced to reach = the uCDN: without operational precautions, this can make a legitimate redir= ection look like a DNS-based attack to a User Agent and trigger false-negative security warnings. When DNS-based redirec= tion with HTTPS is used, this specification assumes that the RT will noneth= eless be able to successfully complete a TLS handshake with the User Agent;= operational mechanisms to distribute the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t.

Jon Peterson
Neustar, Inc.

From: CDNi <cdni-bounces@ietf.org> on behalf of Kevin Ma J = <kevin.j.ma@ericsson.com&= gt;
Date: Friday, November 20, 2015 at = 11:31 AM
To: "Francois Le Faucheur (fle= fauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <be= n@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" <cdni@i= etf.org>
Subject: Re: [CDNi] Jon's commet on= draft-ietf-cdni-redirection

Hi All,

 

  I thought I'd propose the alternate text (below), and see i= f it meets everyone's needs?

 

thanx!

 

--  Kevin J. Ma

 

The Redirection Interface defined in this document is intended to = support delegation of HTTP-based traffic, including TLS encrypted HTTPS tra= ffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTTP, HTTPS, or DNS.&n= bsp; In the case of an HTTPS request from the User Agent, the TLS session p= rovides authentication of the request router sending the response.  In= this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases of HTTP (witho= ut TLS) or DNS redirection, there is no inherent authentication of the requ= est router.  In these cases, forged responses could be inserted by an = attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the case of DNS re= direction, DNSSEC [ref] could be used to authenticate DNS responses, howeve= r, configuration of DNSSEC is outside the scope of this document.

 

In all three of the above cases, either HTTP or HTTPS could be use= d to connect to the Redirection Target.  If the Redirection Target URL= uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and perform encrypti= on of the TLS channel.  Mechanisms to distribute the required informat= ion and/or configuration, such as private keys, to surrogates and request r= outers in dCDNs are outside the scope of this document.

 

 

From: CDNi [mai= lto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi Ben,

 

Minor editorial suggestions:

 

The redirection interface defined in this document e= nables a uCDN to return to a User Agent a DNS response on behalf = of a dCDN. If DNSSEC is deployed, a User Agent can authenticate the DN= S responses it receives, enabling it to distinguish between genuine (redirection) responses and malicious (redirecti= on) responses . Without DNSSEC a User Agent is unable to detect a malicious= DNS redirect.  HTTPS redirection provides an additional layer of= authentication via TLS because in order for the TLS handshake to complete, the server to which the User Agent connects needs t= o authenticate itself to the User Agent.

 

Cheers

 

Francois

 

 

On 27 Oct 2015, at 22:14, Ben Niven-Jenkins <ben@niven-jenkins.co.uk> wrot= e:

 

Hi Jon,

 

Would the following text address your comments, feel= free to wordsmith it to your liking.

 

=3D=3D=3D

The redirection interface defined in this document e= nables a uCDN to return

a DNS response on behalf of a dCDN. If DNSSEC i= s deployed

User Agents can authenticate the DNS responses they = receive, enabling them to distinguish between genuine responses (redir= ections) and malicious responses (redirections). Without DNSSEC a User Agen= t is unable to detect a malicious DNS redirect.  HTTPS redirection provides an additional layer of authentication via= TLS because in order for the TLS handshake to complete, the server th= e User Agent connects to must authenticate itself to the User Agent.

=3D=3D=3D

 

Thanks

Ben

 

 

 

 



On 22 Oct 2015, at 08:56, Ben Niven-Jenkins <ben@niven-jenkins.co.uk> wrot= e:

 

The Redirection Interface defined in this document might b= e used to redirect a request where the User Agent will subsequently attempt= to establish a TLS session with the Redirection Target. In such a case, any surrogate or request router to whi= ch the User Agent is redirected needs to be able to successfully complete t= he TLS handshake and to perform encryption of the TLS channel.

 

The private key for the host in the RT is needed in order = to successfully establish a TLS session. The most widespread mechanism curr= ently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with thei= r CDN(s) of choice. In cases where the owner of the host is not willing to = share their private key, other mechanisms that allow the owner to not share= their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies that a Content Provider=92s con= tent will be delivered by CDNs other than the CDN with which the Content Pr= ovider has a direct business relationship. Therefore, while CDNI does not introduce any new technical requirements on= dCDNs when establishing TLS sessions, Content Providers may be less willin= g to have their private key shared with dCDNs than they are with their chos= en CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute the required information and/or c= onfiguration to surrogates and request routers in dCDNs to enable a dCDN to= successfully complete TLS handshakes and to perform encryption of the TLS channel for a particular host, such a= s private keys or the URI/IP address of a key server, are outside the scope= of this document.

 

 

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 

 --_000_D28DAF8A1753CFjonpetersonneustarbiz_-- From nobody Wed Dec 9 12:37:50 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 323651A1B88 for ; Wed, 9 Dec 2015 12:37:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JrggyWtJSecx for ; Wed, 9 Dec 2015 12:37:41 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFAED1A1B72 for ; Wed, 9 Dec 2015 12:37:40 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-34-5668909eb144 Received: from EUSAAHC004.ericsson.se (Unknown_Domain [147.117.188.84]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 59.8F.06940.E9098665; Wed, 9 Dec 2015 21:35:42 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC004.ericsson.se ([147.117.188.84]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 15:37:39 -0500 From: Kevin Ma J To: "Peterson, Jon" , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Snkq4vCB0pNUWs9BHaBcT/a55tfYGAgACFV4CAAIrmgIAAGj0AgABc0wCAANIKgIAAa4+AgAcwhICACDRggIAHlXwAgB5HeuCAHilkgP//v5FQ Date: Wed, 9 Dec 2015 20:37:38 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0D76Eeusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrJIsWRmVeSWpSXmKPExsUyuXRPiO68CRlhBht2KlksODeBzeLp7D+s Fv8WnGayONNg6cDiMeX3RlaPJUt+MnnsaHjO7PHz+iTGAJYoLpuU1JzMstQifbsErozvJ/ax FqyfzFTRtMymgfHRO8YuRk4OCQETiaYN51kgbDGJC/fWs3UxcnEICRxhlJh3+DgThLOMUaJ1 1wJmkCo2AS2Jx1//MoHYIgJTGSUe/a4HsZkFlCW2NO8FmyosYC/Re7mDDaLGQWLVtxWMIINE BJoYJda9fgK0joODRUBFYuKTKpAaXgFfiU1XFkItW8Em8f3yP7BBnALmEufX3ARbzAh03vdT a5gglolL3HoynwnibAGJJXvOM0PYohIvH/9jhbCVJCYtPccKUZ8vsejKbyaIZYISJ2c+YZnA KDoLyahZSMpmISmDiOtILNj9iQ3C1pZYtvA1M4x95sBjJmTxBYzsqxg5SosLcnLTjQw2MQIj 8JgEm+4OxvvTPQ8xCnAwKvHwfkhIDxNiTSwrrsw9xCjBwawkwhvamREmxJuSWFmVWpQfX1Sa k1p8iFGag0VJnJeRgYFBSCA9sSQ1OzW1ILUIJsvEwSnVwDjDUX5B/Wl1Ve7k4qCwxfw9WRFr jmy14WXyzn5U9vlu/kr793rHnAUyXV48ebc4Yz3//cNys6y0Orxt3/5kr/7s+vrV7c2LJ+7J Lf/+le3jVcl5lTFMFgKbj2zhU4/8qrRUfV1fXHiYc1yjzpn0h9XGnxZujb4yfUNA63GeSK9v dpNmH/12RlWJpTgj0VCLuag4EQDTwwesvAIAAA== Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 20:37:48 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0D76Eeusaamb103erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider's content will be delive= red by CDNs other than the CDN with which the Content Provider has a direct= business relationship. Therefore, while CDNI does not introduce any new te= chnical requirements on dCDNs when establishing TLS sessions, Content Provi= ders may be less willing to have their private key shared with dCDNs than t= hey are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_A419F67F880AB2468214E154CB8A556206C0D76Eeusaamb103erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jon,

 

  Thanks for the review and the updated text!  S= o, the concern that you are highlighting is that the UA, if it (falsely) de= tects a security warning, is going to need to be able to ignore the warning and keep going?  Is that correct?  If so, may= be we should make that even more explicit.  I'll admit I did not recog= nize that subtlety from the previous discussions.  I would also sugges= t that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling the UA to ig= nore the error, we should make that explicit, e.g.:

 

"

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative security war= nings generated by the legitimate redirection.

 

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson= , Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

While all of this is fine t= ext and sets the stage for what I argue needs to be said, it still doesn't = acknowledge that when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.<= /span>

 

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target. When HTTPS is u= sed to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User Agen= t, then the new target domain name may not match the domain in th= e URL dereferenced to reach the uCDN: without operational precautions, this= can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative security war= nings. When DNS-based redirection with HTTPS is used, this specification as= sumes that the RT will nonetheless be able to successfully complete a TLS h= andshake with the User Agent; operational mechanisms to distribute the required information and/or configuration, su= ch as private keys, to surrogates and request routers in dCDNs are outside = the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bounces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi All,

 =

  I thought I'd propose the alternate tex= t (below), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this docu= ment is intended to support delegation of HTTP-based traffic, including TLS= encrypted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTTP, HTTPS, or DNS.&n= bsp; In the case of an HTTPS request from the User Agent, the TLS session p= rovides authentication of the request router sending the response.  In= this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases of HTTP (witho= ut TLS) or DNS redirection, there is no inherent authentication of the requ= est router.  In these cases, forged responses could be inserted by an = attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the case of DNS re= direction, DNSSEC [ref] could be used to authenticate DNS responses, howeve= r, configuration of DNSSEC is outside the scope of this document.

 =

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target.  If the Re= direction Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and perform en= cryption of the TLS channel.  Mechanisms to distribute the required in= formation and/or configuration, such as private keys, to surrogates and req= uest routers in dCDNs are outside the scope of this document.

 =

 =

From: CDNi [mailto:cdni-= bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =




On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface d= efined in this document might be used to redirect a request where the User = Agent will subsequently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the hos= t in the RT is needed in order to successfully establish a TLS session. The= most widespread mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies = that a Content Provider’s content will be delivered by CDNs other tha= n the CDN with which the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute th= e required information and/or configuration to surrogates and request route= rs in dCDNs to enable a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particular h= ost, such as private keys or the URI/IP address of a key server, are outsid= e the scope of this document.=

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_A419F67F880AB2468214E154CB8A556206C0D76Eeusaamb103erics_-- From nobody Wed Dec 9 12:53:17 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40EFA1B2CE0 for ; Wed, 9 Dec 2015 12:53:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.266 X-Spam-Level: X-Spam-Status: No, score=-102.266 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7zyWsZpZhgoo for ; Wed, 9 Dec 2015 12:53:09 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4FEE1B2CD9 for ; Wed, 9 Dec 2015 12:53:09 -0800 (PST) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.15.0.59/8.15.0.59) with SMTP id tB9Kohxk004395; Wed, 9 Dec 2015 15:53:06 -0500 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 1yp6xtt5yv-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 09 Dec 2015 15:53:05 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.186]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0158.001; Wed, 9 Dec 2015 15:53:03 -0500 From: "Peterson, Jon" To: Kevin Ma J , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Sd6BAt8jKfVkKtIgZAGUcIrZ5tCBuAgAD6vYCAABV5AIAAj6oA///nZQCAAUd4gP//9hmAgAel+oCACDRggIAHlXwAgB6cjICAHU4xgIAAoKYA//9+LwA= Date: Wed, 9 Dec 2015 20:53:03 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.182] Content-Type: multipart/alternative; boundary="_000_D28DD3401754C7jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-12-09_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1507310000 definitions=main-1512090344 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 20:53:14 -0000 --_000_D28DD3401754C7jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable No, we shouldn't ever say that a UA should ignore a security warning. We are saying that this document assumes the UA will never have to ignore a= warning because, in any network with a uCDN using HTTPS that does DNS-base= d redirection, the dCDN will have gotten the keys or whatever beforehand. T= he fact that if we didn't assume that, we'd incur these problems, is what I= have been trying to get the text here to note. We've long had text that ta= lks about the workaround without ever saying what it is working around. We = shouldn't expect implementers to just know what they are expected work arou= nd, we need to tell them. That's what my text tried to do. So I would remove that proposed addition saying it is okay to ignore securi= ty warnings (the UA will have no way of knowing their legitimacy, that is i= ndeed the problem). The sentence you added to the very end about further me= chanisms is fine, though. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 12:37 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider=92s content will be deli= vered by CDNs other than the CDN with which the Content Provider has a dire= ct business relationship. Therefore, while CDNI does not introduce any new = technical requirements on dCDNs when establishing TLS sessions, Content Pro= viders may be less willing to have their private key shared with dCDNs than= they are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_D28DD3401754C7jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <4F2E21694FAF2C47A866159C8F99C12B@neustar.biz> Content-Transfer-Encoding: quoted-printable

No, we shouldn't ever say that a UA should ignore a security warning.&= nbsp;

We are saying that this document assumes the UA will never have to ign= ore a warning because, in any network with a uCDN using HTTPS that does DNS= -based redirection, the dCDN will have gotten the keys or whatever beforeha= nd. The fact that if we didn't assume that, we'd incur these problems, is what I have been trying to get the tex= t here to note. We've long had text that talks about the workaround without= ever saying what it is working around. We shouldn't expect implementers to= just know what they are expected work around, we need to tell them. That's what my text tried to do.

So I would remove that proposed addition saying it is okay to ignore s= ecurity warnings (the UA will have no way of knowing their legitimacy, that= is indeed the problem). The sentence you added to the very end about furth= er mechanisms is fine, though. 

Jon Peterson
Neustar, Inc.

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 a= t 12:37 PM
To: Jon Peterson <jon.peterson@neustar.biz>, "Franc= ois Le Faucheur (flefauch)" <= flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" <cdni@i= etf.org>
Subject: RE: [CDNi] Jon's commet on= draft-ietf-cdni-redirection

Hi Jon,

 

  Thanks for the review and the updated text!  So, the c= oncern that you are highlighting is that the UA, if it (falsely) detects a = security warning, is going to need to be able to ignore the warning and keep going?  Is that correct?  If so, = maybe we should make that even more explicit.  I'll admit I did not re= cognize that subtlety from the previous discussions.  I would also sug= gest that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling the UA t= o ignore the error, we should make that explicit, e.g.:

 

"

  In all three of the above cases, either HTTP = or HTTPS could be used to connect to the Redirection Target. When HTTPS is = used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the = User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative se= curity warnings. When DNS-based redirection with HTTPS is used, this specif= ication assumes that the RT will nonetheless be able to successfully comple= te a TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative secur= ity warnings generated by the legitimate redirection.

 

  Note: Operational mechanisms to distribute th= e required information and/or configuration, such as private keys, to surro= gates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

While all of this is fine text and sets the = stage for what I argue needs to be said, it still doesn't acknowledge that = when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.<= /span>

 

In all three of the above cases, either HTTP or HTTP= S could be used to connect to the Redirection Target. When HTTPS is used to=  connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; operational mechanisms to distribute the required information and/or confi= guration, such as private keys, to surrogates and request routers in dCDNs = are outside the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bou= nces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi All,

 =

  I thought I'd propose the alternate text (bel= ow), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this document i= s intended to support delegation of HTTP-based traffic, including TLS encry= pted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTT= P, HTTPS, or DNS.  In the case of an HTTPS request from the User Agent= , the TLS session provides authentication of the request router sending the= response.  In this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases o= f HTTP (without TLS) or DNS redirection, there is no inherent authenticatio= n of the request router.  In these cases, forged responses could be in= serted by an attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the c= ase of DNS redirection, DNSSEC [ref] could be used to authenticate DNS resp= onses, however, configuration of DNSSEC is outside the scope of this docume= nt.

 =

In all three of the above cases, either HTTP or HTTP= S could be used to connect to the Redirection Target.  If the Redirect= ion Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and per= form encryption of the TLS channel.  Mechanisms to distribute the requ= ired information and/or configuration, such as private keys, to surrogates = and request routers in dCDNs are outside the scope of this document.<= /span>

 =

 =

From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =




On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface defined in this do= cument might be used to redirect a request where the User Agent will subseq= uently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the host in the RT is ne= eded in order to successfully establish a TLS session. The most widespread = mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies that a Content Pr= ovider=92s content will be delivered by CDNs other than the CDN with which = the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute the required inform= ation and/or configuration to surrogates and request routers in dCDNs to en= able a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particul= ar host, such as private keys or the URI/IP address of a key server, are ou= tside the scope of this document.

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_D28DD3401754C7jonpetersonneustarbiz_-- From nobody Wed Dec 9 13:29:21 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 145A61B2DDE for ; Wed, 9 Dec 2015 13:29:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FJ1PlJPYeLby for ; Wed, 9 Dec 2015 13:29:10 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87BFA1B2DA2 for ; Wed, 9 Dec 2015 13:29:10 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-27-56689d20b642 Received: from EUSAAHC008.ericsson.se (Unknown_Domain [147.117.188.96]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id FD.BB.32102.02D98665; Wed, 9 Dec 2015 22:29:04 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC008.ericsson.se ([147.117.188.96]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 16:29:06 -0500 From: Kevin Ma J To: "Peterson, Jon" , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Snkq4vCB0pNUWs9BHaBcT/a55tfYGAgACFV4CAAIrmgIAAGj0AgABc0wCAANIKgIAAa4+AgAcwhICACDRggIAHlXwAgB5HeuCAHilkgP//v5FQgABfQ4D//7Ey8A== Date: Wed, 9 Dec 2015 21:29:05 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0D9C6eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrNIsWRmVeSWpSXmKPExsUyuXRPgq7C3Iwwg+6nhhYLzk1gs3g6+w+r xb8Fp5kszjRYOrB4TPm9kdVjyZKfTB47Gp4ze/y8PokxgCWKyyYlNSezLLVI3y6BK+PRtF+M Be8/MVVMOTmZsYHx5iGmLkZODgkBE4mGKTsZIWwxiQv31rN1MXJxCAkcYZT4+HkjM4SzjFFi z9TrzCBVbAJaEo+//gXrFhGYyijx6Hc9iM0soCyxpXkv2CRhAXuJ3ssdbBA1DhKrvq1gBBkk IjCJUeLvp9dgg1gEVCQ6Zl8Aa+AV8JXo6v8FtW0mu8TDCavBNnAKmEvsvv6MBcRmBLrv+6k1 TBDbxCVuPZkP9YOAxJI955khbFGJl4//sULYShKTlp5jhajPl2jeepcdYpmgxMmZT1gmMIrO QjJqFpKyWUjKIOI6Egt2f2KDsLUlli18zQxjnznwmAlZfAEj+ypGjtLigpzcdCPDTYzAKDwm wea4g3Fvr+chRgEORiUe3g8J6WFCrIllxZW5hxglOJiVRHhDOzPChHhTEiurUovy44tKc1KL DzFKc7AoifMyMjAwCAmkJ5akZqemFqQWwWSZODilGhjjcvfmcMe7XrYJTiue1mvAV3yzn+/s 9MWF575JSkXEn7zv2DzXovGhwG7Z/Y9yfz6Ys+pvubzQv/rVF7aJC2ybwPJLb9u8GlbRj0Ja 3pqJeYe0jf/vCXvry5q5aMLRnZ+fVekLyk8QefV5+aMAvmcH3QvK5ieorb+dfXv1XOaTXnfe vb3F/D1JiaU4I9FQi7moOBEAUmDHwb4CAAA= Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 21:29:20 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0D9C6eusaamb103erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jon, Got it. No ignoring in the UA (the "nonetheless" threw me off); and this= RI only supports situations where there are no warnings and no need to ign= ore anything?. " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll be able to successfully complete a TLS handshake with the User Agent; th= e interface described in this document does not cover situations where the = User Agent receiving a false-negative security warning would causes legitim= ate redirection to fail. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection is also outside the scope of this docu= ment. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 3:53 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection No, we shouldn't ever say that a UA should ignore a security warning. We are saying that this document assumes the UA will never have to ignore a= warning because, in any network with a uCDN using HTTPS that does DNS-base= d redirection, the dCDN will have gotten the keys or whatever beforehand. T= he fact that if we didn't assume that, we'd incur these problems, is what I= have been trying to get the text here to note. We've long had text that ta= lks about the workaround without ever saying what it is working around. We = shouldn't expect implementers to just know what they are expected work arou= nd, we need to tell them. That's what my text tried to do. So I would remove that proposed addition saying it is okay to ignore securi= ty warnings (the UA will have no way of knowing their legitimacy, that is i= ndeed the problem). The sentence you added to the very end about further me= chanisms is fine, though. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 12:37 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider's content will be delive= red by CDNs other than the CDN with which the Content Provider has a direct= business relationship. Therefore, while CDNI does not introduce any new te= chnical requirements on dCDNs when establishing TLS sessions, Content Provi= ders may be less willing to have their private key shared with dCDNs than t= hey are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_A419F67F880AB2468214E154CB8A556206C0D9C6eusaamb103erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jon,

 

  Got it.  No ignoring in the UA (the "none= theless" threw me off); and this RI only supports situations where the= re are no warnings and no need to ignore anything?.

 

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will be able to successfully complete a TLS handshak= e with the User Agent; the interface described in this document does not cover situations where the User Agent = receiving a false-negative security warning would causes legitimate redirec= tion to fail.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection is also outside the scope of this document.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson= , Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 3:53 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

No, we shouldn't ever say t= hat a UA should ignore a security warning. 

 

We are saying that this doc= ument assumes the UA will never have to ignore a warning because, in any ne= twork with a uCDN using HTTPS that does DNS-based redirection, the dCDN will have gotten the keys or whatever beforehand. The fact that i= f we didn't assume that, we'd incur these problems, is what I have been try= ing to get the text here to note. We've long had text that talks about the = workaround without ever saying what it is working around. We shouldn't expect implementers to just know what t= hey are expected work around, we need to tell them. That's what my text tri= ed to do.

 

So I would remove that prop= osed addition saying it is okay to ignore security warnings (the UA will ha= ve no way of knowing their legitimacy, that is indeed the problem). The sentence you added to the very end about further mechanisms = is fine, though. 

 

Jon Peterson

Neustar, Inc.

 

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 at 12:37 PM
To: Jon Peterson <jon= .peterson@neustar.biz>, "Francois Le Faucheur (flefauch)" = <flefauch@cisco.com>, Niven= -Jenkins Ben <ben@niven-jenki= ns.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi Jon,

 =

  Thanks for the review and the updated t= ext!  So, the concern that you are highlighting is that the UA, if it = (falsely) detects a security warning, is going to need to be able to ignore the warning and keep going?  Is that correct? = If so, maybe we should make that even more explicit.  I'll admit I di= d not recognize that subtlety from the previous discussions.  I would = also suggest that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling t= he UA to ignore the error, we should make that explicit, e.g.:

 =

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative security war= nings generated by the legitimate redirection.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 =

thanx!=

 =

--  Kevin J. Ma

 =

From: Peterson, Jon [= mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

 

While all of this is fine t= ext and sets the stage for what I argue needs to be said, it still doesn't = acknowledge that when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.

 

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target. When HTTPS is u= sed to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User Agen= t, then the new target domain name may not match the domain in th= e URL dereferenced to reach the uCDN: without operational precautions, this= can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative security war= nings. When DNS-based redirection with HTTPS is used, this specification as= sumes that the RT will nonetheless be able to successfully complete a TLS h= andshake with the User Agent; operational mechanisms to distribute the required information and/or configuration, su= ch as private keys, to surrogates and request routers in dCDNs are outside = the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bounces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

Hi All,

 =

  I thought I'd propose the alternate tex= t (below), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this docu= ment is intended to support delegation of HTTP-based traffic, including TLS= encrypted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTTP, HTTPS, or DNS.&n= bsp; In the case of an HTTPS request from the User Agent, the TLS session p= rovides authentication of the request router sending the response.  In= this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases of HTTP (witho= ut TLS) or DNS redirection, there is no inherent authentication of the requ= est router.  In these cases, forged responses could be inserted by an = attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the case of DNS re= direction, DNSSEC [ref] could be used to authenticate DNS responses, howeve= r, configuration of DNSSEC is outside the scope of this document.

 =

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target.  If the Re= direction Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and perform en= cryption of the TLS channel.  Mechanisms to distribute the required in= formation and/or configuration, such as private keys, to surrogates and req= uest routers in dCDNs are outside the scope of this document.

 =

 =

From: CDNi [mailto:cdni-= bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =





On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface d= efined in this document might be used to redirect a request where the User = Agent will subsequently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the hos= t in the RT is needed in order to successfully establish a TLS session. The= most widespread mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies = that a Content Provider’s content will be delivered by CDNs other tha= n the CDN with which the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute th= e required information and/or configuration to surrogates and request route= rs in dCDNs to enable a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particular h= ost, such as private keys or the URI/IP address of a key server, are outsid= e the scope of this document.=

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_A419F67F880AB2468214E154CB8A556206C0D9C6eusaamb103erics_-- From nobody Wed Dec 9 13:38:46 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0562D1B2E01 for ; Wed, 9 Dec 2015 13:38:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKpqQUpVSWlR for ; Wed, 9 Dec 2015 13:38:40 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F1801B2DFD for ; Wed, 9 Dec 2015 13:38:40 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-aa-56689ee99617 Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 96.23.06940.9EE98665; Wed, 9 Dec 2015 22:36:41 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 16:38:38 -0500 From: Kevin Ma J To: "Peterson, Jon" , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Snkq4vCB0pNUWs9BHaBcT/a55tfYGAgACFV4CAAIrmgIAAGj0AgABc0wCAANIKgIAAa4+AgAcwhICACDRggIAHlXwAgB5HeuCAHilkgP//v5FQgABfQ4D//7Ey8IAAB7nT Date: Wed, 9 Dec 2015 21:38:38 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_F84FB2192F2A427689CB36DA36BC2B9Bericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHIsWRmVeSWpSXmKPExsUyuXRPuO7LeRlhBs9O6lksODeBzeLp7D+s Fv8WnGayONNg6cDiMeX3RlaPJUt+MnnsaHjO7PHz+iTGAJYoLpuU1JzMstQifbsErow/v64z Frz5zlRx7cgDtgbGo8eYuhg5OSQETCRu9j9jh7DFJC7cW8/WxcjFISRwhFHi5eFJ7BDOMkaJ R3d+MYNUsQloSTz++hesW0RgKlDidz2IzSygLLGleS8jiC0sYC8x/9hcNogaB4lV31YwggwS EZjGKLH62wqwBIuAisTXQ/vBBvECNUw4cIAJYtttdompC7+ydDFycHAK+Ekc+l0IUsMIdN73 U2uYIJaJS9x6Mh/qBQGJJXvOM0PYohIvH/9jhahJlpg6ZSIzxHxBiZMzn7BMYBSZhaR9FpKy WUjKIOIGEu/PzWeGsLUlli18DWXrS2z8cpYRWXwBI/sqRo7S4oKc3HQjg02MwFg7JsGmu4Px /nTPQ4wCHIxKPLwfEtLDhFgTy4orcw8xSnAwK4nwhnZmhAnxpiRWVqUW5ccXleakFh9ilOZg URLnZWRgYBASSE8sSc1OTS1ILYLJMnFwSjUwWpxa8Uc8uMTA5+SrazqfomfvELCde+iEIRPD o9s+QQer7pv4FwUbzE9tTZqidcPrHEcp/2mnNkOhRzV+257/C5l7mKHawLJJPvnQ1kWOLx8f KC5fdL23iGNT41b/mfGt11s3P7GWONnt+zci9kBHzVrelnsCwe2bdnh1yXptCJFSbd6ypNlY iaU4I9FQi7moOBEAfVd0sLECAAA= Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 21:38:46 -0000 --_000_F84FB2192F2A427689CB36DA36BC2B9Bericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I guess, is the problem that the UA can't tell, or that the redirect fails?= Probably both? The text I suggested below is more about the latter, thou= gh it could certainly be tweeked to also address the former? Sent from my iPhone On Dec 9, 2015, at 4:30 PM, Kevin Ma J > wrote: Hi Jon, Got it. No ignoring in the UA (the "nonetheless" threw me off); and this= RI only supports situations where there are no warnings and no need to ign= ore anything?. " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll be able to successfully complete a TLS handshake with the User Agent; th= e interface described in this document does not cover situations where the = User Agent receiving a false-negative security warning would causes legitim= ate redirection to fail. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection is also outside the scope of this docu= ment. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 3:53 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection No, we shouldn't ever say that a UA should ignore a security warning. We are saying that this document assumes the UA will never have to ignore a= warning because, in any network with a uCDN using HTTPS that does DNS-base= d redirection, the dCDN will have gotten the keys or whatever beforehand. T= he fact that if we didn't assume that, we'd incur these problems, is what I= have been trying to get the text here to note. We've long had text that ta= lks about the workaround without ever saying what it is working around. We = shouldn't expect implementers to just know what they are expected work arou= nd, we need to tell them. That's what my text tried to do. So I would remove that proposed addition saying it is okay to ignore securi= ty warnings (the UA will have no way of knowing their legitimacy, that is i= ndeed the problem). The sentence you added to the very end about further me= chanisms is fine, though. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 12:37 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider=92s content will be deli= vered by CDNs other than the CDN with which the Content Provider has a dire= ct business relationship. Therefore, while CDNI does not introduce any new = technical requirements on dCDNs when establishing TLS sessions, Content Pro= viders may be less willing to have their private key shared with dCDNs than= they are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_F84FB2192F2A427689CB36DA36BC2B9Bericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
I guess, is the problem that the UA can't tell, or that the redirect f= ails?  Probably both?  The text I suggested below is more about t= he latter, though it could certainly be tweeked to also address the former?=

Sent from my iPhone

On Dec 9, 2015, at 4:30 PM, Kevin Ma J <kevin.j.ma@ericsson.com> wrote:

Hi Jon,

 

  Got it.  No ignoring in the UA (the "none= theless" threw me off); and this RI only supports situations where the= re are no warnings and no need to ignore anything?.

 

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will be able to successfully complete a TLS handshak= e with the User Agent; the interface described in this document does not cover situations where the User Agent = receiving a false-negative security warning would causes legitimate redirec= tion to fail.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection is also outside the scope of this document.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson= , Jon [mailto:jon.peterson@neus= tar.biz]
Sent: Wednesday, December 09, 2015 3:53 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

No, we shouldn't ever say t= hat a UA should ignore a security warning. 

 

We are saying that this doc= ument assumes the UA will never have to ignore a warning because, in any ne= twork with a uCDN using HTTPS that does DNS-based redirection, the dCDN will have gotten the keys or whatever beforehand. The fact that i= f we didn't assume that, we'd incur these problems, is what I have been try= ing to get the text here to note. We've long had text that talks about the = workaround without ever saying what it is working around. We shouldn't expect implementers to just know what t= hey are expected work around, we need to tell them. That's what my text tri= ed to do.

 

So I would remove that prop= osed addition saying it is okay to ignore security warnings (the UA will ha= ve no way of knowing their legitimacy, that is indeed the problem). The sentence you added to the very end about further mechanisms = is fine, though. 

 

Jon Peterson

Neustar, Inc.

 

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 at 12:37 PM
To: Jon Peterson <jon= .peterson@neustar.biz>, "Francois Le Faucheur (flefauch)" = <flefauch@cisco.com>, Niven= -Jenkins Ben <ben@niven-jenki= ns.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi Jon,

 =

  Thanks for the review and the updated t= ext!  So, the concern that you are highlighting is that the UA, if it = (falsely) detects a security warning, is going to need to be able to ignore the warning and keep going?  Is that correct? = If so, maybe we should make that even more explicit.  I'll admit I di= d not recognize that subtlety from the previous discussions.  I would = also suggest that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling t= he UA to ignore the error, we should make that explicit, e.g.:

 =

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative security war= nings generated by the legitimate redirection.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 =

thanx!=

 =

--  Kevin J. Ma

 =

From: Peterson, Jon [= mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

 

While all of this is fine t= ext and sets the stage for what I argue needs to be said, it still doesn't = acknowledge that when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.

 

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target. When HTTPS is u= sed to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User Agen= t, then the new target domain name may not match the domain in th= e URL dereferenced to reach the uCDN: without operational precautions, this= can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative security war= nings. When DNS-based redirection with HTTPS is used, this specification as= sumes that the RT will nonetheless be able to successfully complete a TLS h= andshake with the User Agent; operational mechanisms to distribute the required information and/or configuration, su= ch as private keys, to surrogates and request routers in dCDNs are outside = the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bounces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

Hi All,

 =

  I thought I'd propose the alternate tex= t (below), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this docu= ment is intended to support delegation of HTTP-based traffic, including TLS= encrypted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTTP, HTTPS, or DNS.&n= bsp; In the case of an HTTPS request from the User Agent, the TLS session p= rovides authentication of the request router sending the response.  In= this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases of HTTP (witho= ut TLS) or DNS redirection, there is no inherent authentication of the requ= est router.  In these cases, forged responses could be inserted by an = attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the case of DNS re= direction, DNSSEC [ref] could be used to authenticate DNS responses, howeve= r, configuration of DNSSEC is outside the scope of this document.

 =

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target.  If the Re= direction Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and perform en= cryption of the TLS channel.  Mechanisms to distribute the required in= formation and/or configuration, such as private keys, to surrogates and req= uest routers in dCDNs are outside the scope of this document.

 =

 =

From: CDNi [mailto:cdni-= bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =





On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface d= efined in this document might be used to redirect a request where the User = Agent will subsequently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the hos= t in the RT is needed in order to successfully establish a TLS session. The= most widespread mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies = that a Content Provider=92s content will be delivered by CDNs other than th= e CDN with which the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute th= e required information and/or configuration to surrogates and request route= rs in dCDNs to enable a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particular h= ost, such as private keys or the URI/IP address of a key server, are outsid= e the scope of this document.=

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_F84FB2192F2A427689CB36DA36BC2B9Bericssoncom_-- From nobody Wed Dec 9 14:00:08 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D9F11B2E6F for ; Wed, 9 Dec 2015 14:00:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.266 X-Spam-Level: X-Spam-Status: No, score=-102.266 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dt5ILFJudasR for ; Wed, 9 Dec 2015 14:00:00 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94BE31B2E6C for ; Wed, 9 Dec 2015 14:00:00 -0800 (PST) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.15.0.59/8.15.0.59) with SMTP id tB9LxCBo019176; Wed, 9 Dec 2015 16:59:52 -0500 Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 1yp6y02brx-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 09 Dec 2015 16:59:52 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.186]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0158.001; Wed, 9 Dec 2015 16:59:51 -0500 From: "Peterson, Jon" To: Kevin Ma J , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Sd6BAt8jKfVkKtIgZAGUcIrZ5tCBuAgAD6vYCAABV5AIAAj6oA///nZQCAAUd4gP//9hmAgAel+oCACDRggIAHlXwAgB6cjICAHU4xgIAAoKYA//9+LwAAEgY7gAAAVWMA//9/zQA= Date: Wed, 9 Dec 2015 21:59:50 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.182] Content-Type: multipart/alternative; boundary="_000_D28DE2861754D9jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-12-09_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1507310000 definitions=main-1512090364 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 22:00:06 -0000 --_000_D28DE2861754D9jonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable The problem is indeed that if our assumption fails, the UA will not be able= to tell that the warning is a false negative, and thus redirection will sh= ow up as an attack and may not succeed (though we all know users love to cl= ick through warning dialogs, ideally we shouldn't give them the opportunity= ). I think the sentence you added this time is true - this document does no= t cover a case where a UA receives a false negative security warning when o= ur assumption does fail - though I think that is already basically said abo= ve. I also might say "this document" rather than "the interface described i= n this document." Looking at this, I would really rather have the "operational mechanisms" no= te be attached to where I originally put it; if it's in a separate paragrap= h, then it needs more context to explain that we mean the operational mecha= nisms needed to prevent the assumption from failing as described in the pre= vious paragraph. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 1:38 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection I guess, is the problem that the UA can't tell, or that the redirect fails?= Probably both? The text I suggested below is more about the latter, thou= gh it could certainly be tweeked to also address the former? Sent from my iPhone On Dec 9, 2015, at 4:30 PM, Kevin Ma J > wrote: Hi Jon, Got it. No ignoring in the UA (the "nonetheless" threw me off); and this= RI only supports situations where there are no warnings and no need to ign= ore anything?. " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll be able to successfully complete a TLS handshake with the User Agent; th= e interface described in this document does not cover situations where the = User Agent receiving a false-negative security warning would causes legitim= ate redirection to fail. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection is also outside the scope of this docu= ment. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 3:53 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection No, we shouldn't ever say that a UA should ignore a security warning. We are saying that this document assumes the UA will never have to ignore a= warning because, in any network with a uCDN using HTTPS that does DNS-base= d redirection, the dCDN will have gotten the keys or whatever beforehand. T= he fact that if we didn't assume that, we'd incur these problems, is what I= have been trying to get the text here to note. We've long had text that ta= lks about the workaround without ever saying what it is working around. We = shouldn't expect implementers to just know what they are expected work arou= nd, we need to tell them. That's what my text tried to do. So I would remove that proposed addition saying it is okay to ignore securi= ty warnings (the UA will have no way of knowing their legitimacy, that is i= ndeed the problem). The sentence you added to the very end about further me= chanisms is fine, though. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 12:37 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider=92s content will be deli= vered by CDNs other than the CDN with which the Content Provider has a dire= ct business relationship. Therefore, while CDNI does not introduce any new = technical requirements on dCDNs when establishing TLS sessions, Content Pro= viders may be less willing to have their private key shared with dCDNs than= they are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_D28DE2861754D9jonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable

The problem is indeed that if our assumption fails, the UA will not be= able to tell that the warning is a false negative, and thus redirection wi= ll show up as an attack and may not succeed (though we all know users love = to click through warning dialogs, ideally we shouldn't give them the opportunity). I think the sentence you = added this time is true - this document does not cover a case where a UA re= ceives a false negative security warning when our assumption does fail - th= ough I think that is already basically said above. I also might say "this document" rather than "t= he interface described in this document."

Looking at this, I would really rather have the "operational mech= anisms" note be attached to where I originally put it; if it's in a se= parate paragraph, then it needs more context to explain that we mean the op= erational mechanisms needed to prevent the assumption from failing as described in the previous paragraph.

Jon Peterson
Neustar, Inc.

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 a= t 1:38 PM
To: Jon Peterson <jon.peterson@neustar.biz>, "Franc= ois Le Faucheur (flefauch)" <= flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" <cdni@i= etf.org>
Subject: Re: [CDNi] Jon's commet on= draft-ietf-cdni-redirection

I guess, is the problem that the UA can't tell, or that the redirect f= ails?  Probably both?  The text I suggested below is more about t= he latter, though it could certainly be tweeked to also address the former?=

Sent from my iPhone

On Dec 9, 2015, at 4:30 PM, Kevin Ma J <kevin.j.ma@ericsson.com> wrote:

Hi Jon,

 

  Got it.  No ignoring in the UA (the "nonetheless&= quot; threw me off); and this RI only supports situations where there are n= o warnings and no need to ignore anything?.

 

"=

  In all three of the above cases, either HTTP = or HTTPS could be used to connect to the Redirection Target. When HTTPS is = used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the = User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative se= curity warnings. When DNS-based redirection with HTTPS is used, this specif= ication assumes that the RT will be able to successfully complete a TLS han= dshake with the User Agent; the interface described in this document does not cover situations where the U= ser Agent receiving a false-negative security warning would causes legitima= te redirection to fail.

 =

  Note: Operational mechanisms to distribute th= e required information and/or configuration, such as private keys, to surro= gates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection is also outside the scope of this document.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 3:53 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

No, we shouldn't ever say that a UA should i= gnore a security warning. 

 

We are saying that this document assumes the= UA will never have to ignore a warning because, in any network with a uCDN= using HTTPS that does DNS-based redirection, the dCDN will have gotten the keys or whatever beforehand. The fact that i= f we didn't assume that, we'd incur these problems, is what I have been try= ing to get the text here to note. We've long had text that talks about the = workaround without ever saying what it is working around. We shouldn't expect implementers to just know what t= hey are expected work around, we need to tell them. That's what my text tri= ed to do.

 

So I would remove that proposed addition say= ing it is okay to ignore security warnings (the UA will have no way of know= ing their legitimacy, that is indeed the problem). The sentence you added to the very end about further mechani= sms is fine, though. 

 

Jon Peterson

Neustar, Inc.

 

From: Kevin Ma J <= kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 at 12:37 PM
To: Jon Peterson <jon= .peterson@neustar.biz>, "Francois Le Faucheur (flefauch)" = <flefauch@cisco.com>, Niven= -Jenkins Ben <ben@niven-jenki= ns.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

Hi Jon,

 =

  Thanks for the review and the updated text!&n= bsp; So, the concern that you are highlighting is that the UA, if it (false= ly) detects a security warning, is going to need to be able to ignore the warning and keep going?  Is that correct?&nb= sp; If so, maybe we should make that even more explicit.  I'll admit I= did not recognize that subtlety from the previous discussions.  I wou= ld also suggest that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling t= he UA to ignore the error, we should make that explicit, e.g.:

 =

"=

  In all three of the above cases, either HTTP = or HTTPS could be used to connect to the Redirection Target. When HTTPS is = used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the = User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative se= curity warnings. When DNS-based redirection with HTTPS is used, this specif= ication assumes that the RT will nonetheless be able to successfully comple= te a TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative secur= ity warnings generated by the legitimate redirection.

 =

  Note: Operational mechanisms to distribute th= e required information and/or configuration, such as private keys, to surro= gates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 =

thanx!=

 =

--  Kevin J. Ma

 =

From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

 

While all of this is fine text and sets the = stage for what I argue needs to be said, it still doesn't acknowledge that = when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.

 

In all three of the above cases, either HTTP or HTTP= S could be used to connect to the Redirection Target. When HTTPS is used to=  connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; operational mechanisms to distribute the required information and/or confi= guration, such as private keys, to surrogates and request routers in dCDNs = are outside the scope of this document.<= o:p>

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bou= nces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

Hi All,

 =

  I thought I'd propose the alternate text (bel= ow), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this document i= s intended to support delegation of HTTP-based traffic, including TLS encry= pted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTT= P, HTTPS, or DNS.  In the case of an HTTPS request from the User Agent= , the TLS session provides authentication of the request router sending the= response.  In this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases o= f HTTP (without TLS) or DNS redirection, there is no inherent authenticatio= n of the request router.  In these cases, forged responses could be in= serted by an attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the c= ase of DNS redirection, DNSSEC [ref] could be used to authenticate DNS resp= onses, however, configuration of DNSSEC is outside the scope of this docume= nt.

 =

In all three of the above cases, either HTTP or HTTP= S could be used to connect to the Redirection Target.  If the Redirect= ion Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and per= form encryption of the TLS channel.  Mechanisms to distribute the requ= ired information and/or configuration, such as private keys, to surrogates = and request routers in dCDNs are outside the scope of this document.<= /span>

 =

 =

From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =





On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface defined in this do= cument might be used to redirect a request where the User Agent will subseq= uently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the host in the RT is ne= eded in order to successfully establish a TLS session. The most widespread = mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies that a Content Pr= ovider=92s content will be delivered by CDNs other than the CDN with which = the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute the required inform= ation and/or configuration to surrogates and request routers in dCDNs to en= able a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particul= ar host, such as private keys or the URI/IP address of a key server, are ou= tside the scope of this document.

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_D28DE2861754D9jonpetersonneustarbiz_-- From nobody Wed Dec 9 15:28:59 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2FEE1B2FCD for ; Wed, 9 Dec 2015 15:28:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KX2_4xK722yD for ; Wed, 9 Dec 2015 15:28:47 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 315BD1B2FE5 for ; Wed, 9 Dec 2015 15:28:47 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-5b-5668b8b645a1 Received: from EUSAAHC004.ericsson.se (Unknown_Domain [147.117.188.84]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 73.B8.06940.6B8B8665; Thu, 10 Dec 2015 00:26:47 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC004.ericsson.se ([147.117.188.84]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 18:28:45 -0500 From: Kevin Ma J To: "Peterson, Jon" , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Snkq4vCB0pNUWs9BHaBcT/a55tfYGAgACFV4CAAIrmgIAAGj0AgABc0wCAANIKgIAAa4+AgAcwhICACDRggIAHlXwAgB5HeuCAHilkgP//v5FQgABfQ4D//7Ey8IAAB7nTgABZvgD//8B+AA== Date: Wed, 9 Dec 2015 23:28:44 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0DD8Aeusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrBIsWRmVeSWpSXmKPExsUyuXRPiO72HRlhBjeXilosODeBzeLp7D+s Fv8WnGayONNg6cDiMeX3RlaPJUt+MnnsaHjO7PHz+iTGAJYoLpuU1JzMstQifbsErozvj1+z Fiy7zVwx82szawPjo7nMXYycHBICJhLTH61ih7DFJC7cW8/WxcjFISRwhFHidMM9VghnGaPE sab3YB1sAloSj7/+ZQKxRQSmMko8+l0PYjMLKEtsad7LCGILC9hL9F7uYIOocZBY9W0FI8gg EZBBXTefg61jEVCR+P25jQXE5hXwlXi5cTcjxLYDHBJHOm4CbePg4BQwl9i3PBOkhhHovO+n 1jBBLBOXuPVkPhPE2QISS/ach3pHVOLl43+sELaSxKSl51hBxjAL5Esc3ukIsUpQ4uTMJywT GEVnIZk0C6FqFpIqiBIdiQW7P7FB2NoSyxa+Zoaxzxx4zIQsvoCRfRUjR2lxQU5uupHBJkZg /B2TYNPdwXh/uuchRgEORiUe3g8J6WFCrIllxZW5hxglOJiVRHg9tmWECfGmJFZWpRblxxeV 5qQWH2KU5mBREudlZGBgEBJITyxJzU5NLUgtgskycXBKNTBO+hI5Y+r5No6jn47nqyiLvPOJ MFD98nDVytopd+ykl1/3PV8dW2p99ftuzuAnmjK8EnvObd5+276aw7P81nXmxb8m7l776FrO nQ0GLCU3bk54cyPvmH/exI0vPgq8mDY17oz4Q9//vn2XqpaYnDpcvGrDgwMhu30eVq3WVZoT 6Pl7ZY974MKDX5RYijMSDbWYi4oTAeRNoRO7AgAA Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 23:28:58 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0DD8Aeusaamb103erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jon, Ok, this time for sure...? I think my issue was that the operational mec= hanism listed (i.e., key distribution) is likely needed in all cases, wheth= er they exhibit this problem or not, which I found confusing, and that even= in the failure case, the RT actually does have the ability to do TLS, so i= t seemed more like a choice of the UA/EU to reject the redirect, than the l= ack of RT ability, but I can see it both ways now. How about: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that either th= e RT will be configured such that the TLS handshake with the User Agent wil= l complete without security warnings or the User Agent will continue despit= e the presence of security warnings. The operational mechanisms required t= o prevent false-negative security warnings, e.g., private key distribution = to surrogates and request routers in dCDNs, are outside the scope of this d= ocument. Further mechanisms to notify User Agents of trusted redirection i= s also outside the scope of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 5:00 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection The problem is indeed that if our assumption fails, the UA will not be able= to tell that the warning is a false negative, and thus redirection will sh= ow up as an attack and may not succeed (though we all know users love to cl= ick through warning dialogs, ideally we shouldn't give them the opportunity= ). I think the sentence you added this time is true - this document does no= t cover a case where a UA receives a false negative security warning when o= ur assumption does fail - though I think that is already basically said abo= ve. I also might say "this document" rather than "the interface described i= n this document." Looking at this, I would really rather have the "operational mechanisms" no= te be attached to where I originally put it; if it's in a separate paragrap= h, then it needs more context to explain that we mean the operational mecha= nisms needed to prevent the assumption from failing as described in the pre= vious paragraph. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 1:38 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection I guess, is the problem that the UA can't tell, or that the redirect fails?= Probably both? The text I suggested below is more about the latter, thou= gh it could certainly be tweeked to also address the former? Sent from my iPhone On Dec 9, 2015, at 4:30 PM, Kevin Ma J > wrote: Hi Jon, Got it. No ignoring in the UA (the "nonetheless" threw me off); and this= RI only supports situations where there are no warnings and no need to ign= ore anything?. " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll be able to successfully complete a TLS handshake with the User Agent; th= e interface described in this document does not cover situations where the = User Agent receiving a false-negative security warning would causes legitim= ate redirection to fail. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection is also outside the scope of this docu= ment. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 3:53 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection No, we shouldn't ever say that a UA should ignore a security warning. We are saying that this document assumes the UA will never have to ignore a= warning because, in any network with a uCDN using HTTPS that does DNS-base= d redirection, the dCDN will have gotten the keys or whatever beforehand. T= he fact that if we didn't assume that, we'd incur these problems, is what I= have been trying to get the text here to note. We've long had text that ta= lks about the workaround without ever saying what it is working around. We = shouldn't expect implementers to just know what they are expected work arou= nd, we need to tell them. That's what my text tried to do. So I would remove that proposed addition saying it is okay to ignore securi= ty warnings (the UA will have no way of knowing their legitimacy, that is i= ndeed the problem). The sentence you added to the very end about further me= chanisms is fine, though. Jon Peterson Neustar, Inc. From: Kevin Ma J > Date: Wednesday, December 9, 2015 at 12:37 PM To: Jon Peterson = >, "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Jon, Thanks for the review and the updated text! So, the concern that you are= highlighting is that the UA, if it (falsely) detects a security warning, i= s going to need to be able to ignore the warning and keep going? Is that c= orrect? If so, maybe we should make that even more explicit. I'll admit I= did not recognize that subtlety from the previous discussions. I would al= so suggest that that we break up that last sentence, and if the operational= mechanisms should include a mechanism for telling the UA to ignore the err= or, we should make that explicit, e.g.: " In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify th= e RT to the User Agent, then the new target domain name may not match the d= omain in the URL dereferenced to reach the uCDN: without operational precau= tions, this can make a legitimate redirection look like a DNS-based attack = to a User Agent and trigger false-negative security warnings. When DNS-base= d redirection with HTTPS is used, this specification assumes that the RT wi= ll nonetheless be able to successfully complete a TLS handshake with the Us= er Agent; the User Agent would need to be able to ignore false-negative sec= urity warnings generated by the legitimate redirection. Note: Operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Further mechanisms to notif= y User Agents of trusted redirection notifications is also outside the scop= e of this document. " thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 2:03 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection While all of this is fine text and sets the stage for what I argue needs to= be said, it still doesn't acknowledge that when HTTPS is used, a legitimat= e DNS-based redirection will look like an attack to a UA unless we do these= workarounds. Your second paragraph noted that "the Redirection Target need= s to be able to successfully complete the TLS handshake" but it still does = not say why you would even need to note that, which is what I've been askin= g for. I've tried to add a second sentence to it below, and I also modified= the rest of the paragraph a bit. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. When HTTPS is used to connect to the uCDN, i= f the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the = RT to the User Agent, then the new target domain name may not match the dom= ain in the URL dereferenced to reach the uCDN: without operational precauti= ons, this can make a legitimate redirection look like a DNS-based attack to= a User Agent and trigger false-negative security warnings. When DNS-based = redirection with HTTPS is used, this specification assumes that the RT will= nonetheless be able to successfully complete a TLS handshake with the User= Agent; operational mechanisms to distribute the required information and/o= r configuration, such as private keys, to surrogates and request routers in= dCDNs are outside the scope of this document. Jon Peterson Neustar, Inc. From: CDNi > on behalf = of Kevin Ma J > Date: Friday, November 20, 2015 at 11:31 AM To: "Francois Le Faucheur (flefauch)" >, Niven-Jenkins Ben > Cc: "cdni@ietf.org" > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi All, I thought I'd propose the alternate text (below), and see if it meets eve= ryone's needs? thanx! -- Kevin J. Ma The Redirection Interface defined in this document is intended to support d= elegation of HTTP-based traffic, including TLS encrypted HTTPS traffic, via= DNS or HTTP redirection. The User Agent request to the uCDN may be made o= ver HTTP, HTTPS, or DNS. In the case of an HTTPS request from the User Age= nt, the TLS session provides authentication of the request router sending t= he response. In this case, the user agent may be confident that the HTTP r= edirection over TLS is genuine. In the cases of HTTP (without TLS) or DNS r= edirection, there is no inherent authentication of the request router. In = these cases, forged responses could be inserted by an attacker to malicious= ly redirect the User Agent to an alternate Redirection Target. In the case= of DNS redirection, DNSSEC [ref] could be used to authenticate DNS respons= es, however, configuration of DNSSEC is outside the scope of this document. In all three of the above cases, either HTTP or HTTPS could be used to conn= ect to the Redirection Target. If the Redirection Target URL uses HTTPS, t= he Redirection Target needs to be able to successfully complete the TLS han= dshake and perform encryption of the TLS channel. Mechanisms to distribute= the required information and/or configuration, such as private keys, to su= rrogates and request routers in dCDNs are outside the scope of this documen= t. From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Francois Le Faucheur= (flefauch) Sent: Sunday, November 01, 2015 3:03 AM To: Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection Hi Ben, Minor editorial suggestions: The redirection interface defined in this document enables a uCDN to return= to a User Agent a DNS response on behalf of a dCDN. If DNSSEC is deployed,= a User Agent can authenticate the DNS responses it receives, enabling it t= o distinguish between genuine (redirection) responses and malicious (redire= ction) responses . Without DNSSEC a User Agent is unable to detect a malici= ous DNS redirect. HTTPS redirection provides an additional layer of authen= tication via TLS because in order for the TLS handshake to complete, the se= rver to which the User Agent connects needs to authenticate itself to the U= ser Agent. Cheers Francois On 27 Oct 2015, at 22:14, Ben Niven-Jenkins > wrote: Hi Jon, Would the following text address your comments, feel free to wordsmith it t= o your liking. =3D=3D=3D The redirection interface defined in this document enables a uCDN to return a DNS response on behalf of a dCDN. If DNSSEC is deployed User Agents can authenticate the DNS responses they receive, enabling them = to distinguish between genuine responses (redirections) and malicious respo= nses (redirections). Without DNSSEC a User Agent is unable to detect a mali= cious DNS redirect. HTTPS redirection provides an additional layer of auth= entication via TLS because in order for the TLS handshake to complete, the = server the User Agent connects to must authenticate itself to the User Agen= t. =3D=3D=3D Thanks Ben On 22 Oct 2015, at 08:56, Ben Niven-Jenkins > wrote: The Redirection Interface defined in this document might be used to redirec= t a request where the User Agent will subsequently attempt to establish a T= LS session with the Redirection Target. In such a case, any surrogate or re= quest router to which the User Agent is redirected needs to be able to succ= essfully complete the TLS handshake and to perform encryption of the TLS ch= annel. The private key for the host in the RT is needed in order to successfully e= stablish a TLS session. The most widespread mechanism currently used by (no= n-interconnected) CDNs is for the owner of the host in the RT sharing their= private key with their CDN(s) of choice. In cases where the owner of the h= ost is not willing to share their private key, other mechanisms that allow = the owner to not share their private key are used, for example Keyless SSL = [REF]. CDNI by definition implies that a Content Provider's content will be delive= red by CDNs other than the CDN with which the Content Provider has a direct= business relationship. Therefore, while CDNI does not introduce any new te= chnical requirements on dCDNs when establishing TLS sessions, Content Provi= ders may be less willing to have their private key shared with dCDNs than t= hey are with their chosen CDN(s) in a non-interconnected scenario. Mechanisms to distribute the required information and/or configuration to s= urrogates and request routers in dCDNs to enable a dCDN to successfully com= plete TLS handshakes and to perform encryption of the TLS channel for a par= ticular host, such as private keys or the URI/IP address of a key server, a= re outside the scope of this document. [REF] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-de= tails/ _______________________________________________ CDNi mailing list CDNi@ietf.org https://www.ietf.org/mailman/listinfo/cdni --_000_A419F67F880AB2468214E154CB8A556206C0DD8Aeusaamb103erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jon,

 

  Ok, this time for sure...?  I think my issue w= as that the operational mechanism listed (i.e., key distribution) is likely= needed in all cases, whether they exhibit this problem or not, which I found confusing, and that even in the failure case, the RT= actually does have the ability to do TLS, so it seemed more like a choice = of the UA/EU to reject the redirect, than the lack of RT ability, but I can= see it both ways now.  How about:

 

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that either the RT will be configured such that the TLS handshak= e with the User Agent will complete without security warnings or the User Agent will continue despite the pres= ence of security warnings.  The operational mechanisms required to pre= vent false-negative security warnings, e.g., private key distribution to su= rrogates and request routers in dCDNs, are outside the scope of this document.  Further mechanisms to notify= User Agents of trusted redirection is also outside the scope of this docum= ent.
"

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson= , Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 5:00 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

 

The problem is indeed that = if our assumption fails, the UA will not be able to tell that the warning i= s a false negative, and thus redirection will show up as an attack and may not succeed (though we all know users love to click thro= ugh warning dialogs, ideally we shouldn't give them the opportunity). I thi= nk the sentence you added this time is true - this document does not cover = a case where a UA receives a false negative security warning when our assumption does fail - though I think t= hat is already basically said above. I also might say "this document&q= uot; rather than "the interface described in this document."=

 

Looking at this, I would re= ally rather have the "operational mechanisms" note be attached to= where I originally put it; if it's in a separate paragraph, then it needs more context to explain that we mean the operational mechanisms n= eeded to prevent the assumption from failing as described in the previous p= aragraph.

 

Jon Peterson

Neustar, Inc.

 

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 at 1:38 PM
To: Jon Peterson <jon= .peterson@neustar.biz>, "Francois Le Faucheur (flefauch)" = <flefauch@cisco.com>, Niven= -Jenkins Ben <ben@niven-jenki= ns.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

I guess, is the problem tha= t the UA can't tell, or that the redirect fails?  Probably both?  = ;The text I suggested below is more about the latter, though it could certainly be tweeked to also address the former?

Sent from my iPhone


On Dec 9, 2015, at 4:30 PM, Kevin Ma J <kevin.j.ma@ericsson.com> wrote:

Hi Jon,

 =

  Got it.  No ignoring in the UA (th= e "nonetheless" threw me off); and this RI only supports situatio= ns where there are no warnings and no need to ignore anything?.

 =

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will be able to successfully complete a TLS handshak= e with the User Agent; the interface described in this document does not cover situations where the User Agent = receiving a false-negative security warning would causes legitimate redirec= tion to fail.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection is also outside the scope of this document.
"

 =

thanx!=

 =

--  Kevin J. Ma

 =

From: Peterson, Jon [= mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 3:53 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

 

No, we shouldn't ever say t= hat a UA should ignore a security warning. 

 

We are saying that this doc= ument assumes the UA will never have to ignore a warning because, in any ne= twork with a uCDN using HTTPS that does DNS-based redirection, the dCDN will have gotten the keys or whatever beforehand. The fact that i= f we didn't assume that, we'd incur these problems, is what I have been try= ing to get the text here to note. We've long had text that talks about the = workaround without ever saying what it is working around. We shouldn't expect implementers to just know what t= hey are expected work around, we need to tell them. That's what my text tri= ed to do.

 

So I would remove that prop= osed addition saying it is okay to ignore security warnings (the UA will ha= ve no way of knowing their legitimacy, that is indeed the problem). The sentence you added to the very end about further mechanisms = is fine, though. =

 

Jon Peterson

Neustar, Inc.

 

From: Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Wednesday, December 9, 2015 at 12:37 PM
To: Jon Peterson <jon= .peterson@neustar.biz>, "Francois Le Faucheur (flefauch)" = <flefauch@cisco.com>, Niven= -Jenkins Ben <ben@niven-jenki= ns.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: RE: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

Hi Jon,

 =

  Thanks for the review and the updated t= ext!  So, the concern that you are highlighting is that the UA, if it = (falsely) detects a security warning, is going to need to be able to ignore the warning and keep going?  Is that correct? = If so, maybe we should make that even more explicit.  I'll admit I di= d not recognize that subtlety from the previous discussions.  I would = also suggest that that we break up that last sentence, and if the operational mechanisms should include a mechanism for telling t= he UA to ignore the error, we should make that explicit, e.g.:

 =

"=

  In all three of the above cases, either= HTTP or HTTPS could be used to connect to the Redirection Target. When HTT= PS is used to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User = Agent, then the new target domain name may not match the domain i= n the URL dereferenced to reach the uCDN: without operational precautions, = this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative securit= y warnings. When DNS-based redirection with HTTPS is used, this specificati= on assumes that the RT will nonetheless be able to successfully complete a = TLS handshake with the User Agent; the User Agent would need to be able to ignore false-negative security war= nings generated by the legitimate redirection.

