From nobody Mon Jul 3 04:59:08 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC9AF1315F4; Mon, 3 Jul 2017 04:59:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.399 X-Spam-Level: X-Spam-Status: No, score=-2.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.199, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CVlnIh6HLsKG; Mon, 3 Jul 2017 04:59:04 -0700 (PDT) Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9709C1315F2; Mon, 3 Jul 2017 04:59:04 -0700 (PDT) Received: by mail-wm0-x236.google.com with SMTP id f67so52359251wmh.1; Mon, 03 Jul 2017 04:59:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:from:date:message-id:subject:to; bh=n8JxPFWcOsu/+1jZr7vtmAjXfqsI903TM1bQI6u6VnE=; b=Nw6OA1kDtpDP1NHNQZ7YF0W4OZCwloR7SdIi4s1/oHK3VTgE66NWEcSZziK8g24IIK JJwxFGe9UFoA1cSWBsVLyVTOGPqJELO7YtyLeoO+ZAZaEHNKZ09vKuUWKbd0OoXzuPBc pKCsCZzdh6yNt5f/h+6QMVj4iTn8Gbl0qyTb9PXDsTUNUMkfDdpUC30A33j4KshYaVBb 9Xmg0+M9sh/+yKJ5g3/tMGTOiE/OeWwhPcAlPyqG/+354rFcb/LSLmTPjrM5Kqo/ZBM9 1MBegA2P4UrQtdXkFJyo748J0UORNEaeEgoIAy/lcYeAD5fG5ihkxloqKDZSI6FS4hyX EymQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:from:date:message-id:subject :to; bh=n8JxPFWcOsu/+1jZr7vtmAjXfqsI903TM1bQI6u6VnE=; b=EIKAYWZWqiJqGv90/u5CVjCE2VziSF/TUo+dryjva7qt8DYBe9Xz986VUz9s2zc8IK rHtAQD8vdE7CDjeWZyBpe/3DtfP1QNx5LtMfXZMQYD5WzGu6vx6b+lnzbdzCyFft8+FJ X5CleReWPX1wVB9CaxMML89nd1wo9rP4CGKmc8zYQ61YbuUz/1zn948ma1lPQohbJcRb Q3/b3r7Wkm/c0zVqbHOc5RV2eYenBqx837xm/5Z02f5N4udQfj97KHMnGXEbCL6U2SUJ jCgoTZ7BvIgbtdasD5Bz2DQSuYbNeWeYTerC0lXIxIivyywZAOgtG5/VVOc3BqvOwi/N pjjQ== X-Gm-Message-State: AKS2vOwqTYB+Ax9Jji7/vMm8QumDhtvi8NH/RYU1bSPlfbsBK+5CrMPu JHWK/ds/NAmt4L1tWw1OgOlBQGb6JaK5 X-Received: by 10.28.127.21 with SMTP id a21mr22274601wmd.18.1499083143174; Mon, 03 Jul 2017 04:59:03 -0700 (PDT) MIME-Version: 1.0 Sender: yang.r.yang@gmail.com Received: by 10.28.71.89 with HTTP; Mon, 3 Jul 2017 04:59:02 -0700 (PDT) From: "Y. Richard Yang" Date: Mon, 3 Jul 2017 19:59:02 +0800 X-Google-Sender-Auth: 3ivHpHAr004hC5k1DeLwxFfwFHM Message-ID: To: Jan Seedorf , Jon Peterson , Kevin Ma J , "cdni@ietf.org" , IETF ALTO Content-Type: multipart/alternative; boundary="001a1141fdce3cea330553687e42" Archived-At: Subject: [CDNi] fci alto transport design discussion X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 11:59:07 -0000 --001a1141fdce3cea330553687e42 Content-Type: text/plain; charset="UTF-8" Hi Jan, Jon, Kevin, all, As we are working on the design, a key issue that we are trying to understand is the conflict resolution of the capabilities in the "capabilities" list [RFC8008]. Consider { "capabilities": [ { "capability-type": "FCI.DeliveryProtocol", "capability-value": { "delivery-protocols": [ "http/1.1", ] }, "footprints": [ ] }, { "capability-type": "FCI.DeliveryProtocol", "capability-value": { "delivery-protocols": [ "http/1.0", ] }, "footprints": [ ] } ] } What if the footprints in the two entries have overlap? I see two options: (1) Enforce that each capability-type has a single entry; that is, make capability-type a key; (2) Allow multiple entries with the same capability-type, and the search is ordered by the array; that is, the result is the first matching footprints. I assume that (2) is more flexible. An issue, however, is that it makes incremental updates harder. In other words, this issue will determine whether we should integrate JSON Patch. The current alto incremental updates, based on SSE and JSON Merge Patch, is pretty useful. The FCI use case may argue that we extend the incremental update w/ JSON Patch, to better handle arrays, right away. Any clarification, comments and suggestions will be great. Richard --001a1141fdce3cea330553687e42 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Jan, Jon, Kevin, all,
<= div class=3D"gmail_extra">
As we are wo= rking on the design, a key issue that we are trying to understand is the co= nflict resolution of the capabilities in the "capabilities" list = [RFC8008]. Consider

=C2=A0 =C2=A0{
<= div class=3D"gmail_extra">=C2=A0 =C2=A0 =C2=A0"capabilities": [
=C2=A0 =C2=A0 =C2=A0 =C2=A0{
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"capability-type&qu= ot;: "FCI.DeliveryProtocol",
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"capability-value": {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"delivery= -protocols": [
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0"http/1.1",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0]
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0},
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"footprints": [
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<Footprint obj= ects 1>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0]
=C2=A0 =C2=A0 =C2=A0 =C2=A0},
=C2=A0 =C2=A0 =C2=A0 =C2= =A0{
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&quo= t;capability-type": "FCI.DeliveryProtocol",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"capability-value&q= uot;: {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0"delivery-protocols": [
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"http/1.0",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0]
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0},
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"footprints":= [
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0<Footprint objects 2>
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0]
=C2=A0 =C2=A0 =C2= =A0 =C2=A0}
=C2=A0 =C2=A0 =C2=A0=C2= =A0
=C2=A0 =C2=A0 =C2=A0]
=C2=A0 =C2= =A0}=C2=A0

What if the footprints in the two entries have overlap? I see two opti= ons:
(1) Enforce that each capability-type has a single entry; that is,= make capability-type a key;
(2) Allow mult= iple entries with the same capability-type, and the search is ordered by th= e array; that is, the result is the first matching footprints.

I assume=C2=A0that= (2) is more flexible. An=C2=A0issue, however, is that it makes=C2=A0increm= ental updates harder. In other words, this issue will determine whether we = should integrate JSON Patch. The current alto incremental updates, based on= SSE and JSON Merge Patch, is pretty useful. The FCI use case may argue tha= t we extend the incremental update w/ JSON Patch, to better handle arrays, = right away.

Any clarification, comments and suggestions will be great.

Richard

--001a1141fdce3cea330553687e42-- From nobody Mon Jul 3 05:56:54 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42AF41315D7; Mon, 3 Jul 2017 05:56:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R76GeaLOAkg0; Mon, 3 Jul 2017 05:56:43 -0700 (PDT) Received: from esa1-smtp-out.rz.hft-stuttgart.de (esa1-smtp-out.rz.hft-stuttgart.de [193.197.204.116]) by ietfa.amsl.com (Postfix) with ESMTP id C5CB01300CE; Mon, 3 Jul 2017 05:56:42 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2BwAwDyPVpZ/+LIxcFcDg0BAQEDAQEBC?= =?us-ascii?q?QEBAYMsgRCBDgeOcZBaIpgOKIV0AoMyFAECAQEBAQEBAWsohRgBAQEBAgEjJjU?= =?us-ascii?q?LCQIYKgICVwYBDAYCAQGKIwySbp1jgiYpg2sBhzgBAQgBAQEBASMJAYMdg0yBY?= =?us-ascii?q?SsLgUAigQyHfYJhBZ5/gQGBIZNriROGfokyi342IYEKUiRdhRMcgScEATx0h38?= =?us-ascii?q?BgQwBAQE?= X-IPAS-Result: =?us-ascii?q?A2BwAwDyPVpZ/+LIxcFcDg0BAQEDAQEBCQEBAYMsgRCBDge?= =?us-ascii?q?OcZBaIpgOKIV0AoMyFAECAQEBAQEBAWsohRgBAQEBAgEjJjULCQIYKgICVwYBD?= =?us-ascii?q?AYCAQGKIwySbp1jgiYpg2sBhzgBAQgBAQEBASMJAYMdg0yBYSsLgUAigQyHfYJ?= =?us-ascii?q?hBZ5/gQGBIZNriROGfokyi342IYEKUiRdhRMcgScEATx0h38BgQwBAQE?= Received: from exsrv01.ad.hft-stuttgart.de (HELO mail.hft-stuttgart.de) ([193.197.200.226]) by esa1-exout.rz.hft-stuttgart.de with ESMTP; 03 Jul 2017 14:56:39 +0200 Received: from Jans-MacBook-Air.local (193.197.200.229) by exsrv01.ad.hft-stuttgart.de (193.197.200.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.544.27; Mon, 3 Jul 2017 14:56:39 +0200 To: "Y. Richard Yang" , Jon Peterson , Kevin Ma J , "cdni@ietf.org" , IETF ALTO References: From: Jan Seedorf Message-ID: <2636700d-72af-270b-5809-bd999e0e1ca3@hft-stuttgart.de> Date: Mon, 3 Jul 2017 14:56:38 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------318DC8A9CC3453AB9FDBD8BC" X-Originating-IP: [193.197.200.229] Archived-At: Subject: Re: [CDNi] fci alto transport design discussion X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 12:56:46 -0000 --------------318DC8A9CC3453AB9FDBD8BC Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit Hi Richard and all, looking at RFC8008, its states that "FCI objects are composed of a dictionary of (key,value) pairs where the keys are the property names and the values are the associated property values.", meaning that the "capability-value" is a key. However, I did not find anything on multiple "capability-type" entries, and what to do when they are conflicting. From a CDNI perspective, it should certainly be possible to have something like in your example below: support http1.1 for footprint a and support http1.0 for footprint b. I am for option 2) below, that is allow multiple entries with the same capability type. > The FCI use case may argue that we extend the incremental update w/ > JSON Patch, to better handle arrays, right away. Indeed. Do you want to choose one of the two (JSON Patch vs. JSON Merge Patch) or do you think of making JSON Merge Patch mandatory and JSON Patch optional and then we say in the ALTO FCI service specification that this one demands JSON Patch (as pecified in the ALTO incr. updates)? - Jan On 03.07.17 13:59, Y. Richard Yang wrote: > Hi Jan, Jon, Kevin, all, > > As we are working on the design, a key issue that we are trying to > understand is the conflict resolution of the capabilities in the > "capabilities" list [RFC8008]. Consider > > { > "capabilities": [ > { > "capability-type": "FCI.DeliveryProtocol", > "capability-value": { > "delivery-protocols": [ > "http/1.1", > ] > }, > "footprints": [ > > ] > }, > { > "capability-type": "FCI.DeliveryProtocol", > "capability-value": { > "delivery-protocols": [ > "http/1.0", > ] > }, > "footprints": [ > > ] > } > ] > } > > What if the footprints in the two entries have overlap? I see two > options: > (1) Enforce that each capability-type has a single entry; that is, > make capability-type a key; > (2) Allow multiple entries with the same capability-type, and the > search is ordered by the array; that is, the result is the first > matching footprints. > > I assume that (2) is more flexible. An issue, however, is that it > makes incremental updates harder. In other words, this issue will > determine whether we should integrate JSON Patch. The current alto > incremental updates, based on SSE and JSON Merge Patch, is pretty > useful. The FCI use case may argue that we extend the incremental > update w/ JSON Patch, to better handle arrays, right away. > > Any clarification, comments and suggestions will be great. > > Richard > -- **************************** Prof. Dr. Jan Seedorf jan.seedorf@hft-stuttgart.de **************************** Hochschule für Technik Stuttgart Fakultät Vermessung, Informatik und Mathematik Schellingstr. 24 D-70174 Stuttgart www.hft-stuttgart.de **************************** --------------318DC8A9CC3453AB9FDBD8BC Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 8bit

Hi Richard and all,

looking at RFC8008, its states that "FCI objects are composed of a dictionary of (key,value) pairs where the keys are the property names and the values are the associated property values.", meaning that the "capability-value" is a key. However, I did not find anything on multiple "capability-type" entries, and what to do when they are conflicting. From a CDNI perspective, it should certainly be possible to have something like in your example below: support http1.1 for footprint a and support http1.0 for footprint b.

I am for option 2) below, that is allow multiple entries with the same capability type.

The FCI use case may argue that we extend the incremental update w/ JSON Patch, to better handle arrays, right away.
Indeed. Do you want to choose one of the two (JSON Patch vs. JSON Merge Patch) or do you think of making JSON Merge Patch mandatory and JSON Patch optional and then we say in the ALTO FCI service specification that this one demands JSON Patch (as pecified in the ALTO incr. updates)?

 - Jan


On 03.07.17 13:59, Y. Richard Yang wrote:
Hi Jan, Jon, Kevin, all,

As we are working on the design, a key issue that we are trying to understand is the conflict resolution of the capabilities in the "capabilities" list [RFC8008]. Consider

   {
     "capabilities": [
       {
         "capability-type": "FCI.DeliveryProtocol",
         "capability-value": {
           "delivery-protocols": [
             "http/1.1",
           ]
         },
         "footprints": [
           <Footprint objects 1>
         ]
       },
       {
         "capability-type": "FCI.DeliveryProtocol",
         "capability-value": {
           "delivery-protocols": [
             "http/1.0",
           ]
         },
         "footprints": [
           <Footprint objects 2>
         ]
       }
      
     ]
   } 

What if the footprints in the two entries have overlap? I see two options:
(1) Enforce that each capability-type has a single entry; that is, make capability-type a key;
(2) Allow multiple entries with the same capability-type, and the search is ordered by the array; that is, the result is the first matching footprints.

I assume that (2) is more flexible. An issue, however, is that it makes incremental updates harder. In other words, this issue will determine whether we should integrate JSON Patch. The current alto incremental updates, based on SSE and JSON Merge Patch, is pretty useful. The FCI use case may argue that we extend the incremental update w/ JSON Patch, to better handle arrays, right away.

Any clarification, comments and suggestions will be great.