 =

  Note: Operational mechanisms to distrib= ute the required information and/or configuration, such as private keys, to= surrogates and request routers in dCDNs are outside the scope of this document.  Further mechanisms to notify User Agents= of trusted redirection notifications is also outside the scope of this doc= ument.
"

 =

thanx!=

 =

--  Kevin J. Ma

 =

From: Peterson, Jon [= mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 2:03 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

 

While all of this is fine t= ext and sets the stage for what I argue needs to be said, it still doesn't = acknowledge that when HTTPS is used, a legitimate DNS-based redirection will look like an attack to a UA unless we do these workaround= s. Your second paragraph noted that "the Redirection Target needs to b= e able to successfully complete the TLS handshake" but it still does n= ot say why you would even need to note that, which is what I've been asking for. I've tried to add a second sentence to= it below, and I also modified the rest of the paragraph a bit.

 

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target. When HTTPS is u= sed to connect to the uCDN, if the uCDN uses DNS redirection (in the absence of DNSSEC) to identify the RT to the User Agen= t, then the new target domain name may not match the domain in th= e URL dereferenced to reach the uCDN: without operational precautions, this= can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative security war= nings. When DNS-based redirection with HTTPS is used, this specification as= sumes that the RT will nonetheless be able to successfully complete a TLS h= andshake with the User Agent; operational mechanisms to distribute the required information and/or configuration, su= ch as private keys, to surrogates and request routers in dCDNs are outside = the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

From: CDNi <cdni-bounces@ietf.org> on behalf of Kevin Ma J <kevin.j.ma@ericsson.com>
Date: Friday, November 20, 2015 at 11:31 AM
To: "Francois Le Faucheur (flefauch)" <flefauch@cisco.com>, Niven-Jenkins Ben <ben@niven-jenkins.co.uk>
Cc: "cdni@ietf.org" &= lt;cdni@ietf.org>
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

Hi All,

 =

  I thought I'd propose the alternate tex= t (below), and see if it meets everyone's needs?

 =

thanx!=

 =

--  Kevin J. Ma

 =

The Redirection Interface defined in this docu= ment is intended to support delegation of HTTP-based traffic, including TLS= encrypted HTTPS traffic, via DNS or HTTP redirection.  The User Agent request to the uCDN may be made over HTTP, HTTPS, or DNS.&n= bsp; In the case of an HTTPS request from the User Agent, the TLS session p= rovides authentication of the request router sending the response.  In= this case, the user agent may be confident that the HTTP redirection over TLS is genuine. In the cases of HTTP (witho= ut TLS) or DNS redirection, there is no inherent authentication of the requ= est router.  In these cases, forged responses could be inserted by an = attacker to maliciously redirect the User Agent to an alternate Redirection Target.  In the case of DNS re= direction, DNSSEC [ref] could be used to authenticate DNS responses, howeve= r, configuration of DNSSEC is outside the scope of this document.

 =

In all three of the above cases, either HTTP o= r HTTPS could be used to connect to the Redirection Target.  If the Re= direction Target URL uses HTTPS, the Redirection Target needs to be able to successfully complete the TLS handshake and perform en= cryption of the TLS channel.  Mechanisms to distribute the required in= formation and/or configuration, such as private keys, to surrogates and req= uest routers in dCDNs are outside the scope of this document.

 =

 =

From: CDNi [mailto:cdni-= bounces@ietf.org] On Behalf Of Francois Le Faucheur (flefauch)
Sent: Sunday, November 01, 2015 3:03 AM
To: Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 =

Hi Ben,

 =

Minor editorial suggesti= ons:

 =

The redirection interfac= e defined in this document enables a uCDN to return to a User Agent&nb= sp;a DNS response on behalf of a dCDN. If DNSSEC is deployed, a User A= gent can authenticate the DNS responses it receives, enabling it to distinguish between genuine (redirection) responses an= d malicious (redirection) responses . Without DNSSEC a User Agent is u= nable to detect a malicious DNS redirect.  HTTPS redirection provides&= nbsp;an additional layer of authentication via TLS because in order for the TLS handshake to complete, the server to which the User A= gent connects needs to authenticate itself to the User Agent.

 =

Cheers=

 =

Francois

 =

 =

On 27 Oct 2015, at 22:14= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

Hi Jon,

 =

Would the following text= address your comments, feel free to wordsmith it to your liking.

 =

=3D=3D=3D

The redirection interfac= e defined in this document enables a uCDN to return

a DNS response on behalf= of a dCDN. If DNSSEC is deployed

User Agents can authenti= cate the DNS responses they receive, enabling them to distinguish between g= enuine responses (redirections) and malicious responses (redirections)= . Without DNSSEC a User Agent is unable to detect a malicious DNS redirect.  HTTPS redirection provides an = additional layer of authentication via TLS because in order for the TLS&nbs= p;handshake to complete, the server the User Agent connects to must authent= icate itself to the User Agent.

=3D=3D=3D

 =

Thanks=

Ben

 =

 =

 =

 =






On 22 Oct 2015, at 08:56= , Ben Niven-Jenkins <ben@nive= n-jenkins.co.uk> wrote:

 =

The Redirection Interface d= efined in this document might be used to redirect a request where the User = Agent will subsequently attempt to establish a TLS session with the Redirection Target. In such a case, any surrogate or request rout= er to which the User Agent is redirected needs to be able to successfully c= omplete the TLS handshake and to perform encryption of the TLS channel.

 

The private key for the hos= t in the RT is needed in order to successfully establish a TLS session. The= most widespread mechanism currently used by (non-interconnected) CDNs is for the owner of the host in the RT sharing their private key with= their CDN(s) of choice. In cases where the owner of the host is not willin= g to share their private key, other mechanisms that allow the owner to not = share their private key are used, for example Keyless SSL [REF].

 

CDNI by definition implies = that a Content Provider’s content will be delivered by CDNs other tha= n the CDN with which the Content Provider has a direct business relationship. Therefore, while CDNI does not introduce any new technical r= equirements on dCDNs when establishing TLS sessions, Content Providers may = be less willing to have their private key shared with dCDNs than they are w= ith their chosen CDN(s) in a non-interconnected scenario.

 

Mechanisms to distribute th= e required information and/or configuration to surrogates and request route= rs in dCDNs to enable a dCDN to successfully complete TLS handshakes and to perform encryption of the TLS channel for a particular h= ost, such as private keys or the URI/IP address of a key server, are outsid= e the scope of this document.=

 

 =

________________________= _______________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org= /mailman/listinfo/cdni

 =

--_000_A419F67F880AB2468214E154CB8A556206C0DD8Aeusaamb103erics_-- From nobody Wed Dec 9 16:09:11 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 476651A1BD4 for ; Wed, 9 Dec 2015 16:09:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.266 X-Spam-Level: X-Spam-Status: No, score=-102.266 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D5_2lt1SD9-3 for ; Wed, 9 Dec 2015 16:09:08 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82DA81A1BD1 for ; Wed, 9 Dec 2015 16:09:08 -0800 (PST) Received: from pps.filterd (m0078666.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.15.0.59/8.15.0.59) with SMTP id tBA0447n004884; Wed, 9 Dec 2015 19:09:04 -0500 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 1yp6xttkhb-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 09 Dec 2015 19:09:04 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.186]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0158.001; Wed, 9 Dec 2015 19:09:03 -0500 From: "Peterson, Jon" To: Kevin Ma J , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Sd6BAt8jKfVkKtIgZAGUcIrZ5tCBuAgAD6vYCAABV5AIAAj6oA///nZQCAAUd4gP//9hmAgAel+oCACDRggIAHlXwAgB6cjICAHU4xgIAAoKYA//9+LwAAEgY7gAAAVWMA//9/zQCAAJ71AP//hSOA Date: Thu, 10 Dec 2015 00:09:03 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.182] Content-Type: multipart/alternative; boundary="_000_D28DFCD61754F5jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-12-10_01:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1507310000 definitions=main-1512090407 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2015 00:09:10 -0000 --_000_D28DFCD61754F5jonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable No, we really cannot say in our specification text that we assume the UA wi= ll (or even should) continue despite the presence of security warnings - my= email was just being snarky by pointing out that users in fact tend to do = that, but that is a bad thing, and it is our job as spec authors to prevent= them from being in that position. I think we're shifting the focus here to= o much to the warnings themselves and not to the problem that is causing th= e warnings. The problem causing the warnings is that in this HTTPS case, th= e DNS redirect insecurely directs you to another domain, and that HTTPS sho= uld fail when that happens, if the domain does not hold the keying material= that the UA expects. The proper, long-term way to actually fix this is either to use DNSSEC, or = to give up DNS redirection entirely and just use HTTPS. In that case the UA= securely learns that it should negotiate TLS with the RT's domain instead = of the original domain. But we're not going to tell people they have to do = that. The immediate solution (i.e. workaround) is "operational mechanisms" that w= e assume here, but do not detail - that is, the uCDN giving away its privat= e key to all relevant devices in all dCDNs that could conceivably be RTs. A= ll of your partners/competitors can now impersonate you: enjoy! That is why= this is just a workaround. The mid-term way to address this is the problem space that draft-fieau is t= rying (I think, anyway) to shape. Are we home yet? Here's some proposed edits: In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection to identify the RT to the User Agent, the= n the new target domain name may not match the domain in the URL dereferenc= ed to reach the uCDN: without operational precautions, and in the absence o= f DNSSEC, this can make a legitimate redirection look like a DNS-based atta= ck to a User Agent and trigger false-negative security warnings. When DNS-b= ased redirection with HTTPS is used, this specification assumes that any RT= can complete the necessary TLS handshake with the User Agent. Any operatio= nal mechanisms this requires, e.g., private key distribution to surrogates = and request routers in dCDNs, are outside the scope of this document. Furth= er mechanisms to notify User Agents of trusted redirection are also outside= the scope of this document. Jon Peterson Neustar, Inc. --_000_D28DFCD61754F5jonpetersonneustarbiz_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable
No, we really cannot say in our specification text that we assume the = UA will (or even should) continue despite the presence of security warnings= - my email was just being snarky by pointing out that users in fact tend t= o do that, but that is a bad thing, and it is our job as spec authors to prevent them from being in that posit= ion. I think we're shifting the focus here too much to the warnings themsel= ves and not to the problem that is causing the warnings. The problem causin= g the warnings is that in this HTTPS case, the DNS redirect insecurely directs you to another domain, and that = HTTPS should fail when that happens, if the domain does not hold the keying= material that the UA expects.

The proper, long-term way to actually fix this is either to use DNSSEC= , or to give up DNS redirection entirely and just use HTTPS. In that case t= he UA securely learns that it should negotiate TLS with the RT's domain ins= tead of the original domain. But we're not going to tell people they have to do that.

The immediate solution (i.e. workaround) is "operational mechanis= ms" that we assume here, but do not detail - that is, the uCDN giving = away its private key to all relevant devices in all dCDNs that could concei= vably be RTs. All of your partners/competitors can now impersonate you: enjoy! That is why this is just a workaround.

The mid-term way to address this is the problem space that draft-fieau= is trying (I think, anyway) to shape.

Are we home yet? Here's some proposed edits:

  In all three of the above cases, either HTTP = or HTTPS could be used to connect to the Redirection Target. When HTTPS is = used to connect to the uCDN, if the uCDN uses DNS redirection to identify the RT to the User Agent, then the new&nb= sp;target domain name may not match the domain in the URL dereferenced= to reach the uCDN: without operational precautions, and in the absence of DNSSEC, this can make a legitimate redirection look like a DNS-= based attack to a User Agent and trigger false-negative security warnings. = When DNS-based redirection with HTTPS is used, this specification assumes that any RT can complete the necessary= TLS handshake with the User Agent. Any operational mechanisms this require= s, e.g., private key distribution to surrogates and request routers in dCDN= s, are outside the scope of this document. Further mechanisms to notify User Agents of trusted redirection = are also outside the scope of this document.

Jon Peterson
Neustar, Inc.


 --_000_D28DFCD61754F5jonpetersonneustarbiz_-- From nobody Wed Dec 9 16:54:43 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 091861A6F3E for ; Wed, 9 Dec 2015 16:54:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B1_JVcCrnY0B for ; Wed, 9 Dec 2015 16:54:36 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99C511A6F29 for ; Wed, 9 Dec 2015 16:54:36 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-86-5668cd46d0a9 Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id 92.A4.32102.64DC8665; Thu, 10 Dec 2015 01:54:31 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0248.002; Wed, 9 Dec 2015 19:54:35 -0500 From: Kevin Ma J To: "Peterson, Jon" , "Francois Le Faucheur (flefauch)" , Niven-Jenkins Ben Thread-Topic: [CDNi] Jon's commet on draft-ietf-cdni-redirection Thread-Index: AQHRB0Snkq4vCB0pNUWs9BHaBcT/a55tfYGAgACFV4CAAIrmgIAAGj0AgABc0wCAANIKgIAAa4+AgAcwhICACDRggIAHlXwAgB5HeuCAHilkgP//v5FQgABfQ4D//7Ey8IAAB7nTgABZvgD//8B+AAAMc5CAAAkxVhA= Date: Thu, 10 Dec 2015 00:54:34 +0000 Message-ID: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.11] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0E082eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrOIsWRmVeSWpSXmKPExsUyuXRPuK772Ywwg/ddrBYLzk1gs3g6+w+r xb8Fp5kszjRYOrB4TPm9kdVjyZKfTB47Gp4ze/y8PokxgCWKyyYlNSezLLVI3y6BK6P5xjrm gr9pFR/PTmJvYPwW0cXIySEhYCJx9fYnZghbTOLCvfVsXYxcHEICRxglfvV8YoJwljFKdN78 AlbFJqAl8fjrXyYQW0RgKqPEo9/1IDazgLLElua9jCC2sIC9RO/lDjaIGgeJVd9WMELYmxgl dj3W6GLk4GARUJU4vVcdJMwr4Cux9Nc9VohdGzklVvd2ge3iFDCXmHtzFtguRqDrvp9awwSx S1zi1pP5TBBXC0gs2XMe6gNRiZeP/7FC2EoSH3/PZ4eoz5fYua2dEWKZoMTJmU9YJjCKzkIy ahaSsllIyiDiOhILdn9ig7C1JZYtfM0MY5858JgJWXwBI/sqRo7S4oKc3HQjw02MwOg7JsHm uINxb6/nIUYBDkYlHt4PCelhQqyJZcWVuYcYJTiYlUR4dU5nhAnxpiRWVqUW5ccXleakFh9i lOZgURLnZWRgYBASSE8sSc1OTS1ILYLJMnFwSjUwlh9YPF/9v5pLt4fP9Iney1ON7WqXVcav cYqNfKK8mqUp9PEDOU/LjWs7Rc7vKk503shyf/2TqqBuA5fAlt+yeVa/X4pYnsy9sI0lctlH mZVtVZ9aGkTPvZfwsAkq3zq3UyeiIGeyfe0Xobe606f7zGz65qq+vtNz+fcJltZ/Fx/u3PHa PkVJiaU4I9FQi7moOBEAvjjPuLoCAAA= Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2015 00:54:39 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0E082eusaamb103erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jon, Fair enough. I'm ok with the text below. I'm torn between being more ex= plicit about the issues and maybe adding a few SHOULDs/MUSTs, and coming up= with the least controversial text; I agree with deferring the discussion t= o draft-fieau. thanx! -- Kevin J. Ma From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, December 09, 2015 7:09 PM To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection No, we really cannot say in our specification text that we assume the UA wi= ll (or even should) continue despite the presence of security warnings - my= email was just being snarky by pointing out that users in fact tend to do = that, but that is a bad thing, and it is our job as spec authors to prevent= them from being in that position. I think we're shifting the focus here to= o much to the warnings themselves and not to the problem that is causing th= e warnings. The problem causing the warnings is that in this HTTPS case, th= e DNS redirect insecurely directs you to another domain, and that HTTPS sho= uld fail when that happens, if the domain does not hold the keying material= that the UA expects. The proper, long-term way to actually fix this is either to use DNSSEC, or = to give up DNS redirection entirely and just use HTTPS. In that case the UA= securely learns that it should negotiate TLS with the RT's domain instead = of the original domain. But we're not going to tell people they have to do = that. The immediate solution (i.e. workaround) is "operational mechanisms" that w= e assume here, but do not detail - that is, the uCDN giving away its privat= e key to all relevant devices in all dCDNs that could conceivably be RTs. A= ll of your partners/competitors can now impersonate you: enjoy! That is why= this is just a workaround. The mid-term way to address this is the problem space that draft-fieau is t= rying (I think, anyway) to shape. Are we home yet? Here's some proposed edits: In all three of the above cases, either HTTP or HTTPS could be used to co= nnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection to identify the RT to the User Agent, the= n the new target domain name may not match the domain in the URL dereferenc= ed to reach the uCDN: without operational precautions, and in the absence o= f DNSSEC, this can make a legitimate redirection look like a DNS-based atta= ck to a User Agent and trigger false-negative security warnings. When DNS-b= ased redirection with HTTPS is used, this specification assumes that any RT= can complete the necessary TLS handshake with the User Agent. Any operatio= nal mechanisms this requires, e.g., private key distribution to surrogates = and request routers in dCDNs, are outside the scope of this document. Furth= er mechanisms to notify User Agents of trusted redirection are also outside= the scope of this document. Jon Peterson Neustar, Inc. --_000_A419F67F880AB2468214E154CB8A556206C0E082eusaamb103erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jon,

 

  Fair enough.  I'm ok with the text below. = ; I'm torn between being more explicit about the issues and maybe adding a = few SHOULDs/MUSTs, and coming up with the least controversial text; I agree with deferring the discussion to draft-fieau.

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson= , Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 7:09 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection=

 

No, we really cannot say in= our specification text that we assume the UA will (or even should) continu= e despite the presence of security warnings - my email was just being snarky by pointing out that users in fact tend to do that, but = that is a bad thing, and it is our job as spec authors to prevent them from= being in that position. I think we're shifting the focus here too much to = the warnings themselves and not to the problem that is causing the warnings. The problem causing the warni= ngs is that in this HTTPS case, the DNS redirect insecurely directs you to = another domain, and that HTTPS should fail when that happens, if the domain= does not hold the keying material that the UA expects.

 

The proper, long-term way t= o actually fix this is either to use DNSSEC, or to give up DNS redirection = entirely and just use HTTPS. In that case the UA securely learns that it should negotiate TLS with the RT's domain instead of the or= iginal domain. But we're not going to tell people they have to do that.

 

The immediate solution (i.e= . workaround) is "operational mechanisms" that we assume here, bu= t do not detail - that is, the uCDN giving away its private key to all relevant devices in all dCDNs that could conceivably be RTs. All of yo= ur partners/competitors can now impersonate you: enjoy! That is why this is= just a workaround.

 

The mid-term way to address= this is the problem space that draft-fieau is trying (I think, anyway) to = shape.

 

Are we home yet? Here's som= e proposed edits:

 

  In all three of the above cases, either HTTP or HTTPS= could be used to connect to the Redirection Target. When HTTPS is used to connect to the uCDN, if the uCDN uses DNS redir= ection to identify the RT to the User Agent, then the new target = domain name may not match the domain in the URL dereferenced to reach the u= CDN: without operational precautions, and in the absence of DNSSEC, this can make a legitimate redirection look like a DNS-= based attack to a User Agent and trigger false-negative security warnings. = When DNS-based redirection with HTTPS is used, this specification assumes t= hat any RT can complete the necessary TLS handshake with the User Agent. Any operational mechanisms this require= s, e.g., private key distribution to surrogates and request routers in dCDN= s, are outside the scope of this document. Further mechanisms to notify Use= r Agents of trusted redirection are also outside the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

--_000_A419F67F880AB2468214E154CB8A556206C0E082eusaamb103erics_-- From nobody Thu Dec 10 00:13:36 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 975611A6FF0 for ; Thu, 10 Dec 2015 00:13:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.116 X-Spam-Level: X-Spam-Status: No, score=-2.116 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eR4hM0d-icy8 for ; Thu, 10 Dec 2015 00:13:32 -0800 (PST) Received: from fromintoutb.tno.nl (fromintoutb.tno.nl [134.221.1.27]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8F221A6FE9 for ; Thu, 10 Dec 2015 00:13:31 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.20,407,1444687200"; d="scan'208";a="8680327" Received: from exc-cashub01.tsn.tno.nl (HELO mail.tno.nl) ([134.221.225.220]) by mailhost1b.tno.nl with ESMTP; 10 Dec 2015 09:13:28 +0100 Received: from EXC-MBX03.tsn.tno.nl ([fe80::e969:1300:fb9f:7e12]) by EXC-CASHUB01.tsn.tno.nl ([fe80::b855:be6:1aa8:4d0f%13]) with mapi id 14.03.0248.002; Thu, 10 Dec 2015 09:13:28 +0100 From: "Brandenburg, R. (Ray) van" To: Ben Niven-Jenkins Thread-Topic: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 Thread-Index: AQHRMpE9snEG1azLLU+hJiWtSuTSHp7C15GA///7uoCAAAT3gIABB+cA Date: Thu, 10 Dec 2015 08:13:28 +0000 Message-ID: References: <39F63763-F4DA-4AD2-AA8B-ED7B5200CB89@tno.nl> <87B3E8C2-A530-427E-8F22-39DB88A13DE0@niven-jenkins.co.uk> In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151105 x-originating-ip: [134.221.225.191] Content-Type: text/plain; charset="utf-8" Content-ID: MIME-Version: 1.0 Content-Transfer-Encoding: base64 Archived-At: Cc: "" Subject: Re: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2015 08:13:34 -0000 SGkgQmVuLA0KDQoNCg0KDQpPbiAwOS8xMi8xNSAxODoyOCwgIkJlbiBOaXZlbi1KZW5raW5zIiA8 YmVuQG5pdmVuLWplbmtpbnMuY28udWs+IHdyb3RlOg0KDQo+KEkgcmVhbGlzZWQgSeKAmWQgb25s eSBzZW50IG15IHJlc3BvbnNlIGJlbG93IHRvIFJheSAmIG5vdCB0aGUgZW50aXJlIFdHKS4gQmVu DQo+DQo+PiBPbiA5IERlYyAyMDE1LCBhdCAxNzoxMSwgQmVuIE5pdmVuLUplbmtpbnMgPGJlbkBu aXZlbi1qZW5raW5zLmNvLnVrPiB3cm90ZToNCj4+IA0KPj4gSGkgUmF5LA0KPj4gDQo+Pj4gT24g OSBEZWMgMjAxNSwgYXQgMTY6MjYsIEJyYW5kZW5idXJnLCBSLiAoUmF5KSB2YW4gPHJheS52YW5i cmFuZGVuYnVyZ0B0bm8ubmw+IHdyb3RlOg0KPj4+IE9uIDA5LzEyLzE1IDE1OjUxLCAiQ0ROaSBv biBiZWhhbGYgb2YgQmVuIE5pdmVuLUplbmtpbnMiIDxjZG5pLWJvdW5jZXNAaWV0Zi5vcmcgb24g YmVoYWxmIG9mIGJlbkBuaXZlbi1qZW5raW5zLmNvLnVrPiB3cm90ZToNCj4+Pj4gQXNzdW1pbmcg eW91IGRvbuKAmXQgaW50ZW5kIHRvIGhhdmUgYSBuZXcgcHVibGljL3ByaXZhdGUga2V5IGdlbmVy YXRlZCBmb3IgZWFjaCBzaWduZWQgdG9rZW4gaW4gdGhlIGNoYWluLCBzb21ldGhpbmcgdGhhdCBv Y2N1cnJlZCB0byBtZSBpcyB0aGF0IHRoZSBkcmFmdCBpbnRyb2R1Y2VzIGEgc3VidGxlIGNoYW5n ZSB0byB0aGUgcmVzcG9uc2liaWxpdGllcyBvZiB0aGUgQ0ROIC8gZXhwb3N1cmUgb2YgdGhlIENT UCBmb3IgYXN5bW1ldHJpYyBzaWduYXR1cmVzLg0KPj4+PiANCj4+Pj4gVG9kYXkgYSBDU1AgZ2Vu ZXJhdGVzIGEgdG9rZW4gYW5kIGEgQ0ROIHZhbGlkYXRlcyBpdC4gVGhlIHVyaS1zaWduaW5nLWZv ci1oYXMgZHJhZnQgYWxsb3dzIHRoZSBDRE4gdG8gY3JlYXRlIGEgdG9rZW4gZm9yIGl0c2VsZi4g SW4gdGhlIHBhc3QgdGhlIENETiBjb3VsZCBhbHdheXMgaGF2ZSBkb25lIHRoYXQgYW55d2F5IHdp dGggYSBzaGFyZWQga2V5IGJ1dCBjb3VsZG7igJl0IHdpdGggYW4gYXN5bW1ldHJpYyBzaWduYXR1 cmUgYmVjYXVzZSB0aGUgQ0ROIG5ldmVyIGhhZCBhY2Nlc3MgdG8gdGhlIHByaXZhdGUga2V5LiB1 cmktc2duaW5nLWZvci1oYXMgcmVxdWlyZXMgdGhlIENETiB0byBoYXZlIHRoZSBwcml2YXRlIGtl eSBpbiBvcmRlciB0byBjcmVhdGVkIGNoYWluZWQgdG9rZW5zLiBUaGF0IG1pZ2h0IG5vdCBiZSBh IHByb2JsZW0gZm9yIENTUHMgYnV0IGl04oCZcyBwcm9iYWJseSB3b3J0aCBjYWxsaW5nIG91dCBz b21ld2hlcmUgaW4gdGhlIGRyYWZ0IHRoYXQgdWktc2lnbmluZy1mb3ItaGFzIHJlcXVpcmVkIHRo ZSBDRE4gdG8gaGF2ZSB0aGUgcHJpdmF0ZSBrZXkgd2hlcmVhcyBpZXRmLXNpZ25lZC11cmlzIGRy YWZ0IGRvZXMgbm90Lg0KPj4+IA0KPj4+IEhtbSwgZ29vZCBwb2ludC4gSW4gcHJhY3RpY2UsIEkg YXNzdW1lIHRoZSBDRE4gd291bGQgbm90IHVzZSB0aGUgQ1NQJ3MgcHJpdmF0ZSBrZXkgYnV0IHVz ZSBhbiBpbnRlcm5hbCBvbmUgZm9yIHN1YnNlcXVlbnQgdG9rZW5zLCBidXQgeW91J3JlIHJpZ2h0 IHRoYXQgd2Ugc2hvdWxkIGNhbGwgdGhpcyBvdXQgc29tZXdoZXJlLiBJbiBhbnkgY2FzZSwgSSBl eHBlY3QgdGhlIHVzZSBvZiBhc3ltbWV0cmljIGtleXMgZm9yIGNoYWluZWQgdG9rZW5zIHdvdWxk IG9ubHkgYmUgYmVuZWZpY2lhbCBpbiB2ZXJ5IHNwZWNpZmljIGNpcmN1bXN0YW5jZSBhbnl3YXku IA0KPj4gDQo+PiBJZiB0aGUgQ0ROIHVzZXMgYW4gaW50ZXJuYWwga2V5LCB3aGF0IGhhcHBlbnMg aWYgYSBzdWJzZXF1ZW50IHJlcXVlc3QgZnJvbSB0aGUgY2xpZW50IGdvZXMgdG8gYSBkaWZmZXJl bnQgQ0ROPyBFLmcuIEROUyBiYXNlZCByZXF1ZXN0IHJvdXRpbmcgd2hlcmUgdGhlIGNsaWVudCBk b2VzIGEgRE5TIGxvb2t1cCBwZXIgc2VnbWVudCAod2hpY2ggaXMgaG93IHRoZSBpT1MgY2xpZW50 IGJlaGF2ZXMgQUZBSUspIGFuZCB0aGUgcmVzdWx0cyByZXR1cm5lZCBpbiBETlMgY2hhbmdlICh0 aGUgdUNETiBwaWNrcyBhIGRpZmZlcmVudCBkQ0ROIG9yIHRoZSBDU1AgaXMgdXNpbmcgYSBDRE4g c2VsZWN0b3IgZm9yIGV4YW1wbGUpLg0KPj4gDQo+PiBCZW4NCj4+IA0KDQpBcyBsb25nIGFzIHRo ZSBDRE4gdGhhdCBjcmVhdGVkIHRoZSB0b2tlbiBtYWtlcyBpdCdzIHB1YmxpYyBrZXkgYXZhaWxh YmxlIChhbmQgcGxhY2VzIHRoZSBVUkkgaW4gdGhlIEtleUlEIGZpZWxkKSwgaXQgc2hvdWxkbid0 IG1hdHRlciwgcmlnaHQ/IEhvdyBpcyB0aGlzIGRpZmZlcmVudCBmcm9tIHRoZSBzaW5nbGUgKG5v bi1jaGFpbmVkKSB0b2tlbiBzY2VuYXJpbz8NCg0KUmF5DQoNCj4NClRoaXMgbWVzc2FnZSBtYXkg Y29udGFpbiBpbmZvcm1hdGlvbiB0aGF0IGlzIG5vdCBpbnRlbmRlZCBmb3IgeW91LiBJZiB5b3Ug YXJlIG5vdCB0aGUgYWRkcmVzc2VlIG9yIGlmIHRoaXMgbWVzc2FnZSB3YXMgc2VudCB0byB5b3Ug YnkgbWlzdGFrZSwgeW91IGFyZSByZXF1ZXN0ZWQgdG8gaW5mb3JtIHRoZSBzZW5kZXIgYW5kIGRl bGV0ZSB0aGUgbWVzc2FnZS4gVE5PIGFjY2VwdHMgbm8gbGlhYmlsaXR5IGZvciB0aGUgY29udGVu dCBvZiB0aGlzIGUtbWFpbCwgZm9yIHRoZSBtYW5uZXIgaW4gd2hpY2ggeW91IHVzZSBpdCBhbmQg Zm9yIGRhbWFnZSBvZiBhbnkga2luZCByZXN1bHRpbmcgZnJvbSB0aGUgcmlza3MgaW5oZXJlbnQg dG8gdGhlIGVsZWN0cm9uaWMgdHJhbnNtaXNzaW9uIG9mIG1lc3NhZ2VzLgo= From nobody Thu Dec 10 10:57:14 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 104E31ACE71 for ; Thu, 10 Dec 2015 10:57:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, J_CHICKENPOX_44=0.6, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aQIPZjYZk_pG for ; Thu, 10 Dec 2015 10:57:06 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B5961ACE3E for ; Thu, 10 Dec 2015 10:56:31 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-74-5669ca5d03a4 Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 51.1F.06940.D5AC9665; Thu, 10 Dec 2015 19:54:21 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0248.002; Thu, 10 Dec 2015 13:56:25 -0500 From: Kevin Ma J To: Ben Niven-Jenkins , c^ Thread-Topic: [CDNi] New Liaison Statement, "Liaison Statement to IETF on URI signing" Thread-Index: AQHRFe3cZQiZgR7/OEicTbUfGySugJ6KQW0AgAASJwCAACcsAIAAEXsAgAH0TACAOElTcA== Date: Thu, 10 Dec 2015 18:56:25 +0000 Message-ID: References: <20151103041227.25387.93653.idtracker@ietfa.amsl.com> <33E9CB3F-A487-43C1-B20E-E8D779A6BB58@niven-jenkins.co.uk> <3862FEAC-05EE-490B-94AD-3B8C9A5D6CD3@tno.nl> <7C569AF8-E5CE-4C10-9056-03497D3A6AAB@niven-jenkins.co.uk> <6CB10B3D-1EBD-4DA6-818B-6DB95109C7FB@niven-jenkins.co.uk> In-Reply-To: <6CB10B3D-1EBD-4DA6-818B-6DB95109C7FB@niven-jenkins.co.uk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C0FB6Ceusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrOIsWRmVeSWpSXmKPExsUyuXRPuG7sqcwwg2tXZS0WnJvAZrHj9wRG i6ez/7BavN24icWBxeNIxwU2jyVLfjJ5bHn6j9Hj5/VJjAEsUVw2Kak5mWWpRfp2CVwZfUv/ sRcsucpUsXDVEvYGxg1nmLoYOTkkBEwkdm47zgZhi0lcuLceyObiEBI4wigx881qdghnOaNE z9TjrCBVbAJaEo+//gXrFhFwlnj2dSpLFyMHB7NAjcTcVZYgYWGBcImtX4+zQ5RESNx8vIoR wg6T2Ln9OVg5i4CqRGe7MIjJK+Ar0fOGEWLTeyaJp4eOg5VzCrhLzF25DMxmBLrt+6k1YFuZ BcQlbj2ZD3W/gMSSPeeZIWxRiZeP/7FC2EoSk5aeY4Woz5fon34T7EdeAUGJkzOfsExgFJ2F ZNQsJGWzkJTNAntMU2L9Ln2IEkWJKd0P2SFsDYnWOXPZkcUXMLKvYuQoLS7IyU03MtjECIy+ YxJsujsY70/3PMQowMGoxMP7QSkzTIg1say4MvcQowQHs5II7/edQCHelMTKqtSi/Pii0pzU 4kOM0hwsSuK8jAwMDEIC6YklqdmpqQWpRTBZJg5OqQbGeK2vz42Kr0h5Si9b+sQvM7CS54PU 0tyHfCdCLi0o0EhTunXyScDp/UcClfJ+tuU8MmAJOF65/qGv2qZ5hdNPX6/1E15pwcRjqMzw oUua7+TU5Xs/17pw5cYt+uhZoZ+xt+Mc167E1hk2BsVTfwT8vH7xcFuYyEMfq52vp/t6Gq1g 1wo+vU1KiaU4I9FQi7moOBEA6Acs/boCAAA= Archived-At: Cc: Content Delivery Networks Interconnection Discussion List , Watanabe Shinji Subject: Re: [CDNi] New Liaison Statement, "Liaison Statement to IETF on URI signing" X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2015 18:57:11 -0000 --_000_A419F67F880AB2468214E154CB8A556206C0FB6Ceusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuL0FsbCwNCg0KICAoYXMgYSBjaGFpcikgSSB3YXMgcHJlcGFyaW5nIGEgbGlhaXNvbiBy ZXNwb25zZSBhbmQgZ29pbmcgYmFjayB0aHJvdWdoIHRoZSBsaXN0IGRpc2N1c3Npb25zLCBhbmQg KGFzIGFuIGluZGl2aWR1YWwpIEkgaGFkIGEgY2xhcmlmeWluZyBxdWVzdGlvbiBhYm91dCB0aGUg dG9rZW4gcmVmcmVzaCAod2hpY2ggaXMgbm93IG9ubHkgcGFydCBvZiBSYXkncyBpbmRpdmlkdWFs IGRyYWZ0KToNCg0KPiBXaXRoIGEgdG9rZW4gdGhhdCBjaGFuZ2VzIGFmdGVyIGEgdmFyaWFibGUg bnVtYmVyIG9mIHNlZ21lbnRzLCB0aGUgQ0ROIG5vdyBuZWVkcyB0byBrZWVwIHN0YXRlIGFib3V0 IGhvdyBtYW55IHRpbWVzIGl0IGhhcyBzZWVuIHRoZSB0b2tlbiBhbHJlYWR5IGFuZCBuZWVkcyB0 byBjby1vcmRpbmF0ZSB0aGF0IHN0YXRlIGFjcm9zcyB0aGUgQ0ROIGluIGNhc2Ugc29tZSBvZiB0 aGUgcmVxdWVzdHMgZ28gdG8gZGlmZmVyZW50IHN1cnJvZ2F0ZXMsIGV0Yy4NCg0KICBXaGVuIHdl IHNheSAic3RhdGUiIGhlcmUsIGFyZSB3ZSB0YWxraW5nIGFib3V0IHNlc3Npb24gc3RhdGU/ICBX b3VsZCBpdCBuZWVkIGFueXRoaW5nIG1vcmUgdGhhbiBhIG5ldyBtZXRhZGF0YSB2YXJpYWJsZSB0 aGF0IHNheXMgInRoZSBDRE4gU0hPVUxEIG9ubHkgZ2VuZXJhdGUgYSBuZXcgdG9rZW4gaWYgdGhl IGN1cnJlbnQgdG9rZW4gaXMgbGVzcyB0aGFuIFggc2Vjb25kcyBhd2F5IGZyb20gZXhwaXJpbmci LCB3aGVyZSBYIGlzIGFuIGludGVnZXIgdmFsdWUgY29udmV5ZWQgaW4gdGhlIG1ldGFkYXRhPw0K DQogIEFuZCB3cnQgbm90aWZ5aW5nIHRoZSBjbGllbnQgb2YgdGhlIHZhbHVlIG9mIFgsIEkgdGhp bmsgdGhhdCB3b3VsZCBiZSBvdXQtb2Ytc2NvcGUgZm9yIENETkk/DQoNCnRoYW54IQ0KDQotLSAg S2V2aW4gSi4gTWENCg0KDQpGcm9tOiBDRE5pIFttYWlsdG86Y2RuaS1ib3VuY2VzQGlldGYub3Jn XSBPbiBCZWhhbGYgT2YgQmVuIE5pdmVuLUplbmtpbnMNClNlbnQ6IFdlZG5lc2RheSwgTm92ZW1i ZXIgMDQsIDIwMTUgMToxMiBQTQ0KVG86IGNeDQpDYzogQ29udGVudCBEZWxpdmVyeSBOZXR3b3Jr cyBJbnRlcmNvbm5lY3Rpb24gRGlzY3Vzc2lvbiBMaXN0OyBXYXRhbmFiZSBTaGluamkNClN1Ympl Y3Q6IFJlOiBbQ0ROaV0gTmV3IExpYWlzb24gU3RhdGVtZW50LCAiTGlhaXNvbiBTdGF0ZW1lbnQg dG8gSUVURiBvbiBVUkkgc2lnbmluZyINCg0KQ3JhaWcsDQoNCk9uIDMgTm92IDIwMTUsIGF0IDEy OjIxLCBjXiA8Y0BncnluaW5nLmNvbTxtYWlsdG86Y0BncnluaW5nLmNvbT4+IHdyb3RlOg0KDQpD b29raWUgdXNlIGFsc28gY3JlYXRlcyBvdGhlciBkZXBlbmRlbmNpZXMgd2hlbiB1c2luZyBNU0Ug c3VjaCBhcyBjcm9zc2RvbWFpbi9DT1JTIHdoaWNoIGNhbiBiZSBwcm9ibGVtYXRpYyBpbiBjZXJ0 YWluIGRlcGxveW1lbnRzLg0KUXVlcnkgc3RyaW5nIGJhc2VkIGlzIG1vcmUgcG9ydGFibGUuLi4N CkJ1dCBub3Qgd2l0aG91dCBpdHMgb3duIHNldCBvZiBpc3N1ZXMuIFRoZXJlIGlzIG5vIHNpbmds ZSBhbnN3ZXIgaGVyZSBJTU8uIEJUVyBJIHdhc27igJl0IHRyeWluZyB0byBzdWdnZXN0IHRoYXQg TVBFRyBhdm9pZCBxdWVyeSBwYXJhbWV0ZXJzIGFuZCB1c2UgY29va2llcyBpbnN0ZWFkIGJ1dCB0 byBwb25kZXIgd2hldGhlciB0aGV54oCZZCBjb25zaWRlcmVkIGNvb2tpZXMgYXMgcGFydCBvZiB0 aGUgc29sdXRpb24gc3BhY2UgYXMgaWYgaXQgd2FzIGNvbnNpZGVyZWQgYW5kIGRpc2NvdW50ZWQg SeKAmWQgYmUgaW50ZXJlc3RlZCBpbiB3aGF0IGxlZCB0byB0aGF0IGNob2ljZS4NCg0KDQpXUlQg Z2VuZXJhdGluZyB0b2tlbnMgYmVpbmcgJ2NoZWFwJzsgY29uc2lkZXIgdGhlIGZsYXNoIGNyb3dk cyBhc3NvY2lhdGVkIHdpdGggbmV3cyBldmVudHMgb24gbGl2ZSBzdHJlYW1zLiBUb2tlbiBnZW5l cmF0aW9uIGluIHRoZXNlIGNpcmN1bXN0YW5jZSBpcyB2ZXJ5IGRpZmZlcmVudCB0byB0aGUgbW9k ZXJhdGUgcGVhazptZWFuIGluIG9uLWRlbWFuZCB2aWRlbyB3b3JrZmxvd3MuDQpTdXJlIGJ1dCBz dWNoIGZsYXNoIGNyb3dkcyBwdXQgc3RyZXNzIG9uIHRoZSB3aG9sZSBkZWxpdmVyeSBjaGFpbiBh bmQgSSBoaWdobHkgc3VzcGVjdCB0aGF0IHRoZSBvdmVyaGVhZCBvZiBnZW5lcmF0aW5nIHRva2Vu cyB3aWxsIG5vdCBiZSB0aGUgd2Vha2VzdCBsaW5rIHRoYXQgY2F1c2VzIGEgZmxhc2ggY3Jvd2Qg dG8gaW1wYWN0IGEgc3RyZWFtaW5nIHNlcnZpY2UuDQoNCg0KVGhlIHRyYWRlIG9mZiBiZWluZyBh biBleHRlbmRlZCB0aW1lIGxpbWl0ZWQgdG9rZW4gYmVpbmcgJ2dvb2QgZW5vdWdoJ+KApg0KVGhh dCB3YXMgcGFydCBvZiBteSBwb2ludC4gSWYgb25lIGhhcyB0aGUgb3B0aW9uIHRvIGNyZWF0ZSBh IGxvbmcgbGl2ZWQgc2luZ2xlIHRva2VuIGFuZCBvbmUgaGFzIHRoZSBvcHRpb24gdG8gY2hhaW4g dG9rZW5zIG9uIGVhY2ggcmVxdWVzdCB0aGVuIEnigJltIHN0cnVnZ2xpbmcgdG8gdW5kZXJzdGFu ZCB3aGF0IGJlbmVmaXQgdGhlcmUgaXMgdG8gaGF2aW5nIGEgdGhpcmQgb3B0aW9uIHRoYXQgaXMg c29tZXdoZXJlIGluIHRoZSBtaWRkbGUuDQoNCkkgY2FuIGdvIGludG8gc29tZSBvZiB0aGVzZSBj b25zaWRlcmF0aW9ucyBmdXJ0aGVyIG9mZiBsaXN04oCmDQpJ4oCZZCBjZXJ0YWlubHkgYmUgaW50 ZXJlc3RlZCBpbiBkaXNjdXNzaW5nIHRoaXMgc3R1ZmYgbW9yZSBlaXRoZXIgb24gb3Igb2ZmIGxp c3QuDQoNCkJlbg0KDQoNCkNyYWlnVA0KLS0NCmMlNWUNCk9uIDMgTm92IDIwMTUgMjA6MjAsICJC ZW4gTml2ZW4tSmVua2lucyIgPGJlbkBuaXZlbi1qZW5raW5zLmNvLnVrPG1haWx0bzpiZW5Abml2 ZW4tamVua2lucy5jby51az4+IHdyb3RlOg0KUmF5LA0KDQpJIHdvdWxkbid0IHNpZ25hbCB0byB0 aGUgQ0ROIHdoZXRoZXIgaXQgc2hvdWxkIGV4cGVjdCB0aGUgdG9rZW4gaW4gYSBjb29raWUgb3Ig YSBxdWVyeSBwYXJhbSwgaWYgaXQgd2FzIG1lIEknZCBzcGVjIGl0IHNvIHRoZSBDRE4gaGFzIHRv IHN1cHBvcnQgYm90aCBhbmQgYSBydWxlIGZvciB3aGljaCBvZiBjb29raWUgb3IgcXVlcnkgcGFy YW0gdG8gdXNlIGlmIGJvdGggYXJlIHByZXNlbnQuDQoNCkJlbg0KDQo+IE9uIDMgTm92IDIwMTUs IGF0IDA4OjU4LCBCcmFuZGVuYnVyZywgUi4gKFJheSkgdmFuIDxyYXkudmFuYnJhbmRlbmJ1cmdA dG5vLm5sPG1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPj4gd3JvdGU6DQo+DQo+IEhp IGFsbCwNCj4NCj4gSSd2ZSBhZGRlZCBteSBjb21tZW50cyBiZWxvdy4NCj4NCj4gUmF5DQo+DQo+ DQo+DQo+PiBPbiAwMy8xMS8xNSAwODo1MywgIkNETmkgb24gYmVoYWxmIG9mIEJlbiBOaXZlbi1K ZW5raW5zIiA8Y2RuaS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5v cmc+IG9uIGJlaGFsZiBvZiBiZW5Abml2ZW4tamVua2lucy5jby51azxtYWlsdG86YmVuQG5pdmVu LWplbmtpbnMuY28udWs+PiB3cm90ZToNCj4+DQo+PiBDb2xsZWFndWVzLA0KPj4NCj4+IE15IDJw ICjCpTMuNykgaW5saW5lDQo+Pg0KPj4NCj4+PiBPbiAzIE5vdiAyMDE1LCBhdCAwNDoxMiwgTGlh aXNvbiBTdGF0ZW1lbnQgTWFuYWdlbWVudCBUb29sIDxsc210QGlldGYub3JnPG1haWx0bzpsc210 QGlldGYub3JnPj4gd3JvdGU6DQo+Pj4NCj4+PiBUaXRsZTogTGlhaXNvbiBTdGF0ZW1lbnQgdG8g SUVURiBvbiBVUkkgc2lnbmluZw0KPj4+DQo+Pj4gQm9keTogQXQgdGhlIDExM3RoIE1QRUcgbWVl dGluZyBNUEVHIGV4cGVydHMgdG9vayBub3RlIG9mIHRoZSBuZXcgZHJhZnQgIlVSSSBTaWduaW5n IGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZyIuIFRoaXMgZG9jdW1lbnQgc3BlY2lmaWNhbGx5 IGFkZHJlc3NlcyB0aGUgdXNlIGNhc2Ugb2Ygc2VnbWVudGVkIGNvbnRlbnQgaW4gdGhlIGNvbnRl eHQgb2YgVVJJIFNpZ25pbmcuIE1QRUcgZXhwZXJ0cyBwcm9ncmVzc2VkIHJlZ2FyZGluZyB0aGUg aW50ZWdyYXRpb24gb2YgVVJJIFNpZ25pbmcgZXh0ZW5zaW9uIGZvciBzZWdtZW50ZWQgY29udGVu dCBpbiBNUEVHIERBU0guIEluIGRpc2N1c3Npb24gd2UgaGFkIHNldmVyYWwgY29tbWVudHMgYW5k IG9ic2VydmF0aW9ucyB0aGF0IE1QRUcgZXhwZXJ0cyB3b3VsZCBsaWtlIHRvIHNoYXJlIHdpdGgg dGhlIElFVEYgQ0ROSSB3b3JraW5nIGdyb3VwLiBNUEVHIHdlbGNvbWUgY29tbWVudHMgYW5kIGZl ZWRiYWNrIG9uIHRoZSByZXBvcnRlZCBwcm9ncmVzcy4NCj4+Pg0KPj4+IEludGVncmF0ZWQgd29y a2Zsb3cNCj4+PiBNUEVHIGV4cGVydHMgcmVhY2hlZCBjb25zZW5zdXMgb24gcmVjb21tZW5kaW5n IHRoZSBmb2xsb3dpbmcgc3RlcHMgZm9yIHRoZSBpbnRlZ3JhdGlvbiBvZiBVUkkgU2lnbmluZyBl eHRlbnNpb24gZm9yIHNlZ21lbnRlZCBjb250ZW50IGFuZCBjbGllbnQgYXV0aGVudGljYXRpb24g YW5kIGF1dGhvcmlzYXRpb24gc2NoZW1lIChFeGFtcGxlIG9mIHN1Y2ggYSBzY2hlbWUgaXMgdGhl IE9ubGluZSBNdWx0aW1lZGlhIEF1dGhvcml6YXRpb24gUHJvdG9jb2wgKE9NQVApIHB1YmxpY2x5 IGF2YWlsYWJsZSBvbmxpbmUpLg0KPj4+DQo+Pj4gMS4gICAgVGhlIHNlcnZpY2UgcHJvdmlkZXIg Y2hvc2VzIGEgZ2l2ZW4gY2xpZW50IGF1dGhlbnRpY2F0aW9uIGFuZCBhdXRob3Jpc2F0aW9uIHNj aGVtZSB0byBwcm90ZWN0IHRoZSBhY2Nlc3MgdG8gdGhlIE1QRC4gVGhlIGFwcGxpY2F0aW9uIGFy b3VuZCB0aGUgREFTSCBjbGllbnQgdGFrZXMgY2FyZSBvZiBpbXBsZW1lbnRpbmcgdGhlIHByb3Rv Y29sIGluIG9yZGVyIHRvIHN1Y2Nlc3NmdWxseSByZWNlaXZlIHRoZSBNUEQuDQo+Pj4gMi4gICAg VGhlIGluaXRpYWwgc2VnbWVudCBhY2Nlc3MgdG9rZW4gaXMgcHJvdmlkZWQgZWl0aGVyIGluIHRo ZSBIVFRQIHJlc3BvbnNlIG9mIHRoZSBNUEQgb3Igd2l0aGluIHRoZSBNUEQgaXRzZWxmLg0KPj4+ IDMuICAgIFRoZSBNUEQgY29udGFpbnMgYXBwcm9wcmlhdGUgaW5zdHJ1Y3Rpb25zIHdoaWNoIHNp Z25hbCB0byB0aGUgREFTSCBjbGllbnQgd2hlcmUgdGhlIHNlZ21lbnQgYWNjZXNzIHRva2VuIG11 c3QgYmUgZXh0cmFjdGVkIGZyb20sIGUuZy4gZWl0aGVyIGZyb20gSFRUUCBoZWFkZXIgb2Ygc2Vn bWVudCByZXNwb25zZXMuIEluIGFkZGl0aW9uLCB0aGlzIHNpZ25hbGxpbmcgaW5zdHJ1Y3RzIHRo ZSBEQVNIIGNsaWVudCB0byBpbnNlcnQgdGhpcyBzZWdtZW50IHRva2VuIGJhY2sgaW4gc2VnbWVu dCByZXF1ZXN0cyBhcyBhIHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIuIE5vdGUgdGhhdCBNUEVHIGlu Y2x1ZGVkIHRoaXMgZ2VuZXJpYyBtZWNoYW5pc20gb2YgdHJhbnNwYXJlbnQgcGFyYW1ldGVyIHBh c3NpbmcgaW4gYW4gb25nb2luZyBhbWVuZG1lbnQgb2YgTVBFRyBEQVNIIHBhcnQgMS4gVGhpcyBk b2N1bWVudCBzaG91bGQgcmVhY2ggcHVibGljYXRpb24gaW4gdGhlIGNvdXJzZSBvZiAyMDE2Lg0K Pj4NCj4+IEkgd29uZGVyIGlmIE1QRUcgYWxzbyBjb25zaWRlcmVkIHNldHRpbmcgdGhlIHRva2Vu IGluIGEgY29va2llLCBlLmcuIG9uIHRoZSBNUEQgcmVzcG9uc2U/IEZvciB0aGUgc2l0dWF0aW9u cyB3aGVyZSBpdCB3b3JrcyogaXTigJlzIGEgYmV0dGVyIG9wdGlvbiB0aGFuIHF1ZXJ5IHBhcmFt ZXRlcnMgSU1PIGFuZCBtZWFucyB0aGUgY2xpZW50IGRvZXNu4oCZdCBoYXZlIHRvIGRvIGFueXRo aW5nIHNwZWNpYWwgdG8gaGF2ZSB0aGUgdG9rZW4gaW5zZXJ0ZWQgb24gZXZlcnkgcmVxdWVzdCBh cyB0aGUgSFRUUCBzdGFjayB3aWxsIGRvIHRoYXQgYXMgcGFydCBvZiBIVFRQLg0KPj4NCj4+ICpj b29raWVzIGRvbuKAmXQgd29yayBpbiBhbGwgZW52aXJvbm1lbnRzLCBlLmcuIGJsb2NrZXJzIG9u IGJyb3dzZXJzIG9yIGNsaWVudHMgd2hlcmUgdGhlIHBsYXllciBoYXMgYW4gaW5kZXBlbmRlbnQg Y29va2llIGphciB0byB0aGUgcmVzdCBvZiB0aGUgYXBwL2Jyb3dzZXIgYnV0IGlmIHlvdeKAmXJl IGdvaW5nIHRvIGRvIHNvbWV0aGluZyBsaWtlIGluc2VydCB0aGUgdG9rZW4gaW50byB0aGUgcmVx dWVzdCB1c2luZyBzcGVjaWFsIGNsaWVudCBoYW5kbGluZyBhbnl3YXksIHlvdSBjb3VsZCBkbyB0 aGUgc2FtZSBmb3IgYSBjb29raWUgYW5kIGhhdmUgdGhlIGJlbmVmaXQgb2Ygb25seSBoYXZpbmcg dG8gZG8gaXQgb25jZSByYXRoZXIgdGhhbiBvbmNlIHBlciBzZWdtZW50Lg0KPg0KPiBBZ3JlZWQu DQo+DQo+IE15IGZlZWxpbmcgaXMgeW91J2Qgd2FudCBib3RoIGEgY29va2llLWJhc2VkIGFzIHdl bGwgYXMgYSBxdWVyeSBwYXJhbWV0ZXItYmFzZWQgc29sdXRpb24uIFRoZSBjb29raWUtYmFzZWQg dmVyc2lvbiBmb3IgbGVnYWN5IGNsaWVudHMsIGFuZCBhIHF1ZXJ5LWJhc2VkIHZlcnNpb24gaW4g Y2FzZXMgd2hlcmUgY29va2llJ3MgZG9uJ3Qgd29yay4gSW4gdGhlIHVyaS1zaWduaW5nLWZvci1I QVMgZHJhZnQgSSd2ZSBhZGRlZCBhIGZsYWcgdG8gYWxsb3cgdGhlIENETi9DU1AgdG8gY29tbXVu aWNhdGUgd2hpY2ggbWVjaGFuaXNtIHNob3VsZCBiZSBhcHBsaWVkLg0KPg0KPj4NCj4+PiA0LiAg ICBUaGUgc2VnbWVudCBhY2Nlc3MgdG9rZW4gaXMgbm90IG1lYW50IHRvIGJlIHZhbGlkYXRlZCBi eSB0aGUgYXV0aG9yaXphdGlvbiBwcm92aWRlciBidXQgc29sZWx5IGJ5IHRoZSBDRE4gdG8gZ3Vh cmFudGVlIGFuIGVhc2lseSBzY2FsYWJsZSBhbmQgc3RhdGVsZXNzIHZhbGlkYXRpb24uIFRvIHRo aXMgZW5kLCBNUEVHIGV4cGVydHMgYWNrbm93bGVkZ2VkIHRoZSBuZWVkIG9mIGEgcGFyYW1ldGVy IGZ1bmN0aW9uYWxseSBlcXVpdmFsZW50IHRvIHRoZSBQYXRoIFBhdHRlcm4gZGVmaW5lZCBpbiB0 aGUgVVJJIFNpZ25pbmcgZm9yIEhUVFAgQWRhcHRpdmUgU3RyZWFtaW5nLiBBcyBhIHJlc3VsdCwg dGhlIFVSSSBTaWduaW5nIGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZyBzZWVtcyB0byBmdWxm aWwgdGhlIGlkZW50aWZpZWQgcmVxdWlyZW1lbnRzIGFuZCB3aWxsIGJlIGNvbnNpZGVyZWQgZm9y IGZ1cnRoZXIgd29yay4NCj4+Pg0KPj4+DQo+Pj4gRnVydGhlcm1vcmUsIGhlcmUgYXJlIGNvbW1l bnRzIGZyb20gTVBFRyBleHBlcnRzIG9uIHRoZSBVUkkgU2lnbmluZyBmb3IgSFRUUCBBZGFwdGl2 ZSBTdHJlYW1pbmcgZHJhZnQuDQo+Pj4NCj4+PiBMb25nLXRlcm0gdG9rZW5zIChpbnRvIHNlbnRl bmNlcykNCj4+PiBTb21lIERBU0ggc2VydmljZXMgbWF5IHVzZSBsb25nLXRlcm0gdG9rZW5zIHRv IHJlcXVlc3Qgc2VnbWVudHMsIHdoZXJlIGxvbmctdGVybSB0eXBpY2FsbHkgbWVhbnMgY291cGxl IG9mIGhvdXJzIHRvIHNldmVyYWwgZGF5cy4gSW4gdGhpcyBzY2VuYXJpbywgYWRkaXRpb25hbCB0 b2tlbnMgKG5vdCBVUkkgU2lnbmVkIFRva2VuKSBhcmUgc2VudCBhbG9uZyB0byBlbmZvcmNlIGNs aWVudCBhdXRoZW50aWNhdGlvbi4gQXMgYSByZXN1bHQsIHJlZnJlc2hpbmcgdGhlIFVSSSBTaWdu ZWQgVG9rZW4gYXQgZXZlcnkgcmVxdWVzdCBtYXkgc2VlbSBzdXBlcmZsdW91cy4gTVBFRyBleHBl cnRzIHdvdWxkIGxpa2UgdG8ga25vdyB0aGUgb3BpbmlvbiBvZiB0aGUgSUVURiBDRE5JIHdvcmtp bmcgZ3JvdXAgb24gdGhpcyBzY2VuYXJpbyBhbmQgd2hldGhlciB0aGUgdmFsaWRhdGlvbiBtZWNo YW5pc20gY291bGQgYmUgYWRhcHRlZCwgZS5nLiBieSBzaWduYWxsaW5nIHdoZW4gdGhlIENETiBt dXN0IHJlZ2VuZXJhdGUgYSBuZXcgVVJJIFNpZ25lZCBUb2tlbi4NCj4+DQo+PiBBIHNpbmdsZSB0 b2tlbiBjYW4gYmUgZ2l2ZW4gYSBsb25nIGV4cGlyeSB0aW1lIHNvIEnigJltIG5vdCBjb21wbGV0 ZWx5IGNlcnRhaW4gd2hhdCB0aGUgTVBFRyB1c2UgY2FzZSBpcy4gVGhhdCBwcm92aWRlcyBhIGxv bmcgdGltZSBpbiB3aGljaCBhIHRva2VuIGNvdWxkIGJlIHBhc3NlZCB0byBzb21lb25lIGVsc2Us IHdoaWNoIGRyb3ZlIHRoZSBpZGVhIG9mIGNoYW5naW5nIHRoZSB0b2tlbiBmcm9tIHRoZSBDRE4g c2lkZSBvbiBldmVyeSBzZWdtZW50IHdoaWNoIHJlZHVjZXMgdGhlIGV4cG9zdXJlIHRpbWUgdG8g dGhlIG1pbmltdW0gcG9zc2libGUuIEl0IHNlZW1zIHRoYXQgd2hhdCBNUEVHIGlzIGFza2luZyBm b3IgaXMgdGhlIGFiaWxpdHkgdG8gdHVuZSB0aGUgZXhwb3N1cmUgdGltZS4NCj4+DQo+PiBJTU8g aXQgc291bmRzIGEgbmljZSBrbm9iIHRvIGhhdmUgaW4gdGhlb3J5LCBidXQgSeKAmW0gd29uZGVy aW5nIHdoeSBzb21lb25lIHdvdWxkIGFjdHVhbGx5IHR1bmUgaXQgaW4gcHJhY3RpY2UuIEdlbmVy YXRpbmcgdG9rZW5zIGlzIHByZXR0eSBjaGVhcCwgaXTigJlzIGJhc2ljYWxseSBhIHNpbmdsZSBj YWxsIHRvIGEgU0hBIGhhc2ggZnVuY3Rpb24uIEkgdGhpbmsgaXQgYWxzbyBpbmNyZWFzZXMgdGhl IGltcGxlbWVudGF0aW9uIGNvbXBsZXhpdHkgc2lnbmlmaWNhbnRseS4gV2l0aCBhIGxvbmcgdXNl IHNpbmdsZSB0b2tlbiBvciB3aXRoIHJlLXdyaXRpbmcgdGhlIHRva2VuIG9uIGV2ZXJ5IHNlZ21l bnQgdGhlIENETiBjYW4gcHJvY2VzcyBlYWNoIHJlcXVlc3QgaW5kZXBlbmRlbnRseS4gV2l0aCBh IHRva2VuIHRoYXQgY2hhbmdlcyBhZnRlciBhIHZhcmlhYmxlIG51bWJlciBvZiBzZWdtZW50cywg dGhlIENETiBub3cgbmVlZHMgdG8ga2VlcCBzdGF0ZSBhYm91dCBob3cgbWFueSB0aW1lcyBpdCBo YXMgc2VlbiB0aGUgdG9rZW4gYWxyZWFkeSBhbmQgbmVlZHMgdG8gY28tb3JkaW5hdGUgdGhhdCBz dGF0ZSBhY3Jvc3MgdGhlIENETiBpbiBjYXNlIHNvbWUgb2YgdGhlIHJlcXVlc3RzIGdvIHRvIGRp ZmZlcmVudCBzdXJyb2dhdGVzLCBldGMuDQo+Pg0KPj4gSXQgc291bmRzIGxpa2UgYSBsb3Qgb2Yg Y29tcGxleGl0eSBmb3IgbGl0dGxlIHJlYWwgYmVuZWZpdCBJTU8uDQo+DQo+IEZ1bGx5IGFncmVl Lg0KPg0KPiAoT25lIHdheSB0byBpbXBsZW1lbnQgaXQgd291bGQgYmUgdG8gaGF2ZSBzb21lIHNv cnQgb2YgRXhwaXJhdGlvbiBUaW1lIFRocmVzaG9sZCB0byBpbmRpY2F0ZSB3aGVuIHRoZSBDRE4g c2hvdWxkIHJlZnJlc2ggdGhlIHRva2VuLCBidXQgdGhhdCB3b3VsZCByZXN1bHQgaW4gYWxsIGtp bmRzIG9mIGlzc3Vlcywgc3VjaCBhcyBlZmZlY3RpdmVseSBoYXZpbmcgdmFyaWFibGUgdG9rZW4g bGVuZ3RocyB3aGljaCB3aWxsIGNhdXNlIGlzc3VlcyBpbiBjYXNlcyBvZiBwcm9sb25nZWQgcGF1 c2UpDQo+DQo+Pg0KPj4+IE5hbWUgY29sbGlzaW9uDQo+Pj4gTVBFRyBleHBlcnRzIHVuZGVyc3Rh bmQgdGhhdCB0aGUgbmFtZSBVUklTaWduaW5nUGFja2FnZSwgYXMgYSBxdWVyeSBzdHJpbmcsIGFz IGFuIEhUVFAgaGVhZGVyIHBhcmFtZXRlciBvciBpbiBhIGNvb2tpZSwgY29uc3RpdHV0ZXMgYSBu b3JtYXRpdmUgYXNwZWN0IG9mIHRoZSBVUkkgU2lnbmluZyBzcGVjaWZpY2F0aW9uLiBNUEVHIGV4 cGVydHMgd291bGQgbGlrZSB0byBrbm93IHdoZXRoZXIgdGhlIElFVEYgQ0ROSSB3b3JraW5nIGdy b3VwIGhhcyBkZWNpZGVkIHRoZSBhcHByb3ByaWF0ZSBhcHByb2FjaCB0byBwcmV2ZW50IG5hbWUg Y29sbGlzaW9uLg0KPg0KPiBUaGUgY3VycmVudCBiYXNlIFVSSSBzaWduaW5nIHNwZWMgYWxyZWFk eSBhbGxvd3Mgb3ZlcnJpZGluZyB0aGUgVVJJU2lnbmluZ1BhY2thZ2UgcXVlcnkgc3RyaW5nIHBh cmFtZXRlciBiYXNlZCBvbiBlLmcuIE1ldGFkYXRhLiBJbiBjYXNlIG9mIERBU0gsIGFuZCBjbGll bnRzIGhhdmluZyB0byBrbm93IHRoaXMgbmFtZSwgSSB0aGluayB0aGUgYmVzdCBzb2x1dGlvbiB3 b3VsZCBiZSB0byBqdXN0IGNvbnZleSBpdCBpbiB0aGUgTVBELg0KPg0KPj4+DQo+Pj4gQ29uc2Vj dXRpdmUgdG9rZW5zDQo+Pj4gQWNjb3JkaW5nIHRvIHRoZSBVUkkgU2lnbmluZyBmb3IgSFRUUCBB ZGFwdGl2ZSBTdHJlYW1pbmcgZHJhZnQsIHRoZSBzZXJ2ZXIgbWF5IGlzc3VlIG11bHRpcGxlIHRv a2VucyBhbmQgZGVsaXZlcmVkIHRoZW0gaW4gY29uc2VjdXRpdmUgSFRUUCByZXF1ZXN0cy4gSXQg ZG9lcyBub3Qgc2VlbSB0aGF0IHRoZXJlIGlzIGEgZGVwZW5kZW5jeSBiZXR3ZWVuIHRoZSB0b2tl bnMuIENvdWxkIElFVEYgZXhwZXJ0IGNvbmZpcm0gdGhhdCBhIHRva2VuIGlzc3VlZCBhdCB0aW1l IHQgZG9lcyBub3QgaW52YWxpZGF0ZSBhIHRva2VuIGlzc3VlZCBwcmlvciB0byB0aW1lIHQgPw0K Pj4NCj4+IEluIHRoZSAzIHRva2VuIGltcGxlbWVudGF0aW9ucyBJIGFtIGZhbWlsaWFyIHdpdGgg dG9rZW5zIGFyZSBjb21wbGV0ZWx5IGluZGVwZW5kZW50IGFuZCBhIHRva2VuIGlzc3VlZCBhdCB0 aW1lIHQgZG9lcyBub3QgaW52YWxpZGF0ZSBhIHRva2VuIGlzc3VlZCBwcmlvciB0byB0aW1lIHQu DQo+DQo+IEFncmVlZC4gQXBhcnQgZnJvbSBoYXZpbmcgdG8ga2VlcCBhbmQgc3luY2hyb25pc2Ug c3RhdGUgYWNyb3NzIG5vZGVzLCBJIGRvbid0IHNlZSBob3cgeW91IGNvdWxkIGV2ZW4gaW1wbGVt ZW50IGl0Lg0KPg0KPj4NCj4+IEJlbg0KPj4NCj4+Pg0KPj4+DQo+Pj4gTVBFRyBraW5kbHkgYXNr cyB0aGUgSUVURiBDRE5JIHdvcmtpbmcgZ3JvdXAgdG8gY29uc2lkZXIgdGhlIGFib3ZlIG9ic2Vy dmF0aW9ucyBhbmQgd2VsY29tZSBmdXJ0aGVyIGNvbGxhYm9yYXRpb24gb24gdGhpcyB0b3BpYy4N Cj4+Pg0KPj4+DQo+Pj4NCj4+PiBPdXIgZnV0dXJlIG1lZXRpbmdzOg0KPj4+IC0gICAgREFTSCBB ZC1ob2MgbWVldGluZ3MsIDIxIEZlYnJ1YXJ5IDIwMTYsIFNhbiBEaWVnbywgQ0ENCj4+PiAtICAg IFRoZSAxMTR0aCBNUEVHIG1lZXRpbmcsIDIyIC0gMjYgRmVicnVhcnkgMjAxNiwgU2FuIERpZWdv LCBDQQ0KPj4+DQo+Pj4NCj4+PiBBdHRhY2htZW50czoNCj4+Pg0KPj4+ICAyOW4xNTM4MTENCj4+ PiAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbGliL2R0L2RvY3VtZW50cy9MSUFJU09OL2xpYWlzb24t MjAxNS0xMS0wMi1pc28taWVjLWp0YzEtc2MyOS13ZzExLWNkbmktbGlhaXNvbi1zdGF0ZW1lbnQt dG8taWV0Zi1vbi11cmktc2lnbmluZy1hdHRhY2htZW50LTEuZG9jDQo+Pj4NCj4+PiAgMjluMTUz ODExIGh0bQ0KPj4+ICBodHRwczovL3d3dy5pZXRmLm9yZy9saWIvZHQvZG9jdW1lbnRzL0xJQUlT T04vbGlhaXNvbi0yMDE1LTExLTAyLWlzby1pZWMtanRjMS1zYzI5LXdnMTEtY2RuaS1saWFpc29u LXN0YXRlbWVudC10by1pZXRmLW9uLXVyaS1zaWduaW5nLWF0dGFjaG1lbnQtMi5odG0NCj4+Pg0K Pj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+Pj4g Q0ROaSBtYWlsaW5nIGxpc3QNCj4+PiBDRE5pQGlldGYub3JnPG1haWx0bzpDRE5pQGlldGYub3Jn Pg0KPj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KPj4NCj4+ IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+PiBDRE5p IG1haWxpbmcgbGlzdA0KPj4gQ0ROaUBpZXRmLm9yZzxtYWlsdG86Q0ROaUBpZXRmLm9yZz4NCj4+ IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KPiBUaGlzIG1lc3Nh Z2UgbWF5IGNvbnRhaW4gaW5mb3JtYXRpb24gdGhhdCBpcyBub3QgaW50ZW5kZWQgZm9yIHlvdS4g SWYgeW91IGFyZSBub3QgdGhlIGFkZHJlc3NlZSBvciBpZiB0aGlzIG1lc3NhZ2Ugd2FzIHNlbnQg dG8geW91IGJ5IG1pc3Rha2UsIHlvdSBhcmUgcmVxdWVzdGVkIHRvIGluZm9ybSB0aGUgc2VuZGVy IGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UuIFROTyBhY2NlcHRzIG5vIGxpYWJpbGl0eSBmb3IgdGhl IGNvbnRlbnQgb2YgdGhpcyBlLW1haWwsIGZvciB0aGUgbWFubmVyIGluIHdoaWNoIHlvdSB1c2Ug aXQgYW5kIGZvciBkYW1hZ2Ugb2YgYW55IGtpbmQgcmVzdWx0aW5nIGZyb20gdGhlIHJpc2tzIGlu aGVyZW50IHRvIHRoZSBlbGVjdHJvbmljIHRyYW5zbWlzc2lvbiBvZiBtZXNzYWdlcy4NCg0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCkNETmkgbWFpbGlu ZyBsaXN0DQpDRE5pQGlldGYub3JnPG1haWx0bzpDRE5pQGlldGYub3JnPg0KaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pDQoNCg== --_000_A419F67F880AB2468214E154CB8A556206C0FB6Ceusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIg Lz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxh bmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+SGkgQmVuL0FsbCw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyAoYXMgYSBjaGFpcikgSSB3YXMgcHJlcGFyaW5nIGEgbGlhaXNvbiByZXNwb25zZSBhbmQg Z29pbmcgYmFjayB0aHJvdWdoIHRoZSBsaXN0IGRpc2N1c3Npb25zLCBhbmQgKGFzIGFuIGluZGl2 aWR1YWwpIEkgaGFkIGEgY2xhcmlmeWluZyBxdWVzdGlvbiBhYm91dCB0aGUgdG9rZW4gcmVmcmVz aCAod2hpY2ggaXMNCiBub3cgb25seSBwYXJ0IG9mIFJheSdzIGluZGl2aWR1YWwgZHJhZnQpOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ Jmd0OyA8L3NwYW4+DQpXaXRoIGEgdG9rZW4gdGhhdCBjaGFuZ2VzIGFmdGVyIGEgdmFyaWFibGUg bnVtYmVyIG9mIHNlZ21lbnRzLCB0aGUgQ0ROIG5vdyBuZWVkcyB0byBrZWVwIHN0YXRlIGFib3V0 IGhvdyBtYW55IHRpbWVzIGl0IGhhcyBzZWVuIHRoZSB0b2tlbiBhbHJlYWR5IGFuZCBuZWVkcyB0 byBjby1vcmRpbmF0ZSB0aGF0IHN0YXRlIGFjcm9zcyB0aGUgQ0ROIGluIGNhc2Ugc29tZSBvZiB0 aGUgcmVxdWVzdHMgZ28gdG8gZGlmZmVyZW50IHN1cnJvZ2F0ZXMsIGV0Yy48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgV2hlbiB3ZSBzYXkgJnF1b3Q7c3RhdGUmcXVvdDsgaGVyZSwgYXJlIHdlIHRhbGtpbmcg YWJvdXQgc2Vzc2lvbiBzdGF0ZT8mbmJzcDsgV291bGQgaXQgbmVlZCBhbnl0aGluZyBtb3JlIHRo YW4gYSBuZXcgbWV0YWRhdGEgdmFyaWFibGUgdGhhdCBzYXlzICZxdW90O3RoZSBDRE4gU0hPVUxE IG9ubHkgZ2VuZXJhdGUgYSBuZXcgdG9rZW4gaWYgdGhlDQogY3VycmVudCB0b2tlbiBpcyBsZXNz IHRoYW4gWCBzZWNvbmRzIGF3YXkgZnJvbSBleHBpcmluZyZxdW90Oywgd2hlcmUgWCBpcyBhbiBp bnRlZ2VyIHZhbHVlIGNvbnZleWVkIGluIHRoZSBtZXRhZGF0YT88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyBBbmQgd3J0IG5v dGlmeWluZyB0aGUgY2xpZW50IG9mIHRoZSB2YWx1ZSBvZiBYLCBJIHRoaW5rIHRoYXQgd291bGQg YmUgb3V0LW9mLXNjb3BlIGZvciBDRE5JPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+dGhhbnghPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tLSZuYnNwOyBLZXZpbiBKLiBNYTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4w cHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij4gQ0ROaSBbbWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9u IEJlaGFsZiBPZiA8L2I+QmVuIE5pdmVuLUplbmtpbnM8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVz ZGF5LCBOb3ZlbWJlciAwNCwgMjAxNSAxOjEyIFBNPGJyPg0KPGI+VG86PC9iPiBjXjxicj4NCjxi PkNjOjwvYj4gQ29udGVudCBEZWxpdmVyeSBOZXR3b3JrcyBJbnRlcmNvbm5lY3Rpb24gRGlzY3Vz c2lvbiBMaXN0OyBXYXRhbmFiZSBTaGluamk8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtDRE5p XSBOZXcgTGlhaXNvbiBTdGF0ZW1lbnQsICZxdW90O0xpYWlzb24gU3RhdGVtZW50IHRvIElFVEYg b24gVVJJIHNpZ25pbmcmcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5DcmFpZyw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiAzIE5vdiAyMDE1LCBhdCAxMjoyMSwgY14gJmx0OzxhIGhyZWY9Im1haWx0bzpj QGdyeW5pbmcuY29tIj5jQGdyeW5pbmcuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Q29va2llIHVzZSBhbHNvIGNyZWF0ZXMgb3RoZXIg ZGVwZW5kZW5jaWVzIHdoZW4gdXNpbmcgTVNFIHN1Y2ggYXMgY3Jvc3Nkb21haW4vQ09SUyB3aGlj aCBjYW4gYmUgcHJvYmxlbWF0aWMgaW4gY2VydGFpbiBkZXBsb3ltZW50cy48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+UXVlcnkgc3RyaW5nIGJhc2VkIGlzIG1vcmUgcG9y dGFibGUuLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkJ1dCBub3Qgd2l0aG91dCBpdHMgb3duIHNldCBvZiBpc3N1ZXMu IFRoZXJlIGlzIG5vIHNpbmdsZSBhbnN3ZXIgaGVyZSBJTU8uIEJUVyBJIHdhc27igJl0IHRyeWlu ZyB0byBzdWdnZXN0IHRoYXQgTVBFRyBhdm9pZCBxdWVyeSBwYXJhbWV0ZXJzIGFuZCB1c2UgY29v a2llcyBpbnN0ZWFkIGJ1dCB0byBwb25kZXIgd2hldGhlciB0aGV54oCZZCBjb25zaWRlcmVkIGNv b2tpZXMgYXMgcGFydCBvZiB0aGUgc29sdXRpb24gc3BhY2UNCiBhcyBpZiBpdCB3YXMgY29uc2lk ZXJlZCBhbmQgZGlzY291bnRlZCBJ4oCZZCBiZSBpbnRlcmVzdGVkIGluIHdoYXQgbGVkIHRvIHRo YXQgY2hvaWNlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PldSVCBnZW5lcmF0aW5nIHRva2VucyBiZWluZyAnY2hlYXAnOyBjb25zaWRlciB0aGUgZmxhc2gg Y3Jvd2RzIGFzc29jaWF0ZWQgd2l0aCBuZXdzIGV2ZW50cyBvbiBsaXZlIHN0cmVhbXMuIFRva2Vu IGdlbmVyYXRpb24gaW4gdGhlc2UgY2lyY3Vtc3RhbmNlIGlzIHZlcnkgZGlmZmVyZW50IHRvIHRo ZSBtb2RlcmF0ZQ0KIHBlYWs6bWVhbiBpbiBvbi1kZW1hbmQgdmlkZW8gd29ya2Zsb3dzLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3VyZSBidXQg c3VjaCBmbGFzaCBjcm93ZHMgcHV0IHN0cmVzcyBvbiB0aGUgd2hvbGUgZGVsaXZlcnkgY2hhaW4g YW5kIEkgaGlnaGx5IHN1c3BlY3QgdGhhdCB0aGUgb3ZlcmhlYWQgb2YgZ2VuZXJhdGluZyB0b2tl bnMgd2lsbCBub3QgYmUgdGhlIHdlYWtlc3QgbGluayB0aGF0IGNhdXNlcyBhIGZsYXNoIGNyb3dk IHRvIGltcGFjdCBhIHN0cmVhbWluZyBzZXJ2aWNlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZSB0cmFkZSBvZmYgYmVpbmcgYW4gZXh0ZW5kZWQgdGlt ZSBsaW1pdGVkIHRva2VuIGJlaW5nICdnb29kIGVub3VnaCfigKY8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhdCB3YXMgcGFydCBvZiBteSBwb2ludC4gSWYg b25lIGhhcyB0aGUgb3B0aW9uIHRvIGNyZWF0ZSBhIGxvbmcgbGl2ZWQgc2luZ2xlIHRva2VuIGFu ZCBvbmUgaGFzIHRoZSBvcHRpb24gdG8gY2hhaW4gdG9rZW5zIG9uIGVhY2ggcmVxdWVzdCB0aGVu IEnigJltIHN0cnVnZ2xpbmcgdG8gdW5kZXJzdGFuZCB3aGF0IGJlbmVmaXQgdGhlcmUgaXMgdG8g aGF2aW5nIGEgdGhpcmQgb3B0aW9uIHRoYXQgaXMgc29tZXdoZXJlDQogaW4gdGhlIG1pZGRsZS48 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PkkgY2FuIGdvIGludG8gc29tZSBvZiB0aGVzZSBjb25zaWRlcmF0aW9ucyBmdXJ0aGVyIG9mZiBs aXN04oCmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPknigJlk IGNlcnRhaW5seSBiZSBpbnRlcmVzdGVkIGluIGRpc2N1c3NpbmcgdGhpcyBzdHVmZiBtb3JlIGVp dGhlciBvbiBvciBvZmYgbGlzdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+QmVuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPkNyYWlnVDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj4tLTxicj4NCmMlNWU8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiAzIE5vdiAyMDE1IDIwOjIwLCAmcXVvdDtCZW4gTml2ZW4tSmVua2lucyZxdW90 OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrIj5iZW5Abml2ZW4t amVua2lucy5jby51azwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+UmF5LDxicj4NCjxicj4NCkkgd291bGRuJ3Qgc2lnbmFsIHRvIHRoZSBDRE4gd2hl dGhlciBpdCBzaG91bGQgZXhwZWN0IHRoZSB0b2tlbiBpbiBhIGNvb2tpZSBvciBhIHF1ZXJ5IHBh cmFtLCBpZiBpdCB3YXMgbWUgSSdkIHNwZWMgaXQgc28gdGhlIENETiBoYXMgdG8gc3VwcG9ydCBi b3RoIGFuZCBhIHJ1bGUgZm9yIHdoaWNoIG9mIGNvb2tpZSBvciBxdWVyeSBwYXJhbSB0byB1c2Ug aWYgYm90aCBhcmUgcHJlc2VudC48YnI+DQo8YnI+DQpCZW48YnI+DQo8YnI+DQomZ3Q7IE9uIDMg Tm92IDIwMTUsIGF0IDA4OjU4LCBCcmFuZGVuYnVyZywgUi4gKFJheSkgdmFuICZsdDs8YSBocmVm PSJtYWlsdG86cmF5LnZhbmJyYW5kZW5idXJnQHRuby5ubCI+cmF5LnZhbmJyYW5kZW5idXJnQHRu by5ubDwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDs8YnI+DQomZ3Q7IEhpIGFsbCw8YnI+DQomZ3Q7 PGJyPg0KJmd0OyBJJ3ZlIGFkZGVkIG15IGNvbW1lbnRzIGJlbG93Ljxicj4NCiZndDs8YnI+DQom Z3Q7IFJheTxicj4NCiZndDs8YnI+DQomZ3Q7PGJyPg0KJmd0Ozxicj4NCiZndDsmZ3Q7IE9uIDAz LzExLzE1IDA4OjUzLCAmcXVvdDtDRE5pIG9uIGJlaGFsZiBvZiBCZW4gTml2ZW4tSmVua2lucyZx dW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZyI+Y2RuaS1ib3Vu Y2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YNCjxhIGhyZWY9Im1haWx0bzpiZW5Abml2ZW4t amVua2lucy5jby51ayI+YmVuQG5pdmVuLWplbmtpbnMuY28udWs8L2E+Jmd0OyB3cm90ZTo8YnI+ DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IENvbGxlYWd1ZXMsPGJyPg0KJmd0OyZndDs8YnI+DQom Z3Q7Jmd0OyBNeSAycCAowqUzLjcpIGlubGluZTxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyZndDsgT24gMyBOb3YgMjAxNSwgYXQgMDQ6MTIsIExpYWlzb24gU3RhdGVt ZW50IE1hbmFnZW1lbnQgVG9vbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxzbXRAaWV0Zi5vcmciPmxz bXRAaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0 OyZndDsgVGl0bGU6IExpYWlzb24gU3RhdGVtZW50IHRvIElFVEYgb24gVVJJIHNpZ25pbmc8YnI+ DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgQm9keTogQXQgdGhlIDExM3RoIE1QRUcg bWVldGluZyBNUEVHIGV4cGVydHMgdG9vayBub3RlIG9mIHRoZSBuZXcgZHJhZnQgJnF1b3Q7VVJJ IFNpZ25pbmcgZm9yIEhUVFAgQWRhcHRpdmUgU3RyZWFtaW5nJnF1b3Q7LiBUaGlzIGRvY3VtZW50 IHNwZWNpZmljYWxseSBhZGRyZXNzZXMgdGhlIHVzZSBjYXNlIG9mIHNlZ21lbnRlZCBjb250ZW50 IGluIHRoZSBjb250ZXh0IG9mIFVSSSBTaWduaW5nLiBNUEVHIGV4cGVydHMgcHJvZ3Jlc3NlZCBy ZWdhcmRpbmcgdGhlDQogaW50ZWdyYXRpb24gb2YgVVJJIFNpZ25pbmcgZXh0ZW5zaW9uIGZvciBz ZWdtZW50ZWQgY29udGVudCBpbiBNUEVHIERBU0guIEluIGRpc2N1c3Npb24gd2UgaGFkIHNldmVy YWwgY29tbWVudHMgYW5kIG9ic2VydmF0aW9ucyB0aGF0IE1QRUcgZXhwZXJ0cyB3b3VsZCBsaWtl IHRvIHNoYXJlIHdpdGggdGhlIElFVEYgQ0ROSSB3b3JraW5nIGdyb3VwLiBNUEVHIHdlbGNvbWUg Y29tbWVudHMgYW5kIGZlZWRiYWNrIG9uIHRoZSByZXBvcnRlZCBwcm9ncmVzcy48YnI+DQomZ3Q7 Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgSW50ZWdyYXRlZCB3b3JrZmxvdzxicj4NCiZndDsm Z3Q7Jmd0OyBNUEVHIGV4cGVydHMgcmVhY2hlZCBjb25zZW5zdXMgb24gcmVjb21tZW5kaW5nIHRo ZSBmb2xsb3dpbmcgc3RlcHMgZm9yIHRoZSBpbnRlZ3JhdGlvbiBvZiBVUkkgU2lnbmluZyBleHRl bnNpb24gZm9yIHNlZ21lbnRlZCBjb250ZW50IGFuZCBjbGllbnQgYXV0aGVudGljYXRpb24gYW5k IGF1dGhvcmlzYXRpb24gc2NoZW1lIChFeGFtcGxlIG9mIHN1Y2ggYSBzY2hlbWUgaXMgdGhlIE9u bGluZSBNdWx0aW1lZGlhIEF1dGhvcml6YXRpb24gUHJvdG9jb2wNCiAoT01BUCkgcHVibGljbHkg YXZhaWxhYmxlIG9ubGluZSkuPGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IDEu Jm5ic3A7ICZuYnNwOyBUaGUgc2VydmljZSBwcm92aWRlciBjaG9zZXMgYSBnaXZlbiBjbGllbnQg YXV0aGVudGljYXRpb24gYW5kIGF1dGhvcmlzYXRpb24gc2NoZW1lIHRvIHByb3RlY3QgdGhlIGFj Y2VzcyB0byB0aGUgTVBELiBUaGUgYXBwbGljYXRpb24gYXJvdW5kIHRoZSBEQVNIIGNsaWVudCB0 YWtlcyBjYXJlIG9mIGltcGxlbWVudGluZyB0aGUgcHJvdG9jb2wgaW4gb3JkZXIgdG8gc3VjY2Vz c2Z1bGx5IHJlY2VpdmUgdGhlIE1QRC48YnI+DQomZ3Q7Jmd0OyZndDsgMi4mbmJzcDsgJm5ic3A7 IFRoZSBpbml0aWFsIHNlZ21lbnQgYWNjZXNzIHRva2VuIGlzIHByb3ZpZGVkIGVpdGhlciBpbiB0 aGUgSFRUUCByZXNwb25zZSBvZiB0aGUgTVBEIG9yIHdpdGhpbiB0aGUgTVBEIGl0c2VsZi48YnI+ DQomZ3Q7Jmd0OyZndDsgMy4mbmJzcDsgJm5ic3A7IFRoZSBNUEQgY29udGFpbnMgYXBwcm9wcmlh dGUgaW5zdHJ1Y3Rpb25zIHdoaWNoIHNpZ25hbCB0byB0aGUgREFTSCBjbGllbnQgd2hlcmUgdGhl IHNlZ21lbnQgYWNjZXNzIHRva2VuIG11c3QgYmUgZXh0cmFjdGVkIGZyb20sIGUuZy4gZWl0aGVy IGZyb20gSFRUUCBoZWFkZXIgb2Ygc2VnbWVudCByZXNwb25zZXMuIEluIGFkZGl0aW9uLCB0aGlz IHNpZ25hbGxpbmcgaW5zdHJ1Y3RzIHRoZSBEQVNIIGNsaWVudCB0byBpbnNlcnQgdGhpcw0KIHNl Z21lbnQgdG9rZW4gYmFjayBpbiBzZWdtZW50IHJlcXVlc3RzIGFzIGEgcXVlcnkgc3RyaW5nIHBh cmFtZXRlci4gTm90ZSB0aGF0IE1QRUcgaW5jbHVkZWQgdGhpcyBnZW5lcmljIG1lY2hhbmlzbSBv ZiB0cmFuc3BhcmVudCBwYXJhbWV0ZXIgcGFzc2luZyBpbiBhbiBvbmdvaW5nIGFtZW5kbWVudCBv ZiBNUEVHIERBU0ggcGFydCAxLiBUaGlzIGRvY3VtZW50IHNob3VsZCByZWFjaCBwdWJsaWNhdGlv biBpbiB0aGUgY291cnNlIG9mIDIwMTYuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBJIHdv bmRlciBpZiBNUEVHIGFsc28gY29uc2lkZXJlZCBzZXR0aW5nIHRoZSB0b2tlbiBpbiBhIGNvb2tp ZSwgZS5nLiBvbiB0aGUgTVBEIHJlc3BvbnNlPyBGb3IgdGhlIHNpdHVhdGlvbnMgd2hlcmUgaXQg d29ya3MqIGl04oCZcyBhIGJldHRlciBvcHRpb24gdGhhbiBxdWVyeSBwYXJhbWV0ZXJzIElNTyBh bmQgbWVhbnMgdGhlIGNsaWVudCBkb2VzbuKAmXQgaGF2ZSB0byBkbyBhbnl0aGluZyBzcGVjaWFs IHRvIGhhdmUgdGhlIHRva2VuIGluc2VydGVkDQogb24gZXZlcnkgcmVxdWVzdCBhcyB0aGUgSFRU UCBzdGFjayB3aWxsIGRvIHRoYXQgYXMgcGFydCBvZiBIVFRQLjxicj4NCiZndDsmZ3Q7PGJyPg0K Jmd0OyZndDsgKmNvb2tpZXMgZG9u4oCZdCB3b3JrIGluIGFsbCBlbnZpcm9ubWVudHMsIGUuZy4g YmxvY2tlcnMgb24gYnJvd3NlcnMgb3IgY2xpZW50cyB3aGVyZSB0aGUgcGxheWVyIGhhcyBhbiBp bmRlcGVuZGVudCBjb29raWUgamFyIHRvIHRoZSByZXN0IG9mIHRoZSBhcHAvYnJvd3NlciBidXQg aWYgeW914oCZcmUgZ29pbmcgdG8gZG8gc29tZXRoaW5nIGxpa2UgaW5zZXJ0IHRoZSB0b2tlbiBp bnRvIHRoZSByZXF1ZXN0IHVzaW5nIHNwZWNpYWwgY2xpZW50IGhhbmRsaW5nDQogYW55d2F5LCB5 b3UgY291bGQgZG8gdGhlIHNhbWUgZm9yIGEgY29va2llIGFuZCBoYXZlIHRoZSBiZW5lZml0IG9m IG9ubHkgaGF2aW5nIHRvIGRvIGl0IG9uY2UgcmF0aGVyIHRoYW4gb25jZSBwZXIgc2VnbWVudC48 YnI+DQomZ3Q7PGJyPg0KJmd0OyBBZ3JlZWQuPGJyPg0KJmd0Ozxicj4NCiZndDsgTXkgZmVlbGlu ZyBpcyB5b3UnZCB3YW50IGJvdGggYSBjb29raWUtYmFzZWQgYXMgd2VsbCBhcyBhIHF1ZXJ5IHBh cmFtZXRlci1iYXNlZCBzb2x1dGlvbi4gVGhlIGNvb2tpZS1iYXNlZCB2ZXJzaW9uIGZvciBsZWdh Y3kgY2xpZW50cywgYW5kIGEgcXVlcnktYmFzZWQgdmVyc2lvbiBpbiBjYXNlcyB3aGVyZSBjb29r aWUncyBkb24ndCB3b3JrLiBJbiB0aGUgdXJpLXNpZ25pbmctZm9yLUhBUyBkcmFmdCBJJ3ZlIGFk ZGVkIGEgZmxhZyB0byBhbGxvdw0KIHRoZSBDRE4vQ1NQIHRvIGNvbW11bmljYXRlIHdoaWNoIG1l Y2hhbmlzbSBzaG91bGQgYmUgYXBwbGllZC48YnI+DQomZ3Q7PGJyPg0KJmd0OyZndDs8YnI+DQom Z3Q7Jmd0OyZndDsgNC4mbmJzcDsgJm5ic3A7IFRoZSBzZWdtZW50IGFjY2VzcyB0b2tlbiBpcyBu b3QgbWVhbnQgdG8gYmUgdmFsaWRhdGVkIGJ5IHRoZSBhdXRob3JpemF0aW9uIHByb3ZpZGVyIGJ1 dCBzb2xlbHkgYnkgdGhlIENETiB0byBndWFyYW50ZWUgYW4gZWFzaWx5IHNjYWxhYmxlIGFuZCBz dGF0ZWxlc3MgdmFsaWRhdGlvbi4gVG8gdGhpcyBlbmQsIE1QRUcgZXhwZXJ0cyBhY2tub3dsZWRn ZWQgdGhlIG5lZWQgb2YgYSBwYXJhbWV0ZXIgZnVuY3Rpb25hbGx5IGVxdWl2YWxlbnQNCiB0byB0 aGUgUGF0aCBQYXR0ZXJuIGRlZmluZWQgaW4gdGhlIFVSSSBTaWduaW5nIGZvciBIVFRQIEFkYXB0 aXZlIFN0cmVhbWluZy4gQXMgYSByZXN1bHQsIHRoZSBVUkkgU2lnbmluZyBmb3IgSFRUUCBBZGFw dGl2ZSBTdHJlYW1pbmcgc2VlbXMgdG8gZnVsZmlsIHRoZSBpZGVudGlmaWVkIHJlcXVpcmVtZW50 cyBhbmQgd2lsbCBiZSBjb25zaWRlcmVkIGZvciBmdXJ0aGVyIHdvcmsuPGJyPg0KJmd0OyZndDsm Z3Q7PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IEZ1cnRoZXJtb3JlLCBoZXJl IGFyZSBjb21tZW50cyBmcm9tIE1QRUcgZXhwZXJ0cyBvbiB0aGUgVVJJIFNpZ25pbmcgZm9yIEhU VFAgQWRhcHRpdmUgU3RyZWFtaW5nIGRyYWZ0Ljxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsm Z3Q7Jmd0OyBMb25nLXRlcm0gdG9rZW5zIChpbnRvIHNlbnRlbmNlcyk8YnI+DQomZ3Q7Jmd0OyZn dDsgU29tZSBEQVNIIHNlcnZpY2VzIG1heSB1c2UgbG9uZy10ZXJtIHRva2VucyB0byByZXF1ZXN0 IHNlZ21lbnRzLCB3aGVyZSBsb25nLXRlcm0gdHlwaWNhbGx5IG1lYW5zIGNvdXBsZSBvZiBob3Vy cyB0byBzZXZlcmFsIGRheXMuIEluIHRoaXMgc2NlbmFyaW8sIGFkZGl0aW9uYWwgdG9rZW5zIChu b3QgVVJJIFNpZ25lZCBUb2tlbikgYXJlIHNlbnQgYWxvbmcgdG8gZW5mb3JjZSBjbGllbnQgYXV0 aGVudGljYXRpb24uIEFzIGEgcmVzdWx0LCByZWZyZXNoaW5nDQogdGhlIFVSSSBTaWduZWQgVG9r ZW4gYXQgZXZlcnkgcmVxdWVzdCBtYXkgc2VlbSBzdXBlcmZsdW91cy4gTVBFRyBleHBlcnRzIHdv dWxkIGxpa2UgdG8ga25vdyB0aGUgb3BpbmlvbiBvZiB0aGUgSUVURiBDRE5JIHdvcmtpbmcgZ3Jv dXAgb24gdGhpcyBzY2VuYXJpbyBhbmQgd2hldGhlciB0aGUgdmFsaWRhdGlvbiBtZWNoYW5pc20g Y291bGQgYmUgYWRhcHRlZCwgZS5nLiBieSBzaWduYWxsaW5nIHdoZW4gdGhlIENETiBtdXN0IHJl Z2VuZXJhdGUgYQ0KIG5ldyBVUkkgU2lnbmVkIFRva2VuLjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0 OyZndDsgQSBzaW5nbGUgdG9rZW4gY2FuIGJlIGdpdmVuIGEgbG9uZyBleHBpcnkgdGltZSBzbyBJ 4oCZbSBub3QgY29tcGxldGVseSBjZXJ0YWluIHdoYXQgdGhlIE1QRUcgdXNlIGNhc2UgaXMuIFRo YXQgcHJvdmlkZXMgYSBsb25nIHRpbWUgaW4gd2hpY2ggYSB0b2tlbiBjb3VsZCBiZSBwYXNzZWQg dG8gc29tZW9uZSBlbHNlLCB3aGljaCBkcm92ZSB0aGUgaWRlYSBvZiBjaGFuZ2luZyB0aGUgdG9r ZW4gZnJvbSB0aGUgQ0ROIHNpZGUgb24gZXZlcnkgc2VnbWVudA0KIHdoaWNoIHJlZHVjZXMgdGhl IGV4cG9zdXJlIHRpbWUgdG8gdGhlIG1pbmltdW0gcG9zc2libGUuIEl0IHNlZW1zIHRoYXQgd2hh dCBNUEVHIGlzIGFza2luZyBmb3IgaXMgdGhlIGFiaWxpdHkgdG8gdHVuZSB0aGUgZXhwb3N1cmUg dGltZS48YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IElNTyBpdCBzb3VuZHMgYSBuaWNlIGtu b2IgdG8gaGF2ZSBpbiB0aGVvcnksIGJ1dCBJ4oCZbSB3b25kZXJpbmcgd2h5IHNvbWVvbmUgd291 bGQgYWN0dWFsbHkgdHVuZSBpdCBpbiBwcmFjdGljZS4gR2VuZXJhdGluZyB0b2tlbnMgaXMgcHJl dHR5IGNoZWFwLCBpdOKAmXMgYmFzaWNhbGx5IGEgc2luZ2xlIGNhbGwgdG8gYSBTSEEgaGFzaCBm dW5jdGlvbi4gSSB0aGluayBpdCBhbHNvIGluY3JlYXNlcyB0aGUgaW1wbGVtZW50YXRpb24gY29t cGxleGl0eQ0KIHNpZ25pZmljYW50bHkuIFdpdGggYSBsb25nIHVzZSBzaW5nbGUgdG9rZW4gb3Ig d2l0aCByZS13cml0aW5nIHRoZSB0b2tlbiBvbiBldmVyeSBzZWdtZW50IHRoZSBDRE4gY2FuIHBy b2Nlc3MgZWFjaCByZXF1ZXN0IGluZGVwZW5kZW50bHkuIFdpdGggYSB0b2tlbiB0aGF0IGNoYW5n ZXMgYWZ0ZXIgYSB2YXJpYWJsZSBudW1iZXIgb2Ygc2VnbWVudHMsIHRoZSBDRE4gbm93IG5lZWRz IHRvIGtlZXAgc3RhdGUgYWJvdXQgaG93IG1hbnkgdGltZXMgaXQNCiBoYXMgc2VlbiB0aGUgdG9r ZW4gYWxyZWFkeSBhbmQgbmVlZHMgdG8gY28tb3JkaW5hdGUgdGhhdCBzdGF0ZSBhY3Jvc3MgdGhl IENETiBpbiBjYXNlIHNvbWUgb2YgdGhlIHJlcXVlc3RzIGdvIHRvIGRpZmZlcmVudCBzdXJyb2dh dGVzLCBldGMuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBJdCBzb3VuZHMgbGlrZSBhIGxv dCBvZiBjb21wbGV4aXR5IGZvciBsaXR0bGUgcmVhbCBiZW5lZml0IElNTy48YnI+DQomZ3Q7PGJy Pg0KJmd0OyBGdWxseSBhZ3JlZS48YnI+DQomZ3Q7PGJyPg0KJmd0OyAoT25lIHdheSB0byBpbXBs ZW1lbnQgaXQgd291bGQgYmUgdG8gaGF2ZSBzb21lIHNvcnQgb2YgRXhwaXJhdGlvbiBUaW1lIFRo cmVzaG9sZCB0byBpbmRpY2F0ZSB3aGVuIHRoZSBDRE4gc2hvdWxkIHJlZnJlc2ggdGhlIHRva2Vu LCBidXQgdGhhdCB3b3VsZCByZXN1bHQgaW4gYWxsIGtpbmRzIG9mIGlzc3Vlcywgc3VjaCBhcyBl ZmZlY3RpdmVseSBoYXZpbmcgdmFyaWFibGUgdG9rZW4gbGVuZ3RocyB3aGljaCB3aWxsIGNhdXNl IGlzc3VlcyBpbg0KIGNhc2VzIG9mIHByb2xvbmdlZCBwYXVzZSk8YnI+DQomZ3Q7PGJyPg0KJmd0 OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgTmFtZSBjb2xsaXNpb248YnI+DQomZ3Q7Jmd0OyZndDsg TVBFRyBleHBlcnRzIHVuZGVyc3RhbmQgdGhhdCB0aGUgbmFtZSBVUklTaWduaW5nUGFja2FnZSwg YXMgYSBxdWVyeSBzdHJpbmcsIGFzIGFuIEhUVFAgaGVhZGVyIHBhcmFtZXRlciBvciBpbiBhIGNv b2tpZSwgY29uc3RpdHV0ZXMgYSBub3JtYXRpdmUgYXNwZWN0IG9mIHRoZSBVUkkgU2lnbmluZyBz cGVjaWZpY2F0aW9uLiBNUEVHIGV4cGVydHMgd291bGQgbGlrZSB0byBrbm93IHdoZXRoZXIgdGhl IElFVEYgQ0ROSSB3b3JraW5nIGdyb3VwDQogaGFzIGRlY2lkZWQgdGhlIGFwcHJvcHJpYXRlIGFw cHJvYWNoIHRvIHByZXZlbnQgbmFtZSBjb2xsaXNpb24uPGJyPg0KJmd0Ozxicj4NCiZndDsgVGhl IGN1cnJlbnQgYmFzZSBVUkkgc2lnbmluZyBzcGVjIGFscmVhZHkgYWxsb3dzIG92ZXJyaWRpbmcg dGhlIFVSSVNpZ25pbmdQYWNrYWdlIHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIgYmFzZWQgb24gZS5n LiBNZXRhZGF0YS4gSW4gY2FzZSBvZiBEQVNILCBhbmQgY2xpZW50cyBoYXZpbmcgdG8ga25vdyB0 aGlzIG5hbWUsIEkgdGhpbmsgdGhlIGJlc3Qgc29sdXRpb24gd291bGQgYmUgdG8ganVzdCBjb252 ZXkgaXQgaW4gdGhlIE1QRC48YnI+DQomZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZn dDsmZ3Q7IENvbnNlY3V0aXZlIHRva2Vuczxicj4NCiZndDsmZ3Q7Jmd0OyBBY2NvcmRpbmcgdG8g dGhlIFVSSSBTaWduaW5nIGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZyBkcmFmdCwgdGhlIHNl cnZlciBtYXkgaXNzdWUgbXVsdGlwbGUgdG9rZW5zIGFuZCBkZWxpdmVyZWQgdGhlbSBpbiBjb25z ZWN1dGl2ZSBIVFRQIHJlcXVlc3RzLiBJdCBkb2VzIG5vdCBzZWVtIHRoYXQgdGhlcmUgaXMgYSBk ZXBlbmRlbmN5IGJldHdlZW4gdGhlIHRva2Vucy4gQ291bGQgSUVURiBleHBlcnQgY29uZmlybSB0 aGF0IGEgdG9rZW4NCiBpc3N1ZWQgYXQgdGltZSB0IGRvZXMgbm90IGludmFsaWRhdGUgYSB0b2tl biBpc3N1ZWQgcHJpb3IgdG8gdGltZSB0ID88YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IElu IHRoZSAzIHRva2VuIGltcGxlbWVudGF0aW9ucyBJIGFtIGZhbWlsaWFyIHdpdGggdG9rZW5zIGFy ZSBjb21wbGV0ZWx5IGluZGVwZW5kZW50IGFuZCBhIHRva2VuIGlzc3VlZCBhdCB0aW1lIHQgZG9l cyBub3QgaW52YWxpZGF0ZSBhIHRva2VuIGlzc3VlZCBwcmlvciB0byB0aW1lIHQuPGJyPg0KJmd0 Ozxicj4NCiZndDsgQWdyZWVkLiBBcGFydCBmcm9tIGhhdmluZyB0byBrZWVwIGFuZCBzeW5jaHJv bmlzZSBzdGF0ZSBhY3Jvc3Mgbm9kZXMsIEkgZG9uJ3Qgc2VlIGhvdyB5b3UgY291bGQgZXZlbiBp bXBsZW1lbnQgaXQuPGJyPg0KJmd0Ozxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsgQmVuPGJy Pg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7 Jmd0OyZndDsgTVBFRyBraW5kbHkgYXNrcyB0aGUgSUVURiBDRE5JIHdvcmtpbmcgZ3JvdXAgdG8g Y29uc2lkZXIgdGhlIGFib3ZlIG9ic2VydmF0aW9ucyBhbmQgd2VsY29tZSBmdXJ0aGVyIGNvbGxh Ym9yYXRpb24gb24gdGhpcyB0b3BpYy48YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZn dDs8YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgT3VyIGZ1dHVyZSBtZWV0aW5n czo8YnI+DQomZ3Q7Jmd0OyZndDsgLSZuYnNwOyAmbmJzcDsgREFTSCBBZC1ob2MgbWVldGluZ3Ms IDIxIEZlYnJ1YXJ5IDIwMTYsIFNhbiBEaWVnbywgQ0E8YnI+DQomZ3Q7Jmd0OyZndDsgLSZuYnNw OyAmbmJzcDsgVGhlIDExNHRoIE1QRUcgbWVldGluZywgMjIgLSAyNiBGZWJydWFyeSAyMDE2LCBT YW4gRGllZ28sIENBPGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0 OyZndDsmZ3Q7IEF0dGFjaG1lbnRzOjxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0 OyZuYnNwOyAyOW4xNTM4MTE8YnI+DQomZ3Q7Jmd0OyZndDsmbmJzcDsgPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbGliL2R0L2RvY3VtZW50cy9MSUFJU09OL2xpYWlzb24tMjAxNS0xMS0w Mi1pc28taWVjLWp0YzEtc2MyOS13ZzExLWNkbmktbGlhaXNvbi1zdGF0ZW1lbnQtdG8taWV0Zi1v bi11cmktc2lnbmluZy1hdHRhY2htZW50LTEuZG9jIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczov L3d3dy5pZXRmLm9yZy9saWIvZHQvZG9jdW1lbnRzL0xJQUlTT04vbGlhaXNvbi0yMDE1LTExLTAy LWlzby1pZWMtanRjMS1zYzI5LXdnMTEtY2RuaS1saWFpc29uLXN0YXRlbWVudC10by1pZXRmLW9u LXVyaS1zaWduaW5nLWF0dGFjaG1lbnQtMS5kb2M8L2E+PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0K Jmd0OyZndDsmZ3Q7Jm5ic3A7IDI5bjE1MzgxMSBodG08YnI+DQomZ3Q7Jmd0OyZndDsmbmJzcDsg PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbGliL2R0L2RvY3VtZW50cy9MSUFJU09OL2xp YWlzb24tMjAxNS0xMS0wMi1pc28taWVjLWp0YzEtc2MyOS13ZzExLWNkbmktbGlhaXNvbi1zdGF0 ZW1lbnQtdG8taWV0Zi1vbi11cmktc2lnbmluZy1hdHRhY2htZW50LTIuaHRtIiB0YXJnZXQ9Il9i bGFuayI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9saWIvZHQvZG9jdW1lbnRzL0xJQUlTT04vbGlh aXNvbi0yMDE1LTExLTAyLWlzby1pZWMtanRjMS1zYzI5LXdnMTEtY2RuaS1saWFpc29uLXN0YXRl bWVudC10by1pZXRmLW9uLXVyaS1zaWduaW5nLWF0dGFjaG1lbnQtMi5odG08L2E+PGJyPg0KJmd0 OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyZndDsmZ3Q7IENETmkgbWFpbGluZyBsaXN0PGJy Pg0KJmd0OyZndDsmZ3Q7IDxhIGhyZWY9Im1haWx0bzpDRE5pQGlldGYub3JnIj5DRE5pQGlldGYu b3JnPC9hPjxicj4NCiZndDsmZ3Q7Jmd0OyA8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2NkbmkiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2Nkbmk8L2E+PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZndDsm Z3Q7IENETmkgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyZndDsgPGEgaHJlZj0ibWFpbHRvOkNETmlA aWV0Zi5vcmciPkNETmlAaWV0Zi5vcmc8L2E+PGJyPg0KJmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pIiB0YXJnZXQ9Il9ibGFuayI+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pPC9hPjxicj4NCiZndDsgVGhp cyBtZXNzYWdlIG1heSBjb250YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZv ciB5b3UuIElmIHlvdSBhcmUgbm90IHRoZSBhZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdh cyBzZW50IHRvIHlvdSBieSBtaXN0YWtlLCB5b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhl IHNlbmRlciBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkg Zm9yIHRoZSBjb250ZW50IG9mIHRoaXMNCiBlLW1haWwsIGZvciB0aGUgbWFubmVyIGluIHdoaWNo IHlvdSB1c2UgaXQgYW5kIGZvciBkYW1hZ2Ugb2YgYW55IGtpbmQgcmVzdWx0aW5nIGZyb20gdGhl IHJpc2tzIGluaGVyZW50IHRvIHRoZSBlbGVjdHJvbmljIHRyYW5zbWlzc2lvbiBvZiBtZXNzYWdl cy48YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCkNETmkgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkNETmlAaWV0 Zi5vcmciPkNETmlAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9jZG5pIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A419F67F880AB2468214E154CB8A556206C0FB6Ceusaamb103erics_-- From nobody Mon Dec 14 08:58:19 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD9821ACCD8 for ; Mon, 14 Dec 2015 08:58:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.401 X-Spam-Level: * X-Spam-Status: No, score=1.401 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001, J_CHICKENPOX_44=0.6] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KH4BIdBlw6gE for ; Mon, 14 Dec 2015 08:58:12 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.144]) by ietfa.amsl.com (Postfix) with ESMTP id 17B5F1ACCE4 for ; Mon, 14 Dec 2015 08:58:11 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a8WRt-0001E5-1b; Mon, 14 Dec 2015 16:58:10 +0000 Content-Type: multipart/alternative; boundary="Apple-Mail=_7150624A-0755-4566-BA3B-F375AE51F995" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: Date: Mon, 14 Dec 2015 16:58:06 +0000 Message-Id: References: <20151103041227.25387.93653.idtracker@ietfa.amsl.com> <33E9CB3F-A487-43C1-B20E-E8D779A6BB58@niven-jenkins.co.uk> <3862FEAC-05EE-490B-94AD-3B8C9A5D6CD3@tno.nl> <7C569AF8-E5CE-4C10-9056-03497D3A6AAB@niven-jenkins.co.uk> <6CB10B3D-1EBD-4DA6-818B-6DB95109C7FB@niven-jenkins.co.uk> To: Kevin Ma J X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: Content Delivery Networks Interconnection Discussion List , Watanabe Shinji Subject: Re: [CDNi] New Liaison Statement, "Liaison Statement to IETF on URI signing" X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 16:58:17 -0000 --Apple-Mail=_7150624A-0755-4566-BA3B-F375AE51F995 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Kevin, > On 10 Dec 2015, at 18:56, Kevin Ma J wrote: >=20 > Hi Ben/All, > =20 > (as a chair) I was preparing a liaison response and going back = through the list discussions, and (as an individual) I had a clarifying = question about the token refresh (which is now only part of Ray's = individual draft): > =20 > > With a token that changes after a variable number of segments, the = CDN now needs to keep state about how many times it has seen the token = already and needs to co-ordinate that state across the CDN in case some = of the requests go to different surrogates, etc. > =20 > When we say "state" here, are we talking about session state? I=E2=80=99m not sure if it would count as session state. If a CDN needs = to know how many times it has seen a token, it needs to store = information across requests (count of times it has seen the token). = It=E2=80=99s that storage of information across requests that I mean by = state. > Would it need anything more than a new metadata variable that says = "the CDN SHOULD only generate a new token if the current token is less = than X seconds away from expiring", where X is an integer value conveyed = in the metadata? That would remove the need to maintain state but might introduce other = effects depending on the use case, e.g. if X is too short maybe the = token expires before the client presents it to the CDN again. I=E2=80=99m sure it could be made to work if X was selected with care = but I=E2=80=99m still unconvinced of how much it is really needed, i.e. = how many use cases require the CDN to refresh the token periodically but = where a period of =E2=80=9Cevery request=E2=80=9D would be detrimental/a = perceivable overhead? =20 > And wrt notifying the client of the value of X, I think that would = be out-of-scope for CDNI? I=E2=80=99d assume the client doesn=E2=80=99t need to know the value of = X, it just makes requests like it would normally does it not? Ben > =20 > thanx! > =20 > -- Kevin J. Ma > =20 > =20 > From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Ben = Niven-Jenkins > Sent: Wednesday, November 04, 2015 1:12 PM > To: c^ > Cc: Content Delivery Networks Interconnection Discussion List; = Watanabe Shinji > Subject: Re: [CDNi] New Liaison Statement, "Liaison Statement to IETF = on URI signing" > =20 > Craig, > =20 > On 3 Nov 2015, at 12:21, c^ > = wrote: > =20 > Cookie use also creates other dependencies when using MSE such as = crossdomain/CORS which can be problematic in certain deployments. > Query string based is more portable... > But not without its own set of issues. There is no single answer here = IMO. BTW I wasn=E2=80=99t trying to suggest that MPEG avoid query = parameters and use cookies instead but to ponder whether they=E2=80=99d = considered cookies as part of the solution space as if it was considered = and discounted I=E2=80=99d be interested in what led to that choice. >=20 >=20 > WRT generating tokens being 'cheap'; consider the flash crowds = associated with news events on live streams. Token generation in these = circumstance is very different to the moderate peak:mean in on-demand = video workflows. > Sure but such flash crowds put stress on the whole delivery chain and = I highly suspect that the overhead of generating tokens will not be the = weakest link that causes a flash crowd to impact a streaming service. >=20 >=20 > The trade off being an extended time limited token being 'good = enough'=E2=80=A6 > That was part of my point. If one has the option to create a long = lived single token and one has the option to chain tokens on each = request then I=E2=80=99m struggling to understand what benefit there is = to having a third option that is somewhere in the middle. >=20 > I can go into some of these considerations further off list=E2=80=A6 > I=E2=80=99d certainly be interested in discussing this stuff more = either on or off list. > =20 > Ben >=20 >=20 > CraigT > -- > c%5e > On 3 Nov 2015 20:20, "Ben Niven-Jenkins" > wrote: > Ray, >=20 > I wouldn't signal to the CDN whether it should expect the token in a = cookie or a query param, if it was me I'd spec it so the CDN has to = support both and a rule for which of cookie or query param to use if = both are present. >=20 > Ben >=20 > > On 3 Nov 2015, at 08:58, Brandenburg, R. (Ray) van = > wrote: > > > > Hi all, > > > > I've added my comments below. > > > > Ray > > > > > > > >> On 03/11/15 08:53, "CDNi on behalf of Ben Niven-Jenkins" = on behalf of = ben@niven-jenkins.co.uk > wrote: > >> > >> Colleagues, > >> > >> My 2p (=C2=A53.7) inline > >> > >> > >>> On 3 Nov 2015, at 04:12, Liaison Statement Management Tool = > wrote: > >>> > >>> Title: Liaison Statement to IETF on URI signing > >>> > >>> Body: At the 113th MPEG meeting MPEG experts took note of the new = draft "URI Signing for HTTP Adaptive Streaming". This document = specifically addresses the use case of segmented content in the context = of URI Signing. MPEG experts progressed regarding the integration of URI = Signing extension for segmented content in MPEG DASH. In discussion we = had several comments and observations that MPEG experts would like to = share with the IETF CDNI working group. MPEG welcome comments and = feedback on the reported progress. > >>> > >>> Integrated workflow > >>> MPEG experts reached consensus on recommending the following steps = for the integration of URI Signing extension for segmented content and = client authentication and authorisation scheme (Example of such a scheme = is the Online Multimedia Authorization Protocol (OMAP) publicly = available online). > >>> > >>> 1. The service provider choses a given client authentication = and authorisation scheme to protect the access to the MPD. The = application around the DASH client takes care of implementing the = protocol in order to successfully receive the MPD. > >>> 2. The initial segment access token is provided either in the = HTTP response of the MPD or within the MPD itself. > >>> 3. The MPD contains appropriate instructions which signal to = the DASH client where the segment access token must be extracted from, = e.g. either from HTTP header of segment responses. In addition, this = signalling instructs the DASH client to insert this segment token back = in segment requests as a query string parameter. Note that MPEG included = this generic mechanism of transparent parameter passing in an ongoing = amendment of MPEG DASH part 1. This document should reach publication in = the course of 2016. > >> > >> I wonder if MPEG also considered setting the token in a cookie, = e.g. on the MPD response? For the situations where it works* it=E2=80=99s = a better option than query parameters IMO and means the client doesn=E2=80= =99t have to do anything special to have the token inserted on every = request as the HTTP stack will do that as part of HTTP. > >> > >> *cookies don=E2=80=99t work in all environments, e.g. blockers on = browsers or clients where the player has an independent cookie jar to = the rest of the app/browser but if you=E2=80=99re going to do something = like insert the token into the request using special client handling = anyway, you could do the same for a cookie and have the benefit of only = having to do it once rather than once per segment. > > > > Agreed. > > > > My feeling is you'd want both a cookie-based as well as a query = parameter-based solution. The cookie-based version for legacy clients, = and a query-based version in cases where cookie's don't work. In the = uri-signing-for-HAS draft I've added a flag to allow the CDN/CSP to = communicate which mechanism should be applied. > > > >> > >>> 4. The segment access token is not meant to be validated by the = authorization provider but solely by the CDN to guarantee an easily = scalable and stateless validation. To this end, MPEG experts = acknowledged the need of a parameter functionally equivalent to the Path = Pattern defined in the URI Signing for HTTP Adaptive Streaming. As a = result, the URI Signing for HTTP Adaptive Streaming seems to fulfil the = identified requirements and will be considered for further work. > >>> > >>> > >>> Furthermore, here are comments from MPEG experts on the URI = Signing for HTTP Adaptive Streaming draft. > >>> > >>> Long-term tokens (into sentences) > >>> Some DASH services may use long-term tokens to request segments, = where long-term typically means couple of hours to several days. In this = scenario, additional tokens (not URI Signed Token) are sent along to = enforce client authentication. As a result, refreshing the URI Signed = Token at every request may seem superfluous. MPEG experts would like to = know the opinion of the IETF CDNI working group on this scenario and = whether the validation mechanism could be adapted, e.g. by signalling = when the CDN must regenerate a new URI Signed Token. > >> > >> A single token can be given a long expiry time so I=E2=80=99m not = completely certain what the MPEG use case is. That provides a long time = in which a token could be passed to someone else, which drove the idea = of changing the token from the CDN side on every segment which reduces = the exposure time to the minimum possible. It seems that what MPEG is = asking for is the ability to tune the exposure time. > >> > >> IMO it sounds a nice knob to have in theory, but I=E2=80=99m = wondering why someone would actually tune it in practice. Generating = tokens is pretty cheap, it=E2=80=99s basically a single call to a SHA = hash function. I think it also increases the implementation complexity = significantly. With a long use single token or with re-writing the token = on every segment the CDN can process each request independently. With a = token that changes after a variable number of segments, the CDN now = needs to keep state about how many times it has seen the token already = and needs to co-ordinate that state across the CDN in case some of the = requests go to different surrogates, etc. > >> > >> It sounds like a lot of complexity for little real benefit IMO. > > > > Fully agree. > > > > (One way to implement it would be to have some sort of Expiration = Time Threshold to indicate when the CDN should refresh the token, but = that would result in all kinds of issues, such as effectively having = variable token lengths which will cause issues in cases of prolonged = pause) > > > >> > >>> Name collision > >>> MPEG experts understand that the name URISigningPackage, as a = query string, as an HTTP header parameter or in a cookie, constitutes a = normative aspect of the URI Signing specification. MPEG experts would = like to know whether the IETF CDNI working group has decided the = appropriate approach to prevent name collision. > > > > The current base URI signing spec already allows overriding the = URISigningPackage query string parameter based on e.g. Metadata. In case = of DASH, and clients having to know this name, I think the best solution = would be to just convey it in the MPD. > > > >>> > >>> Consecutive tokens > >>> According to the URI Signing for HTTP Adaptive Streaming draft, = the server may issue multiple tokens and delivered them in consecutive = HTTP requests. It does not seem that there is a dependency between the = tokens. Could IETF expert confirm that a token issued at time t does not = invalidate a token issued prior to time t ? > >> > >> In the 3 token implementations I am familiar with tokens are = completely independent and a token issued at time t does not invalidate = a token issued prior to time t. > > > > Agreed. Apart from having to keep and synchronise state across = nodes, I don't see how you could even implement it. > > > >> > >> Ben > >> > >>> > >>> > >>> MPEG kindly asks the IETF CDNI working group to consider the above = observations and welcome further collaboration on this topic. > >>> > >>> > >>> > >>> Our future meetings: > >>> - DASH Ad-hoc meetings, 21 February 2016, San Diego, CA > >>> - The 114th MPEG meeting, 22 - 26 February 2016, San Diego, CA > >>> > >>> > >>> Attachments: > >>> > >>> 29n153811 > >>> = https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2015-11-02-iso-iec-j= tc1-sc29-wg11-cdni-liaison-statement-to-ietf-on-uri-signing-attachment-1.d= oc = > >>> > >>> 29n153811 htm > >>> = https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2015-11-02-iso-iec-j= tc1-sc29-wg11-cdni-liaison-statement-to-ietf-on-uri-signing-attachment-2.h= tm = > >>> > >>> _______________________________________________ > >>> CDNi mailing list > >>> CDNi@ietf.org > >>> https://www.ietf.org/mailman/listinfo/cdni = > >> > >> _______________________________________________ > >> CDNi mailing list > >> CDNi@ietf.org > >> https://www.ietf.org/mailman/listinfo/cdni = > > This message may contain information that is not intended for you. = If you are not the addressee or if this message was sent to you by = mistake, you are requested to inform the sender and delete the message. = TNO accepts no liability for the content of this e-mail, for the manner = in which you use it and for damage of any kind resulting from the risks = inherent to the electronic transmission of messages. >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = --Apple-Mail=_7150624A-0755-4566-BA3B-F375AE51F995 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Kevin,

On 10 Dec 2015, at 18:56, Kevin = Ma J <kevin.j.ma@ericsson.com> wrote:

Hi = Ben/All,
 
  = (as a chair) I was preparing a liaison response and going back through = the list discussions, and (as an individual) I had a clarifying question = about the token refresh (which is now only part of Ray's individual = draft):
 
> With a token that = changes after a variable number of segments, the CDN now needs to keep = state about how many times it has seen the token already and needs to = co-ordinate that state across the CDN in case some of the requests go to = different surrogates, etc.
 