Richard


-- 
****************************
Prof. Dr. Jan Seedorf
jan.seedorf@hft-stuttgart.de
****************************
Hochschule für Technik Stuttgart
Fakultät Vermessung, Informatik und Mathematik
Schellingstr. 24
D-70174 Stuttgart
www.hft-stuttgart.de
****************************
--------------318DC8A9CC3453AB9FDBD8BC-- From nobody Mon Jul 3 07:52:41 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41F43129562 for ; Mon, 3 Jul 2017 07:52:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ki4SFBOHnkYk for ; Mon, 3 Jul 2017 07:52:21 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50019131662 for ; Mon, 3 Jul 2017 07:52:15 -0700 (PDT) X-AuditID: c6180641-bd7ff70000001788-8d-595a13be51eb Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id DD.7C.06024.EB31A595; Mon, 3 Jul 2017 11:51:58 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.03.0352.000; Mon, 3 Jul 2017 10:52:13 -0400 From: Kevin Ma J To: "'cdni@ietf.org'" Thread-Topic: IETF 99 Draft Agenda Thread-Index: AdLxvZ0JAb5aL5/aRVqi7jHyNmIhXgCQDw1g Date: Mon, 3 Jul 2017 14:52:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrBLMWRmVeSWpSXmKPExsUyuXRPuO4+4ahIgxU/JCyezv7D6sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujM+H+1kL3jBXNC0QaGBsZ+5i5OSQEDCR+NZ8Dcjm4hASOMoo 8XnrCUYIZxmjxO0fv1hBqtgEtCQef/3L1MXIwSEioCpx5msxSFhYQFHi8ozNbCC2iICSxOLj ExghbCOJuVdbweIsAioS905+AovzCvhK7Ps8G8wWArLPN/1iArE5Bfwkeq8dAlvFKCAm8f3U GrA4s4C4xK0n85kgDhWQWLLnPNTRohIvH/9jhbAVJfb1T2eHqNeRWLD7ExuErS2xbOFrZoi9 ghInZz5hmcAoMgvJ2FlIWmYhaZmFpGUBI8sqRo7S4oKc3HQjw02MwPA+JsHmuINxb6/nIUYB DkYlHl5e5qhIIdbEsuLK3EOMEhzMSiK8cfpAId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rzvyi9E CAmkJ5akZqemFqQWwWSZODilGhhn6WicPPByqnbPHk+OuBmBxcX7M/jWJn/fLtPmPn+zeGE8 //LDsv/1Mg3SAk1PBMdc/esf3jJTSfHWVUOnm3cWhTAtVgyTc/49e0rMQm3r+9Xb5B/bHD76 fnkl57IfVv1SzlaNIsWsswOu7b/EfLz4zb4494RZhS8mG4mbBr+6G+DmvDHwT7oSS3FGoqEW c1FxIgCs7aUKawIAAA== Archived-At: Subject: Re: [CDNi] IETF 99 Draft Agenda X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 14:52:28 -0000 Hi All, Updated draft agenda available: https://www.ietf.org/proceedings/99/agend= a/agenda-99-cdni-01 thanx. -- Kevin and Francois > -----Original Message----- > From: Kevin Ma J > Sent: Friday, June 30, 2017 3:55 PM > To: cdni@ietf.org > Subject: IETF 99 Draft Agenda >=20 > Hi All, >=20 > We have posted the draft agenda for our session in Prague: > https://www.ietf.org/proceedings/99/agenda/agenda-99-cdni-00 >=20 > thanx! >=20 > -- Kevin and Francois From nobody Mon Jul 3 09:59:54 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6496412EC00; Mon, 3 Jul 2017 09:59:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.189 X-Spam-Level: X-Spam-Status: No, score=-4.189 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08hDyYaFexDN; Mon, 3 Jul 2017 09:59:49 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D46D11286B2; Mon, 3 Jul 2017 09:59:47 -0700 (PDT) X-AuditID: c6180641-bd7ff70000001788-76-595a31a09a38 Received: from EUSAAHC003.ericsson.se (Unknown_Domain [147.117.188.81]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id 12.8F.06024.0A13A595; Mon, 3 Jul 2017 13:59:29 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC003.ericsson.se ([147.117.188.81]) with mapi id 14.03.0352.000; Mon, 3 Jul 2017 12:59:44 -0400 From: Kevin Ma J To: Jan Seedorf , "Y. Richard Yang" , Jon Peterson , "cdni@ietf.org" , IETF ALTO Thread-Topic: fci alto transport design discussion Thread-Index: AQHS8/PEdGi5HHO/oUy3r13FnkopSKJCUsQA///73vA= Date: Mon, 3 Jul 2017 16:59:43 +0000 Message-ID: References: <2636700d-72af-270b-5809-bd999e0e1ca3@hft-stuttgart.de> In-Reply-To: <2636700d-72af-270b-5809-bd999e0e1ca3@hft-stuttgart.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: multipart/alternative; boundary="_000_A419F67F880AB2468214E154CB8A5562222E0D34eusaamb103erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprGIsWRmVeSWpSXmKPExsUyuXRPoO5Cw6hIg1t7WCwebt/LavF09h9W i4Odb9kszjRYWuw71MHiwOrRvLmbyWPFjdOsHkuW/GTy2NHwnDmAJYrLJiU1J7MstUjfLoEr Y+PWnWwFV04wVjy99ZSxgXHNYcYuRk4OCQETiasLp7N1MXJxCAkcZZQ4PHs2C4SzjFFi2pdG VpAqNgEticdf/zKBJEQE9jBKnH73kBkkISxgKHG8dzc7iC0iYCTRcq0RKM4BZFtJnPwgDRJm EVCRaNo2gwnE5hXwlZh6bhozxIIuRolzt6+B9XIKuEhse9THBmIzCohJfD+1BqyBWUBc4taT +UwQpwpILNlznhnCFpV4+fgfK4StKLGvfzo7RH2+xMK571kglglKnJz5hGUCo/AsJKNmISmb haRsFtDZzAKaEut36UOUKEpM6X7IDmFrSLTOmcuOLL6AkX0VI0dpcUFObrqR4SZGYGwdk2Bz 3MG4t9fzEKMAB6MSD6+ZfFSkEGtiWXFl7iFGCQ5mJRHeb6VAId6UxMqq1KL8+KLSnNTiQ4zS HCxK4rzvyi9ECAmkJ5akZqemFqQWwWSZODilGhjzraJ9NxV/nrrZOXyz6sS9EgcnXdgpcCn5 fIj6vQtrxDhrdaYV6Zjflk+q+rx9Snb+jy/r8r3/Ldd379GcsX+fukOZ45Z9874I7nPaz6tY uyJunvdrD4YFXnLfnlgIxtTvKfp0n/XZE0n/N/98ZMWPz/KQ/1hfovNzS27FitOtj5v1i8tj b+grsRRnJBpqMRcVJwIAB9Vph6kCAAA= Archived-At: Subject: Re: [CDNi] fci alto transport design discussion X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 16:59:52 -0000 --_000_A419F67F880AB2468214E154CB8A5562222E0D34eusaamb103erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQWxsLA0KDQogIChhcyBhbiBpbmRpdmlkdWFsL2F1dGhvcikgSSBhZ3JlZSB0aGF0IHRoZSBm dW5jdGlvbmFsaXR5IGRlc2NyaWJlZCB3b3VsZCBiZSB1c2VmdWwsIGkuZS4sIGJlaW5nIGFibGUg dG8gc3BlY2lmeSBkaWZmZXJlbnQgZm9vdHByaW50cyBmb3IgZGlmZmVyZW50IGNhcGFiaWxpdHkt dmFsdWVzIGFzc29jaWF0ZWQgd2l0aCBhIGdpdmVuIGNhcGFiaWxpdHktdHlwZS4gIFRoaXMgd2Fz IG1vcmUgZXhwbGljaXRseSBsYWlkIG91dCBpbiBkcmFmdC1tYS1jZG5pLWNhcGFiaWxpdGllcywg YnV0IGRpZCBub3QgYWxsIGNvbWUgb3ZlciBpbnRvIFJGQzgwMDguICBUaGUgZGVsaXZlcnkgcHJv dG9jb2wgZXhhbXBsZSBpbiBbMV0gc2hvd3MgaHR0cCBhbmQgaHR0cHMgYmVpbmcgc3VwcG9ydGVk IGFjcm9zcyBkaWZmZXJlbnQgZm9vdHByaW50cywganVzdCBhcyBSaWNoYXJkIHNob3dlZC4gIFRo ZSBmaXJzdCBwYXJ0IG9mIHRoZSBsYXN0IHBhcmFncmFwaCBvZiBbMl0gZGVzY3JpYmVzIHRoZSBp bnRlbmRlZCByZXN0cmljdGlvbiBvbiBkdXBsaWNhdGUgY2FwYWJpbGl0eS12YWx1ZXMgKGlnbm9y aW5nIHRoZSB0eXBvIHdoZXJlIGl0IHNheXMgImZvb3RwcmludC12YWx1ZSIgYW5kIHNob3VsZCBq dXN0IHNheSAidmFsdWVzIik7IHRob3VnaCB0aGlzIGlzIGRlc2NyaWJpbmcgYSAicmVzcG9uc2Ui LCBpdCBtYWludGFpbnMgdGhlIHNhbWUgcmF0aW9uYWwgd3J0IHJlc3RyaWN0aW9ucyBvbiBjcmVh dGluZyB0aGUganNvbiBvYmplY3RzOg0KDQogICBNdWx0aXBsZSBGQ0lNYXBEYXRhIG9iamVjdHMg d2l0aCB0aGUgc2FtZSBjYXBhYmlsaXR5IHR5cGUgYXJlIGFsbG93ZWQNCiAgIHdpdGhpbiBhIGdp dmVuIENETkkgRkNJIE1hcCByZXNwb25zZSBhcyBsb25nIGFzIHRoZSBjYXBhYmlsaXR5IG9wdGlv bg0KICAgW3ZhbHVlc10gZG8gbm90IG92ZXJsYXAsIGkuZS4sIGEgZ2l2ZW4gY2FwYWJpbGl0eSBv cHRpb24gdmFsdWUNCiAgIE1VU1QgTk9UIHNob3cgdXAgaW4gbXVsdGlwbGUgRkNJTWFwRGF0YSBv YmplY3RzIHdpdGhpbiBhIHNpbmdsZSBDRE5JDQogICBGQ0kgTWFwIHJlc3BvbnNlLg0KDQpbMV0g aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LW1hLWNkbmktY2FwYWJpbGl0aWVzLTA5 I3NlY3Rpb24tMy4xLjcuMQ0KWzJdIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1t YS1jZG5pLWNhcGFiaWxpdGllcy0wOSNzZWN0aW9uLTMuMS42DQoNCnRoYW54Lg0KDQotLSAgS2V2 aW4gSi4gTWENCg0KRnJvbTogSmFuIFNlZWRvcmYgW21haWx0bzpqYW4uc2VlZG9yZkBoZnQtc3R1 dHRnYXJ0LmRlXQ0KU2VudDogTW9uZGF5LCBKdWx5IDAzLCAyMDE3IDg6NTcgQU0NClRvOiBZLiBS aWNoYXJkIFlhbmcgPHlyeUBjcy55YWxlLmVkdT47IEpvbiBQZXRlcnNvbiA8am9uLnBldGVyc29u QG5ldXN0YXIuYml6PjsgS2V2aW4gTWEgSiA8a2V2aW4uai5tYUBlcmljc3Nvbi5jb20+OyBjZG5p QGlldGYub3JnOyBJRVRGIEFMVE8gPGFsdG9AaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogZmNpIGFs dG8gdHJhbnNwb3J0IGRlc2lnbiBkaXNjdXNzaW9uDQoNCg0KSGkgUmljaGFyZCBhbmQgYWxsLA0K DQpsb29raW5nIGF0IFJGQzgwMDgsIGl0cyBzdGF0ZXMgdGhhdCAiRkNJIG9iamVjdHMgYXJlIGNv bXBvc2VkIG9mIGEgZGljdGlvbmFyeSBvZiAoa2V5LHZhbHVlKSBwYWlycyB3aGVyZSB0aGUga2V5 cyBhcmUgdGhlIHByb3BlcnR5IG5hbWVzIGFuZCB0aGUgdmFsdWVzIGFyZSB0aGUgYXNzb2NpYXRl ZCBwcm9wZXJ0eSB2YWx1ZXMuIiwgbWVhbmluZyB0aGF0IHRoZSAiY2FwYWJpbGl0eS12YWx1ZSIg aXMgYSBrZXkuIEhvd2V2ZXIsIEkgZGlkIG5vdCBmaW5kIGFueXRoaW5nIG9uIG11bHRpcGxlICJj YXBhYmlsaXR5LXR5cGUiIGVudHJpZXMsIGFuZCB3aGF0IHRvIGRvIHdoZW4gdGhleSBhcmUgY29u ZmxpY3RpbmcuIEZyb20gYSBDRE5JIHBlcnNwZWN0aXZlLCBpdCBzaG91bGQgY2VydGFpbmx5IGJl IHBvc3NpYmxlIHRvIGhhdmUgc29tZXRoaW5nIGxpa2UgaW4geW91ciBleGFtcGxlIGJlbG93OiBz dXBwb3J0IGh0dHAxLjEgZm9yIGZvb3RwcmludCBhIGFuZCBzdXBwb3J0IGh0dHAxLjAgZm9yIGZv b3RwcmludCBiLg0KDQpJIGFtIGZvciBvcHRpb24gMikgYmVsb3csIHRoYXQgaXMgYWxsb3cgbXVs dGlwbGUgZW50cmllcyB3aXRoIHRoZSBzYW1lIGNhcGFiaWxpdHkgdHlwZS4NClRoZSBGQ0kgdXNl IGNhc2UgbWF5IGFyZ3VlIHRoYXQgd2UgZXh0ZW5kIHRoZSBpbmNyZW1lbnRhbCB1cGRhdGUgdy8g SlNPTiBQYXRjaCwgdG8gYmV0dGVyIGhhbmRsZSBhcnJheXMsIHJpZ2h0IGF3YXkuDQpJbmRlZWQu IERvIHlvdSB3YW50IHRvIGNob29zZSBvbmUgb2YgdGhlIHR3byAoSlNPTiBQYXRjaCB2cy4gSlNP TiBNZXJnZSBQYXRjaCkgb3IgZG8geW91IHRoaW5rIG9mIG1ha2luZyBKU09OIE1lcmdlIFBhdGNo IG1hbmRhdG9yeSBhbmQgSlNPTiBQYXRjaCBvcHRpb25hbCBhbmQgdGhlbiB3ZSBzYXkgaW4gdGhl IEFMVE8gRkNJIHNlcnZpY2Ugc3BlY2lmaWNhdGlvbiB0aGF0IHRoaXMgb25lIGRlbWFuZHMgSlNP TiBQYXRjaCAoYXMgcGVjaWZpZWQgaW4gdGhlIEFMVE8gaW5jci4gdXBkYXRlcyk/DQoNCiAtIEph bg0KDQpPbiAwMy4wNy4xNyAxMzo1OSwgWS4gUmljaGFyZCBZYW5nIHdyb3RlOg0KSGkgSmFuLCBK b24sIEtldmluLCBhbGwsDQoNCkFzIHdlIGFyZSB3b3JraW5nIG9uIHRoZSBkZXNpZ24sIGEga2V5 IGlzc3VlIHRoYXQgd2UgYXJlIHRyeWluZyB0byB1bmRlcnN0YW5kIGlzIHRoZSBjb25mbGljdCBy ZXNvbHV0aW9uIG9mIHRoZSBjYXBhYmlsaXRpZXMgaW4gdGhlICJjYXBhYmlsaXRpZXMiIGxpc3Qg W1JGQzgwMDhdLiBDb25zaWRlcg0KICAgew0KICAgICAiY2FwYWJpbGl0aWVzIjogWw0KICAgICAg IHsNCiAgICAgICAgICJjYXBhYmlsaXR5LXR5cGUiOiAiRkNJLkRlbGl2ZXJ5UHJvdG9jb2wiLA0K ICAgICAgICAgImNhcGFiaWxpdHktdmFsdWUiOiB7DQogICAgICAgICAgICJkZWxpdmVyeS1wcm90 b2NvbHMiOiBbDQogICAgICAgICAgICAgImh0dHAvMS4xIiwNCiAgICAgICAgICAgXQ0KICAgICAg ICAgfSwNCiAgICAgICAgICJmb290cHJpbnRzIjogWw0KICAgICAgICAgICA8Rm9vdHByaW50IG9i amVjdHMgMT4NCiAgICAgICAgIF0NCiAgICAgICB9LA0KICAgICAgIHsNCiAgICAgICAgICJjYXBh YmlsaXR5LXR5cGUiOiAiRkNJLkRlbGl2ZXJ5UHJvdG9jb2wiLA0KICAgICAgICAgImNhcGFiaWxp dHktdmFsdWUiOiB7DQogICAgICAgICAgICJkZWxpdmVyeS1wcm90b2NvbHMiOiBbDQogICAgICAg ICAgICAgImh0dHAvMS4wIiwNCiAgICAgICAgICAgXQ0KICAgICAgICAgfSwNCiAgICAgICAgICJm b290cHJpbnRzIjogWw0KICAgICAgICAgICA8Rm9vdHByaW50IG9iamVjdHMgMj4NCiAgICAgICAg IF0NCiAgICAgICB9DQoNCiAgICAgXQ0KICAgfQ0KDQpXaGF0IGlmIHRoZSBmb290cHJpbnRzIGlu IHRoZSB0d28gZW50cmllcyBoYXZlIG92ZXJsYXA/IEkgc2VlIHR3byBvcHRpb25zOg0KKDEpIEVu Zm9yY2UgdGhhdCBlYWNoIGNhcGFiaWxpdHktdHlwZSBoYXMgYSBzaW5nbGUgZW50cnk7IHRoYXQg aXMsIG1ha2UgY2FwYWJpbGl0eS10eXBlIGEga2V5Ow0KKDIpIEFsbG93IG11bHRpcGxlIGVudHJp ZXMgd2l0aCB0aGUgc2FtZSBjYXBhYmlsaXR5LXR5cGUsIGFuZCB0aGUgc2VhcmNoIGlzIG9yZGVy ZWQgYnkgdGhlIGFycmF5OyB0aGF0IGlzLCB0aGUgcmVzdWx0IGlzIHRoZSBmaXJzdCBtYXRjaGlu ZyBmb290cHJpbnRzLg0KDQpJIGFzc3VtZSB0aGF0ICgyKSBpcyBtb3JlIGZsZXhpYmxlLiBBbiBp c3N1ZSwgaG93ZXZlciwgaXMgdGhhdCBpdCBtYWtlcyBpbmNyZW1lbnRhbCB1cGRhdGVzIGhhcmRl ci4gSW4gb3RoZXIgd29yZHMsIHRoaXMgaXNzdWUgd2lsbCBkZXRlcm1pbmUgd2hldGhlciB3ZSBz aG91bGQgaW50ZWdyYXRlIEpTT04gUGF0Y2guIFRoZSBjdXJyZW50IGFsdG8gaW5jcmVtZW50YWwg dXBkYXRlcywgYmFzZWQgb24gU1NFIGFuZCBKU09OIE1lcmdlIFBhdGNoLCBpcyBwcmV0dHkgdXNl ZnVsLiBUaGUgRkNJIHVzZSBjYXNlIG1heSBhcmd1ZSB0aGF0IHdlIGV4dGVuZCB0aGUgaW5jcmVt ZW50YWwgdXBkYXRlIHcvIEpTT04gUGF0Y2gsIHRvIGJldHRlciBoYW5kbGUgYXJyYXlzLCByaWdo dCBhd2F5Lg0KDQpBbnkgY2xhcmlmaWNhdGlvbiwgY29tbWVudHMgYW5kIHN1Z2dlc3Rpb25zIHdp bGwgYmUgZ3JlYXQuDQoNClJpY2hhcmQNCg0KDQoNCg0KLS0NCg0KKioqKioqKioqKioqKioqKioq KioqKioqKioqKg0KDQpQcm9mLiBEci4gSmFuIFNlZWRvcmYNCg0KamFuLnNlZWRvcmZAaGZ0LXN0 dXR0Z2FydC5kZTxtYWlsdG86amFuLnNlZWRvcmZAaGZ0LXN0dXR0Z2FydC5kZT4NCg0KKioqKioq KioqKioqKioqKioqKioqKioqKioqKg0KDQpIb2Noc2NodWxlIGbDvHIgVGVjaG5payBTdHV0dGdh cnQNCg0KRmFrdWx0w6R0IFZlcm1lc3N1bmcsIEluZm9ybWF0aWsgdW5kIE1hdGhlbWF0aWsNCg0K U2NoZWxsaW5nc3RyLiAyNA0KDQpELTcwMTc0IFN0dXR0Z2FydA0KDQp3d3cuaGZ0LXN0dXR0Z2Fy dC5kZTxodHRwOi8vd3d3LmhmdC1zdHV0dGdhcnQuZGU+DQoNCioqKioqKioqKioqKioqKioqKioq KioqKioqKioNCg== --_000_A419F67F880AB2468214E154CB8A5562222E0D34eusaamb103erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcHJlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOmJsYWNrO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZTox Mi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6Ymxh Y2s7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQ cmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1s aW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7DQoJY29sb3I6 YmxhY2s7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVw bHk7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZv bnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246 bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0K PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpz aGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9Indo aXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6d2lu ZG93dGV4dCI+SGkgQWxsLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPiZuYnNw OyAoYXMgYW4gaW5kaXZpZHVhbC9hdXRob3IpIEkgYWdyZWUgdGhhdCB0aGUgZnVuY3Rpb25hbGl0 eSBkZXNjcmliZWQgd291bGQgYmUgdXNlZnVsLCBpLmUuLCBiZWluZyBhYmxlIHRvIHNwZWNpZnkg ZGlmZmVyZW50IGZvb3RwcmludHMgZm9yIGRpZmZlcmVudCBjYXBhYmlsaXR5LXZhbHVlcw0KIGFz c29jaWF0ZWQgd2l0aCBhIGdpdmVuIGNhcGFiaWxpdHktdHlwZS4mbmJzcDsgVGhpcyB3YXMgbW9y ZSBleHBsaWNpdGx5IGxhaWQgb3V0IGluIGRyYWZ0LW1hLWNkbmktY2FwYWJpbGl0aWVzLCBidXQg ZGlkIG5vdCBhbGwgY29tZSBvdmVyIGludG8gUkZDODAwOC4mbmJzcDsgVGhlIGRlbGl2ZXJ5IHBy b3RvY29sIGV4YW1wbGUgaW4gWzFdIHNob3dzIGh0dHAgYW5kIGh0dHBzIGJlaW5nIHN1cHBvcnRl ZCBhY3Jvc3MgZGlmZmVyZW50IGZvb3RwcmludHMsIGp1c3QNCiBhcyBSaWNoYXJkIHNob3dlZC4m bmJzcDsgVGhlIGZpcnN0IHBhcnQgb2YgdGhlIGxhc3QgcGFyYWdyYXBoIG9mIFsyXSBkZXNjcmli ZXMgdGhlIGludGVuZGVkIHJlc3RyaWN0aW9uIG9uIGR1cGxpY2F0ZSBjYXBhYmlsaXR5LXZhbHVl cyAoaWdub3JpbmcgdGhlIHR5cG8gd2hlcmUgaXQgc2F5cyAmcXVvdDtmb290cHJpbnQtdmFsdWUm cXVvdDsgYW5kIHNob3VsZCBqdXN0IHNheSAmcXVvdDt2YWx1ZXMmcXVvdDspOyB0aG91Z2ggdGhp cyBpcyBkZXNjcmliaW5nIGEgJnF1b3Q7cmVzcG9uc2UmcXVvdDssIGl0IG1haW50YWlucw0KIHRo ZSBzYW1lIHJhdGlvbmFsIHdydCByZXN0cmljdGlvbnMgb24gY3JlYXRpbmcgdGhlIGpzb24gb2Jq ZWN0czogPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7Y29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6d2luZG93dGV4dCI+Jm5ic3A7Jm5ic3A7IE11 bHRpcGxlIEZDSU1hcERhdGEgb2JqZWN0cyB3aXRoIHRoZSBzYW1lIGNhcGFiaWxpdHkgdHlwZSBh cmUgYWxsb3dlZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPiZuYnNwOyZuYnNwOyB3aXRoaW4gYSBnaXZlbiBDRE5J IEZDSSBNYXAgcmVzcG9uc2UgYXMgbG9uZyBhcyB0aGUgY2FwYWJpbGl0eSBvcHRpb248bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjp3aW5k b3d0ZXh0Ij4mbmJzcDsmbmJzcDsgW3ZhbHVlc10gZG8gbm90IG92ZXJsYXAsIGkuZS4sIGEgZ2l2 ZW4gY2FwYWJpbGl0eSBvcHRpb24gdmFsdWU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjp3aW5kb3d0ZXh0Ij4mbmJzcDsmbmJzcDsgTVVT VCBOT1Qgc2hvdyB1cCBpbiBtdWx0aXBsZSBGQ0lNYXBEYXRhIG9iamVjdHMgd2l0aGluIGEgc2lu Z2xlIENETkk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjp3aW5kb3d0ZXh0Ij4mbmJzcDsmbmJzcDsgRkNJIE1hcCByZXNwb25zZS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjp3 aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90Oztjb2xvcjp3aW5kb3d0ZXh0Ij5bMV0NCjxhIGhyZWY9Imh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1tYS1jZG5pLWNhcGFiaWxpdGllcy0wOSNzZWN0aW9uLTMu MS43LjEiPg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LW1hLWNkbmktY2FwYWJp bGl0aWVzLTA5I3NlY3Rpb24tMy4xLjcuMTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjp3aW5kb3d0ZXh0Ij5bMl0NCjxhIGhyZWY9 Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1tYS1jZG5pLWNhcGFiaWxpdGllcy0w OSNzZWN0aW9uLTMuMS42Ij4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1tYS1j ZG5pLWNhcGFiaWxpdGllcy0wOSNzZWN0aW9uLTMuMS42PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOndpbmRvd3RleHQiPnRoYW54LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOndpbmRvd3RleHQi Pi0tJm5ic3A7IEtldmluIEouIE1hPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAx LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 d2luZG93dGV4dCI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0 ZXh0Ij4gSmFuIFNlZWRvcmYgW21haWx0bzpqYW4uc2VlZG9yZkBoZnQtc3R1dHRnYXJ0LmRlXQ0K PGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgSnVseSAwMywgMjAxNyA4OjU3IEFNPGJyPg0KPGI+ VG86PC9iPiBZLiBSaWNoYXJkIFlhbmcgJmx0O3lyeUBjcy55YWxlLmVkdSZndDs7IEpvbiBQZXRl cnNvbiAmbHQ7am9uLnBldGVyc29uQG5ldXN0YXIuYml6Jmd0OzsgS2V2aW4gTWEgSiAmbHQ7a2V2 aW4uai5tYUBlcmljc3Nvbi5jb20mZ3Q7OyBjZG5pQGlldGYub3JnOyBJRVRGIEFMVE8gJmx0O2Fs dG9AaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBmY2kgYWx0byB0cmFuc3Bv cnQgZGVzaWduIGRpc2N1c3Npb248bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5IaSBSaWNo YXJkIGFuZCBhbGwsPG86cD48L286cD48L3A+DQo8cD5sb29raW5nIGF0IFJGQzgwMDgsIGl0cyBz dGF0ZXMgdGhhdCAmcXVvdDtGQ0kgb2JqZWN0cyBhcmUgY29tcG9zZWQgb2YgYSBkaWN0aW9uYXJ5 IG9mIChrZXksdmFsdWUpIHBhaXJzIHdoZXJlIHRoZSBrZXlzIGFyZSB0aGUgcHJvcGVydHkgbmFt ZXMgYW5kIHRoZSB2YWx1ZXMgYXJlIHRoZSBhc3NvY2lhdGVkIHByb3BlcnR5IHZhbHVlcy4mcXVv dDssIG1lYW5pbmcgdGhhdCB0aGUgJnF1b3Q7Y2FwYWJpbGl0eS12YWx1ZSZxdW90OyBpcyBhIGtl eS4gSG93ZXZlciwgSSBkaWQgbm90DQogZmluZCBhbnl0aGluZyBvbiBtdWx0aXBsZSAmcXVvdDtj YXBhYmlsaXR5LXR5cGUmcXVvdDsgZW50cmllcywgYW5kIHdoYXQgdG8gZG8gd2hlbiB0aGV5IGFy ZSBjb25mbGljdGluZy4gRnJvbSBhIENETkkgcGVyc3BlY3RpdmUsIGl0IHNob3VsZCBjZXJ0YWlu bHkgYmUgcG9zc2libGUgdG8gaGF2ZSBzb21ldGhpbmcgbGlrZSBpbiB5b3VyIGV4YW1wbGUgYmVs b3c6IHN1cHBvcnQgaHR0cDEuMSBmb3IgZm9vdHByaW50IGEgYW5kIHN1cHBvcnQgaHR0cDEuMCBm b3IgZm9vdHByaW50DQogYi48bzpwPjwvbzpwPjwvcD4NCjxwPkkgYW0gZm9yIG9wdGlvbiAyKSBi ZWxvdywgdGhhdCBpcyBhbGxvdyBtdWx0aXBsZSBlbnRyaWVzIHdpdGggdGhlIHNhbWUgY2FwYWJp bGl0eSB0eXBlLg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBG Q0kgdXNlIGNhc2UgbWF5IGFyZ3VlIHRoYXQgd2UgZXh0ZW5kIHRoZSBpbmNyZW1lbnRhbCB1cGRh dGUgdy8gSlNPTiBQYXRjaCwgdG8gYmV0dGVyIGhhbmRsZSBhcnJheXMsIHJpZ2h0IGF3YXkuPG86 cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbmRlZWQu IERvIHlvdSB3YW50IHRvIGNob29zZSBvbmUgb2YgdGhlIHR3byAoSlNPTiBQYXRjaCB2cy4gSlNP TiBNZXJnZSBQYXRjaCkgb3IgZG8geW91IHRoaW5rIG9mIG1ha2luZyBKU09OIE1lcmdlIFBhdGNo IG1hbmRhdG9yeSBhbmQgSlNPTiBQYXRjaCBvcHRpb25hbCBhbmQgdGhlbiB3ZSBzYXkgaW4gdGhl IEFMVE8gRkNJIHNlcnZpY2Ugc3BlY2lmaWNhdGlvbiB0aGF0IHRoaXMgb25lIGRlbWFuZHMgSlNP Tg0KIFBhdGNoIChhcyBwZWNpZmllZCBpbiB0aGUgQUxUTyBpbmNyLiB1cGRhdGVzKT88bzpwPjwv bzpwPjwvcD4NCjxwPiZuYnNwOy0gSmFuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biAwMy4wNy4xNyAxMzo1OSwgWS4gUmljaGFyZCBZYW5nIHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgSmFuLCBKb24s IEtldmluLCBhbGwsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+QXMgd2UgYXJlIHdvcmtpbmcg b24gdGhlIGRlc2lnbiwgYSBrZXkgaXNzdWUgdGhhdCB3ZSBhcmUgdHJ5aW5nIHRvIHVuZGVyc3Rh bmQgaXMgdGhlIGNvbmZsaWN0IHJlc29sdXRpb24gb2YgdGhlIGNhcGFiaWxpdGllcyBpbiB0aGUg JnF1b3Q7Y2FwYWJpbGl0aWVzJnF1b3Q7IGxpc3QgW1JGQzgwMDhdLiBDb25zaWRlcjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyZxdW90O2NhcGFiaWxpdGllcyZxdW90OzogWzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2NhcGFiaWxpdHktdHlwZSZx dW90OzogJnF1b3Q7RkNJLkRlbGl2ZXJ5UHJvdG9jb2wmcXVvdDssPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7Y2FwYWJpbGl0eS12YWx1ZSZxdW90OzogezxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtkZWxpdmVyeS1wcm90b2NvbHMmcXVvdDs6IFs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2h0dHAvMS4x JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtdPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7fSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtm b290cHJpbnRzJnF1b3Q7OiBbPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZs dDtGb290cHJpbnQgb2JqZWN0cyAxJmd0OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO108 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwO30sPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ezxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2NhcGFiaWxpdHktdHlwZSZxdW90Ozog JnF1b3Q7RkNJLkRlbGl2ZXJ5UHJvdG9jb2wmcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7JnF1b3Q7Y2FwYWJpbGl0eS12YWx1ZSZxdW90OzogezxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtkZWxpdmVyeS1wcm90b2NvbHMmcXVvdDs6IFs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2h0dHAvMS4wJnF1b3Q7 LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtdPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7fSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtmb290cHJp bnRzJnF1b3Q7OiBbPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZsdDtGb290 cHJpbnQgb2JqZWN0cyAyJmd0OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO108bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsg Jm5ic3A7XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgJm5ic3A7fSZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5XaGF0IGlmIHRoZSBmb290cHJpbnRzIGluIHRoZSB0d28gZW50cmllcyBo YXZlIG92ZXJsYXA/IEkgc2VlIHR3byBvcHRpb25zOg0KPGJyPg0KKDEpIEVuZm9yY2UgdGhhdCBl YWNoIGNhcGFiaWxpdHktdHlwZSBoYXMgYSBzaW5nbGUgZW50cnk7IHRoYXQgaXMsIG1ha2UgY2Fw YWJpbGl0eS10eXBlIGEga2V5OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+KDIpIEFsbG93IG11bHRpcGxlIGVudHJpZXMgd2l0aCB0aGUgc2FtZSBj YXBhYmlsaXR5LXR5cGUsIGFuZCB0aGUgc2VhcmNoIGlzIG9yZGVyZWQgYnkgdGhlIGFycmF5OyB0 aGF0IGlzLCB0aGUgcmVzdWx0IGlzIHRoZSBmaXJzdCBtYXRjaGluZyBmb290cHJpbnRzLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFzc3Vt ZSZuYnNwO3RoYXQgKDIpIGlzIG1vcmUgZmxleGlibGUuIEFuJm5ic3A7aXNzdWUsIGhvd2V2ZXIs IGlzIHRoYXQgaXQgbWFrZXMmbmJzcDtpbmNyZW1lbnRhbCB1cGRhdGVzIGhhcmRlci4gSW4gb3Ro ZXIgd29yZHMsIHRoaXMgaXNzdWUgd2lsbCBkZXRlcm1pbmUgd2hldGhlciB3ZSBzaG91bGQgaW50 ZWdyYXRlIEpTT04gUGF0Y2guIFRoZSBjdXJyZW50IGFsdG8gaW5jcmVtZW50YWwgdXBkYXRlcywg YmFzZWQgb24gU1NFIGFuZA0KIEpTT04gTWVyZ2UgUGF0Y2gsIGlzIHByZXR0eSB1c2VmdWwuIFRo ZSBGQ0kgdXNlIGNhc2UgbWF5IGFyZ3VlIHRoYXQgd2UgZXh0ZW5kIHRoZSBpbmNyZW1lbnRhbCB1 cGRhdGUgdy8gSlNPTiBQYXRjaCwgdG8gYmV0dGVyIGhhbmRsZSBhcnJheXMsIHJpZ2h0IGF3YXku PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFu eSBjbGFyaWZpY2F0aW9uLCBjb21tZW50cyBhbmQgc3VnZ2VzdGlvbnMgd2lsbCBiZSBncmVhdC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Umlj aGFyZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cHJlPi0tIDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPioqKioqKioqKioqKioqKioqKioqKioqKioqKio8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT5Qcm9mLiBEci4gSmFuIFNlZWRvcmY8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT48YSBocmVmPSJtYWlsdG86amFuLnNlZWRvcmZAaGZ0LXN0dXR0Z2FydC5kZSI+amFuLnNl ZWRvcmZAaGZ0LXN0dXR0Z2FydC5kZTwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4qKioqKioq KioqKioqKioqKioqKioqKioqKioqPG86cD48L286cD48L3ByZT4NCjxwcmU+SG9jaHNjaHVsZSBm w7xyIFRlY2huaWsgU3R1dHRnYXJ0PG86cD48L286cD48L3ByZT4NCjxwcmU+RmFrdWx0w6R0IFZl cm1lc3N1bmcsIEluZm9ybWF0aWsgdW5kIE1hdGhlbWF0aWs8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT5TY2hlbGxpbmdzdHIuIDI0PG86cD48L286cD48L3ByZT4NCjxwcmU+RC03MDE3NCBTdHV0dGdh cnQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48YSBocmVmPSJodHRwOi8vd3d3LmhmdC1zdHV0dGdh cnQuZGUiPnd3dy5oZnQtc3R1dHRnYXJ0LmRlPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPioq KioqKioqKioqKioqKioqKioqKioqKioqKiogPG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A419F67F880AB2468214E154CB8A5562222E0D34eusaamb103erics_-- From nobody Mon Jul 3 10:32:09 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E96A81316D5 for ; Mon, 3 Jul 2017 10:32:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.399 X-Spam-Level: X-Spam-Status: No, score=-5.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-2.8, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jp5DuJDJVjZ5 for ; Mon, 3 Jul 2017 10:31:53 -0700 (PDT) Received: from relais-inet.orange.com (mta136.mail.business.static.orange.com [80.12.70.36]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70F591316D3 for ; Mon, 3 Jul 2017 10:31:41 -0700 (PDT) Received: from opfednr06.francetelecom.fr (unknown [xx.xx.xx.70]) by opfednr24.francetelecom.fr (ESMTP service) with ESMTP id F0BB64019F for ; Mon, 3 Jul 2017 19:31:39 +0200 (CEST) Received: from Exchangemail-eme2.itn.ftgroup (unknown [xx.xx.31.18]) by opfednr06.francetelecom.fr (ESMTP service) with ESMTP id 814AE1A006E for ; Mon, 3 Jul 2017 19:31:34 +0200 (CEST) Received: from OPEXCLILMA1.corporate.adroot.infra.ftgroup ([fe80::95e2:eb4b:3053:fabf]) by OPEXCLILM34.corporate.adroot.infra.ftgroup ([fe80::cba:56d0:a732:ef5a%19]) with mapi id 14.03.0352.000; Mon, 3 Jul 2017 19:31:34 +0200 From: To: "cdni@ietf.org" Thread-Topic: New Version Notification for draft-fieau-cdni-interfaces-https-delegation-01.txt Thread-Index: AQHS9CGJrDT5uMy+WEef4UCssDRxnKJCWzJw Date: Mon, 3 Jul 2017 17:31:33 +0000 Message-ID: <5860_1499103099_595A7F7B_5860_500_1_1BD328329726EF4E91AE924BB1B4CB9E3E84270F@OPEXCLILMA1.corporate.adroot.infra.ftgroup> References: <149910280042.22816.17102479727457905050.idtracker@ietfa.amsl.com> In-Reply-To: <149910280042.22816.17102479727457905050.idtracker@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.168.234.1] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [CDNi] TR: New Version Notification for draft-fieau-cdni-interfaces-https-delegation-01.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 17:32:02 -0000 SGksDQoNCkp1c3QgcG9zdGVkIGEgcHJvcG9zYWwgdG8gdXBkYXRlIG1ldGFkYXRhIEludGVyZmFj ZSB0byBzdXBwb3J0IEhUVFBTIGRlbGVnYXRpb24gaW4gQ0ROSS4NCg0KaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LWZpZWF1LWNkbmktaW50ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9u LTAxDQoNCkFic3RyYWN0Og0KICAgVGhlIGRlbGl2ZXJ5IG9mIGNvbnRlbnQgb3ZlciBIVFRQUyBp bnZvbHZpbmcgbXVsdGlwbGUgQ0ROcyByYWlzZXMNCiAgIGNyZWRlbnRpYWwgbWFuYWdlbWVudCBp c3N1ZXMuICBUaGlzIGRvY3VtZW50IHJlY2FsbHMgdGhlIG1ldGhvZHMNCiAgIHVuZGVyIHN0dWR5 IGF0IHRoZSBJRVRGLiAgVGhlbiBpdCBzcGVjaWZpZXMgdGhlIHVwZGF0ZXMgbmVlZGVkIGluDQog ICBDRE5JIENvbnRyb2wgYW5kIE1ldGFkYXRhIGludGVyZmFjZXMgdG8gc2V0dXAgSFRUUFMgZGVs ZWdhdGlvbg0KICAgYmV0d2VlbiBhbiB1Q0ROIGFuZCBkQ0ROLg0KDQpGcsOpZMOpcmljDQoNCg0K LS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tDQpEZcKgOiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5v cmcgW21haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmddIA0KRW52b3nDqcKgOiBsdW5kaSAz IGp1aWxsZXQgMjAxNyAxOToyNw0Kw4DCoDogU2FuamF5IE1pc2hyYTsgU1RFUEhBTiBFbWlsZSBJ TVQvT0xOOyBTVEVQSEFOIEVtaWxlIElNVC9PTE47IEZJRUFVIEZyw6lkw6lyaWMgSU1UL09MTg0K T2JqZXTCoDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC1maWVhdS1jZG5pLWlu dGVyZmFjZXMtaHR0cHMtZGVsZWdhdGlvbi0wMS50eHQNCg0KDQpBIG5ldyB2ZXJzaW9uIG9mIEkt RCwgZHJhZnQtZmllYXUtY2RuaS1pbnRlcmZhY2VzLWh0dHBzLWRlbGVnYXRpb24tMDEudHh0DQpo YXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IEZyZWRlcmljIEZpZWF1IGFuZCBwb3N0 ZWQgdG8gdGhlIElFVEYgcmVwb3NpdG9yeS4NCg0KTmFtZToJCWRyYWZ0LWZpZWF1LWNkbmktaW50 ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9uDQpSZXZpc2lvbjoJMDENClRpdGxlOgkJQ0ROSSBpbnRl cmZhY2VzIHVwZGF0ZSBmb3IgSFRUUFMgZGVsZWdhdGlvbg0KRG9jdW1lbnQgZGF0ZToJMjAxNy0w Ny0wMw0KR3JvdXA6CQlJbmRpdmlkdWFsIFN1Ym1pc3Npb24NClBhZ2VzOgkJMTANClVSTDogICAg ICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtZmllYXUt Y2RuaS1pbnRlcmZhY2VzLWh0dHBzLWRlbGVnYXRpb24tMDEudHh0DQpTdGF0dXM6ICAgICAgICAg aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtZmllYXUtY2RuaS1pbnRlcmZh Y2VzLWh0dHBzLWRlbGVnYXRpb24vDQpIdG1saXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LWZpZWF1LWNkbmktaW50ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9uLTAx DQpIdG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9k cmFmdC1maWVhdS1jZG5pLWludGVyZmFjZXMtaHR0cHMtZGVsZWdhdGlvbi0wMQ0KRGlmZjogICAg ICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1maWVhdS1jZG5p LWludGVyZmFjZXMtaHR0cHMtZGVsZWdhdGlvbi0wMQ0KDQpBYnN0cmFjdDoNCiAgIFRoZSBkZWxp dmVyeSBvZiBjb250ZW50IG92ZXIgSFRUUFMgaW52b2x2aW5nIG11bHRpcGxlIENETnMgcmFpc2Vz DQogICBjcmVkZW50aWFsIG1hbmFnZW1lbnQgaXNzdWVzLiAgVGhpcyBkb2N1bWVudCByZWNhbGxz IHRoZSBtZXRob2RzDQogICB1bmRlciBzdHVkeSBhdCB0aGUgSUVURi4gIFRoZW4gaXQgc3BlY2lm aWVzIHRoZSB1cGRhdGVzIG5lZWRlZCBpbg0KICAgQ0ROSSBDb250cm9sIGFuZCBNZXRhZGF0YSBp bnRlcmZhY2VzIHRvIHNldHVwIEhUVFBTIGRlbGVnYXRpb24NCiAgIGJldHdlZW4gYW4gdUNETiBh bmQgZENETi4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KDQoNClBsZWFzZSBub3RlIHRo YXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1p c3Npb24gdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBh dCB0b29scy5pZXRmLm9yZy4NCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0KCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNl IG1lc3NhZ2UgZXQgc2VzIHBpZWNlcyBqb2ludGVzIHBldXZlbnQgY29udGVuaXIgZGVzIGluZm9y bWF0aW9ucyBjb25maWRlbnRpZWxsZXMgb3UgcHJpdmlsZWdpZWVzIGV0IG5lIGRvaXZlbnQgZG9u YwpwYXMgZXRyZSBkaWZmdXNlcywgZXhwbG9pdGVzIG91IGNvcGllcyBzYW5zIGF1dG9yaXNhdGlv bi4gU2kgdm91cyBhdmV6IHJlY3UgY2UgbWVzc2FnZSBwYXIgZXJyZXVyLCB2ZXVpbGxleiBsZSBz aWduYWxlcgphIGwnZXhwZWRpdGV1ciBldCBsZSBkZXRydWlyZSBhaW5zaSBxdWUgbGVzIHBpZWNl cyBqb2ludGVzLiBMZXMgbWVzc2FnZXMgZWxlY3Ryb25pcXVlcyBldGFudCBzdXNjZXB0aWJsZXMg ZCdhbHRlcmF0aW9uLApPcmFuZ2UgZGVjbGluZSB0b3V0ZSByZXNwb25zYWJpbGl0ZSBzaSBjZSBt ZXNzYWdlIGEgZXRlIGFsdGVyZSwgZGVmb3JtZSBvdSBmYWxzaWZpZS4gTWVyY2kuCgpUaGlzIG1l c3NhZ2UgYW5kIGl0cyBhdHRhY2htZW50cyBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgb3IgcHJp dmlsZWdlZCBpbmZvcm1hdGlvbiB0aGF0IG1heSBiZSBwcm90ZWN0ZWQgYnkgbGF3Owp0aGV5IHNo b3VsZCBub3QgYmUgZGlzdHJpYnV0ZWQsIHVzZWQgb3IgY29waWVkIHdpdGhvdXQgYXV0aG9yaXNh dGlvbi4KSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgcGxlYXNlIG5v dGlmeSB0aGUgc2VuZGVyIGFuZCBkZWxldGUgdGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVu dHMuCkFzIGVtYWlscyBtYXkgYmUgYWx0ZXJlZCwgT3JhbmdlIGlzIG5vdCBsaWFibGUgZm9yIG1l c3NhZ2VzIHRoYXQgaGF2ZSBiZWVuIG1vZGlmaWVkLCBjaGFuZ2VkIG9yIGZhbHNpZmllZC4KVGhh bmsgeW91LgoK From nobody Mon Jul 3 11:10:37 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCF4E12EC5C for ; Mon, 3 Jul 2017 11:10:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cBKHzAjM4kG9 for ; Mon, 3 Jul 2017 11:10:32 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 696A21296CF for ; Mon, 3 Jul 2017 11:10:32 -0700 (PDT) X-AuditID: c6180641-befff70000001788-93-595a4237bf06 Received: from EUSAAHC004.ericsson.se (Unknown_Domain [147.117.188.84]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id E5.31.06024.7324A595; Mon, 3 Jul 2017 15:10:15 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC004.ericsson.se ([147.117.188.84]) with mapi id 14.03.0352.000; Mon, 3 Jul 2017 14:10:30 -0400 From: Kevin Ma J To: "frederic.fieau@orange.com" , "cdni@ietf.org" Thread-Topic: New Version Notification for draft-fieau-cdni-interfaces-https-delegation-01.txt Thread-Index: AQHS9CGJrDT5uMy+WEef4UCssDRxnKJCWzJwgAADwYA= Date: Mon, 3 Jul 2017 18:10:30 +0000 Message-ID: References: <149910280042.22816.17102479727457905050.idtracker@ietfa.amsl.com> <5860_1499103099_595A7F7B_5860_500_1_1BD328329726EF4E91AE924BB1B4CB9E3E84270F@OPEXCLILMA1.corporate.adroot.infra.ftgroup> In-Reply-To: <5860_1499103099_595A7F7B_5860_500_1_1BD328329726EF4E91AE924BB1B4CB9E3E84270F@OPEXCLILMA1.corporate.adroot.infra.ftgroup> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrELMWRmVeSWpSXmKPExsUyuXRPiK65U1SkwfK96hZPZ/9htZi5ahGL A5PHkiU/mTxanp1kC2CK4rJJSc3JLEst0rdL4MpYsCS54J1Jxdvzl1kbGA8YdzFyckgImEhc P/SNsYuRi0NI4CijxOyXv9kgnGWMEq86l7KCVLEJaEk8/vqXCcQWEYiTaN7WBWYLC8RLnNi4 iQUiniBx7PM25i5GDiDbSuLjFhWQMIuAisTHCxPBxvAK+Eqc+PqQCWL+KUaJzv7rYA6nQBuj xImr+9hAqhgFxCS+n1oDtoBZQFzi1pP5TBCnCkgs2XOeGcIWlXj5+B8rhK0osa9/OjvIYmYB TYn1u/QhWhUlpnQ/ZIdYLChxcuYTlgmMIrOQTJ2F0DELSccsJB0LGFlWMXKUFhfk5KYbGW5i BIb8MQk2xx2Me3s9DzEKcDAq8fAmWUdFCrEmlhVX5h5ilOBgVhLhFWsBCvGmJFZWpRblxxeV 5qQWH2KU5mBREud9V34hQkggPbEkNTs1tSC1CCbLxMEp1cC4ea2M27SJtuJiv76c3sGn3GXH fWSlu8zb3EcfF71u2m/Mm+9yK5nhxg7H5nUs2temOS5e98HJwSsxI+bDvS1+Wf+LU77X2KQ0 L9zu0Pfs2BXr9CoO+ZXHT3WlNvBkxAudjd2w5++9PvMP0Y1RjZHJpzxEa58WNprrGWbPT/vb Ez27k0E0oVCJpTgj0VCLuag4EQD3Oc3AdQIAAA== Archived-At: Subject: Re: [CDNi] New Version Notification for draft-fieau-cdni-interfaces-https-delegation-01.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jul 2017 18:10:35 -0000 SGkgRnJlZGVyaWMsDQoNCiAgKGFzIGFuIGluZGl2aWR1YWwpIEkgaGFkIGEgcXVpY2sgcmVhZCB0 aHJvdWdoIHRoZSB1cGRhdGVkIGRyYWZ0LiAgSSdtIG5vdCBzdXJlIHdoeSB5b3UgbmVlZCB0aGUg U2VjdXJlZERlbGVnYXRpb24gb2JqZWN0PyAgSSB3b3VsZCBleHBlY3QgdGhlIGRlbGVnYXRlZGRv bWFpbiB0byBqdXN0IGJlIGFuIGFjdHVhbCBIb3N0TWF0Y2ggb2JqZWN0LCBhZ2FpbnN0IHdoaWNo IHRoZSBjbGllbnQgcmVxdWVzdCB3b3VsZCBiZSBtYXRjaGVkLCBpbiBvcmRlciB0byBmaW5kIHRo ZSByZWxldmFudCBQYXRoTWF0Y2ggaGllcmFyY2h5LiAgSSB3b3VsZCBmdXJ0aGVyIGV4cGVjdCB0 aGUgU2VjdXJlZERlbGVnYXRpb24gb2JqZWN0IHRvIGp1c3QgYmUgcGFydCBvZiB0aGUgUGF0aE1l dGFkYXRhIGFzc29jaWF0ZWQgd2l0aCBhbiBhbHJlYWR5IGV4aXN0aW5nIFBhdGhNYXRjaCAoZm91 bmQgdmlhIHRoZSBIb3N0TWF0Y2gsIGFuZCBjb250YWluaW5nIHRoZSBwYXRocGF0dGVybiksIGFu ZCB0aGF0IHRoZSB0aW1ld2luZG93IHdvdWxkIGp1c3QgYmUgYSBUaW1lV2luZG93QUNMIGdlbmVy aWMgbWV0YWRhdGEgb2JqZWN0IGluIHRoZSBzYW1lIFBhdGhNZXRhZGF0YSBsaXN0L2hpZXJhcmNo eSBhcyB0aGUgU2VjdXJlZERlbGVnYXRpb24gb2JqZWN0PyAgVGhhdCB3b3VsZCBsZWF2ZSBvbmx5 IHRoZSBkZWxlZ2F0aW9ubWV0aG9kIHByb3BlcnR5IG9mIFNlY3VyZWREZWxlZ2F0aW9uIG9iamVj dDsgYnV0IEkgZG9uJ3Qgc2VlIGEgcG9pbnQgaW4gaGF2aW5nIHRoZSBTZWN1cmVkRGVsZWdhdGlv biBvYmplY3QsIGp1c3QgdG8gc2F5IHRoYXQgYW5vdGhlciBnZW5lcmljIG1ldGFkYXRhIG9iamVj dCBleGlzdHMgKGUuZy4sIEFjbWVTdGFyRGVsZWdhdGlvbk1ldGhvZCkuDQoNCiAgSSBoYXZlIG5v dCByZWFkIHRoZSBBQ01FIFNUQVIgZHJhZnQsIGJ1dCBhc3N1bWluZyB0aGUgQWNtZVN0YXJEZWxl Z2F0aW9uTWV0aG9kIG9iamVjdCBoYXMgYWxsIHRoZSBuZWNlc3NhcnkgaW5mb3JtYXRpb24sIHRo ZSBBY21lU3RhckRlbGVnYXRpb25NZXRob2Qgb2JqZWN0IG1pZ2h0IGJlIGEgdXNlZnVsIGV4dGVu c2lvbiB0byBDRE5JLg0KDQp0aGFueC4NCg0KLS0gIEtldmluIEouIE1hDQoNCj4gLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogQ0ROaSBbbWFpbHRvOmNkbmktYm91bmNlc0BpZXRm Lm9yZ10gT24gQmVoYWxmIE9mDQo+IGZyZWRlcmljLmZpZWF1QG9yYW5nZS5jb20NCj4gU2VudDog TW9uZGF5LCBKdWx5IDAzLCAyMDE3IDE6MzIgUE0NCj4gVG86IGNkbmlAaWV0Zi5vcmcNCj4gU3Vi amVjdDogW0NETmldIFRSOiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LWZpZWF1 LWNkbmktDQo+IGludGVyZmFjZXMtaHR0cHMtZGVsZWdhdGlvbi0wMS50eHQNCj4gDQo+IEhpLA0K PiANCj4gSnVzdCBwb3N0ZWQgYSBwcm9wb3NhbCB0byB1cGRhdGUgbWV0YWRhdGEgSW50ZXJmYWNl IHRvIHN1cHBvcnQgSFRUUFMNCj4gZGVsZWdhdGlvbiBpbiBDRE5JLg0KPiANCj4gaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWZpZWF1LWNkbmktaW50ZXJmYWNlcy1odHRwcy1kZWxl Z2F0aW9uLQ0KPiAwMQ0KPiANCj4gQWJzdHJhY3Q6DQo+ICAgIFRoZSBkZWxpdmVyeSBvZiBjb250 ZW50IG92ZXIgSFRUUFMgaW52b2x2aW5nIG11bHRpcGxlIENETnMgcmFpc2VzDQo+ICAgIGNyZWRl bnRpYWwgbWFuYWdlbWVudCBpc3N1ZXMuICBUaGlzIGRvY3VtZW50IHJlY2FsbHMgdGhlIG1ldGhv ZHMNCj4gICAgdW5kZXIgc3R1ZHkgYXQgdGhlIElFVEYuICBUaGVuIGl0IHNwZWNpZmllcyB0aGUg dXBkYXRlcyBuZWVkZWQgaW4NCj4gICAgQ0ROSSBDb250cm9sIGFuZCBNZXRhZGF0YSBpbnRlcmZh Y2VzIHRvIHNldHVwIEhUVFBTIGRlbGVnYXRpb24NCj4gICAgYmV0d2VlbiBhbiB1Q0ROIGFuZCBk Q0ROLg0KPiANCj4gRnLDqWTDqXJpYw0KPiANCj4gDQo+IC0tLS0tTWVzc2FnZSBkJ29yaWdpbmUt LS0tLQ0KPiBEZcKgOiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmcgW21haWx0bzppbnRlcm5ldC1k cmFmdHNAaWV0Zi5vcmddDQo+IEVudm95w6nCoDogbHVuZGkgMyBqdWlsbGV0IDIwMTcgMTk6MjcN Cj4gw4DCoDogU2FuamF5IE1pc2hyYTsgU1RFUEhBTiBFbWlsZSBJTVQvT0xOOyBTVEVQSEFOIEVt aWxlIElNVC9PTE47IEZJRUFVDQo+IEZyw6lkw6lyaWMgSU1UL09MTg0KPiBPYmpldMKgOiBOZXcg VmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LWZpZWF1LWNkbmktaW50ZXJmYWNlcy1odHRw cy0NCj4gZGVsZWdhdGlvbi0wMS50eHQNCj4gDQo+IA0KPiBBIG5ldyB2ZXJzaW9uIG9mIEktRCwg ZHJhZnQtZmllYXUtY2RuaS1pbnRlcmZhY2VzLWh0dHBzLWRlbGVnYXRpb24tMDEudHh0DQo+IGhh cyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkgRnJlZGVyaWMgRmllYXUgYW5kIHBvc3Rl ZCB0byB0aGUgSUVURg0KPiByZXBvc2l0b3J5Lg0KPiANCj4gTmFtZToJCWRyYWZ0LWZpZWF1LWNk bmktaW50ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9uDQo+IFJldmlzaW9uOgkwMQ0KPiBUaXRsZToJ CUNETkkgaW50ZXJmYWNlcyB1cGRhdGUgZm9yIEhUVFBTIGRlbGVnYXRpb24NCj4gRG9jdW1lbnQg ZGF0ZToJMjAxNy0wNy0wMw0KPiBHcm91cDoJCUluZGl2aWR1YWwgU3VibWlzc2lvbg0KPiBQYWdl czoJCTEwDQo+IFVSTDogICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1k cmFmdHMvZHJhZnQtZmllYXUtY2RuaS0NCj4gaW50ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9uLTAx LnR4dA0KPiBTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2Mv ZHJhZnQtZmllYXUtY2RuaS0NCj4gaW50ZXJmYWNlcy1odHRwcy1kZWxlZ2F0aW9uLw0KPiBIdG1s aXplZDogICAgICAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWZpZWF1LWNkbmkt aW50ZXJmYWNlcy0NCj4gaHR0cHMtZGVsZWdhdGlvbi0wMQ0KPiBIdG1saXplZDogICAgICAgaHR0 cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1maWVhdS1jZG5pLQ0KPiBp bnRlcmZhY2VzLWh0dHBzLWRlbGVnYXRpb24tMDENCj4gRGlmZjogICAgICAgICAgIGh0dHBzOi8v d3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1maWVhdS1jZG5pLQ0KPiBpbnRlcmZhY2Vz LWh0dHBzLWRlbGVnYXRpb24tMDENCj4gDQo+IEFic3RyYWN0Og0KPiAgICBUaGUgZGVsaXZlcnkg b2YgY29udGVudCBvdmVyIEhUVFBTIGludm9sdmluZyBtdWx0aXBsZSBDRE5zIHJhaXNlcw0KPiAg ICBjcmVkZW50aWFsIG1hbmFnZW1lbnQgaXNzdWVzLiAgVGhpcyBkb2N1bWVudCByZWNhbGxzIHRo ZSBtZXRob2RzDQo+ICAgIHVuZGVyIHN0dWR5IGF0IHRoZSBJRVRGLiAgVGhlbiBpdCBzcGVjaWZp ZXMgdGhlIHVwZGF0ZXMgbmVlZGVkIGluDQo+ICAgIENETkkgQ29udHJvbCBhbmQgTWV0YWRhdGEg aW50ZXJmYWNlcyB0byBzZXR1cCBIVFRQUyBkZWxlZ2F0aW9uDQo+ICAgIGJldHdlZW4gYW4gdUNE TiBhbmQgZENETi4NCj4gDQo+IA0KPiANCj4gDQo+IFBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRh a2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mDQo+IHN1Ym1pc3Npb24gdW50 aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdA0KPiB0b29s cy5pZXRmLm9yZy4NCj4gDQo+IFRoZSBJRVRGIFNlY3JldGFyaWF0DQo+IA0KPiANCj4gX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCj4gDQo+IENlIG1lc3NhZ2UgZXQgc2VzIHBpZWNlcyBqb2ludGVzIHBldXZlbnQgY29u dGVuaXIgZGVzIGluZm9ybWF0aW9ucw0KPiBjb25maWRlbnRpZWxsZXMgb3UgcHJpdmlsZWdpZWVz IGV0IG5lIGRvaXZlbnQgZG9uYw0KPiBwYXMgZXRyZSBkaWZmdXNlcywgZXhwbG9pdGVzIG91IGNv cGllcyBzYW5zIGF1dG9yaXNhdGlvbi4gU2kgdm91cyBhdmV6DQo+IHJlY3UgY2UgbWVzc2FnZSBw YXIgZXJyZXVyLCB2ZXVpbGxleiBsZSBzaWduYWxlcg0KPiBhIGwnZXhwZWRpdGV1ciBldCBsZSBk ZXRydWlyZSBhaW5zaSBxdWUgbGVzIHBpZWNlcyBqb2ludGVzLiBMZXMgbWVzc2FnZXMNCj4gZWxl Y3Ryb25pcXVlcyBldGFudCBzdXNjZXB0aWJsZXMgZCdhbHRlcmF0aW9uLA0KPiBPcmFuZ2UgZGVj bGluZSB0b3V0ZSByZXNwb25zYWJpbGl0ZSBzaSBjZSBtZXNzYWdlIGEgZXRlIGFsdGVyZSwgZGVm b3JtZSBvdQ0KPiBmYWxzaWZpZS4gTWVyY2kuDQo+IA0KPiBUaGlzIG1lc3NhZ2UgYW5kIGl0cyBh dHRhY2htZW50cyBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgb3IgcHJpdmlsZWdlZA0KPiBpbmZv cm1hdGlvbiB0aGF0IG1heSBiZSBwcm90ZWN0ZWQgYnkgbGF3Ow0KPiB0aGV5IHNob3VsZCBub3Qg YmUgZGlzdHJpYnV0ZWQsIHVzZWQgb3IgY29waWVkIHdpdGhvdXQgYXV0aG9yaXNhdGlvbi4NCj4g SWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0 aGUgc2VuZGVyIGFuZA0KPiBkZWxldGUgdGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMu DQo+IEFzIGVtYWlscyBtYXkgYmUgYWx0ZXJlZCwgT3JhbmdlIGlzIG5vdCBsaWFibGUgZm9yIG1l c3NhZ2VzIHRoYXQgaGF2ZSBiZWVuDQo+IG1vZGlmaWVkLCBjaGFuZ2VkIG9yIGZhbHNpZmllZC4N Cj4gVGhhbmsgeW91Lg0KPiANCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCj4gQ0ROaSBtYWlsaW5nIGxpc3QNCj4gQ0ROaUBpZXRmLm9yZw0KPiBodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCg== From nobody Tue Jul 4 03:59:29 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B732C131EB8 for ; Tue, 4 Jul 2017 03:59:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id epg01sGsLGWQ for ; Tue, 4 Jul 2017 03:59:24 -0700 (PDT) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id 81F42131EB2 for ; Tue, 4 Jul 2017 03:59:24 -0700 (PDT) Received: from [176.24.45.127] (helo=[192.168.0.4]) by smtp04.mailcore.me with esmtpa (Exim 4.89) (envelope-from ) id 1dSLXn-0003so-86; Tue, 04 Jul 2017 11:59:23 +0100 Content-Type: multipart/alternative; boundary="Apple-Mail=_85430319-FABD-4005-A774-E01BE51A9F78" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Ben Niven-Jenkins In-Reply-To: Date: Tue, 4 Jul 2017 11:58:56 +0100 Cc: "cdni@ietf.org" Message-Id: <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> To: Phil Sorber X-Mailer: Apple Mail (2.2098) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 X-KLMS-Rule-ID: 1 X-KLMS-Message-Action: clean X-KLMS-AntiSpam-Status: not scanned, license restriction X-KLMS-AntiPhishing: not scanned, license restriction X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.721, bases: 2017/07/04 03:45:00 #9957388 X-KLMS-AntiVirus-Status: Clean, skipped Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jul 2017 10:59:28 -0000 --Apple-Mail=_85430319-FABD-4005-A774-E01BE51A9F78 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Phil & URI Signing authors, I read the latest draft (-12) and below are some questions / thoughts, = in no particular order, that occurred to me while reading the document. * Why support both symmetric & asymmetric keys? What is the advantage to = having both options versus just picking one option (probably asymmetric = keys as they work for all use cases)? * How are the keys distributed between CDNs? I don=E2=80=99t see a = property in the UriSigning Metadata object that would include (or link = to) the keys (I=E2=80=99m assuming you need to support distribution of = at least 2 keys to support key rotation)? * How does a uCDN know whether it is OK/safe/within policy to = re-distribute symmetric keys to a dCDN? * In the case of Signed Token chains, how does a CDN obtain the keys = required to sign the new tokens in the chain as it generates them? * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t know = how one could communicate a token chain via the query string as = specified in the document, as there is no =E2=80=9Cback channel=E2=80=9D = for the CDN to communicate the next token in the chain to the UA. HTH Ben > On 25 Jun 2017, at 21:19, Phil Sorber wrote: >=20 > Really hoping to get some feedback on this at the meeting in Prague. = It's got all the changes that have been discussed so I'm not aware of = any more substantive changes needed. However, lots of editorial nits I = suspect. >=20 > Thanks. >=20 > On Sun, Jun 25, 2017 at 2:12 PM > wrote: >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Content Delivery Networks = Interconnection of the IETF. >=20 > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 >=20 > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. >=20 > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ = >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 = > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 = >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 = >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org = . >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ = >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni --Apple-Mail=_85430319-FABD-4005-A774-E01BE51A9F78 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Phil & URI Signing authors,

I read the latest draft (-12) and below = are some questions / thoughts, in no particular order, that occurred to = me while reading the document.

* Why support both symmetric & = asymmetric keys? What is the advantage to having both options versus = just picking one option (probably asymmetric keys as they work for all = use cases)?

* = How are the keys distributed between CDNs? I don=E2=80=99t see a = property in the UriSigning Metadata object that would include (or link = to) the keys (I=E2=80=99m assuming you need to support distribution of = at least 2 keys to support key rotation)?

* How does a uCDN know whether it is = OK/safe/within policy to re-distribute symmetric keys to a = dCDN?

* In the = case of Signed Token chains, how does a CDN obtain the keys required to = sign the new tokens in the chain as it generates them?

* Section 3.3.1 I think = needs to be more explicit, I don=E2=80=99t know how one could = communicate a token chain via the query string as specified in the = document, as there is no =E2=80=9Cback channel=E2=80=9D for the CDN to = communicate the next token in the chain to the UA.

HTH
Ben

On 25 Jun 2017, at 21:19, Phil = Sorber <sorber@apache.org> wrote:

Really hoping to get some feedback on this at = the meeting in Prague. It's got all the changes that have been discussed = so I'm not aware of any more substantive changes needed. However, lots = of editorial nits I suspect.

Thanks.

On Sun, Jun 25, 2017 = at 2:12 PM <internet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts = directories.
This draft is a work item of the Content Delivery Networks = Interconnection of the IETF.

        Title          =  : URI Signing for CDN Interconnection (CDNI)
        Authors         : = Ray van Brandenburg
                    =       Kent Leung
                    =       Phil Sorber
        Filename        : = draft-ietf-cdni-uri-signing-12.txt
        Pages          =  : 35
        Date          =   : 2017-06-25

Abstract:
   This document describes how the concept of URI signing = supports the
   content access control requirements of CDNI and proposes a = URI
   signing method as a JSON Web Token (JWT) [RFC7519] = profile.

   The proposed URI signing method specifies the information = needed to
   be included in the URI to transmit the signed JWT as well = as the
   claims needed by the signed JWT to authorize a UA.  = The mechanism
   described can be used both in CDNI and single CDN = scenarios.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12<= br class=3D""> https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signi= ng-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing= -12


Please note that it may take a couple of minutes from the time of = submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni
_______________________________________________
CDNi = mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

= --Apple-Mail=_85430319-FABD-4005-A774-E01BE51A9F78-- From nobody Wed Jul 5 14:23:26 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C0F5131DE0 for ; Wed, 5 Jul 2017 14:23:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.521 X-Spam-Level: X-Spam-Status: No, score=-14.521 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hW_q4t0sW4-c for ; Wed, 5 Jul 2017 14:23:20 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 358391316A5 for ; Wed, 5 Jul 2017 14:23:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=31088; q=dns/txt; s=iport; t=1499289800; x=1500499400; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=oRA5zk5nyH+wFJewXBYxS4rTFipr45K19VWD8VqpISU=; b=SHVleXdU6X0+0pzgEFMnYr5POSMN3gC8CfbRqVrK0Rix+2EuDviuZFzz hkqSko3MVT4CqJmjDS+ZNjGfGstUA2RaO8z2w1ZEs43Ia2B/pe9APmh9B TqZClUApd2ecfww7gwYCwjzWLkl9+jh2Z7lpMQFzuvK6JsbTTUdp8XOKH E=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CZAACkV11Z/40NJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgm89LWOBEAeOApFolgCCESEBCoVwAhqDAj8YAQIBAQEBAQEBayi?= =?us-ascii?q?FGAEBAQEDAQEhCkEEBxACAQgRBAEBIQcDAgICJQsUCQgCBAENBQiJQ2QQrweCJ?= =?us-ascii?q?otCAQEBAQEBAQEBAQEBAQEBAQEBAQEBHYMngTGCG4FhgySDJoF6CIJVgmEFikm?= =?us-ascii?q?MYIddAodFg0WIcIIVVoR0g3GGV5UyAQ8QOIEKdRUfKocVdoZGK4EFgQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.40,313,1496102400"; d="scan'208,217";a="264450516" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 05 Jul 2017 21:23:19 +0000 Received: from XCH-RTP-006.cisco.com (xch-rtp-006.cisco.com [64.101.220.146]) by alln-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id v65LNIEF011424 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 5 Jul 2017 21:23:19 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-006.cisco.com (64.101.220.146) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 5 Jul 2017 17:23:18 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Wed, 5 Jul 2017 17:23:18 -0400 From: "Kent Leung (kleung)" To: Ben Niven-Jenkins , Phil Sorber CC: "cdni@ietf.org" Thread-Topic: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt Thread-Index: AQHS7e9LlS4wGS+P5UmudfPkO3mbd6I2R8sAgA2IdACAAfY0sA== Date: Wed, 5 Jul 2017 21:23:18 +0000 Message-ID: <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> In-Reply-To: <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.116.115] Content-Type: multipart/alternative; boundary="_000_07d84d59a86f4dcdb19d4e8679bf26f2XCHRTP006ciscocom_" MIME-Version: 1.0 Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jul 2017 21:23:22 -0000 --_000_07d84d59a86f4dcdb19d4e8679bf26f2XCHRTP006ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLiBUaGFua3MgZm9yIHlvdXIgcmV2aWV3IGNvbW1lbnRzLiAgU2VlIG15IHJlc3BvbnNl IHRvIHNvbWUgb2YgdGhlbSBiZWxvdy4NCg0KDQoNCg0KDQpGcm9tOiBDRE5pIFttYWlsdG86Y2Ru aS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQmVuIE5pdmVuLUplbmtpbnMNClNlbnQ6 IFR1ZXNkYXksIEp1bHkgNCwgMjAxNyAzOjU5IEFNDQpUbzogUGhpbCBTb3JiZXIgPHNvcmJlckBh cGFjaGUub3JnPg0KQ2M6IGNkbmlAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQ0ROaV0gSS1EIEFj dGlvbjogZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLTEyLnR4dA0KDQpIaSBQaGlsICYgVVJJ IFNpZ25pbmcgYXV0aG9ycywNCg0KSSByZWFkIHRoZSBsYXRlc3QgZHJhZnQgKC0xMikgYW5kIGJl bG93IGFyZSBzb21lIHF1ZXN0aW9ucyAvIHRob3VnaHRzLCBpbiBubyBwYXJ0aWN1bGFyIG9yZGVy LCB0aGF0IG9jY3VycmVkIHRvIG1lIHdoaWxlIHJlYWRpbmcgdGhlIGRvY3VtZW50Lg0KDQoqIFdo eSBzdXBwb3J0IGJvdGggc3ltbWV0cmljICYgYXN5bW1ldHJpYyBrZXlzPyBXaGF0IGlzIHRoZSBh ZHZhbnRhZ2UgdG8gaGF2aW5nIGJvdGggb3B0aW9ucyB2ZXJzdXMganVzdCBwaWNraW5nIG9uZSBv cHRpb24gKHByb2JhYmx5IGFzeW1tZXRyaWMga2V5cyBhcyB0aGV5IHdvcmsgZm9yIGFsbCB1c2Ug Y2FzZXMpPw0KDQpLTD4gVGhlcmUgYXJlIHByb3MgYW5kIGNvbnMgb2YgdXNpbmcgZWl0aGVyIGFz eW1tZXRyaWMga2V5cyB2cyBzeW1tZXRyaWMga2V5LiBLZXkgZGlzdHJpYnV0aW9uIGxpbWl0YXRp b25zIGFuZCByZWxhdGlvbnNoaXBzIGJldHdlZW4gQ1NQIGFuZCBDRE5zIGFyZSBmYWN0b3JzLiBT byBJIHRoaW5rIHN1cHBvcnRpbmcgYm90aCBhbGxvd3MgZmxleGliaWxpdHkgZm9yIGRlcGxveW1l bnRzIG9mIFVSSSBzaWduaW5nLiBFeGlzdGluZyBVUkkgc2lnbmluZyBwcm9wcmlldGFyeSBpbXBs ZW1lbnRhdGlvbnMgdHlwaWNhbGx5IHN1cHBvcnQgYm90aCBhbHJlYWR5Lg0KDQoNCiogSG93IGFy ZSB0aGUga2V5cyBkaXN0cmlidXRlZCBiZXR3ZWVuIENETnM/IEkgZG9u4oCZdCBzZWUgYSBwcm9w ZXJ0eSBpbiB0aGUgVXJpU2lnbmluZyBNZXRhZGF0YSBvYmplY3QgdGhhdCB3b3VsZCBpbmNsdWRl IChvciBsaW5rIHRvKSB0aGUga2V5cyAoSeKAmW0gYXNzdW1pbmcgeW91IG5lZWQgdG8gc3VwcG9y dCBkaXN0cmlidXRpb24gb2YgYXQgbGVhc3QgMiBrZXlzIHRvIHN1cHBvcnQga2V5IHJvdGF0aW9u KT8NCg0KS0w+IEtleSBkaXN0cmlidXRpb24gaXMgb3V0IG9mIHNjb3BlLiBJIG5vdGljZWQgZm9s bG93aW5nIHRleHQgd2FzIGRyb3BwZWQgd2hlbiBtZXRob2QgY29udmVydGVkIHRvIEpXVC4gV2Ug Y2FuIHB1dCB0aGlzIGJhY2sgaW4gQ0ROSSBPdmVydmlldyBzZWN0aW9uLCB3aGVyZSB0aGUgYXN5 bW1ldHJpYyBhbmQgc3ltbWV0cmljIGtleSBtZXRob2RzIGFyZSBtZW50aW9uZWQuDQoNCuKAnFR3 byB0eXBlcyBvZiBrZXlzIGNhbiBiZSB1c2VkIGZvciBVUkkgU2lnbmluZzogYXN5bW1ldHJpYyBr ZXlzIGFuZA0KICAgc3ltbWV0cmljIGtleXMuICBBc3ltbWV0cmljIGtleXMgYXJlIGJhc2VkIG9u IGEgcHVibGljL3ByaXZhdGUga2V5DQogICBwYWlyIG1lY2hhbmlzbSBhbmQgYWx3YXlzIGNvbnRh aW4gYSBwcml2YXRlIGtleSBvbmx5IGtub3duIHRvIHRoZQ0KICAgZW50aXR5IHNpZ25pbmcgdGhl IFVSSSAoZWl0aGVyIENTUCBvciB1Q0ROKSBhbmQgYSBwdWJsaWMga2V5IGZvciB0aGUNCiAgIHZl cmlmaWNhdGlvbiBvZiB0aGUgU2lnbmVkIFVSSS4gIFdpdGggc3ltbWV0cmljIGtleXMsIHRoZSBz YW1lIGtleSBpcw0KICAgdXNlZCBieSBib3RoIHRoZSBzaWduaW5nIGVudGl0eSBmb3Igc2lnbmlu ZyB0aGUgVVJJIGFzIHdlbGwgYXMgYnkgdGhlDQogICB2YWxpZGF0aW5nIGVudGl0eSBmb3IgdmFs aWRhdGluZyB0aGUgU2lnbmVkIFVSSS4gIFJlZ2FyZGxlc3Mgb2YgdGhlDQogICB0eXBlIG9mIGtl eXMgdXNlZCwgdGhlIHZhbGlkYXRpbmcgZW50aXR5IGhhcyB0byBvYnRhaW4gdGhlIGtleQ0KICAg KGVpdGhlciB0aGUgcHVibGljIG9yIHRoZSBzeW1tZXRyaWMga2V5KS4gIFRoZXJlIGFyZSB2ZXJ5 IGRpZmZlcmVudA0KICAgcmVxdWlyZW1lbnRzIGZvciBrZXkgZGlzdHJpYnV0aW9uIChvdXQgb2Yg c2NvcGUgb2YgdGhpcyBkb2N1bWVudCkNCiAgIHdpdGggYXN5bW1ldHJpYyBrZXlzIGFuZCB3aXRo IHN5bW1ldHJpYyBrZXlzLiAgS2V5IGRpc3RyaWJ1dGlvbiBmb3INCiAgIHN5bW1ldHJpYyBrZXlz IHJlcXVpcmVzIGNvbmZpZGVudGlhbGl0eSB0byBwcmV2ZW50IGFub3RoZXIgcGFydHkgZnJvbQ0K ICAgZ2V0dGluZyBhY2Nlc3MgdG8gdGhlIGtleSwgc2luY2UgaXQgY291bGQgdGhlbiBnZW5lcmF0 ZSB2YWxpZCBTaWduZWQNCiAgIFVSSXMgZm9yIHVuYXV0aG9yaXplZCByZXF1ZXN0cy4gIEtleSBk aXN0cmlidXRpb24gZm9yIGFzeW1tZXRyaWMga2V5cw0KICAgZG9lcyBub3QgcmVxdWlyZSBjb25m aWRlbnRpYWxpdHkgc2luY2UgcHVibGljIGtleXMgY2FuIHR5cGljYWxseSBiZQ0KICAgZGlzdHJp YnV0ZWQgb3Blbmx5IChiZWNhdXNlIHRoZXkgY2Fubm90IGJlIHVzZWQgZm9yIFVSSSBzaWduaW5n KSBhbmQNCiAgIHByaXZhdGUga2V5cyBhcmUga2VwdCBieSB0aGUgVVJJIHNpZ25pbmcgZnVuY3Rp b24u4oCdDQoNCg0KKiBIb3cgZG9lcyBhIHVDRE4ga25vdyB3aGV0aGVyIGl0IGlzIE9LL3NhZmUv d2l0aGluIHBvbGljeSB0byByZS1kaXN0cmlidXRlIHN5bW1ldHJpYyBrZXlzIHRvIGEgZENETj8N Cg0KS0w+IFNlZSBhYm92ZS4NCg0KKiBJbiB0aGUgY2FzZSBvZiBTaWduZWQgVG9rZW4gY2hhaW5z LCBob3cgZG9lcyBhIENETiBvYnRhaW4gdGhlIGtleXMgcmVxdWlyZWQgdG8gc2lnbiB0aGUgbmV3 IHRva2VucyBpbiB0aGUgY2hhaW4gYXMgaXQgZ2VuZXJhdGVzIHRoZW0/DQoNCktMPiBTZWUgYWJv dmUuDQoNCktlbnQNCg0KDQoqIFNlY3Rpb24gMy4zLjEgSSB0aGluayBuZWVkcyB0byBiZSBtb3Jl IGV4cGxpY2l0LCBJIGRvbuKAmXQga25vdyBob3cgb25lIGNvdWxkIGNvbW11bmljYXRlIGEgdG9r ZW4gY2hhaW4gdmlhIHRoZSBxdWVyeSBzdHJpbmcgYXMgc3BlY2lmaWVkIGluIHRoZSBkb2N1bWVu dCwgYXMgdGhlcmUgaXMgbm8g4oCcYmFjayBjaGFubmVs4oCdIGZvciB0aGUgQ0ROIHRvIGNvbW11 bmljYXRlIHRoZSBuZXh0IHRva2VuIGluIHRoZSBjaGFpbiB0byB0aGUgVUEuDQoNCkhUSA0KQmVu DQoNCk9uIDI1IEp1biAyMDE3LCBhdCAyMToxOSwgUGhpbCBTb3JiZXIgPHNvcmJlckBhcGFjaGUu b3JnPG1haWx0bzpzb3JiZXJAYXBhY2hlLm9yZz4+IHdyb3RlOg0KDQpSZWFsbHkgaG9waW5nIHRv IGdldCBzb21lIGZlZWRiYWNrIG9uIHRoaXMgYXQgdGhlIG1lZXRpbmcgaW4gUHJhZ3VlLiBJdCdz IGdvdCBhbGwgdGhlIGNoYW5nZXMgdGhhdCBoYXZlIGJlZW4gZGlzY3Vzc2VkIHNvIEknbSBub3Qg YXdhcmUgb2YgYW55IG1vcmUgc3Vic3RhbnRpdmUgY2hhbmdlcyBuZWVkZWQuIEhvd2V2ZXIsIGxv dHMgb2YgZWRpdG9yaWFsIG5pdHMgSSBzdXNwZWN0Lg0KVGhhbmtzLg0KDQpPbiBTdW4sIEp1biAy NSwgMjAxNyBhdCAyOjEyIFBNIDxpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8bWFpbHRvOmludGVy bmV0LWRyYWZ0c0BpZXRmLm9yZz4+IHdyb3RlOg0KDQpBIE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBh dmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGlyZWN0b3JpZXMuDQpU aGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBDb250ZW50IERlbGl2ZXJ5IE5ldHdvcmtz IEludGVyY29ubmVjdGlvbiBvZiB0aGUgSUVURi4NCg0KICAgICAgICBUaXRsZSAgICAgICAgICAg OiBVUkkgU2lnbmluZyBmb3IgQ0ROIEludGVyY29ubmVjdGlvbiAoQ0ROSSkNCiAgICAgICAgQXV0 aG9ycyAgICAgICAgIDogUmF5IHZhbiBCcmFuZGVuYnVyZw0KICAgICAgICAgICAgICAgICAgICAg ICAgICBLZW50IExldW5nDQogICAgICAgICAgICAgICAgICAgICAgICAgIFBoaWwgU29yYmVyDQog ICAgICAgIEZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0xMi50 eHQNCiAgICAgICAgUGFnZXMgICAgICAgICAgIDogMzUNCiAgICAgICAgRGF0ZSAgICAgICAgICAg IDogMjAxNy0wNi0yNQ0KDQpBYnN0cmFjdDoNCiAgIFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGhv dyB0aGUgY29uY2VwdCBvZiBVUkkgc2lnbmluZyBzdXBwb3J0cyB0aGUNCiAgIGNvbnRlbnQgYWNj ZXNzIGNvbnRyb2wgcmVxdWlyZW1lbnRzIG9mIENETkkgYW5kIHByb3Bvc2VzIGEgVVJJDQogICBz aWduaW5nIG1ldGhvZCBhcyBhIEpTT04gV2ViIFRva2VuIChKV1QpIFtSRkM3NTE5XSBwcm9maWxl Lg0KDQogICBUaGUgcHJvcG9zZWQgVVJJIHNpZ25pbmcgbWV0aG9kIHNwZWNpZmllcyB0aGUgaW5m b3JtYXRpb24gbmVlZGVkIHRvDQogICBiZSBpbmNsdWRlZCBpbiB0aGUgVVJJIHRvIHRyYW5zbWl0 IHRoZSBzaWduZWQgSldUIGFzIHdlbGwgYXMgdGhlDQogICBjbGFpbXMgbmVlZGVkIGJ5IHRoZSBz aWduZWQgSldUIHRvIGF1dGhvcml6ZSBhIFVBLiAgVGhlIG1lY2hhbmlzbQ0KICAgZGVzY3JpYmVk IGNhbiBiZSB1c2VkIGJvdGggaW4gQ0ROSSBhbmQgc2luZ2xlIENETiBzY2VuYXJpb3MuDQoNCg0K VGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQpodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmcv DQoNClRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2YWlsYWJsZSBhdDoNCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTINCmh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1jZG5pLXVyaS1z aWduaW5nLTEyDQoNCkEgZGlmZiBmcm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJs ZSBhdDoNCmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWNkbmkt dXJpLXNpZ25pbmctMTINCg0KDQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxl IG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6 ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnPGh0dHA6 Ly90b29scy5pZXRmLm9yZy8+Lg0KDQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxl IGJ5IGFub255bW91cyBGVFAgYXQ6DQpmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRz Lw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQ0RO aSBtYWlsaW5nIGxpc3QNCkNETmlAaWV0Zi5vcmc8bWFpbHRvOkNETmlAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpDRE5pIG1haWxpbmcgbGlzdA0KQ0ROaUBp ZXRmLm9yZzxtYWlsdG86Q0ROaUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vY2RuaQ0KDQo= --_000_07d84d59a86f4dcdb19d4e8679bf26f2XCHRTP006ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWls RW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhpIEJlbi4gVGhhbmtz IGZvciB5b3VyIHJldmlldyBjb21tZW50cy4gJm5ic3A7U2VlIG15IHJlc3BvbnNlIHRvIHNvbWUg b2YgdGhlbSBiZWxvdy48bzpwPjwvbzpwPjwvc3Bhbj48L2E+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNw YWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iMCIgc3R5bGU9IndpZHRoOjQ1MS41cHQi Pg0KPHRib2R5Pg0KPHRyPg0KPHRkIGNvbHNwYW49IjMiIHN0eWxlPSJwYWRkaW5nOjBpbiAwaW4g MGluIDBpbiI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bh bj48L3RkPg0KPHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bh bj4NCjwvdHI+DQo8dHIgc3R5bGU9ImhlaWdodDo3LjVwdCI+DQo8dGQgc3R5bGU9InBhZGRpbmc6 MGluIDBpbiAwaW4gMGluO2hlaWdodDo3LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxLjBwdDtjb2xvcjojMUY0OTdEIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+ PC9wPg0KPC90ZD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48 L3NwYW4+DQo8dGQgc3R5bGU9InBhZGRpbmc6MGluIDBpbiAwaW4gMGluO2hlaWdodDo3LjVwdCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bhbj48L3RkPg0K PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bhbj4NCjx0ZCBz dHlsZT0icGFkZGluZzowaW4gMGluIDBpbiAwaW47aGVpZ2h0OjcuNXB0Ij48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPjwvdGQ+DQo8c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPC90cj4NCjwvdGJvZHk+DQo8 L3RhYmxlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IENETmkgW21haWx0bzpjZG5pLWJvdW5jZXNAaWV0Zi5v cmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkJlbiBOaXZlbi1KZW5raW5zPGJyPg0KPGI+U2VudDo8 L2I+IFR1ZXNkYXksIEp1bHkgNCwgMjAxNyAzOjU5IEFNPGJyPg0KPGI+VG86PC9iPiBQaGlsIFNv cmJlciAmbHQ7c29yYmVyQGFwYWNoZS5vcmcmZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBjZG5pQGlldGYu b3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQ0ROaV0gSS1EIEFjdGlvbjogZHJhZnQtaWV0 Zi1jZG5pLXVyaS1zaWduaW5nLTEyLnR4dDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhpIFBoaWwgJmFtcDsgVVJJIFNpZ25pbmcgYXV0aG9ycyw8bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgcmVhZCB0aGUgbGF0ZXN0 IGRyYWZ0ICgtMTIpIGFuZCBiZWxvdyBhcmUgc29tZSBxdWVzdGlvbnMgLyB0aG91Z2h0cywgaW4g bm8gcGFydGljdWxhciBvcmRlciwgdGhhdCBvY2N1cnJlZCB0byBtZSB3aGlsZSByZWFkaW5nIHRo ZSBkb2N1bWVudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+KiBXaHkgc3VwcG9ydCBib3RoIHN5bW1ldHJpYyAmYW1wOyBhc3ltbWV0cmljIGtl eXM/IFdoYXQgaXMgdGhlIGFkdmFudGFnZSB0byBoYXZpbmcgYm90aCBvcHRpb25zIHZlcnN1cyBq dXN0IHBpY2tpbmcgb25lIG9wdGlvbiAocHJvYmFibHkgYXN5bW1ldHJpYyBrZXlzIGFzIHRoZXkg d29yayBmb3IgYWxsIHVzZSBjYXNlcyk/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPktMJmd0OyBUaGVyZSBhcmUgcHJvcyBhbmQgY29ucyBvZiB1c2luZyBl aXRoZXIgYXN5bW1ldHJpYyBrZXlzIHZzIHN5bW1ldHJpYyBrZXkuIEtleSBkaXN0cmlidXRpb24g bGltaXRhdGlvbnMgYW5kIHJlbGF0aW9uc2hpcHMgYmV0d2VlbiBDU1AgYW5kIENETnMgYXJlIGZh Y3RvcnMuDQogU28gSSB0aGluayBzdXBwb3J0aW5nIGJvdGggYWxsb3dzIGZsZXhpYmlsaXR5IGZv ciBkZXBsb3ltZW50cyBvZiBVUkkgc2lnbmluZy4gRXhpc3RpbmcgVVJJIHNpZ25pbmcgcHJvcHJp ZXRhcnkgaW1wbGVtZW50YXRpb25zIHR5cGljYWxseSBzdXBwb3J0IGJvdGggYWxyZWFkeS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogSG93IGFy ZSB0aGUga2V5cyBkaXN0cmlidXRlZCBiZXR3ZWVuIENETnM/IEkgZG9u4oCZdCBzZWUgYSBwcm9w ZXJ0eSBpbiB0aGUgVXJpU2lnbmluZyBNZXRhZGF0YSBvYmplY3QgdGhhdCB3b3VsZCBpbmNsdWRl IChvciBsaW5rIHRvKSB0aGUga2V5cyAoSeKAmW0gYXNzdW1pbmcgeW91IG5lZWQgdG8gc3VwcG9y dCBkaXN0cmlidXRpb24gb2YgYXQgbGVhc3QgMiBrZXlzIHRvIHN1cHBvcnQga2V5IHJvdGF0aW9u KT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+S0wmZ3Q7 IEtleSBkaXN0cmlidXRpb24gaXMgb3V0IG9mIHNjb3BlLiBJIG5vdGljZWQgZm9sbG93aW5nIHRl eHQgd2FzIGRyb3BwZWQgd2hlbiBtZXRob2QgY29udmVydGVkIHRvIEpXVC4gV2UgY2FuIHB1dCB0 aGlzIGJhY2sgaW4gQ0ROSSBPdmVydmlldyBzZWN0aW9uLCB3aGVyZQ0KIHRoZSBhc3ltbWV0cmlj IGFuZCBzeW1tZXRyaWMga2V5IG1ldGhvZHMgYXJlIG1lbnRpb25lZC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPuKAnFR3byB0eXBlcyBvZiBrZXlzIGNhbiBiZSB1 c2VkIGZvciBVUkkgU2lnbmluZzogYXN5bW1ldHJpYyBrZXlzIGFuZDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij4mbmJzcDsmbmJzcDsgc3ltbWV0cmljIGtleXMuJm5ic3A7IEFzeW1tZXRyaWMga2V5cyBhcmUg YmFzZWQgb24gYSBwdWJsaWMvcHJpdmF0ZSBrZXk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5i c3A7IHBhaXIgbWVjaGFuaXNtIGFuZCBhbHdheXMgY29udGFpbiBhIHByaXZhdGUga2V5IG9ubHkg a25vd24gdG8gdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBlbnRpdHkgc2lnbmlu ZyB0aGUgVVJJIChlaXRoZXIgQ1NQIG9yIHVDRE4pIGFuZCBhIHB1YmxpYyBrZXkgZm9yIHRoZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgdmVyaWZpY2F0aW9uIG9mIHRoZSBTaWduZWQg VVJJLiZuYnNwOyBXaXRoIHN5bW1ldHJpYyBrZXlzLCB0aGUgc2FtZSBrZXkgaXM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHVzZWQgYnkgYm90aCB0aGUgc2lnbmluZyBlbnRpdHkgZm9y IHNpZ25pbmcgdGhlIFVSSSBhcyB3ZWxsIGFzIGJ5IHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDsmbmJzcDsgdmFsaWRhdGluZyBlbnRpdHkgZm9yIHZhbGlkYXRpbmcgdGhlIFNpZ25lZCBVUkku Jm5ic3A7IFJlZ2FyZGxlc3Mgb2YgdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyB0 eXBlIG9mIGtleXMgdXNlZCwgdGhlIHZhbGlkYXRpbmcgZW50aXR5IGhhcyB0byBvYnRhaW4gdGhl IGtleTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgKGVpdGhlciB0aGUgcHVibGljIG9y IHRoZSBzeW1tZXRyaWMga2V5KS4mbmJzcDsgVGhlcmUgYXJlIHZlcnkgZGlmZmVyZW50PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyByZXF1aXJlbWVudHMgZm9yIGtleSBkaXN0cmlidXRp b24gKG91dCBvZiBzY29wZSBvZiB0aGlzIGRvY3VtZW50KTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDsmbmJzcDsgd2l0aCBhc3ltbWV0cmljIGtleXMgYW5kIHdpdGggc3ltbWV0cmljIGtleXMuJm5i c3A7IEtleSBkaXN0cmlidXRpb24gZm9yPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBz eW1tZXRyaWMga2V5cyByZXF1aXJlcyBjb25maWRlbnRpYWxpdHkgdG8gcHJldmVudCBhbm90aGVy IHBhcnR5IGZyb208bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IGdldHRpbmcgYWNjZXNz IHRvIHRoZSBrZXksIHNpbmNlIGl0IGNvdWxkIHRoZW4gZ2VuZXJhdGUgdmFsaWQgU2lnbmVkPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBVUklzIGZvciB1bmF1dGhvcml6ZWQgcmVxdWVz dHMuJm5ic3A7IEtleSBkaXN0cmlidXRpb24gZm9yIGFzeW1tZXRyaWMga2V5czxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj4mbmJzcDsmbmJzcDsgZG9lcyBub3QgcmVxdWlyZSBjb25maWRlbnRpYWxpdHkgc2lu Y2UgcHVibGljIGtleXMgY2FuIHR5cGljYWxseSBiZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsm bmJzcDsgZGlzdHJpYnV0ZWQgb3Blbmx5IChiZWNhdXNlIHRoZXkgY2Fubm90IGJlIHVzZWQgZm9y IFVSSSBzaWduaW5nKSBhbmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHByaXZhdGUg a2V5cyBhcmUga2VwdCBieSB0aGUgVVJJIHNpZ25pbmcgZnVuY3Rpb24u4oCdPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIEhvdyBkb2VzIGEgdUNE TiBrbm93IHdoZXRoZXIgaXQgaXMgT0svc2FmZS93aXRoaW4gcG9saWN5IHRvIHJlLWRpc3RyaWJ1 dGUgc3ltbWV0cmljIGtleXMgdG8gYSBkQ0ROPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj5LTCZndDsgU2VlIGFib3ZlLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4qIEluIHRoZSBjYXNlIG9mIFNpZ25lZCBUb2tlbiBjaGFpbnMsIGhvdyBkb2VzIGEg Q0ROIG9idGFpbiB0aGUga2V5cyByZXF1aXJlZCB0byBzaWduIHRoZSBuZXcgdG9rZW5zIGluIHRo ZSBjaGFpbiBhcyBpdCBnZW5lcmF0ZXMgdGhlbT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+S0wmZ3Q7IFNlZSBhYm92ZS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPktlbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogU2VjdGlvbiAzLjMuMSBJIHRoaW5rIG5lZWRzIHRv IGJlIG1vcmUgZXhwbGljaXQsIEkgZG9u4oCZdCBrbm93IGhvdyBvbmUgY291bGQgY29tbXVuaWNh dGUgYSB0b2tlbiBjaGFpbiB2aWEgdGhlIHF1ZXJ5IHN0cmluZyBhcyBzcGVjaWZpZWQgaW4gdGhl IGRvY3VtZW50LCBhcyB0aGVyZSBpcyBubyDigJxiYWNrIGNoYW5uZWzigJ0gZm9yIHRoZSBDRE4g dG8gY29tbXVuaWNhdGUgdGhlIG5leHQgdG9rZW4gaW4gdGhlIGNoYWluDQogdG8gdGhlIFVBLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IVEg8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJlbjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g MjUgSnVuIDIwMTcsIGF0IDIxOjE5LCBQaGlsIFNvcmJlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNv cmJlckBhcGFjaGUub3JnIj5zb3JiZXJAYXBhY2hlLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+UmVhbGx5IGhvcGluZyB0byBnZXQgc29tZSBmZWVkYmFjayBvbiB0 aGlzIGF0IHRoZSBtZWV0aW5nIGluIFByYWd1ZS4gSXQncyBnb3QgYWxsIHRoZSBjaGFuZ2VzIHRo YXQgaGF2ZSBiZWVuIGRpc2N1c3NlZCBzbyBJJ20gbm90IGF3YXJlIG9mIGFueSBtb3JlIHN1YnN0 YW50aXZlIGNoYW5nZXMgbmVlZGVkLiBIb3dldmVyLCBsb3RzIG9mIGVkaXRvcmlhbCBuaXRzDQog SSBzdXNwZWN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGFua3MuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBTdW4sIEp1biAyNSwgMjAxNyBhdCAyOjEyIFBNICZsdDs8YSBocmVmPSJtYWlsdG86aW50 ZXJuZXQtZHJhZnRzQGlldGYub3JnIj5pbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxicj4NCkEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBv bi1saW5lIEludGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy48YnI+DQpUaGlzIGRyYWZ0IGlzIGEg d29yayBpdGVtIG9mIHRoZSBDb250ZW50IERlbGl2ZXJ5IE5ldHdvcmtzIEludGVyY29ubmVjdGlv biBvZiB0aGUgSUVURi48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgVGl0 bGUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzogVVJJIFNpZ25pbmcg Zm9yIENETiBJbnRlcmNvbm5lY3Rpb24gKENETkkpPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IEF1dGhvcnMmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7OiBSYXkgdmFu IEJyYW5kZW5idXJnPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEtlbnQg TGV1bmc8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgUGhpbCBTb3JiZXI8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRmlsZW5hbWUmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgOiBkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTIudHh0PGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFBhZ2VzJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDs6IDM1PGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IERhdGUm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA6IDIwMTctMDYtMjU8YnI+ DQo8YnI+DQpBYnN0cmFjdDo8YnI+DQombmJzcDsgJm5ic3A7VGhpcyBkb2N1bWVudCBkZXNjcmli ZXMgaG93IHRoZSBjb25jZXB0IG9mIFVSSSBzaWduaW5nIHN1cHBvcnRzIHRoZTxicj4NCiZuYnNw OyAmbmJzcDtjb250ZW50IGFjY2VzcyBjb250cm9sIHJlcXVpcmVtZW50cyBvZiBDRE5JIGFuZCBw cm9wb3NlcyBhIFVSSTxicj4NCiZuYnNwOyAmbmJzcDtzaWduaW5nIG1ldGhvZCBhcyBhIEpTT04g V2ViIFRva2VuIChKV1QpIFtSRkM3NTE5XSBwcm9maWxlLjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDtUaGUgcHJvcG9zZWQgVVJJIHNpZ25pbmcgbWV0aG9kIHNwZWNpZmllcyB0aGUgaW5mb3JtYXRp b24gbmVlZGVkIHRvPGJyPg0KJm5ic3A7ICZuYnNwO2JlIGluY2x1ZGVkIGluIHRoZSBVUkkgdG8g dHJhbnNtaXQgdGhlIHNpZ25lZCBKV1QgYXMgd2VsbCBhcyB0aGU8YnI+DQombmJzcDsgJm5ic3A7 Y2xhaW1zIG5lZWRlZCBieSB0aGUgc2lnbmVkIEpXVCB0byBhdXRob3JpemUgYSBVQS4mbmJzcDsg VGhlIG1lY2hhbmlzbTxicj4NCiZuYnNwOyAmbmJzcDtkZXNjcmliZWQgY2FuIGJlIHVzZWQgYm90 aCBpbiBDRE5JIGFuZCBzaW5nbGUgQ0ROIHNjZW5hcmlvcy48YnI+DQo8YnI+DQo8YnI+DQpUaGUg SUVURiBkYXRhdHJhY2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczo8YnI+DQo8YSBo cmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWNkbmktdXJp LXNpZ25pbmcvIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLzwvYT48YnI+DQo8YnI+DQpUaGVyZSBhcmUg YWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6PGJyPg0KPGEgaHJlZj0iaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0xMiIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWNkbmkt dXJpLXNpZ25pbmctMTI8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvaHRtbC9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTIiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtY2Ru aS11cmktc2lnbmluZy0xMjwvYT48YnI+DQo8YnI+DQpBIGRpZmYgZnJvbSB0aGUgcHJldmlvdXMg dmVyc2lvbiBpcyBhdmFpbGFibGUgYXQ6PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0xMiIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWNkbmkt dXJpLXNpZ25pbmctMTI8L2E+PGJyPg0KPGJyPg0KPGJyPg0KUGxlYXNlIG5vdGUgdGhhdCBpdCBt YXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lvbjxi cj4NCnVudGlsIHRoZSBodG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFibGUgYXQg PGEgaHJlZj0iaHR0cDovL3Rvb2xzLmlldGYub3JnLyIgdGFyZ2V0PSJfYmxhbmsiPg0KdG9vbHMu aWV0Zi5vcmc8L2E+Ljxicj4NCjxicj4NCkludGVybmV0LURyYWZ0cyBhcmUgYWxzbyBhdmFpbGFi bGUgYnkgYW5vbnltb3VzIEZUUCBhdDo8YnI+DQo8YSBocmVmPSJmdHA6Ly9mdHAuaWV0Zi5vcmcv aW50ZXJuZXQtZHJhZnRzLyIgdGFyZ2V0PSJfYmxhbmsiPmZ0cDovL2Z0cC5pZXRmLm9yZy9pbnRl cm5ldC1kcmFmdHMvPC9hPjxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KQ0ROaSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJt YWlsdG86Q0ROaUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkNETmlAaWV0Zi5vcmc8L2E+PGJy Pg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5p PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NCkNETmkgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJl Zj0ibWFpbHRvOkNETmlAaWV0Zi5vcmciPkNETmlAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0i aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nkbmk8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_07d84d59a86f4dcdb19d4e8679bf26f2XCHRTP006ciscocom_-- From nobody Thu Jul 6 22:40:36 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAB5912EA58 for ; Thu, 6 Jul 2017 22:39:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e2dtIpjRO_Qm for ; Thu, 6 Jul 2017 22:39:32 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C433129B31 for ; Thu, 6 Jul 2017 22:39:32 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 0D815B81684; Thu, 6 Jul 2017 22:38:53 -0700 (PDT) To: rob.murray@nokia.com, ben.niven-jenkins@nokia.com, ben@nostrum.com, aamelnikov@fastmail.fm, adam@nostrum.com, flefauch@gmail.com, kevin.j.ma@ericsson.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: kevin.j.ma@ericsson.com, cdni@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20170707053853.0D815B81684@rfc-editor.org> Date: Thu, 6 Jul 2017 22:38:53 -0700 (PDT) Archived-At: X-Mailman-Approved-At: Thu, 06 Jul 2017 22:40:35 -0700 Subject: [CDNi] [Technical Errata Reported] RFC8007 (5064) X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jul 2017 05:39:34 -0000 The following errata report has been submitted for RFC8007, "Content Delivery Network Interconnection (CDNI) Control Interface / Triggers". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5064 -------------------------------------- Type: Technical Reported by: Kevin J. Ma Section: 6.2.5 Original Text ------------- 6.2.5. Deleting Trigger Status Resources The uCDN can delete completed and failed Trigger Status Resources to reduce the size of the collections, as described in Section 4.4. For example, to delete the "preposition" request from earlier examples: Corrected Text -------------- 6.2.5. Canceling or Deleting Trigger Status Resources The uCDN can cancel pending or active Trigger Status Resource processing, as described in Section 4.3. For example, to cancel the "preposition" request from earlier examples: REQUEST: POST /triggers HTTP/1.1 User-Agent: example-user-agent/0.1 Host: dcdn.example.com Accept: */* Content-Type: application/cdni; ptype=ci-trigger-command Content-Length: 91 { "cancel" : [ "https://dcdn.example.com/triggers/0" ], "cdn-path" : [ "AS64496:1" ] } RESPONSE: HTTP/1.1 200 OK Content-Length: 0 Server: example-server/0.1 Date: Wed, 04 May 2016 08:50:00 GMT The uCDN can also delete completed and/or failed Trigger Status Resources to reduce the size of the collections, as described in Section 4.4. For example, to delete the "preposition" request from earlier examples: Notes ----- There is no example for canceling a trigger. Section 4.3 does not specify what the response payload should be for cancel responses. An explicit example would help clarify the intent of an empty response. A cancel example probably warrants its own section, but for the purposes of simplifying this errata, it has been combined with the delete example. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8007 (draft-ietf-cdni-control-triggers-15) -------------------------------------- Title : Content Delivery Network Interconnection (CDNI) Control Interface / Triggers Publication Date : December 2016 Author(s) : R. Murray, B. Niven-Jenkins Category : PROPOSED STANDARD Source : Content Delivery Networks Interconnection Area : Applications and Real-Time Stream : IETF Verifying Party : IESG From nobody Mon Jul 10 01:20:53 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D414213167F for ; Mon, 10 Jul 2017 01:20:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IYUECIQ_oO6e for ; Mon, 10 Jul 2017 01:20:48 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0107.outbound.protection.outlook.com [104.47.2.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FE0A13167B for ; Mon, 10 Jul 2017 01:20:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wG1NMO4aW+QT/ZqrBRChTDjepNf1i9T4nzI0KzKikGo=; b=jCunlMcGujZ43Rd/2DCJTVxFkKfwpJ7DFxduIxQQZc67y5MpmflreE/fBeCkhABoaj31Zi16h33z2hvbjr7NcPWCtyurZdGtls5YbsQ/k9AldWJ1WLg1aBVnm+drclKRUunJdeLT5UKwk9rhm2NINTYMNAhCmS6RWdseZiGmGCI= Received: from AM3PR07MB466.eurprd07.prod.outlook.com (10.242.113.19) by AM3PR07MB449.eurprd07.prod.outlook.com (10.242.113.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1261.4; Mon, 10 Jul 2017 08:20:45 +0000 Received: from AM3PR07MB466.eurprd07.prod.outlook.com ([fe80::5598:df73:1d53:a37b]) by AM3PR07MB466.eurprd07.prod.outlook.com ([fe80::5598:df73:1d53:a37b%18]) with mapi id 15.01.1261.012; Mon, 10 Jul 2017 08:20:44 +0000 From: "Murray, Rob (Nokia - GB/Cambridge, UK)" To: RFC Errata System , "Niven - Jenkins, Ben (Nokia - GB/Cambridge, UK)" , "ben@nostrum.com" , "aamelnikov@fastmail.fm" , "adam@nostrum.com" , "flefauch@gmail.com" , "kevin.j.ma@ericsson.com" CC: "cdni@ietf.org" Thread-Topic: [Technical Errata Reported] RFC8007 (5064) Thread-Index: AQHS9uNq61WlBpE/A0GXFoEkwaM1KqJMzdyA Date: Mon, 10 Jul 2017 08:20:44 +0000 Message-ID: <0BF8F2EE-67B6-4555-B176-EAE24247EDBE@nokia.com> References: <20170707053853.0D815B81684@rfc-editor.org> In-Reply-To: <20170707053853.0D815B81684@rfc-editor.org> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.21.0.170409 authentication-results: rfc-editor.org; dkim=none (message not signed) header.d=none;rfc-editor.org; dmarc=none action=none header.from=nokia.com; x-originating-ip: [81.134.152.4] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM3PR07MB449; 7:oc0kSS+zOEyb5jVOyOtTVWwjRkXBEPPMbpct44B7FBwkXLb0YEmci2ii38OQxupIeCVd/6x84dUzwQfT6ymWNnQDpSSqWQvZgLGXpncqGIDWM2WVifCPfDHvvYFPq87ODtmEJ77VB61Cv8tWxPIdxs5GPHdpw79dYzNer5e/iFX6aBO5D4iA1x/MDKf5vRSNjEw5x4BHHFPt6clyeTgwRtyraM6AkjQ3TpMLwSbW9a5gVOEMz9jBW/zzTDEBPRvXqwUB+OJ9tsggS9iRlzTtvVDYCnrkgtsNiGltstVBXfvSXIohmwqi5E/v83QPG3WSEprzC10Vifhoi20bBeVDziS8mIN8WcfgwhPWXFZJzgP79in9OFtjaa5R1N60hcSxhOSHhiMxOUQqIQz7LQlK7mo8b2u2wzXywoDAHr3ybwVTHCJWzWLxi6dvKNmP1+mOGcxyKpm6SDCNRqGqau6PhTU+A7mutiBc4NfuVFVpOUVeGgIOoF+Atxlh50+tiICMIu0snZjdGdDbE+b0bkoly+Mbt36eTmz83hHF11yA1TNdfcwGYjHhnqizj+f3crQzwHxMwyH+TlrU+0Y9PA+W0sYkEBM7o0jROz1kQYkU7H5+uJaacaZsu+GBTG7bJ0wfw1nBumqar1bmf2tAlLycTrNUBqQH0dV80X6d+zp87O4+/P/vXRAbbTb2AvkuMnuMNZIRk0XYQzjigtK8JXx7HrCeBRyTI229DAUGAqPfZYurAWZGY2ACG6kFbUtBIsQk72h5L7L2m5WklwwP3H6Co33BoWEkyrPBqDyPdg0vS4M= x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(6009001)(39850400002)(39400400002)(39410400002)(39860400002)(39450400003)(39840400002)(13464003)(6486002)(83716003)(3280700002)(53936002)(478600001)(86362001)(4326008)(229853002)(966005)(8936002)(2906002)(82746002)(8676002)(39060400002)(38730400002)(6246003)(83506001)(81166006)(3846002)(6116002)(102836003)(2950100002)(7736002)(36756003)(66066001)(2900100001)(4001350100001)(3660700001)(50986999)(6436002)(54356999)(76176999)(6306002)(99286003)(2201001)(8666007)(6506006)(33656002)(6512007)(53546010)(14454004)(25786009)(305945005)(2501003)(1720100001)(189998001)(5250100002)(5660300001); DIR:OUT; SFP:1102; SCL:1; SRVR:AM3PR07MB449; H:AM3PR07MB466.eurprd07.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; x-ms-office365-filtering-correlation-id: 79e138e2-b3cc-49ea-47a3-08d4c76c8fd0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(48565401081)(300000503095)(300135400095)(2017052603031)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:AM3PR07MB449; x-ms-traffictypediagnostic: AM3PR07MB449: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(37575265505322)(158342451672863)(278428928389397)(236129657087228)(82608151540597); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(2017060910075)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3002001)(100000703101)(100105400095)(6055026)(6041248)(20161123560025)(20161123555025)(20161123558100)(20161123564025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM3PR07MB449; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM3PR07MB449; x-forefront-prvs: 03648EFF89 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <9BCDB25EB5A7AA4EAAC99CB5ACFBF2A8@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2017 08:20:44.8175 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM3PR07MB449 Archived-At: Subject: Re: [CDNi] [Technical Errata Reported] RFC8007 (5064) X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Jul 2017 08:20:51 -0000 VGhhbmtzIEtldmluIC0gdGhlIGNoYW5nZSBsb29rcyBnb29kIHRvIG1lLg0KDQotLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogUkZDIEVycmF0YSBTeXN0ZW0gPHJmYy1lZGl0b3JAcmZj LWVkaXRvci5vcmc+DQpEYXRlOiBGcmlkYXksIDcgSnVseSAyMDE3IGF0IDA2OjM4DQpUbzogIk11 cnJheSwgUm9iIChOb2tpYSAtIEdCL0NhbWJyaWRnZSwgVUspIiA8cm9iLm11cnJheUBub2tpYS5j b20+LCAiTml2ZW4gLSBKZW5raW5zLCBCZW4gKE5va2lhIC0gR0IvQ2FtYnJpZGdlLCBVSykiIDxi ZW4ubml2ZW4tamVua2luc0Bub2tpYS5jb20+LCAiYmVuQG5vc3RydW0uY29tIiA8YmVuQG5vc3Ry dW0uY29tPiwgImFhbWVsbmlrb3ZAZmFzdG1haWwuZm0iIDxhYW1lbG5pa292QGZhc3RtYWlsLmZt PiwgImFkYW1Abm9zdHJ1bS5jb20iIDxhZGFtQG5vc3RydW0uY29tPiwgImZsZWZhdWNoQGdtYWls LmNvbSIgPGZsZWZhdWNoQGdtYWlsLmNvbT4sICJrZXZpbi5qLm1hQGVyaWNzc29uLmNvbSIgPGtl dmluLmoubWFAZXJpY3Nzb24uY29tPg0KQ2M6ICJrZXZpbi5qLm1hQGVyaWNzc29uLmNvbSIgPGtl dmluLmoubWFAZXJpY3Nzb24uY29tPiwgImNkbmlAaWV0Zi5vcmciIDxjZG5pQGlldGYub3JnPiwg InJmYy1lZGl0b3JAcmZjLWVkaXRvci5vcmciIDxyZmMtZWRpdG9yQHJmYy1lZGl0b3Iub3JnPg0K U3ViamVjdDogW1RlY2huaWNhbCBFcnJhdGEgUmVwb3J0ZWRdIFJGQzgwMDcgKDUwNjQpDQoNClRo ZSBmb2xsb3dpbmcgZXJyYXRhIHJlcG9ydCBoYXMgYmVlbiBzdWJtaXR0ZWQgZm9yIFJGQzgwMDcs DQoiQ29udGVudCBEZWxpdmVyeSBOZXR3b3JrIEludGVyY29ubmVjdGlvbiAoQ0ROSSkgQ29udHJv bCBJbnRlcmZhY2UgLyBUcmlnZ2VycyIuDQoNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tDQpZb3UgbWF5IHJldmlldyB0aGUgcmVwb3J0IGJlbG93IGFuZCBhdDoNCmh0dHA6 Ly93d3cucmZjLWVkaXRvci5vcmcvZXJyYXRhL2VpZDUwNjQNCg0KLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0NClR5cGU6IFRlY2huaWNhbA0KUmVwb3J0ZWQgYnk6IEtldmlu IEouIE1hIDxrZXZpbi5qLm1hQGVyaWNzc29uLmNvbT4NCg0KU2VjdGlvbjogNi4yLjUNCg0KT3Jp Z2luYWwgVGV4dA0KLS0tLS0tLS0tLS0tLQ0KNi4yLjUuICBEZWxldGluZyBUcmlnZ2VyIFN0YXR1 cyBSZXNvdXJjZXMNCg0KICAgVGhlIHVDRE4gY2FuIGRlbGV0ZSBjb21wbGV0ZWQgYW5kIGZhaWxl ZCBUcmlnZ2VyIFN0YXR1cyBSZXNvdXJjZXMgdG8NCiAgIHJlZHVjZSB0aGUgc2l6ZSBvZiB0aGUg Y29sbGVjdGlvbnMsIGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQuNC4gIEZvcg0KICAgZXhhbXBs ZSwgdG8gZGVsZXRlIHRoZSAicHJlcG9zaXRpb24iIHJlcXVlc3QgZnJvbSBlYXJsaWVyIGV4YW1w bGVzOg0KDQoNCkNvcnJlY3RlZCBUZXh0DQotLS0tLS0tLS0tLS0tLQ0KNi4yLjUuICBDYW5jZWxp bmcgb3IgRGVsZXRpbmcgVHJpZ2dlciBTdGF0dXMgUmVzb3VyY2VzDQoNCiAgIFRoZSB1Q0ROIGNh biBjYW5jZWwgcGVuZGluZyBvciBhY3RpdmUgVHJpZ2dlciBTdGF0dXMgUmVzb3VyY2UNCiAgIHBy b2Nlc3NpbmcsIGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQuMy4gIEZvciBleGFtcGxlLCB0byBj YW5jZWwNCiAgIHRoZSAicHJlcG9zaXRpb24iIHJlcXVlc3QgZnJvbSBlYXJsaWVyIGV4YW1wbGVz Og0KDQogICBSRVFVRVNUOg0KDQogICAgIFBPU1QgL3RyaWdnZXJzIEhUVFAvMS4xDQogICAgIFVz ZXItQWdlbnQ6IGV4YW1wbGUtdXNlci1hZ2VudC8wLjENCiAgICAgSG9zdDogZGNkbi5leGFtcGxl LmNvbQ0KICAgICBBY2NlcHQ6ICovKg0KICAgICBDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2Nk bmk7IHB0eXBlPWNpLXRyaWdnZXItY29tbWFuZA0KICAgICBDb250ZW50LUxlbmd0aDogOTENCg0K ICAgICB7DQogICAgICAgImNhbmNlbCIgOiBbICJodHRwczovL2RjZG4uZXhhbXBsZS5jb20vdHJp Z2dlcnMvMCIgXSwNCiAgICAgICAiY2RuLXBhdGgiIDogWyAiQVM2NDQ5NjoxIiBdDQogICAgIH0N Cg0KICAgUkVTUE9OU0U6DQoNCiAgICAgSFRUUC8xLjEgMjAwIE9LDQogICAgIENvbnRlbnQtTGVu Z3RoOiAwDQogICAgIFNlcnZlcjogZXhhbXBsZS1zZXJ2ZXIvMC4xDQogICAgIERhdGU6IFdlZCwg MDQgTWF5IDIwMTYgMDg6NTA6MDAgR01UDQoNCiAgIFRoZSB1Q0ROIGNhbiBhbHNvIGRlbGV0ZSBj b21wbGV0ZWQgYW5kL29yIGZhaWxlZCBUcmlnZ2VyIFN0YXR1cw0KICAgUmVzb3VyY2VzIHRvIHJl ZHVjZSB0aGUgc2l6ZSBvZiB0aGUgY29sbGVjdGlvbnMsIGFzIGRlc2NyaWJlZCBpbg0KICAgU2Vj dGlvbiA0LjQuICBGb3IgZXhhbXBsZSwgdG8gZGVsZXRlIHRoZSAicHJlcG9zaXRpb24iIHJlcXVl c3QgZnJvbQ0KICAgZWFybGllciBleGFtcGxlczoNCg0KDQpOb3Rlcw0KLS0tLS0NClRoZXJlIGlz IG5vIGV4YW1wbGUgZm9yIGNhbmNlbGluZyBhIHRyaWdnZXIuICBTZWN0aW9uIDQuMyBkb2VzIG5v dCBzcGVjaWZ5IHdoYXQgdGhlIHJlc3BvbnNlIHBheWxvYWQgc2hvdWxkIGJlIGZvciBjYW5jZWwg cmVzcG9uc2VzLiAgQW4gZXhwbGljaXQgZXhhbXBsZSB3b3VsZCBoZWxwIGNsYXJpZnkgdGhlIGlu dGVudCBvZiBhbiBlbXB0eSByZXNwb25zZS4gIEEgY2FuY2VsIGV4YW1wbGUgcHJvYmFibHkgd2Fy cmFudHMgaXRzIG93biBzZWN0aW9uLCBidXQgZm9yIHRoZSBwdXJwb3NlcyBvZiBzaW1wbGlmeWlu ZyB0aGlzIGVycmF0YSwgaXQgaGFzIGJlZW4gY29tYmluZWQgd2l0aCB0aGUgZGVsZXRlIGV4YW1w bGUuDQoNCkluc3RydWN0aW9uczoNCi0tLS0tLS0tLS0tLS0NClRoaXMgZXJyYXR1bSBpcyBjdXJy ZW50bHkgcG9zdGVkIGFzICJSZXBvcnRlZCIuIElmIG5lY2Vzc2FyeSwgcGxlYXNlDQp1c2UgIlJl cGx5IEFsbCIgdG8gZGlzY3VzcyB3aGV0aGVyIGl0IHNob3VsZCBiZSB2ZXJpZmllZCBvcg0KcmVq ZWN0ZWQuIFdoZW4gYSBkZWNpc2lvbiBpcyByZWFjaGVkLCB0aGUgdmVyaWZ5aW5nIHBhcnR5ICAN CmNhbiBsb2cgaW4gdG8gY2hhbmdlIHRoZSBzdGF0dXMgYW5kIGVkaXQgdGhlIHJlcG9ydCwgaWYg bmVjZXNzYXJ5LiANCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NClJG QzgwMDcgKGRyYWZ0LWlldGYtY2RuaS1jb250cm9sLXRyaWdnZXJzLTE1KQ0KLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NClRpdGxlICAgICAgICAgICAgICAgOiBDb250ZW50 IERlbGl2ZXJ5IE5ldHdvcmsgSW50ZXJjb25uZWN0aW9uIChDRE5JKSBDb250cm9sIEludGVyZmFj ZSAvIFRyaWdnZXJzDQpQdWJsaWNhdGlvbiBEYXRlICAgIDogRGVjZW1iZXIgMjAxNg0KQXV0aG9y KHMpICAgICAgICAgICA6IFIuIE11cnJheSwgQi4gTml2ZW4tSmVua2lucw0KQ2F0ZWdvcnkgICAg ICAgICAgICA6IFBST1BPU0VEIFNUQU5EQVJEDQpTb3VyY2UgICAgICAgICAgICAgIDogQ29udGVu dCBEZWxpdmVyeSBOZXR3b3JrcyBJbnRlcmNvbm5lY3Rpb24NCkFyZWEgICAgICAgICAgICAgICAg OiBBcHBsaWNhdGlvbnMgYW5kIFJlYWwtVGltZQ0KU3RyZWFtICAgICAgICAgICAgICA6IElFVEYN ClZlcmlmeWluZyBQYXJ0eSAgICAgOiBJRVNHDQoNCg0K From nobody Thu Jul 13 11:17:51 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ED5F129B05 for ; Thu, 13 Jul 2017 11:17:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AiweFO836k3b for ; Thu, 13 Jul 2017 11:17:48 -0700 (PDT) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 522B91296C6 for ; Thu, 13 Jul 2017 11:17:48 -0700 (PDT) X-AuditID: c618062d-dc5689c000002716-bb-5967ceebbb09 Received: from EUSAAHC003.ericsson.se (Unknown_Domain [147.117.188.81]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id FB.25.10006.BEEC7695; Thu, 13 Jul 2017 21:50:03 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC003.ericsson.se ([147.117.188.81]) with mapi id 14.03.0352.000; Thu, 13 Jul 2017 14:17:45 -0400 From: Kevin Ma J To: "'cdni@ietf.org'" Thread-Topic: IETF 99 Agenda Thread-Index: AdL8BARoi1U+U8LQTnyUW0Z6zMBcoA== Date: Thu, 13 Jul 2017 18:17:45 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrPLMWRmVeSWpSXmKPExsUyuXRPoO7rc+mRBntualo8nf2H1YHRY8mS n0wBjFFcNimpOZllqUX6dglcGatX9TAV7GSveLDuMnsD41vWLkZODgkBE4mlLw+xdDFycQgJ HGWU+ND+iRkkISSwnFFiw3FnEJtNQEvi8de/TF2MHBwiAqoSZ74Wg4SFBaQlJu8A6eUECstI nN7TyQZRoidxdKYmSJgFqPpY10cmEJtXwFfi2LqZ7CA2o4CYxPdTa8DizALiEreezGeCOEdA Ysme88wQtqjEy8f/oM5UlNjXP50dol5HYsHuT2wQtrbEsoWvmSHmC0qcnPmEZQKj0CwkY2ch aZmFpGUWkpYFjCyrGDlKiwtyctONDDYxAoP1mASb7g7G+9M9DzEKcDAq8fA+3pUeKcSaWFZc mXuIUYKDWUmE99ByoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHeCecvRAgJpCeWpGanphakFsFk mTg4pRoY+bKndfR4802YydtbtGLDD7Ptkh/Wf9xktX9i4vagymnK2o85L4vVTbnGcndu3gHL fQZ5T5qfHi1liVPbuylOa4/R7h9RgTdcdgVfjcnlVjx/j6U1kOnSjRXb2lftN+JfU7BL5s3W gFUqpx9pzbXuVRTYbarB0r12g8Fss9nl+opspyWMPuSuUmIpzkg01GIuKk4EAP1FZh9SAgAA Archived-At: Subject: Re: [CDNi] IETF 99 Agenda X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Jul 2017 18:17:49 -0000 Hi All, The final agenda has been uploaded: https://datatracker.ietf.org/meeting/= 99/agenda/cdni/ Note: the meeting time/place has changed to: Monday, July 17, 2017, 17:40= -18:40, Berlin/Brussels thanx! -- Kevin and Francois > -----Original Message----- > From: Kevin Ma J > Sent: Monday, July 03, 2017 10:52 AM > To: 'cdni@ietf.org' > Subject: RE: IETF 99 Draft Agenda >=20 > Hi All, >=20 > Updated draft agenda available: > https://www.ietf.org/proceedings/99/agenda/agenda-99-cdni-01 >=20 > thanx. >=20 > -- Kevin and Francois >=20 > > -----Original Message----- > > From: Kevin Ma J > > Sent: Friday, June 30, 2017 3:55 PM > > To: cdni@ietf.org > > Subject: IETF 99 Draft Agenda > > > > Hi All, > > > > We have posted the draft agenda for our session in Prague: > > https://www.ietf.org/proceedings/99/agenda/agenda-99-cdni-00 > > > > thanx! > > > > -- Kevin and Francois From nobody Sun Jul 16 01:10:21 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 111441275AB for ; Sun, 16 Jul 2017 01:10:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.421 X-Spam-Level: X-Spam-Status: No, score=-6.421 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C4R-OqIgwvGO for ; Sun, 16 Jul 2017 01:10:18 -0700 (PDT) Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by ietfa.amsl.com (Postfix) with SMTP id 607AA127180 for ; Sun, 16 Jul 2017 01:10:18 -0700 (PDT) Received: (qmail 40903 invoked by uid 99); 15 Jul 2017 16:10:17 -0000 Received: from Unknown (HELO mail-relay.apache.org) (140.211.11.15) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 15 Jul 2017 16:10:17 +0000 Received: from mail-io0-f170.google.com (mail-io0-f170.google.com [209.85.223.170]) by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id 5D6F71A0029 for ; Sat, 15 Jul 2017 16:10:16 +0000 (UTC) Received: by mail-io0-f170.google.com with SMTP id h64so27027078iod.0 for ; Sat, 15 Jul 2017 09:10:16 -0700 (PDT) X-Gm-Message-State: AIVw110LQGARU8PGDDeGYbF98z0c2Ua5cVhUsC6FU3tjbbP0nfDqPxNg HlmTsf+IAgOGxqt9JeyleTxFl1ZuXQ== X-Received: by 10.107.158.84 with SMTP id h81mr12017583ioe.97.1500135013940; Sat, 15 Jul 2017 09:10:13 -0700 (PDT) MIME-Version: 1.0 References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> In-Reply-To: <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> From: Phil Sorber Date: Sat, 15 Jul 2017 16:10:03 +0000 X-Gmail-Original-Message-ID: Message-ID: To: "Kent Leung (kleung)" , Ben Niven-Jenkins Cc: "cdni@ietf.org" Content-Type: multipart/alternative; boundary="001a1140ba929f164a05545d6670" Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Jul 2017 08:10:21 -0000 --001a1140ba929f164a05545d6670 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I created this PR to add that paragraph back. Can you guys comment? https://github.com/PSUdaemon/URISigningSpec/pull/22 Thanks. On Wed, Jul 5, 2017 at 11:24 PM Kent Leung (kleung) wrote: > Hi Ben. Thanks for your review comments. See my response to some of them > below. > > > > > > > > *From:* CDNi [mailto:cdni-bounces@ietf.org] *On Behalf Of *Ben > Niven-Jenkins > *Sent:* Tuesday, July 4, 2017 3:59 AM > *To:* Phil Sorber > *Cc:* cdni@ietf.org > > > *Subject:* Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt > > > > Hi Phil & URI Signing authors, > > > > I read the latest draft (-12) and below are some questions / thoughts, in > no particular order, that occurred to me while reading the document. > > > > * Why support both symmetric & asymmetric keys? What is the advantage to > having both options versus just picking one option (probably asymmetric > keys as they work for all use cases)? > > > > KL> There are pros and cons of using either asymmetric keys vs symmetric > key. Key distribution limitations and relationships between CSP and CDNs > are factors. So I think supporting both allows flexibility for deployment= s > of URI signing. Existing URI signing proprietary implementations typicall= y > support both already. > > > > > > * How are the keys distributed between CDNs? I don=E2=80=99t see a proper= ty in the > UriSigning Metadata object that would include (or link to) the keys (I=E2= =80=99m > assuming you need to support distribution of at least 2 keys to support k= ey > rotation)? > > > > KL> Key distribution is out of scope. I noticed following text was droppe= d > when method converted to JWT. We can put this back in CDNI Overview > section, where the asymmetric and symmetric key methods are mentioned. > > > > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric keys a= nd > > symmetric keys. Asymmetric keys are based on a public/private key > > pair mechanism and always contain a private key only known to the > > entity signing the URI (either CSP or uCDN) and a public key for the > > verification of the Signed URI. With symmetric keys, the same key is > > used by both the signing entity for signing the URI as well as by the > > validating entity for validating the Signed URI. Regardless of the > > type of keys used, the validating entity has to obtain the key > > (either the public or the symmetric key). There are very different > > requirements for key distribution (out of scope of this document) > > with asymmetric keys and with symmetric keys. Key distribution for > > symmetric keys requires confidentiality to prevent another party from > > getting access to the key, since it could then generate valid Signed > > URIs for unauthorized requests. Key distribution for asymmetric keys > > does not require confidentiality since public keys can typically be > > distributed openly (because they cannot be used for URI signing) and > > private keys are kept by the URI signing function.=E2=80=9D > > > > > > * How does a uCDN know whether it is OK/safe/within policy to > re-distribute symmetric keys to a dCDN? > > > > KL> See above. > > > > * In the case of Signed Token chains, how does a CDN obtain the keys > required to sign the new tokens in the chain as it generates them? > > > > KL> See above. > > > > Kent > > > > > > * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t know h= ow one > could communicate a token chain via the query string as specified in the > document, as there is no =E2=80=9Cback channel=E2=80=9D for the CDN to co= mmunicate the next > token in the chain to the UA. > > > > HTH > > Ben > > > > On 25 Jun 2017, at 21:19, Phil Sorber wrote: > > > > Really hoping to get some feedback on this at the meeting in Prague. It's > got all the changes that have been discussed so I'm not aware of any more > substantive changes needed. However, lots of editorial nits I suspect. > > Thanks. > > > > On Sun, Jun 25, 2017 at 2:12 PM wrote: > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Content Delivery Networks Interconnectio= n > of the IETF. > > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 > > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. > > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > > > --001a1140ba929f164a05545d6670 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I created this PR to add that paragraph back. Can you guys= comment?