  When we say "state" here, = are we talking about session = state?

I=E2=80=99m not sure if it would count as session = state. If a CDN needs to know how many times it has seen a token, it = needs to store information across requests (count of times it has seen = the token). It=E2=80=99s that storage of information across requests = that I mean by state.

  Would it need anything = more than a new metadata variable that says "the CDN SHOULD only = generate a new token if the current token is less than X seconds away = from expiring", where X is an integer value conveyed in the = metadata?

That would remove the need to maintain state but might = introduce other effects depending on the use case, e.g. if X is too = short maybe the token expires before the client presents it to the CDN = again.

I=E2=80=99m sure it could be = made to work if X was selected with care but I=E2=80=99m still = unconvinced of how much it is really needed, i.e. how many use cases = require the CDN to refresh the token periodically but where a period of = =E2=80=9Cevery request=E2=80=9D would be detrimental/a perceivable = overhead?
 
  And wrt notifying the = client of the value of X, I think that would be out-of-scope for = CDNI?

I=E2=80=99d= assume the client doesn=E2=80=99t need to know the value of X, it just = makes requests like it would normally does it not?

Ben

 
thanx!
 
--  Kevin J. Ma
 
 
From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf = Of Ben = Niven-Jenkins
Sent: Wednesday, November 04, = 2015 1:12 PM
To: c^
Cc: Content Delivery Networks = Interconnection Discussion List; Watanabe Shinji
Subject: Re: [CDNi] New Liaison = Statement, "Liaison Statement to IETF on URI signing"
 
Craig,
 
On 3 = Nov 2015, at 12:21, c^ <c@gryning.com> wrote:
 
Cookie use also creates other dependencies when using MSE = such as crossdomain/CORS which can be problematic in certain = deployments.
Query string based is more portable...
But not without its own set of issues. = There is no single answer here IMO. BTW I wasn=E2=80=99t trying to = suggest that MPEG avoid query parameters and use cookies instead but to = ponder whether they=E2=80=99d considered cookies as part of the solution = space as if it was considered and discounted I=E2=80=99d be interested = in what led to that choice.


WRT generating tokens being 'cheap'; consider the flash = crowds associated with news events on live streams. Token generation in = these circumstance is very different to the moderate peak:mean in = on-demand video workflows.
Sure but such flash = crowds put stress on the whole delivery chain and I highly suspect that = the overhead of generating tokens will not be the weakest link that = causes a flash crowd to impact a streaming service.


The trade off being an extended time = limited token being 'good enough'=E2=80=A6
That = was part of my point. If one has the option to create a long lived = single token and one has the option to chain tokens on each request then = I=E2=80=99m struggling to understand what benefit there is to having a = third option that is somewhere in the middle.

I can go into some of these = considerations further off list=E2=80=A6
I=E2=80= =99d certainly be interested in discussing this stuff more either on or = off list.
 
Ben


CraigT
--
c%5e
On 3 Nov 2015 20:20, "Ben Niven-Jenkins" <ben@niven-jenkins.co.uk> = wrote:
Ray,

I wouldn't signal to the = CDN whether it should expect the token in a cookie or a query param, if = it was me I'd spec it so the CDN has to support both and a rule for = which of cookie or query param to use if both are present.

Ben

> On 3 Nov = 2015, at 08:58, Brandenburg, R. (Ray) van <ray.vanbrandenburg@tno.nl> = wrote:
>
> Hi all,
>> I've added my comments below.
>
> Ray
>
>
>
>> On 03/11/15 08:53, "CDNi on = behalf of Ben Niven-Jenkins" <cdni-bounces@ietf.org on behalf of ben@niven-jenkins.co.uk> = wrote:
>>
>> Colleagues,
>>
>> My 2p (=C2=A53.7) inline
>>
>>
>>> On = 3 Nov 2015, at 04:12, Liaison Statement Management Tool <lsmt@ietf.org> wrote:
>>>
>>> Title: Liaison = Statement to IETF on URI signing
>>>
>>> Body: At the 113th MPEG meeting MPEG experts = took note of the new draft "URI Signing for HTTP Adaptive Streaming". = This document specifically addresses the use case of segmented content = in the context of URI Signing. MPEG experts progressed regarding the = integration of URI Signing extension for segmented content in MPEG DASH. = In discussion we had several comments and observations that MPEG experts = would like to share with the IETF CDNI working group. MPEG welcome = comments and feedback on the reported progress.
>>>
>>> Integrated = workflow
>>> MPEG experts reached consensus on = recommending the following steps for the integration of URI Signing = extension for segmented content and client authentication and = authorisation scheme (Example of such a scheme is the Online Multimedia = Authorization Protocol (OMAP) publicly available online).
>>>
>>> 1.    The = service provider choses a given client authentication and authorisation = scheme to protect the access to the MPD. The application around the DASH = client takes care of implementing the protocol in order to successfully = receive the MPD.
>>> 2.    The initial = segment access token is provided either in the HTTP response of the MPD = or within the MPD itself.
>>> 3.    The = MPD contains appropriate instructions which signal to the DASH client = where the segment access token must be extracted from, e.g. either from = HTTP header of segment responses. In addition, this signalling instructs = the DASH client to insert this segment token back in segment requests as = a query string parameter. Note that MPEG included this generic mechanism = of transparent parameter passing in an ongoing amendment of MPEG DASH = part 1. This document should reach publication in the course of 2016.
>>
>> I wonder if MPEG also = considered setting the token in a cookie, e.g. on the MPD response? For = the situations where it works* it=E2=80=99s a better option than query = parameters IMO and means the client doesn=E2=80=99t have to do anything = special to have the token inserted on every request as the HTTP stack = will do that as part of HTTP.
>>
>> *cookies don=E2=80=99t work in all environments, = e.g. blockers on browsers or clients where the player has an independent = cookie jar to the rest of the app/browser but if you=E2=80=99re going to = do something like insert the token into the request using special client = handling anyway, you could do the same for a cookie and have the benefit = of only having to do it once rather than once per segment.
>
> Agreed.
>
> My feeling is you'd want both a cookie-based as well as = a query parameter-based solution. The cookie-based version for legacy = clients, and a query-based version in cases where cookie's don't work. = In the uri-signing-for-HAS draft I've added a flag to allow the CDN/CSP = to communicate which mechanism should be applied.
>
>>
>>> 4.    The = segment access token is not meant to be validated by the authorization = provider but solely by the CDN to guarantee an easily scalable and = stateless validation. To this end, MPEG experts acknowledged the need of = a parameter functionally equivalent to the Path Pattern defined in the = URI Signing for HTTP Adaptive Streaming. As a result, the URI Signing = for HTTP Adaptive Streaming seems to fulfil the identified requirements = and will be considered for further work.
>>>
>>>
>>> Furthermore, here are = comments from MPEG experts on the URI Signing for HTTP Adaptive = Streaming draft.
>>>
>>> = Long-term tokens (into sentences)
>>> Some DASH = services may use long-term tokens to request segments, where long-term = typically means couple of hours to several days. In this scenario, = additional tokens (not URI Signed Token) are sent along to enforce = client authentication. As a result, refreshing the URI Signed Token at = every request may seem superfluous. MPEG experts would like to know the = opinion of the IETF CDNI working group on this scenario and whether the = validation mechanism could be adapted, e.g. by signalling when the CDN = must regenerate a new URI Signed Token.
>>
>> A single token can be given a long expiry time so = I=E2=80=99m not completely certain what the MPEG use case is. That = provides a long time in which a token could be passed to someone else, = which drove the idea of changing the token from the CDN side on every = segment which reduces the exposure time to the minimum possible. It = seems that what MPEG is asking for is the ability to tune the exposure = time.
>>
>> IMO it sounds a nice = knob to have in theory, but I=E2=80=99m wondering why someone would = actually tune it in practice. Generating tokens is pretty cheap, it=E2=80=99= s basically a single call to a SHA hash function. I think it also = increases the implementation complexity significantly. With a long use = single token or with re-writing the token on every segment the CDN can = process each request independently. With a token that changes after a = variable number of segments, the CDN now needs to keep state about how = many times it has seen the token already and needs to co-ordinate that = state across the CDN in case some of the requests go to different = surrogates, etc.
>>
>> It sounds = like a lot of complexity for little real benefit IMO.
>
> Fully agree.
>
> (One way to implement it would be to have some sort of = Expiration Time Threshold to indicate when the CDN should refresh the = token, but that would result in all kinds of issues, such as effectively = having variable token lengths which will cause issues in cases of = prolonged pause)
>
>>
>>> Name collision
>>> MPEG = experts understand that the name URISigningPackage, as a query string, = as an HTTP header parameter or in a cookie, constitutes a normative = aspect of the URI Signing specification. MPEG experts would like to know = whether the IETF CDNI working group has decided the appropriate approach = to prevent name collision.
>
> The = current base URI signing spec already allows overriding the = URISigningPackage query string parameter based on e.g. Metadata. In case = of DASH, and clients having to know this name, I think the best solution = would be to just convey it in the MPD.
>
>>>
>>> Consecutive tokens
>>> According to the URI Signing for HTTP Adaptive = Streaming draft, the server may issue multiple tokens and delivered them = in consecutive HTTP requests. It does not seem that there is a = dependency between the tokens. Could IETF expert confirm that a token = issued at time t does not invalidate a token issued prior to time t ?
>>
>> In the 3 token = implementations I am familiar with tokens are completely independent and = a token issued at time t does not invalidate a token issued prior to = time t.
>
> Agreed. Apart from having = to keep and synchronise state across nodes, I don't see how you could = even implement it.
>
>>
>> Ben
>>
>>>
>>>
>>> MPEG kindly asks the IETF CDNI working group to = consider the above observations and welcome further collaboration on = this topic.
>>>
>>>
>>>
>>> Our future = meetings:
>>> -    DASH Ad-hoc = meetings, 21 February 2016, San Diego, CA
>>> = -    The 114th MPEG meeting, 22 - 26 February 2016, San Diego, = CA
>>>
>>>
>>> Attachments:
>>>
>>>  29n153811
>>>  https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2015-11-0= 2-iso-iec-jtc1-sc29-wg11-cdni-liaison-statement-to-ietf-on-uri-signing-att= achment-1.doc
>>>
>>>  29n153811 htm
>>>  https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2015-11-0= 2-iso-iec-jtc1-sc29-wg11-cdni-liaison-statement-to-ietf-on-uri-signing-att= achment-2.htm
>>>
>>> = _______________________________________________
>>>= CDNi mailing list
>>> CDNi@ietf.org
>>> https://www.ietf.org/mailman/listinfo/cdni
>>
>> = _______________________________________________
>> = CDNi mailing list
>> CDNi@ietf.org
>> https://www.ietf.org/mailman/listinfo/cdni
> This message may contain information that is not = intended for you. If you are not the addressee or if this message was = sent to you by mistake, you are requested to inform the sender and = delete the message. TNO accepts no liability for the content of this = e-mail, for the manner in which you use it and for damage of any kind = resulting from the risks inherent to the electronic transmission of = messages.

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

= --Apple-Mail=_7150624A-0755-4566-BA3B-F375AE51F995-- From nobody Mon Dec 14 09:09:04 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 948911ACD8E for ; Mon, 14 Dec 2015 09:09:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.499 X-Spam-Level: X-Spam-Status: No, score=-0.499 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HTML_MESSAGE=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zCsVysWLAC4h for ; Mon, 14 Dec 2015 09:09:00 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.144]) by ietfa.amsl.com (Postfix) with ESMTP id A8C7C1ACDCF for ; Mon, 14 Dec 2015 09:08:38 -0800 (PST) Received: from 5ec217a6.skybroadband.com ([94.194.23.166] helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a8Wc1-0000FR-JK; Mon, 14 Dec 2015 17:08:38 +0000 Content-Type: multipart/alternative; boundary="Apple-Mail=_6BC0D1D4-314F-4635-98E9-24B827D81FA1" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: Date: Mon, 14 Dec 2015 17:08:36 +0000 Message-Id: References: <39F63763-F4DA-4AD2-AA8B-ED7B5200CB89@tno.nl> <87B3E8C2-A530-427E-8F22-39DB88A13DE0@niven-jenkins.co.uk> To: "Brandenburg, R. (Ray) van" X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: "" Subject: Re: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 17:09:02 -0000 --Apple-Mail=_6BC0D1D4-314F-4635-98E9-24B827D81FA1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ray, > On 10 Dec 2015, at 08:13, Brandenburg, R. (Ray) van = wrote: > On 09/12/15 18:28, "Ben Niven-Jenkins" > wrote: >=20 >> (I realised I=E2=80=99d only sent my response below to Ray & not the = entire WG). Ben >>=20 >>> On 9 Dec 2015, at 17:11, Ben Niven-Jenkins = wrote: >>>=20 >>> Hi Ray, >>>=20 >>>> On 9 Dec 2015, at 16:26, Brandenburg, R. (Ray) van = wrote: >>>> On 09/12/15 15:51, "CDNi on behalf of Ben Niven-Jenkins" = wrote: >>>>> Assuming you don=E2=80=99t intend to have a new public/private key = generated for each signed token in the chain, something that occurred to = me is that the draft introduces a subtle change to the responsibilities = of the CDN / exposure of the CSP for asymmetric signatures. >>>>>=20 >>>>> Today a CSP generates a token and a CDN validates it. The = uri-signing-for-has draft allows the CDN to create a token for itself. = In the past the CDN could always have done that anyway with a shared key = but couldn=E2=80=99t with an asymmetric signature because the CDN never = had access to the private key. uri-sgning-for-has requires the CDN to = have the private key in order to created chained tokens. That might not = be a problem for CSPs but it=E2=80=99s probably worth calling out = somewhere in the draft that ui-signing-for-has required the CDN to have = the private key whereas ietf-signed-uris draft does not. >>>>=20 >>>> Hmm, good point. In practice, I assume the CDN would not use the = CSP's private key but use an internal one for subsequent tokens, but = you're right that we should call this out somewhere. In any case, I = expect the use of asymmetric keys for chained tokens would only be = beneficial in very specific circumstance anyway.=20 >>>=20 >>> If the CDN uses an internal key, what happens if a subsequent = request from the client goes to a different CDN? E.g. DNS based request = routing where the client does a DNS lookup per segment (which is how the = iOS client behaves AFAIK) and the results returned in DNS change (the = uCDN picks a different dCDN or the CSP is using a CDN selector for = example). >>>=20 >>> Ben >>>=20 >=20 > As long as the CDN that created the token makes it's public key = available (and places the URI in the KeyID field), it shouldn't matter, = right? How is this different from the single (non-chained) token = scenario? You are right this isn=E2=80=99t any different to the non-chained token = scenario but I=E2=80=99d overlooked that KEYID contained a reference to = where to obtain the public key. I=E2=80=99d assumed that the public key would be carried in CDNI = metadata (or otherwise out of band of the token itself) like it would = need to be for shared secrets. Which made me think that if any dCDN can recreate the token using their = own key & insert a reference to the public key in the KEYID, what=E2=80=99= s to stop Joe Public doing the same and minting their own tokens? Would = that mean we=E2=80=99d have to distribute a form of "public keys for = tokens=E2=80=9D whitelist (containing all public keys that can be used = to validate a token/hostname/site), whereas if only the CSP could = generate the token you=E2=80=99d only need to distribute a single public = key (the CSPs)? Thanks Ben --Apple-Mail=_6BC0D1D4-314F-4635-98E9-24B827D81FA1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Ray,

On 10 Dec 2015, at 08:13, = Brandenburg, R. (Ray) van <ray.vanbrandenburg@tno.nl> wrote:
On 09/12/15 18:28, "Ben = Niven-Jenkins" <ben@niven-jenkins.co.uk> wrote:

(I realised I=E2=80=99d = only sent my response below to Ray & not the entire WG). Ben

On 9 Dec = 2015, at 17:11, Ben Niven-Jenkins <ben@niven-jenkins.co.uk> wrote:

Hi Ray,

On 9 Dec 2015, at 16:26, Brandenburg, R. (Ray) van <ray.vanbrandenburg@tno.nl> wrote:
On = 09/12/15 15:51, "CDNi on behalf of Ben Niven-Jenkins" <cdni-bounces@ietf.org= on behalf of ben@niven-jenkins.co.uk> wrote:
Assuming you don=E2=80=99t= intend to have a new public/private key generated for each signed token = in the chain, something that occurred to me is that the draft introduces = a subtle change to the responsibilities of the CDN / exposure of the CSP = for asymmetric signatures.

Today a CSP = generates a token and a CDN validates it. The uri-signing-for-has draft = allows the CDN to create a token for itself. In the past the CDN could = always have done that anyway with a shared key but couldn=E2=80=99t with = an asymmetric signature because the CDN never had access to the private = key. uri-sgning-for-has requires the CDN to have the private key in = order to created chained tokens. That might not be a problem for CSPs = but it=E2=80=99s probably worth calling out somewhere in the draft that = ui-signing-for-has required the CDN to have the private key whereas = ietf-signed-uris draft does not.

Hmm, good point. In practice, I assume the CDN would not use = the CSP's private key but use an internal one for subsequent tokens, but = you're right that we should call this out somewhere. In any case, I = expect the use of asymmetric keys for chained tokens would only be = beneficial in very specific circumstance anyway. 

If the CDN uses an internal key, = what happens if a subsequent request from the client goes to a different = CDN? E.g. DNS based request routing where the client does a DNS lookup = per segment (which is how the iOS client behaves AFAIK) and the results = returned in DNS change (the uCDN picks a different dCDN or the CSP is = using a CDN selector for example).

Ben


As long as the CDN that created the token makes = it's public key available (and places the URI in the KeyID field), it = shouldn't matter, right? How is this different from the single = (non-chained) token scenario?

You are right this isn=E2=80=99t any different to the = non-chained token scenario but I=E2=80=99d overlooked that KEYID = contained a reference to where to obtain the public key.

I=E2=80=99d assumed that = the public key would be carried in CDNI metadata (or otherwise out of = band of the token itself) like it would need to be for shared = secrets.

Which = made me think that if any dCDN can recreate the token using their own = key & insert a reference to the public key in the KEYID, what=E2=80=99= s to stop Joe Public doing the same and minting their own tokens? Would = that mean we=E2=80=99d have to distribute a form of "public keys for = tokens=E2=80=9D whitelist (containing all public keys that can be used = to validate a token/hostname/site), whereas if only the CSP could = generate the token you=E2=80=99d only need to distribute a single public = key (the CSPs)?