On Wed, Jul 5, 2017 at 11:24 PM Kent Leung (kleung) <kleung@cisco.com> wrote:

Hi Ben. Thanks for your review comments.=C2=A0 See my response= to some of them below.

=C2=A0

= =C2=A0

=C2=A0

From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Ben Niven-Jenkins
Sent: Tuesday, July 4, 2017 3:59 AM
To: Phil Sorber <sorber@apache.org>
Cc: cdni@ietf.org=


Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt

=C2=A0

Hi Phil & URI Signing authors,

=

=C2=A0

I read the latest draft (-12) and below are some que= stions / thoughts, in no particular order, that occurred to me while readin= g the document.

=C2=A0

* Why support both symmetric & asymmetric keys? = What is the advantage to having both options versus just picking one option= (probably asymmetric keys as they work for all use cases)?

=C2=A0

KL> There are pros and cons of usi= ng either asymmetric keys vs symmetric key. Key distribution limitations an= d relationships between CSP and CDNs are factors. So I think supporting both allows flexibility for deployments of URI signi= ng. Existing URI signing proprietary implementations typically support both= already.

=C2=A0

=C2=A0

* How are the keys distributed between CDNs? I don= =E2=80=99t see a property in the UriSigning Metadata object that would incl= ude (or link to) the keys (I=E2=80=99m assuming you need to support distrib= ution of at least 2 keys to support key rotation)?

=C2=A0

KL> Key distribution is out of sco= pe. I noticed following text was dropped when method converted to JWT. We c= an put this back in CDNI Overview section, where the asymmetric and symmetric key methods are mentioned.

=C2=A0

=E2=80=9CTwo types of keys can be use= d for URI Signing: asymmetric keys and

=C2=A0=C2=A0 symmetric keys.=C2=A0 As= ymmetric keys are based on a public/private key

=C2=A0=C2=A0 pair mechanism and alway= s contain a private key only known to the

=C2=A0=C2=A0 entity signing the URI (= either CSP or uCDN) and a public key for the

=C2=A0=C2=A0 verification of the Sign= ed URI.=C2=A0 With symmetric keys, the same key is

=C2=A0=C2=A0 used by both the signing= entity for signing the URI as well as by the

=C2=A0=C2=A0 validating entity for va= lidating the Signed URI.=C2=A0 Regardless of the

=C2=A0=C2=A0 type of keys used, the v= alidating entity has to obtain the key

=C2=A0=C2=A0 (either the public or th= e symmetric key).=C2=A0 There are very different

=C2=A0=C2=A0 requirements for key dis= tribution (out of scope of this document)

=C2=A0=C2=A0 with asymmetric keys and= with symmetric keys.=C2=A0 Key distribution for

=C2=A0=C2=A0 symmetric keys requires = confidentiality to prevent another party from

=C2=A0=C2=A0 getting access to the ke= y, since it could then generate valid Signed

=C2=A0=C2=A0 URIs for unauthorized re= quests.=C2=A0 Key distribution for asymmetric keys

=C2=A0=C2=A0 does not require confide= ntiality since public keys can typically be

=C2=A0=C2=A0 distributed openly (beca= use they cannot be used for URI signing) and

=C2=A0=C2=A0 private keys are kept by= the URI signing function.=E2=80=9D

=C2=A0

=C2=A0

* How does a uCDN know whether it is OK/safe/within = policy to re-distribute symmetric keys to a dCDN?

=C2=A0

KL> See above.

=C2=A0

* In the case of Signed Token chains, how does a CDN= obtain the keys required to sign the new tokens in the chain as it generat= es them?

=C2=A0

KL> See above.

<= div class=3D"m_3681488755081264711WordSection1">

=C2=A0

Kent

=C2=A0

=C2=A0

* Section 3.3.1 I think needs to be more explicit, I= don=E2=80=99t know how one could communicate a token chain via the query s= tring as specified in the document, as there is no =E2=80=9Cback channel=E2= =80=9D for the CDN to communicate the next token in the chain to the UA.

=C2=A0

HTH

Ben

=C2=A0

On 25 Jun 2017, at 21:19, Phil Sorber <sorber@apache.org> wrot= e:

=C2=A0

Really hoping to get = some feedback on this at the meeting in Prague. It's got all the change= s that have been discussed so I'm not aware of any more substantive cha= nges needed. However, lots of editorial nits I suspect.

Thanks.

=C2=A0

On Sun, Jun 25, 2017 at 2:12 PM <internet-drafts@ietf.org&= gt; wrote:


A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Content Delivery Networks Interconnection = of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= URI Signing for CDN Interconnection (CDNI)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Ray = van Brandenburg
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Kent Leung
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Phil Sorber
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-cdni-uri-signing-12.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 35
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2017-06-25

Abstract:
=C2=A0 =C2=A0This document describes how the concept of URI signing support= s the
=C2=A0 =C2=A0content access control requirements of CDNI and proposes a URI=
=C2=A0 =C2=A0signing method as a JSON Web Token (JWT) [RFC7519] profile.
=C2=A0 =C2=A0The proposed URI signing method specifies the information need= ed to
=C2=A0 =C2=A0be included in the URI to transmit the signed JWT as well as t= he
=C2=A0 =C2=A0claims needed by the signed JWT to authorize a UA.=C2=A0 The m= echanism
=C2=A0 =C2=A0described can be used both in CDNI and single CDN scenarios.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signi= ng/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12
https://datatracker.ietf.org/doc/html/draft-ietf-cd= ni-uri-signing-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-u= ri-signing-12


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp= .ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
CDNi@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/cdni

=C2=A0

--001a1140ba929f164a05545d6670-- From nobody Tue Jul 18 07:33:53 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 507FF12F3CB for ; Tue, 18 Jul 2017 07:33:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2-1ie8f--uca for ; Tue, 18 Jul 2017 07:33:46 -0700 (PDT) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.146]) by ietfa.amsl.com (Postfix) with ESMTP id 62803131B11 for ; Tue, 18 Jul 2017 07:33:44 -0700 (PDT) Received: from [176.24.45.127] (helo=[192.168.0.6]) by smtp04.mailcore.me with esmtpa (Exim 4.89) (envelope-from ) id 1dXTZF-0007na-OQ; Tue, 18 Jul 2017 15:33:43 +0100 From: Ben Niven-Jenkins Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_2B4E26BB-4240-4924-AE35-1D2619748D7E" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 18 Jul 2017 15:33:40 +0100 In-Reply-To: <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> Cc: Phil Sorber , "cdni@ietf.org" To: "Kent Leung (kleung)" References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> X-Mailer: Apple Mail (2.3273) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 X-KLMS-Rule-ID: 1 X-KLMS-Message-Action: clean X-KLMS-AntiSpam-Status: not scanned, license restriction X-KLMS-AntiPhishing: not scanned, license restriction X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.721, bases: 2017/07/18 07:52:00 #10107487 X-KLMS-AntiVirus-Status: Clean, skipped Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 14:33:52 -0000 --Apple-Mail=_2B4E26BB-4240-4924-AE35-1D2619748D7E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Kent, See inline > On 5 Jul 2017, at 22:23, Kent Leung (kleung) wrote: > From: CDNi [mailto:cdni-bounces@ietf.org = ] On Behalf Of Ben Niven-Jenkins > Sent: Tuesday, July 4, 2017 3:59 AM > =20 > Hi Phil & URI Signing authors, > =20 > I read the latest draft (-12) and below are some questions / thoughts, = in no particular order, that occurred to me while reading the document. > =20 > * Why support both symmetric & asymmetric keys? What is the advantage = to having both options versus just picking one option (probably = asymmetric keys as they work for all use cases)? > =20 > KL> There are pros and cons of using either asymmetric keys vs = symmetric key. Key distribution limitations and relationships between = CSP and CDNs are factors. So I think supporting both allows flexibility = for deployments of URI signing. Existing URI signing proprietary = implementations typically support both already. Apologies if I=E2=80=99m raking up discussions you=E2=80=99ve already = had when writing the document. Can you expand on what factors justify = having two different methods for signing URIs? I am coming from the point of view that I can=E2=80=99t think of = sufficient justification for having two methods. symmetric keys have the = downside of requiring confidentiality. asymmetric keys do not suffer = that issue. What is the downside of asymmetric keys that justifies using = symmetric keys and tackling the issue of maintaining confidentiality? In other words, why not just specify asymmetric keys and leave it at = that? I am also worried about interoperability because if you specify both = symmetric & asymmetric keys I think it is far from guaranteed that all = implementations will implement both variants and I=E2=80=99m yet to be = convinced that we need to take that risk at all. Ben > =20 > =20 > * How are the keys distributed between CDNs? I don=E2=80=99t see a = property in the UriSigning Metadata object that would include (or link = to) the keys (I=E2=80=99m assuming you need to support distribution of = at least 2 keys to support key rotation)? > =20 > KL> Key distribution is out of scope. I noticed following text was = dropped when method converted to JWT. We can put this back in CDNI = Overview section, where the asymmetric and symmetric key methods are = mentioned. > =20 > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric = keys and > symmetric keys. Asymmetric keys are based on a public/private key > pair mechanism and always contain a private key only known to the > entity signing the URI (either CSP or uCDN) and a public key for = the > verification of the Signed URI. With symmetric keys, the same key = is > used by both the signing entity for signing the URI as well as by = the > validating entity for validating the Signed URI. Regardless of the > type of keys used, the validating entity has to obtain the key > (either the public or the symmetric key). There are very different > requirements for key distribution (out of scope of this document) > with asymmetric keys and with symmetric keys. Key distribution for > symmetric keys requires confidentiality to prevent another party = from > getting access to the key, since it could then generate valid = Signed > URIs for unauthorized requests. Key distribution for asymmetric = keys > does not require confidentiality since public keys can typically be > distributed openly (because they cannot be used for URI signing) = and > private keys are kept by the URI signing function.=E2=80=9D > =20 > =20 > * How does a uCDN know whether it is OK/safe/within policy to = re-distribute symmetric keys to a dCDN? > =20 > KL> See above. > =20 > * In the case of Signed Token chains, how does a CDN obtain the keys = required to sign the new tokens in the chain as it generates them? > =20 > KL> See above. > =20 > Kent > =20 > =20 > * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t = know how one could communicate a token chain via the query string as = specified in the document, as there is no =E2=80=9Cback channel=E2=80=9D = for the CDN to communicate the next token in the chain to the UA. > =20 > HTH > Ben > =20 > On 25 Jun 2017, at 21:19, Phil Sorber > wrote: > =20 > Really hoping to get some feedback on this at the meeting in Prague. = It's got all the changes that have been discussed so I'm not aware of = any more substantive changes needed. However, lots of editorial nits I = suspect. >=20 > Thanks. > =20 > On Sun, Jun 25, 2017 at 2:12 PM > wrote: >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Content Delivery Networks = Interconnection of the IETF. >=20 > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 >=20 > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. >=20 > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ = >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 = > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 = >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 = >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org = . >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ = >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = > =20 --Apple-Mail=_2B4E26BB-4240-4924-AE35-1D2619748D7E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Kent,

See inline

On 5 Jul 2017, at 22:23, Kent = Leung (kleung) <kleung@cisco.com> wrote:
From: CDNi [mailto:cdni-bounces@ietf.org] On = Behalf Of Ben Niven-Jenkins
Sent: Tuesday, July 4, 2017 3:59 = AM
 
Hi Phil & URI Signing authors,
 
I read the latest draft (-12) and below = are some questions / thoughts, in no particular order, that occurred to = me while reading the document.
 
* Why support both symmetric & asymmetric keys? = What is the advantage to having both options versus just picking one = option (probably asymmetric keys as they work for all use cases)?
 
KL> There are pros = and cons of using either asymmetric keys vs symmetric key. Key = distribution limitations and relationships between CSP and CDNs are = factors. So I think supporting both allows flexibility for deployments = of URI signing. Existing URI signing proprietary implementations = typically support both = already.

Apologies if I=E2=80=99m raking up discussions you=E2=80=99= ve already had when writing the document. Can you expand on what factors = justify having two different methods for signing URIs?

I am coming from the point of view that I can=E2=80=99= t think of sufficient justification for having two methods. symmetric = keys have the downside of requiring confidentiality. asymmetric keys do = not suffer that issue. What is the downside of asymmetric keys that = justifies using symmetric keys and tackling the issue of maintaining = confidentiality?

In other = words, why not just specify asymmetric keys and leave it at = that?

I am also worried about = interoperability because if you specify both symmetric & asymmetric = keys I think it is far from guaranteed that all implementations will = implement both variants and I=E2=80=99m yet to be convinced that we need = to take that risk at all.
Ben

 
 
* How are the keys distributed between = CDNs? I don=E2=80=99t see a property in the UriSigning Metadata object = that would include (or link to) the keys (I=E2=80=99m assuming you need = to support distribution of at least 2 keys to support key rotation)?
 
KL> Key distribution = is out of scope. I noticed following text was dropped when method = converted to JWT. We can put this back in CDNI Overview section, where = the asymmetric and symmetric key methods are mentioned.
 
=E2=80=9CTwo types of = keys can be used for URI Signing: asymmetric keys and
   symmetric keys.  = Asymmetric keys are based on a public/private key
   pair mechanism and always = contain a private key only known to the
   entity signing the URI = (either CSP or uCDN) and a public key for the
   verification of the Signed = URI.  With symmetric keys, the same key is
   used by both the signing = entity for signing the URI as well as by the
   validating entity for = validating the Signed URI.  Regardless of the
   type of keys used, the = validating entity has to obtain the key
   (either the public or the = symmetric key).  There are very different
   requirements for key = distribution (out of scope of this document)
   with asymmetric keys and with = symmetric keys.  Key distribution for
   symmetric keys requires = confidentiality to prevent another party from
   getting access to the key, = since it could then generate valid Signed
   URIs for unauthorized = requests.  Key distribution for asymmetric keys
   does not require = confidentiality since public keys can typically be
   distributed openly (because = they cannot be used for URI signing) and
   private keys are kept by the = URI signing function.=E2=80=9D
 
 
* How does a uCDN know whether it is = OK/safe/within policy to re-distribute symmetric keys to a dCDN?
 
KL> See above.
 
* In the case of Signed Token chains, how = does a CDN obtain the keys required to sign the new tokens in the chain = as it generates them?
 
KL> See above.
 
Kent
 
 
* Section 3.3.1 I think needs to be more = explicit, I don=E2=80=99t know how one could communicate a token chain = via the query string as specified in the document, as there is no = =E2=80=9Cback channel=E2=80=9D for the CDN to communicate the next token = in the chain to the UA.
 
HTH
Ben
 
On 25 Jun 2017, at = 21:19, Phil Sorber <sorber@apache.org> wrote:
 

Really hoping = to get some feedback on this at the meeting in Prague. It's got all the = changes that have been discussed so I'm not aware of any more = substantive changes needed. However, lots of editorial nits I = suspect.

Thanks.
 
On Sun, Jun 25, 2017 at 2:12 PM <internet-drafts@ietf.org> = wrote:

A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Content Delivery Networks Interconnection of the IETF.

        Title    =        : URI Signing for CDN Interconnection = (CDNI)
        Authors    =      : Ray van Brandenburg
    =                     =   Kent Leung
          =                 Phil Sorber
        Filename      =   : draft-ietf-cdni-uri-signing-12.txt
    =     Pages           : 35
        Date        =     : 2017-06-25

Abstract:
   This document describes how the concept of URI = signing supports the
   content access control = requirements of CDNI and proposes a URI
  =  signing method as a JSON Web Token (JWT) [RFC7519] profile.

   The proposed URI signing method = specifies the information needed to
   be = included in the URI to transmit the signed JWT as well as the
   claims needed by the signed JWT to authorize a = UA.  The mechanism
   described can be used = both in CDNI and single CDN scenarios.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/

There are also htmlized versions = available at:
https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12<= br class=3D"">https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signi= ng-12

A diff from the previous version = is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing= -12


Please note that it = may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni
_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni
 

= --Apple-Mail=_2B4E26BB-4240-4924-AE35-1D2619748D7E-- From nobody Tue Jul 18 07:35:00 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EA9A12F3CB for ; Tue, 18 Jul 2017 07:34:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SFL1lNwJmIvN for ; Tue, 18 Jul 2017 07:34:55 -0700 (PDT) Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.146]) by ietfa.amsl.com (Postfix) with ESMTP id B73FC13167B for ; Tue, 18 Jul 2017 07:34:54 -0700 (PDT) Received: from [176.24.45.127] (helo=[192.168.0.6]) by smtp04.mailcore.me with esmtpa (Exim 4.89) (envelope-from ) id 1dXTaO-0009J8-Qq; Tue, 18 Jul 2017 15:34:54 +0100 From: Ben Niven-Jenkins Message-Id: <0FA2A300-501E-42B5-89B3-F5522B720468@niven-jenkins.co.uk> Content-Type: multipart/alternative; boundary="Apple-Mail=_43106485-2AF8-4E31-8BBC-0F752851A830" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 18 Jul 2017 15:34:52 +0100 In-Reply-To: Cc: "Kent Leung (kleung)" , "cdni@ietf.org" To: Phil Sorber References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> X-Mailer: Apple Mail (2.3273) X-Mailcore-Auth: 9600544 X-Mailcore-Domain: 172912 X-KLMS-Rule-ID: 1 X-KLMS-Message-Action: clean X-KLMS-AntiSpam-Status: not scanned, license restriction X-KLMS-AntiPhishing: not scanned, license restriction X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.721, bases: 2017/07/18 07:52:00 #10107487 X-KLMS-AntiVirus-Status: Clean, skipped Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 14:34:58 -0000 --Apple-Mail=_43106485-2AF8-4E31-8BBC-0F752851A830 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Phil, I think the text is fine for the document as-is. Although see my = response to Kent as I=E2=80=99m currently unconvinced we should try to = specify both symmetric & asymmetric keys. Regards Ben > On 15 Jul 2017, at 17:10, Phil Sorber wrote: >=20 > I created this PR to add that paragraph back. Can you guys comment? >=20 > https://github.com/PSUdaemon/URISigningSpec/pull/22 = >=20 > Thanks. >=20 > On Wed, Jul 5, 2017 at 11:24 PM Kent Leung (kleung) > wrote: > Hi Ben. Thanks for your review comments.=C2=A0 See my response to some = of them below. <> > =20 >=20 > =20 >=20 > =20 >=20 > From: CDNi [mailto:cdni-bounces@ietf.org = ] On Behalf Of Ben Niven-Jenkins > Sent: Tuesday, July 4, 2017 3:59 AM > To: Phil Sorber > > Cc: cdni@ietf.org >=20 > Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt >=20 >=20 > =20 >=20 > Hi Phil & URI Signing authors, >=20 > =20 >=20 > I read the latest draft (-12) and below are some questions / thoughts, = in no particular order, that occurred to me while reading the document. >=20 > =20 >=20 > * Why support both symmetric & asymmetric keys? What is the advantage = to having both options versus just picking one option (probably = asymmetric keys as they work for all use cases)? >=20 > =20 >=20 > KL> There are pros and cons of using either asymmetric keys vs = symmetric key. Key distribution limitations and relationships between = CSP and CDNs are factors. So I think supporting both allows flexibility = for deployments of URI signing. Existing URI signing proprietary = implementations typically support both already. >=20 > =20 >=20 > =20 >=20 > * How are the keys distributed between CDNs? I don=E2=80=99t see a = property in the UriSigning Metadata object that would include (or link = to) the keys (I=E2=80=99m assuming you need to support distribution of = at least 2 keys to support key rotation)? >=20 > =20 >=20 > KL> Key distribution is out of scope. I noticed following text was = dropped when method converted to JWT. We can put this back in CDNI = Overview section, where the asymmetric and symmetric key methods are = mentioned. >=20 > =20 >=20 > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric = keys and >=20 > symmetric keys. Asymmetric keys are based on a public/private key >=20 > pair mechanism and always contain a private key only known to the >=20 > entity signing the URI (either CSP or uCDN) and a public key for = the >=20 > verification of the Signed URI. With symmetric keys, the same key = is >=20 > used by both the signing entity for signing the URI as well as by = the >=20 > validating entity for validating the Signed URI. Regardless of the >=20 > type of keys used, the validating entity has to obtain the key >=20 > (either the public or the symmetric key). There are very different >=20 > requirements for key distribution (out of scope of this document) >=20 > with asymmetric keys and with symmetric keys. Key distribution for >=20 > symmetric keys requires confidentiality to prevent another party = from >=20 > getting access to the key, since it could then generate valid = Signed >=20 > URIs for unauthorized requests. Key distribution for asymmetric = keys >=20 > does not require confidentiality since public keys can typically be >=20 > distributed openly (because they cannot be used for URI signing) = and >=20 > private keys are kept by the URI signing function.=E2=80=9D >=20 > =20 >=20 > =20 >=20 > * How does a uCDN know whether it is OK/safe/within policy to = re-distribute symmetric keys to a dCDN? >=20 > =20 >=20 > KL> See above. >=20 > =20 >=20 > * In the case of Signed Token chains, how does a CDN obtain the keys = required to sign the new tokens in the chain as it generates them? >=20 > =20 >=20 > KL> See above. >=20 > =20 >=20 > Kent >=20 > =20 >=20 > =20 >=20 > * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t = know how one could communicate a token chain via the query string as = specified in the document, as there is no =E2=80=9Cback channel=E2=80=9D = for the CDN to communicate the next token in the chain to the UA. >=20 > =20 >=20 > HTH >=20 > Ben >=20 > =20 >=20 > On 25 Jun 2017, at 21:19, Phil Sorber > wrote: >=20 > =20 >=20 > Really hoping to get some feedback on this at the meeting in Prague. = It's got all the changes that have been discussed so I'm not aware of = any more substantive changes needed. However, lots of editorial nits I = suspect. >=20 > Thanks. >=20 > =20 >=20 > On Sun, Jun 25, 2017 at 2:12 PM > wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Content Delivery Networks = Interconnection of the IETF. >=20 > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 >=20 > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. >=20 > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ = >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 = > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 = >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 = >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org = . >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ = >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni = > =20 >=20 --Apple-Mail=_43106485-2AF8-4E31-8BBC-0F752851A830 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Phil,

I = think the text is fine for the document as-is. Although see my response = to Kent as I=E2=80=99m currently unconvinced we should try to specify = both symmetric & asymmetric keys.

Regards
Ben

On 15 Jul 2017, at 17:10, Phil = Sorber <sorber@apache.org> wrote:

I created this PR to add that paragraph back. Can you guys = comment?

https://github.com/PSUdaemon/URISigningSpec/pull/22

Thanks.

On Wed, Jul 5, 2017 at 11:24 PM Kent Leung = (kleung) <kleung@cisco.com> wrote:

Hi Ben. Thanks for your review comments.  See = my response to some of them below.

 

 

 

From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Ben Niven-Jenkins
Sent: Tuesday, July 4, 2017 3:59 AM
To: Phil Sorber <sorber@apache.org>
Cc: cdni@ietf.org


Subject: Re: [CDNi] I-D Action: = draft-ietf-cdni-uri-signing-12.txt


 

Hi Phil & URI Signing = authors,

 

I read the latest draft (-12) and = below are some questions / thoughts, in no particular order, that = occurred to me while reading the document.

 

* Why support both symmetric = & asymmetric keys? What is the advantage to having both options = versus just picking one option (probably asymmetric keys as they work = for all use cases)?

 

KL> There are pros and cons of using either = asymmetric keys vs symmetric key. Key distribution limitations and = relationships between CSP and CDNs are factors. So I think supporting both allows flexibility for deployments of URI = signing. Existing URI signing proprietary implementations typically = support both already.

 

 

=

* How are the keys distributed = between CDNs? I don=E2=80=99t see a property in the UriSigning Metadata = object that would include (or link to) the keys (I=E2=80=99m assuming = you need to support distribution of at least 2 keys to support key = rotation)?

 

KL> Key distribution is out of scope. I noticed = following text was dropped when method converted to JWT. We can put this = back in CDNI Overview section, where the asymmetric and symmetric key methods are mentioned.

 

=E2=80=9CTwo types of keys can be used for URI = Signing: asymmetric keys and

   symmetric keys.  Asymmetric keys = are based on a public/private key

   pair mechanism and always contain a = private key only known to the

   entity signing the URI (either CSP or = uCDN) and a public key for the

   verification of the Signed URI.  = With symmetric keys, the same key is

   used by both the signing entity for = signing the URI as well as by the

   validating entity for validating the = Signed URI.  Regardless of the

   type of keys used, the validating = entity has to obtain the key

   (either the public or the symmetric = key).  There are very different

   requirements for key distribution (out = of scope of this document)

   with asymmetric keys and with = symmetric keys.  Key distribution for

   symmetric keys requires = confidentiality to prevent another party from

   getting access to the key, since it = could then generate valid Signed

   URIs for unauthorized requests.  = Key distribution for asymmetric keys

   does not require confidentiality since = public keys can typically be

   distributed openly (because they = cannot be used for URI signing) and

   private keys are kept by the URI = signing function.=E2=80=9D

 

 

=

* How does a uCDN know whether it = is OK/safe/within policy to re-distribute symmetric keys to a dCDN?

 

KL> See above.

 

=

* In the case of Signed Token = chains, how does a CDN obtain the keys required to sign the new tokens = in the chain as it generates them?

=

 

KL> See above.

 

Kent

 

 

=

* Section 3.3.1 I think needs to = be more explicit, I don=E2=80=99t know how one could communicate a token = chain via the query string as specified in the document, as there is no = =E2=80=9Cback channel=E2=80=9D for the CDN to communicate the next token = in the chain to the UA.

 

HTH

Ben

 

On 25 Jun 2017, at 21:19, Phil = Sorber <sorber@apache.org> wrote:

 

Really hoping to get some feedback on = this at the meeting in Prague. It's got all the changes that have been = discussed so I'm not aware of any more substantive changes needed. = However, lots of editorial nits I suspect.

Thanks.

 

On Sun, Jun 25, 2017 at 2:12 PM = <internet-drafts@ietf.org> wrote:


A New Internet-Draft is available from the on-line Internet-Drafts = directories.
This draft is a work item of the Content Delivery Networks = Interconnection of the IETF.

        Title          =  : URI Signing for CDN Interconnection (CDNI)
        Authors         : = Ray van Brandenburg
                    =       Kent Leung
                    =       Phil Sorber
        Filename        : = draft-ietf-cdni-uri-signing-12.txt
        Pages          =  : 35
        Date          =   : 2017-06-25

Abstract:
   This document describes how the concept of URI signing = supports the
   content access control requirements of CDNI and proposes a = URI
   signing method as a JSON Web Token (JWT) [RFC7519] = profile.

   The proposed URI signing method specifies the information = needed to
   be included in the URI to transmit the signed JWT as well = as the
   claims needed by the signed JWT to authorize a UA.  = The mechanism
   described can be used both in CDNI and single CDN = scenarios.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12<= br class=3D""> https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signi= ng-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing= -12


Please note that it may take a couple of minutes from the time of = submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

 


= --Apple-Mail=_43106485-2AF8-4E31-8BBC-0F752851A830-- From nobody Tue Jul 18 08:54:48 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AB721318A8 for ; Tue, 18 Jul 2017 08:54:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZCsFFhJ0-9dR for ; Tue, 18 Jul 2017 08:54:46 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EE38131563 for ; Tue, 18 Jul 2017 08:54:46 -0700 (PDT) X-AuditID: c6180641-befff70000001788-2b-596de8e4ca0d Received: from EUSAAHC001.ericsson.se (Unknown_Domain [147.117.188.75]) by usplmg21.ericsson.net (Symantec Mail Security) with SMTP id E5.CB.06024.4E8ED695; Tue, 18 Jul 2017 12:54:28 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC001.ericsson.se ([147.117.188.75]) with mapi id 14.03.0352.000; Tue, 18 Jul 2017 11:54:44 -0400 From: Kevin Ma J To: "cdni@ietf.org" Thread-Topic: IETF99 CDNI minutes Thread-Index: AdL/3iGnTUpmDMKmSKqT2dhU7Z5eDA== Date: Tue, 18 Jul 2017 15:54:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrALMWRmVeSWpSXmKPExsUyuXSPt+6TF7mRBmfajC2ezv7D6sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujHffvzMV3GSsOLDlOWsD4zLGLkZODgkBE4ktJ/YzdzFycQgJ HGWUuHpzKROEs5xRYtr6d8wgVWwCWhKPv/4FSnBwiAgoS/w85AgSFhaQkZi/+DoriC0ioCjR +3cdVImeRNN8H5Awi4CqRMuhFjYQm1fAV+LmsQksIDajgJjE91NrmEBsZgFxiVtP5jNB3CMg sWTPeWYIW1Ti5eN/rBC2osS+/unsEPU6Egt2f2KDsLUlli18zQwxX1Di5MwnLBMYhWYhGTsL ScssJC2zkLQsYGRZxchRWlyQk5tuZLiJERiuxyTYHHcw7u31PMQowMGoxMObeiI3Uog1say4 MvcQowQHs5IIb55WXqQQb0piZVVqUX58UWlOavEhRmkOFiVx3nflFyKEBNITS1KzU1MLUotg skwcnFINjD2+Jcd/qxz44MHvq/+QfZvCaim3Y7qPrmzt+ue4N0d5zqczNrINjj8OP01ZvqAu tlfumdbtL1Y/FrWzt23NXHkrO+yJwLdcAeejfH0MnXJuF18Gnvbg27P14ALx/TbRTCrVgXER KWdFSiP0Atwy8/57nL992UcoP/CT1FTG3zWzfcpm7VT2VGIpzkg01GIuKk4EAOlKXVpTAgAA Archived-At: Subject: [CDNi] IETF99 CDNI minutes X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 15:54:47 -0000 Hi All, Minutes have been posted: https://datatracker.ietf.org/doc/minutes-99-cdn= i/ Many thanks to Phil for sitting in as chair and to Magnus for taking minu= tes! thanx! -- Kevin and Francois From nobody Tue Jul 18 08:57:06 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7106131B7A for ; Tue, 18 Jul 2017 08:57:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WgYYW1npzRrn for ; Tue, 18 Jul 2017 08:56:55 -0700 (PDT) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5CD0131B7F for ; Tue, 18 Jul 2017 08:56:54 -0700 (PDT) X-AuditID: c618062d-9edff70000002716-75-596e45955906 Received: from EUSAAHC004.ericsson.se (Unknown_Domain [147.117.188.84]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 3E.4E.10006.5954E695; Tue, 18 Jul 2017 19:29:57 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC004.ericsson.se ([147.117.188.84]) with mapi id 14.03.0352.000; Tue, 18 Jul 2017 11:56:53 -0400 From: Kevin Ma J To: Kevin Ma J , "cdni@ietf.org" Thread-Topic: IETF99 CDNI minutes Thread-Index: AdL/3iGnTUpmDMKmSKqT2dhU7Z5eDAAAE6jw Date: Tue, 18 Jul 2017 15:56:52 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrJLMWRmVeSWpSXmKPExsUyuXRPiO5U17xIg3tXhS2ezv7D6sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujAtbjrAXTGat6H55nbGBcTFLFyMnh4SAicTc5+fYuxi5OIQE jjJKPNvUyQzhLGeU+N59kwmkik1AS+Lx179ANgeHiICnxJn15iBhYQEFidmvvrKB2CICihK9 f9cxQdhGEt9OHgNbwCKgKnFu2UlWEJtXwFdi3fLzjCC2EJD948Z3ZhCbU8BP4mX7crA4o4CY xPdTa8DmMAuIS9x6Mp8J4lABiSV7zjND2KISLx//Y4WwFSX29U9nh6jXkViw+xMbhK0tsWzh a2aIvYISJ2c+YZnAKDILydhZSFpmIWmZhaRlASPLKkaO0uKCnNx0I4NNjMAAPybBpruD8f50 z0OMAhyMSjy8c1TyIoVYE8uKK3MPMUpwMCuJ8OZpAYV4UxIrq1KL8uOLSnNSiw8xSnOwKInz Tjh/IUJIID2xJDU7NbUgtQgmy8TBKdXAWL3nwd/zqTOeRmRe03737O/a9oeyv69nM31dnr/5 KYc/Z0N4oSTnxmNc76wdPMOl8nr8PL4s3C9+4AIDz48/NQYuJtrty14sVzG1av29Ti3TLeGy WatG5MWm3yp3Ut3fvzoTFFmV9Nvuu/9TRoeytCsijpkeC742vRZWnKnsqXeveEJSyV5bJZbi jERDLeai4kQA9/4Jv2wCAAA= Archived-At: Subject: Re: [CDNi] IETF99 CDNI minutes X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 15:57:05 -0000 https://www.ietf.org/proceedings/99/minutes/minutes-99-cdni-01.txt > -----Original Message----- > From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Kevin Ma J > Sent: Tuesday, July 18, 2017 11:55 AM > To: cdni@ietf.org > Subject: [CDNi] IETF99 CDNI minutes >=20 > Hi All, >=20 > Minutes have been posted: https://datatracker.ietf.org/doc/minutes-99- > cdni/ >=20 > Many thanks to Phil for sitting in as chair and to Magnus for taking > minutes! >=20 > thanx! >=20 > -- Kevin and Francois >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni From nobody Tue Jul 18 09:01:50 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36415131A54 for ; Tue, 18 Jul 2017 09:01:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kzhkMuHtSiKv for ; Tue, 18 Jul 2017 09:01:46 -0700 (PDT) Received: from usplmg20.ericsson.net (usplmg20.ericsson.net [198.24.6.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28F30129B5E for ; Tue, 18 Jul 2017 09:01:46 -0700 (PDT) X-AuditID: c618062d-dc5689c000002716-07-596e46b82f42 Received: from EUSAAHC003.ericsson.se (Unknown_Domain [147.117.188.81]) by usplmg20.ericsson.net (Symantec Mail Security) with SMTP id 2A.AE.10006.8B64E695; Tue, 18 Jul 2017 19:34:48 +0200 (CEST) Received: from EUSAAMB103.ericsson.se ([147.117.188.120]) by EUSAAHC003.ericsson.se ([147.117.188.81]) with mapi id 14.03.0352.000; Tue, 18 Jul 2017 12:01:18 -0400 From: Kevin Ma J To: "'cdni@ietf.org'" Thread-Topic: IETF99 CDNI minutes Thread-Index: AdL/3iGnTUpmDMKmSKqT2dhU7Z5eDAAAE6jwAAAkVNA= Date: Tue, 18 Jul 2017 16:01:17 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.9] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrFLMWRmVeSWpSXmKPExsUyuXRPoO4Ot7xIg80TDCyezv7D6sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujN+7VzMV7GGvWLhrBUsDYzdbFyMnh4SAicT7EzeYuxi5OIQE jjJKrFh7B8pZzijx4fJRZpAqNgEticdf/zJ1MXJwiAioSpz5WgwSFhZQkJj96ivYIBEBRYne v+uYIGwrif4lp8BaWYDKX/dvZAGxeQV8Jb7e2cQIMX8io8TpLZNYQRKcAn4SyzesAmtmFBCT +H5qDZjNLCAucevJfCaISwUkluw5zwxhi0q8fPyPFcJWlNjXP50dol5HYsHuT2wQtrbEsoWv mSEWC0qcnPmEZQKjyCwkY2chaZmFpGUWkpYFjCyrGDlKiwtyctONDDYxAkP8mASb7g7G+9M9 DzEKcDAq8fDOUcmLFGJNLCuuzD3EKMHBrCTCm6cFFOJNSaysSi3Kjy8qzUktPsQozcGiJM47 4fyFCCGB9MSS1OzU1ILUIpgsEwenVAOj1vyFrmXKMceSLm7riHy4bdnrgH2zfdq+b/aaoHjv gNqz7Zftvgn2R/Xc8Bf6Mt2uQ+q4Q8fEt+FTH1V9WKdy+7Dy4d+Cp/+kCp67+24VW0XcXznm o1kHOWMLRaqnVTK1i0U+FH3922DWiooIVSduJvvdLT3LfSdrJUXIa+vF7ztreE/ZfXqOEktx RqKhFnNRcSIA1WSRXG0CAAA= Archived-At: Subject: Re: [CDNi] IETF99 CDNI minutes X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 16:01:48 -0000 https://www.ietf.org/proceedings/99/minutes/minutes-99-cdni-02.txt > -----Original Message----- > From: Kevin Ma J > Sent: Tuesday, July 18, 2017 11:57 AM > To: Kevin Ma J ; cdni@ietf.org > Subject: RE: IETF99 CDNI minutes >=20 > https://www.ietf.org/proceedings/99/minutes/minutes-99-cdni-01.txt >=20 > > -----Original Message----- > > From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Kevin Ma J > > Sent: Tuesday, July 18, 2017 11:55 AM > > To: cdni@ietf.org > > Subject: [CDNi] IETF99 CDNI minutes > > > > Hi All, > > > > Minutes have been posted: https://datatracker.ietf.org/doc/minutes-99= - > > cdni/ > > > > Many thanks to Phil for sitting in as chair and to Magnus for taking > > minutes! > > > > thanx! > > > > -- Kevin and Francois > > > > _______________________________________________ > > CDNi mailing list > > CDNi@ietf.org > > https://www.ietf.org/mailman/listinfo/cdni From nobody Tue Jul 18 14:38:14 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6BED1318BD for ; Tue, 18 Jul 2017 14:38:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R8h-pLFP68y8 for ; Tue, 18 Jul 2017 14:38:09 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC10D131899 for ; Tue, 18 Jul 2017 14:38:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=52108; q=dns/txt; s=iport; t=1500413888; x=1501623488; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=IAQizky2RusgmOXB56AV5i/URPUNNRnu++WpDOLspGk=; b=dSGyVjUsbLB+E33TyCncxW/U1EkCqxCvUILU8CotgUI75bE36fiAChVA PzgMf4TqevHQtZnvNCrBukbCbyL263K9hgMln1wuniLGcxPaZLwl0qk/Z ZR1M6SvCS4FF5wxfYhIjLdmNv7fCOy8ihvbL1i+9EdD2YKOljXz5TaMtI A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CYAABXf25Z/5FdJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgm8+LWSBFAeOBJFndJUQghEhAQqFGwIagzg/GAECAQEBAQEBAWs?= =?us-ascii?q?ohRgBAQEBAwEBIQpBBAcQAgEIEQQBASEBBgMCAgIlCxQJCAIEDgUIiUNkEK9Yg?= =?us-ascii?q?iaKfQEBAQEBAQEBAQEBAQEBAQEBAQEBAR2DKIExghyBYYJwNIMmgXoIglWCYQW?= =?us-ascii?q?KUIxyh3ICh0iDSoh5ghVXhHiDdoZelVYBDxA4gQp1FR8qhxZ2hhYrgQWBDQEBA?= =?us-ascii?q?Q?= X-IronPort-AV: E=Sophos;i="5.40,378,1496102400"; d="scan'208,217";a="457457177" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jul 2017 21:37:53 +0000 Received: from XCH-RTP-008.cisco.com (xch-rtp-008.cisco.com [64.101.220.148]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id v6ILbrGp012228 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 18 Jul 2017 21:37:53 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-008.cisco.com (64.101.220.148) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 18 Jul 2017 17:37:52 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Tue, 18 Jul 2017 17:37:52 -0400 From: "Kent Leung (kleung)" To: Ben Niven-Jenkins CC: Phil Sorber , "cdni@ietf.org" Thread-Topic: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt Thread-Index: AQHS7e9LlS4wGS+P5UmudfPkO3mbd6I2R8sAgA2IdACAAfY0sIAURm8AgAAftZA= Date: Tue, 18 Jul 2017 21:37:52 +0000 Message-ID: References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.105.93] Content-Type: multipart/alternative; boundary="_000_a79e35933ce241c78267514fa39f289aXCHRTP006ciscocom_" MIME-Version: 1.0 Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 21:38:13 -0000 --_000_a79e35933ce241c78267514fa39f289aXCHRTP006ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLiBJ4oCZbSB0cnlpbmcgdG8gcmVjYWxsIHRoZSByYXRpb25hbGUuIEkgdGhpbmsgaW5p dGlhbGx5LCBVUkkgc2lnbmluZyB3YXMgYmFzZWQgb24gdGhlIG5vbi1DRE5JIGVudmlyb25tZW50 IHdoZXJlIGJvdGggc3ltbWV0cmljIGFuZCBhc3ltbWV0cmljIGtleXMgd2VyZSBzdXBwb3J0ZWQg YW5kIGNvbmZpZGVudGlhbGl0eSB3YXMgbm90IGFuIGlzc3VlIGJldHdlZW4gQ1NQIGFuZCBDRE4u IFRoZSBpc3N1ZSBmb3Igc3ltbWV0cmljIGtleSBpcyBlbmNvdW50ZXJlZCBmb3Iga2V5IGRpc3Ry aWJ1dGlvbiBiZXR3ZWVuIENTUC91Q0ROIGFuZCBkQ0ROLiBUaGlzIGNvbmNlcm4gaGFzIGJlZW4g ZG9jdW1lbnRlZDoNCg0KICDigJxJbiBDRE5JLCB0aGVyZSBhcmUgdHdvIG1ldGhvZHMgZm9yIHJl cXVlc3Qgcm91dGluZzogRE5TLWJhc2VkIGFuZA0KICAgSFRUUC1iYXNlZC4gIEZvciBETlMtYmFz ZWQgcmVxdWVzdCByb3V0aW5nLCB0aGUgU2lnbmVkIFVSSSAoaS5lLiwNCiAgIFRhcmdldCBDRE4g VVJJKSBwcm92aWRlZCBieSB0aGUgQ1NQIHJlYWNoZXMgdGhlIERvd25zdHJlYW0gQ0RODQogICBk aXJlY3RseS4gIEluIHRoZSBjYXNlIHdoZXJlIHRoZSBEb3duc3RyZWFtIENETiBkb2VzIG5vdCBo YXZlIGEgdHJ1c3QNCiAgIHJlbGF0aW9uc2hpcCB3aXRoIHRoZSBDU1AsIHRoaXMgbWVhbnMgdGhh dCBvbmx5IGFuIGFzeW1tZXRyaWMgcHVibGljLw0KICAgcHJpdmF0ZSBrZXkgbWV0aG9kIGNhbiBi ZSB1c2VkIGZvciBjb21wdXRpbmcgdGhlIFVSSSBTaWduYXR1cmUNCiAgIGJlY2F1c2UgdGhlIENT UCBhbmQgRG93bnN0cmVhbSBDRE4gYXJlIG5vdCBhYmxlIHRvIGV4Y2hhbmdlIHN5bW1ldHJpYw0K ICAgc2hhcmVkIHNlY3JldCBrZXlzLiAgU2luY2UgdGhlIENTUCBpcyB1bmxpa2VseSB0byBoYXZl IHJlbGF0aW9uc2hpcHMNCiAgIHdpdGggYWxsIHRoZSBEb3duc3RyZWFtIENETnMgdGhhdCBhcmUg ZGVsZWdhdGVkIHRvIGJ5IHRoZSBVcHN0cmVhbQ0KICAgQ0ROLCB0aGUgQ1NQIG1heSBjaG9vc2Ug dG8gYWxsb3cgdGhlIEF1dGhvcml0YXRpdmUgQ0ROIHRvDQogICByZWRpc3RyaWJ1dGUgdGhlIHNo YXJlZCBrZXkgdG8gYSBzdWJzZXQgb2YgdGhlaXIgRG93bnN0cmVhbSBDRE5zIC7igJ0NCg0KICDi gJxUd28gdHlwZXMgb2Yga2V5cyBjYW4gYmUgdXNlZCBmb3IgVVJJIFNpZ25pbmc6IGFzeW1tZXRy aWMga2V5cyBhbmQNCiAgIHN5bW1ldHJpYyBrZXlzLiAg4oCmICBXaXRoIHN5bW1ldHJpYyBrZXlz LCB0aGUgc2FtZSBrZXkgaXMNCiAgIHVzZWQgYnkgYm90aCB0aGUgc2lnbmluZyBlbnRpdHkgZm9y IHNpZ25pbmcgdGhlIFVSSSBhcyB3ZWxsIGFzIGJ5IHRoZQ0KICAgdmFsaWRhdGluZyBlbnRpdHkg Zm9yIHZhbGlkYXRpbmcgdGhlIFNpZ25lZCBVUkkuICDigKYgIEtleSBkaXN0cmlidXRpb24gZm9y DQogICBzeW1tZXRyaWMga2V5cyByZXF1aXJlcyBjb25maWRlbnRpYWxpdHkgdG8gcHJldmVudCBh bm90aGVyIHBhcnR5IGZyb20NCiAgIGdldHRpbmcgYWNjZXNzIHRvIHRoZSBrZXksIHNpbmNlIGl0 IGNvdWxkIHRoZW4gZ2VuZXJhdGUgdmFsaWQgU2lnbmVkDQogICBVUklzIGZvciB1bmF1dGhvcml6 ZWQgcmVxdWVzdHMu4oCdDQoNCiAg4oCcV2l0aCBETlMtYmFzZWQgcmVxdWVzdCByb3V0aW5nLCBV UkkgU2lnbmluZyBkb2VzIG5vdCBtYXRjaCB3ZWxsIHRoZQ0KICAgZ2VuZXJhbCBjaGFpbiBvZiB0 cnVzdCBtb2RlbCBvZiBDRE5JIHdoZW4gdXNlZCB3aXRoIHN5bW1ldHJpYyBrZXlzDQogICBiZWNh dXNlIHRoZSBzeW1tZXRyaWMga2V5IGluZm9ybWF0aW9uIG5lZWRzIHRvIGJlIGRpc3RyaWJ1dGVk IGFjcm9zcw0KICAgbXVsdGlwbGUgQ0ROSSBob3BzIGluY2x1ZGluZyBub24tYWRqYWNlbnQgaG9w cy4gIFRoaXMgcmFpc2VzIGENCiAgIHNlY3VyaXR5IGNvbmNlcm4gZm9yIGFwcGxpY2FiaWxpdHkg b2YgVVJJIFNpZ25pbmcgd2l0aCBzeW1tZXRyaWMga2V5cw0KICAgaW4gY2FzZSBvZiBETlMtYmFz ZWQgaW50ZXItQ0ROIHJlcXVlc3Qgcm91dGluZy7igJ0NCg0KSW4gbGlnaHQgb2Yga2VlcGluZyB0 aGluZ3Mgc2ltcGxlIGFuZCB0aGUgcGF0aCBvZiBsZWFzdCBleGlzdGVuY2UsIEnigJltIGZpbmUg d2l0aCBkZWZpbmluZyBvbmx5IGFzeW1tZXRyaWMga2V5Lg0KDQpNYXliZSB0aG91Z2h0cyBmcm9t IFBoaWwgYW5kIEtldmluIGFuZCBvdGhlcnM/DQoNCktlbnQNCg0KDQpGcm9tOiBCZW4gTml2ZW4t SmVua2lucyBbbWFpbHRvOmJlbkBuaXZlbi1qZW5raW5zLmNvLnVrXQ0KU2VudDogVHVlc2RheSwg SnVseSAxOCwgMjAxNyA0OjM0IFBNDQpUbzogS2VudCBMZXVuZyAoa2xldW5nKSA8a2xldW5nQGNp c2NvLmNvbT4NCkNjOiBQaGlsIFNvcmJlciA8c29yYmVyQGFwYWNoZS5vcmc+OyBjZG5pQGlldGYu b3JnDQpTdWJqZWN0OiBSZTogW0NETmldIEktRCBBY3Rpb246IGRyYWZ0LWlldGYtY2RuaS11cmkt c2lnbmluZy0xMi50eHQNCg0KSGkgS2VudCwNCg0KU2VlIGlubGluZQ0KDQpPbiA1IEp1bCAyMDE3 LCBhdCAyMjoyMywgS2VudCBMZXVuZyAoa2xldW5nKSA8a2xldW5nQGNpc2NvLmNvbTxtYWlsdG86 a2xldW5nQGNpc2NvLmNvbT4+IHdyb3RlOg0KRnJvbTogQ0ROaSBbbWFpbHRvOmNkbmktYm91bmNl c0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJlbiBOaXZlbi1KZW5raW5zDQpTZW50OiBUdWVzZGF5 LCBKdWx5IDQsIDIwMTcgMzo1OSBBTQ0KDQoNCkhpIFBoaWwgJiBVUkkgU2lnbmluZyBhdXRob3Jz LA0KDQpJIHJlYWQgdGhlIGxhdGVzdCBkcmFmdCAoLTEyKSBhbmQgYmVsb3cgYXJlIHNvbWUgcXVl c3Rpb25zIC8gdGhvdWdodHMsIGluIG5vIHBhcnRpY3VsYXIgb3JkZXIsIHRoYXQgb2NjdXJyZWQg dG8gbWUgd2hpbGUgcmVhZGluZyB0aGUgZG9jdW1lbnQuDQoNCiogV2h5IHN1cHBvcnQgYm90aCBz eW1tZXRyaWMgJiBhc3ltbWV0cmljIGtleXM/IFdoYXQgaXMgdGhlIGFkdmFudGFnZSB0byBoYXZp bmcgYm90aCBvcHRpb25zIHZlcnN1cyBqdXN0IHBpY2tpbmcgb25lIG9wdGlvbiAocHJvYmFibHkg YXN5bW1ldHJpYyBrZXlzIGFzIHRoZXkgd29yayBmb3IgYWxsIHVzZSBjYXNlcyk/DQoNCktMPiBU aGVyZSBhcmUgcHJvcyBhbmQgY29ucyBvZiB1c2luZyBlaXRoZXIgYXN5bW1ldHJpYyBrZXlzIHZz IHN5bW1ldHJpYyBrZXkuIEtleSBkaXN0cmlidXRpb24gbGltaXRhdGlvbnMgYW5kIHJlbGF0aW9u c2hpcHMgYmV0d2VlbiBDU1AgYW5kIENETnMgYXJlIGZhY3RvcnMuIFNvIEkgdGhpbmsgc3VwcG9y dGluZyBib3RoIGFsbG93cyBmbGV4aWJpbGl0eSBmb3IgZGVwbG95bWVudHMgb2YgVVJJIHNpZ25p bmcuIEV4aXN0aW5nIFVSSSBzaWduaW5nIHByb3ByaWV0YXJ5IGltcGxlbWVudGF0aW9ucyB0eXBp Y2FsbHkgc3VwcG9ydCBib3RoIGFscmVhZHkuDQoNCkFwb2xvZ2llcyBpZiBJ4oCZbSByYWtpbmcg dXAgZGlzY3Vzc2lvbnMgeW914oCZdmUgYWxyZWFkeSBoYWQgd2hlbiB3cml0aW5nIHRoZSBkb2N1 bWVudC4gQ2FuIHlvdSBleHBhbmQgb24gd2hhdCBmYWN0b3JzIGp1c3RpZnkgaGF2aW5nIHR3byBk aWZmZXJlbnQgbWV0aG9kcyBmb3Igc2lnbmluZyBVUklzPw0KDQpJIGFtIGNvbWluZyBmcm9tIHRo ZSBwb2ludCBvZiB2aWV3IHRoYXQgSSBjYW7igJl0IHRoaW5rIG9mIHN1ZmZpY2llbnQganVzdGlm aWNhdGlvbiBmb3IgaGF2aW5nIHR3byBtZXRob2RzLiBzeW1tZXRyaWMga2V5cyBoYXZlIHRoZSBk b3duc2lkZSBvZiByZXF1aXJpbmcgY29uZmlkZW50aWFsaXR5LiBhc3ltbWV0cmljIGtleXMgZG8g bm90IHN1ZmZlciB0aGF0IGlzc3VlLiBXaGF0IGlzIHRoZSBkb3duc2lkZSBvZiBhc3ltbWV0cmlj IGtleXMgdGhhdCBqdXN0aWZpZXMgdXNpbmcgc3ltbWV0cmljIGtleXMgYW5kIHRhY2tsaW5nIHRo ZSBpc3N1ZSBvZiBtYWludGFpbmluZyBjb25maWRlbnRpYWxpdHk/DQoNCkluIG90aGVyIHdvcmRz LCB3aHkgbm90IGp1c3Qgc3BlY2lmeSBhc3ltbWV0cmljIGtleXMgYW5kIGxlYXZlIGl0IGF0IHRo YXQ/DQoNCkkgYW0gYWxzbyB3b3JyaWVkIGFib3V0IGludGVyb3BlcmFiaWxpdHkgYmVjYXVzZSBp ZiB5b3Ugc3BlY2lmeSBib3RoIHN5bW1ldHJpYyAmIGFzeW1tZXRyaWMga2V5cyBJIHRoaW5rIGl0 IGlzIGZhciBmcm9tIGd1YXJhbnRlZWQgdGhhdCBhbGwgaW1wbGVtZW50YXRpb25zIHdpbGwgaW1w bGVtZW50IGJvdGggdmFyaWFudHMgYW5kIEnigJltIHlldCB0byBiZSBjb252aW5jZWQgdGhhdCB3 ZSBuZWVkIHRvIHRha2UgdGhhdCByaXNrIGF0IGFsbC4NCg0KDQpCZW4NCg0KDQoNCiogSG93IGFy ZSB0aGUga2V5cyBkaXN0cmlidXRlZCBiZXR3ZWVuIENETnM/IEkgZG9u4oCZdCBzZWUgYSBwcm9w ZXJ0eSBpbiB0aGUgVXJpU2lnbmluZyBNZXRhZGF0YSBvYmplY3QgdGhhdCB3b3VsZCBpbmNsdWRl IChvciBsaW5rIHRvKSB0aGUga2V5cyAoSeKAmW0gYXNzdW1pbmcgeW91IG5lZWQgdG8gc3VwcG9y dCBkaXN0cmlidXRpb24gb2YgYXQgbGVhc3QgMiBrZXlzIHRvIHN1cHBvcnQga2V5IHJvdGF0aW9u KT8NCg0KS0w+IEtleSBkaXN0cmlidXRpb24gaXMgb3V0IG9mIHNjb3BlLiBJIG5vdGljZWQgZm9s bG93aW5nIHRleHQgd2FzIGRyb3BwZWQgd2hlbiBtZXRob2QgY29udmVydGVkIHRvIEpXVC4gV2Ug Y2FuIHB1dCB0aGlzIGJhY2sgaW4gQ0ROSSBPdmVydmlldyBzZWN0aW9uLCB3aGVyZSB0aGUgYXN5 bW1ldHJpYyBhbmQgc3ltbWV0cmljIGtleSBtZXRob2RzIGFyZSBtZW50aW9uZWQuDQoNCuKAnFR3 byB0eXBlcyBvZiBrZXlzIGNhbiBiZSB1c2VkIGZvciBVUkkgU2lnbmluZzogYXN5bW1ldHJpYyBr ZXlzIGFuZA0KICAgc3ltbWV0cmljIGtleXMuICBBc3ltbWV0cmljIGtleXMgYXJlIGJhc2VkIG9u IGEgcHVibGljL3ByaXZhdGUga2V5DQogICBwYWlyIG1lY2hhbmlzbSBhbmQgYWx3YXlzIGNvbnRh aW4gYSBwcml2YXRlIGtleSBvbmx5IGtub3duIHRvIHRoZQ0KICAgZW50aXR5IHNpZ25pbmcgdGhl IFVSSSAoZWl0aGVyIENTUCBvciB1Q0ROKSBhbmQgYSBwdWJsaWMga2V5IGZvciB0aGUNCiAgIHZl cmlmaWNhdGlvbiBvZiB0aGUgU2lnbmVkIFVSSS4gIFdpdGggc3ltbWV0cmljIGtleXMsIHRoZSBz YW1lIGtleSBpcw0KICAgdXNlZCBieSBib3RoIHRoZSBzaWduaW5nIGVudGl0eSBmb3Igc2lnbmlu ZyB0aGUgVVJJIGFzIHdlbGwgYXMgYnkgdGhlDQogICB2YWxpZGF0aW5nIGVudGl0eSBmb3IgdmFs aWRhdGluZyB0aGUgU2lnbmVkIFVSSS4gIFJlZ2FyZGxlc3Mgb2YgdGhlDQogICB0eXBlIG9mIGtl eXMgdXNlZCwgdGhlIHZhbGlkYXRpbmcgZW50aXR5IGhhcyB0byBvYnRhaW4gdGhlIGtleQ0KICAg KGVpdGhlciB0aGUgcHVibGljIG9yIHRoZSBzeW1tZXRyaWMga2V5KS4gIFRoZXJlIGFyZSB2ZXJ5 IGRpZmZlcmVudA0KICAgcmVxdWlyZW1lbnRzIGZvciBrZXkgZGlzdHJpYnV0aW9uIChvdXQgb2Yg c2NvcGUgb2YgdGhpcyBkb2N1bWVudCkNCiAgIHdpdGggYXN5bW1ldHJpYyBrZXlzIGFuZCB3aXRo IHN5bW1ldHJpYyBrZXlzLiAgS2V5IGRpc3RyaWJ1dGlvbiBmb3INCiAgIHN5bW1ldHJpYyBrZXlz IHJlcXVpcmVzIGNvbmZpZGVudGlhbGl0eSB0byBwcmV2ZW50IGFub3RoZXIgcGFydHkgZnJvbQ0K ICAgZ2V0dGluZyBhY2Nlc3MgdG8gdGhlIGtleSwgc2luY2UgaXQgY291bGQgdGhlbiBnZW5lcmF0 ZSB2YWxpZCBTaWduZWQNCiAgIFVSSXMgZm9yIHVuYXV0aG9yaXplZCByZXF1ZXN0cy4gIEtleSBk aXN0cmlidXRpb24gZm9yIGFzeW1tZXRyaWMga2V5cw0KICAgZG9lcyBub3QgcmVxdWlyZSBjb25m aWRlbnRpYWxpdHkgc2luY2UgcHVibGljIGtleXMgY2FuIHR5cGljYWxseSBiZQ0KICAgZGlzdHJp YnV0ZWQgb3Blbmx5IChiZWNhdXNlIHRoZXkgY2Fubm90IGJlIHVzZWQgZm9yIFVSSSBzaWduaW5n KSBhbmQNCiAgIHByaXZhdGUga2V5cyBhcmUga2VwdCBieSB0aGUgVVJJIHNpZ25pbmcgZnVuY3Rp b24u4oCdDQoNCg0KKiBIb3cgZG9lcyBhIHVDRE4ga25vdyB3aGV0aGVyIGl0IGlzIE9LL3NhZmUv d2l0aGluIHBvbGljeSB0byByZS1kaXN0cmlidXRlIHN5bW1ldHJpYyBrZXlzIHRvIGEgZENETj8N Cg0KS0w+IFNlZSBhYm92ZS4NCg0KKiBJbiB0aGUgY2FzZSBvZiBTaWduZWQgVG9rZW4gY2hhaW5z LCBob3cgZG9lcyBhIENETiBvYnRhaW4gdGhlIGtleXMgcmVxdWlyZWQgdG8gc2lnbiB0aGUgbmV3 IHRva2VucyBpbiB0aGUgY2hhaW4gYXMgaXQgZ2VuZXJhdGVzIHRoZW0/DQoNCktMPiBTZWUgYWJv dmUuDQoNCktlbnQNCg0KDQoqIFNlY3Rpb24gMy4zLjEgSSB0aGluayBuZWVkcyB0byBiZSBtb3Jl IGV4cGxpY2l0LCBJIGRvbuKAmXQga25vdyBob3cgb25lIGNvdWxkIGNvbW11bmljYXRlIGEgdG9r ZW4gY2hhaW4gdmlhIHRoZSBxdWVyeSBzdHJpbmcgYXMgc3BlY2lmaWVkIGluIHRoZSBkb2N1bWVu dCwgYXMgdGhlcmUgaXMgbm8g4oCcYmFjayBjaGFubmVs4oCdIGZvciB0aGUgQ0ROIHRvIGNvbW11 bmljYXRlIHRoZSBuZXh0IHRva2VuIGluIHRoZSBjaGFpbiB0byB0aGUgVUEuDQoNCkhUSA0KQmVu DQoNCk9uIDI1IEp1biAyMDE3LCBhdCAyMToxOSwgUGhpbCBTb3JiZXIgPHNvcmJlckBhcGFjaGUu b3JnPG1haWx0bzpzb3JiZXJAYXBhY2hlLm9yZz4+IHdyb3RlOg0KDQpSZWFsbHkgaG9waW5nIHRv IGdldCBzb21lIGZlZWRiYWNrIG9uIHRoaXMgYXQgdGhlIG1lZXRpbmcgaW4gUHJhZ3VlLiBJdCdz IGdvdCBhbGwgdGhlIGNoYW5nZXMgdGhhdCBoYXZlIGJlZW4gZGlzY3Vzc2VkIHNvIEknbSBub3Qg YXdhcmUgb2YgYW55IG1vcmUgc3Vic3RhbnRpdmUgY2hhbmdlcyBuZWVkZWQuIEhvd2V2ZXIsIGxv dHMgb2YgZWRpdG9yaWFsIG5pdHMgSSBzdXNwZWN0Lg0KVGhhbmtzLg0KDQpPbiBTdW4sIEp1biAy NSwgMjAxNyBhdCAyOjEyIFBNIDxpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8bWFpbHRvOmludGVy bmV0LWRyYWZ0c0BpZXRmLm9yZz4+IHdyb3RlOg0KDQpBIE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBh dmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGlyZWN0b3JpZXMuDQpU aGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBDb250ZW50IERlbGl2ZXJ5IE5ldHdvcmtz IEludGVyY29ubmVjdGlvbiBvZiB0aGUgSUVURi4NCg0KICAgICAgICBUaXRsZSAgICAgICAgICAg OiBVUkkgU2lnbmluZyBmb3IgQ0ROIEludGVyY29ubmVjdGlvbiAoQ0ROSSkNCiAgICAgICAgQXV0 aG9ycyAgICAgICAgIDogUmF5IHZhbiBCcmFuZGVuYnVyZw0KICAgICAgICAgICAgICAgICAgICAg ICAgICBLZW50IExldW5nDQogICAgICAgICAgICAgICAgICAgICAgICAgIFBoaWwgU29yYmVyDQog ICAgICAgIEZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0xMi50 eHQNCiAgICAgICAgUGFnZXMgICAgICAgICAgIDogMzUNCiAgICAgICAgRGF0ZSAgICAgICAgICAg IDogMjAxNy0wNi0yNQ0KDQpBYnN0cmFjdDoNCiAgIFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGhv dyB0aGUgY29uY2VwdCBvZiBVUkkgc2lnbmluZyBzdXBwb3J0cyB0aGUNCiAgIGNvbnRlbnQgYWNj ZXNzIGNvbnRyb2wgcmVxdWlyZW1lbnRzIG9mIENETkkgYW5kIHByb3Bvc2VzIGEgVVJJDQogICBz aWduaW5nIG1ldGhvZCBhcyBhIEpTT04gV2ViIFRva2VuIChKV1QpIFtSRkM3NTE5XSBwcm9maWxl Lg0KDQogICBUaGUgcHJvcG9zZWQgVVJJIHNpZ25pbmcgbWV0aG9kIHNwZWNpZmllcyB0aGUgaW5m b3JtYXRpb24gbmVlZGVkIHRvDQogICBiZSBpbmNsdWRlZCBpbiB0aGUgVVJJIHRvIHRyYW5zbWl0 IHRoZSBzaWduZWQgSldUIGFzIHdlbGwgYXMgdGhlDQogICBjbGFpbXMgbmVlZGVkIGJ5IHRoZSBz aWduZWQgSldUIHRvIGF1dGhvcml6ZSBhIFVBLiAgVGhlIG1lY2hhbmlzbQ0KICAgZGVzY3JpYmVk IGNhbiBiZSB1c2VkIGJvdGggaW4gQ0ROSSBhbmQgc2luZ2xlIENETiBzY2VuYXJpb3MuDQoNCg0K VGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQpodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmcv DQoNClRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2YWlsYWJsZSBhdDoNCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTINCmh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1jZG5pLXVyaS1z aWduaW5nLTEyDQoNCkEgZGlmZiBmcm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJs ZSBhdDoNCmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWNkbmkt dXJpLXNpZ25pbmctMTINCg0KDQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxl IG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQp1bnRpbCB0aGUgaHRtbGl6 ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnPGh0dHA6 Ly90b29scy5pZXRmLm9yZy8+Lg0KDQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxhYmxl IGJ5IGFub255bW91cyBGVFAgYXQ6DQpmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRz Lw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KQ0RO aSBtYWlsaW5nIGxpc3QNCkNETmlAaWV0Zi5vcmc8bWFpbHRvOkNETmlAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpDRE5pIG1haWxpbmcgbGlzdA0KQ0ROaUBp ZXRmLm9yZzxtYWlsdG86Q0ROaUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vY2RuaQ0KDQoNCg== --_000_a79e35933ce241c78267514fa39f289aXCHRTP006ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtY29udmVy dGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIw DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdv cmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4w aW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0i X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgQmVuLiBJ 4oCZbSB0cnlpbmcgdG8gcmVjYWxsIHRoZSByYXRpb25hbGUuIEkgdGhpbmsgaW5pdGlhbGx5LCBV Ukkgc2lnbmluZyB3YXMgYmFzZWQgb24gdGhlIG5vbi1DRE5JIGVudmlyb25tZW50IHdoZXJlIGJv dGggc3ltbWV0cmljDQogYW5kIGFzeW1tZXRyaWMga2V5cyB3ZXJlIHN1cHBvcnRlZCBhbmQgY29u ZmlkZW50aWFsaXR5IHdhcyBub3QgYW4gaXNzdWUgYmV0d2VlbiBDU1AgYW5kIENETi4gVGhlIGlz c3VlIGZvciBzeW1tZXRyaWMga2V5IGlzIGVuY291bnRlcmVkIGZvciBrZXkgZGlzdHJpYnV0aW9u IGJldHdlZW4gQ1NQL3VDRE4gYW5kIGRDRE4uIFRoaXMgY29uY2VybiBoYXMgYmVlbiBkb2N1bWVu dGVkOjxvOnA+PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyDigJxJbiBDRE5JLCB0aGVyZSBh cmUgdHdvIG1ldGhvZHMgZm9yIHJlcXVlc3Qgcm91dGluZzogRE5TLWJhc2VkIGFuZDxvOnA+PC9v OnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOyZuYnNwOyBIVFRQLWJhc2VkLiZuYnNwOyBGb3IgRE5TLWJhc2VkIHJlcXVlc3Qg cm91dGluZywgdGhlIFNpZ25lZCBVUkkgKGkuZS4sPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxF bmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IFRh cmdldCBDRE4gVVJJKSBwcm92aWRlZCBieSB0aGUgQ1NQIHJlYWNoZXMgdGhlIERvd25zdHJlYW0g Q0ROPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IGRpcmVjdGx5LiZuYnNwOyBJbiB0aGUgY2FzZSB3 aGVyZSB0aGUgRG93bnN0cmVhbSBDRE4gZG9lcyBub3QgaGF2ZSBhIHRydXN0PG86cD48L286cD48 L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ Jm5ic3A7Jm5ic3A7IHJlbGF0aW9uc2hpcCB3aXRoIHRoZSBDU1AsIHRoaXMgbWVhbnMgdGhhdCBv bmx5IGFuIGFzeW1tZXRyaWMgcHVibGljLzxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29t cG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBwcml2YXRl IGtleSBtZXRob2QgY2FuIGJlIHVzZWQgZm9yIGNvbXB1dGluZyB0aGUgVVJJIFNpZ25hdHVyZTxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBiZWNhdXNlIHRoZSBDU1AgYW5kIERvd25zdHJlYW0gQ0RO IGFyZSBub3QgYWJsZSB0byBleGNoYW5nZSBzeW1tZXRyaWM8bzpwPjwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJz cDsgc2hhcmVkIHNlY3JldCBrZXlzLiZuYnNwOyBTaW5jZSB0aGUgQ1NQIGlzIHVubGlrZWx5IHRv IGhhdmUgcmVsYXRpb25zaGlwczxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyB3aXRoIGFsbCB0aGUg RG93bnN0cmVhbSBDRE5zIHRoYXQgYXJlIGRlbGVnYXRlZCB0byBieSB0aGUgVXBzdHJlYW08bzpw PjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj4mbmJzcDsmbmJzcDsgQ0ROLCB0aGUgQ1NQIG1heSBjaG9vc2UgdG8gYWxsb3cgdGhl IEF1dGhvcml0YXRpdmUgQ0ROIHRvPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3Nl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHJlZGlzdHJpYnV0 ZSB0aGUgc2hhcmVkIGtleSB0byBhIHN1YnNldCBvZiB0aGVpciBEb3duc3RyZWFtIENETnMgLuKA nTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyDigJxUd28gdHlwZXMgb2Yga2V5 cyBjYW4gYmUgdXNlZCBmb3IgVVJJIFNpZ25pbmc6IGFzeW1tZXRyaWMga2V5cyBhbmQ8bzpwPjwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDsmbmJzcDsgc3ltbWV0cmljIGtleXMuJm5ic3A7IOKApiZuYnNwOyBXaXRoIHN5 bW1ldHJpYyBrZXlzLCB0aGUgc2FtZSBrZXkgaXM8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgdXNl ZCBieSBib3RoIHRoZSBzaWduaW5nIGVudGl0eSBmb3Igc2lnbmluZyB0aGUgVVJJIGFzIHdlbGwg YXMgYnkgdGhlPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHZhbGlkYXRpbmcgZW50aXR5IGZvciB2 YWxpZGF0aW5nIHRoZSBTaWduZWQgVVJJLiZuYnNwOyDigKYmbmJzcDsgS2V5IGRpc3RyaWJ1dGlv biBmb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgc3ltbWV0cmljIGtleXMgcmVxdWlyZXMgY29u ZmlkZW50aWFsaXR5IHRvIHByZXZlbnQgYW5vdGhlciBwYXJ0eSBmcm9tPG86cD48L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7Jm5ic3A7IGdldHRpbmcgYWNjZXNzIHRvIHRoZSBrZXksIHNpbmNlIGl0IGNvdWxkIHRoZW4g Z2VuZXJhdGUgdmFsaWQgU2lnbmVkPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3Nl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IFVSSXMgZm9yIHVu YXV0aG9yaXplZCByZXF1ZXN0cy7igJ08bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBv c2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDsg4oCcV2l0aCBETlMtYmFzZWQgcmVxdWVzdCByb3V0aW5nLCBVUkkgU2lnbmluZyBkb2VzIG5v dCBtYXRjaCB3ZWxsIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBnZW5lcmFsIGNoYWluIG9m IHRydXN0IG1vZGVsIG9mIENETkkgd2hlbiB1c2VkIHdpdGggc3ltbWV0cmljIGtleXM8bzpwPjwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDsmbmJzcDsgYmVjYXVzZSB0aGUgc3ltbWV0cmljIGtleSBpbmZvcm1hdGlvbiBu ZWVkcyB0byBiZSBkaXN0cmlidXRlZCBhY3Jvc3M8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgbXVs dGlwbGUgQ0ROSSBob3BzIGluY2x1ZGluZyBub24tYWRqYWNlbnQgaG9wcy4mbmJzcDsgVGhpcyBy YWlzZXMgYTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBzZWN1cml0eSBjb25jZXJuIGZvciBhcHBs aWNhYmlsaXR5IG9mIFVSSSBTaWduaW5nIHdpdGggc3ltbWV0cmljIGtleXM8bzpwPjwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4m bmJzcDsmbmJzcDsgaW4gY2FzZSBvZiBETlMtYmFzZWQgaW50ZXItQ0ROIHJlcXVlc3Qgcm91dGlu Zy7igJ08bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBv c2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JbiBsaWdodCBvZiBrZWVwaW5nIHRo aW5ncyBzaW1wbGUgYW5kIHRoZSBwYXRoIG9mIGxlYXN0IGV4aXN0ZW5jZSwgSeKAmW0gZmluZSB3 aXRoIGRlZmluaW5nIG9ubHkgYXN5bW1ldHJpYyBrZXkuPG86cD48L286cD48L3NwYW4+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+TWF5YmUgdGhvdWdodHMgZnJvbSBQaGlsIGFuZCBLZXZpbiBhbmQgb3RoZXJzPzxvOnA+ PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPktlbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjwvc3Bhbj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBCZW4gTml2ZW4tSmVua2lucyBbbWFpbHRvOmJl bkBuaXZlbi1qZW5raW5zLmNvLnVrXQ0KPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkg MTgsIDIwMTcgNDozNCBQTTxicj4NCjxiPlRvOjwvYj4gS2VudCBMZXVuZyAoa2xldW5nKSAmbHQ7 a2xldW5nQGNpc2NvLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IFBoaWwgU29yYmVyICZsdDtzb3Ji ZXJAYXBhY2hlLm9yZyZndDs7IGNkbmlAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtDRE5pXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTIudHh0PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgS2VudCw8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNlZSBpbmxpbmU8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIDUg SnVsIDIwMTcsIGF0IDIyOjIzLCBLZW50IExldW5nIChrbGV1bmcpICZsdDs8YSBocmVmPSJtYWls dG86a2xldW5nQGNpc2NvLmNvbSI+a2xldW5nQGNpc2NvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 Q0ROaSBbPGEgaHJlZj0ibWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImNvbG9yOnB1cnBsZSI+bWFpbHRvOmNkbmktYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XSZu YnNwOzxiPk9uDQogQmVoYWxmIE9mJm5ic3A7PC9iPkJlbiBOaXZlbi1KZW5raW5zPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U2VudDo8L3Nw YW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlR1ZXNkYXksDQogSnVseSA0 LCAyMDE3IDM6NTkgQU08YnI+DQo8YnI+DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBQaGlsICZh bXA7IFVSSSBTaWduaW5nIGF1dGhvcnMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHJlYWQgdGhlIGxh dGVzdCBkcmFmdCAoLTEyKSBhbmQgYmVsb3cgYXJlIHNvbWUgcXVlc3Rpb25zIC8gdGhvdWdodHMs IGluIG5vIHBhcnRpY3VsYXIgb3JkZXIsIHRoYXQgb2NjdXJyZWQgdG8gbWUgd2hpbGUgcmVhZGlu ZyB0aGUgZG9jdW1lbnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogV2h5IHN1cHBvcnQg Ym90aCBzeW1tZXRyaWMgJmFtcDsgYXN5bW1ldHJpYyBrZXlzPyBXaGF0IGlzIHRoZSBhZHZhbnRh Z2UgdG8gaGF2aW5nIGJvdGggb3B0aW9ucyB2ZXJzdXMganVzdCBwaWNraW5nIG9uZSBvcHRpb24g KHByb2JhYmx5IGFzeW1tZXRyaWMga2V5cyBhcyB0aGV5IHdvcmsgZm9yIGFsbCB1c2UgY2FzZXMp PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5LTCZndDsgVGhlcmUgYXJlIHByb3MgYW5kIGNvbnMgb2Yg dXNpbmcgZWl0aGVyIGFzeW1tZXRyaWMga2V5cyB2cyBzeW1tZXRyaWMga2V5LiBLZXkgZGlzdHJp YnV0aW9uIGxpbWl0YXRpb25zIGFuZCByZWxhdGlvbnNoaXBzIGJldHdlZW4gQ1NQIGFuZCBDRE5z IGFyZSBmYWN0b3JzLg0KIFNvIEkgdGhpbmsgc3VwcG9ydGluZyBib3RoIGFsbG93cyBmbGV4aWJp bGl0eSBmb3IgZGVwbG95bWVudHMgb2YgVVJJIHNpZ25pbmcuIEV4aXN0aW5nIFVSSSBzaWduaW5n IHByb3ByaWV0YXJ5IGltcGxlbWVudGF0aW9ucyB0eXBpY2FsbHkgc3VwcG9ydCBib3RoIGFscmVh ZHkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcG9sb2dpZXMgaWYgSeKAmW0gcmFraW5n IHVwIGRpc2N1c3Npb25zIHlvdeKAmXZlIGFscmVhZHkgaGFkIHdoZW4gd3JpdGluZyB0aGUgZG9j dW1lbnQuIENhbiB5b3UgZXhwYW5kIG9uIHdoYXQgZmFjdG9ycyBqdXN0aWZ5IGhhdmluZyB0d28g ZGlmZmVyZW50IG1ldGhvZHMgZm9yIHNpZ25pbmcgVVJJcz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhbSBjb21pbmcgZnJvbSB0aGUgcG9p bnQgb2YgdmlldyB0aGF0IEkgY2Fu4oCZdCB0aGluayBvZiBzdWZmaWNpZW50IGp1c3RpZmljYXRp b24gZm9yIGhhdmluZyB0d28gbWV0aG9kcy4gc3ltbWV0cmljIGtleXMgaGF2ZSB0aGUgZG93bnNp ZGUgb2YgcmVxdWlyaW5nIGNvbmZpZGVudGlhbGl0eS4gYXN5bW1ldHJpYyBrZXlzIGRvIG5vdCBz dWZmZXIgdGhhdCBpc3N1ZS4gV2hhdCBpcyB0aGUgZG93bnNpZGUgb2YgYXN5bW1ldHJpYw0KIGtl eXMgdGhhdCBqdXN0aWZpZXMgdXNpbmcgc3ltbWV0cmljIGtleXMgYW5kIHRhY2tsaW5nIHRoZSBp c3N1ZSBvZiBtYWludGFpbmluZyBjb25maWRlbnRpYWxpdHk/PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBvdGhlciB3b3Jkcywg d2h5IG5vdCBqdXN0IHNwZWNpZnkgYXN5bW1ldHJpYyBrZXlzIGFuZCBsZWF2ZSBpdCBhdCB0aGF0 PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J IGFtIGFsc28gd29ycmllZCBhYm91dCBpbnRlcm9wZXJhYmlsaXR5IGJlY2F1c2UgaWYgeW91IHNw ZWNpZnkgYm90aCBzeW1tZXRyaWMgJmFtcDsgYXN5bW1ldHJpYyBrZXlzIEkgdGhpbmsgaXQgaXMg ZmFyIGZyb20gZ3VhcmFudGVlZCB0aGF0IGFsbCBpbXBsZW1lbnRhdGlvbnMgd2lsbCBpbXBsZW1l bnQgYm90aCB2YXJpYW50cyBhbmQgSeKAmW0geWV0IHRvIGJlIGNvbnZpbmNlZCB0aGF0IHdlIG5l ZWQgdG8gdGFrZSB0aGF0DQogcmlzayBhdCBhbGwuPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIEhv dyBhcmUgdGhlIGtleXMgZGlzdHJpYnV0ZWQgYmV0d2VlbiBDRE5zPyBJIGRvbuKAmXQgc2VlIGEg cHJvcGVydHkgaW4gdGhlIFVyaVNpZ25pbmcgTWV0YWRhdGEgb2JqZWN0IHRoYXQgd291bGQgaW5j bHVkZSAob3IgbGluayB0bykgdGhlIGtleXMgKEnigJltIGFzc3VtaW5nIHlvdSBuZWVkIHRvIHN1 cHBvcnQgZGlzdHJpYnV0aW9uIG9mIGF0IGxlYXN0IDIga2V5cyB0byBzdXBwb3J0IGtleSByb3Rh dGlvbik/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPktMJmd0OyBLZXkgZGlzdHJpYnV0aW9uIGlzIG91 dCBvZiBzY29wZS4gSSBub3RpY2VkIGZvbGxvd2luZyB0ZXh0IHdhcyBkcm9wcGVkIHdoZW4gbWV0 aG9kIGNvbnZlcnRlZCB0byBKV1QuIFdlIGNhbiBwdXQgdGhpcyBiYWNrIGluIENETkkgT3ZlcnZp ZXcgc2VjdGlvbiwgd2hlcmUNCiB0aGUgYXN5bW1ldHJpYyBhbmQgc3ltbWV0cmljIGtleSBtZXRo b2RzIGFyZSBtZW50aW9uZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj7igJxUd28gdHlwZXMgb2Yga2V5cyBj YW4gYmUgdXNlZCBmb3IgVVJJIFNpZ25pbmc6IGFzeW1tZXRyaWMga2V5cyBhbmQ8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHN5bW1ldHJpYyBrZXlzLiZuYnNw OyBBc3ltbWV0cmljIGtleXMgYXJlIGJhc2VkIG9uIGEgcHVibGljL3ByaXZhdGUga2V5PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBwYWlyIG1lY2hhbmlzbSBh bmQgYWx3YXlzIGNvbnRhaW4gYSBwcml2YXRlIGtleSBvbmx5IGtub3duIHRvIHRoZTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgZW50aXR5IHNpZ25pbmcgdGhl IFVSSSAoZWl0aGVyIENTUCBvciB1Q0ROKSBhbmQgYSBwdWJsaWMga2V5IGZvciB0aGU8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHZlcmlmaWNhdGlvbiBvZiB0 aGUgU2lnbmVkIFVSSS4mbmJzcDsgV2l0aCBzeW1tZXRyaWMga2V5cywgdGhlIHNhbWUga2V5IGlz PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyB1c2VkIGJ5IGJv dGggdGhlIHNpZ25pbmcgZW50aXR5IGZvciBzaWduaW5nIHRoZSBVUkkgYXMgd2VsbCBhcyBieSB0 aGU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHZhbGlkYXRp bmcgZW50aXR5IGZvciB2YWxpZGF0aW5nIHRoZSBTaWduZWQgVVJJLiZuYnNwOyBSZWdhcmRsZXNz IG9mIHRoZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgdHlw ZSBvZiBrZXlzIHVzZWQsIHRoZSB2YWxpZGF0aW5nIGVudGl0eSBoYXMgdG8gb2J0YWluIHRoZSBr ZXk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IChlaXRoZXIg dGhlIHB1YmxpYyBvciB0aGUgc3ltbWV0cmljIGtleSkuJm5ic3A7IFRoZXJlIGFyZSB2ZXJ5IGRp ZmZlcmVudDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgcmVx dWlyZW1lbnRzIGZvciBrZXkgZGlzdHJpYnV0aW9uIChvdXQgb2Ygc2NvcGUgb2YgdGhpcyBkb2N1 bWVudCk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHdpdGgg YXN5bW1ldHJpYyBrZXlzIGFuZCB3aXRoIHN5bW1ldHJpYyBrZXlzLiZuYnNwOyBLZXkgZGlzdHJp YnV0aW9uIGZvcjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsg c3ltbWV0cmljIGtleXMgcmVxdWlyZXMgY29uZmlkZW50aWFsaXR5IHRvIHByZXZlbnQgYW5vdGhl ciBwYXJ0eSBmcm9tPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNw OyBnZXR0aW5nIGFjY2VzcyB0byB0aGUga2V5LCBzaW5jZSBpdCBjb3VsZCB0aGVuIGdlbmVyYXRl IHZhbGlkIFNpZ25lZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJz cDsgVVJJcyBmb3IgdW5hdXRob3JpemVkIHJlcXVlc3RzLiZuYnNwOyBLZXkgZGlzdHJpYnV0aW9u IGZvciBhc3ltbWV0cmljIGtleXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7Jm5ic3A7IGRvZXMgbm90IHJlcXVpcmUgY29uZmlkZW50aWFsaXR5IHNpbmNlIHB1YmxpYyBr ZXlzIGNhbiB0eXBpY2FsbHkgYmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7Jm5ic3A7IGRpc3RyaWJ1dGVkIG9wZW5seSAoYmVjYXVzZSB0aGV5IGNhbm5vdCBiZSB1c2Vk IGZvciBVUkkgc2lnbmluZykgYW5kPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZu YnNwOyZuYnNwOyBwcml2YXRlIGtleXMgYXJlIGtlcHQgYnkgdGhlIFVSSSBzaWduaW5nIGZ1bmN0 aW9uLuKAnTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBIb3cgZG9l cyBhIHVDRE4ga25vdyB3aGV0aGVyIGl0IGlzIE9LL3NhZmUvd2l0aGluIHBvbGljeSB0byByZS1k aXN0cmlidXRlIHN5bW1ldHJpYyBrZXlzIHRvIGEgZENETj88bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ S0wmZ3Q7IFNlZSBhYm92ZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+KiBJbiB0aGUgY2FzZSBvZiBTaWduZWQgVG9rZW4gY2hhaW5zLCBo b3cgZG9lcyBhIENETiBvYnRhaW4gdGhlIGtleXMgcmVxdWlyZWQgdG8gc2lnbiB0aGUgbmV3IHRv a2VucyBpbiB0aGUgY2hhaW4gYXMgaXQgZ2VuZXJhdGVzIHRoZW0/PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPktMJmd0OyBTZWUgYWJvdmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5LZW50PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIFNlY3Rpb24gMy4zLjEgSSB0aGluayBuZWVkcyB0 byBiZSBtb3JlIGV4cGxpY2l0LCBJIGRvbuKAmXQga25vdyBob3cgb25lIGNvdWxkIGNvbW11bmlj YXRlIGEgdG9rZW4gY2hhaW4gdmlhIHRoZSBxdWVyeSBzdHJpbmcgYXMgc3BlY2lmaWVkIGluIHRo ZSBkb2N1bWVudCwgYXMgdGhlcmUgaXMgbm8g4oCcYmFjayBjaGFubmVs4oCdIGZvciB0aGUgQ0RO IHRvIGNvbW11bmljYXRlIHRoZSBuZXh0IHRva2VuIGluIHRoZSBjaGFpbg0KIHRvIHRoZSBVQS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SFRIPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZW48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIDI1IEp1biAyMDE3LCBhdCAyMToxOSwgUGhpbCBTb3JiZXIgJmx0 OzxhIGhyZWY9Im1haWx0bzpzb3JiZXJAYXBhY2hlLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+c29yYmVyQGFwYWNoZS5vcmc8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPlJlYWxseSBob3BpbmcgdG8gZ2V0 IHNvbWUgZmVlZGJhY2sgb24gdGhpcyBhdCB0aGUgbWVldGluZyBpbiBQcmFndWUuIEl0J3MgZ290 IGFsbCB0aGUgY2hhbmdlcyB0aGF0IGhhdmUgYmVlbiBkaXNjdXNzZWQgc28gSSdtIG5vdCBhd2Fy ZSBvZiBhbnkgbW9yZSBzdWJzdGFudGl2ZSBjaGFuZ2VzIG5lZWRlZC4gSG93ZXZlciwgbG90cyBv ZiBlZGl0b3JpYWwgbml0cw0KIEkgc3VzcGVjdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIFN1biwgSnVuIDI1LCAyMDE3IGF0IDI6MTIgUE0gJmx0OzxhIGhyZWY9Im1haWx0bzppbnRl cm5ldC1kcmFmdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmludGVybmV0 LWRyYWZ0c0BpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpBIE5ldyBJbnRlcm5ldC1E cmFmdCBpcyBhdmFpbGFibGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMgZGlyZWN0 b3JpZXMuPGJyPg0KVGhpcyBkcmFmdCBpcyBhIHdvcmsgaXRlbSBvZiB0aGUgQ29udGVudCBEZWxp dmVyeSBOZXR3b3JrcyBJbnRlcmNvbm5lY3Rpb24gb2YgdGhlIElFVEYuPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFRpdGxlJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDs6IFVSSSBTaWduaW5nIGZvciBDRE4gSW50ZXJjb25uZWN0aW9uIChDRE5J KTxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBBdXRob3JzJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOzogUmF5IHZhbiBCcmFuZGVuYnVyZzxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBLZW50IExldW5nPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IFBoaWwgU29yYmVyPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7IEZpbGVuYW1lJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IDogZHJhZnQtaWV0Zi1jZG5p LXVyaS1zaWduaW5nLTEyLnR4dDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBQYWdl cyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7OiAzNTxicj4NCiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBEYXRlJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgOiAyMDE3LTA2LTI1PGJyPg0KPGJyPg0KQWJzdHJhY3Q6PGJyPg0KJm5ic3A7 ICZuYnNwO1RoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGhvdyB0aGUgY29uY2VwdCBvZiBVUkkgc2ln bmluZyBzdXBwb3J0cyB0aGU8YnI+DQombmJzcDsgJm5ic3A7Y29udGVudCBhY2Nlc3MgY29udHJv bCByZXF1aXJlbWVudHMgb2YgQ0ROSSBhbmQgcHJvcG9zZXMgYSBVUkk8YnI+DQombmJzcDsgJm5i c3A7c2lnbmluZyBtZXRob2QgYXMgYSBKU09OIFdlYiBUb2tlbiAoSldUKSBbUkZDNzUxOV0gcHJv ZmlsZS48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7VGhlIHByb3Bvc2VkIFVSSSBzaWduaW5nIG1l dGhvZCBzcGVjaWZpZXMgdGhlIGluZm9ybWF0aW9uIG5lZWRlZCB0bzxicj4NCiZuYnNwOyAmbmJz cDtiZSBpbmNsdWRlZCBpbiB0aGUgVVJJIHRvIHRyYW5zbWl0IHRoZSBzaWduZWQgSldUIGFzIHdl bGwgYXMgdGhlPGJyPg0KJm5ic3A7ICZuYnNwO2NsYWltcyBuZWVkZWQgYnkgdGhlIHNpZ25lZCBK V1QgdG8gYXV0aG9yaXplIGEgVUEuJm5ic3A7IFRoZSBtZWNoYW5pc208YnI+DQombmJzcDsgJm5i c3A7ZGVzY3JpYmVkIGNhbiBiZSB1c2VkIGJvdGggaW4gQ0ROSSBhbmQgc2luZ2xlIENETiBzY2Vu YXJpb3MuPGJyPg0KPGJyPg0KPGJyPg0KVGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2Ug Zm9yIHRoaXMgZHJhZnQgaXM6PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLyIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9j L2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy88L3NwYW4+PC9hPjxicj4NCjxicj4NClRoZXJl IGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2YWlsYWJsZSBhdDo8YnI+DQo8YSBocmVmPSJo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLTEy IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtY2RuaS11cmktc2lnbmluZy0xMjwvc3Bhbj48L2E+ PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFm dC1pZXRmLWNkbmktdXJpLXNpZ25pbmctMTIiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0 LWlldGYtY2RuaS11cmktc2lnbmluZy0xMjwvc3Bhbj48L2E+PGJyPg0KPGJyPg0KQSBkaWZmIGZy b20gdGhlIHByZXZpb3VzIHZlcnNpb24gaXMgYXZhaWxhYmxlIGF0Ojxicj4NCjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWNkbmktdXJpLXNpZ25p bmctMTIiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczov L3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0Zi1jZG5pLXVyaS1zaWduaW5nLTEy PC9zcGFuPjwvYT48YnI+DQo8YnI+DQo8YnI+DQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtl IGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uPGJyPg0KdW50 aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdDxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwOi8v dG9vbHMuaWV0Zi5vcmcvIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+dG9vbHMuaWV0Zi5vcmc8L3NwYW4+PC9hPi48YnI+DQo8YnI+DQpJbnRlcm5ldC1EcmFmdHMg YXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6PGJyPg0KPGEgaHJlZj0iZnRw Oi8vZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5mdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLzwv c3Bhbj48L2E+PGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpDRE5pIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpD RE5pQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ Q0ROaUBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9jZG5pIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jZG5pPC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpDRE5pIG1haWxp bmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpDRE5pQGlldGYub3JnIj48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5DRE5pQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkiPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY2RuaTwvc3Bh bj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4N CjwvaHRtbD4NCg== --_000_a79e35933ce241c78267514fa39f289aXCHRTP006ciscocom_-- From nobody Tue Jul 18 15:38:15 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A62E3127275 for ; Tue, 18 Jul 2017 15:38:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KKLhmQ7Mq4Qe for ; Tue, 18 Jul 2017 15:38:09 -0700 (PDT) Received: from mail-yw0-x244.google.com (mail-yw0-x244.google.com [IPv6:2607:f8b0:4002:c05::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC2B4127241 for ; Tue, 18 Jul 2017 15:38:08 -0700 (PDT) Received: by mail-yw0-x244.google.com with SMTP id v193so1772554ywg.0 for ; Tue, 18 Jul 2017 15:38:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yGqFL7HOVKfcMCif/nVrBmL9de6pCqLE+LLW+WIzFzE=; b=V77kRd/ik+Jay8LzkpSieWqtkrQ97iqyvzhQN+zSXpfk7WXaqOmOtTMMst30UY6rId HrEbUlbE/fcEo5mqb6+Fj2YzsohpdjUX95DQ/H0j+vJ2HfZy/JWBW0/VpLFm0ibb5U1t ChseI50H7lDy0na6alS3LaRf1wJhDo4WqpSDmG+Xr9xAlGj/L1Dbx+xhMZNT+dPK9pJ8 qxIynwGHBFv6ftgRQLafT2TGw9gfjTjdi72yKOQN+QSZX0cpHNP1VUwvuNT8G7W/x81E T2xQsEMvTSWX4LWWRsacGCEjnu1pNCZS/31RkXXO64kOQAd2ZJ3Hr1XZgPCU55sn1Jti nyqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yGqFL7HOVKfcMCif/nVrBmL9de6pCqLE+LLW+WIzFzE=; b=ZjTRxKTNbs/heDa1U0vdX9Q1CgJODPRMSuVledaKnWa4RaioJWvvPGq58THIJnhYI+ 7H2uIH2SvwVyApDpthuU6Hie1odgax9oz1EbhUhoBx/JHuapb+mivANDnfLiNGYFmPq3 ctWqm9/DZQmAw5uC6JFRFj5cyaFJqtv+eUdRjln1ceOogTRi7WlZQekLnchFNbPDjLs+ mgHAOUVLQL0k5j5M80QC0isxYSDRIMPVqSRiCLrG+ckbxa5Ma61ouFGDRX8yDVxE4Wlt jpa3sBDMU7CPiNUv5tNu6A0JAChCADizMadtBMn0wmuEER6vCkWrnV3Oa63GlPCXoFDx RrMA== X-Gm-Message-State: AIVw112+zo0oDOelR0H6ZFco5Q+kgQEDhMgXqNFQkB0lPh0eh6ej9Kca GIihDZazYqp4lwrlaYg= X-Received: by 10.129.80.10 with SMTP id e10mr2912433ywb.309.1500417487699; Tue, 18 Jul 2017 15:38:07 -0700 (PDT) Received: from [10.100.17.73] (static-108-26-234-5.bstnma.fios.verizon.net. [108.26.234.5]) by smtp.gmail.com with ESMTPSA id u66sm1274746ywa.44.2017.07.18.15.38.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Jul 2017 15:38:06 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-086A1BCF-37AE-4EF0-BE6F-71619F6A8D51 Mime-Version: 1.0 (1.0) From: "Kevin J. Ma" X-Mailer: iPhone Mail (14F89) In-Reply-To: Date: Tue, 18 Jul 2017 18:38:05 -0400 Cc: Ben Niven-Jenkins , "cdni@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> To: "Kent Leung (kleung)" Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jul 2017 22:38:14 -0000 --Apple-Mail-086A1BCF-37AE-4EF0-BE6F-71619F6A8D51 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Ben/Kent, (as an individual) It's been my experience that symmetric keys have been m= ore prevelant, historically; and I think we were originally trying to match e= xisting schemes. Since JWTs supported both symmetric and asymmetric, it was= a freebie from that point of view. At this point, though, JWT has strayed sufficiently far from legacy implem= entations that I think we could probably define the scope for CDNI to be onl= y asymmetric, if we wanted, without much resistance. I don't have any particular affinity for symmetric keys. If the WG wants t= o drop them, it's ok with me. thanx. -- Kevin J. Ma Sent from my iPhone > On Jul 18, 2017, at 5:37 PM, Kent Leung (kleung) wrote:= >=20 > Hi Ben. I=E2=80=99m trying to recall the rationale. I think initially, URI= signing was based on the non-CDNI environment where both symmetric and asym= metric keys were supported and confidentiality was not an issue between CSP a= nd CDN. The issue for symmetric key is encountered for key distribution betw= een CSP/uCDN and dCDN. This concern has been documented: > =20 > =E2=80=9CIn CDNI, there are two methods for request routing: DNS-based a= nd > HTTP-based. For DNS-based request routing, the Signed URI (i.e., > Target CDN URI) provided by the CSP reaches the Downstream CDN > directly. In the case where the Downstream CDN does not have a trust > relationship with the CSP, this means that only an asymmetric public/ > private key method can be used for computing the URI Signature > because the CSP and Downstream CDN are not able to exchange symmetric > shared secret keys. Since the CSP is unlikely to have relationships > with all the Downstream CDNs that are delegated to by the Upstream > CDN, the CSP may choose to allow the Authoritative CDN to > redistribute the shared key to a subset of their Downstream CDNs .=E2=80= =9D > =20 > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric keys a= nd > symmetric keys. =E2=80=A6 With symmetric keys, the same key is > used by both the signing entity for signing the URI as well as by the > validating entity for validating the Signed URI. =E2=80=A6 Key distri= bution for > symmetric keys requires confidentiality to prevent another party from > getting access to the key, since it could then generate valid Signed > URIs for unauthorized requests.=E2=80=9D > =20 > =E2=80=9CWith DNS-based request routing, URI Signing does not match well= the > general chain of trust model of CDNI when used with symmetric keys > because the symmetric key information needs to be distributed across > multiple CDNI hops including non-adjacent hops. This raises a > security concern for applicability of URI Signing with symmetric keys > in case of DNS-based inter-CDN request routing.=E2=80=9D > =20 > In light of keeping things simple and the path of least existence, I=E2=80= =99m fine with defining only asymmetric key. > =20 > Maybe thoughts from Phil and Kevin and others? > =20 > Kent > =20 > =20 > From: Ben Niven-Jenkins [mailto:ben@niven-jenkins.co.uk]=20 > Sent: Tuesday, July 18, 2017 4:34 PM > To: Kent Leung (kleung) > Cc: Phil Sorber ; cdni@ietf.org > Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt > =20 > Hi Kent, > =20 > See inline > =20 > On 5 Jul 2017, at 22:23, Kent Leung (kleung) wrote: > From: CDNi [mailto:cdni-bounces@ietf.org] On Behalf Of Ben Niven-Jenkins > Sent: Tuesday, July 4, 2017 3:59 AM >=20 > =20 > Hi Phil & URI Signing authors, > =20 > I read the latest draft (-12) and below are some questions / thoughts, in n= o particular order, that occurred to me while reading the document. > =20 > * Why support both symmetric & asymmetric keys? What is the advantage to h= aving both options versus just picking one option (probably asymmetric keys a= s they work for all use cases)? > =20 > KL> There are pros and cons of using either asymmetric keys vs symmetric k= ey. Key distribution limitations and relationships between CSP and CDNs are f= actors. So I think supporting both allows flexibility for deployments of URI= signing. Existing URI signing proprietary implementations typically support= both already. > =20 > Apologies if I=E2=80=99m raking up discussions you=E2=80=99ve already had w= hen writing the document. Can you expand on what factors justify having two d= ifferent methods for signing URIs? > =20 > I am coming from the point of view that I can=E2=80=99t think of sufficien= t justification for having two methods. symmetric keys have the downside of r= equiring confidentiality. asymmetric keys do not suffer that issue. What is t= he downside of asymmetric keys that justifies using symmetric keys and tackl= ing the issue of maintaining confidentiality? > =20 > In other words, why not just specify asymmetric keys and leave it at that?= > =20 > I am also worried about interoperability because if you specify both symme= tric & asymmetric keys I think it is far from guaranteed that all implementa= tions will implement both variants and I=E2=80=99m yet to be convinced that w= e need to take that risk at all. >=20 > =20 > Ben > =20 > =20 > =20 > * How are the keys distributed between CDNs? I don=E2=80=99t see a propert= y in the UriSigning Metadata object that would include (or link to) the keys= (I=E2=80=99m assuming you need to support distribution of at least 2 keys t= o support key rotation)? > =20 > KL> Key distribution is out of scope. I noticed following text was dropped= when method converted to JWT. We can put this back in CDNI Overview section= , where the asymmetric and symmetric key methods are mentioned. > =20 > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric keys an= d > symmetric keys. Asymmetric keys are based on a public/private key > pair mechanism and always contain a private key only known to the > entity signing the URI (either CSP or uCDN) and a public key for the > verification of the Signed URI. With symmetric keys, the same key is > used by both the signing entity for signing the URI as well as by the > validating entity for validating the Signed URI. Regardless of the > type of keys used, the validating entity has to obtain the key > (either the public or the symmetric key). There are very different > requirements for key distribution (out of scope of this document) > with asymmetric keys and with symmetric keys. Key distribution for > symmetric keys requires confidentiality to prevent another party from > getting access to the key, since it could then generate valid Signed > URIs for unauthorized requests. Key distribution for asymmetric keys > does not require confidentiality since public keys can typically be > distributed openly (because they cannot be used for URI signing) and > private keys are kept by the URI signing function.=E2=80=9D > =20 > =20 > * How does a uCDN know whether it is OK/safe/within policy to re-distribut= e symmetric keys to a dCDN? > =20 > KL> See above. > =20 > * In the case of Signed Token chains, how does a CDN obtain the keys requi= red to sign the new tokens in the chain as it generates them? > =20 > KL> See above. > =20 > Kent > =20 > =20 > * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t know ho= w one could communicate a token chain via the query string as specified in t= he document, as there is no =E2=80=9Cback channel=E2=80=9D for the CDN to co= mmunicate the next token in the chain to the UA. > =20 > HTH > Ben > =20 > On 25 Jun 2017, at 21:19, Phil Sorber wrote: > =20 > Really hoping to get some feedback on this at the meeting in Prague. It's g= ot all the changes that have been discussed so I'm not aware of any more sub= stantive changes needed. However, lots of editorial nits I suspect. >=20 > Thanks. > =20 > On Sun, Jun 25, 2017 at 2:12 PM wrote: >=20 > A New Internet-Draft is available from the on-line Internet-Drafts directo= ries. > This draft is a work item of the Content Delivery Networks Interconnection= of the IETF. >=20 > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 >=20 > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. >=20 > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 >=20 >=20 > Please note that it may take a couple of minutes from the time of submissi= on > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > =20 > =20 > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni --Apple-Mail-086A1BCF-37AE-4EF0-BE6F-71619F6A8D51 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi Ben/Kent,