Thanks
Ben

= --Apple-Mail=_6BC0D1D4-314F-4635-98E9-24B827D81FA1-- From nobody Mon Dec 14 09:21:40 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F064F1AC3B9 for ; Mon, 14 Dec 2015 09:21:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, J_CHICKENPOX_44=0.6, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Ec3S0lGkY6M for ; Mon, 14 Dec 2015 09:21:34 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6DB11A8883 for ; Mon, 14 Dec 2015 09:21:30 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-bf-566ef9e71925 Received: from EUSAAHC008.ericsson.se (Unknown_Domain [147.117.188.96]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id B5.7A.06940.7E9FE665; Mon, 14 Dec 2015 18:18:32 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC008.ericsson.se ([147.117.188.96]) with mapi id 14.03.0248.002; Mon, 14 Dec 2015 12:21:29 -0500 From: Kevin Ma J To: Ben Niven-Jenkins Thread-Topic: [CDNi] New Liaison Statement, "Liaison Statement to IETF on URI signing" Thread-Index: AQHRFe3cZQiZgR7/OEicTbUfGySugJ6KQW0AgAASJwCAACcsAIAAEXsAgAH0TACAOElTcIAGf1AA//+xZkA= Date: Mon, 14 Dec 2015 17:21:28 +0000 Message-ID: References: <20151103041227.25387.93653.idtracker@ietfa.amsl.com> <33E9CB3F-A487-43C1-B20E-E8D779A6BB58@niven-jenkins.co.uk> <3862FEAC-05EE-490B-94AD-3B8C9A5D6CD3@tno.nl> <7C569AF8-E5CE-4C10-9056-03497D3A6AAB@niven-jenkins.co.uk> <6CB10B3D-1EBD-4DA6-818B-6DB95109C7FB@niven-jenkins.co.uk> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A556206C1F823eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrBIsWRmVeSWpSXmKPExsUyuXRPgu6Ln3lhBicOcVgsODeBzWLH7wmM Fk9n/2G1eLtxE4sDi8eRjgtsHkuW/GTy2PL0H6PHz+uTGANYorhsUlJzMstSi/TtErgyjn/8 y16w5ABzxbV7h5gbGC9sYe5i5OSQEDCRuLzqPzuELSZx4d56ti5GLg4hgSOMEnd7LrNCOMsZ Jf4fbWQDqWIT0JJ4/PUvUxcjB4eIgL5Ex7FikBpmgUmMEluWXWYCqREWCJfY+vU42FQRgQiJ m49XMULYSRJNre/BbBYBVYmff6+AzeQV8JV4NPMZO8SyD8wSfStugxVxCrhLXNm0kwXEZgQ6 7/upNWALmAXEJW49mc8EcbaAxJI956HeEZV4+fgfK4StKLGvfzo7yKHMAvkSsx/kQuwSlDg5 8wnLBEbRWUgmzUKomoWkCiKsKbF+lz5EtaLElO6H7BC2hkTrnLnsyOILGNlXMXKUFhfk5KYb GWxiBMbfMQk23R2M96d7HmIU4GBU4uE1OJAbJsSaWFZcmXuIUYKDWUmEtwgYvUK8KYmVValF +fFFpTmpxYcYpTlYlMR5GRkYGIQE0hNLUrNTUwtSi2CyTBycUg2M2w55HPBXXCyt8FTb3pZ3 CkfjTt/JaoyscqH7n69sv3N/ldoF05DYTeu2ea2P25jEKOqe7fnKwlw5soJju9OZydkvxTku 7TgnqPXk4If9oZ/ur7yxwCYx75mvaP5Thef3ci0mn/pWemSWp9HsBKe/jD+/CPDpvOD7Mcvj ZoKWcpTUzgt/dq+8rcRSnJFoqMVcVJwIAFAc91+7AgAA Archived-At: Cc: Content Delivery Networks Interconnection Discussion List , Watanabe Shinji Subject: Re: [CDNi] New Liaison Statement, "Liaison Statement to IETF on URI signing" X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 17:21:40 -0000 --_000_A419F67F880AB2468214E154CB8A556206C1F823eusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQo+IEnigJltIHN1cmUgaXQgY291bGQgYmUgbWFkZSB0byB3b3JrIGlmIFggd2Fz IHNlbGVjdGVkIHdpdGggY2FyZSBidXQgSeKAmW0gc3RpbGwgdW5jb252aW5jZWQgb2YgaG93IG11 Y2ggaXQgaXMgcmVhbGx5IG5lZWRlZCwgaS5lLiBob3cgbWFueSB1c2UgY2FzZXMgcmVxdWlyZSB0 aGUgQ0ROIHRvIHJlZnJlc2ggdGhlIHRva2VuIHBlcmlvZGljYWxseSBidXQgd2hlcmUgYSBwZXJp b2Qgb2Yg4oCcZXZlcnkgcmVxdWVzdOKAnSB3b3VsZCBiZSBkZXRyaW1lbnRhbC9hIHBlcmNlaXZh YmxlIG92ZXJoZWFkPw0KDQogIEkgYWdyZWUgd2l0aCB5b3UgYWJvdXQgYm90aCBuZWVkaW5nIHRv IHR1bmUgWCwgYW5kIG5vdCBuZWNlc3NhcmlseSBuZWVkaW5nIGRlbGF5ZWQgdG9rZW4gcmVnZW5l cmF0aW9uOyBJIHdhcyBqdXN0IGNvbnNpZGVyaW5nIHRoZSBhbHRlcm5hdGl2ZSB0byBtYWludGFp bmluZyBzdGF0ZS4NCg0KPiBJ4oCZZCBhc3N1bWUgdGhlIGNsaWVudCBkb2VzbuKAmXQgbmVlZCB0 byBrbm93IHRoZSB2YWx1ZSBvZiBYLCBpdCBqdXN0IG1ha2VzIHJlcXVlc3RzIGxpa2UgaXQgd291 bGQgbm9ybWFsbHkgZG9lcyBpdCBub3Q/DQoNCiAgUmF5IGhhZCBicm91Z2h0IHVwIHRoZSB1c2Ug Y2FzZSBvZiBhIGxvbmcgcGF1c2UsIGR1cmluZyB3aGljaCBJIGFzc3VtZSB0aGVyZSB3YXMgdG8g YmUgc29tZSB0eXBlIG9mIGJhY2tncm91bmQgcHJvY2VzcyB0aGF0IGRvZXMgSEVBRC9SYW5nZSBy ZXF1ZXN0cyB0byBwZXJpb2RpY2FsbHkgZ2V0IGEgbmV3IHRva2VuLiAgUGVyc29uYWxseSwgSSBk b24ndCB0aGluayB0aGlzIGlzIGEgc3Ryb25nIHVzZSBjYXNlLCBidXQgcmVnYXJkbGVzcywgdGhl IGludGVyZmFjZSBiZXR3ZWVuIGNsaWVudCBhbmQgQ0ROL0NTUCBpcyBvdXQtb2Ytc2NvcGUgZm9y IENETkksIHNvIEkgZG9uJ3Qgc2VlIHVzIHNwZWNpZnlpbmcgYSB3YXkgdG8gY29udmV5IHRoYXQg aW5mb3JtYXRpb24uDQoNCnRoYW54IQ0KDQotLSAgS2V2aW4gSi4gTWENCg0KDQpGcm9tOiBCZW4g Tml2ZW4tSmVua2lucyBbbWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrXQ0KU2VudDogTW9u ZGF5LCBEZWNlbWJlciAxNCwgMjAxNSAxMTo1OCBBTQ0KVG86IEtldmluIE1hIEoNCkNjOiBjXjsg Q29udGVudCBEZWxpdmVyeSBOZXR3b3JrcyBJbnRlcmNvbm5lY3Rpb24gRGlzY3Vzc2lvbiBMaXN0 OyBXYXRhbmFiZSBTaGluamkNClN1YmplY3Q6IFJlOiBbQ0ROaV0gTmV3IExpYWlzb24gU3RhdGVt ZW50LCAiTGlhaXNvbiBTdGF0ZW1lbnQgdG8gSUVURiBvbiBVUkkgc2lnbmluZyINCg0KSGkgS2V2 aW4sDQoNCk9uIDEwIERlYyAyMDE1LCBhdCAxODo1NiwgS2V2aW4gTWEgSiA8a2V2aW4uai5tYUBl cmljc3Nvbi5jb208bWFpbHRvOmtldmluLmoubWFAZXJpY3Nzb24uY29tPj4gd3JvdGU6DQoNCkhp IEJlbi9BbGwsDQoNCiAgKGFzIGEgY2hhaXIpIEkgd2FzIHByZXBhcmluZyBhIGxpYWlzb24gcmVz cG9uc2UgYW5kIGdvaW5nIGJhY2sgdGhyb3VnaCB0aGUgbGlzdCBkaXNjdXNzaW9ucywgYW5kIChh cyBhbiBpbmRpdmlkdWFsKSBJIGhhZCBhIGNsYXJpZnlpbmcgcXVlc3Rpb24gYWJvdXQgdGhlIHRv a2VuIHJlZnJlc2ggKHdoaWNoIGlzIG5vdyBvbmx5IHBhcnQgb2YgUmF5J3MgaW5kaXZpZHVhbCBk cmFmdCk6DQoNCj4gV2l0aCBhIHRva2VuIHRoYXQgY2hhbmdlcyBhZnRlciBhIHZhcmlhYmxlIG51 bWJlciBvZiBzZWdtZW50cywgdGhlIENETiBub3cgbmVlZHMgdG8ga2VlcCBzdGF0ZSBhYm91dCBo b3cgbWFueSB0aW1lcyBpdCBoYXMgc2VlbiB0aGUgdG9rZW4gYWxyZWFkeSBhbmQgbmVlZHMgdG8g Y28tb3JkaW5hdGUgdGhhdCBzdGF0ZSBhY3Jvc3MgdGhlIENETiBpbiBjYXNlIHNvbWUgb2YgdGhl IHJlcXVlc3RzIGdvIHRvIGRpZmZlcmVudCBzdXJyb2dhdGVzLCBldGMuDQoNCiAgV2hlbiB3ZSBz YXkgInN0YXRlIiBoZXJlLCBhcmUgd2UgdGFsa2luZyBhYm91dCBzZXNzaW9uIHN0YXRlPw0KDQpJ 4oCZbSBub3Qgc3VyZSBpZiBpdCB3b3VsZCBjb3VudCBhcyBzZXNzaW9uIHN0YXRlLiBJZiBhIENE TiBuZWVkcyB0byBrbm93IGhvdyBtYW55IHRpbWVzIGl0IGhhcyBzZWVuIGEgdG9rZW4sIGl0IG5l ZWRzIHRvIHN0b3JlIGluZm9ybWF0aW9uIGFjcm9zcyByZXF1ZXN0cyAoY291bnQgb2YgdGltZXMg aXQgaGFzIHNlZW4gdGhlIHRva2VuKS4gSXTigJlzIHRoYXQgc3RvcmFnZSBvZiBpbmZvcm1hdGlv biBhY3Jvc3MgcmVxdWVzdHMgdGhhdCBJIG1lYW4gYnkgc3RhdGUuDQoNCg0KICBXb3VsZCBpdCBu ZWVkIGFueXRoaW5nIG1vcmUgdGhhbiBhIG5ldyBtZXRhZGF0YSB2YXJpYWJsZSB0aGF0IHNheXMg InRoZSBDRE4gU0hPVUxEIG9ubHkgZ2VuZXJhdGUgYSBuZXcgdG9rZW4gaWYgdGhlIGN1cnJlbnQg dG9rZW4gaXMgbGVzcyB0aGFuIFggc2Vjb25kcyBhd2F5IGZyb20gZXhwaXJpbmciLCB3aGVyZSBY IGlzIGFuIGludGVnZXIgdmFsdWUgY29udmV5ZWQgaW4gdGhlIG1ldGFkYXRhPw0KDQpUaGF0IHdv dWxkIHJlbW92ZSB0aGUgbmVlZCB0byBtYWludGFpbiBzdGF0ZSBidXQgbWlnaHQgaW50cm9kdWNl IG90aGVyIGVmZmVjdHMgZGVwZW5kaW5nIG9uIHRoZSB1c2UgY2FzZSwgZS5nLiBpZiBYIGlzIHRv byBzaG9ydCBtYXliZSB0aGUgdG9rZW4gZXhwaXJlcyBiZWZvcmUgdGhlIGNsaWVudCBwcmVzZW50 cyBpdCB0byB0aGUgQ0ROIGFnYWluLg0KDQpJ4oCZbSBzdXJlIGl0IGNvdWxkIGJlIG1hZGUgdG8g d29yayBpZiBYIHdhcyBzZWxlY3RlZCB3aXRoIGNhcmUgYnV0IEnigJltIHN0aWxsIHVuY29udmlu Y2VkIG9mIGhvdyBtdWNoIGl0IGlzIHJlYWxseSBuZWVkZWQsIGkuZS4gaG93IG1hbnkgdXNlIGNh c2VzIHJlcXVpcmUgdGhlIENETiB0byByZWZyZXNoIHRoZSB0b2tlbiBwZXJpb2RpY2FsbHkgYnV0 IHdoZXJlIGEgcGVyaW9kIG9mIOKAnGV2ZXJ5IHJlcXVlc3TigJ0gd291bGQgYmUgZGV0cmltZW50 YWwvYSBwZXJjZWl2YWJsZSBvdmVyaGVhZD8NCg0KICBBbmQgd3J0IG5vdGlmeWluZyB0aGUgY2xp ZW50IG9mIHRoZSB2YWx1ZSBvZiBYLCBJIHRoaW5rIHRoYXQgd291bGQgYmUgb3V0LW9mLXNjb3Bl IGZvciBDRE5JPw0KDQpJ4oCZZCBhc3N1bWUgdGhlIGNsaWVudCBkb2VzbuKAmXQgbmVlZCB0byBr bm93IHRoZSB2YWx1ZSBvZiBYLCBpdCBqdXN0IG1ha2VzIHJlcXVlc3RzIGxpa2UgaXQgd291bGQg bm9ybWFsbHkgZG9lcyBpdCBub3Q/DQoNCkJlbg0KDQoNCg0KdGhhbnghDQoNCi0tICBLZXZpbiBK LiBNYQ0KDQoNCkZyb206IENETmkgW21haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJl aGFsZiBPZiBCZW4gTml2ZW4tSmVua2lucw0KU2VudDogV2VkbmVzZGF5LCBOb3ZlbWJlciAwNCwg MjAxNSAxOjEyIFBNDQpUbzogY14NCkNjOiBDb250ZW50IERlbGl2ZXJ5IE5ldHdvcmtzIEludGVy Y29ubmVjdGlvbiBEaXNjdXNzaW9uIExpc3Q7IFdhdGFuYWJlIFNoaW5qaQ0KU3ViamVjdDogUmU6 IFtDRE5pXSBOZXcgTGlhaXNvbiBTdGF0ZW1lbnQsICJMaWFpc29uIFN0YXRlbWVudCB0byBJRVRG IG9uIFVSSSBzaWduaW5nIg0KDQpDcmFpZywNCg0KT24gMyBOb3YgMjAxNSwgYXQgMTI6MjEsIGNe IDxjQGdyeW5pbmcuY29tPG1haWx0bzpjQGdyeW5pbmcuY29tPj4gd3JvdGU6DQoNCkNvb2tpZSB1 c2UgYWxzbyBjcmVhdGVzIG90aGVyIGRlcGVuZGVuY2llcyB3aGVuIHVzaW5nIE1TRSBzdWNoIGFz IGNyb3NzZG9tYWluL0NPUlMgd2hpY2ggY2FuIGJlIHByb2JsZW1hdGljIGluIGNlcnRhaW4gZGVw bG95bWVudHMuDQpRdWVyeSBzdHJpbmcgYmFzZWQgaXMgbW9yZSBwb3J0YWJsZS4uLg0KQnV0IG5v dCB3aXRob3V0IGl0cyBvd24gc2V0IG9mIGlzc3Vlcy4gVGhlcmUgaXMgbm8gc2luZ2xlIGFuc3dl ciBoZXJlIElNTy4gQlRXIEkgd2FzbuKAmXQgdHJ5aW5nIHRvIHN1Z2dlc3QgdGhhdCBNUEVHIGF2 b2lkIHF1ZXJ5IHBhcmFtZXRlcnMgYW5kIHVzZSBjb29raWVzIGluc3RlYWQgYnV0IHRvIHBvbmRl ciB3aGV0aGVyIHRoZXnigJlkIGNvbnNpZGVyZWQgY29va2llcyBhcyBwYXJ0IG9mIHRoZSBzb2x1 dGlvbiBzcGFjZSBhcyBpZiBpdCB3YXMgY29uc2lkZXJlZCBhbmQgZGlzY291bnRlZCBJ4oCZZCBi ZSBpbnRlcmVzdGVkIGluIHdoYXQgbGVkIHRvIHRoYXQgY2hvaWNlLg0KDQoNCg0KV1JUIGdlbmVy YXRpbmcgdG9rZW5zIGJlaW5nICdjaGVhcCc7IGNvbnNpZGVyIHRoZSBmbGFzaCBjcm93ZHMgYXNz b2NpYXRlZCB3aXRoIG5ld3MgZXZlbnRzIG9uIGxpdmUgc3RyZWFtcy4gVG9rZW4gZ2VuZXJhdGlv biBpbiB0aGVzZSBjaXJjdW1zdGFuY2UgaXMgdmVyeSBkaWZmZXJlbnQgdG8gdGhlIG1vZGVyYXRl IHBlYWs6bWVhbiBpbiBvbi1kZW1hbmQgdmlkZW8gd29ya2Zsb3dzLg0KU3VyZSBidXQgc3VjaCBm bGFzaCBjcm93ZHMgcHV0IHN0cmVzcyBvbiB0aGUgd2hvbGUgZGVsaXZlcnkgY2hhaW4gYW5kIEkg aGlnaGx5IHN1c3BlY3QgdGhhdCB0aGUgb3ZlcmhlYWQgb2YgZ2VuZXJhdGluZyB0b2tlbnMgd2ls bCBub3QgYmUgdGhlIHdlYWtlc3QgbGluayB0aGF0IGNhdXNlcyBhIGZsYXNoIGNyb3dkIHRvIGlt cGFjdCBhIHN0cmVhbWluZyBzZXJ2aWNlLg0KDQoNCg0KVGhlIHRyYWRlIG9mZiBiZWluZyBhbiBl eHRlbmRlZCB0aW1lIGxpbWl0ZWQgdG9rZW4gYmVpbmcgJ2dvb2QgZW5vdWdoJ+KApg0KVGhhdCB3 YXMgcGFydCBvZiBteSBwb2ludC4gSWYgb25lIGhhcyB0aGUgb3B0aW9uIHRvIGNyZWF0ZSBhIGxv bmcgbGl2ZWQgc2luZ2xlIHRva2VuIGFuZCBvbmUgaGFzIHRoZSBvcHRpb24gdG8gY2hhaW4gdG9r ZW5zIG9uIGVhY2ggcmVxdWVzdCB0aGVuIEnigJltIHN0cnVnZ2xpbmcgdG8gdW5kZXJzdGFuZCB3 aGF0IGJlbmVmaXQgdGhlcmUgaXMgdG8gaGF2aW5nIGEgdGhpcmQgb3B0aW9uIHRoYXQgaXMgc29t ZXdoZXJlIGluIHRoZSBtaWRkbGUuDQoNCg0KSSBjYW4gZ28gaW50byBzb21lIG9mIHRoZXNlIGNv bnNpZGVyYXRpb25zIGZ1cnRoZXIgb2ZmIGxpc3TigKYNCknigJlkIGNlcnRhaW5seSBiZSBpbnRl cmVzdGVkIGluIGRpc2N1c3NpbmcgdGhpcyBzdHVmZiBtb3JlIGVpdGhlciBvbiBvciBvZmYgbGlz dC4NCg0KQmVuDQoNCg0KDQpDcmFpZ1QNCi0tDQpjJTVlDQpPbiAzIE5vdiAyMDE1IDIwOjIwLCAi QmVuIE5pdmVuLUplbmtpbnMiIDxiZW5Abml2ZW4tamVua2lucy5jby51azxtYWlsdG86YmVuQG5p dmVuLWplbmtpbnMuY28udWs+PiB3cm90ZToNClJheSwNCg0KSSB3b3VsZG4ndCBzaWduYWwgdG8g dGhlIENETiB3aGV0aGVyIGl0IHNob3VsZCBleHBlY3QgdGhlIHRva2VuIGluIGEgY29va2llIG9y IGEgcXVlcnkgcGFyYW0sIGlmIGl0IHdhcyBtZSBJJ2Qgc3BlYyBpdCBzbyB0aGUgQ0ROIGhhcyB0 byBzdXBwb3J0IGJvdGggYW5kIGEgcnVsZSBmb3Igd2hpY2ggb2YgY29va2llIG9yIHF1ZXJ5IHBh cmFtIHRvIHVzZSBpZiBib3RoIGFyZSBwcmVzZW50Lg0KDQpCZW4NCg0KPiBPbiAzIE5vdiAyMDE1 LCBhdCAwODo1OCwgQnJhbmRlbmJ1cmcsIFIuIChSYXkpIHZhbiA8cmF5LnZhbmJyYW5kZW5idXJn QHRuby5ubDxtYWlsdG86cmF5LnZhbmJyYW5kZW5idXJnQHRuby5ubD4+IHdyb3RlOg0KPg0KPiBI aSBhbGwsDQo+DQo+IEkndmUgYWRkZWQgbXkgY29tbWVudHMgYmVsb3cuDQo+DQo+IFJheQ0KPg0K Pg0KPg0KPj4gT24gMDMvMTEvMTUgMDg6NTMsICJDRE5pIG9uIGJlaGFsZiBvZiBCZW4gTml2ZW4t SmVua2lucyIgPGNkbmktYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86Y2RuaS1ib3VuY2VzQGlldGYu b3JnPiBvbiBiZWhhbGYgb2YgYmVuQG5pdmVuLWplbmtpbnMuY28udWs8bWFpbHRvOmJlbkBuaXZl bi1qZW5raW5zLmNvLnVrPj4gd3JvdGU6DQo+Pg0KPj4gQ29sbGVhZ3VlcywNCj4+DQo+PiBNeSAy cCAowqUzLjcpIGlubGluZQ0KPj4NCj4+DQo+Pj4gT24gMyBOb3YgMjAxNSwgYXQgMDQ6MTIsIExp YWlzb24gU3RhdGVtZW50IE1hbmFnZW1lbnQgVG9vbCA8bHNtdEBpZXRmLm9yZzxtYWlsdG86bHNt dEBpZXRmLm9yZz4+IHdyb3RlOg0KPj4+DQo+Pj4gVGl0bGU6IExpYWlzb24gU3RhdGVtZW50IHRv IElFVEYgb24gVVJJIHNpZ25pbmcNCj4+Pg0KPj4+IEJvZHk6IEF0IHRoZSAxMTN0aCBNUEVHIG1l ZXRpbmcgTVBFRyBleHBlcnRzIHRvb2sgbm90ZSBvZiB0aGUgbmV3IGRyYWZ0ICJVUkkgU2lnbmlu ZyBmb3IgSFRUUCBBZGFwdGl2ZSBTdHJlYW1pbmciLiBUaGlzIGRvY3VtZW50IHNwZWNpZmljYWxs eSBhZGRyZXNzZXMgdGhlIHVzZSBjYXNlIG9mIHNlZ21lbnRlZCBjb250ZW50IGluIHRoZSBjb250 ZXh0IG9mIFVSSSBTaWduaW5nLiBNUEVHIGV4cGVydHMgcHJvZ3Jlc3NlZCByZWdhcmRpbmcgdGhl IGludGVncmF0aW9uIG9mIFVSSSBTaWduaW5nIGV4dGVuc2lvbiBmb3Igc2VnbWVudGVkIGNvbnRl bnQgaW4gTVBFRyBEQVNILiBJbiBkaXNjdXNzaW9uIHdlIGhhZCBzZXZlcmFsIGNvbW1lbnRzIGFu ZCBvYnNlcnZhdGlvbnMgdGhhdCBNUEVHIGV4cGVydHMgd291bGQgbGlrZSB0byBzaGFyZSB3aXRo IHRoZSBJRVRGIENETkkgd29ya2luZyBncm91cC4gTVBFRyB3ZWxjb21lIGNvbW1lbnRzIGFuZCBm ZWVkYmFjayBvbiB0aGUgcmVwb3J0ZWQgcHJvZ3Jlc3MuDQo+Pj4NCj4+PiBJbnRlZ3JhdGVkIHdv cmtmbG93DQo+Pj4gTVBFRyBleHBlcnRzIHJlYWNoZWQgY29uc2Vuc3VzIG9uIHJlY29tbWVuZGlu ZyB0aGUgZm9sbG93aW5nIHN0ZXBzIGZvciB0aGUgaW50ZWdyYXRpb24gb2YgVVJJIFNpZ25pbmcg ZXh0ZW5zaW9uIGZvciBzZWdtZW50ZWQgY29udGVudCBhbmQgY2xpZW50IGF1dGhlbnRpY2F0aW9u IGFuZCBhdXRob3Jpc2F0aW9uIHNjaGVtZSAoRXhhbXBsZSBvZiBzdWNoIGEgc2NoZW1lIGlzIHRo ZSBPbmxpbmUgTXVsdGltZWRpYSBBdXRob3JpemF0aW9uIFByb3RvY29sIChPTUFQKSBwdWJsaWNs eSBhdmFpbGFibGUgb25saW5lKS4NCj4+Pg0KPj4+IDEuICAgIFRoZSBzZXJ2aWNlIHByb3ZpZGVy IGNob3NlcyBhIGdpdmVuIGNsaWVudCBhdXRoZW50aWNhdGlvbiBhbmQgYXV0aG9yaXNhdGlvbiBz Y2hlbWUgdG8gcHJvdGVjdCB0aGUgYWNjZXNzIHRvIHRoZSBNUEQuIFRoZSBhcHBsaWNhdGlvbiBh cm91bmQgdGhlIERBU0ggY2xpZW50IHRha2VzIGNhcmUgb2YgaW1wbGVtZW50aW5nIHRoZSBwcm90 b2NvbCBpbiBvcmRlciB0byBzdWNjZXNzZnVsbHkgcmVjZWl2ZSB0aGUgTVBELg0KPj4+IDIuICAg IFRoZSBpbml0aWFsIHNlZ21lbnQgYWNjZXNzIHRva2VuIGlzIHByb3ZpZGVkIGVpdGhlciBpbiB0 aGUgSFRUUCByZXNwb25zZSBvZiB0aGUgTVBEIG9yIHdpdGhpbiB0aGUgTVBEIGl0c2VsZi4NCj4+ PiAzLiAgICBUaGUgTVBEIGNvbnRhaW5zIGFwcHJvcHJpYXRlIGluc3RydWN0aW9ucyB3aGljaCBz aWduYWwgdG8gdGhlIERBU0ggY2xpZW50IHdoZXJlIHRoZSBzZWdtZW50IGFjY2VzcyB0b2tlbiBt dXN0IGJlIGV4dHJhY3RlZCBmcm9tLCBlLmcuIGVpdGhlciBmcm9tIEhUVFAgaGVhZGVyIG9mIHNl Z21lbnQgcmVzcG9uc2VzLiBJbiBhZGRpdGlvbiwgdGhpcyBzaWduYWxsaW5nIGluc3RydWN0cyB0 aGUgREFTSCBjbGllbnQgdG8gaW5zZXJ0IHRoaXMgc2VnbWVudCB0b2tlbiBiYWNrIGluIHNlZ21l bnQgcmVxdWVzdHMgYXMgYSBxdWVyeSBzdHJpbmcgcGFyYW1ldGVyLiBOb3RlIHRoYXQgTVBFRyBp bmNsdWRlZCB0aGlzIGdlbmVyaWMgbWVjaGFuaXNtIG9mIHRyYW5zcGFyZW50IHBhcmFtZXRlciBw YXNzaW5nIGluIGFuIG9uZ29pbmcgYW1lbmRtZW50IG9mIE1QRUcgREFTSCBwYXJ0IDEuIFRoaXMg ZG9jdW1lbnQgc2hvdWxkIHJlYWNoIHB1YmxpY2F0aW9uIGluIHRoZSBjb3Vyc2Ugb2YgMjAxNi4N Cj4+DQo+PiBJIHdvbmRlciBpZiBNUEVHIGFsc28gY29uc2lkZXJlZCBzZXR0aW5nIHRoZSB0b2tl biBpbiBhIGNvb2tpZSwgZS5nLiBvbiB0aGUgTVBEIHJlc3BvbnNlPyBGb3IgdGhlIHNpdHVhdGlv bnMgd2hlcmUgaXQgd29ya3MqIGl04oCZcyBhIGJldHRlciBvcHRpb24gdGhhbiBxdWVyeSBwYXJh bWV0ZXJzIElNTyBhbmQgbWVhbnMgdGhlIGNsaWVudCBkb2VzbuKAmXQgaGF2ZSB0byBkbyBhbnl0 aGluZyBzcGVjaWFsIHRvIGhhdmUgdGhlIHRva2VuIGluc2VydGVkIG9uIGV2ZXJ5IHJlcXVlc3Qg YXMgdGhlIEhUVFAgc3RhY2sgd2lsbCBkbyB0aGF0IGFzIHBhcnQgb2YgSFRUUC4NCj4+DQo+PiAq Y29va2llcyBkb27igJl0IHdvcmsgaW4gYWxsIGVudmlyb25tZW50cywgZS5nLiBibG9ja2VycyBv biBicm93c2VycyBvciBjbGllbnRzIHdoZXJlIHRoZSBwbGF5ZXIgaGFzIGFuIGluZGVwZW5kZW50 IGNvb2tpZSBqYXIgdG8gdGhlIHJlc3Qgb2YgdGhlIGFwcC9icm93c2VyIGJ1dCBpZiB5b3XigJly ZSBnb2luZyB0byBkbyBzb21ldGhpbmcgbGlrZSBpbnNlcnQgdGhlIHRva2VuIGludG8gdGhlIHJl cXVlc3QgdXNpbmcgc3BlY2lhbCBjbGllbnQgaGFuZGxpbmcgYW55d2F5LCB5b3UgY291bGQgZG8g dGhlIHNhbWUgZm9yIGEgY29va2llIGFuZCBoYXZlIHRoZSBiZW5lZml0IG9mIG9ubHkgaGF2aW5n IHRvIGRvIGl0IG9uY2UgcmF0aGVyIHRoYW4gb25jZSBwZXIgc2VnbWVudC4NCj4NCj4gQWdyZWVk Lg0KPg0KPiBNeSBmZWVsaW5nIGlzIHlvdSdkIHdhbnQgYm90aCBhIGNvb2tpZS1iYXNlZCBhcyB3 ZWxsIGFzIGEgcXVlcnkgcGFyYW1ldGVyLWJhc2VkIHNvbHV0aW9uLiBUaGUgY29va2llLWJhc2Vk IHZlcnNpb24gZm9yIGxlZ2FjeSBjbGllbnRzLCBhbmQgYSBxdWVyeS1iYXNlZCB2ZXJzaW9uIGlu IGNhc2VzIHdoZXJlIGNvb2tpZSdzIGRvbid0IHdvcmsuIEluIHRoZSB1cmktc2lnbmluZy1mb3It SEFTIGRyYWZ0IEkndmUgYWRkZWQgYSBmbGFnIHRvIGFsbG93IHRoZSBDRE4vQ1NQIHRvIGNvbW11 bmljYXRlIHdoaWNoIG1lY2hhbmlzbSBzaG91bGQgYmUgYXBwbGllZC4NCj4NCj4+DQo+Pj4gNC4g ICAgVGhlIHNlZ21lbnQgYWNjZXNzIHRva2VuIGlzIG5vdCBtZWFudCB0byBiZSB2YWxpZGF0ZWQg YnkgdGhlIGF1dGhvcml6YXRpb24gcHJvdmlkZXIgYnV0IHNvbGVseSBieSB0aGUgQ0ROIHRvIGd1 YXJhbnRlZSBhbiBlYXNpbHkgc2NhbGFibGUgYW5kIHN0YXRlbGVzcyB2YWxpZGF0aW9uLiBUbyB0 aGlzIGVuZCwgTVBFRyBleHBlcnRzIGFja25vd2xlZGdlZCB0aGUgbmVlZCBvZiBhIHBhcmFtZXRl ciBmdW5jdGlvbmFsbHkgZXF1aXZhbGVudCB0byB0aGUgUGF0aCBQYXR0ZXJuIGRlZmluZWQgaW4g dGhlIFVSSSBTaWduaW5nIGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZy4gQXMgYSByZXN1bHQs IHRoZSBVUkkgU2lnbmluZyBmb3IgSFRUUCBBZGFwdGl2ZSBTdHJlYW1pbmcgc2VlbXMgdG8gZnVs ZmlsIHRoZSBpZGVudGlmaWVkIHJlcXVpcmVtZW50cyBhbmQgd2lsbCBiZSBjb25zaWRlcmVkIGZv ciBmdXJ0aGVyIHdvcmsuDQo+Pj4NCj4+Pg0KPj4+IEZ1cnRoZXJtb3JlLCBoZXJlIGFyZSBjb21t ZW50cyBmcm9tIE1QRUcgZXhwZXJ0cyBvbiB0aGUgVVJJIFNpZ25pbmcgZm9yIEhUVFAgQWRhcHRp dmUgU3RyZWFtaW5nIGRyYWZ0Lg0KPj4+DQo+Pj4gTG9uZy10ZXJtIHRva2VucyAoaW50byBzZW50 ZW5jZXMpDQo+Pj4gU29tZSBEQVNIIHNlcnZpY2VzIG1heSB1c2UgbG9uZy10ZXJtIHRva2VucyB0 byByZXF1ZXN0IHNlZ21lbnRzLCB3aGVyZSBsb25nLXRlcm0gdHlwaWNhbGx5IG1lYW5zIGNvdXBs ZSBvZiBob3VycyB0byBzZXZlcmFsIGRheXMuIEluIHRoaXMgc2NlbmFyaW8sIGFkZGl0aW9uYWwg dG9rZW5zIChub3QgVVJJIFNpZ25lZCBUb2tlbikgYXJlIHNlbnQgYWxvbmcgdG8gZW5mb3JjZSBj bGllbnQgYXV0aGVudGljYXRpb24uIEFzIGEgcmVzdWx0LCByZWZyZXNoaW5nIHRoZSBVUkkgU2ln bmVkIFRva2VuIGF0IGV2ZXJ5IHJlcXVlc3QgbWF5IHNlZW0gc3VwZXJmbHVvdXMuIE1QRUcgZXhw ZXJ0cyB3b3VsZCBsaWtlIHRvIGtub3cgdGhlIG9waW5pb24gb2YgdGhlIElFVEYgQ0ROSSB3b3Jr aW5nIGdyb3VwIG9uIHRoaXMgc2NlbmFyaW8gYW5kIHdoZXRoZXIgdGhlIHZhbGlkYXRpb24gbWVj aGFuaXNtIGNvdWxkIGJlIGFkYXB0ZWQsIGUuZy4gYnkgc2lnbmFsbGluZyB3aGVuIHRoZSBDRE4g bXVzdCByZWdlbmVyYXRlIGEgbmV3IFVSSSBTaWduZWQgVG9rZW4uDQo+Pg0KPj4gQSBzaW5nbGUg dG9rZW4gY2FuIGJlIGdpdmVuIGEgbG9uZyBleHBpcnkgdGltZSBzbyBJ4oCZbSBub3QgY29tcGxl dGVseSBjZXJ0YWluIHdoYXQgdGhlIE1QRUcgdXNlIGNhc2UgaXMuIFRoYXQgcHJvdmlkZXMgYSBs b25nIHRpbWUgaW4gd2hpY2ggYSB0b2tlbiBjb3VsZCBiZSBwYXNzZWQgdG8gc29tZW9uZSBlbHNl LCB3aGljaCBkcm92ZSB0aGUgaWRlYSBvZiBjaGFuZ2luZyB0aGUgdG9rZW4gZnJvbSB0aGUgQ0RO IHNpZGUgb24gZXZlcnkgc2VnbWVudCB3aGljaCByZWR1Y2VzIHRoZSBleHBvc3VyZSB0aW1lIHRv IHRoZSBtaW5pbXVtIHBvc3NpYmxlLiBJdCBzZWVtcyB0aGF0IHdoYXQgTVBFRyBpcyBhc2tpbmcg Zm9yIGlzIHRoZSBhYmlsaXR5IHRvIHR1bmUgdGhlIGV4cG9zdXJlIHRpbWUuDQo+Pg0KPj4gSU1P IGl0IHNvdW5kcyBhIG5pY2Uga25vYiB0byBoYXZlIGluIHRoZW9yeSwgYnV0IEnigJltIHdvbmRl cmluZyB3aHkgc29tZW9uZSB3b3VsZCBhY3R1YWxseSB0dW5lIGl0IGluIHByYWN0aWNlLiBHZW5l cmF0aW5nIHRva2VucyBpcyBwcmV0dHkgY2hlYXAsIGl04oCZcyBiYXNpY2FsbHkgYSBzaW5nbGUg Y2FsbCB0byBhIFNIQSBoYXNoIGZ1bmN0aW9uLiBJIHRoaW5rIGl0IGFsc28gaW5jcmVhc2VzIHRo ZSBpbXBsZW1lbnRhdGlvbiBjb21wbGV4aXR5IHNpZ25pZmljYW50bHkuIFdpdGggYSBsb25nIHVz ZSBzaW5nbGUgdG9rZW4gb3Igd2l0aCByZS13cml0aW5nIHRoZSB0b2tlbiBvbiBldmVyeSBzZWdt ZW50IHRoZSBDRE4gY2FuIHByb2Nlc3MgZWFjaCByZXF1ZXN0IGluZGVwZW5kZW50bHkuIFdpdGgg YSB0b2tlbiB0aGF0IGNoYW5nZXMgYWZ0ZXIgYSB2YXJpYWJsZSBudW1iZXIgb2Ygc2VnbWVudHMs IHRoZSBDRE4gbm93IG5lZWRzIHRvIGtlZXAgc3RhdGUgYWJvdXQgaG93IG1hbnkgdGltZXMgaXQg aGFzIHNlZW4gdGhlIHRva2VuIGFscmVhZHkgYW5kIG5lZWRzIHRvIGNvLW9yZGluYXRlIHRoYXQg c3RhdGUgYWNyb3NzIHRoZSBDRE4gaW4gY2FzZSBzb21lIG9mIHRoZSByZXF1ZXN0cyBnbyB0byBk aWZmZXJlbnQgc3Vycm9nYXRlcywgZXRjLg0KPj4NCj4+IEl0IHNvdW5kcyBsaWtlIGEgbG90IG9m IGNvbXBsZXhpdHkgZm9yIGxpdHRsZSByZWFsIGJlbmVmaXQgSU1PLg0KPg0KPiBGdWxseSBhZ3Jl ZS4NCj4NCj4gKE9uZSB3YXkgdG8gaW1wbGVtZW50IGl0IHdvdWxkIGJlIHRvIGhhdmUgc29tZSBz b3J0IG9mIEV4cGlyYXRpb24gVGltZSBUaHJlc2hvbGQgdG8gaW5kaWNhdGUgd2hlbiB0aGUgQ0RO IHNob3VsZCByZWZyZXNoIHRoZSB0b2tlbiwgYnV0IHRoYXQgd291bGQgcmVzdWx0IGluIGFsbCBr aW5kcyBvZiBpc3N1ZXMsIHN1Y2ggYXMgZWZmZWN0aXZlbHkgaGF2aW5nIHZhcmlhYmxlIHRva2Vu IGxlbmd0aHMgd2hpY2ggd2lsbCBjYXVzZSBpc3N1ZXMgaW4gY2FzZXMgb2YgcHJvbG9uZ2VkIHBh dXNlKQ0KPg0KPj4NCj4+PiBOYW1lIGNvbGxpc2lvbg0KPj4+IE1QRUcgZXhwZXJ0cyB1bmRlcnN0 YW5kIHRoYXQgdGhlIG5hbWUgVVJJU2lnbmluZ1BhY2thZ2UsIGFzIGEgcXVlcnkgc3RyaW5nLCBh cyBhbiBIVFRQIGhlYWRlciBwYXJhbWV0ZXIgb3IgaW4gYSBjb29raWUsIGNvbnN0aXR1dGVzIGEg bm9ybWF0aXZlIGFzcGVjdCBvZiB0aGUgVVJJIFNpZ25pbmcgc3BlY2lmaWNhdGlvbi4gTVBFRyBl eHBlcnRzIHdvdWxkIGxpa2UgdG8ga25vdyB3aGV0aGVyIHRoZSBJRVRGIENETkkgd29ya2luZyBn cm91cCBoYXMgZGVjaWRlZCB0aGUgYXBwcm9wcmlhdGUgYXBwcm9hY2ggdG8gcHJldmVudCBuYW1l IGNvbGxpc2lvbi4NCj4NCj4gVGhlIGN1cnJlbnQgYmFzZSBVUkkgc2lnbmluZyBzcGVjIGFscmVh ZHkgYWxsb3dzIG92ZXJyaWRpbmcgdGhlIFVSSVNpZ25pbmdQYWNrYWdlIHF1ZXJ5IHN0cmluZyBw YXJhbWV0ZXIgYmFzZWQgb24gZS5nLiBNZXRhZGF0YS4gSW4gY2FzZSBvZiBEQVNILCBhbmQgY2xp ZW50cyBoYXZpbmcgdG8ga25vdyB0aGlzIG5hbWUsIEkgdGhpbmsgdGhlIGJlc3Qgc29sdXRpb24g d291bGQgYmUgdG8ganVzdCBjb252ZXkgaXQgaW4gdGhlIE1QRC4NCj4NCj4+Pg0KPj4+IENvbnNl Y3V0aXZlIHRva2Vucw0KPj4+IEFjY29yZGluZyB0byB0aGUgVVJJIFNpZ25pbmcgZm9yIEhUVFAg QWRhcHRpdmUgU3RyZWFtaW5nIGRyYWZ0LCB0aGUgc2VydmVyIG1heSBpc3N1ZSBtdWx0aXBsZSB0 b2tlbnMgYW5kIGRlbGl2ZXJlZCB0aGVtIGluIGNvbnNlY3V0aXZlIEhUVFAgcmVxdWVzdHMuIEl0 IGRvZXMgbm90IHNlZW0gdGhhdCB0aGVyZSBpcyBhIGRlcGVuZGVuY3kgYmV0d2VlbiB0aGUgdG9r ZW5zLiBDb3VsZCBJRVRGIGV4cGVydCBjb25maXJtIHRoYXQgYSB0b2tlbiBpc3N1ZWQgYXQgdGlt ZSB0IGRvZXMgbm90IGludmFsaWRhdGUgYSB0b2tlbiBpc3N1ZWQgcHJpb3IgdG8gdGltZSB0ID8N Cj4+DQo+PiBJbiB0aGUgMyB0b2tlbiBpbXBsZW1lbnRhdGlvbnMgSSBhbSBmYW1pbGlhciB3aXRo IHRva2VucyBhcmUgY29tcGxldGVseSBpbmRlcGVuZGVudCBhbmQgYSB0b2tlbiBpc3N1ZWQgYXQg dGltZSB0IGRvZXMgbm90IGludmFsaWRhdGUgYSB0b2tlbiBpc3N1ZWQgcHJpb3IgdG8gdGltZSB0 Lg0KPg0KPiBBZ3JlZWQuIEFwYXJ0IGZyb20gaGF2aW5nIHRvIGtlZXAgYW5kIHN5bmNocm9uaXNl IHN0YXRlIGFjcm9zcyBub2RlcywgSSBkb24ndCBzZWUgaG93IHlvdSBjb3VsZCBldmVuIGltcGxl bWVudCBpdC4NCj4NCj4+DQo+PiBCZW4NCj4+DQo+Pj4NCj4+Pg0KPj4+IE1QRUcga2luZGx5IGFz a3MgdGhlIElFVEYgQ0ROSSB3b3JraW5nIGdyb3VwIHRvIGNvbnNpZGVyIHRoZSBhYm92ZSBvYnNl cnZhdGlvbnMgYW5kIHdlbGNvbWUgZnVydGhlciBjb2xsYWJvcmF0aW9uIG9uIHRoaXMgdG9waWMu DQo+Pj4NCj4+Pg0KPj4+DQo+Pj4gT3VyIGZ1dHVyZSBtZWV0aW5nczoNCj4+PiAtICAgIERBU0gg QWQtaG9jIG1lZXRpbmdzLCAyMSBGZWJydWFyeSAyMDE2LCBTYW4gRGllZ28sIENBDQo+Pj4gLSAg ICBUaGUgMTE0dGggTVBFRyBtZWV0aW5nLCAyMiAtIDI2IEZlYnJ1YXJ5IDIwMTYsIFNhbiBEaWVn bywgQ0ENCj4+Pg0KPj4+DQo+Pj4gQXR0YWNobWVudHM6DQo+Pj4NCj4+PiAgMjluMTUzODExDQo+ Pj4gIGh0dHBzOi8vd3d3LmlldGYub3JnL2xpYi9kdC9kb2N1bWVudHMvTElBSVNPTi9saWFpc29u LTIwMTUtMTEtMDItaXNvLWllYy1qdGMxLXNjMjktd2cxMS1jZG5pLWxpYWlzb24tc3RhdGVtZW50 LXRvLWlldGYtb24tdXJpLXNpZ25pbmctYXR0YWNobWVudC0xLmRvYw0KPj4+DQo+Pj4gIDI5bjE1 MzgxMSBodG0NCj4+PiAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbGliL2R0L2RvY3VtZW50cy9MSUFJ U09OL2xpYWlzb24tMjAxNS0xMS0wMi1pc28taWVjLWp0YzEtc2MyOS13ZzExLWNkbmktbGlhaXNv bi1zdGF0ZW1lbnQtdG8taWV0Zi1vbi11cmktc2lnbmluZy1hdHRhY2htZW50LTIuaHRtDQo+Pj4N Cj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4+ IENETmkgbWFpbGluZyBsaXN0DQo+Pj4gQ0ROaUBpZXRmLm9yZzxtYWlsdG86Q0ROaUBpZXRmLm9y Zz4NCj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCj4+DQo+ PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4gQ0RO aSBtYWlsaW5nIGxpc3QNCj4+IENETmlAaWV0Zi5vcmc8bWFpbHRvOkNETmlAaWV0Zi5vcmc+DQo+ PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCj4gVGhpcyBtZXNz YWdlIG1heSBjb250YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZvciB5b3Uu IElmIHlvdSBhcmUgbm90IHRoZSBhZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdhcyBzZW50 IHRvIHlvdSBieSBtaXN0YWtlLCB5b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhlIHNlbmRl ciBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkgZm9yIHRo ZSBjb250ZW50IG9mIHRoaXMgZS1tYWlsLCBmb3IgdGhlIG1hbm5lciBpbiB3aGljaCB5b3UgdXNl IGl0IGFuZCBmb3IgZGFtYWdlIG9mIGFueSBraW5kIHJlc3VsdGluZyBmcm9tIHRoZSByaXNrcyBp bmhlcmVudCB0byB0aGUgZWxlY3Ryb25pYyB0cmFuc21pc3Npb24gb2YgbWVzc2FnZXMuDQoNCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpDRE5pIG1haWxp bmcgbGlzdA0KQ0ROaUBpZXRmLm9yZzxtYWlsdG86Q0ROaUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KDQo= --_000_A419F67F880AB2468214E154CB8A556206C1F823eusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29BY2V0YXRlLCBsaS5Nc29BY2V0 YXRlLCBkaXYuTXNvQWNldGF0ZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxl LWxpbms6IkJhbGxvb24gVGV4dCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206 LjAwMDFwdDsNCglmb250LXNpemU6OC4wcHQ7DQoJZm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMt c2VyaWYiO30NCnNwYW4uYXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFw cGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOndp bmRvd3RleHQ7fQ0Kc3Bhbi5CYWxsb29uVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkJhbGxv b24gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkJhbGxvb24gVGV4dCI7DQoJZm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiO30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+SGkgQmVuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpJ4oCZbSBzdXJlIGl0IGNv dWxkIGJlIG1hZGUgdG8gd29yayBpZiBYIHdhcyBzZWxlY3RlZCB3aXRoIGNhcmUgYnV0IEnigJlt IHN0aWxsIHVuY29udmluY2VkIG9mIGhvdyBtdWNoIGl0IGlzIHJlYWxseSBuZWVkZWQsIGkuZS4g aG93IG1hbnkgdXNlIGNhc2VzIHJlcXVpcmUgdGhlIENETiB0byByZWZyZXNoIHRoZSB0b2tlbiBw ZXJpb2RpY2FsbHkgYnV0IHdoZXJlIGEgcGVyaW9kIG9mIOKAnGV2ZXJ5IHJlcXVlc3TigJ0gd291 bGQgYmUgZGV0cmltZW50YWwvYSBwZXJjZWl2YWJsZQ0KIG92ZXJoZWFkPzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgSSBhZ3JlZSB3aXRo IHlvdSBhYm91dCBib3RoIG5lZWRpbmcgdG8gdHVuZSBYLCBhbmQgbm90IG5lY2Vzc2FyaWx5IG5l ZWRpbmcgZGVsYXllZCB0b2tlbiByZWdlbmVyYXRpb247IEkgd2FzIGp1c3QgY29uc2lkZXJpbmcg dGhlIGFsdGVybmF0aXZlIHRvIG1haW50YWluaW5nIHN0YXRlLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jmd0OyA8L3NwYW4+DQpJ4oCZ ZCBhc3N1bWUgdGhlIGNsaWVudCBkb2VzbuKAmXQgbmVlZCB0byBrbm93IHRoZSB2YWx1ZSBvZiBY LCBpdCBqdXN0IG1ha2VzIHJlcXVlc3RzIGxpa2UgaXQgd291bGQgbm9ybWFsbHkgZG9lcyBpdCBu b3Q/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyBSYXkgaGFkIGJyb3VnaHQgdXAgdGhlIHVzZSBjYXNlIG9mIGEgbG9uZyBwYXVzZSwgZHVy aW5nIHdoaWNoIEkgYXNzdW1lIHRoZXJlIHdhcyB0byBiZSBzb21lIHR5cGUgb2YgYmFja2dyb3Vu ZCBwcm9jZXNzIHRoYXQgZG9lcyBIRUFEL1JhbmdlIHJlcXVlc3RzIHRvIHBlcmlvZGljYWxseSBn ZXQgYSBuZXcgdG9rZW4uJm5ic3A7DQogUGVyc29uYWxseSwgSSBkb24ndCB0aGluayB0aGlzIGlz IGEgc3Ryb25nIHVzZSBjYXNlLCBidXQgcmVnYXJkbGVzcywgdGhlIGludGVyZmFjZSBiZXR3ZWVu IGNsaWVudCBhbmQgQ0ROL0NTUCBpcyBvdXQtb2Ytc2NvcGUgZm9yIENETkksIHNvIEkgZG9uJ3Qg c2VlIHVzIHNwZWNpZnlpbmcgYSB3YXkgdG8gY29udmV5IHRoYXQgaW5mb3JtYXRpb24uPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij50aGFu eCE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPi0tJm5ic3A7IEtldmluIEouIE1hPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9t Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiBCZW4gTml2ZW4tSmVua2lu cyBbbWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrXQ0KPGJyPg0KPGI+U2VudDo8L2I+IE1v bmRheSwgRGVjZW1iZXIgMTQsIDIwMTUgMTE6NTggQU08YnI+DQo8Yj5Ubzo8L2I+IEtldmluIE1h IEo8YnI+DQo8Yj5DYzo8L2I+IGNeOyBDb250ZW50IERlbGl2ZXJ5IE5ldHdvcmtzIEludGVyY29u bmVjdGlvbiBEaXNjdXNzaW9uIExpc3Q7IFdhdGFuYWJlIFNoaW5qaTxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW0NETmldIE5ldyBMaWFpc29uIFN0YXRlbWVudCwgJnF1b3Q7TGlhaXNvbiBTdGF0 ZW1lbnQgdG8gSUVURiBvbiBVUkkgc2lnbmluZyZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEtldmluLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIDEwIERlYyAyMDE1LCBhdCAxODo1NiwgS2V2aW4g TWEgSiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmtldmluLmoubWFAZXJpY3Nzb24uY29tIj5rZXZpbi5q Lm1hQGVyaWNzc29uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkhpIEJlbi9BbGwsPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgKGFzIGEgY2hhaXIpIEkgd2FzIHByZXBhcmluZyBhIGxp YWlzb24gcmVzcG9uc2UgYW5kIGdvaW5nIGJhY2sgdGhyb3VnaCB0aGUgbGlzdCBkaXNjdXNzaW9u cywgYW5kIChhcyBhbiBpbmRpdmlkdWFsKSBJIGhhZCBhIGNsYXJpZnlpbmcgcXVlc3Rpb24gYWJv dXQgdGhlIHRva2VuIHJlZnJlc2ggKHdoaWNoIGlzDQogbm93IG9ubHkgcGFydCBvZiBSYXkncyBp bmRpdmlkdWFsIGRyYWZ0KTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZndDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPldpdGgg YSB0b2tlbiB0aGF0IGNoYW5nZXMgYWZ0ZXIgYSB2YXJpYWJsZSBudW1iZXIgb2Ygc2VnbWVudHMs IHRoZSBDRE4gbm93IG5lZWRzIHRvIGtlZXAgc3RhdGUgYWJvdXQgaG93IG1hbnkgdGltZXMgaXQg aGFzIHNlZW4NCiB0aGUgdG9rZW4gYWxyZWFkeSBhbmQgbmVlZHMgdG8gY28tb3JkaW5hdGUgdGhh dCBzdGF0ZSBhY3Jvc3MgdGhlIENETiBpbiBjYXNlIHNvbWUgb2YgdGhlIHJlcXVlc3RzIGdvIHRv IGRpZmZlcmVudCBzdXJyb2dhdGVzLCBldGMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNw OyBXaGVuIHdlIHNheSAmcXVvdDtzdGF0ZSZxdW90OyBoZXJlLCBhcmUgd2UgdGFsa2luZyBhYm91 dCBzZXNzaW9uIHN0YXRlPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPknigJltIG5vdCBzdXJlIGlmIGl0 IHdvdWxkIGNvdW50IGFzIHNlc3Npb24gc3RhdGUuIElmIGEgQ0ROIG5lZWRzIHRvIGtub3cgaG93 IG1hbnkgdGltZXMgaXQgaGFzIHNlZW4gYSB0b2tlbiwgaXQgbmVlZHMgdG8gc3RvcmUgaW5mb3Jt YXRpb24gYWNyb3NzIHJlcXVlc3RzIChjb3VudCBvZiB0aW1lcyBpdCBoYXMgc2VlbiB0aGUgdG9r ZW4pLiBJdOKAmXMgdGhhdCBzdG9yYWdlIG9mIGluZm9ybWF0aW9uIGFjcm9zcyByZXF1ZXN0cw0K IHRoYXQgSSBtZWFuIGJ5IHN0YXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgV291bGQgaXQgbmVlZCBh bnl0aGluZyBtb3JlIHRoYW4gYSBuZXcgbWV0YWRhdGEgdmFyaWFibGUgdGhhdCBzYXlzICZxdW90 O3RoZSBDRE4gU0hPVUxEIG9ubHkgZ2VuZXJhdGUgYSBuZXcgdG9rZW4gaWYgdGhlIGN1cnJlbnQg dG9rZW4gaXMgbGVzcyB0aGFuIFggc2Vjb25kcyBhd2F5IGZyb20gZXhwaXJpbmcmcXVvdDssIHdo ZXJlDQogWCBpcyBhbiBpbnRlZ2VyIHZhbHVlIGNvbnZleWVkIGluIHRoZSBtZXRhZGF0YT88L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5UaGF0IHdvdWxkIHJlbW92ZSB0aGUgbmVlZCB0byBtYWludGFpbiBzdGF0ZSBidXQgbWlnaHQg aW50cm9kdWNlIG90aGVyIGVmZmVjdHMgZGVwZW5kaW5nIG9uIHRoZSB1c2UgY2FzZSwgZS5nLiBp ZiBYIGlzIHRvbyBzaG9ydCBtYXliZSB0aGUgdG9rZW4gZXhwaXJlcyBiZWZvcmUgdGhlIGNsaWVu dCBwcmVzZW50cyBpdCB0byB0aGUgQ0ROIGFnYWluLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBzdXJlIGl0IGNvdWxkIGJlIG1hZGUg dG8gd29yayBpZiBYIHdhcyBzZWxlY3RlZCB3aXRoIGNhcmUgYnV0IEnigJltIHN0aWxsIHVuY29u dmluY2VkIG9mIGhvdyBtdWNoIGl0IGlzIHJlYWxseSBuZWVkZWQsIGkuZS4gaG93IG1hbnkgdXNl IGNhc2VzIHJlcXVpcmUgdGhlIENETiB0byByZWZyZXNoIHRoZSB0b2tlbiBwZXJpb2RpY2FsbHkg YnV0IHdoZXJlIGEgcGVyaW9kIG9mIOKAnGV2ZXJ5IHJlcXVlc3TigJ0gd291bGQNCiBiZSBkZXRy aW1lbnRhbC9hIHBlcmNlaXZhYmxlIG92ZXJoZWFkPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsgQW5kIHdydCBub3RpZnlpbmcgdGhlIGNsaWVudCBvZiB0aGUgdmFsdWUg b2YgWCwgSSB0aGluayB0aGF0IHdvdWxkIGJlIG91dC1vZi1zY29wZSBmb3IgQ0ROST88L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SeKAmWQgYXNzdW1lIHRoZSBjbGllbnQgZG9lc27igJl0IG5lZWQgdG8ga25vdyB0aGUg dmFsdWUgb2YgWCwgaXQganVzdCBtYWtlcyByZXF1ZXN0cyBsaWtlIGl0IHdvdWxkIG5vcm1hbGx5 IGRvZXMgaXQgbm90PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5CZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+dGhhbnghPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij4tLSZuYnNwOyBLZXZpbiBKLiBNYTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij5DRE5pDQogWzxhIGhyZWY9Im1haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5v cmciPm1haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPkJlbiBOaXZlbi1KZW5raW5z PGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPldlZG5lc2RheSwgTm92ZW1iZXIgMDQsIDIwMTUgMToxMiBQTTxicj4NCjxiPlRv OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Y148 YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPkNvbnRlbnQgRGVsaXZlcnkgTmV0d29ya3MgSW50ZXJjb25uZWN0aW9uIERpc2N1c3Np b24gTGlzdDsgV2F0YW5hYmUgU2hpbmppPGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbQ0ROaV0gTmV3IExpYWlz b24gU3RhdGVtZW50LCAmcXVvdDtMaWFpc29uIFN0YXRlbWVudCB0byBJRVRGIG9uIFVSSSBzaWdu aW5nJnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q3JhaWcsPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gMyBOb3YgMjAxNSwgYXQgMTI6MjEsIGNeICZsdDs8YSBocmVmPSJtYWlsdG86Y0BncnluaW5n LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+Y0BncnluaW5nLmNvbTwvc3Bhbj48L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q29va2llIHVzZSBhbHNvIGNyZWF0ZXMgb3RoZXIgZGVw ZW5kZW5jaWVzIHdoZW4gdXNpbmcgTVNFIHN1Y2ggYXMgY3Jvc3Nkb21haW4vQ09SUyB3aGljaCBj YW4gYmUgcHJvYmxlbWF0aWMgaW4gY2VydGFpbiBkZXBsb3ltZW50cy48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlF1ZXJ5IHN0cmluZyBiYXNlZCBp cyBtb3JlIHBvcnRhYmxlLi4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CdXQgbm90IHdpdGhv dXQgaXRzIG93biBzZXQgb2YgaXNzdWVzLiBUaGVyZSBpcyBubyBzaW5nbGUgYW5zd2VyIGhlcmUg SU1PLiBCVFcgSSB3YXNu4oCZdCB0cnlpbmcgdG8gc3VnZ2VzdCB0aGF0IE1QRUcgYXZvaWQgcXVl cnkgcGFyYW1ldGVycyBhbmQgdXNlIGNvb2tpZXMgaW5zdGVhZCBidXQgdG8gcG9uZGVyIHdoZXRo ZXIgdGhleeKAmWQgY29uc2lkZXJlZCBjb29raWVzIGFzIHBhcnQgb2YgdGhlIHNvbHV0aW9uIHNw YWNlDQogYXMgaWYgaXQgd2FzIGNvbnNpZGVyZWQgYW5kIGRpc2NvdW50ZWQgSeKAmWQgYmUgaW50 ZXJlc3RlZCBpbiB3aGF0IGxlZCB0byB0aGF0IGNob2ljZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPGJyPg0K PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+V1JUIGdlbmVyYXRpbmcgdG9rZW5zIGJlaW5nICdjaGVhcCc7IGNvbnNpZGVyIHRoZSBmbGFz aCBjcm93ZHMgYXNzb2NpYXRlZCB3aXRoIG5ld3MgZXZlbnRzIG9uIGxpdmUgc3RyZWFtcy4gVG9r ZW4gZ2VuZXJhdGlvbiBpbiB0aGVzZSBjaXJjdW1zdGFuY2UgaXMgdmVyeSBkaWZmZXJlbnQgdG8g dGhlIG1vZGVyYXRlIHBlYWs6bWVhbiBpbiBvbi1kZW1hbmQgdmlkZW8gd29ya2Zsb3dzLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+U3VyZSBidXQgc3VjaCBmbGFzaCBjcm93ZHMgcHV0IHN0cmVzcyBvbiB0aGUgd2hvbGUg ZGVsaXZlcnkgY2hhaW4gYW5kIEkgaGlnaGx5IHN1c3BlY3QgdGhhdCB0aGUgb3ZlcmhlYWQgb2Yg Z2VuZXJhdGluZyB0b2tlbnMgd2lsbCBub3QgYmUgdGhlIHdlYWtlc3QgbGluayB0aGF0IGNhdXNl cyBhIGZsYXNoIGNyb3dkIHRvIGltcGFjdCBhIHN0cmVhbWluZyBzZXJ2aWNlLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8 YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5UaGUgdHJhZGUgb2ZmIGJlaW5nIGFuIGV4dGVuZGVkIHRpbWUgbGltaXRl ZCB0b2tlbiBiZWluZyAnZ29vZCBlbm91Z2gn4oCmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYXQgd2FzIHBhcnQgb2YgbXkgcG9p bnQuIElmIG9uZSBoYXMgdGhlIG9wdGlvbiB0byBjcmVhdGUgYSBsb25nIGxpdmVkIHNpbmdsZSB0 b2tlbiBhbmQgb25lIGhhcyB0aGUgb3B0aW9uIHRvIGNoYWluIHRva2VucyBvbiBlYWNoIHJlcXVl c3QgdGhlbiBJ4oCZbSBzdHJ1Z2dsaW5nIHRvIHVuZGVyc3RhbmQgd2hhdCBiZW5lZml0IHRoZXJl IGlzIHRvIGhhdmluZyBhIHRoaXJkIG9wdGlvbiB0aGF0IGlzIHNvbWV3aGVyZQ0KIGluIHRoZSBt aWRkbGUuPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBjYW4gZ28gaW50byBzb21lIG9mIHRoZXNlIGNv bnNpZGVyYXRpb25zIGZ1cnRoZXIgb2ZmIGxpc3TigKY8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmWQgY2VydGFpbmx5IGJlIGlu dGVyZXN0ZWQgaW4gZGlzY3Vzc2luZyB0aGlzIHN0dWZmIG1vcmUgZWl0aGVyIG9uIG9yIG9mZiBs aXN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4N Cjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkNyYWlnVDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+LS08YnI+DQpjJTVlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gMyBOb3YgMjAxNSAyMDoyMCwgJnF1b3Q7QmVu IE5pdmVuLUplbmtpbnMmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpiZW5Abml2ZW4tamVua2lu cy5jby51ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YmVuQG5pdmVuLWplbmtpbnMuY28u dWs8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5SYXksPGJyPg0KPGJyPg0KSSB3b3VsZG4ndCBzaWduYWwgdG8g dGhlIENETiB3aGV0aGVyIGl0IHNob3VsZCBleHBlY3QgdGhlIHRva2VuIGluIGEgY29va2llIG9y IGEgcXVlcnkgcGFyYW0sIGlmIGl0IHdhcyBtZSBJJ2Qgc3BlYyBpdCBzbyB0aGUgQ0ROIGhhcyB0 byBzdXBwb3J0IGJvdGggYW5kIGEgcnVsZSBmb3Igd2hpY2ggb2YgY29va2llIG9yIHF1ZXJ5IHBh cmFtIHRvIHVzZSBpZiBib3RoIGFyZSBwcmVzZW50Ljxicj4NCjxicj4NCkJlbjxicj4NCjxicj4N CiZndDsgT24gMyBOb3YgMjAxNSwgYXQgMDg6NTgsIEJyYW5kZW5idXJnLCBSLiAoUmF5KSB2YW4g Jmx0OzxhIGhyZWY9Im1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5yYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPC9zcGFuPjwvYT4mZ3Q7 IHdyb3RlOjxicj4NCiZndDs8YnI+DQomZ3Q7IEhpIGFsbCw8YnI+DQomZ3Q7PGJyPg0KJmd0OyBJ J3ZlIGFkZGVkIG15IGNvbW1lbnRzIGJlbG93Ljxicj4NCiZndDs8YnI+DQomZ3Q7IFJheTxicj4N CiZndDs8YnI+DQomZ3Q7PGJyPg0KJmd0Ozxicj4NCiZndDsmZ3Q7IE9uIDAzLzExLzE1IDA4OjUz LCAmcXVvdDtDRE5pIG9uIGJlaGFsZiBvZiBCZW4gTml2ZW4tSmVua2lucyZxdW90OyAmbHQ7PGEg aHJlZj0ibWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+Y2RuaS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+b24gYmVoYWxmIG9mPHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpiZW5Abml2 ZW4tamVua2lucy5jby51ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YmVuQG5pdmVuLWpl bmtpbnMuY28udWs8L3NwYW4+PC9hPiZndDsNCiB3cm90ZTo8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZn dDsmZ3Q7IENvbGxlYWd1ZXMsPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBNeSAycCAowqUz LjcpIGlubGluZTxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsg T24gMyBOb3YgMjAxNSwgYXQgMDQ6MTIsIExpYWlzb24gU3RhdGVtZW50IE1hbmFnZW1lbnQgVG9v bCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxzbXRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPmxzbXRAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyZndDsm Z3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IFRpdGxlOiBMaWFpc29uIFN0YXRlbWVudCB0byBJRVRGIG9u IFVSSSBzaWduaW5nPGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IEJvZHk6IEF0 IHRoZSAxMTN0aCBNUEVHIG1lZXRpbmcgTVBFRyBleHBlcnRzIHRvb2sgbm90ZSBvZiB0aGUgbmV3 IGRyYWZ0ICZxdW90O1VSSSBTaWduaW5nIGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZyZxdW90 Oy4gVGhpcyBkb2N1bWVudCBzcGVjaWZpY2FsbHkgYWRkcmVzc2VzIHRoZSB1c2UgY2FzZSBvZiBz ZWdtZW50ZWQgY29udGVudCBpbiB0aGUgY29udGV4dCBvZiBVUkkgU2lnbmluZy4gTVBFRyBleHBl cnRzIHByb2dyZXNzZWQgcmVnYXJkaW5nIHRoZQ0KIGludGVncmF0aW9uIG9mIFVSSSBTaWduaW5n IGV4dGVuc2lvbiBmb3Igc2VnbWVudGVkIGNvbnRlbnQgaW4gTVBFRyBEQVNILiBJbiBkaXNjdXNz aW9uIHdlIGhhZCBzZXZlcmFsIGNvbW1lbnRzIGFuZCBvYnNlcnZhdGlvbnMgdGhhdCBNUEVHIGV4 cGVydHMgd291bGQgbGlrZSB0byBzaGFyZSB3aXRoIHRoZSBJRVRGIENETkkgd29ya2luZyBncm91 cC4gTVBFRyB3ZWxjb21lIGNvbW1lbnRzIGFuZCBmZWVkYmFjayBvbiB0aGUgcmVwb3J0ZWQgcHJv Z3Jlc3MuPGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IEludGVncmF0ZWQgd29y a2Zsb3c8YnI+DQomZ3Q7Jmd0OyZndDsgTVBFRyBleHBlcnRzIHJlYWNoZWQgY29uc2Vuc3VzIG9u IHJlY29tbWVuZGluZyB0aGUgZm9sbG93aW5nIHN0ZXBzIGZvciB0aGUgaW50ZWdyYXRpb24gb2Yg VVJJIFNpZ25pbmcgZXh0ZW5zaW9uIGZvciBzZWdtZW50ZWQgY29udGVudCBhbmQgY2xpZW50IGF1 dGhlbnRpY2F0aW9uIGFuZCBhdXRob3Jpc2F0aW9uIHNjaGVtZSAoRXhhbXBsZSBvZiBzdWNoIGEg c2NoZW1lIGlzIHRoZSBPbmxpbmUgTXVsdGltZWRpYSBBdXRob3JpemF0aW9uIFByb3RvY29sDQog KE9NQVApIHB1YmxpY2x5IGF2YWlsYWJsZSBvbmxpbmUpLjxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4N CiZndDsmZ3Q7Jmd0OyAxLiZuYnNwOyAmbmJzcDsgVGhlIHNlcnZpY2UgcHJvdmlkZXIgY2hvc2Vz IGEgZ2l2ZW4gY2xpZW50IGF1dGhlbnRpY2F0aW9uIGFuZCBhdXRob3Jpc2F0aW9uIHNjaGVtZSB0 byBwcm90ZWN0IHRoZSBhY2Nlc3MgdG8gdGhlIE1QRC4gVGhlIGFwcGxpY2F0aW9uIGFyb3VuZCB0 aGUgREFTSCBjbGllbnQgdGFrZXMgY2FyZSBvZiBpbXBsZW1lbnRpbmcgdGhlIHByb3RvY29sIGlu IG9yZGVyIHRvIHN1Y2Nlc3NmdWxseSByZWNlaXZlIHRoZSBNUEQuPGJyPg0KJmd0OyZndDsmZ3Q7 IDIuJm5ic3A7ICZuYnNwOyBUaGUgaW5pdGlhbCBzZWdtZW50IGFjY2VzcyB0b2tlbiBpcyBwcm92 aWRlZCBlaXRoZXIgaW4gdGhlIEhUVFAgcmVzcG9uc2Ugb2YgdGhlIE1QRCBvciB3aXRoaW4gdGhl IE1QRCBpdHNlbGYuPGJyPg0KJmd0OyZndDsmZ3Q7IDMuJm5ic3A7ICZuYnNwOyBUaGUgTVBEIGNv bnRhaW5zIGFwcHJvcHJpYXRlIGluc3RydWN0aW9ucyB3aGljaCBzaWduYWwgdG8gdGhlIERBU0gg Y2xpZW50IHdoZXJlIHRoZSBzZWdtZW50IGFjY2VzcyB0b2tlbiBtdXN0IGJlIGV4dHJhY3RlZCBm cm9tLCBlLmcuIGVpdGhlciBmcm9tIEhUVFAgaGVhZGVyIG9mIHNlZ21lbnQgcmVzcG9uc2VzLiBJ biBhZGRpdGlvbiwgdGhpcyBzaWduYWxsaW5nIGluc3RydWN0cyB0aGUgREFTSCBjbGllbnQgdG8g aW5zZXJ0IHRoaXMNCiBzZWdtZW50IHRva2VuIGJhY2sgaW4gc2VnbWVudCByZXF1ZXN0cyBhcyBh IHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIuIE5vdGUgdGhhdCBNUEVHIGluY2x1ZGVkIHRoaXMgZ2Vu ZXJpYyBtZWNoYW5pc20gb2YgdHJhbnNwYXJlbnQgcGFyYW1ldGVyIHBhc3NpbmcgaW4gYW4gb25n b2luZyBhbWVuZG1lbnQgb2YgTVBFRyBEQVNIIHBhcnQgMS4gVGhpcyBkb2N1bWVudCBzaG91bGQg cmVhY2ggcHVibGljYXRpb24gaW4gdGhlIGNvdXJzZSBvZiAyMDE2Ljxicj4NCiZndDsmZ3Q7PGJy Pg0KJmd0OyZndDsgSSB3b25kZXIgaWYgTVBFRyBhbHNvIGNvbnNpZGVyZWQgc2V0dGluZyB0aGUg dG9rZW4gaW4gYSBjb29raWUsIGUuZy4gb24gdGhlIE1QRCByZXNwb25zZT8gRm9yIHRoZSBzaXR1 YXRpb25zIHdoZXJlIGl0IHdvcmtzKiBpdOKAmXMgYSBiZXR0ZXIgb3B0aW9uIHRoYW4gcXVlcnkg cGFyYW1ldGVycyBJTU8gYW5kIG1lYW5zIHRoZSBjbGllbnQgZG9lc27igJl0IGhhdmUgdG8gZG8g YW55dGhpbmcgc3BlY2lhbCB0byBoYXZlIHRoZSB0b2tlbiBpbnNlcnRlZA0KIG9uIGV2ZXJ5IHJl cXVlc3QgYXMgdGhlIEhUVFAgc3RhY2sgd2lsbCBkbyB0aGF0IGFzIHBhcnQgb2YgSFRUUC48YnI+ DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7ICpjb29raWVzIGRvbuKAmXQgd29yayBpbiBhbGwgZW52 aXJvbm1lbnRzLCBlLmcuIGJsb2NrZXJzIG9uIGJyb3dzZXJzIG9yIGNsaWVudHMgd2hlcmUgdGhl IHBsYXllciBoYXMgYW4gaW5kZXBlbmRlbnQgY29va2llIGphciB0byB0aGUgcmVzdCBvZiB0aGUg YXBwL2Jyb3dzZXIgYnV0IGlmIHlvdeKAmXJlIGdvaW5nIHRvIGRvIHNvbWV0aGluZyBsaWtlIGlu c2VydCB0aGUgdG9rZW4gaW50byB0aGUgcmVxdWVzdCB1c2luZyBzcGVjaWFsIGNsaWVudCBoYW5k bGluZw0KIGFueXdheSwgeW91IGNvdWxkIGRvIHRoZSBzYW1lIGZvciBhIGNvb2tpZSBhbmQgaGF2 ZSB0aGUgYmVuZWZpdCBvZiBvbmx5IGhhdmluZyB0byBkbyBpdCBvbmNlIHJhdGhlciB0aGFuIG9u Y2UgcGVyIHNlZ21lbnQuPGJyPg0KJmd0Ozxicj4NCiZndDsgQWdyZWVkLjxicj4NCiZndDs8YnI+ DQomZ3Q7IE15IGZlZWxpbmcgaXMgeW91J2Qgd2FudCBib3RoIGEgY29va2llLWJhc2VkIGFzIHdl bGwgYXMgYSBxdWVyeSBwYXJhbWV0ZXItYmFzZWQgc29sdXRpb24uIFRoZSBjb29raWUtYmFzZWQg dmVyc2lvbiBmb3IgbGVnYWN5IGNsaWVudHMsIGFuZCBhIHF1ZXJ5LWJhc2VkIHZlcnNpb24gaW4g Y2FzZXMgd2hlcmUgY29va2llJ3MgZG9uJ3Qgd29yay4gSW4gdGhlIHVyaS1zaWduaW5nLWZvci1I QVMgZHJhZnQgSSd2ZSBhZGRlZCBhIGZsYWcgdG8gYWxsb3cNCiB0aGUgQ0ROL0NTUCB0byBjb21t dW5pY2F0ZSB3aGljaCBtZWNoYW5pc20gc2hvdWxkIGJlIGFwcGxpZWQuPGJyPg0KJmd0Ozxicj4N CiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IDQuJm5ic3A7ICZuYnNwOyBUaGUgc2VnbWVudCBh Y2Nlc3MgdG9rZW4gaXMgbm90IG1lYW50IHRvIGJlIHZhbGlkYXRlZCBieSB0aGUgYXV0aG9yaXph dGlvbiBwcm92aWRlciBidXQgc29sZWx5IGJ5IHRoZSBDRE4gdG8gZ3VhcmFudGVlIGFuIGVhc2ls eSBzY2FsYWJsZSBhbmQgc3RhdGVsZXNzIHZhbGlkYXRpb24uIFRvIHRoaXMgZW5kLCBNUEVHIGV4 cGVydHMgYWNrbm93bGVkZ2VkIHRoZSBuZWVkIG9mIGEgcGFyYW1ldGVyIGZ1bmN0aW9uYWxseSBl cXVpdmFsZW50DQogdG8gdGhlIFBhdGggUGF0dGVybiBkZWZpbmVkIGluIHRoZSBVUkkgU2lnbmlu ZyBmb3IgSFRUUCBBZGFwdGl2ZSBTdHJlYW1pbmcuIEFzIGEgcmVzdWx0LCB0aGUgVVJJIFNpZ25p bmcgZm9yIEhUVFAgQWRhcHRpdmUgU3RyZWFtaW5nIHNlZW1zIHRvIGZ1bGZpbCB0aGUgaWRlbnRp ZmllZCByZXF1aXJlbWVudHMgYW5kIHdpbGwgYmUgY29uc2lkZXJlZCBmb3IgZnVydGhlciB3b3Jr Ljxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyBG dXJ0aGVybW9yZSwgaGVyZSBhcmUgY29tbWVudHMgZnJvbSBNUEVHIGV4cGVydHMgb24gdGhlIFVS SSBTaWduaW5nIGZvciBIVFRQIEFkYXB0aXZlIFN0cmVhbWluZyBkcmFmdC48YnI+DQomZ3Q7Jmd0 OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgTG9uZy10ZXJtIHRva2VucyAoaW50byBzZW50ZW5jZXMp PGJyPg0KJmd0OyZndDsmZ3Q7IFNvbWUgREFTSCBzZXJ2aWNlcyBtYXkgdXNlIGxvbmctdGVybSB0 b2tlbnMgdG8gcmVxdWVzdCBzZWdtZW50cywgd2hlcmUgbG9uZy10ZXJtIHR5cGljYWxseSBtZWFu cyBjb3VwbGUgb2YgaG91cnMgdG8gc2V2ZXJhbCBkYXlzLiBJbiB0aGlzIHNjZW5hcmlvLCBhZGRp dGlvbmFsIHRva2VucyAobm90IFVSSSBTaWduZWQgVG9rZW4pIGFyZSBzZW50IGFsb25nIHRvIGVu Zm9yY2UgY2xpZW50IGF1dGhlbnRpY2F0aW9uLiBBcyBhIHJlc3VsdCwgcmVmcmVzaGluZw0KIHRo ZSBVUkkgU2lnbmVkIFRva2VuIGF0IGV2ZXJ5IHJlcXVlc3QgbWF5IHNlZW0gc3VwZXJmbHVvdXMu IE1QRUcgZXhwZXJ0cyB3b3VsZCBsaWtlIHRvIGtub3cgdGhlIG9waW5pb24gb2YgdGhlIElFVEYg Q0ROSSB3b3JraW5nIGdyb3VwIG9uIHRoaXMgc2NlbmFyaW8gYW5kIHdoZXRoZXIgdGhlIHZhbGlk YXRpb24gbWVjaGFuaXNtIGNvdWxkIGJlIGFkYXB0ZWQsIGUuZy4gYnkgc2lnbmFsbGluZyB3aGVu IHRoZSBDRE4gbXVzdCByZWdlbmVyYXRlIGENCiBuZXcgVVJJIFNpZ25lZCBUb2tlbi48YnI+DQom Z3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IEEgc2luZ2xlIHRva2VuIGNhbiBiZSBnaXZlbiBhIGxvbmcg ZXhwaXJ5IHRpbWUgc28gSeKAmW0gbm90IGNvbXBsZXRlbHkgY2VydGFpbiB3aGF0IHRoZSBNUEVH IHVzZSBjYXNlIGlzLiBUaGF0IHByb3ZpZGVzIGEgbG9uZyB0aW1lIGluIHdoaWNoIGEgdG9rZW4g Y291bGQgYmUgcGFzc2VkIHRvIHNvbWVvbmUgZWxzZSwgd2hpY2ggZHJvdmUgdGhlIGlkZWEgb2Yg Y2hhbmdpbmcgdGhlIHRva2VuIGZyb20gdGhlIENETiBzaWRlIG9uIGV2ZXJ5IHNlZ21lbnQNCiB3 aGljaCByZWR1Y2VzIHRoZSBleHBvc3VyZSB0aW1lIHRvIHRoZSBtaW5pbXVtIHBvc3NpYmxlLiBJ dCBzZWVtcyB0aGF0IHdoYXQgTVBFRyBpcyBhc2tpbmcgZm9yIGlzIHRoZSBhYmlsaXR5IHRvIHR1 bmUgdGhlIGV4cG9zdXJlIHRpbWUuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBJTU8gaXQg c291bmRzIGEgbmljZSBrbm9iIHRvIGhhdmUgaW4gdGhlb3J5LCBidXQgSeKAmW0gd29uZGVyaW5n IHdoeSBzb21lb25lIHdvdWxkIGFjdHVhbGx5IHR1bmUgaXQgaW4gcHJhY3RpY2UuIEdlbmVyYXRp bmcgdG9rZW5zIGlzIHByZXR0eSBjaGVhcCwgaXTigJlzIGJhc2ljYWxseSBhIHNpbmdsZSBjYWxs IHRvIGEgU0hBIGhhc2ggZnVuY3Rpb24uIEkgdGhpbmsgaXQgYWxzbyBpbmNyZWFzZXMgdGhlIGlt cGxlbWVudGF0aW9uIGNvbXBsZXhpdHkNCiBzaWduaWZpY2FudGx5LiBXaXRoIGEgbG9uZyB1c2Ug c2luZ2xlIHRva2VuIG9yIHdpdGggcmUtd3JpdGluZyB0aGUgdG9rZW4gb24gZXZlcnkgc2VnbWVu dCB0aGUgQ0ROIGNhbiBwcm9jZXNzIGVhY2ggcmVxdWVzdCBpbmRlcGVuZGVudGx5LiBXaXRoIGEg dG9rZW4gdGhhdCBjaGFuZ2VzIGFmdGVyIGEgdmFyaWFibGUgbnVtYmVyIG9mIHNlZ21lbnRzLCB0 aGUgQ0ROIG5vdyBuZWVkcyB0byBrZWVwIHN0YXRlIGFib3V0IGhvdyBtYW55IHRpbWVzIGl0DQog aGFzIHNlZW4gdGhlIHRva2VuIGFscmVhZHkgYW5kIG5lZWRzIHRvIGNvLW9yZGluYXRlIHRoYXQg c3RhdGUgYWNyb3NzIHRoZSBDRE4gaW4gY2FzZSBzb21lIG9mIHRoZSByZXF1ZXN0cyBnbyB0byBk aWZmZXJlbnQgc3Vycm9nYXRlcywgZXRjLjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsgSXQg c291bmRzIGxpa2UgYSBsb3Qgb2YgY29tcGxleGl0eSBmb3IgbGl0dGxlIHJlYWwgYmVuZWZpdCBJ TU8uPGJyPg0KJmd0Ozxicj4NCiZndDsgRnVsbHkgYWdyZWUuPGJyPg0KJmd0Ozxicj4NCiZndDsg KE9uZSB3YXkgdG8gaW1wbGVtZW50IGl0IHdvdWxkIGJlIHRvIGhhdmUgc29tZSBzb3J0IG9mIEV4 cGlyYXRpb24gVGltZSBUaHJlc2hvbGQgdG8gaW5kaWNhdGUgd2hlbiB0aGUgQ0ROIHNob3VsZCBy ZWZyZXNoIHRoZSB0b2tlbiwgYnV0IHRoYXQgd291bGQgcmVzdWx0IGluIGFsbCBraW5kcyBvZiBp c3N1ZXMsIHN1Y2ggYXMgZWZmZWN0aXZlbHkgaGF2aW5nIHZhcmlhYmxlIHRva2VuIGxlbmd0aHMg d2hpY2ggd2lsbCBjYXVzZSBpc3N1ZXMgaW4NCiBjYXNlcyBvZiBwcm9sb25nZWQgcGF1c2UpPGJy Pg0KJmd0Ozxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IE5hbWUgY29sbGlzaW9uPGJy Pg0KJmd0OyZndDsmZ3Q7IE1QRUcgZXhwZXJ0cyB1bmRlcnN0YW5kIHRoYXQgdGhlIG5hbWUgVVJJ U2lnbmluZ1BhY2thZ2UsIGFzIGEgcXVlcnkgc3RyaW5nLCBhcyBhbiBIVFRQIGhlYWRlciBwYXJh bWV0ZXIgb3IgaW4gYSBjb29raWUsIGNvbnN0aXR1dGVzIGEgbm9ybWF0aXZlIGFzcGVjdCBvZiB0 aGUgVVJJIFNpZ25pbmcgc3BlY2lmaWNhdGlvbi4gTVBFRyBleHBlcnRzIHdvdWxkIGxpa2UgdG8g a25vdyB3aGV0aGVyIHRoZSBJRVRGIENETkkgd29ya2luZyBncm91cA0KIGhhcyBkZWNpZGVkIHRo ZSBhcHByb3ByaWF0ZSBhcHByb2FjaCB0byBwcmV2ZW50IG5hbWUgY29sbGlzaW9uLjxicj4NCiZn dDs8YnI+DQomZ3Q7IFRoZSBjdXJyZW50IGJhc2UgVVJJIHNpZ25pbmcgc3BlYyBhbHJlYWR5IGFs bG93cyBvdmVycmlkaW5nIHRoZSBVUklTaWduaW5nUGFja2FnZSBxdWVyeSBzdHJpbmcgcGFyYW1l dGVyIGJhc2VkIG9uIGUuZy4gTWV0YWRhdGEuIEluIGNhc2Ugb2YgREFTSCwgYW5kIGNsaWVudHMg aGF2aW5nIHRvIGtub3cgdGhpcyBuYW1lLCBJIHRoaW5rIHRoZSBiZXN0IHNvbHV0aW9uIHdvdWxk IGJlIHRvIGp1c3QgY29udmV5IGl0IGluIHRoZSBNUEQuPGJyPg0KJmd0Ozxicj4NCiZndDsmZ3Q7 Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyBDb25zZWN1dGl2ZSB0b2tlbnM8YnI+DQomZ3Q7Jmd0OyZn dDsgQWNjb3JkaW5nIHRvIHRoZSBVUkkgU2lnbmluZyBmb3IgSFRUUCBBZGFwdGl2ZSBTdHJlYW1p bmcgZHJhZnQsIHRoZSBzZXJ2ZXIgbWF5IGlzc3VlIG11bHRpcGxlIHRva2VucyBhbmQgZGVsaXZl cmVkIHRoZW0gaW4gY29uc2VjdXRpdmUgSFRUUCByZXF1ZXN0cy4gSXQgZG9lcyBub3Qgc2VlbSB0 aGF0IHRoZXJlIGlzIGEgZGVwZW5kZW5jeSBiZXR3ZWVuIHRoZSB0b2tlbnMuIENvdWxkIElFVEYg ZXhwZXJ0IGNvbmZpcm0gdGhhdCBhIHRva2VuDQogaXNzdWVkIGF0IHRpbWUgdCBkb2VzIG5vdCBp bnZhbGlkYXRlIGEgdG9rZW4gaXNzdWVkIHByaW9yIHRvIHRpbWUgdCA/PGJyPg0KJmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyBJbiB0aGUgMyB0b2tlbiBpbXBsZW1lbnRhdGlvbnMgSSBhbSBmYW1pbGlh ciB3aXRoIHRva2VucyBhcmUgY29tcGxldGVseSBpbmRlcGVuZGVudCBhbmQgYSB0b2tlbiBpc3N1 ZWQgYXQgdGltZSB0IGRvZXMgbm90IGludmFsaWRhdGUgYSB0b2tlbiBpc3N1ZWQgcHJpb3IgdG8g dGltZSB0Ljxicj4NCiZndDs8YnI+DQomZ3Q7IEFncmVlZC4gQXBhcnQgZnJvbSBoYXZpbmcgdG8g a2VlcCBhbmQgc3luY2hyb25pc2Ugc3RhdGUgYWNyb3NzIG5vZGVzLCBJIGRvbid0IHNlZSBob3cg eW91IGNvdWxkIGV2ZW4gaW1wbGVtZW50IGl0Ljxicj4NCiZndDs8YnI+DQomZ3Q7Jmd0Ozxicj4N CiZndDsmZ3Q7IEJlbjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZn dDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IE1QRUcga2luZGx5IGFza3MgdGhlIElFVEYgQ0ROSSB3 b3JraW5nIGdyb3VwIHRvIGNvbnNpZGVyIHRoZSBhYm92ZSBvYnNlcnZhdGlvbnMgYW5kIHdlbGNv bWUgZnVydGhlciBjb2xsYWJvcmF0aW9uIG9uIHRoaXMgdG9waWMuPGJyPg0KJmd0OyZndDsmZ3Q7 PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7IE91 ciBmdXR1cmUgbWVldGluZ3M6PGJyPg0KJmd0OyZndDsmZ3Q7IC0mbmJzcDsgJm5ic3A7IERBU0gg QWQtaG9jIG1lZXRpbmdzLCAyMSBGZWJydWFyeSAyMDE2LCBTYW4gRGllZ28sIENBPGJyPg0KJmd0 OyZndDsmZ3Q7IC0mbmJzcDsgJm5ic3A7IFRoZSAxMTR0aCBNUEVHIG1lZXRpbmcsIDIyIC0gMjYg RmVicnVhcnkgMjAxNiwgU2FuIERpZWdvLCBDQTxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsm Z3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyBBdHRhY2htZW50czo8YnI+DQomZ3Q7Jmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyZndDsmbmJzcDsgMjluMTUzODExPGJyPg0KJmd0OyZndDsmZ3Q7Jm5ic3A7 PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9 Imh0dHBzOi8vd3d3LmlldGYub3JnL2xpYi9kdC9kb2N1bWVudHMvTElBSVNPTi9saWFpc29uLTIw MTUtMTEtMDItaXNvLWllYy1qdGMxLXNjMjktd2cxMS1jZG5pLWxpYWlzb24tc3RhdGVtZW50LXRv LWlldGYtb24tdXJpLXNpZ25pbmctYXR0YWNobWVudC0xLmRvYyIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL2xpYi9kdC9kb2N1 bWVudHMvTElBSVNPTi9saWFpc29uLTIwMTUtMTEtMDItaXNvLWllYy1qdGMxLXNjMjktd2cxMS1j ZG5pLWxpYWlzb24tc3RhdGVtZW50LXRvLWlldGYtb24tdXJpLXNpZ25pbmctYXR0YWNobWVudC0x LmRvYzwvc3Bhbj48L2E+PGJyPg0KJmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7Jm5ic3A7 IDI5bjE1MzgxMSBodG08YnI+DQomZ3Q7Jmd0OyZndDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbGliL2R0L2RvY3VtZW50cy9MSUFJU09OL2xpYWlzb24tMjAxNS0xMS0wMi1pc28taWVjLWp0 YzEtc2MyOS13ZzExLWNkbmktbGlhaXNvbi1zdGF0ZW1lbnQtdG8taWV0Zi1vbi11cmktc2lnbmlu Zy1hdHRhY2htZW50LTIuaHRtIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbGliL2R0L2RvY3VtZW50cy9MSUFJU09OL2xpYWlz b24tMjAxNS0xMS0wMi1pc28taWVjLWp0YzEtc2MyOS13ZzExLWNkbmktbGlhaXNvbi1zdGF0ZW1l bnQtdG8taWV0Zi1vbi11cmktc2lnbmluZy1hdHRhY2htZW50LTIuaHRtPC9zcGFuPjwvYT48YnI+ DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7Jmd0OyZndDsgQ0ROaSBtYWlsaW5nIGxp c3Q8YnI+DQomZ3Q7Jmd0OyZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOkNETmlAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPkNETmlAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCiZndDsmZ3Q7Jmd0Ozxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkiIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2Nkbmk8L3NwYW4+PC9hPjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsgX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7Jmd0 OyBDRE5pIG1haWxpbmcgbGlzdDxicj4NCiZndDsmZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpDRE5pQGlldGYub3JnIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5DRE5pQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQom Z3Q7Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48 YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkiIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2Nkbmk8L3NwYW4+PC9hPjxicj4NCiZndDsgVGhpcyBtZXNzYWdl IG1heSBjb250YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZvciB5b3UuIElm IHlvdSBhcmUgbm90IHRoZSBhZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdhcyBzZW50IHRv IHlvdSBieSBtaXN0YWtlLCB5b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhlIHNlbmRlciBh bmQgZGVsZXRlIHRoZSBtZXNzYWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkgZm9yIHRoZSBj b250ZW50IG9mIHRoaXMNCiBlLW1haWwsIGZvciB0aGUgbWFubmVyIGluIHdoaWNoIHlvdSB1c2Ug aXQgYW5kIGZvciBkYW1hZ2Ugb2YgYW55IGtpbmQgcmVzdWx0aW5nIGZyb20gdGhlIHJpc2tzIGlu aGVyZW50IHRvIHRoZSBlbGVjdHJvbmljIHRyYW5zbWlzc2lvbiBvZiBtZXNzYWdlcy48YnI+DQo8 YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CkNETmkgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkNETmlAaWV0Zi5vcmciPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPkNETmlAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaSIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vY2RuaTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_A419F67F880AB2468214E154CB8A556206C1F823eusaamb103erics_-- From nobody Mon Dec 14 12:07:48 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 200EE1B2E83 for ; Mon, 14 Dec 2015 12:07:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.201 X-Spam-Level: X-Spam-Status: No, score=-6.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5SX31CJHz3IB for ; Mon, 14 Dec 2015 12:07:43 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C52191B2E85 for ; Mon, 14 Dec 2015 12:07:43 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-ee-566f2188d040 Received: from EUSAAHC006.ericsson.se (Unknown_Domain [147.117.188.90]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id ED.BE.32102.8812F665; Mon, 14 Dec 2015 21:07:36 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC006.ericsson.se ([147.117.188.90]) with mapi id 14.03.0248.002; Mon, 14 Dec 2015 15:07:42 -0500 From: Kevin Ma J To: "cdni@ietf.org" Thread-Topic: Response to Liaison Statement on URI Signing Thread-Index: AdE2lBu7d05r8E4UT/O4koQZbwRotQ== Date: Mon, 14 Dec 2015 20:07:41 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLLMWRmVeSWpSXmKPExsUyuXRPlG6HYn6Ywc0XRhZPZ/9hdWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxpWfDSwFh9Qrfh47wdrA+Euhi5GTQ0LAROLEif1MELaYxIV7 69m6GLk4hASOMEpMvLuFEcJZzihxZfkjVpAqNgEticdf/wJ1cHCICChL/DzkCBIWFjCVuDFx GwuILSJgJbHo7SIoW0+ia98XRhCbRUBVYtqtJmYQm1fAV6LtzkowmxFo8fdTa8COYBYQl7j1 ZD7UQQISS/acZ4awRSVePv7HCmErSuzrn84OUa8jsWD3JzYIW1ti2cLXUPMFJU7OfMIygVF4 FpKxs5C0zELSMgtJywJGllWMHKXFBTm56UaGmxiBgXxMgs1xB+PeXs9DjAIcjEo8vBsE88OE WBPLiitzDzFKcDArifDqygKFeFMSK6tSi/Lji0pzUosPMUpzsCiJ8zIyMDAICaQnlqRmp6YW pBbBZJk4OKUaGK25OyoZCphTDJRsslXz2Mpv+7ZdCWAW3PHmUIVW7StDkYCty2d3ViQo/Th/ 6uz9jMkXZj7lWDstR5thVeSJx79/ThSxsYtdoVCt5/GBKz/xbJBNqYDOxasXTyr3vn88WWSP U8QZp28e5533eewx2bJ9Fe/E1r/7Y9MSPgarR7PkTmpbFHMuXImlOCPRUIu5qDgRAE/H8xhg AgAA Archived-At: Subject: [CDNi] Response to Liaison Statement on URI Signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 20:07:46 -0000 Hi All, (as a chair) As per the Open Discussion action item from Yokohama [1], th= e chairs have worked with Ray to draft a response to the MPEG liaison state= ment on URI Signing [2]. Please find the response below, and feel free to = send comments to the list. If there are no objections or unaddressed comme= nts by December 30th, we will send the official response to MPEG. thanx! -- Kevin J. Ma =20 [1] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni [2] https://datatracker.ietf.org/liaison/1434/ ----- From: Kevin J. Ma >From Group: CDNI To: Watanabe Shinji To Group: ISO-IEC-JTC1-SC29 Title: Response to request for information on URI Signing 2015-11-02 Response Contact: Kevin J. Ma Technical Contact: Ray van Brandenburg Purpose: In Response Body: The IETF CDNI working group would like to acknowledge our receipt of the MP= EG experts liaison letter and careful consideration during the 94th IETF me= eting. Having reviewed the Online Multimedia Authorization Protocol Version 1.0 (O= MAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the proposed= scope of usage for CDNI URI Signing to be the only as the Access Token, as= returned by the authorization server in step (E) of sections 2.3 and 2.4 o= f the OMAPv1 specification, to be use solely for authorizing requests to th= e resource server (i.e., the CDN), as described in steps (F) and (G) of sec= tions 2.3 and 2.4 of the OMAPv1 specification. We agree that this is an ex= emplary use case for CDNI URI Signing with the Path Pattern Information Ele= ment. =20 At the 93rd IETF, the CDNI working group decided to remove text related to = signing of segmented content URIs from the CDNI URI Signing draft [draft-ie= tf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd I= ETF [minutes-93-cdni]. The removed sections are currently documented in a s= eparate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension= to the main URI signing document. It should be noted that at this point, t= hat document is regarded as an independent submission and IETF has not made= a decision regarding its future status. At the 94th IETF, it was agreed th= at the Path Pattern Information element was not covered by the IPR disclosu= re and would be a useful feature for a number of URI Signing use cases, inc= luding segmented content [minutes-94-cdni]. Path Pattern support will be re= instated in a future revision of the main URI signing draft. =20 With respect to long-lived tokens, as mentioned in the Security Considerati= ons section (9) of the CDNI URI Signing draft, increasing the token validit= y period increases the potential for replay attacks, including DoS attacks;= however, nothing in the protocol prevents the use of long-lived tokens.