  (as an individual= )  It's been my experience that symmetric keys have been more prevelant= , historically; and I think we were originally trying to match existing sche= mes.  Since JWTs supported both symmetric and asymmetric, it was a free= bie from that point of view.

<= div id=3D"AppleMailSignature">  At this point, though, JWT has str= ayed sufficiently far from legacy implementations that I think we could prob= ably define the scope for CDNI to be only asymmetric, if we wanted, without m= uch resistance.

  I don't have any particular affinity for symmet= ric keys.  If the WG wants to drop them, it's ok with me.

thanx.

-- &nb= sp;Kevin J. Ma

Sent from my iPhone

On Jul 18, 2017, at 5= :37 PM, Kent Leung (kleung) <kleung@c= isco.com> wrote:

Hi Ben. I=E2= =80=99m trying to recall the rationale. I think initially, URI signing was b= ased on the non-CDNI environment where both symmetric and asymmetric keys were supported and confidentiality was not an issue bet= ween CSP and CDN. The issue for symmetric key is encountered for key distrib= ution between CSP/uCDN and dCDN. This concern has been documented:

 

  =E2=80=9CIn CDNI, there are two methods for request routing: DNS= -based and

   HTTP-based.  For DNS-based request routing, the Signe= d URI (i.e.,

   Target CDN URI) provided by the CSP reaches the Downstream= CDN

   directly.  In the case where the Downstream CDN does n= ot have a trust

   relationship with the CSP, this means that only an asymmet= ric public/

   private key method can be used for computing the URI Signa= ture

   because the CSP and Downstream CDN are not able to exchang= e symmetric

   shared secret keys.  Since the CSP is unlikely to hav= e relationships

   with all the Downstream CDNs that are delegated to by the U= pstream

   CDN, the CSP may choose to allow the Authoritative CDN to<= o:p>

   redistribute the shared key to a subset of their Downstrea= m CDNs .=E2=80=9D

 

  =E2=80=9CTwo types of keys can be used for URI Signing: asymmetr= ic keys and

   symmetric keys.  =E2=80=A6  With symmetric keys,= the same key is

   used by both the signing entity for signing the URI as wel= l as by the

   validating entity for validating the Signed URI.  =E2= =80=A6  Key distribution for

   symmetric keys requires confidentiality to prevent another= party from

   getting access to the key, since it could then generate va= lid Signed

   URIs for unauthorized requests.=E2=80=9D=

 

  =E2=80=9CWith DNS-based request routing, URI Signing does not ma= tch well the

   general chain of trust model of CDNI when used with symmet= ric keys

   because the symmetric key information needs to be distribu= ted across

   multiple CDNI hops including non-adjacent hops.  This= raises a

   security concern for applicability of URI Signing with sym= metric keys

   in case of DNS-based inter-CDN request routing.=E2=80=9D

 

In light of keeping things simple and the path of least existence, I=E2= =80=99m fine with defining only asymmetric key.

=

 

Maybe thoughts from Phil and Kevin and others?=

 

Kent

 

 

From: Ben Niven-Jenkins [mailto:ben@niven-jenkins.co.uk]
Sent: Tuesday, July 18, 2017 4:34 PM
To: Kent Leung (kleung) <kleun= g@cisco.com>
Cc: Phil Sorber <sorber@apach= e.org>; cdni@ietf.org
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt

 

Hi Kent,

 

See inline

 

On 5 Jul 2017, at 22:23, Kent Leung (kleung) <kleung@cisco.com> wrote:

From: CDNi [mailto:cdni-bounces@ietf.org= ] On Behalf Of Ben Niven-Jenkins

Sent: Tuesday, July 4, 2017 3:59 AM

 

Hi Phil & URI Signing authors,

 

I read the latest draft (-12) and below are some ques= tions / thoughts, in no particular order, that occurred to me while reading t= he document.

 

* Why support both symmetric & asymmetric keys? W= hat is the advantage to having both options versus just picking one option (= probably asymmetric keys as they work for all use cases)?

 

KL> There are pros and cons of using= either asymmetric keys vs symmetric key. Key distribution limitations and r= elationships between CSP and CDNs are factors. So I think supporting both allows flexibility for deployments of URI signin= g. Existing URI signing proprietary implementations typically support both a= lready.

 

Apologies if I=E2=80=99m raking up discussions you=E2= =80=99ve already had when writing the document. Can you expand on what facto= rs justify having two different methods for signing URIs?

 

I am coming from the point of view that I can=E2=80=99= t think of sufficient justification for having two methods. symmetric keys h= ave the downside of requiring confidentiality. asymmetric keys do not suffer= that issue. What is the downside of asymmetric keys that justifies using symmetric keys and tackling the issue of maintain= ing confidentiality?

 

In other words, why not just specify asymmetric keys a= nd leave it at that?

 

I am also worried about interoperability because if y= ou specify both symmetric & asymmetric keys I think it is far from guara= nteed that all implementations will implement both variants and I=E2=80=99m y= et to be convinced that we need to take that risk at all.

 

Ben

 

 

 

* How are the keys distributed between CDNs? I don=E2= =80=99t see a property in the UriSigning Metadata object that would include (= or link to) the keys (I=E2=80=99m assuming you need to support distribution o= f at least 2 keys to support key rotation)?

 

KL> Key distribution is out of scope= . I noticed following text was dropped when method converted to JWT. We can p= ut this back in CDNI Overview section, where the asymmetric and symmetric key methods are mentioned.

 

=E2=80=9CTwo types of keys can be used f= or URI Signing: asymmetric keys and

   symmetric keys.  Asym= metric keys are based on a public/private key

   pair mechanism and always c= ontain a private key only known to the

   entity signing the URI (ei= ther CSP or uCDN) and a public key for the

   verification of the Signed= URI.  With symmetric keys, the same key is

   used by both the signing e= ntity for signing the URI as well as by the

   validating entity for vali= dating the Signed URI.  Regardless of the

   type of keys used, the val= idating entity has to obtain the key

   (either the public or the s= ymmetric key).  There are very different

   requirements for key distr= ibution (out of scope of this document)

   with asymmetric keys and w= ith symmetric keys.  Key distribution for

   symmetric keys requires co= nfidentiality to prevent another party from

   getting access to the key,= since it could then generate valid Signed

   URIs for unauthorized requ= ests.  Key distribution for asymmetric keys

   does not require confident= iality since public keys can typically be

   distributed openly (becaus= e they cannot be used for URI signing) and

   private keys are kept by t= he URI signing function.=E2=80=9D

 

 

* How does a uCDN know whether it is OK/safe/within p= olicy to re-distribute symmetric keys to a dCDN?

 

KL> See above.

=

 

* In the case of Signed Token chains, how does a CDN o= btain the keys required to sign the new tokens in the chain as it generates t= hem?

 

KL> See above.

=

 

Kent

 

 

* Section 3.3.1 I think needs to be more explicit, I d= on=E2=80=99t know how one could communicate a token chain via the query stri= ng as specified in the document, as there is no =E2=80=9Cback channel=E2=80=9D= for the CDN to communicate the next token in the chain to the UA.

 

HTH

Ben

 

On 25 Jun 2017, at 21:19, Phil Sorber <sorber@apache.org> wrote:

 

Really hoping to get s= ome feedback on this at the meeting in Prague. It's got all the changes that= have been discussed so I'm not aware of any more substantive changes needed= . However, lots of editorial nits I suspect.

Thanks.

 

On Sun, Jun 25, 2017 at 2:12 PM <internet-drafts@ietf= .org> wrote:


A New Internet-Draft is available from the on-line Internet-Drafts directori= es.
This draft is a work item of the Content Delivery Networks Interconnection o= f the IETF.