=20 With respect to CDNs refreshing tokens, the CDNI working group discussed me= chanisms for signaling token refresh between CDNs and felt that the require= d additional complexity of such a mechanism outweighed the cost of regenera= ting the tokens. Note: Signaling between CDNs and clients is out-of-scope f= or CDNI. As mentioned above, chained token support was removed from the cur= rent CDNI URI Signing draft and there is no plan to reinstate it in the mai= n URI signing document due to IPR issues. As such, the topic of token regen= eration is limited to [draft-brandenburg-cdni-uri-signing-for-has]. With respect to name collisions, the current version of the CDNI URI Signin= g draft only supports query-string-based conveyance of the token. The meta= data element "package-attribute" was introduced to allow content service pr= oviders (CSPs) to select any query string parameter name they wanted, assum= ing that CSPs would be in the best position to select a low-collision-proba= bility name; URISigningPackage is only the default name. =20 With respect to consecutive tokens, the CDNI URI Signing mechanism was desi= gned to be stateless, so that consecutive tokens can be retrieved from diff= erent delivery nodes. As such, there is no relationship between consecutive= tokens and token invalidation is solely based on the Expiry Time informati= on element. The CDNI working group appreciates the MPEG experts' thoughtful input and l= ooks forward to continued collaboration with MPEG experts on URI Signing. =20 Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina [2012_09_28_OATC-OMAP_1-0] http://www.oatc.us/Portals/_default/Knowledgebas= e/1/2012_09_28_OATC-OMAP_1-0.pdf [draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-ietf-c= dni-uri-signing/ [draft-brandenburg-cdni-uri-signing-for-has] https://datatracker.ietf.org/d= oc/draft-brandenburg-cdni-uri-signing-for-has/ [minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-93-cd= ni [minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-94-cd= ni From nobody Tue Dec 15 00:24:59 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E78B21A1BA9 for ; Tue, 15 Dec 2015 00:24:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.115 X-Spam-Level: X-Spam-Status: No, score=-2.115 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cHElHK35aniV for ; Tue, 15 Dec 2015 00:24:53 -0800 (PST) Received: from fromintoutb.tno.nl (fromintoutb.tno.nl [134.221.1.27]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCD8C1A1A6F for ; Tue, 15 Dec 2015 00:24:52 -0800 (PST) X-IronPort-AV: E=Sophos;i="5.20,431,1444687200"; d="scan'208,217";a="8714117" Received: from exc-cashub03.tsn.tno.nl (HELO mail.tno.nl) ([134.221.225.222]) by mailhost1b.tno.nl with ESMTP; 15 Dec 2015 09:24:50 +0100 Received: from EXC-MBX03.tsn.tno.nl ([fe80::e969:1300:fb9f:7e12]) by EXC-CASHUB03.tsn.tno.nl ([fe80::6d39:f277:173e:a926%13]) with mapi id 14.03.0248.002; Tue, 15 Dec 2015 09:24:51 +0100 From: "Brandenburg, R. (Ray) van" To: Ben Niven-Jenkins Thread-Topic: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 Thread-Index: AQHRMpE9snEG1azLLU+hJiWtSuTSHp7C15GA///7uoCAAAT3gIABB+cAgAbOFACAARDDgA== Date: Tue, 15 Dec 2015 08:24:50 +0000 Message-ID: References: <39F63763-F4DA-4AD2-AA8B-ED7B5200CB89@tno.nl> <87B3E8C2-A530-427E-8F22-39DB88A13DE0@niven-jenkins.co.uk> In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151206 x-originating-ip: [134.221.225.191] Content-Type: multipart/alternative; boundary="_000_AF33AF866F194112A679C8CC205BC41Btnonl_" MIME-Version: 1.0 Archived-At: Cc: "" Subject: Re: [CDNi] draft-brandenburg-cdni-uri-signing-for-has-01 X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 08:24:58 -0000 --_000_AF33AF866F194112A679C8CC205BC41Btnonl_ Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQoNCkZyb206IEJlbiBOaXZlbi1KZW5raW5zIDxiZW5Abml2ZW4tamVua2lucy5j by51azxtYWlsdG86YmVuQG5pdmVuLWplbmtpbnMuY28udWs+Pg0KRGF0ZTogTW9uZGF5IDE0IERl Y2VtYmVyIDIwMTUgYXQgMTg6MDgNClRvOiBSYXkgdmFuIEJyYW5kZW5idXJnIDxyYXkudmFuYnJh bmRlbmJ1cmdAdG5vLm5sPG1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPj4NCkNjOiAi Y2RuaUBpZXRmLm9yZzxtYWlsdG86Y2RuaUBpZXRmLm9yZz4iIDxjZG5pQGlldGYub3JnPG1haWx0 bzpjZG5pQGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbQ0ROaV0gZHJhZnQtYnJhbmRlbmJ1cmct Y2RuaS11cmktc2lnbmluZy1mb3ItaGFzLTAxDQoNCkhpIFJheSwNCg0KT24gMTAgRGVjIDIwMTUs IGF0IDA4OjEzLCBCcmFuZGVuYnVyZywgUi4gKFJheSkgdmFuIDxyYXkudmFuYnJhbmRlbmJ1cmdA dG5vLm5sPG1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPj4gd3JvdGU6DQpPbiAwOS8x Mi8xNSAxODoyOCwgIkJlbiBOaXZlbi1KZW5raW5zIiA8YmVuQG5pdmVuLWplbmtpbnMuY28udWs8 bWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrPj4gd3JvdGU6DQoNCihJIHJlYWxpc2VkIEni gJlkIG9ubHkgc2VudCBteSByZXNwb25zZSBiZWxvdyB0byBSYXkgJiBub3QgdGhlIGVudGlyZSBX RykuIEJlbg0KDQpPbiA5IERlYyAyMDE1LCBhdCAxNzoxMSwgQmVuIE5pdmVuLUplbmtpbnMgPGJl bkBuaXZlbi1qZW5raW5zLmNvLnVrPG1haWx0bzpiZW5Abml2ZW4tamVua2lucy5jby51az4+IHdy b3RlOg0KDQpIaSBSYXksDQoNCk9uIDkgRGVjIDIwMTUsIGF0IDE2OjI2LCBCcmFuZGVuYnVyZywg Ui4gKFJheSkgdmFuIDxyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPG1haWx0bzpyYXkudmFuYnJh bmRlbmJ1cmdAdG5vLm5sPj4gd3JvdGU6DQpPbiAwOS8xMi8xNSAxNTo1MSwgIkNETmkgb24gYmVo YWxmIG9mIEJlbiBOaXZlbi1KZW5raW5zIiA8Y2RuaS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpj ZG5pLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBiZW5Abml2ZW4tamVua2lucy5jby51 azxtYWlsdG86YmVuQG5pdmVuLWplbmtpbnMuY28udWs+PiB3cm90ZToNCkFzc3VtaW5nIHlvdSBk b27igJl0IGludGVuZCB0byBoYXZlIGEgbmV3IHB1YmxpYy9wcml2YXRlIGtleSBnZW5lcmF0ZWQg Zm9yIGVhY2ggc2lnbmVkIHRva2VuIGluIHRoZSBjaGFpbiwgc29tZXRoaW5nIHRoYXQgb2NjdXJy ZWQgdG8gbWUgaXMgdGhhdCB0aGUgZHJhZnQgaW50cm9kdWNlcyBhIHN1YnRsZSBjaGFuZ2UgdG8g dGhlIHJlc3BvbnNpYmlsaXRpZXMgb2YgdGhlIENETiAvIGV4cG9zdXJlIG9mIHRoZSBDU1AgZm9y IGFzeW1tZXRyaWMgc2lnbmF0dXJlcy4NCg0KVG9kYXkgYSBDU1AgZ2VuZXJhdGVzIGEgdG9rZW4g YW5kIGEgQ0ROIHZhbGlkYXRlcyBpdC4gVGhlIHVyaS1zaWduaW5nLWZvci1oYXMgZHJhZnQgYWxs b3dzIHRoZSBDRE4gdG8gY3JlYXRlIGEgdG9rZW4gZm9yIGl0c2VsZi4gSW4gdGhlIHBhc3QgdGhl IENETiBjb3VsZCBhbHdheXMgaGF2ZSBkb25lIHRoYXQgYW55d2F5IHdpdGggYSBzaGFyZWQga2V5 IGJ1dCBjb3VsZG7igJl0IHdpdGggYW4gYXN5bW1ldHJpYyBzaWduYXR1cmUgYmVjYXVzZSB0aGUg Q0ROIG5ldmVyIGhhZCBhY2Nlc3MgdG8gdGhlIHByaXZhdGUga2V5LiB1cmktc2duaW5nLWZvci1o YXMgcmVxdWlyZXMgdGhlIENETiB0byBoYXZlIHRoZSBwcml2YXRlIGtleSBpbiBvcmRlciB0byBj cmVhdGVkIGNoYWluZWQgdG9rZW5zLiBUaGF0IG1pZ2h0IG5vdCBiZSBhIHByb2JsZW0gZm9yIENT UHMgYnV0IGl04oCZcyBwcm9iYWJseSB3b3J0aCBjYWxsaW5nIG91dCBzb21ld2hlcmUgaW4gdGhl IGRyYWZ0IHRoYXQgdWktc2lnbmluZy1mb3ItaGFzIHJlcXVpcmVkIHRoZSBDRE4gdG8gaGF2ZSB0 aGUgcHJpdmF0ZSBrZXkgd2hlcmVhcyBpZXRmLXNpZ25lZC11cmlzIGRyYWZ0IGRvZXMgbm90Lg0K DQpIbW0sIGdvb2QgcG9pbnQuIEluIHByYWN0aWNlLCBJIGFzc3VtZSB0aGUgQ0ROIHdvdWxkIG5v dCB1c2UgdGhlIENTUCdzIHByaXZhdGUga2V5IGJ1dCB1c2UgYW4gaW50ZXJuYWwgb25lIGZvciBz dWJzZXF1ZW50IHRva2VucywgYnV0IHlvdSdyZSByaWdodCB0aGF0IHdlIHNob3VsZCBjYWxsIHRo aXMgb3V0IHNvbWV3aGVyZS4gSW4gYW55IGNhc2UsIEkgZXhwZWN0IHRoZSB1c2Ugb2YgYXN5bW1l dHJpYyBrZXlzIGZvciBjaGFpbmVkIHRva2VucyB3b3VsZCBvbmx5IGJlIGJlbmVmaWNpYWwgaW4g dmVyeSBzcGVjaWZpYyBjaXJjdW1zdGFuY2UgYW55d2F5Lg0KDQpJZiB0aGUgQ0ROIHVzZXMgYW4g aW50ZXJuYWwga2V5LCB3aGF0IGhhcHBlbnMgaWYgYSBzdWJzZXF1ZW50IHJlcXVlc3QgZnJvbSB0 aGUgY2xpZW50IGdvZXMgdG8gYSBkaWZmZXJlbnQgQ0ROPyBFLmcuIEROUyBiYXNlZCByZXF1ZXN0 IHJvdXRpbmcgd2hlcmUgdGhlIGNsaWVudCBkb2VzIGEgRE5TIGxvb2t1cCBwZXIgc2VnbWVudCAo d2hpY2ggaXMgaG93IHRoZSBpT1MgY2xpZW50IGJlaGF2ZXMgQUZBSUspIGFuZCB0aGUgcmVzdWx0 cyByZXR1cm5lZCBpbiBETlMgY2hhbmdlICh0aGUgdUNETiBwaWNrcyBhIGRpZmZlcmVudCBkQ0RO IG9yIHRoZSBDU1AgaXMgdXNpbmcgYSBDRE4gc2VsZWN0b3IgZm9yIGV4YW1wbGUpLg0KDQpCZW4N Cg0KDQpBcyBsb25nIGFzIHRoZSBDRE4gdGhhdCBjcmVhdGVkIHRoZSB0b2tlbiBtYWtlcyBpdCdz IHB1YmxpYyBrZXkgYXZhaWxhYmxlIChhbmQgcGxhY2VzIHRoZSBVUkkgaW4gdGhlIEtleUlEIGZp ZWxkKSwgaXQgc2hvdWxkbid0IG1hdHRlciwgcmlnaHQ/IEhvdyBpcyB0aGlzIGRpZmZlcmVudCBm cm9tIHRoZSBzaW5nbGUgKG5vbi1jaGFpbmVkKSB0b2tlbiBzY2VuYXJpbz8NCg0KWW91IGFyZSBy aWdodCB0aGlzIGlzbuKAmXQgYW55IGRpZmZlcmVudCB0byB0aGUgbm9uLWNoYWluZWQgdG9rZW4g c2NlbmFyaW8gYnV0IEnigJlkIG92ZXJsb29rZWQgdGhhdCBLRVlJRCBjb250YWluZWQgYSByZWZl cmVuY2UgdG8gd2hlcmUgdG8gb2J0YWluIHRoZSBwdWJsaWMga2V5Lg0KDQpJ4oCZZCBhc3N1bWVk IHRoYXQgdGhlIHB1YmxpYyBrZXkgd291bGQgYmUgY2FycmllZCBpbiBDRE5JIG1ldGFkYXRhIChv ciBvdGhlcndpc2Ugb3V0IG9mIGJhbmQgb2YgdGhlIHRva2VuIGl0c2VsZikgbGlrZSBpdCB3b3Vs ZCBuZWVkIHRvIGJlIGZvciBzaGFyZWQgc2VjcmV0cy4NCg0KV2hpY2ggbWFkZSBtZSB0aGluayB0 aGF0IGlmIGFueSBkQ0ROIGNhbiByZWNyZWF0ZSB0aGUgdG9rZW4gdXNpbmcgdGhlaXIgb3duIGtl eSAmIGluc2VydCBhIHJlZmVyZW5jZSB0byB0aGUgcHVibGljIGtleSBpbiB0aGUgS0VZSUQsIHdo YXTigJlzIHRvIHN0b3AgSm9lIFB1YmxpYyBkb2luZyB0aGUgc2FtZSBhbmQgbWludGluZyB0aGVp ciBvd24gdG9rZW5zPyBXb3VsZCB0aGF0IG1lYW4gd2XigJlkIGhhdmUgdG8gZGlzdHJpYnV0ZSBh IGZvcm0gb2YgInB1YmxpYyBrZXlzIGZvciB0b2tlbnPigJ0gd2hpdGVsaXN0IChjb250YWluaW5n IGFsbCBwdWJsaWMga2V5cyB0aGF0IGNhbiBiZSB1c2VkIHRvIHZhbGlkYXRlIGEgdG9rZW4vaG9z dG5hbWUvc2l0ZSksIHdoZXJlYXMgaWYgb25seSB0aGUgQ1NQIGNvdWxkIGdlbmVyYXRlIHRoZSB0 b2tlbiB5b3XigJlkIG9ubHkgbmVlZCB0byBkaXN0cmlidXRlIGEgc2luZ2xlIHB1YmxpYyBrZXkg KHRoZSBDU1BzKT8NCg0KWW91J3JlIHJpZ2h0IHRoYXQgdGhpcyBpcyBpbmRlZWQgYSBjb25jZXJu LiBJbiBwcmFjdGljZSwgSSB3b3VsZCBpbWFnaW5lIGEgQ0ROIHdvdWxkIGluZGVlZCBvbmx5IGFj Y2VwdCBhIHdoaXRlbGlzdGVkIGxpc3Qgb2YgS0lEcywgb3IgZG9tYWlucywgYWx0aG91Z2ggSSBk b24ndCB0aGluayB3ZSBuZWVkIHRvIHNwZWNpZnkgYSBtZWNoYW5pc20gZm9yIGRpc3RyaWJ1dGlu ZyBzdWNoIGEgbGlzdC4NCg0KVGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2Yg dGhlIG1haW4gVVJJIFNpZ25pbmcgZG9jdW1lbnQgY3VycmVudGx5IGluY2x1ZGVzIHRoZSBmb2xs b3dpbmcgcGFyYWdyYXBoOg0KDQoiIEluIHRoZSBjYXNlIHdoZXJlIGFzeW1tZXRyaWMga2V5cyBh cmUgdXNlZCwgdGhlIEtJRCBpbmZvcm1hdGlvbiBlbGVtZW50IG1pZ2h0IGNvbnRhaW4gdGhlIFVS TCB0byB0aGUgcHVibGljIGtleS4gIFRvIHByZXZlbnQgbWFsaWNpb3VzIGNsaWVudHMgZnJvbSBz aWduaW5nIHRoZWlyIG93biBVUklzIGFuZCBpbnNlcnRpbmcgdGhlIGFzc29jaWF0ZWQgcHVibGlj IGtleSBVUkwgaW4gdGhlIEtJRCBmaWVsZCwgdGhlcmVieSBwYXNzaW5nIFVSSSB2YWxpZGF0aW9u LCBpdCBpcyBpbXBvcnRhbnQgdGhhdCBDRE5zIGNoZWNrIHdoZXRoZXIgdGhlIFVSSSBjb252ZXll ZCBpbiB0aGUgS0lEIGZpZWxkIGlzIGluIHRoZSBhbGxvd2FibGUgc2V0IG9mIEtJRHMgYXMgbGlz dGVkIGluIHRoZSBDRE5JIG1ldGFkYXRhIG9yIHNldCB2aWEgY29uZmlndXJhdGlvbi4iDQoNCklu IGFkZGl0aW9uLCB0aGUgYWxnb3JpdGhtIGl0c2VsZiBhbHNvIG1lbnRpb25zIHRoYXQgdXBvbiBy ZWNlaXZpbmcgYSBwdWJsaWMga2V5IFVSTCwgdGhlIHJlY2VpdmluZyBDRE4gc2hvdWxkIGNoZWNr IHdoZXRoZXIgaXQgaXMgaW4gdGhlIGFwcHJvdmVkIGxpc3Qgb2YgS0VZIElEcyAocmVjZWl2ZWQg ZWl0aGVyIHZpYSBtZXRhZGF0YSBvciBzZXQgYnkgY29uZmlndXJhdGlvbikuDQoNClRoYW5rcywN Cg0KUmF5DQoNClRoYW5rcw0KQmVuDQoNClRoaXMgbWVzc2FnZSBtYXkgY29udGFpbiBpbmZvcm1h dGlvbiB0aGF0IGlzIG5vdCBpbnRlbmRlZCBmb3IgeW91LiBJZiB5b3UgYXJlIG5vdCB0aGUgYWRk cmVzc2VlIG9yIGlmIHRoaXMgbWVzc2FnZSB3YXMgc2VudCB0byB5b3UgYnkgbWlzdGFrZSwgeW91 IGFyZSByZXF1ZXN0ZWQgdG8gaW5mb3JtIHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSB0aGUgbWVzc2Fn ZS4gVE5PIGFjY2VwdHMgbm8gbGlhYmlsaXR5IGZvciB0aGUgY29udGVudCBvZiB0aGlzIGUtbWFp bCwgZm9yIHRoZSBtYW5uZXIgaW4gd2hpY2ggeW91IHVzZSBpdCBhbmQgZm9yIGRhbWFnZSBvZiBh bnkga2luZCByZXN1bHRpbmcgZnJvbSB0aGUgcmlza3MgaW5oZXJlbnQgdG8gdGhlIGVsZWN0cm9u aWMgdHJhbnNtaXNzaW9uIG9mIG1lc3NhZ2VzLgo= --_000_AF33AF866F194112A679C8CC205BC41Btnonl_ Content-Type: text/html; charset="utf-8" Content-ID: <41916ADA56DC724CBDF1DCAA3E4EF945@tno.nl> MIME-Version: 1.0 Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJy ZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsgY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1zaXplOiAx NHB4OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2PkhpIEJlbiw8L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBpZD0iTUFD X09VVExPT0tfU0lHTkFUVVJFIj48L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ PGJyPg0KPC9kaXY+DQo8c3BhbiBpZD0iT0xLX1NSQ19CT0RZX1NFQ1RJT04iPg0KPGRpdiBzdHls ZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTsgZm9udC1zaXplOjEycHQ7IHRleHQtYWxpZ246bGVmdDsg Y29sb3I6YmxhY2s7IEJPUkRFUi1CT1RUT006IG1lZGl1bSBub25lOyBCT1JERVItTEVGVDogbWVk aXVtIG5vbmU7IFBBRERJTkctQk9UVE9NOiAwaW47IFBBRERJTkctTEVGVDogMGluOyBQQURESU5H LVJJR0hUOiAwaW47IEJPUkRFUi1UT1A6ICNiNWM0ZGYgMXB0IHNvbGlkOyBCT1JERVItUklHSFQ6 IG1lZGl1bSBub25lOyBQQURESU5HLVRPUDogM3B0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXdlaWdo dDpib2xkIj5Gcm9tOiA8L3NwYW4+QmVuIE5pdmVuLUplbmtpbnMgJmx0OzxhIGhyZWY9Im1haWx0 bzpiZW5Abml2ZW4tamVua2lucy5jby51ayI+YmVuQG5pdmVuLWplbmtpbnMuY28udWs8L2E+Jmd0 Ozxicj4NCjxzcGFuIHN0eWxlPSJmb250LXdlaWdodDpib2xkIj5EYXRlOiA8L3NwYW4+TW9uZGF5 IDE0IERlY2VtYmVyIDIwMTUgYXQgMTg6MDg8YnI+DQo8c3BhbiBzdHlsZT0iZm9udC13ZWlnaHQ6 Ym9sZCI+VG86IDwvc3Bhbj5SYXkgdmFuIEJyYW5kZW5idXJnICZsdDs8YSBocmVmPSJtYWlsdG86 cmF5LnZhbmJyYW5kZW5idXJnQHRuby5ubCI+cmF5LnZhbmJyYW5kZW5idXJnQHRuby5ubDwvYT4m Z3Q7PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OmJvbGQiPkNjOiA8L3NwYW4+JnF1b3Q7 PGEgaHJlZj0ibWFpbHRvOmNkbmlAaWV0Zi5vcmciPmNkbmlAaWV0Zi5vcmc8L2E+JnF1b3Q7ICZs dDs8YSBocmVmPSJtYWlsdG86Y2RuaUBpZXRmLm9yZyI+Y2RuaUBpZXRmLm9yZzwvYT4mZ3Q7PGJy Pg0KPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OmJvbGQiPlN1YmplY3Q6IDwvc3Bhbj5SZTogW0NE TmldIGRyYWZ0LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25pbmctZm9yLWhhcy0wMTxicj4NCjwv ZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu OjAgMCAwIDQwcHg7IGJvcmRlcjpub25lOyBwYWRkaW5nOjBweDsiPg0KPGRpdiBzdHlsZT0id29y ZC13cmFwOiBicmVhay13b3JkOyAtd2Via2l0LW5ic3AtbW9kZTogc3BhY2U7IC13ZWJraXQtbGlu ZS1icmVhazogYWZ0ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCkhpIFJheSwNCjxkaXYgY2xh c3M9IiI+PGJyIGNsYXNzPSIiPg0KPGRpdj4NCjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNsYXNz PSIiPg0KPGRpdiBjbGFzcz0iIj5PbiAxMCBEZWMgMjAxNSwgYXQgMDg6MTMsIEJyYW5kZW5idXJn LCBSLiAoUmF5KSB2YW4gJmx0OzxhIGhyZWY9Im1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5v Lm5sIiBjbGFzcz0iIj5yYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPC9hPiZndDsgd3JvdGU6PC9k aXY+DQo8ZGl2IGNsYXNzPSIiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogSGVsdmV0aWNhOyBm b250LXNpemU6IDEycHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50OiBub3JtYWw7 IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IGxpbmUtaGVpZ2h0 OiBub3JtYWw7IG9ycGhhbnM6IGF1dG87IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDog MHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd2lkb3dzOiBh dXRvOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyBm bG9hdDogbm9uZTsgZGlzcGxheTogaW5saW5lICFpbXBvcnRhbnQ7IiBjbGFzcz0iIj5Pbg0KIDA5 LzEyLzE1IDE4OjI4LCAmcXVvdDtCZW4gTml2ZW4tSmVua2lucyZxdW90OyAmbHQ7PC9zcGFuPjxh IGhyZWY9Im1haWx0bzpiZW5Abml2ZW4tamVua2lucy5jby51ayIgc3R5bGU9ImZvbnQtZmFtaWx5 OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTogMTJweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZh cmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1h bDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9y bWFsOyB3aWRvd3M6IGF1dG87IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tl LXdpZHRoOiAwcHg7IiBjbGFzcz0iIj5iZW5Abml2ZW4tamVua2lucy5jby51azwvYT48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6IEhlbHZldGljYTsgZm9udC1zaXplOiAxMnB4OyBmb250LXN0eWxl OiBub3JtYWw7IGZvbnQtdmFyaWFudDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0 ZXItc3BhY2luZzogbm9ybWFsOyBsaW5lLWhlaWdodDogbm9ybWFsOyBvcnBoYW5zOiBhdXRvOyB0 ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7 IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdpZG93czogYXV0bzsgd29yZC1zcGFjaW5nOiAwcHg7IC13 ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGlu ZSAhaW1wb3J0YW50OyIgY2xhc3M9IiI+Jmd0Ow0KIHdyb3RlOjwvc3Bhbj48YnIgc3R5bGU9ImZv bnQtZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTogMTJweDsgZm9udC1zdHlsZTogbm9ybWFs OyBmb250LXZhcmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNp bmc6IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGln bjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1z cGFjZTogbm9ybWFsOyB3aWRvd3M6IGF1dG87IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRl eHQtc3Ryb2tlLXdpZHRoOiAwcHg7IiBjbGFzcz0iIj4NCjxiciBzdHlsZT0iZm9udC1mYW1pbHk6 IEhlbHZldGljYTsgZm9udC1zaXplOiAxMnB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFy aWFudDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFs OyBsaW5lLWhlaWdodDogbm9ybWFsOyBvcnBoYW5zOiBhdXRvOyB0ZXh0LWFsaWduOiBzdGFydDsg dGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3Jt YWw7IHdpZG93czogYXV0bzsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Ut d2lkdGg6IDBweDsiIGNsYXNzPSIiPg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgc3R5bGU9ImZv bnQtZmFtaWx5OiBIZWx2ZXRpY2E7IGZvbnQtc2l6ZTogMTJweDsgZm9udC1zdHlsZTogbm9ybWFs OyBmb250LXZhcmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNp bmc6IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGln bjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1z cGFjZTogbm9ybWFsOyB3aWRvd3M6IGF1dG87IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRl eHQtc3Ryb2tlLXdpZHRoOiAwcHg7IiBjbGFzcz0iIj4NCihJIHJlYWxpc2VkIEnigJlkIG9ubHkg c2VudCBteSByZXNwb25zZSBiZWxvdyB0byBSYXkgJmFtcDsgbm90IHRoZSBlbnRpcmUgV0cpLiBC ZW48YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBj bGFzcz0iIj5PbiA5IERlYyAyMDE1LCBhdCAxNzoxMSwgQmVuIE5pdmVuLUplbmtpbnMgJmx0Ozxh IGhyZWY9Im1haWx0bzpiZW5Abml2ZW4tamVua2lucy5jby51ayIgY2xhc3M9IiI+YmVuQG5pdmVu LWplbmtpbnMuY28udWs8L2E+Jmd0OyB3cm90ZTo8YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+ DQpIaSBSYXksPGJyIGNsYXNzPSIiPg0KPGJyIGNsYXNzPSIiPg0KPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSIgY2xhc3M9IiI+T24gOSBEZWMgMjAxNSwgYXQgMTY6MjYsIEJyYW5kZW5idXJnLCBSLiAo UmF5KSB2YW4gJmx0OzxhIGhyZWY9Im1haWx0bzpyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sIiBj bGFzcz0iIj5yYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPC9hPiZndDsgd3JvdGU6PGJyIGNsYXNz PSIiPg0KT24gMDkvMTIvMTUgMTU6NTEsICZxdW90O0NETmkgb24gYmVoYWxmIG9mIEJlbiBOaXZl bi1KZW5raW5zJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86Y2RuaS1ib3VuY2VzQGlldGYub3Jn IiBjbGFzcz0iIj5jZG5pLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFsZiBvZg0KPGEgaHJl Zj0ibWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrIiBjbGFzcz0iIj5iZW5Abml2ZW4tamVu a2lucy5jby51azwvYT4mZ3Q7IHdyb3RlOjxiciBjbGFzcz0iIj4NCjxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiIGNsYXNzPSIiPkFzc3VtaW5nIHlvdSBkb27igJl0IGludGVuZCB0byBoYXZlIGEgbmV3 IHB1YmxpYy9wcml2YXRlIGtleSBnZW5lcmF0ZWQgZm9yIGVhY2ggc2lnbmVkIHRva2VuIGluIHRo ZSBjaGFpbiwgc29tZXRoaW5nIHRoYXQgb2NjdXJyZWQgdG8gbWUgaXMgdGhhdCB0aGUgZHJhZnQg aW50cm9kdWNlcyBhIHN1YnRsZSBjaGFuZ2UgdG8gdGhlIHJlc3BvbnNpYmlsaXRpZXMgb2YgdGhl IENETiAvIGV4cG9zdXJlDQogb2YgdGhlIENTUCBmb3IgYXN5bW1ldHJpYyBzaWduYXR1cmVzLjxi ciBjbGFzcz0iIj4NCjxiciBjbGFzcz0iIj4NClRvZGF5IGEgQ1NQIGdlbmVyYXRlcyBhIHRva2Vu IGFuZCBhIENETiB2YWxpZGF0ZXMgaXQuIFRoZSB1cmktc2lnbmluZy1mb3ItaGFzIGRyYWZ0IGFs bG93cyB0aGUgQ0ROIHRvIGNyZWF0ZSBhIHRva2VuIGZvciBpdHNlbGYuIEluIHRoZSBwYXN0IHRo ZSBDRE4gY291bGQgYWx3YXlzIGhhdmUgZG9uZSB0aGF0IGFueXdheSB3aXRoIGEgc2hhcmVkIGtl eSBidXQgY291bGRu4oCZdCB3aXRoIGFuIGFzeW1tZXRyaWMgc2lnbmF0dXJlIGJlY2F1c2UgdGhl IENETg0KIG5ldmVyIGhhZCBhY2Nlc3MgdG8gdGhlIHByaXZhdGUga2V5LiB1cmktc2duaW5nLWZv ci1oYXMgcmVxdWlyZXMgdGhlIENETiB0byBoYXZlIHRoZSBwcml2YXRlIGtleSBpbiBvcmRlciB0 byBjcmVhdGVkIGNoYWluZWQgdG9rZW5zLiBUaGF0IG1pZ2h0IG5vdCBiZSBhIHByb2JsZW0gZm9y IENTUHMgYnV0IGl04oCZcyBwcm9iYWJseSB3b3J0aCBjYWxsaW5nIG91dCBzb21ld2hlcmUgaW4g dGhlIGRyYWZ0IHRoYXQgdWktc2lnbmluZy1mb3ItaGFzIHJlcXVpcmVkDQogdGhlIENETiB0byBo YXZlIHRoZSBwcml2YXRlIGtleSB3aGVyZWFzIGlldGYtc2lnbmVkLXVyaXMgZHJhZnQgZG9lcyBu b3QuPGJyIGNsYXNzPSIiPg0KPC9ibG9ja3F1b3RlPg0KPGJyIGNsYXNzPSIiPg0KSG1tLCBnb29k IHBvaW50LiBJbiBwcmFjdGljZSwgSSBhc3N1bWUgdGhlIENETiB3b3VsZCBub3QgdXNlIHRoZSBD U1AncyBwcml2YXRlIGtleSBidXQgdXNlIGFuIGludGVybmFsIG9uZSBmb3Igc3Vic2VxdWVudCB0 b2tlbnMsIGJ1dCB5b3UncmUgcmlnaHQgdGhhdCB3ZSBzaG91bGQgY2FsbCB0aGlzIG91dCBzb21l d2hlcmUuIEluIGFueSBjYXNlLCBJIGV4cGVjdCB0aGUgdXNlIG9mIGFzeW1tZXRyaWMga2V5cyBm b3IgY2hhaW5lZCB0b2tlbnMgd291bGQNCiBvbmx5IGJlIGJlbmVmaWNpYWwgaW4gdmVyeSBzcGVj aWZpYyBjaXJjdW1zdGFuY2UgYW55d2F5LjxzcGFuIGNsYXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48YnIgY2xhc3M9IiI+DQo8L2Jsb2NrcXVvdGU+DQo8YnIgY2xhc3M9 IiI+DQpJZiB0aGUgQ0ROIHVzZXMgYW4gaW50ZXJuYWwga2V5LCB3aGF0IGhhcHBlbnMgaWYgYSBz dWJzZXF1ZW50IHJlcXVlc3QgZnJvbSB0aGUgY2xpZW50IGdvZXMgdG8gYSBkaWZmZXJlbnQgQ0RO PyBFLmcuIEROUyBiYXNlZCByZXF1ZXN0IHJvdXRpbmcgd2hlcmUgdGhlIGNsaWVudCBkb2VzIGEg RE5TIGxvb2t1cCBwZXIgc2VnbWVudCAod2hpY2ggaXMgaG93IHRoZSBpT1MgY2xpZW50IGJlaGF2 ZXMgQUZBSUspIGFuZCB0aGUgcmVzdWx0cyByZXR1cm5lZA0KIGluIEROUyBjaGFuZ2UgKHRoZSB1 Q0ROIHBpY2tzIGEgZGlmZmVyZW50IGRDRE4gb3IgdGhlIENTUCBpcyB1c2luZyBhIENETiBzZWxl Y3RvciBmb3IgZXhhbXBsZSkuPGJyIGNsYXNzPSIiPg0KPGJyIGNsYXNzPSIiPg0KQmVuPGJyIGNs YXNzPSIiPg0KPGJyIGNsYXNzPSIiPg0KPC9ibG9ja3F1b3RlPg0KPC9ibG9ja3F1b3RlPg0KPGJy IHN0eWxlPSJmb250LWZhbWlseTogSGVsdmV0aWNhOyBmb250LXNpemU6IDEycHg7IGZvbnQtc3R5 bGU6IG5vcm1hbDsgZm9udC12YXJpYW50OiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxl dHRlci1zcGFjaW5nOiBub3JtYWw7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG9ycGhhbnM6IGF1dG87 IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9u ZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd2lkb3dzOiBhdXRvOyB3b3JkLXNwYWNpbmc6IDBweDsg LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyIgY2xhc3M9IiI+DQo8c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6IEhlbHZldGljYTsgZm9udC1zaXplOiAxMnB4OyBmb250LXN0eWxlOiBub3Jt YWw7IGZvbnQtdmFyaWFudDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3Bh Y2luZzogbm9ybWFsOyBsaW5lLWhlaWdodDogbm9ybWFsOyBvcnBoYW5zOiBhdXRvOyB0ZXh0LWFs aWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRl LXNwYWNlOiBub3JtYWw7IHdpZG93czogYXV0bzsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQt dGV4dC1zdHJva2Utd2lkdGg6IDBweDsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1w b3J0YW50OyIgY2xhc3M9IiI+QXMNCiBsb25nIGFzIHRoZSBDRE4gdGhhdCBjcmVhdGVkIHRoZSB0 b2tlbiBtYWtlcyBpdCdzIHB1YmxpYyBrZXkgYXZhaWxhYmxlIChhbmQgcGxhY2VzIHRoZSBVUkkg aW4gdGhlIEtleUlEIGZpZWxkKSwgaXQgc2hvdWxkbid0IG1hdHRlciwgcmlnaHQ/IEhvdyBpcyB0 aGlzIGRpZmZlcmVudCBmcm9tIHRoZSBzaW5nbGUgKG5vbi1jaGFpbmVkKSB0b2tlbiBzY2VuYXJp bz88L3NwYW4+PGJyIHN0eWxlPSJmb250LWZhbWlseTogSGVsdmV0aWNhOyBmb250LXNpemU6IDEy cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50OiBub3JtYWw7IGZvbnQtd2VpZ2h0 OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IG9y cGhhbnM6IGF1dG87IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRy YW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd2lkb3dzOiBhdXRvOyB3b3JkLXNw YWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyIgY2xhc3M9IiI+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2 IGNsYXNzPSIiPllvdSBhcmUgcmlnaHQgdGhpcyBpc27igJl0IGFueSBkaWZmZXJlbnQgdG8gdGhl IG5vbi1jaGFpbmVkIHRva2VuIHNjZW5hcmlvIGJ1dCBJ4oCZZCBvdmVybG9va2VkIHRoYXQgS0VZ SUQgY29udGFpbmVkIGEgcmVmZXJlbmNlIHRvIHdoZXJlIHRvIG9idGFpbiB0aGUgcHVibGljIGtl eS48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNz PSIiPknigJlkIGFzc3VtZWQgdGhhdCB0aGUgcHVibGljIGtleSB3b3VsZCBiZSBjYXJyaWVkIGlu IENETkkgbWV0YWRhdGEgKG9yIG90aGVyd2lzZSBvdXQgb2YgYmFuZCBvZiB0aGUgdG9rZW4gaXRz ZWxmKSBsaWtlIGl0IHdvdWxkIG5lZWQgdG8gYmUgZm9yIHNoYXJlZCBzZWNyZXRzLjwvZGl2Pg0K PGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+V2hpY2gg bWFkZSBtZSB0aGluayB0aGF0IGlmIGFueSBkQ0ROIGNhbiByZWNyZWF0ZSB0aGUgdG9rZW4gdXNp bmcgdGhlaXIgb3duIGtleSAmYW1wOyBpbnNlcnQgYSByZWZlcmVuY2UgdG8gdGhlIHB1YmxpYyBr ZXkgaW4gdGhlIEtFWUlELCB3aGF04oCZcyB0byBzdG9wIEpvZSBQdWJsaWMgZG9pbmcgdGhlIHNh bWUgYW5kIG1pbnRpbmcgdGhlaXIgb3duIHRva2Vucz8gV291bGQgdGhhdCBtZWFuIHdl4oCZZCBo YXZlIHRvIGRpc3RyaWJ1dGUNCiBhIGZvcm0gb2YgJnF1b3Q7cHVibGljIGtleXMgZm9yIHRva2Vu c+KAnSB3aGl0ZWxpc3QgKGNvbnRhaW5pbmcgYWxsIHB1YmxpYyBrZXlzIHRoYXQgY2FuIGJlIHVz ZWQgdG8gdmFsaWRhdGUgYSB0b2tlbi9ob3N0bmFtZS9zaXRlKSwgd2hlcmVhcyBpZiBvbmx5IHRo ZSBDU1AgY291bGQgZ2VuZXJhdGUgdGhlIHRva2VuIHlvdeKAmWQgb25seSBuZWVkIHRvIGRpc3Ry aWJ1dGUgYSBzaW5nbGUgcHVibGljIGtleSAodGhlIENTUHMpPzwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjwvc3Bhbj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PllvdSdy ZSByaWdodCB0aGF0IHRoaXMgaXMgaW5kZWVkIGEgY29uY2Vybi4gSW4gcHJhY3RpY2UsIEkgd291 bGQgaW1hZ2luZSBhIENETiB3b3VsZCBpbmRlZWQgb25seSBhY2NlcHQgYSB3aGl0ZWxpc3RlZCBs aXN0IG9mIEtJRHMsIG9yIGRvbWFpbnMsIGFsdGhvdWdoIEkgZG9uJ3QgdGhpbmsgd2UgbmVlZCB0 byBzcGVjaWZ5IGEgbWVjaGFuaXNtIGZvciBkaXN0cmlidXRpbmcgc3VjaCBhIGxpc3QuJm5ic3A7 PC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5UaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlv bnMgc2VjdGlvbiBvZiB0aGUgbWFpbiBVUkkgU2lnbmluZyBkb2N1bWVudCBjdXJyZW50bHkgaW5j bHVkZXMgdGhlIGZvbGxvd2luZyBwYXJhZ3JhcGg6PC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0K PGRpdj4mcXVvdDsgSW4gdGhlIGNhc2Ugd2hlcmUgYXN5bW1ldHJpYyBrZXlzIGFyZSB1c2VkLCB0 aGUgS0lEIGluZm9ybWF0aW9uIGVsZW1lbnQgbWlnaHQgY29udGFpbiB0aGUgVVJMIHRvIHRoZSBw dWJsaWMga2V5LiAmbmJzcDtUbyBwcmV2ZW50IG1hbGljaW91cyBjbGllbnRzIGZyb20gc2lnbmlu ZyB0aGVpciBvd24gVVJJcyBhbmQgaW5zZXJ0aW5nIHRoZSBhc3NvY2lhdGVkIHB1YmxpYyBrZXkg VVJMIGluIHRoZSBLSUQgZmllbGQsIHRoZXJlYnkgcGFzc2luZyBVUkkNCiB2YWxpZGF0aW9uLCBp dCBpcyBpbXBvcnRhbnQgdGhhdCBDRE5zIGNoZWNrIHdoZXRoZXIgdGhlIFVSSSBjb252ZXllZCBp biB0aGUgS0lEIGZpZWxkIGlzIGluIHRoZSBhbGxvd2FibGUgc2V0IG9mIEtJRHMgYXMgbGlzdGVk IGluIHRoZSBDRE5JIG1ldGFkYXRhIG9yIHNldCB2aWEgY29uZmlndXJhdGlvbi4mcXVvdDs8L2Rp dj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PkluIGFkZGl0aW9uLCB0aGUgYWxnb3JpdGhtIGl0 c2VsZiBhbHNvIG1lbnRpb25zIHRoYXQgdXBvbiByZWNlaXZpbmcgYSBwdWJsaWMga2V5IFVSTCwg dGhlIHJlY2VpdmluZyBDRE4gc2hvdWxkIGNoZWNrIHdoZXRoZXIgaXQgaXMgaW4gdGhlIGFwcHJv dmVkIGxpc3Qgb2YgS0VZIElEcyAocmVjZWl2ZWQgZWl0aGVyIHZpYSBtZXRhZGF0YSBvciBzZXQg YnkgY29uZmlndXJhdGlvbikuPC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5UaGFua3Ms PC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5SYXk8L2Rpdj4NCjxkaXY+PGJyPg0KPC9k aXY+DQo8c3BhbiBpZD0iT0xLX1NSQ19CT0RZX1NFQ1RJT04iPg0KPGRpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW46MCAwIDAgNDBweDsgYm9yZGVyOm5vbmU7IHBhZGRpbmc6MHB4OyI+DQo8 ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFj ZTsgLXdlYmtpdC1saW5lLWJyZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsiIGNsYXNzPSIiPg0KPGRp diBjbGFzcz0iIj5UaGFua3M8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+QmVuPC9kaXY+DQo8ZGl2IGNs YXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjwvc3Bhbj4NCjxwIHN0eWxlPSJNQVJHSU46IDBjbSAwY20gMHB0IiBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6ICdBcmlhbCcsJ3NhbnMtc2VyaWYnOyBGT05U LVNJWkU6IDhwdDsgbXNvLWJpZGktZm9udC1mYW1pbHk6ICdUaW1lcyBOZXcgUm9tYW4nOyBtc28t YmlkaS1mb250LXNpemU6IDExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxmb250 IHN0eWxlPSJGT05ULVNJWkU6IDExcHgiIHNpemU9IjMiPg0KPC9mb250PjxwIHN0eWxlPSJNQVJH SU46IDBjbSAwY20gMHB0IiBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzdHlsZT0iRk9OVC1TSVpF OiAxMXB4IiBzaXplPSIzIj48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6ICdBcmlhbCcsJ3NhbnMt c2VyaWYnOyBGT05ULVNJWkU6IDhwdDsgbXNvLWJpZGktZm9udC1zaXplOiA4LjVwdCI+VGhpcyBt ZXNzYWdlIG1heSBjb250YWluIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZvciB5 b3UuIElmIHlvdSBhcmUgbm90IHRoZSBhZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdhcyBz ZW50IHRvIHlvdSBieSBtaXN0YWtlLCB5b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhlIHNl bmRlciBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkgZm9y IHRoZSBjb250ZW50IG9mIHRoaXMgZS1tYWlsLCBmb3IgdGhlIG1hbm5lciBpbiB3aGljaCB5b3Ug dXNlIGl0IGFuZCBmb3IgZGFtYWdlIG9mIGFueSBraW5kIHJlc3VsdGluZyBmcm9tIHRoZSByaXNr cyBpbmhlcmVudCB0byB0aGUgZWxlY3Ryb25pYyB0cmFuc21pc3Npb24gb2YgbWVzc2FnZXMuPGJy Pjxicj48L3NwYW4+PC9mb250PjwvcD48L2JvZHk+DQo8L2h0bWw+DQo= --_000_AF33AF866F194112A679C8CC205BC41Btnonl_-- From nobody Tue Dec 15 09:29:00 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 736421A9113 for ; Tue, 15 Dec 2015 09:28:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.9 X-Spam-Level: X-Spam-Status: No, score=-3.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7ov0jVeOxxP5 for ; Tue, 15 Dec 2015 09:28:55 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.145]) by ietfa.amsl.com (Postfix) with ESMTP id 8F4BC1A90F3 for ; Tue, 15 Dec 2015 09:28:54 -0800 (PST) Received: from voda-hammer-gw.mrs.uk.cw.net ([194.70.79.130] helo=[192.168.12.72]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1a8tPB-0003XT-0R; Tue, 15 Dec 2015 17:28:53 +0000 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: Date: Tue, 15 Dec 2015 17:28:49 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Kevin Ma J X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Response to Liaison Statement on URI Signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 17:28:58 -0000 Kevin, Looks fine to me. Only minor comment I have: At the end of the 3rd paragraph include a = reference to [draft-ietf-cdni-uri-signing] to make really clear which = document is the "main URI signing draft=E2=80=9D. Ben > On 14 Dec 2015, at 20:07, Kevin Ma J wrote: >=20 > Hi All, >=20 > (as a chair) As per the Open Discussion action item from Yokohama = [1], the chairs have worked with Ray to draft a response to the MPEG = liaison statement on URI Signing [2]. Please find the response below, = and feel free to send comments to the list. If there are no objections = or unaddressed comments by December 30th, we will send the official = response to MPEG. >=20 > thanx! >=20 > -- Kevin J. Ma >=20 > [1] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni > [2] https://datatracker.ietf.org/liaison/1434/ >=20 > ----- >=20 > From: Kevin J. Ma >> =46rom Group: CDNI > To: Watanabe Shinji > To Group: ISO-IEC-JTC1-SC29 > Title: Response to request for information on URI Signing 2015-11-02 > Response Contact: Kevin J. Ma > Technical Contact: Ray van Brandenburg > Purpose: In Response > Body: >=20 > The IETF CDNI working group would like to acknowledge our receipt of = the MPEG experts liaison letter and careful consideration during the = 94th IETF meeting. >=20 > Having reviewed the Online Multimedia Authorization Protocol Version = 1.0 (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the = proposed scope of usage for CDNI URI Signing to be the only as the = Access Token, as returned by the authorization server in step (E) of = sections 2.3 and 2.4 of the OMAPv1 specification, to be use solely for = authorizing requests to the resource server (i.e., the CDN), as = described in steps (F) and (G) of sections 2.3 and 2.4 of the OMAPv1 = specification. We agree that this is an exemplary use case for CDNI URI = Signing with the Path Pattern Information Element. >=20 > At the 93rd IETF, the CDNI working group decided to remove text = related to signing of segmented content URIs from the CDNI URI Signing = draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure = made after the 92nd IETF [minutes-93-cdni]. The removed sections are = currently documented in a separate draft = [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the = main URI signing document. It should be noted that at this point, that = document is regarded as an independent submission and IETF has not made = a decision regarding its future status. At the 94th IETF, it was agreed = that the Path Pattern Information element was not covered by the IPR = disclosure and would be a useful feature for a number of URI Signing use = cases, including segmented content [minutes-94-cdni]. Path Pattern = support will be reinstated in a future revision of the main URI signing = draft. >=20 > With respect to long-lived tokens, as mentioned in the Security = Considerations section (9) of the CDNI URI Signing draft, increasing the = token validity period increases the potential for replay attacks, = including DoS attacks; however, nothing in the protocol prevents the use = of long-lived tokens.=20 >=20 > With respect to CDNs refreshing tokens, the CDNI working group = discussed mechanisms for signaling token refresh between CDNs and felt = that the required additional complexity of such a mechanism outweighed = the cost of regenerating the tokens. Note: Signaling between CDNs and = clients is out-of-scope for CDNI. As mentioned above, chained token = support was removed from the current CDNI URI Signing draft and there is = no plan to reinstate it in the main URI signing document due to IPR = issues. As such, the topic of token regeneration is limited to = [draft-brandenburg-cdni-uri-signing-for-has]. >=20 > With respect to name collisions, the current version of the CDNI URI = Signing draft only supports query-string-based conveyance of the token. = The metadata element "package-attribute" was introduced to allow content = service providers (CSPs) to select any query string parameter name they = wanted, assuming that CSPs would be in the best position to select a = low-collision-probability name; URISigningPackage is only the default = name. >=20 > With respect to consecutive tokens, the CDNI URI Signing mechanism was = designed to be stateless, so that consecutive tokens can be retrieved = from different delivery nodes. As such, there is no relationship between = consecutive tokens and token invalidation is solely based on the Expiry = Time information element. >=20 > The CDNI working group appreciates the MPEG experts' thoughtful input = and looks forward to continued collaboration with MPEG experts on URI = Signing. >=20 > Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina >=20 > [2012_09_28_OATC-OMAP_1-0] = http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-OMAP_1= -0.pdf > [draft-ietf-cdni-uri-signing] = https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ > [draft-brandenburg-cdni-uri-signing-for-has] = https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-ha= s/ > [minutes-93-cdni] = https://www.ietf.org/proceedings/93/minutes/minutes-93-cdni > [minutes-94-cdni] = https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni >=20 >=20 >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni From nobody Tue Dec 15 09:32:15 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E43091A90F3 for ; Tue, 15 Dec 2015 09:32:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.201 X-Spam-Level: X-Spam-Status: No, score=-6.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VSCn_tIeEv81 for ; Tue, 15 Dec 2015 09:32:12 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69C9B1A90B9 for ; Tue, 15 Dec 2015 09:32:12 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-9b-56704e942bb0 Received: from EUSAAHC001.ericsson.se (Unknown_Domain [147.117.188.75]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id B3.58.32102.49E40765; Tue, 15 Dec 2015 18:32:05 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC001.ericsson.se ([147.117.188.75]) with mapi id 14.03.0248.002; Tue, 15 Dec 2015 12:32:10 -0500 From: Kevin Ma J To: Ben Niven-Jenkins Thread-Topic: [CDNi] Response to Liaison Statement on URI Signing Thread-Index: AdE2lBu7d05r8E4UT/O4koQZbwRotQA89wyAAApUfdA= Date: Tue, 15 Dec 2015 17:32:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrBLMWRmVeSWpSXmKPExsUyuXSPt+5Uv4Iwg+W/uS0WnJvAZvF09h9W ByaPJUt+Mnn8vD6JMYApissmJTUnsyy1SN8ugSvjz9MDLAVrHCqOfVnP3MB4w66LkZNDQsBE YkfHBTYIW0ziwr31QDYXh5DAEUaJZx1HWCGc5YwSve2TwKrYBLQkHn/9y9TFyMEhIqAv0XGs GCTMLKAssaV5LyOILSzgIPH/RD87RImjxJrfESBhEQEriZsXFzGD2CwCqhKXVm1jAbF5BXwl 7q7oh1rVxShx7dkLVpBeTgF3ic9LuUFqGIFu+35qDRPEKnGJW0/mM0HcLCCxZM95ZghbVOLl 43+sELaSxKSl58DGMAtoSqzfpQ/RqigxpfshO8RaQYmTM5+wTGAUm4Vk6iyEjllIOmYh6VjA yLKKkaO0uCAnN93IcBMjMD6OSbA57mDc2+t5iFGAg1GJh3eDYH6YEGtiWXFl7iFGCQ5mJRHe 8z4FYUK8KYmVValF+fFFpTmpxYcYpTlYlMR5GRkYGIQE0hNLUrNTUwtSi2CyTBycUg2MrfOr z1ySjfB3lbfoiYjObTsbrSX63Hd315ztaVcn5demaV1zDPueyVtabOYz31/DriPXjssnTMUh QeHsi7Y1X5Xz9jjadSi6qklXp22fkZ3c8mTl17/KNz02a0rPu202Q6p61ZOIZY5sqesX6amE eO1PXjdt28/NjzsZlt7bxRyvXuhQW6PEUpyRaKjFXFScCADf3W/tiwIAAA== Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Response to Liaison Statement on URI Signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 17:32:15 -0000 SGkgQmVuLA0KDQogIHdpbGwgZG8uDQoNCnRoYW54IQ0KDQotLSAgS2V2aW4gSi4gTWENCg0KPiAt LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBCZW4gTml2ZW4tSmVua2lucyBbbWFp bHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrXQ0KPiBTZW50OiBUdWVzZGF5LCBEZWNlbWJlciAx NSwgMjAxNSAxMjoyOSBQTQ0KPiBUbzogS2V2aW4gTWEgSg0KPiBDYzogY2RuaUBpZXRmLm9yZw0K PiBTdWJqZWN0OiBSZTogW0NETmldIFJlc3BvbnNlIHRvIExpYWlzb24gU3RhdGVtZW50IG9uIFVS SSBTaWduaW5nDQo+IA0KPiBLZXZpbiwNCj4gDQo+IExvb2tzIGZpbmUgdG8gbWUuDQo+IA0KPiBP bmx5IG1pbm9yIGNvbW1lbnQgSSBoYXZlOiBBdCB0aGUgZW5kIG9mIHRoZSAzcmQgcGFyYWdyYXBo IGluY2x1ZGUgYQ0KPiByZWZlcmVuY2UgdG8gW2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZ10g dG8gbWFrZSByZWFsbHkgY2xlYXIgd2hpY2gNCj4gZG9jdW1lbnQgaXMgdGhlICJtYWluIFVSSSBz aWduaW5nIGRyYWZ04oCdLg0KPiANCj4gQmVuDQo+IA0KPiA+IE9uIDE0IERlYyAyMDE1LCBhdCAy MDowNywgS2V2aW4gTWEgSiA8a2V2aW4uai5tYUBlcmljc3Nvbi5jb20+IHdyb3RlOg0KPiA+DQo+ ID4gSGkgQWxsLA0KPiA+DQo+ID4gIChhcyBhIGNoYWlyKSBBcyBwZXIgdGhlIE9wZW4gRGlzY3Vz c2lvbiBhY3Rpb24gaXRlbSBmcm9tIFlva29oYW1hIFsxXSwNCj4gdGhlIGNoYWlycyBoYXZlIHdv cmtlZCB3aXRoIFJheSB0byBkcmFmdCBhIHJlc3BvbnNlIHRvIHRoZSBNUEVHIGxpYWlzb24NCj4g c3RhdGVtZW50IG9uIFVSSSBTaWduaW5nIFsyXS4gIFBsZWFzZSBmaW5kIHRoZSByZXNwb25zZSBi ZWxvdywgYW5kIGZlZWwNCj4gZnJlZSB0byBzZW5kIGNvbW1lbnRzIHRvIHRoZSBsaXN0LiAgSWYg dGhlcmUgYXJlIG5vIG9iamVjdGlvbnMgb3INCj4gdW5hZGRyZXNzZWQgY29tbWVudHMgYnkgRGVj ZW1iZXIgMzB0aCwgd2Ugd2lsbCBzZW5kIHRoZSBvZmZpY2lhbCByZXNwb25zZQ0KPiB0byBNUEVH Lg0KPiA+DQo+ID4gdGhhbnghDQo+ID4NCj4gPiAtLSAgS2V2aW4gSi4gTWENCj4gPg0KPiA+IFsx XSBodHRwczovL3d3dy5pZXRmLm9yZy9wcm9jZWVkaW5ncy85NC9taW51dGVzL21pbnV0ZXMtOTQt Y2RuaQ0KPiA+IFsyXSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2xpYWlzb24vMTQzNC8N Cj4gPg0KPiA+IC0tLS0tDQo+ID4NCj4gPiBGcm9tOiBLZXZpbiBKLiBNYQ0KPiA+PiBGcm9tIEdy b3VwOiBDRE5JDQo+ID4gVG86IFdhdGFuYWJlIFNoaW5qaSA8d2F0YW5hYmVAaXRzY2ouaXBzai5v ci5qcD4NCj4gPiBUbyBHcm91cDogSVNPLUlFQy1KVEMxLVNDMjkNCj4gPiBUaXRsZTogUmVzcG9u c2UgdG8gcmVxdWVzdCBmb3IgaW5mb3JtYXRpb24gb24gVVJJIFNpZ25pbmcgMjAxNS0xMS0wMg0K PiA+IFJlc3BvbnNlIENvbnRhY3Q6IEtldmluIEouIE1hIDxrZXZpbi5qLm1hQGVyaWNzc29uLmNv bT4NCj4gPiBUZWNobmljYWwgQ29udGFjdDogUmF5IHZhbiBCcmFuZGVuYnVyZyA8cmF5LnZhbmJy YW5kZW5idXJnQHRuby5ubD4NCj4gPiBQdXJwb3NlOiBJbiBSZXNwb25zZQ0KPiA+IEJvZHk6DQo+ ID4NCj4gPiBUaGUgSUVURiBDRE5JIHdvcmtpbmcgZ3JvdXAgd291bGQgbGlrZSB0byBhY2tub3ds ZWRnZSBvdXIgcmVjZWlwdCBvZiB0aGUNCj4gTVBFRyBleHBlcnRzIGxpYWlzb24gbGV0dGVyIGFu ZCBjYXJlZnVsIGNvbnNpZGVyYXRpb24gZHVyaW5nIHRoZSA5NHRoIElFVEYNCj4gbWVldGluZy4N Cj4gPg0KPiA+IEhhdmluZyByZXZpZXdlZCB0aGUgT25saW5lIE11bHRpbWVkaWEgQXV0aG9yaXph dGlvbiBQcm90b2NvbCBWZXJzaW9uIDEuMA0KPiAoT01BUHYxKSBzcGVjaWZpY2F0aW9uIFsyMDEy XzA5XzI4X09BVEMtT01BUF8xLTBdLCB3ZSB1bmRlcnN0YW5kIHRoZQ0KPiBwcm9wb3NlZCBzY29w ZSBvZiB1c2FnZSBmb3IgQ0ROSSBVUkkgU2lnbmluZyB0byBiZSB0aGUgb25seSBhcyB0aGUgQWNj ZXNzDQo+IFRva2VuLCBhcyByZXR1cm5lZCBieSB0aGUgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgaW4g c3RlcCAoRSkgb2Ygc2VjdGlvbnMgMi4zDQo+IGFuZCAyLjQgb2YgdGhlIE9NQVB2MSBzcGVjaWZp Y2F0aW9uLCB0byBiZSB1c2Ugc29sZWx5IGZvciBhdXRob3JpemluZw0KPiByZXF1ZXN0cyB0byB0 aGUgcmVzb3VyY2Ugc2VydmVyIChpLmUuLCB0aGUgQ0ROKSwgYXMgZGVzY3JpYmVkIGluIHN0ZXBz IChGKQ0KPiBhbmQgKEcpIG9mIHNlY3Rpb25zIDIuMyBhbmQgMi40IG9mIHRoZSBPTUFQdjEgc3Bl Y2lmaWNhdGlvbi4gIFdlIGFncmVlDQo+IHRoYXQgdGhpcyBpcyBhbiBleGVtcGxhcnkgdXNlIGNh c2UgZm9yIENETkkgVVJJIFNpZ25pbmcgd2l0aCB0aGUgUGF0aA0KPiBQYXR0ZXJuIEluZm9ybWF0 aW9uIEVsZW1lbnQuDQo+ID4NCj4gPiBBdCB0aGUgOTNyZCBJRVRGLCB0aGUgQ0ROSSB3b3JraW5n IGdyb3VwIGRlY2lkZWQgdG8gcmVtb3ZlIHRleHQgcmVsYXRlZA0KPiB0byBzaWduaW5nIG9mIHNl Z21lbnRlZCBjb250ZW50IFVSSXMgZnJvbSB0aGUgQ0ROSSBVUkkgU2lnbmluZyBkcmFmdA0KPiBb ZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nXSBpbiByZXNwb25zZSB0byBhbiBJUFIgZGlzY2xv c3VyZSBtYWRlIGFmdGVyDQo+IHRoZSA5Mm5kIElFVEYgW21pbnV0ZXMtOTMtY2RuaV0uIFRoZSBy ZW1vdmVkIHNlY3Rpb25zIGFyZSBjdXJyZW50bHkNCj4gZG9jdW1lbnRlZCBpbiBhIHNlcGFyYXRl IGRyYWZ0IFtkcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci0NCj4gaGFzXSwg YXMgYW4gZXh0ZW5zaW9uIHRvIHRoZSBtYWluIFVSSSBzaWduaW5nIGRvY3VtZW50LiBJdCBzaG91 bGQgYmUgbm90ZWQNCj4gdGhhdCBhdCB0aGlzIHBvaW50LCB0aGF0IGRvY3VtZW50IGlzIHJlZ2Fy ZGVkIGFzIGFuIGluZGVwZW5kZW50IHN1Ym1pc3Npb24NCj4gYW5kIElFVEYgaGFzIG5vdCBtYWRl IGEgZGVjaXNpb24gcmVnYXJkaW5nIGl0cyBmdXR1cmUgc3RhdHVzLiBBdCB0aGUgOTR0aA0KPiBJ RVRGLCBpdCB3YXMgYWdyZWVkIHRoYXQgdGhlIFBhdGggUGF0dGVybiBJbmZvcm1hdGlvbiBlbGVt ZW50IHdhcyBub3QNCj4gY292ZXJlZCBieSB0aGUgSVBSIGRpc2Nsb3N1cmUgYW5kIHdvdWxkIGJl IGEgdXNlZnVsIGZlYXR1cmUgZm9yIGEgbnVtYmVyDQo+IG9mIFVSSSBTaWduaW5nIHVzZSBjYXNl cywgaW5jbHVkaW5nIHNlZ21lbnRlZCBjb250ZW50IFttaW51dGVzLTk0LWNkbmldLg0KPiBQYXRo IFBhdHRlcm4gc3VwcG9ydCB3aWxsIGJlIHJlaW5zdGF0ZWQgaW4gYSBmdXR1cmUgcmV2aXNpb24g b2YgdGhlIG1haW4NCj4gVVJJIHNpZ25pbmcgZHJhZnQuDQo+ID4NCj4gPiBXaXRoIHJlc3BlY3Qg dG8gbG9uZy1saXZlZCB0b2tlbnMsIGFzIG1lbnRpb25lZCBpbiB0aGUgU2VjdXJpdHkNCj4gQ29u c2lkZXJhdGlvbnMgc2VjdGlvbiAoOSkgb2YgdGhlIENETkkgVVJJIFNpZ25pbmcgZHJhZnQsIGlu Y3JlYXNpbmcgdGhlDQo+IHRva2VuIHZhbGlkaXR5IHBlcmlvZCBpbmNyZWFzZXMgdGhlIHBvdGVu dGlhbCBmb3IgcmVwbGF5IGF0dGFja3MsDQo+IGluY2x1ZGluZyBEb1MgYXR0YWNrczsgaG93ZXZl ciwgbm90aGluZyBpbiB0aGUgcHJvdG9jb2wgcHJldmVudHMgdGhlIHVzZQ0KPiBvZiBsb25nLWxp dmVkIHRva2Vucy4NCj4gPg0KPiA+IFdpdGggcmVzcGVjdCB0byBDRE5zIHJlZnJlc2hpbmcgdG9r ZW5zLCB0aGUgQ0ROSSB3b3JraW5nIGdyb3VwIGRpc2N1c3NlZA0KPiBtZWNoYW5pc21zIGZvciBz aWduYWxpbmcgdG9rZW4gcmVmcmVzaCBiZXR3ZWVuIENETnMgYW5kIGZlbHQgdGhhdCB0aGUNCj4g cmVxdWlyZWQgYWRkaXRpb25hbCBjb21wbGV4aXR5IG9mIHN1Y2ggYSBtZWNoYW5pc20gb3V0d2Vp Z2hlZCB0aGUgY29zdCBvZg0KPiByZWdlbmVyYXRpbmcgdGhlIHRva2Vucy4gTm90ZTogU2lnbmFs aW5nIGJldHdlZW4gQ0ROcyBhbmQgY2xpZW50cyBpcyBvdXQtDQo+IG9mLXNjb3BlIGZvciBDRE5J LiBBcyBtZW50aW9uZWQgYWJvdmUsIGNoYWluZWQgdG9rZW4gc3VwcG9ydCB3YXMgcmVtb3ZlZA0K PiBmcm9tIHRoZSBjdXJyZW50IENETkkgVVJJIFNpZ25pbmcgZHJhZnQgYW5kIHRoZXJlIGlzIG5v IHBsYW4gdG8gcmVpbnN0YXRlDQo+IGl0IGluIHRoZSBtYWluIFVSSSBzaWduaW5nIGRvY3VtZW50 IGR1ZSB0byBJUFIgaXNzdWVzLiBBcyBzdWNoLCB0aGUgdG9waWMNCj4gb2YgdG9rZW4gcmVnZW5l cmF0aW9uIGlzIGxpbWl0ZWQgdG8gW2RyYWZ0LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25pbmct DQo+IGZvci1oYXNdLg0KPiA+DQo+ID4gV2l0aCByZXNwZWN0IHRvIG5hbWUgY29sbGlzaW9ucywg dGhlIGN1cnJlbnQgdmVyc2lvbiBvZiB0aGUgQ0ROSSBVUkkNCj4gU2lnbmluZyBkcmFmdCBvbmx5 IHN1cHBvcnRzIHF1ZXJ5LXN0cmluZy1iYXNlZCBjb252ZXlhbmNlIG9mIHRoZSB0b2tlbi4NCj4g VGhlIG1ldGFkYXRhIGVsZW1lbnQgInBhY2thZ2UtYXR0cmlidXRlIiB3YXMgaW50cm9kdWNlZCB0 byBhbGxvdyBjb250ZW50DQo+IHNlcnZpY2UgcHJvdmlkZXJzIChDU1BzKSB0byBzZWxlY3QgYW55 IHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIgbmFtZSB0aGV5DQo+IHdhbnRlZCwgYXNzdW1pbmcgdGhh dCBDU1BzIHdvdWxkIGJlIGluIHRoZSBiZXN0IHBvc2l0aW9uIHRvIHNlbGVjdCBhIGxvdy0NCj4g Y29sbGlzaW9uLXByb2JhYmlsaXR5IG5hbWU7IFVSSVNpZ25pbmdQYWNrYWdlIGlzIG9ubHkgdGhl IGRlZmF1bHQgbmFtZS4NCj4gPg0KPiA+IFdpdGggcmVzcGVjdCB0byBjb25zZWN1dGl2ZSB0b2tl bnMsIHRoZSBDRE5JIFVSSSBTaWduaW5nIG1lY2hhbmlzbSB3YXMNCj4gZGVzaWduZWQgdG8gYmUg c3RhdGVsZXNzLCBzbyB0aGF0IGNvbnNlY3V0aXZlIHRva2VucyBjYW4gYmUgcmV0cmlldmVkIGZy b20NCj4gZGlmZmVyZW50IGRlbGl2ZXJ5IG5vZGVzLiBBcyBzdWNoLCB0aGVyZSBpcyBubyByZWxh dGlvbnNoaXAgYmV0d2Vlbg0KPiBjb25zZWN1dGl2ZSB0b2tlbnMgYW5kIHRva2VuIGludmFsaWRh dGlvbiBpcyBzb2xlbHkgYmFzZWQgb24gdGhlIEV4cGlyeQ0KPiBUaW1lIGluZm9ybWF0aW9uIGVs ZW1lbnQuDQo+ID4NCj4gPiBUaGUgQ0ROSSB3b3JraW5nIGdyb3VwIGFwcHJlY2lhdGVzIHRoZSBN UEVHIGV4cGVydHMnIHRob3VnaHRmdWwgaW5wdXQNCj4gYW5kIGxvb2tzIGZvcndhcmQgdG8gY29u dGludWVkIGNvbGxhYm9yYXRpb24gd2l0aCBNUEVHIGV4cGVydHMgb24gVVJJDQo+IFNpZ25pbmcu DQo+ID4NCj4gPiBPdXIgbmV4dCBtZWV0aW5nOiBJRVRGIDk1LCBBcHJpbCAzLTggMjAxNiwgQnVl bm9zIEFpcmVzLCBBcmdlbnRpbmENCj4gPg0KPiA+IFsyMDEyXzA5XzI4X09BVEMtT01BUF8xLTBd DQo+IGh0dHA6Ly93d3cub2F0Yy51cy9Qb3J0YWxzL19kZWZhdWx0L0tub3dsZWRnZWJhc2UvMS8y MDEyXzA5XzI4X09BVEMtDQo+IE9NQVBfMS0wLnBkZg0KPiA+IFtkcmFmdC1pZXRmLWNkbmktdXJp LXNpZ25pbmddIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LQ0KPiBpZXRm LWNkbmktdXJpLXNpZ25pbmcvDQo+ID4gW2RyYWZ0LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25p bmctZm9yLWhhc10NCj4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtYnJh bmRlbmJ1cmctY2RuaS11cmktc2lnbmluZy1mb3ItDQo+IGhhcy8NCj4gPiBbbWludXRlcy05My1j ZG5pXSBodHRwczovL3d3dy5pZXRmLm9yZy9wcm9jZWVkaW5ncy85My9taW51dGVzL21pbnV0ZXMt DQo+IDkzLWNkbmkNCj4gPiBbbWludXRlcy05NC1jZG5pXSBodHRwczovL3d3dy5pZXRmLm9yZy9w cm9jZWVkaW5ncy85NC9taW51dGVzL21pbnV0ZXMtDQo+IDk0LWNkbmkNCj4gPg0KPiA+DQo+ID4N Cj4gPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ IENETmkgbWFpbGluZyBsaXN0DQo+ID4gQ0ROaUBpZXRmLm9yZw0KPiA+IGh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KDQo= From nobody Tue Dec 15 09:49:27 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38A301A90BD for ; Tue, 15 Dec 2015 09:49:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.201 X-Spam-Level: X-Spam-Status: No, score=-6.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FXfnLjJWyiUq for ; Tue, 15 Dec 2015 09:49:23 -0800 (PST) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D5D01A9114 for ; Tue, 15 Dec 2015 09:49:23 -0800 (PST) X-AuditID: c618062d-f79d16d000001b1c-4a-567051e3d0ca Received: from EUSAAHC006.ericsson.se (Unknown_Domain [147.117.188.90]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 62.FF.06940.3E150765; Tue, 15 Dec 2015 18:46:11 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC006.ericsson.se ([147.117.188.90]) with mapi id 14.03.0248.002; Tue, 15 Dec 2015 12:49:21 -0500 From: Kevin Ma J To: Ben Niven-Jenkins Thread-Topic: [CDNi] Response to Liaison Statement on URI Signing Thread-Index: AdE2lBu7d05r8E4UT/O4koQZbwRotQA89wyAAApUfdAAFCpUcA== Date: Tue, 15 Dec 2015 17:49:21 +0000 Message-ID: References: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.10] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrLLMWRmVeSWpSXmKPExsUyuXRPlO7jwIIwg+NPLS0WnJvAZvF09h9W ByaPJUt+Mnn8vD6JMYApissmJTUnsyy1SN8ugSvj9cGJrAUrKiu2dB9gbmCcUdbFyMkhIWAi se9zGwuELSZx4d56ti5GLg4hgSOMEt2b9zBCOMsZJXr7vjGDVLEJaEk8/vqXqYuRg0NEQF+i 41gxSJhZQFliS/NeRhBbWMBB4v+JfnaIEkeJNb8jQMIiAk4Sc1csYQKxWQRUJS48WcsKYvMK +EocnruEBWJVN6PE2u+72EASjEAHfT+1hglivrjErSfzmSAOFZBYsuc8M4QtKvHy8T9WCFtJ YtLSc6wge5kFNCXW79KHaFWUmNL9kB1il6DEyZlPWCYwis5CMnUWQscsJB2zkHQsYGRZxchR WlyQk5tuZLCJERgJxyTYdHcw3p/ueYhRgINRiYd3g2B+mBBrYllxZe4hRgkOZiUR3vM+BWFC vCmJlVWpRfnxRaU5qcWHGKU5WJTEeRkZGBiEBNITS1KzU1MLUotgskwcnFINjI2uc8R/T8rQ jam4HSlVfX9aC2f6t3ZtobkX/zst3XJaxl+h89b9cw9uc24INTt+amPORdkNa29zrVt83dXm yyePfx+r1yd03a0pPL5Fqkb6wjqprdO6V/Bkhr+WzlvtZXnkFYv6EYm4Rwuv7Xmfc1gwZjrz /Jqen3knovbZc18rX5a5bEfj0TYlluKMREMt5qLiRABQ0/NRgAIAAA== Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Response to Liaison Statement on URI Signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 17:49:26 -0000 SSBjbGVhbmVkIHVwIHRoZSBkcmFmdCBsYW5ndWFnZQ0KLSByZW1vdmVkICJtYWluIiBvciBjaGFu Z2VkICJtYWluIiAtPiAiQ0ROSSIgaW4gYWxsIHBsYWNlcw0KLSB1c2VkICJleHRlbnNpb24iIHRv IHJlZmVyIHRvIFJheSdzIGRyYWZ0DQotIGNoYW5nZWQgImRvY3VtZW50IiAtPiAiZHJhZnQiIGlu IGFsbCBwbGFjZXMNCi0gYWRkZWQgcmVmZXJlbmNlcyB0byBbZHJhZnQtaWV0Zi1jZG5pLXVyaS1z aWduaW5nXSBhZnRlciBhbGwgbWVudGlvbnMgb2YgdGhlIGRyYWZ0DQoNCkZyb206IEtldmluIEou IE1hDQpGcm9tIEdyb3VwOiBDRE5JDQpUbzogV2F0YW5hYmUgU2hpbmppIDx3YXRhbmFiZUBpdHNj ai5pcHNqLm9yLmpwPg0KVG8gR3JvdXA6IElTTy1JRUMtSlRDMS1TQzI5DQpUaXRsZTogUmVzcG9u c2UgdG8gcmVxdWVzdCBmb3IgaW5mb3JtYXRpb24gb24gVVJJIFNpZ25pbmcgMjAxNS0xMS0wMg0K UmVzcG9uc2UgQ29udGFjdDogS2V2aW4gSi4gTWEgPGtldmluLmoubWFAZXJpY3Nzb24uY29tPg0K VGVjaG5pY2FsIENvbnRhY3Q6IFJheSB2YW4gQnJhbmRlbmJ1cmcgPHJheS52YW5icmFuZGVuYnVy Z0B0bm8ubmw+DQpQdXJwb3NlOiBJbiBSZXNwb25zZQ0KQm9keToNCg0KVGhlIElFVEYgQ0ROSSB3 b3JraW5nIGdyb3VwIHdvdWxkIGxpa2UgdG8gYWNrbm93bGVkZ2Ugb3VyIHJlY2VpcHQgb2YgdGhl IE1QRUcgZXhwZXJ0cyBsaWFpc29uIGxldHRlciBhbmQgY2FyZWZ1bCBjb25zaWRlcmF0aW9uIGR1 cmluZyB0aGUgOTR0aCBJRVRGIG1lZXRpbmcuDQoNCkhhdmluZyByZXZpZXdlZCB0aGUgT25saW5l IE11bHRpbWVkaWEgQXV0aG9yaXphdGlvbiBQcm90b2NvbCBWZXJzaW9uIDEuMCAoT01BUHYxKSBz cGVjaWZpY2F0aW9uIFsyMDEyXzA5XzI4X09BVEMtT01BUF8xLTBdLCB3ZSB1bmRlcnN0YW5kIHRo ZSBwcm9wb3NlZCBzY29wZSBvZiB1c2FnZSBmb3IgQ0ROSSBVUkkgU2lnbmluZyB0byBiZSB0aGUg b25seSBhcyB0aGUgQWNjZXNzIFRva2VuLCBhcyByZXR1cm5lZCBieSB0aGUgYXV0aG9yaXphdGlv biBzZXJ2ZXIgaW4gc3RlcCAoRSkgb2Ygc2VjdGlvbnMgMi4zIGFuZCAyLjQgb2YgdGhlIE9NQVB2 MSBzcGVjaWZpY2F0aW9uLCB0byBiZSB1c2Ugc29sZWx5IGZvciBhdXRob3JpemluZyByZXF1ZXN0 cyB0byB0aGUgcmVzb3VyY2Ugc2VydmVyIChpLmUuLCB0aGUgQ0ROKSwgYXMgZGVzY3JpYmVkIGlu IHN0ZXBzIChGKSBhbmQgKEcpIG9mIHNlY3Rpb25zIDIuMyBhbmQgMi40IG9mIHRoZSBPTUFQdjEg c3BlY2lmaWNhdGlvbi4gIFdlIGFncmVlIHRoYXQgdGhpcyBpcyBhbiBleGVtcGxhcnkgdXNlIGNh c2UgZm9yIENETkkgVVJJIFNpZ25pbmcgd2l0aCB0aGUgUGF0aCBQYXR0ZXJuIEluZm9ybWF0aW9u IEVsZW1lbnQuDQogDQpBdCB0aGUgOTNyZCBJRVRGLCB0aGUgQ0ROSSB3b3JraW5nIGdyb3VwIGRl Y2lkZWQgdG8gcmVtb3ZlIHRleHQgcmVsYXRlZCB0byBzaWduaW5nIG9mIHNlZ21lbnRlZCBjb250 ZW50IFVSSXMgZnJvbSB0aGUgQ0ROSSBVUkkgU2lnbmluZyBkcmFmdCBbZHJhZnQtaWV0Zi1jZG5p LXVyaS1zaWduaW5nXSBpbiByZXNwb25zZSB0byBhbiBJUFIgZGlzY2xvc3VyZSBtYWRlIGFmdGVy IHRoZSA5Mm5kIElFVEYgW21pbnV0ZXMtOTMtY2RuaV0uIFRoZSByZW1vdmVkIHNlY3Rpb25zIGFy ZSBjdXJyZW50bHkgZG9jdW1lbnRlZCBpbiBhIHNlcGFyYXRlIGRyYWZ0IFtkcmFmdC1icmFuZGVu YnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci1oYXNdLCBhcyBhbiBleHRlbnNpb24gdG8gdGhlIENE TkkgVVJJIHNpZ25pbmcgZHJhZnQgW2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZ10uIEl0IHNo b3VsZCBiZSBub3RlZCB0aGF0IGF0IHRoaXMgcG9pbnQsIHRoYXQgZG9jdW1lbnQgaXMgcmVnYXJk ZWQgYXMgYW4gaW5kZXBlbmRlbnQgc3VibWlzc2lvbiBhbmQgSUVURiBoYXMgbm90IG1hZGUgYSBk ZWNpc2lvbiByZWdhcmRpbmcgaXRzIGZ1dHVyZSBzdGF0dXMuIEF0IHRoZSA5NHRoIElFVEYsIGl0 IHdhcyBhZ3JlZWQgdGhhdCB0aGUgUGF0aCBQYXR0ZXJuIEluZm9ybWF0aW9uIGVsZW1lbnQgd2Fz IG5vdCBjb3ZlcmVkIGJ5IHRoZSBJUFIgZGlzY2xvc3VyZSBhbmQgd291bGQgYmUgYSB1c2VmdWwg ZmVhdHVyZSBmb3IgYSBudW1iZXIgb2YgVVJJIFNpZ25pbmcgdXNlIGNhc2VzLCBpbmNsdWRpbmcg c2VnbWVudGVkIGNvbnRlbnQgW21pbnV0ZXMtOTQtY2RuaV0uIFBhdGggUGF0dGVybiBzdXBwb3J0 IHdpbGwgYmUgcmVpbnN0YXRlZCBpbiBhIGZ1dHVyZSByZXZpc2lvbiBvZiB0aGUgQ0ROSSBVUkkg c2lnbmluZyBkcmFmdCBbZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nXS4NCiANCldpdGggcmVz cGVjdCB0byBsb25nLWxpdmVkIHRva2VucywgYXMgbWVudGlvbmVkIGluIHRoZSBTZWN1cml0eSBD b25zaWRlcmF0aW9ucyBzZWN0aW9uICg5KSBvZiB0aGUgQ0ROSSBVUkkgU2lnbmluZyBkcmFmdCwg aW5jcmVhc2luZyB0aGUgdG9rZW4gdmFsaWRpdHkgcGVyaW9kIGluY3JlYXNlcyB0aGUgcG90ZW50 aWFsIGZvciByZXBsYXkgYXR0YWNrcywgaW5jbHVkaW5nIERvUyBhdHRhY2tzOyBob3dldmVyLCBu b3RoaW5nIGluIHRoZSBwcm90b2NvbCBwcmV2ZW50cyB0aGUgdXNlIG9mIGxvbmctbGl2ZWQgdG9r ZW5zLiANCg0KV2l0aCByZXNwZWN0IHRvIENETnMgcmVmcmVzaGluZyB0b2tlbnMsIHRoZSBDRE5J IHdvcmtpbmcgZ3JvdXAgZGlzY3Vzc2VkIG1lY2hhbmlzbXMgZm9yIHNpZ25hbGluZyB0b2tlbiBy ZWZyZXNoIGJldHdlZW4gQ0ROcyBhbmQgZmVsdCB0aGF0IHRoZSByZXF1aXJlZCBhZGRpdGlvbmFs IGNvbXBsZXhpdHkgb2Ygc3VjaCBhIG1lY2hhbmlzbSBvdXR3ZWlnaGVkIHRoZSBjb3N0IG9mIHJl Z2VuZXJhdGluZyB0aGUgdG9rZW5zLiBOb3RlOiBTaWduYWxpbmcgYmV0d2VlbiBDRE5zIGFuZCBj bGllbnRzIGlzIG91dC1vZi1zY29wZSBmb3IgQ0ROSS4gQXMgbWVudGlvbmVkIGFib3ZlLCBjaGFp bmVkIHRva2VuIHN1cHBvcnQgd2FzIHJlbW92ZWQgZnJvbSB0aGUgQ0ROSSBVUkkgU2lnbmluZyBk cmFmdCBbZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nXSBhbmQgdGhlcmUgaXMgbm8gcGxhbiB0 byByZWluc3RhdGUgaXQgaW4gdGhlIENETkkgVVJJIHNpZ25pbmcgZHJhZnQgW2RyYWZ0LWlldGYt Y2RuaS11cmktc2lnbmluZ10gZHVlIHRvIElQUiBpc3N1ZXMuIEFzIHN1Y2gsIHRoZSB0b3BpYyBv ZiB0b2tlbiByZWdlbmVyYXRpb24gaXMgbGltaXRlZCB0byB0aGUgZXh0ZW5zaW9uIGRyYWZ0IFtk cmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci1oYXNdLg0KDQpXaXRoIHJlc3Bl Y3QgdG8gbmFtZSBjb2xsaXNpb25zLCB0aGUgY3VycmVudCB2ZXJzaW9uIG9mIHRoZSBDRE5JIFVS SSBTaWduaW5nIGRyYWZ0IFtkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmddIG9ubHkgc3VwcG9y dHMgcXVlcnktc3RyaW5nLWJhc2VkIGNvbnZleWFuY2Ugb2YgdGhlIHRva2VuLiAgVGhlIG1ldGFk YXRhIGVsZW1lbnQgInBhY2thZ2UtYXR0cmlidXRlIiB3YXMgaW50cm9kdWNlZCB0byBhbGxvdyBj b250ZW50IHNlcnZpY2UgcHJvdmlkZXJzIChDU1BzKSB0byBzZWxlY3QgYW55IHF1ZXJ5IHN0cmlu ZyBwYXJhbWV0ZXIgbmFtZSB0aGV5IHdhbnRlZCwgYXNzdW1pbmcgdGhhdCBDU1BzIHdvdWxkIGJl IGluIHRoZSBiZXN0IHBvc2l0aW9uIHRvIHNlbGVjdCBhIGxvdy1jb2xsaXNpb24tcHJvYmFiaWxp dHkgbmFtZTsgVVJJU2lnbmluZ1BhY2thZ2UgaXMgb25seSB0aGUgZGVmYXVsdCBuYW1lLg0KIA0K V2l0aCByZXNwZWN0IHRvIGNvbnNlY3V0aXZlIHRva2VucywgdGhlIENETkkgVVJJIFNpZ25pbmcg bWVjaGFuaXNtIHdhcyBkZXNpZ25lZCB0byBiZSBzdGF0ZWxlc3MsIHNvIHRoYXQgY29uc2VjdXRp dmUgdG9rZW5zIGNhbiBiZSByZXRyaWV2ZWQgZnJvbSBkaWZmZXJlbnQgZGVsaXZlcnkgbm9kZXMu IEFzIHN1Y2gsIHRoZXJlIGlzIG5vIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIGNvbnNlY3V0aXZlIHRv a2VucyBhbmQgdG9rZW4gaW52YWxpZGF0aW9uIGlzIHNvbGVseSBiYXNlZCBvbiB0aGUgRXhwaXJ5 IFRpbWUgaW5mb3JtYXRpb24gZWxlbWVudC4NCg0KVGhlIENETkkgd29ya2luZyBncm91cCBhcHBy ZWNpYXRlcyB0aGUgTVBFRyBleHBlcnRzJyB0aG91Z2h0ZnVsIGlucHV0IGFuZCBsb29rcyBmb3J3 YXJkIHRvIGNvbnRpbnVlZCBjb2xsYWJvcmF0aW9uIHdpdGggTVBFRyBleHBlcnRzIG9uIFVSSSBT aWduaW5nLg0KIA0KT3VyIG5leHQgbWVldGluZzogSUVURiA5NSwgQXByaWwgMy04IDIwMTYsIEJ1 ZW5vcyBBaXJlcywgQXJnZW50aW5hDQoNClsyMDEyXzA5XzI4X09BVEMtT01BUF8xLTBdIGh0dHA6 Ly93d3cub2F0Yy51cy9Qb3J0YWxzL19kZWZhdWx0L0tub3dsZWRnZWJhc2UvMS8yMDEyXzA5XzI4 X09BVEMtT01BUF8xLTAucGRmDQpbZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nXSBodHRwczov L2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmcvDQpb ZHJhZnQtYnJhbmRlbmJ1cmctY2RuaS11cmktc2lnbmluZy1mb3ItaGFzXSBodHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLWZv ci1oYXMvDQpbbWludXRlcy05My1jZG5pXSBodHRwczovL3d3dy5pZXRmLm9yZy9wcm9jZWVkaW5n cy85My9taW51dGVzL21pbnV0ZXMtOTMtY2RuaQ0KW21pbnV0ZXMtOTQtY2RuaV0gaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvcHJvY2VlZGluZ3MvOTQvbWludXRlcy9taW51dGVzLTk0LWNkbmkNCg0KPiAt LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBLZXZpbiBNYSBKDQo+IFNlbnQ6IFR1 ZXNkYXksIERlY2VtYmVyIDE1LCAyMDE1IDEyOjMzIFBNDQo+IFRvOiAnQmVuIE5pdmVuLUplbmtp bnMnDQo+IENjOiBjZG5pQGlldGYub3JnDQo+IFN1YmplY3Q6IFJFOiBbQ0ROaV0gUmVzcG9uc2Ug dG8gTGlhaXNvbiBTdGF0ZW1lbnQgb24gVVJJIFNpZ25pbmcNCj4gDQo+IEhpIEJlbiwNCj4gDQo+ ICAgd2lsbCBkby4NCj4gDQo+IHRoYW54IQ0KPiANCj4gLS0gIEtldmluIEouIE1hDQo+IA0KPiA+ IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ID4gRnJvbTogQmVuIE5pdmVuLUplbmtpbnMg W21haWx0bzpiZW5Abml2ZW4tamVua2lucy5jby51a10NCj4gPiBTZW50OiBUdWVzZGF5LCBEZWNl bWJlciAxNSwgMjAxNSAxMjoyOSBQTQ0KPiA+IFRvOiBLZXZpbiBNYSBKDQo+ID4gQ2M6IGNkbmlA aWV0Zi5vcmcNCj4gPiBTdWJqZWN0OiBSZTogW0NETmldIFJlc3BvbnNlIHRvIExpYWlzb24gU3Rh dGVtZW50IG9uIFVSSSBTaWduaW5nDQo+ID4NCj4gPiBLZXZpbiwNCj4gPg0KPiA+IExvb2tzIGZp bmUgdG8gbWUuDQo+ID4NCj4gPiBPbmx5IG1pbm9yIGNvbW1lbnQgSSBoYXZlOiBBdCB0aGUgZW5k IG9mIHRoZSAzcmQgcGFyYWdyYXBoIGluY2x1ZGUgYQ0KPiA+IHJlZmVyZW5jZSB0byBbZHJhZnQt aWV0Zi1jZG5pLXVyaS1zaWduaW5nXSB0byBtYWtlIHJlYWxseSBjbGVhciB3aGljaA0KPiA+IGRv Y3VtZW50IGlzIHRoZSAibWFpbiBVUkkgc2lnbmluZyBkcmFmdOKAnS4NCj4gPg0KPiA+IEJlbg0K PiA+DQo+ID4gPiBPbiAxNCBEZWMgMjAxNSwgYXQgMjA6MDcsIEtldmluIE1hIEogPGtldmluLmou bWFAZXJpY3Nzb24uY29tPiB3cm90ZToNCj4gPiA+DQo+ID4gPiBIaSBBbGwsDQo+ID4gPg0KPiA+ ID4gIChhcyBhIGNoYWlyKSBBcyBwZXIgdGhlIE9wZW4gRGlzY3Vzc2lvbiBhY3Rpb24gaXRlbSBm cm9tIFlva29oYW1hDQo+IFsxXSwNCj4gPiB0aGUgY2hhaXJzIGhhdmUgd29ya2VkIHdpdGggUmF5 IHRvIGRyYWZ0IGEgcmVzcG9uc2UgdG8gdGhlIE1QRUcgbGlhaXNvbg0KPiA+IHN0YXRlbWVudCBv biBVUkkgU2lnbmluZyBbMl0uICBQbGVhc2UgZmluZCB0aGUgcmVzcG9uc2UgYmVsb3csIGFuZCBm ZWVsDQo+ID4gZnJlZSB0byBzZW5kIGNvbW1lbnRzIHRvIHRoZSBsaXN0LiAgSWYgdGhlcmUgYXJl IG5vIG9iamVjdGlvbnMgb3INCj4gPiB1bmFkZHJlc3NlZCBjb21tZW50cyBieSBEZWNlbWJlciAz MHRoLCB3ZSB3aWxsIHNlbmQgdGhlIG9mZmljaWFsDQo+IHJlc3BvbnNlDQo+ID4gdG8gTVBFRy4N Cj4gPiA+DQo+ID4gPiB0aGFueCENCj4gPiA+DQo+ID4gPiAtLSAgS2V2aW4gSi4gTWENCj4gPiA+ DQo+ID4gPiBbMV0gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcHJvY2VlZGluZ3MvOTQvbWludXRlcy9t aW51dGVzLTk0LWNkbmkNCj4gPiA+IFsyXSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2xp YWlzb24vMTQzNC8NCj4gPiA+DQo+ID4gPiAtLS0tLQ0KPiA+ID4NCj4gPiA+IEZyb206IEtldmlu IEouIE1hDQo+ID4gPj4gRnJvbSBHcm91cDogQ0ROSQ0KPiA+ID4gVG86IFdhdGFuYWJlIFNoaW5q aSA8d2F0YW5hYmVAaXRzY2ouaXBzai5vci5qcD4NCj4gPiA+IFRvIEdyb3VwOiBJU08tSUVDLUpU QzEtU0MyOQ0KPiA+ID4gVGl0bGU6IFJlc3BvbnNlIHRvIHJlcXVlc3QgZm9yIGluZm9ybWF0aW9u IG9uIFVSSSBTaWduaW5nIDIwMTUtMTEtMDINCj4gPiA+IFJlc3BvbnNlIENvbnRhY3Q6IEtldmlu IEouIE1hIDxrZXZpbi5qLm1hQGVyaWNzc29uLmNvbT4NCj4gPiA+IFRlY2huaWNhbCBDb250YWN0 OiBSYXkgdmFuIEJyYW5kZW5idXJnIDxyYXkudmFuYnJhbmRlbmJ1cmdAdG5vLm5sPg0KPiA+ID4g UHVycG9zZTogSW4gUmVzcG9uc2UNCj4gPiA+IEJvZHk6DQo+ID4gPg0KPiA+ID4gVGhlIElFVEYg Q0ROSSB3b3JraW5nIGdyb3VwIHdvdWxkIGxpa2UgdG8gYWNrbm93bGVkZ2Ugb3VyIHJlY2VpcHQg b2YNCj4gdGhlDQo+ID4gTVBFRyBleHBlcnRzIGxpYWlzb24gbGV0dGVyIGFuZCBjYXJlZnVsIGNv bnNpZGVyYXRpb24gZHVyaW5nIHRoZSA5NHRoDQo+IElFVEYNCj4gPiBtZWV0aW5nLg0KPiA+ID4N Cj4gPiA+IEhhdmluZyByZXZpZXdlZCB0aGUgT25saW5lIE11bHRpbWVkaWEgQXV0aG9yaXphdGlv biBQcm90b2NvbCBWZXJzaW9uDQo+IDEuMA0KPiA+IChPTUFQdjEpIHNwZWNpZmljYXRpb24gWzIw MTJfMDlfMjhfT0FUQy1PTUFQXzEtMF0sIHdlIHVuZGVyc3RhbmQgdGhlDQo+ID4gcHJvcG9zZWQg c2NvcGUgb2YgdXNhZ2UgZm9yIENETkkgVVJJIFNpZ25pbmcgdG8gYmUgdGhlIG9ubHkgYXMgdGhl DQo+IEFjY2Vzcw0KPiA+IFRva2VuLCBhcyByZXR1cm5lZCBieSB0aGUgYXV0aG9yaXphdGlvbiBz ZXJ2ZXIgaW4gc3RlcCAoRSkgb2Ygc2VjdGlvbnMNCj4gMi4zDQo+ID4gYW5kIDIuNCBvZiB0aGUg T01BUHYxIHNwZWNpZmljYXRpb24sIHRvIGJlIHVzZSBzb2xlbHkgZm9yIGF1dGhvcml6aW5nDQo+ ID4gcmVxdWVzdHMgdG8gdGhlIHJlc291cmNlIHNlcnZlciAoaS5lLiwgdGhlIENETiksIGFzIGRl c2NyaWJlZCBpbiBzdGVwcw0KPiAoRikNCj4gPiBhbmQgKEcpIG9mIHNlY3Rpb25zIDIuMyBhbmQg Mi40IG9mIHRoZSBPTUFQdjEgc3BlY2lmaWNhdGlvbi4gIFdlIGFncmVlDQo+ID4gdGhhdCB0aGlz IGlzIGFuIGV4ZW1wbGFyeSB1c2UgY2FzZSBmb3IgQ0ROSSBVUkkgU2lnbmluZyB3aXRoIHRoZSBQ YXRoDQo+ID4gUGF0dGVybiBJbmZvcm1hdGlvbiBFbGVtZW50Lg0KPiA+ID4NCj4gPiA+IEF0IHRo ZSA5M3JkIElFVEYsIHRoZSBDRE5JIHdvcmtpbmcgZ3JvdXAgZGVjaWRlZCB0byByZW1vdmUgdGV4 dA0KPiByZWxhdGVkDQo+ID4gdG8gc2lnbmluZyBvZiBzZWdtZW50ZWQgY29udGVudCBVUklzIGZy b20gdGhlIENETkkgVVJJIFNpZ25pbmcgZHJhZnQNCj4gPiBbZHJhZnQtaWV0Zi1jZG5pLXVyaS1z aWduaW5nXSBpbiByZXNwb25zZSB0byBhbiBJUFIgZGlzY2xvc3VyZSBtYWRlDQo+IGFmdGVyDQo+ ID4gdGhlIDkybmQgSUVURiBbbWludXRlcy05My1jZG5pXS4gVGhlIHJlbW92ZWQgc2VjdGlvbnMg YXJlIGN1cnJlbnRseQ0KPiA+IGRvY3VtZW50ZWQgaW4gYSBzZXBhcmF0ZSBkcmFmdCBbZHJhZnQt YnJhbmRlbmJ1cmctY2RuaS11cmktc2lnbmluZy1mb3ItDQo+ID4gaGFzXSwgYXMgYW4gZXh0ZW5z aW9uIHRvIHRoZSBtYWluIFVSSSBzaWduaW5nIGRvY3VtZW50LiBJdCBzaG91bGQgYmUNCj4gbm90 ZWQNCj4gPiB0aGF0IGF0IHRoaXMgcG9pbnQsIHRoYXQgZG9jdW1lbnQgaXMgcmVnYXJkZWQgYXMg YW4gaW5kZXBlbmRlbnQNCj4gc3VibWlzc2lvbg0KPiA+IGFuZCBJRVRGIGhhcyBub3QgbWFkZSBh IGRlY2lzaW9uIHJlZ2FyZGluZyBpdHMgZnV0dXJlIHN0YXR1cy4gQXQgdGhlDQo+IDk0dGgNCj4g PiBJRVRGLCBpdCB3YXMgYWdyZWVkIHRoYXQgdGhlIFBhdGggUGF0dGVybiBJbmZvcm1hdGlvbiBl bGVtZW50IHdhcyBub3QNCj4gPiBjb3ZlcmVkIGJ5IHRoZSBJUFIgZGlzY2xvc3VyZSBhbmQgd291 bGQgYmUgYSB1c2VmdWwgZmVhdHVyZSBmb3IgYSBudW1iZXINCj4gPiBvZiBVUkkgU2lnbmluZyB1 c2UgY2FzZXMsIGluY2x1ZGluZyBzZWdtZW50ZWQgY29udGVudCBbbWludXRlcy05NC1jZG5pXS4N Cj4gPiBQYXRoIFBhdHRlcm4gc3VwcG9ydCB3aWxsIGJlIHJlaW5zdGF0ZWQgaW4gYSBmdXR1cmUg cmV2aXNpb24gb2YgdGhlIG1haW4NCj4gPiBVUkkgc2lnbmluZyBkcmFmdC4NCj4gPiA+DQo+ID4g PiBXaXRoIHJlc3BlY3QgdG8gbG9uZy1saXZlZCB0b2tlbnMsIGFzIG1lbnRpb25lZCBpbiB0aGUg U2VjdXJpdHkNCj4gPiBDb25zaWRlcmF0aW9ucyBzZWN0aW9uICg5KSBvZiB0aGUgQ0ROSSBVUkkg U2lnbmluZyBkcmFmdCwgaW5jcmVhc2luZyB0aGUNCj4gPiB0b2tlbiB2YWxpZGl0eSBwZXJpb2Qg aW5jcmVhc2VzIHRoZSBwb3RlbnRpYWwgZm9yIHJlcGxheSBhdHRhY2tzLA0KPiA+IGluY2x1ZGlu ZyBEb1MgYXR0YWNrczsgaG93ZXZlciwgbm90aGluZyBpbiB0aGUgcHJvdG9jb2wgcHJldmVudHMg dGhlIHVzZQ0KPiA+IG9mIGxvbmctbGl2ZWQgdG9rZW5zLg0KPiA+ID4NCj4gPiA+IFdpdGggcmVz cGVjdCB0byBDRE5zIHJlZnJlc2hpbmcgdG9rZW5zLCB0aGUgQ0ROSSB3b3JraW5nIGdyb3VwDQo+ IGRpc2N1c3NlZA0KPiA+IG1lY2hhbmlzbXMgZm9yIHNpZ25hbGluZyB0b2tlbiByZWZyZXNoIGJl dHdlZW4gQ0ROcyBhbmQgZmVsdCB0aGF0IHRoZQ0KPiA+IHJlcXVpcmVkIGFkZGl0aW9uYWwgY29t cGxleGl0eSBvZiBzdWNoIGEgbWVjaGFuaXNtIG91dHdlaWdoZWQgdGhlIGNvc3QNCj4gb2YNCj4g PiByZWdlbmVyYXRpbmcgdGhlIHRva2Vucy4gTm90ZTogU2lnbmFsaW5nIGJldHdlZW4gQ0ROcyBh bmQgY2xpZW50cyBpcw0KPiBvdXQtDQo+ID4gb2Ytc2NvcGUgZm9yIENETkkuIEFzIG1lbnRpb25l ZCBhYm92ZSwgY2hhaW5lZCB0b2tlbiBzdXBwb3J0IHdhcyByZW1vdmVkDQo+ID4gZnJvbSB0aGUg Y3VycmVudCBDRE5JIFVSSSBTaWduaW5nIGRyYWZ0IGFuZCB0aGVyZSBpcyBubyBwbGFuIHRvDQo+ IHJlaW5zdGF0ZQ0KPiA+IGl0IGluIHRoZSBtYWluIFVSSSBzaWduaW5nIGRvY3VtZW50IGR1ZSB0 byBJUFIgaXNzdWVzLiBBcyBzdWNoLCB0aGUNCj4gdG9waWMNCj4gPiBvZiB0b2tlbiByZWdlbmVy YXRpb24gaXMgbGltaXRlZCB0byBbZHJhZnQtYnJhbmRlbmJ1cmctY2RuaS11cmktc2lnbmluZy0N Cj4gPiBmb3ItaGFzXS4NCj4gPiA+DQo+ID4gPiBXaXRoIHJlc3BlY3QgdG8gbmFtZSBjb2xsaXNp b25zLCB0aGUgY3VycmVudCB2ZXJzaW9uIG9mIHRoZSBDRE5JIFVSSQ0KPiA+IFNpZ25pbmcgZHJh ZnQgb25seSBzdXBwb3J0cyBxdWVyeS1zdHJpbmctYmFzZWQgY29udmV5YW5jZSBvZiB0aGUgdG9r ZW4uDQo+ID4gVGhlIG1ldGFkYXRhIGVsZW1lbnQgInBhY2thZ2UtYXR0cmlidXRlIiB3YXMgaW50 cm9kdWNlZCB0byBhbGxvdyBjb250ZW50DQo+ID4gc2VydmljZSBwcm92aWRlcnMgKENTUHMpIHRv IHNlbGVjdCBhbnkgcXVlcnkgc3RyaW5nIHBhcmFtZXRlciBuYW1lIHRoZXkNCj4gPiB3YW50ZWQs IGFzc3VtaW5nIHRoYXQgQ1NQcyB3b3VsZCBiZSBpbiB0aGUgYmVzdCBwb3NpdGlvbiB0byBzZWxl Y3QgYQ0KPiBsb3ctDQo+ID4gY29sbGlzaW9uLXByb2JhYmlsaXR5IG5hbWU7IFVSSVNpZ25pbmdQ YWNrYWdlIGlzIG9ubHkgdGhlIGRlZmF1bHQgbmFtZS4NCj4gPiA+DQo+ID4gPiBXaXRoIHJlc3Bl Y3QgdG8gY29uc2VjdXRpdmUgdG9rZW5zLCB0aGUgQ0ROSSBVUkkgU2lnbmluZyBtZWNoYW5pc20g d2FzDQo+ID4gZGVzaWduZWQgdG8gYmUgc3RhdGVsZXNzLCBzbyB0aGF0IGNvbnNlY3V0aXZlIHRv a2VucyBjYW4gYmUgcmV0cmlldmVkDQo+IGZyb20NCj4gPiBkaWZmZXJlbnQgZGVsaXZlcnkgbm9k ZXMuIEFzIHN1Y2gsIHRoZXJlIGlzIG5vIHJlbGF0aW9uc2hpcCBiZXR3ZWVuDQo+ID4gY29uc2Vj dXRpdmUgdG9rZW5zIGFuZCB0b2tlbiBpbnZhbGlkYXRpb24gaXMgc29sZWx5IGJhc2VkIG9uIHRo ZSBFeHBpcnkNCj4gPiBUaW1lIGluZm9ybWF0aW9uIGVsZW1lbnQuDQo+ID4gPg0KPiA+ID4gVGhl IENETkkgd29ya2luZyBncm91cCBhcHByZWNpYXRlcyB0aGUgTVBFRyBleHBlcnRzJyB0aG91Z2h0 ZnVsIGlucHV0DQo+ID4gYW5kIGxvb2tzIGZvcndhcmQgdG8gY29udGludWVkIGNvbGxhYm9yYXRp b24gd2l0aCBNUEVHIGV4cGVydHMgb24gVVJJDQo+ID4gU2lnbmluZy4NCj4gPiA+DQo+ID4gPiBP dXIgbmV4dCBtZWV0aW5nOiBJRVRGIDk1LCBBcHJpbCAzLTggMjAxNiwgQnVlbm9zIEFpcmVzLCBB cmdlbnRpbmENCj4gPiA+DQo+ID4gPiBbMjAxMl8wOV8yOF9PQVRDLU9NQVBfMS0wXQ0KPiA+IGh0 dHA6Ly93d3cub2F0Yy51cy9Qb3J0YWxzL19kZWZhdWx0L0tub3dsZWRnZWJhc2UvMS8yMDEyXzA5 XzI4X09BVEMtDQo+ID4gT01BUF8xLTAucGRmDQo+ID4gPiBbZHJhZnQtaWV0Zi1jZG5pLXVyaS1z aWduaW5nXSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC0NCj4gPiBpZXRm LWNkbmktdXJpLXNpZ25pbmcvDQo+ID4gPiBbZHJhZnQtYnJhbmRlbmJ1cmctY2RuaS11cmktc2ln bmluZy1mb3ItaGFzXQ0KPiA+IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0 LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25pbmctZm9yLQ0KPiA+IGhhcy8NCj4gPiA+IFttaW51 dGVzLTkzLWNkbmldIGh0dHBzOi8vd3d3LmlldGYub3JnL3Byb2NlZWRpbmdzLzkzL21pbnV0ZXMv bWludXRlcy0NCj4gPiA5My1jZG5pDQo+ID4gPiBbbWludXRlcy05NC1jZG5pXSBodHRwczovL3d3 dy5pZXRmLm9yZy9wcm9jZWVkaW5ncy85NC9taW51dGVzL21pbnV0ZXMtDQo+ID4gOTQtY2RuaQ0K PiA+ID4NCj4gPiA+DQo+ID4gPg0KPiA+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCj4gPiA+IENETmkgbWFpbGluZyBsaXN0DQo+ID4gPiBDRE5pQGll dGYub3JnDQo+ID4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkN Cg0K From nobody Wed Dec 23 18:28:58 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAB831AD0C3; Wed, 23 Dec 2015 18:28:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.912 X-Spam-Level: X-Spam-Status: No, score=-101.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PREZX6DMb45v; Wed, 23 Dec 2015 18:28:55 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1900:3001:11::31]) by ietfa.amsl.com (Postfix) with ESMTP id 75E9A1AD0C2; Wed, 23 Dec 2015 18:28:55 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 0891E18000D; Wed, 23 Dec 2015 18:28:41 -0800 (PST) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Message-Id: <20151224022841.0891E18000D@rfc-editor.org> Date: Wed, 23 Dec 2015 18:28:41 -0800 (PST) Archived-At: Cc: drafts-update-ref@iana.org, cdni@ietf.org, rfc-editor@rfc-editor.org Subject: [CDNi] RFC 7736 on Content Delivery Network Interconnection (CDNI) Media Type Registration X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Dec 2015 02:28:56 -0000 A new Request for Comments is now available in online RFC libraries. RFC 7736 Title: Content Delivery Network Interconnection (CDNI) Media Type Registration Author: K. Ma Status: Informational Stream: IETF Date: December 2015 Mailbox: kevin.j.ma@ericsson.com Pages: 7 Characters: 13053 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-cdni-media-type-06.txt URL: https://www.rfc-editor.org/info/rfc7736 DOI: http://dx.doi.org/10.17487/RFC7736 This document defines the standard media type used by the Content Delivery Network Interconnection (CDNI) protocol suite, including the registration procedure and recommended usage of the required payload- type parameter. This document is a product of the Content Delivery Networks Interconnection Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/rfc.html Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Wed Dec 30 05:34:02 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6434F1ACCEE for ; Wed, 30 Dec 2015 05:33:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.801 X-Spam-Level: X-Spam-Status: No, score=0.801 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PrSH6k_I4G4x for ; Wed, 30 Dec 2015 05:33:51 -0800 (PST) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.144]) by ietfa.amsl.com (Postfix) with ESMTP id 5B9361A0019 for ; Wed, 30 Dec 2015 05:33:51 -0800 (PST) Received: from dab-ell1-h-74-10.dab.02.net ([82.132.239.239] helo=[10.8.156.89]) by smtp04.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from ) id 1aEGst-0004MD-9s; Wed, 30 Dec 2015 13:33:50 +0000 Content-Type: multipart/alternative; boundary=Apple-Mail-489BDB28-4CEC-433E-8853-0061F608CA5D Mime-Version: 1.0 (1.0) From: Ben Niven-Jenkins X-Mailer: iPhone Mail (13C75) In-Reply-To: Date: Wed, 30 Dec 2015 13:33:40 +0000 Content-Transfer-Encoding: 7bit Message-Id: References: <73F3A4F6-FC5D-4BC8-BEEC-82F27BA3641F@tno.nl> <102272CE-9EF0-4959-B9E2-8A2F10147BF7@cisco.com> <853CC284-D147-4A1F-8C47-213775F47768@cisco.com> <437C224B-1C0E-4705-8D52-98E139DDD75E@niven-jenkins.co.uk> <46A08C98-7B12-4F98-8826-8E9FE904B83C@niven-jenkins.co.uk> <6DF9C32E-A750-4CF6-A613-489225FC5042@cisco.com> To: Kevin Ma J X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 Archived-At: Cc: "cdni@ietf.org" Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2015 13:33:54 -0000 --Apple-Mail-489BDB28-4CEC-433E-8853-0061F608CA5D Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Colleagues, I like Jon's text. We'll include & publish a new version.=20 Ben > On 10 Dec 2015, at 00:54, Kevin Ma J wrote: >=20 > Hi Jon, > =20 > Fair enough. I'm ok with the text below. I'm torn between being more e= xplicit about the issues and maybe adding a few SHOULDs/MUSTs, and coming up= with the least controversial text; I agree with deferring the discussion to= draft-fieau. > =20 > thanx! > =20 > -- Kevin J. Ma > =20 > From: Peterson, Jon [mailto:jon.peterson@neustar.biz]=20 > Sent: Wednesday, December 09, 2015 7:09 PM > To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben > Cc: cdni@ietf.org > Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection > =20 > No, we really cannot say in our specification text that we assume the UA w= ill (or even should) continue despite the presence of security warnings - my= email was just being snarky by pointing out that users in fact tend to do t= hat, but that is a bad thing, and it is our job as spec authors to prevent t= hem from being in that position. I think we're shifting the focus here too m= uch to the warnings themselves and not to the problem that is causing the wa= rnings. The problem causing the warnings is that in this HTTPS case, the DNS= redirect insecurely directs you to another domain, and that HTTPS should fa= il when that happens, if the domain does not hold the keying material that t= he UA expects. > =20 > The proper, long-term way to actually fix this is either to use DNSSEC, or= to give up DNS redirection entirely and just use HTTPS. In that case the UA= securely learns that it should negotiate TLS with the RT's domain instead o= f the original domain. But we're not going to tell people they have to do th= at. > =20 > The immediate solution (i.e. workaround) is "operational mechanisms" that w= e assume here, but do not detail - that is, the uCDN giving away its private= key to all relevant devices in all dCDNs that could conceivably be RTs. All= of your partners/competitors can now impersonate you: enjoy! That is why th= is is just a workaround. > =20 > The mid-term way to address this is the problem space that draft-fieau is t= rying (I think, anyway) to shape. > =20 > Are we home yet? Here's some proposed edits: > =20 > In all three of the above cases, either HTTP or HTTPS could be used to c= onnect to the Redirection Target. When HTTPS is used to connect to the uCDN,= if the uCDN uses DNS redirection to identify the RT to the User Agent, then= the new target domain name may not match the domain in the URL dereferenced= to reach the uCDN: without operational precautions, and in the absence of D= NSSEC, this can make a legitimate redirection look like a DNS-based attack t= o a User Agent and trigger false-negative security warnings. When DNS-based r= edirection with HTTPS is used, this specification assumes that any RT can co= mplete the necessary TLS handshake with the User Agent. Any operational mech= anisms this requires, e.g., private key distribution to surrogates and reque= st routers in dCDNs, are outside the scope of this document. Further mechani= sms to notify User Agents of trusted redirection are also outside the scope o= f this document. > =20 > Jon Peterson > Neustar, Inc. > =20 --Apple-Mail-489BDB28-4CEC-433E-8853-0061F608CA5D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
Colleagues,