        Title           : U= RI Signing for CDN Interconnection (CDNI)
        Authors         : Ray v= an Brandenburg
                     =     Kent Leung
                     =     Phil Sorber
        Filename        : draft-ietf= -cdni-uri-signing-12.txt
        Pages           : 3= 5
        Date            : 2= 017-06-25

Abstract:
   This document describes how the concept of URI signing supports= the
   content access control requirements of CDNI and proposes a URI<= br>    signing method as a JSON Web Token (JWT) [RFC7519] profile.
=
   The proposed URI signing method specifies the information neede= d to
   be included in the URI to transmit the signed JWT as well as th= e
   claims needed by the signed JWT to authorize a UA.  The me= chanism
   described can be used both in CDNI and single CDN scenarios.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/do= c/draft-ietf-cdni-uri-signing/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-= ietf-cdni-uri-signing-12
https://datatracker.ietf= .org/doc/html/draft-ietf-cdni-uri-signing-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdi= ff?url2=3Ddraft-ietf-cdni-uri-signing-12


Please note that it may take a couple of minutes from the time of submission=
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni<= /a>

 

 

____________________= ___________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman= /listinfo/cdni
= --Apple-Mail-086A1BCF-37AE-4EF0-BE6F-71619F6A8D51-- From nobody Wed Jul 19 00:21:58 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7090F131BF7 for ; Wed, 19 Jul 2017 00:21:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.42 X-Spam-Level: X-Spam-Status: No, score=-6.42 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fk85RpJR9Puf for ; Wed, 19 Jul 2017 00:21:52 -0700 (PDT) Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by ietfa.amsl.com (Postfix) with SMTP id A3AB213178D for ; Wed, 19 Jul 2017 00:21:52 -0700 (PDT) Received: (qmail 76489 invoked by uid 99); 19 Jul 2017 07:21:52 -0000 Received: from mail-relay.apache.org (HELO mail-relay.apache.org) (140.211.11.15) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Jul 2017 07:21:52 +0000 Received: from mail-it0-f47.google.com (mail-it0-f47.google.com [209.85.214.47]) by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id B7B8F1A002E for ; Wed, 19 Jul 2017 07:21:51 +0000 (UTC) Received: by mail-it0-f47.google.com with SMTP id v127so15640620itd.0 for ; Wed, 19 Jul 2017 00:21:51 -0700 (PDT) X-Gm-Message-State: AIVw110QuENcZVw3b79F90vipK1D6C2UzaDOVOU5teiUNx601KLbOQx+ eHZM7Tz46ySOViVIgUCoMeu7u/5eGw== X-Received: by 10.36.144.133 with SMTP id x127mr1054029itd.2.1500448911211; Wed, 19 Jul 2017 00:21:51 -0700 (PDT) MIME-Version: 1.0 References: <149842148725.3124.11919861730574680552@ietfa.amsl.com> <21D2B0F2-9D1E-45BB-B216-44FFBCD56DE0@niven-jenkins.co.uk> <07d84d59a86f4dcdb19d4e8679bf26f2@XCH-RTP-006.cisco.com> In-Reply-To: From: Phil Sorber Date: Wed, 19 Jul 2017 07:21:40 +0000 X-Gmail-Original-Message-ID: Message-ID: To: "Kevin J. Ma" , "Kent Leung (kleung)" , Ben Niven-Jenkins Cc: "cdni@ietf.org" Content-Type: multipart/alternative; boundary="94eb2c07fd465b7e430554a67c1d" Archived-At: Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 07:21:56 -0000 --94eb2c07fd465b7e430554a67c1d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I agree with Kevin on the historic factor, and I think people are going to want to have an option to do something that is comfortable. I also think that we won't have to worry as much about implementations since most of the heavy lifting will be done in a JOSE or JWT library. If you do it right, you get both in one code path. I have a POC that I wrote to validate the examples. As far as having to deal with the confidentiality of secret keys, an implementation will likely still have to deal with that if they include PII such as client IP since that needs to be encrypted. On Wed, Jul 19, 2017 at 12:38 AM Kevin J. Ma wrote: > Hi Ben/Kent, > > (as an individual) It's been my experience that symmetric keys have > been more prevelant, historically; and I think we were originally trying = to > match existing schemes. Since JWTs supported both symmetric and > asymmetric, it was a freebie from that point of view. > > At this point, though, JWT has strayed sufficiently far from legacy > implementations that I think we could probably define the scope for CDNI = to > be only asymmetric, if we wanted, without much resistance. > > I don't have any particular affinity for symmetric keys. If the WG > wants to drop them, it's ok with me. > > thanx. > > -- Kevin J. Ma > > Sent from my iPhone > > On Jul 18, 2017, at 5:37 PM, Kent Leung (kleung) wrote= : > > Hi Ben. I=E2=80=99m trying to recall the rationale. I think initially, UR= I signing > was based on the non-CDNI environment where both symmetric and asymmetric > keys were supported and confidentiality was not an issue between CSP and > CDN. The issue for symmetric key is encountered for key distribution > between CSP/uCDN and dCDN. This concern has been documented: > > > > =E2=80=9CIn CDNI, there are two methods for request routing: DNS-based = and > > HTTP-based. For DNS-based request routing, the Signed URI (i.e., > > Target CDN URI) provided by the CSP reaches the Downstream CDN > > directly. In the case where the Downstream CDN does not have a trust > > relationship with the CSP, this means that only an asymmetric public/ > > private key method can be used for computing the URI Signature > > because the CSP and Downstream CDN are not able to exchange symmetric > > shared secret keys. Since the CSP is unlikely to have relationships > > with all the Downstream CDNs that are delegated to by the Upstream > > CDN, the CSP may choose to allow the Authoritative CDN to > > redistribute the shared key to a subset of their Downstream CDNs .=E2= =80=9D > > > > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric keys= and > > symmetric keys. =E2=80=A6 With symmetric keys, the same key is > > used by both the signing entity for signing the URI as well as by the > > validating entity for validating the Signed URI. =E2=80=A6 Key distr= ibution > for > > symmetric keys requires confidentiality to prevent another party from > > getting access to the key, since it could then generate valid Signed > > URIs for unauthorized requests.=E2=80=9D > > > > =E2=80=9CWith DNS-based request routing, URI Signing does not match wel= l the > > general chain of trust model of CDNI when used with symmetric keys > > because the symmetric key information needs to be distributed across > > multiple CDNI hops including non-adjacent hops. This raises a > > security concern for applicability of URI Signing with symmetric keys > > in case of DNS-based inter-CDN request routing.=E2=80=9D > > > > In light of keeping things simple and the path of least existence, I=E2= =80=99m > fine with defining only asymmetric key. > > > > Maybe thoughts from Phil and Kevin and others? > > > > Kent > > > > > > *From:* Ben Niven-Jenkins [mailto:ben@niven-jenkins.co.uk > ] > *Sent:* Tuesday, July 18, 2017 4:34 PM > *To:* Kent Leung (kleung) > *Cc:* Phil Sorber ; cdni@ietf.org > *Subject:* Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt > > > > Hi Kent, > > > > See inline > > > > On 5 Jul 2017, at 22:23, Kent Leung (kleung) wrote: > > *From:* CDNi [mailto:cdni-bounces@ietf.org ] *On > Behalf Of *Ben Niven-Jenkins > > *Sent:* Tuesday, July 4, 2017 3:59 AM > > > > Hi Phil & URI Signing authors, > > > > I read the latest draft (-12) and below are some questions / thoughts, in > no particular order, that occurred to me while reading the document. > > > > * Why support both symmetric & asymmetric keys? What is the advantage to > having both options versus just picking one option (probably asymmetric > keys as they work for all use cases)? > > > > KL> There are pros and cons of using either asymmetric keys vs symmetric > key. Key distribution limitations and relationships between CSP and CDNs > are factors. So I think supporting both allows flexibility for deployment= s > of URI signing. Existing URI signing proprietary implementations typicall= y > support both already. > > > > Apologies if I=E2=80=99m raking up discussions you=E2=80=99ve already had= when writing the > document. Can you expand on what factors justify having two different > methods for signing URIs? > > > > I am coming from the point of view that I can=E2=80=99t think of sufficie= nt > justification for having two methods. symmetric keys have the downside of > requiring confidentiality. asymmetric keys do not suffer that issue. What > is the downside of asymmetric keys that justifies using symmetric keys an= d > tackling the issue of maintaining confidentiality? > > > > In other words, why not just specify asymmetric keys and leave it at that= ? > > > > I am also worried about interoperability because if you specify both > symmetric & asymmetric keys I think it is far from guaranteed that all > implementations will implement both variants and I=E2=80=99m yet to be co= nvinced > that we need to take that risk at all. > > > > Ben > > > > > > > > * How are the keys distributed between CDNs? I don=E2=80=99t see a proper= ty in the > UriSigning Metadata object that would include (or link to) the keys (I=E2= =80=99m > assuming you need to support distribution of at least 2 keys to support k= ey > rotation)? > > > > KL> Key distribution is out of scope. I noticed following text was droppe= d > when method converted to JWT. We can put this back in CDNI Overview > section, where the asymmetric and symmetric key methods are mentioned. > > > > =E2=80=9CTwo types of keys can be used for URI Signing: asymmetric keys a= nd > > symmetric keys. Asymmetric keys are based on a public/private key > > pair mechanism and always contain a private key only known to the > > entity signing the URI (either CSP or uCDN) and a public key for the > > verification of the Signed URI. With symmetric keys, the same key is > > used by both the signing entity for signing the URI as well as by the > > validating entity for validating the Signed URI. Regardless of the > > type of keys used, the validating entity has to obtain the key > > (either the public or the symmetric key). There are very different > > requirements for key distribution (out of scope of this document) > > with asymmetric keys and with symmetric keys. Key distribution for > > symmetric keys requires confidentiality to prevent another party from > > getting access to the key, since it could then generate valid Signed > > URIs for unauthorized requests. Key distribution for asymmetric keys > > does not require confidentiality since public keys can typically be > > distributed openly (because they cannot be used for URI signing) and > > private keys are kept by the URI signing function.=E2=80=9D > > > > > > * How does a uCDN know whether it is OK/safe/within policy to > re-distribute symmetric keys to a dCDN? > > > > KL> See above. > > > > * In the case of Signed Token chains, how does a CDN obtain the keys > required to sign the new tokens in the chain as it generates them? > > > > KL> See above. > > > > Kent > > > > > > * Section 3.3.1 I think needs to be more explicit, I don=E2=80=99t know h= ow one > could communicate a token chain via the query string as specified in the > document, as there is no =E2=80=9Cback channel=E2=80=9D for the CDN to co= mmunicate the next > token in the chain to the UA. > > > > HTH > > Ben > > > > On 25 Jun 2017, at 21:19, Phil Sorber wrote: > > > > Really hoping to get some feedback on this at the meeting in Prague. It's > got all the changes that have been discussed so I'm not aware of any more > substantive changes needed. However, lots of editorial nits I suspect. > > Thanks. > > > > On Sun, Jun 25, 2017 at 2:12 PM wrote: > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Content Delivery Networks Interconnectio= n > of the IETF. > > Title : URI Signing for CDN Interconnection (CDNI) > Authors : Ray van Brandenburg > Kent Leung > Phil Sorber > Filename : draft-ietf-cdni-uri-signing-12.txt > Pages : 35 > Date : 2017-06-25 > > Abstract: > This document describes how the concept of URI signing supports the > content access control requirements of CDNI and proposes a URI > signing method as a JSON Web Token (JWT) [RFC7519] profile. > > The proposed URI signing method specifies the information needed to > be included in the URI to transmit the signed JWT as well as the > claims needed by the signed JWT to authorize a UA. The mechanism > described can be used both in CDNI and single CDN scenarios. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-12 > https://datatracker.ietf.org/doc/html/draft-ietf-cdni-uri-signing-12 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-cdni-uri-signing-12 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > > > > > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni > --94eb2c07fd465b7e430554a67c1d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I agree with Kevin on the historic factor, and I thin= k people are going to want to have an option to do something that is comfor= table. I also think that we won't have to worry as much about implement= ations since most of the heavy lifting will be done in a JOSE or JWT librar= y. If you do it right, you get both in one code path. I have a POC that I w= rote to validate the examples.

As far as having to= deal with the confidentiality of secret keys, an implementation will likel= y still have to deal with that if they include PII such as client IP since = that needs to be encrypted.

On Wed, Jul 19, 2017 at 12:38 AM Kevin J. Ma <kevin.j.ma.ietf@gmail.com> wrote:
Hi Ben/Kent,

=C2=A0 (as an individual) =C2=A0It&= #39;s been my experience that symmetric keys have been more prevelant, hist= orically; and I think we were originally trying to match existing schemes.= =C2=A0 Since JWTs supported both symmetric and asymmetric, it was a freebie= from that point of view.

=C2= =A0=C2=A0At this point, though, JWT has strayed sufficiently far from legac= y implementations that I think we could probably define the scope for CDNI = to be only asymmetric, if we wanted, without much resistance.

=C2=A0=C2=A0I don't have any particular= affinity for symmetric keys.=C2=A0 If the WG wants to drop them, it's = ok with me.

thanx.

-- =C2=A0Kevin J. Ma

Sent from my iP= hone

On Jul 18, 2017, at 5:37 PM, Ken= t Leung (kleung) <= kleung@cisco.com> wrote:

Hi Ben. I=E2=80=99m trying to recall the rationale. I think in= itially, URI signing was based on the non-CDNI environment where both symme= tric and asymmetric keys were supported and confidentiality was not an issue be= tween CSP and CDN. The issue for symmetric key is encountered for key distr= ibution between CSP/uCDN and dCDN. This concern has been documented:=

=C2=A0

=C2=A0 =E2=80=9CIn CDNI, there = are two methods for request routing: DNS-based and

=C2=A0=C2=A0 HTTP-based.=C2=A0 = For DNS-based request routing, the Signed URI (i.e.,

=C2=A0=C2=A0 Target CDN URI) pr= ovided by the CSP reaches the Downstream CDN

=C2=A0=C2=A0 directly.=C2=A0 In= the case where the Downstream CDN does not have a trust

=C2=A0=C2=A0 relationship with = the CSP, this means that only an asymmetric public/

=C2=A0=C2=A0 private key method= can be used for computing the URI Signature

=C2=A0=C2=A0 because the CSP an= d Downstream CDN are not able to exchange symmetric

=C2=A0=C2=A0 shared secret keys= .=C2=A0 Since the CSP is unlikely to have relationships

=C2=A0=C2=A0 with all the Downs= tream CDNs that are delegated to by the Upstream

=C2=A0=C2=A0 CDN, the CSP may c= hoose to allow the Authoritative CDN to

=C2=A0=C2=A0 redistribute the s= hared key to a subset of their Downstream CDNs .=E2=80=9D

=C2=A0

=C2=A0 =E2=80=9CTwo types of ke= ys can be used for URI Signing: asymmetric keys and

=C2=A0=C2=A0 symmetric keys.=C2= =A0 =E2=80=A6=C2=A0 With symmetric keys, the same key is

=C2=A0=C2=A0 used by both the s= igning entity for signing the URI as well as by the

=C2=A0=C2=A0 validating entity = for validating the Signed URI.=C2=A0 =E2=80=A6=C2=A0 Key distribution for

=C2=A0=C2=A0 symmetric keys req= uires confidentiality to prevent another party from

=C2=A0=C2=A0 getting access to = the key, since it could then generate valid Signed

=C2=A0=C2=A0 URIs for unauthori= zed requests.=E2=80=9D

=C2=A0

=C2=A0 =E2=80=9CWith DNS-based = request routing, URI Signing does not match well the

=C2=A0=C2=A0 general chain of t= rust model of CDNI when used with symmetric keys

=C2=A0=C2=A0 because the symmet= ric key information needs to be distributed across

=C2=A0=C2=A0 multiple CDNI hops= including non-adjacent hops.=C2=A0 This raises a

=C2=A0=C2=A0 security concern f= or applicability of URI Signing with symmetric keys

=C2=A0=C2=A0 in case of DNS-bas= ed inter-CDN request routing.=E2=80=9D

=C2=A0

In light of keeping things simp= le and the path of least existence, I=E2=80=99m fine with defining only asy= mmetric key.

=C2=A0

Maybe thoughts from Phil and Ke= vin and others?

=C2=A0

Kent

=C2=A0

=C2=A0

From: Ben Niven-Jenkins [mailto:ben@niven-jenkins.= co.uk]
Sent: Tuesday, July 18, 2017 4:34 PM
To: Kent Leung (kleung) <kleung@cisco.com>
Cc: Phil Sorber <sorber@apache.org>; cdni@ietf.org
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-12.txt

=C2=A0

Hi Kent,

=C2=A0

See inline

=C2=A0

On 5 Jul 2017, at 22:23, Kent Leung (kleung) <kleung@cisco.com>= wrote:

From:=C2=A0CDNi [mailto= :cdni-bounces@ietf.org]=C2=A0On Behalf Of=C2=A0Ben Niven-Jenkins

Sent:=C2=A0Tuesday, July 4, 2017 3:59 AM

=C2=A0

Hi Phil & URI Signing authors,

=C2=A0

I read the latest draft (-12) and below are some que= stions / thoughts, in no particular order, that occurred to me while readin= g the document.

=C2=A0

* Why support both symmetric & asymmetric keys? = What is the advantage to having both options versus just picking one option= (probably asymmetric keys as they work for all use cases)?

=C2=A0

KL> There are pros and cons of usi= ng either asymmetric keys vs symmetric key. Key distribution limitations an= d relationships between CSP and CDNs are factors. So I think supporting both allows flexibility for deployments of URI signi= ng. Existing URI signing proprietary implementations typically support both= already.

=C2=A0

Apologies if I=E2=80=99m raking up discussions you= =E2=80=99ve already had when writing the document. Can you expand on what f= actors justify having two different methods for signing URIs?=

=C2=A0

I am coming from the point of view that I can=E2=80= =99t think of sufficient justification for having two methods. symmetric ke= ys have the downside of requiring confidentiality. asymmetric keys do not s= uffer that issue. What is the downside of asymmetric keys that justifies using symmetric keys and tackling the issue of maintai= ning confidentiality?

=C2=A0

In other words, why not just specify asymmetric keys= and leave it at that?

=C2=A0

I am also worried about interoperability because if = you specify both symmetric & asymmetric keys I think it is far from gua= ranteed that all implementations will implement both variants and I=E2=80= =99m yet to be convinced that we need to take that risk at all.

=C2=A0

Ben

=C2=A0

=C2=A0

=C2=A0

* How are the keys distributed between CDNs? I don= =E2=80=99t see a property in the UriSigning Metadata object that would incl= ude (or link to) the keys (I=E2=80=99m assuming you need to support distrib= ution of at least 2 keys to support key rotation)?

=C2=A0

KL> Key distribution is out of sco= pe. I noticed following text was dropped when method converted to JWT. We c= an put this back in CDNI Overview section, where the asymmetric and symmetric key methods are mentioned.

=C2=A0

=E2=80=9CTwo types of keys can be use= d for URI Signing: asymmetric keys and

=C2=A0=C2=A0 symmetric keys.=C2=A0 As= ymmetric keys are based on a public/private key

=C2=A0=C2=A0 pair mechanism and alway= s contain a private key only known to the

=C2=A0=C2=A0 entity signing the URI (= either CSP or uCDN) and a public key for the

=C2=A0=C2=A0 verification of the Sign= ed URI.=C2=A0 With symmetric keys, the same key is

=C2=A0=C2=A0 used by both the signing= entity for signing the URI as well as by the

=C2=A0=C2=A0 validating entity for va= lidating the Signed URI.=C2=A0 Regardless of the

=C2=A0=C2=A0 type of keys used, the v= alidating entity has to obtain the key

=C2=A0=C2=A0 (either the public or th= e symmetric key).=C2=A0 There are very different

=C2=A0=C2=A0 requirements for key dis= tribution (out of scope of this document)

=C2=A0=C2=A0 with asymmetric keys and= with symmetric keys.=C2=A0 Key distribution for

=C2=A0=C2=A0 symmetric keys requires = confidentiality to prevent another party from

=C2=A0=C2=A0 getting access to the ke= y, since it could then generate valid Signed

=C2=A0=C2=A0 URIs for unauthorized re= quests.=C2=A0 Key distribution for asymmetric keys

=C2=A0=C2=A0 does not require confide= ntiality since public keys can typically be

=C2=A0=C2=A0 distributed openly (beca= use they cannot be used for URI signing) and

=C2=A0=C2=A0 private keys are kept by= the URI signing function.=E2=80=9D

=C2=A0

=C2=A0

* How does a uCDN know whether it is OK/safe/within = policy to re-distribute symmetric keys to a dCDN?

=C2=A0

KL> See above.

=C2=A0

* In the case of Signed Token chains, how does a CDN= obtain the keys required to sign the new tokens in the chain as it generat= es them?

=C2=A0

KL> See above.

=C2=A0

Kent

=C2=A0

=C2=A0

* Section 3.3.1 I think needs to be more explicit, I= don=E2=80=99t know how one could communicate a token chain via the query s= tring as specified in the document, as there is no =E2=80=9Cback channel=E2= =80=9D for the CDN to communicate the next token in the chain to the UA.

=C2=A0

HTH

Ben

=C2=A0

On 25 Jun 2017, at 21:19, Phil Sorber <s= orber@apache.org> wrote:

=C2=A0

Really hoping to get = some feedback on this at the meeting in Prague. It's got all the change= s that have been discussed so I'm not aware of any more substantive cha= nges needed. However, lots of editorial nits I suspect.

Thanks.

=C2=A0

On Sun, Jun 25, 2017 at 2:12 PM <= internet-drafts@ietf.org> wrote:


A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Content Delivery Networks Interconnection = of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= URI Signing for CDN Interconnection (CDNI)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Ray = van Brandenburg
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Kent Leung
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Phil Sorber
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-cdni-uri-signing-12.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 35
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2017-06-25

Abstract:
=C2=A0 =C2=A0This document describes how the concept of URI signing support= s the
=C2=A0 =C2=A0content access control requirements of CDNI and proposes a URI=
=C2=A0 =C2=A0signing method as a JSON Web Token (JWT) [RFC7519] profile.
=C2=A0 =C2=A0The proposed URI signing method specifies the information need= ed to
=C2=A0 =C2=A0be included in the URI to transmit the signed JWT as well as t= he
=C2=A0 =C2=A0claims needed by the signed JWT to authorize a UA.=C2=A0 The m= echanism
=C2=A0 =C2=A0described can be used both in CDNI and single CDN scenarios.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/= doc/draft-ietf-cdni-uri-signing/

There are also htmlized versions available at:
https://tools.ietf.org/html/draf= t-ietf-cdni-uri-signing-12
https://datatracker.ie= tf.org/doc/html/draft-ietf-cdni-uri-signing-12

A diff from the previous version is available at:
https://www.ietf.org/rfc= diff?url2=3Ddraft-ietf-cdni-uri-signing-12


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at=C2=A0tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni

=C2=A0

=C2=A0

___________________= ____________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni
=
_______________________________________________
CDNi mailing list
CDNi@ietf.org
https://www.ietf.org/mailman/listinfo/cdni
--94eb2c07fd465b7e430554a67c1d-- From nobody Wed Jul 19 06:43:28 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5D5712EC46 for ; Wed, 19 Jul 2017 06:43:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.421 X-Spam-Level: X-Spam-Status: No, score=-6.421 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eClSRr9Ml1Sq for ; Wed, 19 Jul 2017 06:43:26 -0700 (PDT) Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by ietfa.amsl.com (Postfix) with SMTP id E4CDD129B10 for ; Wed, 19 Jul 2017 06:43:26 -0700 (PDT) Received: (qmail 78718 invoked by uid 99); 19 Jul 2017 13:43:23 -0000 Received: from mail-relay.apache.org (HELO mail-relay.apache.org) (140.211.11.15) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Jul 2017 13:43:23 +0000 Received: from mail-it0-f41.google.com (mail-it0-f41.google.com [209.85.214.41]) by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id 6019E1A031E for ; Wed, 19 Jul 2017 13:43:23 +0000 (UTC) Received: by mail-it0-f41.google.com with SMTP id a62so662849itd.1 for ; Wed, 19 Jul 2017 06:43:22 -0700 (PDT) X-Gm-Message-State: AIVw110ZjCQYTv2cScMLpZd7CvdzEtpfUy+iY+UFQyGsPnE4bDErTO3I FkJL9Q+FRhyvNMPyFgd6uRR35csTPA== X-Received: by 10.36.213.135 with SMTP id a129mr202858itg.50.1500471800875; Wed, 19 Jul 2017 06:43:20 -0700 (PDT) MIME-Version: 1.0 From: Phil Sorber Date: Wed, 19 Jul 2017 13:43:09 +0000 X-Gmail-Original-Message-ID: Message-ID: To: "cdni@ietf.org" Cc: Ray van Brandenburg , "Thomas, E.D.R. (Emmanuel)" , Matthew Miller Content-Type: multipart/alternative; boundary="94eb2c05ffa2aff9c50554abd057" Archived-At: Subject: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 13:43:28 -0000 --94eb2c05ffa2aff9c50554abd057 Content-Type: text/plain; charset="UTF-8" Since we have added the HAS content I have been thinking about how specific we have made it. Perhaps just specifying a method for token chaining, and then citing HAS as a use case makes more sense. I wanted to get some opinions on it before I make those changes. It shouldn't be that big of a change, just taking the HAS specific stuff and putting it in a lower "Use Case" sub-section at the bottom and leaving everything else as a "Signed Token Chaining" section. Thoughts? Thanks. --94eb2c05ffa2aff9c50554abd057 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Since we have added the HAS content I have been think= ing about how specific we have made it. Perhaps just specifying a method fo= r token chaining, and then citing HAS as a use case makes more sense. I wan= ted to get some opinions on it before I make those changes. It shouldn'= t be that big of a change, just taking the HAS specific stuff and putting i= t in a lower "Use Case" sub-section at the bottom and leaving eve= rything else as a "Signed Token Chaining" section.
=
Thoughts?