I like Jon's text. We'll include & publish a new version. 

Ben

On 10 Dec 2015, at 00:54, Kevin Ma J <kevin.j.ma@ericsson.com> wrote:

Hi Jon,

 

  Fair enough.  I'm ok with the text below.  I'm torn between being more explicit about the issues and maybe adding a few SHOULDs/MUSTs, and coming up with the least controversial text; I agree with deferring the discussion to draft-fieau.

 

thanx!

 

--  Kevin J. Ma

 

From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, December 09, 2015 7:09 PM
To: Kevin Ma J; Francois Le Faucheur (flefauch); Niven-Jenkins Ben
Cc: cdni@ietf.org
Subject: Re: [CDNi] Jon's commet on draft-ietf-cdni-redirection

 

No, we really cannot say in our specification text that we assume the UA will (or even should) continue despite the presence of security warnings - my email was just being snarky by pointing out that users in fact tend to do that, but that is a bad thing, and it is our job as spec authors to prevent them from being in that position. I think we're shifting the focus here too much to the warnings themselves and not to the problem that is causing the warnings. The problem causing the warnings is that in this HTTPS case, the DNS redirect insecurely directs you to another domain, and that HTTPS should fail when that happens, if the domain does not hold the keying material that the UA expects.

 

The proper, long-term way to actually fix this is either to use DNSSEC, or to give up DNS redirection entirely and just use HTTPS. In that case the UA securely learns that it should negotiate TLS with the RT's domain instead of the original domain. But we're not going to tell people they have to do that.

 

The immediate solution (i.e. workaround) is "operational mechanisms" that we assume here, but do not detail - that is, the uCDN giving away its private key to all relevant devices in all dCDNs that could conceivably be RTs. All of your partners/competitors can now impersonate you: enjoy! That is why this is just a workaround.

 

The mid-term way to address this is the problem space that draft-fieau is trying (I think, anyway) to shape.

 

Are we home yet? Here's some proposed edits:

 

  In all three of the above cases, either HTTP or HTTPS could be used to connect to the Redirection Target. When HTTPS is used to connect to the uCDN, if the uCDN uses DNS redirection to identify the RT to the User Agent, then the new target domain name may not match the domain in the URL dereferenced to reach the uCDN: without operational precautions, and in the absence of DNSSEC, this can make a legitimate redirection look like a DNS-based attack to a User Agent and trigger false-negative security warnings. When DNS-based redirection with HTTPS is used, this specification assumes that any RT can complete the necessary TLS handshake with the User Agent. Any operational mechanisms this requires, e.g., private key distribution to surrogates and request routers in dCDNs, are outside the scope of this document. Further mechanisms to notify User Agents of trusted redirection are also outside the scope of this document.

 

Jon Peterson

Neustar, Inc.