Thanks.
--94eb2c05ffa2aff9c50554abd057-- From nobody Wed Jul 19 06:51:38 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D6DA131746 for ; Wed, 19 Jul 2017 06:51:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qd3fdFXa6ZQQ for ; Wed, 19 Jul 2017 06:51:35 -0700 (PDT) Received: from mail-qt0-x244.google.com (mail-qt0-x244.google.com [IPv6:2607:f8b0:400d:c0d::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DFE412F268 for ; Wed, 19 Jul 2017 06:51:35 -0700 (PDT) Received: by mail-qt0-x244.google.com with SMTP id l55so257449qtl.3 for ; Wed, 19 Jul 2017 06:51:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gD5scWNCvhbum+jMgIsLW82Dz4p2V3MaVkes3k3fC9E=; b=S4sJUtZDuT7D0Q9aGXGimMHXVL1oC8ufGJFATVP4OuLAOCtOoN8AHNs85iTqKvM14D v8WxBdHV+9HuMiQxqxE6iAxCVhU4CoH/YaS/TMVNaC69W4miJ4Y9q31mB1G+ij7yzy5M wrda9JZu60QDZ91veNGTRMipR3B2qcgU9eAG+5LL9Z3NSM+YNCmEi37sbd0GcZRbISy8 AX9sH6Oopfy4+4gSVKqm5jLHz15htu+lbiWDKtDKT+4P6Epm/2Kex+0AvkK0fkfjvCzJ AwjEf3a0hkbzV8h6zKW6+g5dwYxit+uT2MAFiFj0OFfN9gCIpLL+Eojc/2vmhHNP+7QH Jx5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gD5scWNCvhbum+jMgIsLW82Dz4p2V3MaVkes3k3fC9E=; b=uV81vXikPQlhf8PK3N/0d8rzTu13b2w1MvD7txRvPo4Fe9QY3gsOul2z/aIyEnCLc6 RRU0q1Ozgw/BoIsEOM0emiUSwsgKNamfvdrkCFGE1Lw5/T7RQidYIg4R7J15X5sGYO97 St4XeBV7HWuQ5VITozMwTvehUasusHJgR7xIEjCaQRt00IidRjYLGz7/zLKOlfcsSbHY VhSwMQg67SmVeDpVBcOcM/V3Ib9UMw1ao43QCdPMxvEUetp7oqqtVebPZidtSZLjSzBO xRz0vkCx5AAa858oFfhd2mSsqY+vr++KzyfLKETrqxzn6hHtmUpe9H54wlzwMxgeJTRb 7/Hg== X-Gm-Message-State: AIVw111ald6BcSbeQS8ugJcnZAJix3B3ioTGjugaAIWcmv+SbyyDJInx 5/CpwWC8RJsRWUR16mI= X-Received: by 10.237.61.16 with SMTP id g16mr269016qtf.60.1500472293985; Wed, 19 Jul 2017 06:51:33 -0700 (PDT) Received: from [192.168.1.107] (c-24-34-41-146.hsd1.nh.comcast.net. [24.34.41.146]) by smtp.gmail.com with ESMTPSA id m41sm52763qtc.78.2017.07.19.06.51.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jul 2017 06:51:32 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: "Kevin J. Ma" X-Mailer: iPhone Mail (14F89) In-Reply-To: Date: Wed, 19 Jul 2017 09:51:31 -0400 Cc: "cdni@ietf.org" , Ray van Brandenburg , Matthew Miller Content-Transfer-Encoding: quoted-printable Message-Id: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> References: To: Phil Sorber Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 13:51:36 -0000 (as an individual) I agree with making the section more generic and citing H= AS as a use case for token chaining. Sent from my iPhone > On Jul 19, 2017, at 9:43 AM, Phil Sorber wrote: >=20 > Since we have added the HAS content I have been thinking about how specifi= c we have made it. Perhaps just specifying a method for token chaining, and t= hen citing HAS as a use case makes more sense. I wanted to get some opinions= on it before I make those changes. It shouldn't be that big of a change, ju= st taking the HAS specific stuff and putting it in a lower "Use Case" sub-se= ction at the bottom and leaving everything else as a "Signed Token Chaining"= section. >=20 > Thoughts? >=20 > Thanks. > _______________________________________________ > CDNi mailing list > CDNi@ietf.org > https://www.ietf.org/mailman/listinfo/cdni From nobody Wed Jul 19 07:14:29 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FF9F131C51 for ; Wed, 19 Jul 2017 07:14:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.921 X-Spam-Level: X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tiledmedia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BKgw4VBe300i for ; Wed, 19 Jul 2017 07:14:25 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01on0094.outbound.protection.outlook.com [104.47.0.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C015131891 for ; Wed, 19 Jul 2017 07:14:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tiledmedia.onmicrosoft.com; s=selector1-tiledmedia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=GTLEj1X44HJx+PYRRKrehXJo8h/Em7wq7RK2c+edPUs=; b=bcR2L6rMeya63Gu4/xsVFchnEtvx5GECbd8B8jjvct0IlbipbhznkswlOpFBJUhRtg1jqabXSHnh0r7vZ78De+2aDFgVrh3sTV5DIf973wlivP79n9tT88yZmNhzPVehUpJjzi1hSU4wRqWNtjuT6W43X/cxUFUhu8fq3n+g5qo= Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com (10.168.157.13) by AM5PR0701MB1731.eurprd07.prod.outlook.com (10.167.215.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1282.4; Wed, 19 Jul 2017 14:14:21 +0000 Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5]) by AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5%18]) with mapi id 15.01.1282.007; Wed, 19 Jul 2017 14:14:21 +0000 From: Ray van Brandenburg To: "Kevin J. Ma" CC: Phil Sorber , "cdni@ietf.org" , "Matthew Miller" Thread-Topic: [CDNi] URI Signing Signed Token Chaining refactor Thread-Index: AQHTAJUCafvhrEh6vkqITYzFagrYeaJbKxaAgAAGYYA= Date: Wed, 19 Jul 2017 14:14:21 +0000 Message-ID: References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> In-Reply-To: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=tiledmedia.com; x-originating-ip: [89.255.38.58] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0701MB1731; 7:4yrp66z+4KxAvWox40zNTxUGqeY4faDfb8c8ZW1wrnPi/3ssMHqWe/wN2gekf/FXqs2qdMODFrBRn8RKcPCuPtG49lWbDSWnf8cTt0gRkNPYdif/UMusTppuAKeHLMX4wI4iVyomzXfwxbBzErt3oDrJ2h7k72JTIVTdNN2e9IxbDbcfunyjDC4tUhzN4rWQF71XgAm3ZzEgkweDoFwaQQvBdzEb6+/0jNzawtYFQ9DQqsgrpLY/kg+0RK5sTHCQfow3o5U5T0Qb3LwYsOFetsf8JGErXj6+I1rGBkOZXGStHTi1YJe0gSCYIM1EayNLGl+/ZZd71cVM9eM12fJDudvgfEZTWgQCJS8AXw3PzjaAjgXJsQKlefdQnemnUGA+R8e2zttq0GsUTp+yHq6xK4iwHnduQgtJ2jaS/2sbzsaXoJpifw+Wojk5yK++M3mDlPsKv+mJFRB46ST/U7t/HUzNS7wM2plt/BrdBWHLCZJdka3GJqITH5tIM0ED1Puy5MDotTZTevif/m9SzcBVTLU8m73NhaBBj0rzyfBZRMrDsGOPBOST3qGEB03GC8KcBBtO+eybcCFZvJ5k7Nb0H7fSXmIXa1BXu+EqWA7apoDm9yhQKwViejY9V5LMEgy91E1jMYlek6ySlM5ckh5/HGDSQMR+qdFAJgKaFpPkVxZ8Uuj4GF4eIunTdjyajyitKfq3WdBMKD/QOBIrhp0q5vhQ6ZEAWRnFg9D7lsbP3DuV73rTMsPqilSKbebz6qZ7shUrtq/NrSlMqCRqW4PGRBv9T99mPFC+XDZurjSAPYw= x-ms-office365-filtering-correlation-id: 78ba4dff-cae0-447a-bf7f-08d4ceb0738d x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:AM5PR0701MB1731; x-ms-traffictypediagnostic: AM5PR0701MB1731: x-exchange-antispam-report-test: UriScan:(236129657087228); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(2017060910075)(10201501046)(100000703101)(100105400095)(3002001)(93006095)(93001095)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(2016111802025)(6072148)(6043046)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB1731; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB1731; x-forefront-prvs: 0373D94D15 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39450400003)(39400400002)(39410400002)(39830400002)(24454002)(377454003)(81166006)(8936002)(5660300001)(2900100001)(229853002)(8676002)(6506006)(102836003)(305945005)(189998001)(6916009)(5250100002)(2950100002)(7736002)(66066001)(3846002)(6116002)(6486002)(38730400002)(6512007)(54356999)(86362001)(6246003)(53936002)(6306002)(110136004)(54906002)(99286003)(50986999)(76176999)(25786009)(478600001)(39060400002)(4326008)(2906002)(3660700001)(3280700002)(14454004)(83716003)(82746002)(6436002)(5003630100001)(33656002)(36756003)(966005)(53546010); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB1731; H:AM5PR0701MB3044.eurprd07.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: tiledmedia.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2017 14:14:21.3677 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0702b858-b758-4fb0-9e66-447a46ee0509 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB1731 Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:14:27 -0000 WWVzLCBnb29kIHBvaW50IQ0KDQpBbHRob3VnaCBJIGNhbuKAmXQgdGhpbmsgb2YgYW5vdGhlciB1 c2UgY2FzZSBmcm9tIHRoZSB0b3Agb2YgbXkgaGVhZCwgSSBkb27igJl0IHNlZSBhIGdvb2QgcmVh c29uIHRvIGxpbWl0IGl0IHRvIEhBUyBlaXRoZXIuDQoNClJheQ0KDQoNCj4gT24gMTkgSnVsIDIw MTcsIGF0IDE1OjUxLCBLZXZpbiBKLiBNYSA8a2V2aW4uai5tYS5pZXRmQGdtYWlsLmNvbT4gd3Jv dGU6DQo+IA0KPiAoYXMgYW4gaW5kaXZpZHVhbCkgSSBhZ3JlZSB3aXRoIG1ha2luZyB0aGUgc2Vj dGlvbiBtb3JlIGdlbmVyaWMgYW5kIGNpdGluZyBIQVMgYXMgYSB1c2UgY2FzZSBmb3IgdG9rZW4g Y2hhaW5pbmcuDQo+IA0KPiBTZW50IGZyb20gbXkgaVBob25lDQo+IA0KPj4gT24gSnVsIDE5LCAy MDE3LCBhdCA5OjQzIEFNLCBQaGlsIFNvcmJlciA8c29yYmVyQGFwYWNoZS5vcmc+IHdyb3RlOg0K Pj4gDQo+PiBTaW5jZSB3ZSBoYXZlIGFkZGVkIHRoZSBIQVMgY29udGVudCBJIGhhdmUgYmVlbiB0 aGlua2luZyBhYm91dCBob3cgc3BlY2lmaWMgd2UgaGF2ZSBtYWRlIGl0LiBQZXJoYXBzIGp1c3Qg c3BlY2lmeWluZyBhIG1ldGhvZCBmb3IgdG9rZW4gY2hhaW5pbmcsIGFuZCB0aGVuIGNpdGluZyBI QVMgYXMgYSB1c2UgY2FzZSBtYWtlcyBtb3JlIHNlbnNlLiBJIHdhbnRlZCB0byBnZXQgc29tZSBv cGluaW9ucyBvbiBpdCBiZWZvcmUgSSBtYWtlIHRob3NlIGNoYW5nZXMuIEl0IHNob3VsZG4ndCBi ZSB0aGF0IGJpZyBvZiBhIGNoYW5nZSwganVzdCB0YWtpbmcgdGhlIEhBUyBzcGVjaWZpYyBzdHVm ZiBhbmQgcHV0dGluZyBpdCBpbiBhIGxvd2VyICJVc2UgQ2FzZSIgc3ViLXNlY3Rpb24gYXQgdGhl IGJvdHRvbSBhbmQgbGVhdmluZyBldmVyeXRoaW5nIGVsc2UgYXMgYSAiU2lnbmVkIFRva2VuIENo YWluaW5nIiBzZWN0aW9uLg0KPj4gDQo+PiBUaG91Z2h0cz8NCj4+IA0KPj4gVGhhbmtzLg0KPj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+IENETmkg bWFpbGluZyBsaXN0DQo+PiBDRE5pQGlldGYub3JnDQo+PiBodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2NkbmkNCg0K From nobody Wed Jul 19 07:27:23 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9A3D131532 for ; Wed, 19 Jul 2017 07:27:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outer-planes-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cgvSOuZxH86J for ; Wed, 19 Jul 2017 07:27:19 -0700 (PDT) Received: from mail-wr0-x22f.google.com (mail-wr0-x22f.google.com [IPv6:2a00:1450:400c:c0c::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D833131CC9 for ; Wed, 19 Jul 2017 07:27:18 -0700 (PDT) Received: by mail-wr0-x22f.google.com with SMTP id y43so59321864wrd.3 for ; Wed, 19 Jul 2017 07:27:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outer-planes-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to; bh=86ibxE/sqnZRvF6bfT9DeM6QTuSKaSpT9M1+Dl3dAek=; b=S+GlsOekERgzRbgIX0ZuwzONcUHHQ4/b6W0JmJkHt3ONM3jknOk03H1+Elj7zg8h5Z 1pstWW/hNV9j3DT6pDVHAL9Xyb0A3XHO3VYrDpzHq6jAXVSn1sfFnBVOabZs+gjnPWhp uB2y/GDEZdGyBSv8M0KrPOw2Jw2RVPqM5wqGgfRICwCZP+gkAe3ZYIiqpYiAkEy7nvW2 Z/JBIc/Nyyvhqb/cd9pnT8fYuAiOqcRqBucVCucFoSbrzOfB5letKMIUa7fQaTz0mO3+ keTt0SnS5G2pJYQaDk8yWV6sI0iTWAdoszJO+ZAZn+wtCpGtp+Cd4w0Tso7eRcLDyVsb S4Ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=86ibxE/sqnZRvF6bfT9DeM6QTuSKaSpT9M1+Dl3dAek=; b=erL5tJSsYNdR+hMesllQb/hjubJ6g8c8EaropdS68HC+/yl+KOSeOsV75wkcJx75mz fSEmJo6zbA08XcnvwR3ySPS7SiYy2+BKMRght0aCBpqRlepZFynytmVsBxFRKWo80rf7 SDNIrTe0g0TgGAW+QqsEAW02gtooxLyTWLzuRgtWi/PL++AgvyJwBgTisVaHZcrVGGpV EieVsx0GTjftKqC5kNU1TfpJpxGryHys2MUeunllcxIxsRlEthP8UW/XT67jHwAhAvBi zx2sW5Atn3cR/0w5Ryuj3bWGCbGHd6OkUHJ7yzoWKwvogFw8qXDdDZOtacIwh6a2cnuV 4IRw== X-Gm-Message-State: AIVw112zI/WMFYI1V0R75VkcLHVyayJDs9bu0KS3+jkICGZPYOpKt66u rNe+HuxvzYFrxh5Kq/i/EBfP X-Received: by 10.223.168.15 with SMTP id l15mr4875505wrc.37.1500474436703; Wed, 19 Jul 2017 07:27:16 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:2971:923e:3627:ab64? ([2001:67c:370:128:2971:923e:3627:ab64]) by smtp.gmail.com with ESMTPSA id 3sm3360063wrs.18.2017.07.19.07.27.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jul 2017 07:27:16 -0700 (PDT) To: Ray van Brandenburg , "Kevin J. Ma" Cc: Phil Sorber , "cdni@ietf.org" References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> From: "Matthew A. Miller" Message-ID: Date: Wed, 19 Jul 2017 16:27:14 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Thunderbird/54.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="h4GKe7D01aGwxXnPpr0eAi6bMVHWxJ9eP" Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:27:21 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --h4GKe7D01aGwxXnPpr0eAi6bMVHWxJ9eP Content-Type: multipart/mixed; boundary="esdn2r1jRBpa7P1tg6gfEo6MNTnD2BoK9"; protected-headers="v1" From: "Matthew A. Miller" To: Ray van Brandenburg , "Kevin J. Ma" Cc: Phil Sorber , "cdni@ietf.org" Message-ID: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> In-Reply-To: --esdn2r1jRBpa7P1tg6gfEo6MNTnD2BoK9 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Making it (a little bit) more generic makes sense. I'm not sure about the name 'Signed Token Chain', but I don't have a better one. In cryptographic circles, "chain" has certain implications that this document is not expressing. The "next" item in the chain is supposed to be cryptographically tied to the "previous" item in the chain by using (a hash of, or the exact value of) the previous token when generating the next token. I don't know that that binding property is required here, so I'm not suggesting a change in the protocol. I do worry, however, that the language may potentially confuse (or worse, mislead) people about the security properties this document is providing. - m&m Matthew A. Miller < http://goo.gl/LM55L > On 7/19/17 4:14 PM, Ray van Brandenburg wrote: > Yes, good point! >=20 > Although I can=E2=80=99t think of another use case from the top of my h= ead, I don=E2=80=99t see a good reason to limit it to HAS either. >=20 > Ray >=20 >=20 >> On 19 Jul 2017, at 15:51, Kevin J. Ma wrot= e: >> >> (as an individual) I agree with making the section more generic and ci= ting HAS as a use case for token chaining. >> >> Sent from my iPhone >> >>> On Jul 19, 2017, at 9:43 AM, Phil Sorber wrote: >>> >>> Since we have added the HAS content I have been thinking about how sp= ecific we have made it. Perhaps just specifying a method for token chaini= ng, and then citing HAS as a use case makes more sense. I wanted to get s= ome opinions on it before I make those changes. It shouldn't be that big = of a change, just taking the HAS specific stuff and putting it in a lower= "Use Case" sub-section at the bottom and leaving everything else as a "S= igned Token Chaining" section. >>> >>> Thoughts? >>> >>> Thanks. >>> _______________________________________________ >>> CDNi mailing list >>> CDNi@ietf.org >>> https://www.ietf.org/mailman/listinfo/cdni >=20 --esdn2r1jRBpa7P1tg6gfEo6MNTnD2BoK9-- --h4GKe7D01aGwxXnPpr0eAi6bMVHWxJ9eP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJZb2xCAAoJEOz0ck4QngW7KOgH/19T0ibVgpPTuD/XOGfR8zq8 4ueZmKqRkTGtI/HjC2Gyd8dR4hvJge4vL+mKzcVBL+k2RbvboqPYbA9UMgDfoZg2 01gWXmkIWtKSZBR9o6nDFhUyB1FYlU6X3XkDbvZ4XCnppaN8Xe2Ly2g4L7JlluSk pivlzfzkatR89eBnCg/7rgFkMo9w8igksdtRPKmK8JPFxX1uAKRwbW0lr0SIEZRg 8xBu5reEnGtWnWCfR6VxK6ygqo0RnyRiNlJDjjc1BG4NYPypb5aB7+zFFnfdfAb9 ac/RV10RrSek5iFKcDOcYnnHvp9ErVlS2h5+cxYORV/v7W+N77ONzb3H+X4al3c= =epJw -----END PGP SIGNATURE----- --h4GKe7D01aGwxXnPpr0eAi6bMVHWxJ9eP-- From nobody Wed Jul 19 07:35:33 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D1051318A3 for ; Wed, 19 Jul 2017 07:35:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vvf35QlNQrTq for ; Wed, 19 Jul 2017 07:35:28 -0700 (PDT) Received: from mail-qt0-x244.google.com (mail-qt0-x244.google.com [IPv6:2607:f8b0:400d:c0d::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E24A131B8F for ; Wed, 19 Jul 2017 07:35:28 -0700 (PDT) Received: by mail-qt0-x244.google.com with SMTP id l55so481514qtl.3 for ; Wed, 19 Jul 2017 07:35:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XSIbWrS5RMPHgNK919krANe0dK5VqZ37OXKumOInm5Q=; b=b6C5JODTH/7ybryrTyC1BZwMqH114SUnElUUtdJ0QhZ8f6h/5fGKKBfmpDNQDuY9uX YGJSqYjv70kJgEElPd3BdVIsKLMAq/4NM2mUPKNHG0VhzSpgU/y8vZptaI7JwnjkHhRf hbRJR/yjr5nmiCsrFedSSjXAw0Xf7V3zrYmJrUX1eH0kA4KONBTFnqorEAYBGMNhaJBj oGU5a4tnCTnx7fvYHZ95DwfkdnoY8KouRda9eVIJNb9d2+Pz3QnxiZxlno1bpoDNRTfO 0n2qydca/PzVNyn3vewl6ZR1bXkZHSWFOaf6gCEa+fjwNQkfpG65mWdmyToikHvvIAbe 3g5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XSIbWrS5RMPHgNK919krANe0dK5VqZ37OXKumOInm5Q=; b=XTGy/Nh8D7G5JCfbNzWsDiM+KMTNCpp3mgG5iIN0YEzdlGJcuPazuRLUOPjUGRE/sT QgAyKb0Gd4sH2X3Uc8CxPOQY0Ws1h8IBAY8DvQDWAugMqItbIh+0sIe9Ny8rzgn0mFA2 rIANSZ87DYGCudphRPjsd8bt77z5XXvxVDkPwYjbyqd0ujYD1GFJgeFTBFOinVLzxtzX CFfflFXNa3nezTyi2vxFF64japvhIHSYwonLJESHGTSPODWrfU63ZF2lWAQewY834dTn /5UoMgFN86a0WsH4Pzhsy+FqDSgqf6YyrOg6KGJ1WsPbiBQxlstSdwXKidNbpPNy6AHK IZ8g== X-Gm-Message-State: AIVw113HFyJSpzaFPZE1ncLga9/OpEMRIb48xtk+CxWkmVLDYFLoV1Du er5mBwXHYHjRyg== X-Received: by 10.237.56.135 with SMTP id k7mr475572qte.134.1500474927554; Wed, 19 Jul 2017 07:35:27 -0700 (PDT) Received: from [172.20.20.20] ([73.61.19.153]) by smtp.gmail.com with ESMTPSA id c55sm154397qta.8.2017.07.19.07.35.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jul 2017 07:35:26 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: "Kevin J. Ma" X-Mailer: iPhone Mail (14F89) In-Reply-To: Date: Wed, 19 Jul 2017 10:35:25 -0400 Cc: Ray van Brandenburg , Phil Sorber , "cdni@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> To: "Matthew A. Miller" Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:35:32 -0000 how do you feel about "short-lived token renewal"? -- Kevin J. Ma Sent from my iPhone > On Jul 19, 2017, at 10:27 AM, Matthew A. Miller wrote: >=20 > Making it (a little bit) more generic makes sense. >=20 > I'm not sure about the name 'Signed Token Chain', but I don't have a > better one. In cryptographic circles, "chain" has certain implications > that this document is not expressing. The "next" item in the chain is > supposed to be cryptographically tied to the "previous" item in the > chain by using (a hash of, or the exact value of) the previous token > when generating the next token. >=20 > I don't know that that binding property is required here, so I'm not > suggesting a change in the protocol. I do worry, however, that the > language may potentially confuse (or worse, mislead) people about the > security properties this document is providing. >=20 >=20 > - m&m >=20 > Matthew A. Miller > < http://goo.gl/LM55L > >=20 >> On 7/19/17 4:14 PM, Ray van Brandenburg wrote: >> Yes, good point! >>=20 >> Although I can=E2=80=99t think of another use case from the top of my hea= d, I don=E2=80=99t see a good reason to limit it to HAS either. >>=20 >> Ray >>=20 >>=20 >>> On 19 Jul 2017, at 15:51, Kevin J. Ma wrote:= >>>=20 >>> (as an individual) I agree with making the section more generic and citi= ng HAS as a use case for token chaining. >>>=20 >>> Sent from my iPhone >>>=20 >>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber wrote: >>>>=20 >>>> Since we have added the HAS content I have been thinking about how spec= ific we have made it. Perhaps just specifying a method for token chaining, a= nd then citing HAS as a use case makes more sense. I wanted to get some opin= ions on it before I make those changes. It shouldn't be that big of a change= , just taking the HAS specific stuff and putting it in a lower "Use Case" su= b-section at the bottom and leaving everything else as a "Signed Token Chain= ing" section. >>>>=20 >>>> Thoughts? >>>>=20 >>>> Thanks. >>>> _______________________________________________ >>>> CDNi mailing list >>>> CDNi@ietf.org >>>> https://www.ietf.org/mailman/listinfo/cdni >>=20 >=20 From nobody Wed Jul 19 07:36:35 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF47B131B8F for ; Wed, 19 Jul 2017 07:36:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outer-planes-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id el3spaXjnvyj for ; Wed, 19 Jul 2017 07:36:32 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AC9D1318A3 for ; Wed, 19 Jul 2017 07:36:32 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id w126so871444wme.0 for ; Wed, 19 Jul 2017 07:36:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outer-planes-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to; bh=VbKdRK713zrGrYAcEFl6BQecU112bQJoHJplxaZAIQk=; b=NqJsRJqEUTNzSY84CS6hE01apPX+W4ox0QpnWT/XPGLpHpnp4i/GdUQRDBAidb2t0O bXmKdsFKOtUpBXcShb7DnpiIfvw6y1X/e5Q068JL6mpwBca5CveWB6ErGuOb5QMV7oTd 4ZfgXFhTl+7g5Fmrj6hWd3TPHeJ2GU5Wil73SENSTuXBFS8MhOMUoCIvgMoWP9b2plvO VeX1QtDQsNuT+fXGbpMdjsfqWnbU3+GvpJ9trVGC999mqSSoUOVt7RQcUetlc0aM4eKg n2JErEg2r/1vH5yaBk3FemTOEh1wkdEiJoIHKpYkMvi/tIjIKjw22Ace2y2jP++Su0tT fCIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=VbKdRK713zrGrYAcEFl6BQecU112bQJoHJplxaZAIQk=; b=L3TbevAHoD8W9VBxlnx9hGSgQHznYdtsvVNWBely5cqq/Mox28J/oCZr8QOkb4ftxS auWeg5OS9OzdTyILCUMDHnv4qhCsZVOKf4enIYYTsjiiVg/48mi2fKGTQBWp0wbLQnWm rXRQGxoAYIZ5m7GHMHjtrlkH1xz1JGOuGkaOeOQAebLCmGtLBcBwKPE2eFOINeszQENP Isz3EYX7YCGYA1IwOCt5rQ/fT51O3sqqbfOem5jhlszZ68cNyaOkI2YemcGqL4aoYFnS xpXpWPq78LV2s4oIKwaIm6EYB0QrsH298ldnoiZxL6UPnOkwFBRfZLUiCb7G6+PLX8K+ aVxQ== X-Gm-Message-State: AIVw111m4DK2Vtv8cHd3pk3OQJCCFEC7vjWogp4WxcsTkF2l8FTMizqH ddAtHVwA4bMItAnKVhKeotkb X-Received: by 10.28.166.70 with SMTP id p67mr181470wme.90.1500474990336; Wed, 19 Jul 2017 07:36:30 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:2971:923e:3627:ab64? ([2001:67c:370:128:2971:923e:3627:ab64]) by smtp.gmail.com with ESMTPSA id n19sm115081wmd.40.2017.07.19.07.36.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jul 2017 07:36:29 -0700 (PDT) To: "Kevin J. Ma" Cc: Ray van Brandenburg , Phil Sorber , "cdni@ietf.org" References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> From: "Matthew A. Miller" Message-ID: <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> Date: Wed, 19 Jul 2017 16:36:27 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Thunderbird/54.0 MIME-Version: 1.0 In-Reply-To: <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ph9pmQVIWr5m3OSBPvL2PjIh7qOrPTE6D" Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:36:34 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ph9pmQVIWr5m3OSBPvL2PjIh7qOrPTE6D Content-Type: multipart/mixed; boundary="lcV8gQjaCnwQPoqdSWKD5R1f4oKQOXVPW"; protected-headers="v1" From: "Matthew A. Miller" To: "Kevin J. Ma" Cc: Ray van Brandenburg , Phil Sorber , "cdni@ietf.org" Message-ID: <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> In-Reply-To: <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> --lcV8gQjaCnwQPoqdSWKD5R1f4oKQOXVPW Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Even simply 'Token Renewal' would be perfectly fine. I'm most concerned about the 'Chain' part. - m&m Matthew A. Miller < http://goo.gl/LM55L > On 7/19/17 4:35 PM, Kevin J. Ma wrote: > how do you feel about "short-lived token renewal"? >=20 > -- Kevin J. Ma >=20 > Sent from my iPhone >=20 >> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller wrote: >> >> Making it (a little bit) more generic makes sense. >> >> I'm not sure about the name 'Signed Token Chain', but I don't have a >> better one. In cryptographic circles, "chain" has certain implication= s >> that this document is not expressing. The "next" item in the chain is= >> supposed to be cryptographically tied to the "previous" item in the >> chain by using (a hash of, or the exact value of) the previous token >> when generating the next token. >> >> I don't know that that binding property is required here, so I'm not >> suggesting a change in the protocol. I do worry, however, that the >> language may potentially confuse (or worse, mislead) people about the >> security properties this document is providing. >> >> >> - m&m >> >> Matthew A. Miller >> < http://goo.gl/LM55L > >> >>> On 7/19/17 4:14 PM, Ray van Brandenburg wrote: >>> Yes, good point! >>> >>> Although I can=E2=80=99t think of another use case from the top of my= head, I don=E2=80=99t see a good reason to limit it to HAS either. >>> >>> Ray >>> >>> >>>> On 19 Jul 2017, at 15:51, Kevin J. Ma wr= ote: >>>> >>>> (as an individual) I agree with making the section more generic and = citing HAS as a use case for token chaining. >>>> >>>> Sent from my iPhone >>>> >>>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber wrote:= >>>>> >>>>> Since we have added the HAS content I have been thinking about how = specific we have made it. Perhaps just specifying a method for token chai= ning, and then citing HAS as a use case makes more sense. I wanted to get= some opinions on it before I make those changes. It shouldn't be that bi= g of a change, just taking the HAS specific stuff and putting it in a low= er "Use Case" sub-section at the bottom and leaving everything else as a = "Signed Token Chaining" section. >>>>> >>>>> Thoughts? >>>>> >>>>> Thanks. >>>>> _______________________________________________ >>>>> CDNi mailing list >>>>> CDNi@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/cdni >>> >> --lcV8gQjaCnwQPoqdSWKD5R1f4oKQOXVPW-- --ph9pmQVIWr5m3OSBPvL2PjIh7qOrPTE6D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJZb25rAAoJEOz0ck4QngW71qkIAKw/9hzqtCqpCVTcTnHBKFuU 29G9niVYjqqg2rGnZnAyHqGdCRX8Mo8piqgwDvWuu6unlV8BpvKDthHLH7YbjU0m ie6vxFU/+/61jEwIUAkA7ZCOuTpU4ncXfFy5L161+Rlo0el9D5n/9vrV5DnI+SO7 yFK+QnUyhzeXnpddXcs3ZuQ+kv6U0gaA7jF2B7/tnhMR+K32ruqFL3YkHYQA0QZ3 UTrs9158WFgeWXA9mQaibhr3YKZrzDHTrwOp8WkkkMb5rllyUbXpd41AZbi5BVSU bEZCeyYZ2wukBdSECBfrQXahj3sQ3e2msLWZenUb8wocuxSsed5kFTgUEA/ov10= =X3kR -----END PGP SIGNATURE----- --ph9pmQVIWr5m3OSBPvL2PjIh7qOrPTE6D-- From nobody Wed Jul 19 07:38:16 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53C22131C74 for ; Wed, 19 Jul 2017 07:38:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9dWNVDz2cZby for ; Wed, 19 Jul 2017 07:38:10 -0700 (PDT) Received: from mail-qt0-x241.google.com (mail-qt0-x241.google.com [IPv6:2607:f8b0:400d:c0d::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B394F126CB6 for ; Wed, 19 Jul 2017 07:38:10 -0700 (PDT) Received: by mail-qt0-x241.google.com with SMTP id h47so481109qta.5 for ; Wed, 19 Jul 2017 07:38:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PEg+6HGxb9IhpieC0x2MiECe9Kw+WFcbDs2IDeLtT0E=; b=sFW62/1a40G999hODyaxMx1be4zQHNkleLJOnpAQvFzcD8VWaQfBhkefbXbmcfcOwH XBwIBM5K1kZSIePlRI6NCZMnm4da0wer/dX41KmlDCSl47N75d9+EDZxhz/zHkrOcvjl pIoSLUDWZNVyWqViMj1ecs/xgrkW6XK8QFkP94zd4bdnB0Keu0DK9RppIgFc1tSEwamc g5/8dkeyh6zro8qKx4Bznu/zFUZqJWsJS90tv03EH6OfD2hL9lrzy3+DQFaSwjT+dobD 1MHlui0+Rdf9z5vzw4LscH065HSeh0L5uxMTNcKKVs2vAG1b4u+Ie+TSt1yU7eh2P4dR 9u0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PEg+6HGxb9IhpieC0x2MiECe9Kw+WFcbDs2IDeLtT0E=; b=DijNolqfixDqqiugxyNcmWNOd5JRpSgHAujs1+k7zJ38jKAIUOsl1mnztG0ZcXrFgD PMkKtXWxyxzO8kAe5BHuJtladAzB+uKSxYKU7cNiMoSvhErQsxF8Sc37W/wl/WjbpTBB e3p3KWUSnulnCXWIdWbiRCUZcoF45e7zIJE7mR8wlgZBpNEOv4qOCv5YFKJzvNynjCok DRNxQTg/+RJnzwJWjwtV865e7Wyq/6pB9BbM0HjOgHC9C6h3EIFAX2f2Hb6C9+CwnHlh vjAthE0046Q8Wh9Ht9j5o81oWfrD1oSOY5DVyM3qF02PvknHRQhlnJ9dJvxV1WWpOER/ dzkA== X-Gm-Message-State: AIVw1120zrlLprq0EVgL9yvuUSh29f5Szbpj99pj1hLvVYDQPMOlOpkD O+jBJsFIoH37iIaDJck= X-Received: by 10.200.42.130 with SMTP id b2mr412858qta.259.1500475089918; Wed, 19 Jul 2017 07:38:09 -0700 (PDT) Received: from [172.20.20.20] ([73.61.19.153]) by smtp.gmail.com with ESMTPSA id e40sm148796qta.14.2017.07.19.07.38.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jul 2017 07:38:08 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: "Kevin J. Ma" X-Mailer: iPhone Mail (14F89) In-Reply-To: <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> Date: Wed, 19 Jul 2017 10:38:07 -0400 Cc: Ray van Brandenburg , Phil Sorber , "cdni@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> To: "Matthew A. Miller" Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:38:15 -0000 I'm good with replacing "chaining" with "renewal". Ray? Sent from my iPhone > On Jul 19, 2017, at 10:36 AM, Matthew A. Miller wrote: >=20 > Even simply 'Token Renewal' would be perfectly fine. I'm most concerned > about the 'Chain' part. >=20 >=20 > - m&m >=20 > Matthew A. Miller > < http://goo.gl/LM55L > >=20 >> On 7/19/17 4:35 PM, Kevin J. Ma wrote: >> how do you feel about "short-lived token renewal"? >>=20 >> -- Kevin J. Ma >>=20 >> Sent from my iPhone >>=20 >>> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller wrote: >>>=20 >>> Making it (a little bit) more generic makes sense. >>>=20 >>> I'm not sure about the name 'Signed Token Chain', but I don't have a >>> better one. In cryptographic circles, "chain" has certain implications >>> that this document is not expressing. The "next" item in the chain is >>> supposed to be cryptographically tied to the "previous" item in the >>> chain by using (a hash of, or the exact value of) the previous token >>> when generating the next token. >>>=20 >>> I don't know that that binding property is required here, so I'm not >>> suggesting a change in the protocol. I do worry, however, that the >>> language may potentially confuse (or worse, mislead) people about the >>> security properties this document is providing. >>>=20 >>>=20 >>> - m&m >>>=20 >>> Matthew A. Miller >>> < http://goo.gl/LM55L > >>>=20 >>>> On 7/19/17 4:14 PM, Ray van Brandenburg wrote: >>>> Yes, good point! >>>>=20 >>>> Although I can=E2=80=99t think of another use case from the top of my h= ead, I don=E2=80=99t see a good reason to limit it to HAS either. >>>>=20 >>>> Ray >>>>=20 >>>>=20 >>>>> On 19 Jul 2017, at 15:51, Kevin J. Ma wrot= e: >>>>>=20 >>>>> (as an individual) I agree with making the section more generic and ci= ting HAS as a use case for token chaining. >>>>>=20 >>>>> Sent from my iPhone >>>>>=20 >>>>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber wrote: >>>>>>=20 >>>>>> Since we have added the HAS content I have been thinking about how sp= ecific we have made it. Perhaps just specifying a method for token chaining,= and then citing HAS as a use case makes more sense. I wanted to get some op= inions on it before I make those changes. It shouldn't be that big of a chan= ge, just taking the HAS specific stuff and putting it in a lower "Use Case" s= ub-section at the bottom and leaving everything else as a "Signed Token Chai= ning" section. >>>>>>=20 >>>>>> Thoughts? >>>>>>=20 >>>>>> Thanks. >>>>>> _______________________________________________ >>>>>> CDNi mailing list >>>>>> CDNi@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/cdni >>>>=20 >>>=20 >=20 From nobody Wed Jul 19 07:38:48 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26ECF12F268 for ; Wed, 19 Jul 2017 07:38:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.911 X-Spam-Level: X-Spam-Status: No, score=-2.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tiledmedia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zSHYUV0nmli9 for ; Wed, 19 Jul 2017 07:38:44 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40114.outbound.protection.outlook.com [40.107.4.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8887126CB6 for ; Wed, 19 Jul 2017 07:38:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tiledmedia.onmicrosoft.com; s=selector1-tiledmedia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=JMywz9R6aPp4IAtwhEKwihqrO5H2zUF9/M8YjVGZiIo=; b=XTJM0Qooar9aOoHI615qDmwli3ci8sXGnD6uavq5jSxKmIGjdx5WLw02h/nUY2VaVWAevesLjAHj3QZ76df/IR5XtqHz26q5UfjMxzhovfC4xJ8AJyxWVbn8CQOCkFTiSK4jPr3nOfB2xO0KSefb35K+kl3P8bnDWTcS+Rg6HpU= Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com (10.168.157.13) by AM5PR0701MB2721.eurprd07.prod.outlook.com (10.173.93.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1282.4; Wed, 19 Jul 2017 14:38:40 +0000 Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5]) by AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5%18]) with mapi id 15.01.1282.007; Wed, 19 Jul 2017 14:38:40 +0000 From: Ray van Brandenburg To: "Kevin J. Ma" CC: "Matthew A. Miller" , Phil Sorber , "cdni@ietf.org" Thread-Topic: [CDNi] URI Signing Signed Token Chaining refactor Thread-Index: AQHTAJUCafvhrEh6vkqITYzFagrYeaJbKxaAgAAGYYCAAAOaAIAAAkmAgAAASoCAAAB3gIAAACcA Date: Wed, 19 Jul 2017 14:38:40 +0000 Message-ID: <68FD4785-68D5-46A7-8BFB-2539611D097A@tiledmedia.com> References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> In-Reply-To: Accept-Language: en-US, nl-NL Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=tiledmedia.com; x-originating-ip: [89.255.38.58] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2721; 7:NOyHt4zrh9l5DpqPLw3zVJtXvjqkZscAs/is9YE890rKID36wIk6bSupXGtOSWeEOTmeZOsBQjh/lCwlPc/wRDsNL/mCmGh+HgGVeicgFTJLYlVHbNUXdidEBQd9lrRKzKuRy4zHBwC8wVroeUE9nzW3+udH6L5ISMeJ+0ao2s4veNL+rmpyhU/LWZ0nrjvcTOW/rUO2EPzDYF+/eQO0K6dgnN5Uqnxed6FE+BCzcbLAhlZtH4NQfNCc3dWrh8rYBXykgTPRjsQG6+Tlb/cX513Nb2d12xq2rzHZWduCopHp16Gp3ZcesZ6hpOV241wJXeCe/DLFY44tTVCP+QypR694c9y8ZbkLuWyG2YwnOxkf7YNd3IiZIcdEDO4e6KNhJLKQ2piyX4gpgUeKUtIPCMiBmGa93jgaPhkrHaoy0PjZaZTmzJUbRy36O8F18Qud5tia0ZGnB+gMsV+AVUW1EfirbvisZ1vE6fdMd22E8/ncsTDXLO5EhkgcXBjaaFGHRNG2EFZEsU6LVuq/kLHp/Q0Wb01+oZbltSLvjitb1KKvoI8HZCY+/sa+2UNv+/wBHM44F/dyoq6r1A+JEQ4qc3SfJgzC9bAaV/MK9MiStlVBMPLm0RbxrlGyNcsxP+21AdR7xg6+aZsQvO/1Z2j0kK3yfIq0a94OQtXNHSziJ9Ui8/HylfjFtR1WjKzRJQtAMYDpj9CtnHc4qlYyHAC0QHCJxLicMEv0koh4lKi40HXsnmUxlxJsgv+W6c945l5VYl7MUOUkOVO0JzQTCdZbTZ6kXJPRDB11sWHnVs4ODOU= x-ms-office365-filtering-correlation-id: c2c6d845-1b95-48ab-f8af-08d4ceb3d935 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:AM5PR0701MB2721; x-ms-traffictypediagnostic: AM5PR0701MB2721: x-exchange-antispam-report-test: UriScan:(278178393323532)(236129657087228)(192374486261705); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(2017060910075)(8121501046)(5005006)(3002001)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(6041248)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(2016111802025)(20161123562025)(20161123558100)(20161123564025)(6043046)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB2721; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB2721; x-forefront-prvs: 0373D94D15 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39830400002)(39450400003)(39400400002)(377454003)(24454002)(5660300001)(14454004)(3660700001)(50986999)(54356999)(76176999)(93886004)(9886003)(4326008)(2900100001)(86362001)(305945005)(1720100001)(66066001)(229853002)(6486002)(53366004)(25786009)(53936002)(82746002)(7736002)(6506006)(2950100002)(189998001)(966005)(39060400002)(110136004)(6916009)(53376002)(38730400002)(5003630100001)(33656002)(6246003)(11609785009)(8676002)(8936002)(81166006)(3280700002)(83716003)(478600001)(5250100002)(54906002)(6436002)(6512007)(6306002)(2906002)(3846002)(102836003)(53546010)(99286003)(6116002)(36756003)(4068875011); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB2721; H:AM5PR0701MB3044.eurprd07.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <111AF0223532FF46A83F255FBDC3AD24@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: tiledmedia.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2017 14:38:40.1750 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0702b858-b758-4fb0-9e66-447a46ee0509 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2721 Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:38:46 -0000 V29ya3MgZm9yIG1lLg0KDQpSYXkNCg0KPiBPbiAxOSBKdWwgMjAxNywgYXQgMTY6MzgsIEtldmlu IEouIE1hIDxrZXZpbi5qLm1hLmlldGZAZ21haWwuY29tPiB3cm90ZToNCj4gDQo+IEknbSBnb29k IHdpdGggcmVwbGFjaW5nICJjaGFpbmluZyIgd2l0aCAicmVuZXdhbCIuDQo+IA0KPiBSYXk/DQo+ IA0KPiBTZW50IGZyb20gbXkgaVBob25lDQo+IA0KPj4gT24gSnVsIDE5LCAyMDE3LCBhdCAxMDoz NiBBTSwgTWF0dGhldyBBLiBNaWxsZXIgPGxpbnV4d29sZkBvdXRlci1wbGFuZXMubmV0PiB3cm90 ZToNCj4+IA0KPj4gRXZlbiBzaW1wbHkgJ1Rva2VuIFJlbmV3YWwnIHdvdWxkIGJlIHBlcmZlY3Rs eSBmaW5lLiAgSSdtIG1vc3QgY29uY2VybmVkDQo+PiBhYm91dCB0aGUgJ0NoYWluJyBwYXJ0Lg0K Pj4gDQo+PiANCj4+IC0gbSZtDQo+PiANCj4+IE1hdHRoZXcgQS4gTWlsbGVyDQo+PiA8IGh0dHA6 Ly9nb28uZ2wvTE01NUwgPg0KPj4gDQo+Pj4gT24gNy8xOS8xNyA0OjM1IFBNLCBLZXZpbiBKLiBN YSB3cm90ZToNCj4+PiBob3cgZG8geW91IGZlZWwgYWJvdXQgInNob3J0LWxpdmVkIHRva2VuIHJl bmV3YWwiPw0KPj4+IA0KPj4+IC0tICBLZXZpbiBKLiBNYQ0KPj4+IA0KPj4+IFNlbnQgZnJvbSBt eSBpUGhvbmUNCj4+PiANCj4+Pj4gT24gSnVsIDE5LCAyMDE3LCBhdCAxMDoyNyBBTSwgTWF0dGhl dyBBLiBNaWxsZXIgPGxpbnV4d29sZkBvdXRlci1wbGFuZXMubmV0PiB3cm90ZToNCj4+Pj4gDQo+ Pj4+IE1ha2luZyBpdCAoYSBsaXR0bGUgYml0KSBtb3JlIGdlbmVyaWMgbWFrZXMgc2Vuc2UuDQo+ Pj4+IA0KPj4+PiBJJ20gbm90IHN1cmUgYWJvdXQgdGhlIG5hbWUgJ1NpZ25lZCBUb2tlbiBDaGFp bicsIGJ1dCBJIGRvbid0IGhhdmUgYQ0KPj4+PiBiZXR0ZXIgb25lLiAgSW4gY3J5cHRvZ3JhcGhp YyBjaXJjbGVzLCAiY2hhaW4iIGhhcyBjZXJ0YWluIGltcGxpY2F0aW9ucw0KPj4+PiB0aGF0IHRo aXMgZG9jdW1lbnQgaXMgbm90IGV4cHJlc3NpbmcuICBUaGUgIm5leHQiIGl0ZW0gaW4gdGhlIGNo YWluIGlzDQo+Pj4+IHN1cHBvc2VkIHRvIGJlIGNyeXB0b2dyYXBoaWNhbGx5IHRpZWQgdG8gdGhl ICJwcmV2aW91cyIgaXRlbSBpbiB0aGUNCj4+Pj4gY2hhaW4gYnkgdXNpbmcgKGEgaGFzaCBvZiwg b3IgdGhlIGV4YWN0IHZhbHVlIG9mKSB0aGUgcHJldmlvdXMgdG9rZW4NCj4+Pj4gd2hlbiBnZW5l cmF0aW5nIHRoZSBuZXh0IHRva2VuLg0KPj4+PiANCj4+Pj4gSSBkb24ndCBrbm93IHRoYXQgdGhh dCBiaW5kaW5nIHByb3BlcnR5IGlzIHJlcXVpcmVkIGhlcmUsIHNvIEknbSBub3QNCj4+Pj4gc3Vn Z2VzdGluZyBhIGNoYW5nZSBpbiB0aGUgcHJvdG9jb2wuICBJIGRvIHdvcnJ5LCBob3dldmVyLCB0 aGF0IHRoZQ0KPj4+PiBsYW5ndWFnZSBtYXkgcG90ZW50aWFsbHkgY29uZnVzZSAob3Igd29yc2Us IG1pc2xlYWQpIHBlb3BsZSBhYm91dCB0aGUNCj4+Pj4gc2VjdXJpdHkgcHJvcGVydGllcyB0aGlz IGRvY3VtZW50IGlzIHByb3ZpZGluZy4NCj4+Pj4gDQo+Pj4+IA0KPj4+PiAtIG0mbQ0KPj4+PiAN Cj4+Pj4gTWF0dGhldyBBLiBNaWxsZXINCj4+Pj4gPCBodHRwOi8vZ29vLmdsL0xNNTVMID4NCj4+ Pj4gDQo+Pj4+PiBPbiA3LzE5LzE3IDQ6MTQgUE0sIFJheSB2YW4gQnJhbmRlbmJ1cmcgd3JvdGU6 DQo+Pj4+PiBZZXMsIGdvb2QgcG9pbnQhDQo+Pj4+PiANCj4+Pj4+IEFsdGhvdWdoIEkgY2Fu4oCZ dCB0aGluayBvZiBhbm90aGVyIHVzZSBjYXNlIGZyb20gdGhlIHRvcCBvZiBteSBoZWFkLCBJIGRv buKAmXQgc2VlIGEgZ29vZCByZWFzb24gdG8gbGltaXQgaXQgdG8gSEFTIGVpdGhlci4NCj4+Pj4+ IA0KPj4+Pj4gUmF5DQo+Pj4+PiANCj4+Pj4+IA0KPj4+Pj4+IE9uIDE5IEp1bCAyMDE3LCBhdCAx NTo1MSwgS2V2aW4gSi4gTWEgPGtldmluLmoubWEuaWV0ZkBnbWFpbC5jb20+IHdyb3RlOg0KPj4+ Pj4+IA0KPj4+Pj4+IChhcyBhbiBpbmRpdmlkdWFsKSBJIGFncmVlIHdpdGggbWFraW5nIHRoZSBz ZWN0aW9uIG1vcmUgZ2VuZXJpYyBhbmQgY2l0aW5nIEhBUyBhcyBhIHVzZSBjYXNlIGZvciB0b2tl biBjaGFpbmluZy4NCj4+Pj4+PiANCj4+Pj4+PiBTZW50IGZyb20gbXkgaVBob25lDQo+Pj4+Pj4g DQo+Pj4+Pj4+IE9uIEp1bCAxOSwgMjAxNywgYXQgOTo0MyBBTSwgUGhpbCBTb3JiZXIgPHNvcmJl ckBhcGFjaGUub3JnPiB3cm90ZToNCj4+Pj4+Pj4gDQo+Pj4+Pj4+IFNpbmNlIHdlIGhhdmUgYWRk ZWQgdGhlIEhBUyBjb250ZW50IEkgaGF2ZSBiZWVuIHRoaW5raW5nIGFib3V0IGhvdyBzcGVjaWZp YyB3ZSBoYXZlIG1hZGUgaXQuIFBlcmhhcHMganVzdCBzcGVjaWZ5aW5nIGEgbWV0aG9kIGZvciB0 b2tlbiBjaGFpbmluZywgYW5kIHRoZW4gY2l0aW5nIEhBUyBhcyBhIHVzZSBjYXNlIG1ha2VzIG1v cmUgc2Vuc2UuIEkgd2FudGVkIHRvIGdldCBzb21lIG9waW5pb25zIG9uIGl0IGJlZm9yZSBJIG1h a2UgdGhvc2UgY2hhbmdlcy4gSXQgc2hvdWxkbid0IGJlIHRoYXQgYmlnIG9mIGEgY2hhbmdlLCBq dXN0IHRha2luZyB0aGUgSEFTIHNwZWNpZmljIHN0dWZmIGFuZCBwdXR0aW5nIGl0IGluIGEgbG93 ZXIgIlVzZSBDYXNlIiBzdWItc2VjdGlvbiBhdCB0aGUgYm90dG9tIGFuZCBsZWF2aW5nIGV2ZXJ5 dGhpbmcgZWxzZSBhcyBhICJTaWduZWQgVG9rZW4gQ2hhaW5pbmciIHNlY3Rpb24uDQo+Pj4+Pj4+ IA0KPj4+Pj4+PiBUaG91Z2h0cz8NCj4+Pj4+Pj4gDQo+Pj4+Pj4+IFRoYW5rcy4NCj4+Pj4+Pj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4g Q0ROaSBtYWlsaW5nIGxpc3QNCj4+Pj4+Pj4gQ0ROaUBpZXRmLm9yZw0KPj4+Pj4+PiBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2NkbmkNCj4+Pj4+IA0KPj4+PiANCj4+IA0K DQo= From nobody Wed Jul 19 07:56:38 2017 Return-Path: X-Original-To: cdni@ietfa.amsl.com Delivered-To: cdni@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27881131CEB for ; Wed, 19 Jul 2017 07:56:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.42 X-Spam-Level: X-Spam-Status: No, score=-6.42 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rnqsa5exxp2T for ; Wed, 19 Jul 2017 07:56:35 -0700 (PDT) Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by ietfa.amsl.com (Postfix) with SMTP id 32699131CE6 for ; Wed, 19 Jul 2017 07:56:35 -0700 (PDT) Received: (qmail 49944 invoked by uid 99); 19 Jul 2017 14:56:34 -0000 Received: from mail-relay.apache.org (HELO mail-relay.apache.org) (140.211.11.15) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Jul 2017 14:56:34 +0000 Received: from mail-it0-f51.google.com (mail-it0-f51.google.com [209.85.214.51]) by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id 370671A0029 for ; Wed, 19 Jul 2017 14:56:34 +0000 (UTC) Received: by mail-it0-f51.google.com with SMTP id h199so1874246ith.1 for ; Wed, 19 Jul 2017 07:56:34 -0700 (PDT) X-Gm-Message-State: AIVw110mhsfTaQJwS5XhgY6HrbEETXH4kfLU5WSadWREtwz2gKKGZQNS zOzsG9QxlLXXu6vuOXscN3UOR7VrBA== X-Received: by 10.36.86.139 with SMTP id o133mr181669itb.50.1500476193704; Wed, 19 Jul 2017 07:56:33 -0700 (PDT) MIME-Version: 1.0 References: <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> <68FD4785-68D5-46A7-8BFB-2539611D097A@tiledmedia.com> In-Reply-To: <68FD4785-68D5-46A7-8BFB-2539611D097A@tiledmedia.com> From: Phil Sorber Date: Wed, 19 Jul 2017 14:56:23 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Ray van Brandenburg , "Kevin J. Ma" Cc: "Matthew A. Miller" , "cdni@ietf.org" Content-Type: multipart/alternative; boundary="001a11419c668513360554acd641" Archived-At: Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor X-BeenThere: cdni@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2017 14:56:37 -0000 --001a11419c668513360554acd641 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ok, I'll put together a PR. Thanks. On Wed, Jul 19, 2017 at 4:39 PM Ray van Brandenburg wrote: > Works for me. > > Ray > > > On 19 Jul 2017, at 16:38, Kevin J. Ma wrote= : > > > > I'm good with replacing "chaining" with "renewal". > > > > Ray? > > > > Sent from my iPhone > > > >> On Jul 19, 2017, at 10:36 AM, Matthew A. Miller < > linuxwolf@outer-planes.net> wrote: > >> > >> Even simply 'Token Renewal' would be perfectly fine. I'm most concern= ed > >> about the 'Chain' part. > >> > >> > >> - m&m > >> > >> Matthew A. Miller > >> < http://goo.gl/LM55L > > >> > >>> On 7/19/17 4:35 PM, Kevin J. Ma wrote: > >>> how do you feel about "short-lived token renewal"? > >>> > >>> -- Kevin J. Ma > >>> > >>> Sent from my iPhone > >>> > >>>> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller < > linuxwolf@outer-planes.net> wrote: > >>>> > >>>> Making it (a little bit) more generic makes sense. > >>>> > >>>> I'm not sure about the name 'Signed Token Chain', but I don't have a > >>>> better one. In cryptographic circles, "chain" has certain > implications > >>>> that this document is not expressing. The "next" item in the chain = is > >>>> supposed to be cryptographically tied to the "previous" item in the > >>>> chain by using (a hash of, or the exact value of) the previous token > >>>> when generating the next token. > >>>> > >>>> I don't know that that binding property is required here, so I'm not > >>>> suggesting a change in the protocol. I do worry, however, that the > >>>> language may potentially confuse (or worse, mislead) people about th= e > >>>> security properties this document is providing. > >>>> > >>>> > >>>> - m&m > >>>> > >>>> Matthew A. Miller > >>>> < http://goo.gl/LM55L > > >>>> > >>>>> On 7/19/17 4:14 PM, Ray van Brandenburg wrote: > >>>>> Yes, good point! > >>>>> > >>>>> Although I can=E2=80=99t think of another use case from the top of = my head, > I don=E2=80=99t see a good reason to limit it to HAS either. > >>>>> > >>>>> Ray > >>>>> > >>>>> > >>>>>> On 19 Jul 2017, at 15:51, Kevin J. Ma > wrote: > >>>>>> > >>>>>> (as an individual) I agree with making the section more generic an= d > citing HAS as a use case for token chaining. > >>>>>> > >>>>>> Sent from my iPhone > >>>>>> > >>>>>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber > wrote: > >>>>>>> > >>>>>>> Since we have added the HAS content I have been thinking about ho= w > specific we have made it. Perhaps just specifying a method for token > chaining, and then citing HAS as a use case makes more sense. I wanted to > get some opinions on it before I make those changes. It shouldn't be that > big of a change, just taking the HAS specific stuff and putting it in a > lower "Use Case" sub-section at the bottom and leaving everything else as= a > "Signed Token Chaining" section. > >>>>>>> > >>>>>>> Thoughts? > >>>>>>> > >>>>>>> Thanks. > >>>>>>> _______________________________________________ > >>>>>>> CDNi mailing list > >>>>>>> CDNi@ietf.org > >>>>>>> https://www.ietf.org/mailman/listinfo/cdni > >>>>> > >>>> > >> > > --001a11419c668513360554acd641 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Ok, I'll put together a PR.

<= div>Thanks.

O= n Wed, Jul 19, 2017 at 4:39 PM Ray van Brandenburg <ray@tiledmedia.com> wrote:
Works for me.

Ray

> On 19 Jul 2017, at 16:38, Kevin J. Ma <kevin.j.ma.ietf@gmail.com> wrote:=
>
> I'm good with replacing "chaining" with "renewal&qu= ot;.
>
> Ray?
>
> Sent from my iPhone
>
>> On Jul 19, 2017, at 10:36 AM, Matthew A. Miller <linuxwolf@outer-planes.ne= t> wrote:
>>
>> Even simply 'Token Renewal' would be perfectly fine.=C2=A0= I'm most concerned
>> about the 'Chain' part.
>>
>>
>> - m&m
>>
>> Matthew A. Miller
>> < http://goo.gl/LM55L >
>>
>>> On 7/19/17 4:35 PM, Kevin J. Ma wrote:
>>> how do you feel about "short-lived token renewal"? >>>
>>> --=C2=A0 Kevin J. Ma
>>>
>>> Sent from my iPhone
>>>
>>>> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller <linuxwolf@outer-p= lanes.net> wrote:
>>>>
>>>> Making it (a little bit) more generic makes sense.
>>>>
>>>> I'm not sure about the name 'Signed Token Chain= 9;, but I don't have a
>>>> better one.=C2=A0 In cryptographic circles, "chain&qu= ot; has certain implications
>>>> that this document is not expressing.=C2=A0 The "next= " item in the chain is
>>>> supposed to be cryptographically tied to the "previou= s" item in the
>>>> chain by using (a hash of, or the exact value of) the prev= ious token
>>>> when generating the next token.
>>>>
>>>> I don't know that that binding property is required he= re, so I'm not
>>>> suggesting a change in the protocol.=C2=A0 I do worry, how= ever, that the
>>>> language may potentially confuse (or worse, mislead) peopl= e about the
>>>> security properties this document is providing.
>>>>
>>>>
>>>> - m&m
>>>>
>>>> Matthew A. Miller
>>>> < http://goo.gl/LM55L >
>>>>
>>>>> On 7/19/17 4:14 PM, Ray van Brandenburg wrote:
>>>>> Yes, good point!
>>>>>
>>>>> Although I can=E2=80=99t think of another use case fro= m the top of my head, I don=E2=80=99t see a good reason to limit it to HAS = either.
>>>>>
>>>>> Ray
>>>>>
>>>>>
>>>>>> On 19 Jul 2017, at 15:51, Kevin J. Ma <kevin.j.ma.ietf@gma= il.com> wrote:
>>>>>>
>>>>>> (as an individual) I agree with making the section= more generic and citing HAS as a use case for token chaining.
>>>>>>
>>>>>> Sent from my iPhone
>>>>>>
>>>>>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber <<= a href=3D"mailto:sorber@apache.org" target=3D"_blank">sorber@apache.org= > wrote:
>>>>>>>
>>>>>>> Since we have added the HAS content I have bee= n thinking about how specific we have made it. Perhaps just specifying a me= thod for token chaining, and then citing HAS as a use case makes more sense= . I wanted to get some opinions on it before I make those changes. It shoul= dn't be that big of a change, just taking the HAS specific stuff and pu= tting it in a lower "Use Case" sub-section at the bottom and leav= ing everything else as a "Signed Token Chaining" section.
>>>>>>>
>>>>>>> Thoughts?
>>>>>>>
>>>>>>> Thanks.
>>>>>>> ______________________________________________= _
>>>>>>> CDNi mailing list
>>>>>>> CDNi@ietf.org
>>>>>>> https://www.ietf.org/mailman/= listinfo/cdni
>>>>>
>>>>
>>

--001a11419c668513360554acd641--