 

--Apple-Mail-489BDB28-4CEC-433E-8853-0061F608CA5D-- From nobody Wed Dec 30 07:51:42 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62DD51ACD5E for ; Wed, 30 Dec 2015 07:51:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.801 X-Spam-Level: X-Spam-Status: No, score=-4.801 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QimJBTrc9cIA for ; Wed, 30 Dec 2015 07:51:38 -0800 (PST) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B9AE1ACD58 for ; Wed, 30 Dec 2015 07:51:37 -0800 (PST) X-AuditID: c6180641-f799c6d000007d66-ed-5683fd7ee50a Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id 1B.BC.32102.E7DF3865; Wed, 30 Dec 2015 16:51:26 +0100 (CET) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0248.002; Wed, 30 Dec 2015 10:51:33 -0500 From: Kevin Ma J To: "cdni@ietf.org" Thread-Topic: [CDNi] Response to Liaison Statement on URI Signing Thread-Index: AdE2lBu7d05r8E4UT/O4koQZbwRotQA89wyAAApUfdAAFCpUcALF6FaQ Date: Wed, 30 Dec 2015 15:51:32 +0000 Message-ID: References: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.11] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrJLMWRmVeSWpSXmKPExsUyuXRPuG7d3+Ywg7fnRC2ezv7D6sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujP1Nu5kLJrUwVpxcsJ+lgfFBA2MXIyeHhICJxOkrp9kgbDGJ C/fWA9lcHEICRxgljv/4wQ7hLGeU+Pr2MStIFZuAlsTjr3+Zuhg5OEQElCV+HnIECQsLOEj8 P9HPDhF2lFjzOwIkLCLgJjFp0WmwThYBVYnVfUfB9vIK+Eq8OtoHNb6HUaJp+wYmkAQj0BHf T60Bs5kFxCVuPZnPBHGcgMSSPeeZIWxRiZeP/7FC2EoSH3/PB9vLLKApsX6XPkSrosSU7ofs ELsEJU7OfMIygVFkFpKpsxA6ZiHpmIWkYwEjyypGjtLigpzcdCPDTYzAAD8mwea4g3Fvr+ch RgEORiUe3g0ezWFCrIllxZW5hxglOJiVRHgXbAIK8aYkVlalFuXHF5XmpBYfYpTmYFES502U aQwTEkhPLEnNTk0tSC2CyTJxcEo1MPb0L01vcMjSO9Sm/7PYlHHRce7ds4+Jx5vKvItxvpzC /udl08nMNY9uKf/8sbu7evef+jv3LrDdOeX2JqUnRYut13sW0wxF7wLZzy2VWSkTREWar51b XK8h1uJhLjVl0/ujlW8OnM7ZedXF86/n/2BZ57jVC4SOXtuo/ePvmScTlj5nU2la06HEUpyR aKjFXFScCAA4Xv3cbAIAAA== Archived-At: Subject: Re: [CDNi] Response to Liaison Statement on URI Signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2015 15:51:41 -0000 SGkgQWxsLA0KDQogIEhhdmluZyBoZWFyZCBubyBvdGhlciBvYmplY3Rpb25zIG9yIGNvbW1lbnRz LCB0aGUgY2hhaXJzIHdpbGwgbW92ZSBhaGVhZCB3aXRoIGZpbGluZyB0aGUgbGlhaXNvbiByZXNw b25zZS4NCg0KdGhhbnghDQoNCi0tICBLZXZpbiBKLiBNYQ0KDQo+IC0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQo+IEZyb206IEtldmluIE1hIEoNCj4gU2VudDogVHVlc2RheSwgRGVjZW1iZXIg MTUsIDIwMTUgMTI6NTAgUE0NCj4gVG86ICdCZW4gTml2ZW4tSmVua2lucycNCj4gQ2M6ICdjZG5p QGlldGYub3JnJw0KPiBTdWJqZWN0OiBSRTogW0NETmldIFJlc3BvbnNlIHRvIExpYWlzb24gU3Rh dGVtZW50IG9uIFVSSSBTaWduaW5nDQo+IA0KPiBJIGNsZWFuZWQgdXAgdGhlIGRyYWZ0IGxhbmd1 YWdlDQo+IC0gcmVtb3ZlZCAibWFpbiIgb3IgY2hhbmdlZCAibWFpbiIgLT4gIkNETkkiIGluIGFs bCBwbGFjZXMNCj4gLSB1c2VkICJleHRlbnNpb24iIHRvIHJlZmVyIHRvIFJheSdzIGRyYWZ0DQo+ IC0gY2hhbmdlZCAiZG9jdW1lbnQiIC0+ICJkcmFmdCIgaW4gYWxsIHBsYWNlcw0KPiAtIGFkZGVk IHJlZmVyZW5jZXMgdG8gW2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZ10gYWZ0ZXIgYWxsIG1l bnRpb25zIG9mDQo+IHRoZSBkcmFmdA0KPiANCj4gRnJvbTogS2V2aW4gSi4gTWENCj4gRnJvbSBH cm91cDogQ0ROSQ0KPiBUbzogV2F0YW5hYmUgU2hpbmppIDx3YXRhbmFiZUBpdHNjai5pcHNqLm9y LmpwPg0KPiBUbyBHcm91cDogSVNPLUlFQy1KVEMxLVNDMjkNCj4gVGl0bGU6IFJlc3BvbnNlIHRv IHJlcXVlc3QgZm9yIGluZm9ybWF0aW9uIG9uIFVSSSBTaWduaW5nIDIwMTUtMTEtMDINCj4gUmVz cG9uc2UgQ29udGFjdDogS2V2aW4gSi4gTWEgPGtldmluLmoubWFAZXJpY3Nzb24uY29tPg0KPiBU ZWNobmljYWwgQ29udGFjdDogUmF5IHZhbiBCcmFuZGVuYnVyZyA8cmF5LnZhbmJyYW5kZW5idXJn QHRuby5ubD4NCj4gUHVycG9zZTogSW4gUmVzcG9uc2UNCj4gQm9keToNCj4gDQo+IFRoZSBJRVRG IENETkkgd29ya2luZyBncm91cCB3b3VsZCBsaWtlIHRvIGFja25vd2xlZGdlIG91ciByZWNlaXB0 IG9mIHRoZQ0KPiBNUEVHIGV4cGVydHMgbGlhaXNvbiBsZXR0ZXIgYW5kIGNhcmVmdWwgY29uc2lk ZXJhdGlvbiBkdXJpbmcgdGhlIDk0dGggSUVURg0KPiBtZWV0aW5nLg0KPiANCj4gSGF2aW5nIHJl dmlld2VkIHRoZSBPbmxpbmUgTXVsdGltZWRpYSBBdXRob3JpemF0aW9uIFByb3RvY29sIFZlcnNp b24gMS4wDQo+IChPTUFQdjEpIHNwZWNpZmljYXRpb24gWzIwMTJfMDlfMjhfT0FUQy1PTUFQXzEt MF0sIHdlIHVuZGVyc3RhbmQgdGhlDQo+IHByb3Bvc2VkIHNjb3BlIG9mIHVzYWdlIGZvciBDRE5J IFVSSSBTaWduaW5nIHRvIGJlIHRoZSBvbmx5IGFzIHRoZSBBY2Nlc3MNCj4gVG9rZW4sIGFzIHJl dHVybmVkIGJ5IHRoZSBhdXRob3JpemF0aW9uIHNlcnZlciBpbiBzdGVwIChFKSBvZiBzZWN0aW9u cyAyLjMNCj4gYW5kIDIuNCBvZiB0aGUgT01BUHYxIHNwZWNpZmljYXRpb24sIHRvIGJlIHVzZSBz b2xlbHkgZm9yIGF1dGhvcml6aW5nDQo+IHJlcXVlc3RzIHRvIHRoZSByZXNvdXJjZSBzZXJ2ZXIg KGkuZS4sIHRoZSBDRE4pLCBhcyBkZXNjcmliZWQgaW4gc3RlcHMgKEYpDQo+IGFuZCAoRykgb2Yg c2VjdGlvbnMgMi4zIGFuZCAyLjQgb2YgdGhlIE9NQVB2MSBzcGVjaWZpY2F0aW9uLiAgV2UgYWdy ZWUNCj4gdGhhdCB0aGlzIGlzIGFuIGV4ZW1wbGFyeSB1c2UgY2FzZSBmb3IgQ0ROSSBVUkkgU2ln bmluZyB3aXRoIHRoZSBQYXRoDQo+IFBhdHRlcm4gSW5mb3JtYXRpb24gRWxlbWVudC4NCj4gDQo+ IEF0IHRoZSA5M3JkIElFVEYsIHRoZSBDRE5JIHdvcmtpbmcgZ3JvdXAgZGVjaWRlZCB0byByZW1v dmUgdGV4dCByZWxhdGVkIHRvDQo+IHNpZ25pbmcgb2Ygc2VnbWVudGVkIGNvbnRlbnQgVVJJcyBm cm9tIHRoZSBDRE5JIFVSSSBTaWduaW5nIGRyYWZ0IFtkcmFmdC0NCj4gaWV0Zi1jZG5pLXVyaS1z aWduaW5nXSBpbiByZXNwb25zZSB0byBhbiBJUFIgZGlzY2xvc3VyZSBtYWRlIGFmdGVyIHRoZQ0K PiA5Mm5kIElFVEYgW21pbnV0ZXMtOTMtY2RuaV0uIFRoZSByZW1vdmVkIHNlY3Rpb25zIGFyZSBj dXJyZW50bHkgZG9jdW1lbnRlZA0KPiBpbiBhIHNlcGFyYXRlIGRyYWZ0IFtkcmFmdC1icmFuZGVu YnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci1oYXNdLCBhcyBhbg0KPiBleHRlbnNpb24gdG8gdGhl IENETkkgVVJJIHNpZ25pbmcgZHJhZnQgW2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZ10uIEl0 DQo+IHNob3VsZCBiZSBub3RlZCB0aGF0IGF0IHRoaXMgcG9pbnQsIHRoYXQgZG9jdW1lbnQgaXMg cmVnYXJkZWQgYXMgYW4NCj4gaW5kZXBlbmRlbnQgc3VibWlzc2lvbiBhbmQgSUVURiBoYXMgbm90 IG1hZGUgYSBkZWNpc2lvbiByZWdhcmRpbmcgaXRzDQo+IGZ1dHVyZSBzdGF0dXMuIEF0IHRoZSA5 NHRoIElFVEYsIGl0IHdhcyBhZ3JlZWQgdGhhdCB0aGUgUGF0aCBQYXR0ZXJuDQo+IEluZm9ybWF0 aW9uIGVsZW1lbnQgd2FzIG5vdCBjb3ZlcmVkIGJ5IHRoZSBJUFIgZGlzY2xvc3VyZSBhbmQgd291 bGQgYmUgYQ0KPiB1c2VmdWwgZmVhdHVyZSBmb3IgYSBudW1iZXIgb2YgVVJJIFNpZ25pbmcgdXNl IGNhc2VzLCBpbmNsdWRpbmcgc2VnbWVudGVkDQo+IGNvbnRlbnQgW21pbnV0ZXMtOTQtY2RuaV0u IFBhdGggUGF0dGVybiBzdXBwb3J0IHdpbGwgYmUgcmVpbnN0YXRlZCBpbiBhDQo+IGZ1dHVyZSBy ZXZpc2lvbiBvZiB0aGUgQ0ROSSBVUkkgc2lnbmluZyBkcmFmdCBbZHJhZnQtaWV0Zi1jZG5pLXVy aS0NCj4gc2lnbmluZ10uDQo+IA0KPiBXaXRoIHJlc3BlY3QgdG8gbG9uZy1saXZlZCB0b2tlbnMs IGFzIG1lbnRpb25lZCBpbiB0aGUgU2VjdXJpdHkNCj4gQ29uc2lkZXJhdGlvbnMgc2VjdGlvbiAo OSkgb2YgdGhlIENETkkgVVJJIFNpZ25pbmcgZHJhZnQsIGluY3JlYXNpbmcgdGhlDQo+IHRva2Vu IHZhbGlkaXR5IHBlcmlvZCBpbmNyZWFzZXMgdGhlIHBvdGVudGlhbCBmb3IgcmVwbGF5IGF0dGFj a3MsDQo+IGluY2x1ZGluZyBEb1MgYXR0YWNrczsgaG93ZXZlciwgbm90aGluZyBpbiB0aGUgcHJv dG9jb2wgcHJldmVudHMgdGhlIHVzZQ0KPiBvZiBsb25nLWxpdmVkIHRva2Vucy4NCj4gDQo+IFdp dGggcmVzcGVjdCB0byBDRE5zIHJlZnJlc2hpbmcgdG9rZW5zLCB0aGUgQ0ROSSB3b3JraW5nIGdy b3VwIGRpc2N1c3NlZA0KPiBtZWNoYW5pc21zIGZvciBzaWduYWxpbmcgdG9rZW4gcmVmcmVzaCBi ZXR3ZWVuIENETnMgYW5kIGZlbHQgdGhhdCB0aGUNCj4gcmVxdWlyZWQgYWRkaXRpb25hbCBjb21w bGV4aXR5IG9mIHN1Y2ggYSBtZWNoYW5pc20gb3V0d2VpZ2hlZCB0aGUgY29zdCBvZg0KPiByZWdl bmVyYXRpbmcgdGhlIHRva2Vucy4gTm90ZTogU2lnbmFsaW5nIGJldHdlZW4gQ0ROcyBhbmQgY2xp ZW50cyBpcyBvdXQtDQo+IG9mLXNjb3BlIGZvciBDRE5JLiBBcyBtZW50aW9uZWQgYWJvdmUsIGNo YWluZWQgdG9rZW4gc3VwcG9ydCB3YXMgcmVtb3ZlZA0KPiBmcm9tIHRoZSBDRE5JIFVSSSBTaWdu aW5nIGRyYWZ0IFtkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmddIGFuZCB0aGVyZSBpcw0KPiBu byBwbGFuIHRvIHJlaW5zdGF0ZSBpdCBpbiB0aGUgQ0ROSSBVUkkgc2lnbmluZyBkcmFmdCBbZHJh ZnQtaWV0Zi1jZG5pLQ0KPiB1cmktc2lnbmluZ10gZHVlIHRvIElQUiBpc3N1ZXMuIEFzIHN1Y2gs IHRoZSB0b3BpYyBvZiB0b2tlbiByZWdlbmVyYXRpb24NCj4gaXMgbGltaXRlZCB0byB0aGUgZXh0 ZW5zaW9uIGRyYWZ0IFtkcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLWZvci0NCj4g aGFzXS4NCj4gDQo+IFdpdGggcmVzcGVjdCB0byBuYW1lIGNvbGxpc2lvbnMsIHRoZSBjdXJyZW50 IHZlcnNpb24gb2YgdGhlIENETkkgVVJJDQo+IFNpZ25pbmcgZHJhZnQgW2RyYWZ0LWlldGYtY2Ru aS11cmktc2lnbmluZ10gb25seSBzdXBwb3J0cyBxdWVyeS1zdHJpbmctDQo+IGJhc2VkIGNvbnZl eWFuY2Ugb2YgdGhlIHRva2VuLiAgVGhlIG1ldGFkYXRhIGVsZW1lbnQgInBhY2thZ2UtYXR0cmli dXRlIg0KPiB3YXMgaW50cm9kdWNlZCB0byBhbGxvdyBjb250ZW50IHNlcnZpY2UgcHJvdmlkZXJz IChDU1BzKSB0byBzZWxlY3QgYW55DQo+IHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIgbmFtZSB0aGV5 IHdhbnRlZCwgYXNzdW1pbmcgdGhhdCBDU1BzIHdvdWxkIGJlIGluDQo+IHRoZSBiZXN0IHBvc2l0 aW9uIHRvIHNlbGVjdCBhIGxvdy1jb2xsaXNpb24tcHJvYmFiaWxpdHkgbmFtZTsNCj4gVVJJU2ln bmluZ1BhY2thZ2UgaXMgb25seSB0aGUgZGVmYXVsdCBuYW1lLg0KPiANCj4gV2l0aCByZXNwZWN0 IHRvIGNvbnNlY3V0aXZlIHRva2VucywgdGhlIENETkkgVVJJIFNpZ25pbmcgbWVjaGFuaXNtIHdh cw0KPiBkZXNpZ25lZCB0byBiZSBzdGF0ZWxlc3MsIHNvIHRoYXQgY29uc2VjdXRpdmUgdG9rZW5z IGNhbiBiZSByZXRyaWV2ZWQgZnJvbQ0KPiBkaWZmZXJlbnQgZGVsaXZlcnkgbm9kZXMuIEFzIHN1 Y2gsIHRoZXJlIGlzIG5vIHJlbGF0aW9uc2hpcCBiZXR3ZWVuDQo+IGNvbnNlY3V0aXZlIHRva2Vu cyBhbmQgdG9rZW4gaW52YWxpZGF0aW9uIGlzIHNvbGVseSBiYXNlZCBvbiB0aGUgRXhwaXJ5DQo+ IFRpbWUgaW5mb3JtYXRpb24gZWxlbWVudC4NCj4gDQo+IFRoZSBDRE5JIHdvcmtpbmcgZ3JvdXAg YXBwcmVjaWF0ZXMgdGhlIE1QRUcgZXhwZXJ0cycgdGhvdWdodGZ1bCBpbnB1dCBhbmQNCj4gbG9v a3MgZm9yd2FyZCB0byBjb250aW51ZWQgY29sbGFib3JhdGlvbiB3aXRoIE1QRUcgZXhwZXJ0cyBv biBVUkkgU2lnbmluZy4NCj4gDQo+IE91ciBuZXh0IG1lZXRpbmc6IElFVEYgOTUsIEFwcmlsIDMt OCAyMDE2LCBCdWVub3MgQWlyZXMsIEFyZ2VudGluYQ0KPiANCj4gWzIwMTJfMDlfMjhfT0FUQy1P TUFQXzEtMF0NCj4gaHR0cDovL3d3dy5vYXRjLnVzL1BvcnRhbHMvX2RlZmF1bHQvS25vd2xlZGdl YmFzZS8xLzIwMTJfMDlfMjhfT0FUQy0NCj4gT01BUF8xLTAucGRmDQo+IFtkcmFmdC1pZXRmLWNk bmktdXJpLXNpZ25pbmddIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWll dGYtDQo+IGNkbmktdXJpLXNpZ25pbmcvDQo+IFtkcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1z aWduaW5nLWZvci1oYXNdDQo+IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0 LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25pbmctZm9yLQ0KPiBoYXMvDQo+IFttaW51dGVzLTkz LWNkbmldIGh0dHBzOi8vd3d3LmlldGYub3JnL3Byb2NlZWRpbmdzLzkzL21pbnV0ZXMvbWludXRl cy05My0NCj4gY2RuaQ0KPiBbbWludXRlcy05NC1jZG5pXSBodHRwczovL3d3dy5pZXRmLm9yZy9w cm9jZWVkaW5ncy85NC9taW51dGVzL21pbnV0ZXMtOTQtDQo+IGNkbmkNCj4gDQo+ID4gLS0tLS1P cmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gPiBGcm9tOiBLZXZpbiBNYSBKDQo+ID4gU2VudDogVHVl c2RheSwgRGVjZW1iZXIgMTUsIDIwMTUgMTI6MzMgUE0NCj4gPiBUbzogJ0JlbiBOaXZlbi1KZW5r aW5zJw0KPiA+IENjOiBjZG5pQGlldGYub3JnDQo+ID4gU3ViamVjdDogUkU6IFtDRE5pXSBSZXNw b25zZSB0byBMaWFpc29uIFN0YXRlbWVudCBvbiBVUkkgU2lnbmluZw0KPiA+DQo+ID4gSGkgQmVu LA0KPiA+DQo+ID4gICB3aWxsIGRvLg0KPiA+DQo+ID4gdGhhbnghDQo+ID4NCj4gPiAtLSAgS2V2 aW4gSi4gTWENCj4gPg0KPiA+ID4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gPiA+IEZy b206IEJlbiBOaXZlbi1KZW5raW5zIFttYWlsdG86YmVuQG5pdmVuLWplbmtpbnMuY28udWtdDQo+ ID4gPiBTZW50OiBUdWVzZGF5LCBEZWNlbWJlciAxNSwgMjAxNSAxMjoyOSBQTQ0KPiA+ID4gVG86 IEtldmluIE1hIEoNCj4gPiA+IENjOiBjZG5pQGlldGYub3JnDQo+ID4gPiBTdWJqZWN0OiBSZTog W0NETmldIFJlc3BvbnNlIHRvIExpYWlzb24gU3RhdGVtZW50IG9uIFVSSSBTaWduaW5nDQo+ID4g Pg0KPiA+ID4gS2V2aW4sDQo+ID4gPg0KPiA+ID4gTG9va3MgZmluZSB0byBtZS4NCj4gPiA+DQo+ ID4gPiBPbmx5IG1pbm9yIGNvbW1lbnQgSSBoYXZlOiBBdCB0aGUgZW5kIG9mIHRoZSAzcmQgcGFy YWdyYXBoIGluY2x1ZGUgYQ0KPiA+ID4gcmVmZXJlbmNlIHRvIFtkcmFmdC1pZXRmLWNkbmktdXJp LXNpZ25pbmddIHRvIG1ha2UgcmVhbGx5IGNsZWFyIHdoaWNoDQo+ID4gPiBkb2N1bWVudCBpcyB0 aGUgIm1haW4gVVJJIHNpZ25pbmcgZHJhZnTigJ0uDQo+ID4gPg0KPiA+ID4gQmVuDQo+ID4gPg0K PiA+ID4gPiBPbiAxNCBEZWMgMjAxNSwgYXQgMjA6MDcsIEtldmluIE1hIEogPGtldmluLmoubWFA ZXJpY3Nzb24uY29tPg0KPiB3cm90ZToNCj4gPiA+ID4NCj4gPiA+ID4gSGkgQWxsLA0KPiA+ID4g Pg0KPiA+ID4gPiAgKGFzIGEgY2hhaXIpIEFzIHBlciB0aGUgT3BlbiBEaXNjdXNzaW9uIGFjdGlv biBpdGVtIGZyb20gWW9rb2hhbWENCj4gPiBbMV0sDQo+ID4gPiB0aGUgY2hhaXJzIGhhdmUgd29y a2VkIHdpdGggUmF5IHRvIGRyYWZ0IGEgcmVzcG9uc2UgdG8gdGhlIE1QRUcNCj4gbGlhaXNvbg0K PiA+ID4gc3RhdGVtZW50IG9uIFVSSSBTaWduaW5nIFsyXS4gIFBsZWFzZSBmaW5kIHRoZSByZXNw b25zZSBiZWxvdywgYW5kDQo+IGZlZWwNCj4gPiA+IGZyZWUgdG8gc2VuZCBjb21tZW50cyB0byB0 aGUgbGlzdC4gIElmIHRoZXJlIGFyZSBubyBvYmplY3Rpb25zIG9yDQo+ID4gPiB1bmFkZHJlc3Nl ZCBjb21tZW50cyBieSBEZWNlbWJlciAzMHRoLCB3ZSB3aWxsIHNlbmQgdGhlIG9mZmljaWFsDQo+ ID4gcmVzcG9uc2UNCj4gPiA+IHRvIE1QRUcuDQo+ID4gPiA+DQo+ID4gPiA+IHRoYW54IQ0KPiA+ ID4gPg0KPiA+ID4gPiAtLSAgS2V2aW4gSi4gTWENCj4gPiA+ID4NCj4gPiA+ID4gWzFdIGh0dHBz Oi8vd3d3LmlldGYub3JnL3Byb2NlZWRpbmdzLzk0L21pbnV0ZXMvbWludXRlcy05NC1jZG5pDQo+ ID4gPiA+IFsyXSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2xpYWlzb24vMTQzNC8NCj4g PiA+ID4NCj4gPiA+ID4gLS0tLS0NCj4gPiA+ID4NCj4gPiA+ID4gRnJvbTogS2V2aW4gSi4gTWEN Cj4gPiA+ID4+IEZyb20gR3JvdXA6IENETkkNCj4gPiA+ID4gVG86IFdhdGFuYWJlIFNoaW5qaSA8 d2F0YW5hYmVAaXRzY2ouaXBzai5vci5qcD4NCj4gPiA+ID4gVG8gR3JvdXA6IElTTy1JRUMtSlRD MS1TQzI5DQo+ID4gPiA+IFRpdGxlOiBSZXNwb25zZSB0byByZXF1ZXN0IGZvciBpbmZvcm1hdGlv biBvbiBVUkkgU2lnbmluZyAyMDE1LTExLTAyDQo+ID4gPiA+IFJlc3BvbnNlIENvbnRhY3Q6IEtl dmluIEouIE1hIDxrZXZpbi5qLm1hQGVyaWNzc29uLmNvbT4NCj4gPiA+ID4gVGVjaG5pY2FsIENv bnRhY3Q6IFJheSB2YW4gQnJhbmRlbmJ1cmcgPHJheS52YW5icmFuZGVuYnVyZ0B0bm8ubmw+DQo+ ID4gPiA+IFB1cnBvc2U6IEluIFJlc3BvbnNlDQo+ID4gPiA+IEJvZHk6DQo+ID4gPiA+DQo+ID4g PiA+IFRoZSBJRVRGIENETkkgd29ya2luZyBncm91cCB3b3VsZCBsaWtlIHRvIGFja25vd2xlZGdl IG91ciByZWNlaXB0IG9mDQo+ID4gdGhlDQo+ID4gPiBNUEVHIGV4cGVydHMgbGlhaXNvbiBsZXR0 ZXIgYW5kIGNhcmVmdWwgY29uc2lkZXJhdGlvbiBkdXJpbmcgdGhlIDk0dGgNCj4gPiBJRVRGDQo+ ID4gPiBtZWV0aW5nLg0KPiA+ID4gPg0KPiA+ID4gPiBIYXZpbmcgcmV2aWV3ZWQgdGhlIE9ubGlu ZSBNdWx0aW1lZGlhIEF1dGhvcml6YXRpb24gUHJvdG9jb2wgVmVyc2lvbg0KPiA+IDEuMA0KPiA+ ID4gKE9NQVB2MSkgc3BlY2lmaWNhdGlvbiBbMjAxMl8wOV8yOF9PQVRDLU9NQVBfMS0wXSwgd2Ug dW5kZXJzdGFuZCB0aGUNCj4gPiA+IHByb3Bvc2VkIHNjb3BlIG9mIHVzYWdlIGZvciBDRE5JIFVS SSBTaWduaW5nIHRvIGJlIHRoZSBvbmx5IGFzIHRoZQ0KPiA+IEFjY2Vzcw0KPiA+ID4gVG9rZW4s IGFzIHJldHVybmVkIGJ5IHRoZSBhdXRob3JpemF0aW9uIHNlcnZlciBpbiBzdGVwIChFKSBvZiBz ZWN0aW9ucw0KPiA+IDIuMw0KPiA+ID4gYW5kIDIuNCBvZiB0aGUgT01BUHYxIHNwZWNpZmljYXRp b24sIHRvIGJlIHVzZSBzb2xlbHkgZm9yIGF1dGhvcml6aW5nDQo+ID4gPiByZXF1ZXN0cyB0byB0 aGUgcmVzb3VyY2Ugc2VydmVyIChpLmUuLCB0aGUgQ0ROKSwgYXMgZGVzY3JpYmVkIGluIHN0ZXBz DQo+ID4gKEYpDQo+ID4gPiBhbmQgKEcpIG9mIHNlY3Rpb25zIDIuMyBhbmQgMi40IG9mIHRoZSBP TUFQdjEgc3BlY2lmaWNhdGlvbi4gIFdlIGFncmVlDQo+ID4gPiB0aGF0IHRoaXMgaXMgYW4gZXhl bXBsYXJ5IHVzZSBjYXNlIGZvciBDRE5JIFVSSSBTaWduaW5nIHdpdGggdGhlIFBhdGgNCj4gPiA+ IFBhdHRlcm4gSW5mb3JtYXRpb24gRWxlbWVudC4NCj4gPiA+ID4NCj4gPiA+ID4gQXQgdGhlIDkz cmQgSUVURiwgdGhlIENETkkgd29ya2luZyBncm91cCBkZWNpZGVkIHRvIHJlbW92ZSB0ZXh0DQo+ ID4gcmVsYXRlZA0KPiA+ID4gdG8gc2lnbmluZyBvZiBzZWdtZW50ZWQgY29udGVudCBVUklzIGZy b20gdGhlIENETkkgVVJJIFNpZ25pbmcgZHJhZnQNCj4gPiA+IFtkcmFmdC1pZXRmLWNkbmktdXJp LXNpZ25pbmddIGluIHJlc3BvbnNlIHRvIGFuIElQUiBkaXNjbG9zdXJlIG1hZGUNCj4gPiBhZnRl cg0KPiA+ID4gdGhlIDkybmQgSUVURiBbbWludXRlcy05My1jZG5pXS4gVGhlIHJlbW92ZWQgc2Vj dGlvbnMgYXJlIGN1cnJlbnRseQ0KPiA+ID4gZG9jdW1lbnRlZCBpbiBhIHNlcGFyYXRlIGRyYWZ0 IFtkcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLQ0KPiBmb3ItDQo+ID4gPiBoYXNd LCBhcyBhbiBleHRlbnNpb24gdG8gdGhlIG1haW4gVVJJIHNpZ25pbmcgZG9jdW1lbnQuIEl0IHNo b3VsZCBiZQ0KPiA+IG5vdGVkDQo+ID4gPiB0aGF0IGF0IHRoaXMgcG9pbnQsIHRoYXQgZG9jdW1l bnQgaXMgcmVnYXJkZWQgYXMgYW4gaW5kZXBlbmRlbnQNCj4gPiBzdWJtaXNzaW9uDQo+ID4gPiBh bmQgSUVURiBoYXMgbm90IG1hZGUgYSBkZWNpc2lvbiByZWdhcmRpbmcgaXRzIGZ1dHVyZSBzdGF0 dXMuIEF0IHRoZQ0KPiA+IDk0dGgNCj4gPiA+IElFVEYsIGl0IHdhcyBhZ3JlZWQgdGhhdCB0aGUg UGF0aCBQYXR0ZXJuIEluZm9ybWF0aW9uIGVsZW1lbnQgd2FzIG5vdA0KPiA+ID4gY292ZXJlZCBi eSB0aGUgSVBSIGRpc2Nsb3N1cmUgYW5kIHdvdWxkIGJlIGEgdXNlZnVsIGZlYXR1cmUgZm9yIGEN Cj4gbnVtYmVyDQo+ID4gPiBvZiBVUkkgU2lnbmluZyB1c2UgY2FzZXMsIGluY2x1ZGluZyBzZWdt ZW50ZWQgY29udGVudCBbbWludXRlcy05NC0NCj4gY2RuaV0uDQo+ID4gPiBQYXRoIFBhdHRlcm4g c3VwcG9ydCB3aWxsIGJlIHJlaW5zdGF0ZWQgaW4gYSBmdXR1cmUgcmV2aXNpb24gb2YgdGhlDQo+ IG1haW4NCj4gPiA+IFVSSSBzaWduaW5nIGRyYWZ0Lg0KPiA+ID4gPg0KPiA+ID4gPiBXaXRoIHJl c3BlY3QgdG8gbG9uZy1saXZlZCB0b2tlbnMsIGFzIG1lbnRpb25lZCBpbiB0aGUgU2VjdXJpdHkN Cj4gPiA+IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gKDkpIG9mIHRoZSBDRE5JIFVSSSBTaWduaW5n IGRyYWZ0LCBpbmNyZWFzaW5nDQo+IHRoZQ0KPiA+ID4gdG9rZW4gdmFsaWRpdHkgcGVyaW9kIGlu Y3JlYXNlcyB0aGUgcG90ZW50aWFsIGZvciByZXBsYXkgYXR0YWNrcywNCj4gPiA+IGluY2x1ZGlu ZyBEb1MgYXR0YWNrczsgaG93ZXZlciwgbm90aGluZyBpbiB0aGUgcHJvdG9jb2wgcHJldmVudHMg dGhlDQo+IHVzZQ0KPiA+ID4gb2YgbG9uZy1saXZlZCB0b2tlbnMuDQo+ID4gPiA+DQo+ID4gPiA+ IFdpdGggcmVzcGVjdCB0byBDRE5zIHJlZnJlc2hpbmcgdG9rZW5zLCB0aGUgQ0ROSSB3b3JraW5n IGdyb3VwDQo+ID4gZGlzY3Vzc2VkDQo+ID4gPiBtZWNoYW5pc21zIGZvciBzaWduYWxpbmcgdG9r ZW4gcmVmcmVzaCBiZXR3ZWVuIENETnMgYW5kIGZlbHQgdGhhdCB0aGUNCj4gPiA+IHJlcXVpcmVk IGFkZGl0aW9uYWwgY29tcGxleGl0eSBvZiBzdWNoIGEgbWVjaGFuaXNtIG91dHdlaWdoZWQgdGhl IGNvc3QNCj4gPiBvZg0KPiA+ID4gcmVnZW5lcmF0aW5nIHRoZSB0b2tlbnMuIE5vdGU6IFNpZ25h bGluZyBiZXR3ZWVuIENETnMgYW5kIGNsaWVudHMgaXMNCj4gPiBvdXQtDQo+ID4gPiBvZi1zY29w ZSBmb3IgQ0ROSS4gQXMgbWVudGlvbmVkIGFib3ZlLCBjaGFpbmVkIHRva2VuIHN1cHBvcnQgd2Fz DQo+IHJlbW92ZWQNCj4gPiA+IGZyb20gdGhlIGN1cnJlbnQgQ0ROSSBVUkkgU2lnbmluZyBkcmFm dCBhbmQgdGhlcmUgaXMgbm8gcGxhbiB0bw0KPiA+IHJlaW5zdGF0ZQ0KPiA+ID4gaXQgaW4gdGhl IG1haW4gVVJJIHNpZ25pbmcgZG9jdW1lbnQgZHVlIHRvIElQUiBpc3N1ZXMuIEFzIHN1Y2gsIHRo ZQ0KPiA+IHRvcGljDQo+ID4gPiBvZiB0b2tlbiByZWdlbmVyYXRpb24gaXMgbGltaXRlZCB0byBb ZHJhZnQtYnJhbmRlbmJ1cmctY2RuaS11cmktDQo+IHNpZ25pbmctDQo+ID4gPiBmb3ItaGFzXS4N Cj4gPiA+ID4NCj4gPiA+ID4gV2l0aCByZXNwZWN0IHRvIG5hbWUgY29sbGlzaW9ucywgdGhlIGN1 cnJlbnQgdmVyc2lvbiBvZiB0aGUgQ0ROSSBVUkkNCj4gPiA+IFNpZ25pbmcgZHJhZnQgb25seSBz dXBwb3J0cyBxdWVyeS1zdHJpbmctYmFzZWQgY29udmV5YW5jZSBvZiB0aGUNCj4gdG9rZW4uDQo+ ID4gPiBUaGUgbWV0YWRhdGEgZWxlbWVudCAicGFja2FnZS1hdHRyaWJ1dGUiIHdhcyBpbnRyb2R1 Y2VkIHRvIGFsbG93DQo+IGNvbnRlbnQNCj4gPiA+IHNlcnZpY2UgcHJvdmlkZXJzIChDU1BzKSB0 byBzZWxlY3QgYW55IHF1ZXJ5IHN0cmluZyBwYXJhbWV0ZXIgbmFtZQ0KPiB0aGV5DQo+ID4gPiB3 YW50ZWQsIGFzc3VtaW5nIHRoYXQgQ1NQcyB3b3VsZCBiZSBpbiB0aGUgYmVzdCBwb3NpdGlvbiB0 byBzZWxlY3QgYQ0KPiA+IGxvdy0NCj4gPiA+IGNvbGxpc2lvbi1wcm9iYWJpbGl0eSBuYW1lOyBV UklTaWduaW5nUGFja2FnZSBpcyBvbmx5IHRoZSBkZWZhdWx0DQo+IG5hbWUuDQo+ID4gPiA+DQo+ ID4gPiA+IFdpdGggcmVzcGVjdCB0byBjb25zZWN1dGl2ZSB0b2tlbnMsIHRoZSBDRE5JIFVSSSBT aWduaW5nIG1lY2hhbmlzbQ0KPiB3YXMNCj4gPiA+IGRlc2lnbmVkIHRvIGJlIHN0YXRlbGVzcywg c28gdGhhdCBjb25zZWN1dGl2ZSB0b2tlbnMgY2FuIGJlIHJldHJpZXZlZA0KPiA+IGZyb20NCj4g PiA+IGRpZmZlcmVudCBkZWxpdmVyeSBub2Rlcy4gQXMgc3VjaCwgdGhlcmUgaXMgbm8gcmVsYXRp b25zaGlwIGJldHdlZW4NCj4gPiA+IGNvbnNlY3V0aXZlIHRva2VucyBhbmQgdG9rZW4gaW52YWxp ZGF0aW9uIGlzIHNvbGVseSBiYXNlZCBvbiB0aGUNCj4gRXhwaXJ5DQo+ID4gPiBUaW1lIGluZm9y bWF0aW9uIGVsZW1lbnQuDQo+ID4gPiA+DQo+ID4gPiA+IFRoZSBDRE5JIHdvcmtpbmcgZ3JvdXAg YXBwcmVjaWF0ZXMgdGhlIE1QRUcgZXhwZXJ0cycgdGhvdWdodGZ1bA0KPiBpbnB1dA0KPiA+ID4g YW5kIGxvb2tzIGZvcndhcmQgdG8gY29udGludWVkIGNvbGxhYm9yYXRpb24gd2l0aCBNUEVHIGV4 cGVydHMgb24gVVJJDQo+ID4gPiBTaWduaW5nLg0KPiA+ID4gPg0KPiA+ID4gPiBPdXIgbmV4dCBt ZWV0aW5nOiBJRVRGIDk1LCBBcHJpbCAzLTggMjAxNiwgQnVlbm9zIEFpcmVzLCBBcmdlbnRpbmEN Cj4gPiA+ID4NCj4gPiA+ID4gWzIwMTJfMDlfMjhfT0FUQy1PTUFQXzEtMF0NCj4gPiA+IGh0dHA6 Ly93d3cub2F0Yy51cy9Qb3J0YWxzL19kZWZhdWx0L0tub3dsZWRnZWJhc2UvMS8yMDEyXzA5XzI4 X09BVEMtDQo+ID4gPiBPTUFQXzEtMC5wZGYNCj4gPiA+ID4gW2RyYWZ0LWlldGYtY2RuaS11cmkt c2lnbmluZ10NCj4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtDQo+ID4g PiBpZXRmLWNkbmktdXJpLXNpZ25pbmcvDQo+ID4gPiA+IFtkcmFmdC1icmFuZGVuYnVyZy1jZG5p LXVyaS1zaWduaW5nLWZvci1oYXNdDQo+ID4gPiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2RvYy9kcmFmdC1icmFuZGVuYnVyZy1jZG5pLXVyaS1zaWduaW5nLQ0KPiBmb3ItDQo+ID4gPiBo YXMvDQo+ID4gPiA+IFttaW51dGVzLTkzLWNkbmldDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL3By b2NlZWRpbmdzLzkzL21pbnV0ZXMvbWludXRlcy0NCj4gPiA+IDkzLWNkbmkNCj4gPiA+ID4gW21p bnV0ZXMtOTQtY2RuaV0NCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcHJvY2VlZGluZ3MvOTQvbWlu dXRlcy9taW51dGVzLQ0KPiA+ID4gOTQtY2RuaQ0KPiA+ID4gPg0KPiA+ID4gPg0KPiA+ID4gPg0K PiA+ID4gPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K PiA+ID4gPiBDRE5pIG1haWxpbmcgbGlzdA0KPiA+ID4gPiBDRE5pQGlldGYub3JnDQo+ID4gPiA+ IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaQ0KDQo= From nobody Wed Dec 30 22:39:42 2015 Return-Path: X-Original-To: cdni@ietf.org Delivered-To: cdni@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 015E31A86E2; Wed, 30 Dec 2015 22:39:41 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Liaison Statement Management Tool To: "Watanabe Shinji" X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151231063940.24976.55306.idtracker@ietfa.amsl.com> Date: Wed, 30 Dec 2015 22:39:40 -0800 Archived-At: Cc: Ben Campbell , Stephan Wenger , Content Delivery Networks Interconnection Discussion List , Barry Leiba Subject: [CDNi] New Liaison Statement, "Response to request for information on URI Signing 2015-11-02" X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2015 06:39:41 -0000 Title: Response to request for information on URI Signing 2015-11-02 Submission Date: 2015-12-30 URL of the IETF Web page: https://datatracker.ietf.org/liaison/1450/ From: "Kevin J. Ma" To: Watanabe Shinji Cc: Barry Leiba ,Ben Campbell ,Content Delivery Networks Interconnection Discussion List ,Alissa Cooper ,Francois Le Faucheur ,Kevin Ma ,Stephan Wenger , Response Contacts: Kevin Ma ,Francois Le Faucheur Technical Contacts: Ray van Brandenburg Purpose: In response Referenced liaison: Liaison Statement to IETF on URI signing (https://datatracker.ietf.org/liaison/1434/) Body: The IETF CDNI working group would like to acknowledge our receipt of the MPEG experts liaison letter and careful consideration during the 94th IETF meeting. Having reviewed the Online Multimedia Authorization Protocol Version 1.0 (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the proposed scope of usage for CDNI URI Signing to be the only as the Access Token, as returned by the authorization server in step (E) of sections 2.3 and 2.4 of the OMAPv1 specification, to be use solely for authorizing requests to the resource server (i.e., the CDN), as described in steps (F) and (G) of sections 2.3 and 2.4 of the OMAPv1 specification. We agree that this is an exemplary use case for CDNI URI Signing with the Path Pattern Information Element. At the 93rd IETF, the CDNI working group decided to remove text related to signing of segmented content URIs from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd IETF [minutes-93-cdni]. The removed sections are currently documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. It should be noted that at this point, that document is regarded as an individual submission and the CDNI working group has not made a decision regarding its future status. At the 94th IETF, it was agreed that the Path Pattern Information element was not covered by the IPR disclosure and would be a useful feature for a number of URI Signing use cases, including segmented content [minutes-94-cdni]. Path Pattern support will be reinstated in a future revision of the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. With respect to long-lived tokens, as mentioned in the Security Considerations section (9) of the CDNI URI Signing draft, increasing the token validity period increases the potential for replay attacks, including DoS attacks; however, nothing in the protocol prevents the use of long-lived tokens. With respect to CDNs refreshing tokens, the CDNI working group discussed mechanisms for signaling token refresh between CDNs and felt that the required additional complexity of such a mechanism outweighed the cost of regenerating the tokens. Note: Signaling between CDNs and clients is out-of-scope for CDNI. As mentioned above, chained token support was removed from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] and there is no plan to reinstate it in the CDNI URI signing draft [draft-ietf-cdni-uri-signing] due to IPR issues. As such, the topic of token regeneration is limited to the extension draft [draft-brandenburg-cdni-uri-signing-for-has]. With respect to name collisions, the current version of the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] only supports query-string-based conveyance of the token. The metadata element "package-attribute" was introduced to allow content service providers (CSPs) to select any query string parameter name they wanted, assuming that CSPs would be in the best position to select a low-collision-probability name; URISigningPackage is only the default name. With respect to consecutive tokens, the CDNI URI Signing mechanism was designed to be stateless, so that consecutive tokens can be retrieved from different delivery nodes. As such, there is no relationship between consecutive tokens and token invalidation is solely based on the Expiry Time information element. The CDNI working group appreciates the MPEG experts' thoughtful input and looks forward to continued collaboration with MPEG experts on URI Signing. Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina [2012_09_28_OATC-OMAP_1-0] http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-OMAP_1-0.pdf [draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ [draft-brandenburg-cdni-uri-signing-for-has] https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-has/ [minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-93-cdni [minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni Attachments: No document has been attached From nobody Thu Dec 31 01:27:46 2015 Return-Path: X-Original-To: cdni@ietf.org Delivered-To: cdni@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B92B1A1A3B; Thu, 31 Dec 2015 01:27:44 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151231092744.20028.72498.idtracker@ietfa.amsl.com> Date: Thu, 31 Dec 2015 01:27:44 -0800 Archived-At: Cc: cdni@ietf.org Subject: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-06.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2015 09:27:44 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Content Delivery Networks Interconnection Working Group of the IETF. Title : URI Signing for CDN Interconnection (CDNI) Authors : Kent Leung Francois Le Faucheur Ray van Brandenburg Bill Downey Michel Fisher Filename : draft-ietf-cdni-uri-signing-06.txt Pages : 42 Date : 2015-12-31 Abstract: This document describes how the concept of URI signing supports the content access control requirements of CDNI and proposes a URI signing scheme. The proposed URI signing method specifies the information needed to be included in the URI and the algorithm used to authorize and to validate access requests for the content referenced by the URI. The mechanism described can be used both in CDNI and single CDN scenarios. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-cdni-uri-signing-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Dec 31 01:49:14 2015 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0431A1A76 for ; Thu, 31 Dec 2015 01:49:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.585 X-Spam-Level: X-Spam-Status: No, score=0.585 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5HiBxku83YqA for ; Thu, 31 Dec 2015 01:49:10 -0800 (PST) Received: from fromintouta.tno.nl (fromintouta.tno.nl [134.221.1.26]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2D2C1A1A70 for ; Thu, 31 Dec 2015 01:49:09 -0800 (PST) X-IronPort-AV: E=Sophos; i="5.20,503,1444687200"; d="scan'208,217"; a="54745880" Received: from exc-cashub03.tsn.tno.nl (HELO mail.tno.nl) ([134.221.225.222]) by mailhost1a.tno.nl with ESMTP; 31 Dec 2015 10:49:07 +0100 Received: from EXC-MBX03.tsn.tno.nl ([fe80::e969:1300:fb9f:7e12]) by EXC-CASHUB03.tsn.tno.nl ([fe80::6d39:f277:173e:a926%13]) with mapi id 14.03.0248.002; Thu, 31 Dec 2015 10:49:07 +0100 From: "Brandenburg, R. (Ray) van" To: "cdni@ietf.org" Thread-Topic: Updated version of draft-ietf-cdni-uri-signing Thread-Index: AQHRQ7B9CgPkKQP4nEKF6dESlsMw9A== Date: Thu, 31 Dec 2015 09:49:07 +0000 Message-ID: <197C25E3-DFCF-4320-9283-88E28615E0AF@tno.nl> Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.151217 x-originating-ip: [134.221.225.191] x-esetresult: clean, is OK x-esetid: 37303A29F3684861617665 Content-Type: multipart/alternative; boundary="_000_197C25E3DFCF4320928388E28615E0AFtnonl_" MIME-Version: 1.0 Archived-At: Subject: [CDNi] Updated version of draft-ietf-cdni-uri-signing X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2015 09:49:13 -0000 --_000_197C25E3DFCF4320928388E28615E0AFtnonl_ Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGkgYWxsLA0KDQpJJ3ZlIGp1c3QgdXBsb2FkZWQgYSBuZXcgdmVyc2lvbiBvZiBkcmFmdC1pZXRm LWNkbmktdXJpLXNpZ25pbmcgKC0wNikuIFRoaXMgdmVyc2lvbiBhZGRyZXNzZXMgbW9zdCBvZiB0 aGUgY29tbWVudHMgcmVjZWl2ZWQgb3ZlciB0aGUgcGFzdCB0d28gbW9udGhzLCBpbmNsdWRpbmcg TGVpZidzIGV4dGVuc2l2ZSByZXZpZXcuDQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMDYNCg0KRGlmZjogaHR0cHM6Ly93d3cuaWV0Zi5v cmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0wNg0KDQpXaGlsZSB0 aGUgbmV3IHZlcnNpb24gaW5jbHVkZXMgYSBsb3Qgb2YgY2hhbmdlcyB0byBub3JtYXRpdmUgc2Vj dGlvbnMsIEkgd291bGQgbGlrZSB0byBicmllZmx5IGFkZHJlc3MgdGhlIHR3byBtb3N0IGltcG9y dGFudCBvbmVzOg0KLSBJbmNsdXNpb24gb2YgdGhlIFVSSSBQYXR0ZXJuIGluZm9ybWF0aW9uIGVs ZW1lbnQ6IGR1cmluZyB0aGUgWW9rb2hhbWEgbWVldGluZyBpdCB3YXMgZGVjaWRlZCB0aGF0IHRo ZSBQYXRoIFBhdHRlcm4gaW5mb3JtYXRpb24gZWxlbWVudCBmcm9tIGRyYWZ0LWJyYW5kZW5idXJn LWNkbmktdXJpLXNpZ25pbmctZm9yLWhhcyBzaG91bGQgYmUgYnJvdWdodCBpbnRvIHRoaXMgZG9j dW1lbnQuIER1cmluZyB0aGlzIHByb2Nlc3MsIHdlJ3ZlIGZsZXNoZWQgb3V0IHRoZSBwYXR0ZXJu IG1lY2hhbmlzbSBhIGxpdHRsZSBiaXQgc28gdGhhdCBpdCBwcm92aWRlcyBmb3IgbW9yZSBmbGV4 aWJpbGl0eSwgbW9zdCBub3RhYmx5IHRoZSBhYmlsaXR5IHRvIHBhdHRlcm4gYWxsIFVSSSBjb21w b25lbnRzIGFuZCBub3QganVzdCB0aGUgcGF0aC4gQmVjYXVzZSBvZiB0aGlzLCBpdCB3YXMgYWxz byByZW5hbWVkIHRvIFVSSSBQYXR0ZXJuLiBOb3RlIHRoYXQgZm9yIG5vdyB3ZSd2ZSBkZWNpZGVk IHRvIG5vdCBnbyBmb3IgYSBmdWxsIHJlZ2V4IGJ1dCBmb3IgYSBzbGlnaHRseSBzaW1wbGVyIG1l Y2hhbmlzbSB0aGF0IHNob3VsZCBiZSBsZXNzIGNvbXBsZXggd2hpbGUgaG9wZWZ1bGx5IHN0aWxs IHByb3ZpZGluZyBlbm91Z2ggZmxleGliaWxpdHkuIEkgd291bGQgbGlrZSB0byBzb2xpY2l0IHNv bWUgY29tbWVudHMgb24gdGhpcyBkZWNpc2lvbi4gT2YgY291cnNlLCBzaG91bGQgdGhlIFdHIGRl Y2lkZSB0aGF0IHdlIHNob3VsZCBnbyBmb3IgYSBmdWxsIHJlZ2V4IGluc3RlYWQsIHRoaXMgc2hv dWxkIGJlIGEgcmVsYXRpdmVseSBlYXN5IGVkaXQuDQotIE1hbmRhdG9yeSBlbmNyeXB0aW9uIG9m IHRoZSBDbGllbnQgSVAgaW5mb3JtYXRpb24gZWxlbWVudC4gRHVyaW5nIHRoZSBJRVNHIHJldmll dyBvZiBkcmFmdC1pZXRmLWNkbmktbG9nZ2luZywgd2UgaGFkIGEgbG9uZyBkaXNjdXNzaW9uIGFy b3VuZCBsb2dnaW5nIG9mIGNsaWVudCBJUCBhZGRyZXNzZXMuIEdpdmVuIHRoYXQgdGhlIFVSSSBT aWduaW5nIGFsZ29yaXRobSAob3B0aW9uYWxseSkgYWxsb3dzIGZvciB0aGUgQ2xpZW50IElQIHRv IGJlIHBsYWNlZCBpbiB0aGUgU2lnbmVkIFVSSSwgdGhpcyB3b3VsZCAgbWVhbiB0aGF0IHRoZSBD bGllbnQgSVAgaXMgbG9nZ2VkIHRocm91Z2ggdGhlIFVSSSBsb2cgZmllbGQgYXMgd2VsbC4gR2l2 ZW4gdGhlIG9waW5pb25zIG9mIHRoZSBJRVNHLCB3ZSd2ZSBkZWNpZGVkIHRvIG1ha2UgZW5jcnlw dGlvbiBvZiB0aGUgQ2xpZW50IElQIGluIHRoZSBTaWduZWQgVVJJIG1hbmRhdG9yeS4gQWx0aG91 Z2ggdGhpcyBkb2VzIG1ha2UgdGhlIGFsZ29yaXRobSBzbGlnaHRseSBtb3JlIGNvbXBsZXgsIHdl IGRpZG4ndCBzZWUgYW55IHdheSBhcm91bmQgaXQuDQoNCldlJ3ZlIHlldCB0byBhZGRyZXNzIHNv bWUgb2YgdGhlIGNvbW1lbnRzIG9uIHRoZSBpbmZvcm1hdGl2ZSBzZWN0aW9ucywgaG93ZXZlciwg Z2l2ZW4gdGhhdCB0aGlzIGlzIGEgcHJldHR5IHNpZ25pZmljYW50IHJld3JpdGUgb2YgdGhlIG5v cm1hdGl2ZSBhc3BlY3RzIG9mIHRoZSBkcmFmdCwgd2UndmUgY2hvc2VuIHRvIHVwbG9hZCB0aGlz IHZlcnNpb24gaW5zdGVhZCBvZiB3YWl0aW5nIGZvciB0aGUgaW5mb3JtYXRpdmUgc2VjdGlvbnMg dG8gYmUgZmluaXNoZWQgYXMgd2VsbCBzbyB0aGF0IHBlb3BsZSBjYW4gY29tbWVudCBvbiB0aGUg YWxnb3JpdGhtIGl0c2VsZi4NCg0KQW55IGNvbW1lbnRzIGFyZSBncmVhdGx5IGFwcHJlY2lhdGVk Lg0KDQpCZXN0IHJlZ2FyZHMsDQoNClJheQ0KVGhpcyBtZXNzYWdlIG1heSBjb250YWluIGluZm9y bWF0aW9uIHRoYXQgaXMgbm90IGludGVuZGVkIGZvciB5b3UuIElmIHlvdSBhcmUgbm90IHRoZSBh ZGRyZXNzZWUgb3IgaWYgdGhpcyBtZXNzYWdlIHdhcyBzZW50IHRvIHlvdSBieSBtaXN0YWtlLCB5 b3UgYXJlIHJlcXVlc3RlZCB0byBpbmZvcm0gdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoZSBtZXNz YWdlLiBUTk8gYWNjZXB0cyBubyBsaWFiaWxpdHkgZm9yIHRoZSBjb250ZW50IG9mIHRoaXMgZS1t YWlsLCBmb3IgdGhlIG1hbm5lciBpbiB3aGljaCB5b3UgdXNlIGl0IGFuZCBmb3IgZGFtYWdlIG9m IGFueSBraW5kIHJlc3VsdGluZyBmcm9tIHRoZSByaXNrcyBpbmhlcmVudCB0byB0aGUgZWxlY3Ry b25pYyB0cmFuc21pc3Npb24gb2YgbWVzc2FnZXMuCg== --_000_197C25E3DFCF4320928388E28615E0AFtnonl_ Content-Type: text/html; charset="utf-8" Content-ID: <08BE773EC6732A4ABD81B3756F6B50F7@tno.nl> MIME-Version: 1.0 Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJy ZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsgY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1zaXplOiAx NHB4OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsiPg0KPGRpdj5IaSBhbGwsPC9k aXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5JJ3ZlIGp1c3QgdXBsb2FkZWQgYSBuZXcgdmVy c2lvbiBvZiBkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmcgKC0wNikuIFRoaXMgdmVyc2lvbiBh ZGRyZXNzZXMgbW9zdCBvZiB0aGUgY29tbWVudHMgcmVjZWl2ZWQgb3ZlciB0aGUgcGFzdCB0d28g bW9udGhzLCBpbmNsdWRpbmcgTGVpZidzIGV4dGVuc2l2ZSByZXZpZXcuJm5ic3A7PC9kaXY+DQo8 ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLTA2IiBzdHlsZT0iZm9udC1mYW1pbHk6IC13 ZWJraXQtc3RhbmRhcmQ7Ij5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1j ZG5pLXVyaS1zaWduaW5nLTA2PC9hPjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+RGlm ZjombmJzcDs8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQt aWV0Zi1jZG5pLXVyaS1zaWduaW5nLTA2IiBzdHlsZT0iZm9udC1mYW1pbHk6IC13ZWJraXQtc3Rh bmRhcmQ7Ij5odHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0Zi1jZG5p LXVyaS1zaWduaW5nLTA2PC9hPjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+V2hpbGUg dGhlIG5ldyB2ZXJzaW9uIGluY2x1ZGVzIGEgbG90IG9mIGNoYW5nZXMgdG8gbm9ybWF0aXZlIHNl Y3Rpb25zLCBJIHdvdWxkIGxpa2UgdG8gYnJpZWZseSBhZGRyZXNzIHRoZSB0d28gbW9zdCBpbXBv cnRhbnQgb25lczo8L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9IkFwcGxlLXRhYi1zcGFuIiBzdHls ZT0id2hpdGUtc3BhY2U6cHJlIj48L3NwYW4+LSBJbmNsdXNpb24gb2YgdGhlIFVSSSBQYXR0ZXJu IGluZm9ybWF0aW9uIGVsZW1lbnQ6IGR1cmluZyB0aGUgWW9rb2hhbWEgbWVldGluZyBpdCB3YXMg ZGVjaWRlZCB0aGF0IHRoZSBQYXRoIFBhdHRlcm4gaW5mb3JtYXRpb24gZWxlbWVudCBmcm9tIGRy YWZ0LWJyYW5kZW5idXJnLWNkbmktdXJpLXNpZ25pbmctZm9yLWhhcyBzaG91bGQNCiBiZSBicm91 Z2h0IGludG8gdGhpcyBkb2N1bWVudC4gRHVyaW5nIHRoaXMgcHJvY2Vzcywgd2UndmUgZmxlc2hl ZCBvdXQgdGhlIHBhdHRlcm4gbWVjaGFuaXNtIGEgbGl0dGxlIGJpdCBzbyB0aGF0IGl0IHByb3Zp ZGVzIGZvciBtb3JlIGZsZXhpYmlsaXR5LCBtb3N0IG5vdGFibHkgdGhlIGFiaWxpdHkgdG8gcGF0 dGVybiBhbGwgVVJJIGNvbXBvbmVudHMgYW5kIG5vdCBqdXN0IHRoZSBwYXRoLiBCZWNhdXNlIG9m IHRoaXMsIGl0IHdhcyBhbHNvIHJlbmFtZWQNCiB0byBVUkkgUGF0dGVybi4gTm90ZSB0aGF0IGZv ciBub3cgd2UndmUgZGVjaWRlZCB0byBub3QgZ28gZm9yIGEgZnVsbCByZWdleCBidXQgZm9yIGEg c2xpZ2h0bHkgc2ltcGxlciBtZWNoYW5pc20gdGhhdCBzaG91bGQgYmUgbGVzcyBjb21wbGV4IHdo aWxlIGhvcGVmdWxseSBzdGlsbCBwcm92aWRpbmcgZW5vdWdoIGZsZXhpYmlsaXR5LiBJIHdvdWxk IGxpa2UgdG8gc29saWNpdCBzb21lIGNvbW1lbnRzIG9uIHRoaXMgZGVjaXNpb24uIE9mIGNvdXJz ZSwNCiBzaG91bGQgdGhlIFdHIGRlY2lkZSB0aGF0IHdlIHNob3VsZCBnbyBmb3IgYSBmdWxsIHJl Z2V4IGluc3RlYWQsIHRoaXMgc2hvdWxkIGJlIGEgcmVsYXRpdmVseSBlYXN5IGVkaXQuJm5ic3A7 PC9kaXY+DQo8ZGl2PjxzcGFuIGNsYXNzPSJBcHBsZS10YWItc3BhbiIgc3R5bGU9IndoaXRlLXNw YWNlOnByZSI+PC9zcGFuPi0gTWFuZGF0b3J5IGVuY3J5cHRpb24gb2YgdGhlIENsaWVudCBJUCBp bmZvcm1hdGlvbiBlbGVtZW50LiBEdXJpbmcgdGhlIElFU0cgcmV2aWV3IG9mIGRyYWZ0LWlldGYt Y2RuaS1sb2dnaW5nLCB3ZSBoYWQgYSBsb25nIGRpc2N1c3Npb24gYXJvdW5kIGxvZ2dpbmcgb2Yg Y2xpZW50IElQIGFkZHJlc3Nlcy4gR2l2ZW4gdGhhdCB0aGUgVVJJDQogU2lnbmluZyBhbGdvcml0 aG0gKG9wdGlvbmFsbHkpIGFsbG93cyBmb3IgdGhlIENsaWVudCBJUCB0byBiZSBwbGFjZWQgaW4g dGhlIFNpZ25lZCBVUkksIHRoaXMgd291bGQgJm5ic3A7bWVhbiB0aGF0IHRoZSBDbGllbnQgSVAg aXMgbG9nZ2VkIHRocm91Z2ggdGhlIFVSSSBsb2cgZmllbGQgYXMgd2VsbC4gR2l2ZW4gdGhlIG9w aW5pb25zIG9mIHRoZSBJRVNHLCB3ZSd2ZSBkZWNpZGVkIHRvIG1ha2UgZW5jcnlwdGlvbiBvZiB0 aGUgQ2xpZW50IElQIGluIHRoZQ0KIFNpZ25lZCBVUkkgbWFuZGF0b3J5LiBBbHRob3VnaCB0aGlz IGRvZXMgbWFrZSB0aGUgYWxnb3JpdGhtIHNsaWdodGx5IG1vcmUgY29tcGxleCwgd2UgZGlkbid0 IHNlZSBhbnkgd2F5IGFyb3VuZCBpdC48L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2Pldl J3ZlIHlldCB0byBhZGRyZXNzIHNvbWUgb2YgdGhlIGNvbW1lbnRzIG9uIHRoZSBpbmZvcm1hdGl2 ZSBzZWN0aW9ucywgaG93ZXZlciwgZ2l2ZW4gdGhhdCB0aGlzIGlzIGEgcHJldHR5IHNpZ25pZmlj YW50IHJld3JpdGUgb2YgdGhlIG5vcm1hdGl2ZSBhc3BlY3RzIG9mIHRoZSBkcmFmdCwgd2UndmUg Y2hvc2VuIHRvIHVwbG9hZCB0aGlzIHZlcnNpb24gaW5zdGVhZCBvZiB3YWl0aW5nIGZvciB0aGUg aW5mb3JtYXRpdmUgc2VjdGlvbnMgdG8NCiBiZSBmaW5pc2hlZCBhcyB3ZWxsIHNvIHRoYXQgcGVv cGxlIGNhbiBjb21tZW50IG9uIHRoZSBhbGdvcml0aG0gaXRzZWxmLiZuYnNwOzwvZGl2Pg0KPGRp dj48YnI+DQo8L2Rpdj4NCjxkaXY+QW55IGNvbW1lbnRzIGFyZSBncmVhdGx5IGFwcHJlY2lhdGVk LjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+QmVzdCByZWdhcmRzLDwvZGl2Pg0KPGRp dj48YnI+DQo8L2Rpdj4NCjxkaXY+UmF5PC9kaXY+DQo8ZGl2Pg0KPGRpdiBpZD0iTUFDX09VVExP T0tfU0lHTkFUVVJFIj48L2Rpdj4NCjwvZGl2Pg0KPHAgc3R5bGU9Ik1BUkdJTjogMGNtIDBjbSAw cHQiIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJGT05ULUZBTUlMWTogJ0FyaWFsJywn c2Fucy1zZXJpZic7IEZPTlQtU0laRTogOHB0OyBtc28tYmlkaS1mb250LWZhbWlseTogJ1RpbWVz IE5ldyBSb21hbic7IG1zby1iaWRpLWZvbnQtc2l6ZTogMTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+PGZvbnQgc3R5bGU9IkZPTlQtU0laRTogMTFweCIgc2l6ZT0iMyI+DQo8L2Zv bnQ+PHAgc3R5bGU9Ik1BUkdJTjogMGNtIDBjbSAwcHQiIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250 IHN0eWxlPSJGT05ULVNJWkU6IDExcHgiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJGT05ULUZBTUlM WTogJ0FyaWFsJywnc2Fucy1zZXJpZic7IEZPTlQtU0laRTogOHB0OyBtc28tYmlkaS1mb250LXNp emU6IDguNXB0Ij5UaGlzIG1lc3NhZ2UgbWF5IGNvbnRhaW4gaW5mb3JtYXRpb24gdGhhdCBpcyBu b3QgaW50ZW5kZWQgZm9yIHlvdS4gSWYgeW91IGFyZSBub3QgdGhlIGFkZHJlc3NlZSBvciBpZiB0 aGlzIG1lc3NhZ2Ugd2FzIHNlbnQgdG8geW91IGJ5IG1pc3Rha2UsIHlvdSBhcmUgcmVxdWVzdGVk IHRvIGluZm9ybSB0aGUgc2VuZGVyIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UuIFROTyBhY2NlcHRz IG5vIGxpYWJpbGl0eSBmb3IgdGhlIGNvbnRlbnQgb2YgdGhpcyBlLW1haWwsIGZvciB0aGUgbWFu bmVyIGluIHdoaWNoIHlvdSB1c2UgaXQgYW5kIGZvciBkYW1hZ2Ugb2YgYW55IGtpbmQgcmVzdWx0 aW5nIGZyb20gdGhlIHJpc2tzIGluaGVyZW50IHRvIHRoZSBlbGVjdHJvbmljIHRyYW5zbWlzc2lv biBvZiBtZXNzYWdlcy48YnI+PGJyPjwvc3Bhbj48L2ZvbnQ+PC9wPjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_197C25E3DFCF4320928388E28615E0AFtnonl_--