From xml-bounces+eap-archive=lists.ietf.org@frascone.com Sat Mar 1 06:08:38 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E06328E0DF for ; Sat, 1 Mar 2008 06:05:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.742 X-Spam-Level: X-Spam-Status: No, score=-0.742 tagged_above=-999 required=5 tests=[AWL=-0.557, BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HVFVkZPRnRpj for ; Sat, 1 Mar 2008 06:05:11 -0800 (PST) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id E7A6A2946AB for ; Sat, 1 Mar 2008 05:31:10 -0800 (PST) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 7141B19AD8D3 for ; Sat, 1 Mar 2008 05:31:01 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: frascone.com mailing list memberships reminder From: xml-owner@frascone.com X-No-Archive: yes Message-ID: Date: Sat, 01 Mar 2008 05:30:17 -0800 Precedence: bulk X-BeenThere: xml@frascone.com X-Mailman-Version: 2.1.9 List-Id: Diameter XML Dictionary Design Team List -- CLOSED -- ARCHIVES ONLY X-List-Administrivia: yes To: eap-archive@lists.ietf.org Errors-To: xml-bounces+eap-archive=lists.ietf.org@frascone.com This is a monthly reminder about your frascone.com mailing list memberships. It shows the lists you are subscribed to, your passwords, and a Web page URL you can use to manage your subscriptions. Visit the Web page URL shown below to unsubscribe, change your e-mail address, temporarily disable your subscription for a vacation, set digest-style delivery, and so on. You can also use e-mail to make changes. For more info, send a message to the '-request' address of the list (for example, xml-request@frascone.com) containing just the word 'help' in the message body. An e-mail message will be sent to you with instructions. Here is the subscription information for eap-archive@lists.ietf.org: List Password // URL ---- -------- eap@frascone.com bibeos http://lists.frascone.com/mailman/options/eap/eap-archive%40lists.ietf.org From kcooney@att.com Sat Mar 1 12:24:41 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A06F63A67EA for ; Sat, 1 Mar 2008 12:24:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -50.192 X-Spam-Level: X-Spam-Status: No, score=-50.192 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX_IMAGE=3, EXTRA_MPART_TYPE=1, HELO_EQ_RU=0.595, HOST_EQ_RU=0.875, HTML_IMAGE_ONLY_08=1.787, HTML_MESSAGE=1, HTML_SHORT_LINK_IMG_1=0.001, MPART_ALT_DIFF=0.739, MY_CID_AND_STYLE=1.54, PART_CID_STOCK=1.635, PART_CID_STOCK_LESS=0.384, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, SARE_GIF_ATTACH=1.42, SARE_HTML_IMG_ONLY=1.666, STOCK_IMG_CTYPE=0.907, STOCK_IMG_HDR_FROM=0.001, STOCK_IMG_HTML=0.001, TVD_FW_GRAPHIC_NAME_LONG=1.08, TVD_SPACE_RATIO=2.219, T_TVD_FW_GRAPHIC_ID1=0.01, URIBL_BLACK=20, URIBL_RHS_DOB=1.083, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zVqmlsjsl+0e for ; Sat, 1 Mar 2008 12:24:40 -0800 (PST) Received: from 174.60.pppoe.mari-el.ru (174.60.pppoe.mari-el.ru [77.40.60.174]) by core3.amsl.com (Postfix) with ESMTP id 3B0C528C3D9 for ; Sat, 1 Mar 2008 12:23:09 -0800 (PST) Message-ID: <000801c87bda$033c2ee5$98083685@kyegm> From: "hillard ignacio" To: Subject: to: Date: Sat, 01 Mar 2008 18:35:40 +0000 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0003_01C87BDA.033AF9C3" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C87BDA.033AF9C3 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0004_01C87BDA.033AF9C3" ------=_NextPart_001_0004_01C87BDA.033AF9C3 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable http://livinferetis.com ------=_NextPart_001_0004_01C87BDA.033AF9C3 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable ------=_NextPart_001_0004_01C87BDA.033AF9C3-- ------=_NextPart_000_0003_01C87BDA.033AF9C3 Content-Type: image/gif; name="wandercum.gif" Content-Transfer-Encoding: base64 Content-ID: <000501c87bda$033af9c3$98083685@kyegm> R0lGODlhLgIjAdUAAKRxTdEhJciVbunIuNeqjLeFXmIICOW8qa6ZjY1dPKITFNfT0WxaVHVLLtK4 pQxu3uKymtVMTSoeFtKff+61xqp8ee7Y1n96f9GboLQ3Orexr9zb28jHxteOiFs5JEU4M////wAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAAAAAALAAAAAAuAiMBAAb/QJBw SCwaj8ikcslsOp/QqHRKrVqv2Kx2y+16v+CweKy1mM9oNHnNbrvf8Lh8Tq/H0QOHfn/o8xdmdoKD hIWGh4iJikp4fnsTkASSf4AWi5eYmZqbnJ1sjY58kpAFpZF7gJ6qq6ytrq9zZ3mikbW1pqccA5aw vb6/wMGtaXnFj6O3AqQAAAXKeru8iA/U1MLX2Nnah8SztATK4eLiAAkAEw4Du4rV1tvv8PHyW92h oaSl+frKBQkJAtA2JGr3YJ7BgwgTCql3DxmkcfucQSpXIOC0dgozatzYS5Y6Yw0f8tNHMp+AfgCg XazGsaXLl4vMFIt2D2K4kjhLmZOUqhBB/5hAgwp9IzPdRz72HEKM2CwfM4uEfg6dSrUqFpkWjh77 phQis1JN9UEVJNWq2bNojYBKqsdW1wm4TjKbG7ZiuqgY0+rdO3RDJW+AtUJA5iwuXJJyzVHMp5Js Xr6QI2f0uzWpSLeHTWZmysxfYQLr7JSVTLr0tgUa2iKYFNIh68EnNd/8SrecuWeh6Yw2zbu3ItQc NCBAwAEJ5dXgACL1pnrc0n0iwXaejlv0Y9/Ys9Pxi+ACg+8fwjNAoEHgkA0OhicP9/oYPuixZ8uW bnvuM2lydmvfzx/McfDhBSjgBxeYl1oCzpTTDGgfefQISnPJ9px8BdSmTHG6XdffEwF06P9hBp0Q JOKGv6HWHQMBSqCiBAN+oCID5QmHoAANeHBOOmk46MdJ/vhT10nPyNVMbM1YeNcc+nXh4ZJLLOlh k04GAEuUUmoi4pUskUjIBicOuOKXKbIo3nBOFYkgeeow9EhiPeK0zI8VegYafm8kyQWVVSJBJZRO ThllJlgGmqWWdHCAAIrhfanoooqON+RmPS6Y5gKCKRWnYogJGWFh/qxmXhx2bpHBnkmQqqepraA6 kKCsEioHet4hmiijtK5I4KOERYqbOlw5d+lXmlVooQDMoIOkhl+oSgSeeRqh7CrP+sRqq666ASuA AtaqLYtNIXcUAhVIxBqvb33GT30RCav/LmN0thHqFtGCwGypf/rZJzuBFpFvtZ901+Ks29b6QQPO oJJVHqc4kLDCN5HUFDpw1aaPxPflh6wX8c576r2vxGvdlUmAzO8Y1/6rIsABgxneP0b1IYvCOxa8 Y2w5iSssXWWa5EC7bLyrBZ4b1+usx5wQfazISvg88hUlezmriyenDOaNH0VDKbmwyezQxGF9NZLE Nxe8gMWDihEts80OYfQma4OK9BIXL51F0/+i7KWYKE8NQR8NOrgekLacS1/OQILVo4+mDEC2O2M8 i3baQniMdhVAcwi00RqH8TYTZZOB5RGfU0V33S6W3mIDDfhTI60pVT3py3+Le1mF9AG7/2mZhy/I s+dxKyn0spMPzXERjz8Z9JOjBq9E8RkzTy/Hvw8ROhWbE7E5yNQKkT1Qo5MeYOq5YwoAora+yLfr 9UQnO4VzIX5zbbb5SMDuYyidReXAZ66248wbT3z/0fsfAP0nwP4dYU/4s96IrFA96S3QgdMaUQQL EhTUXKBFspLVyhQDtjitrlHns1qOKNWWzVwGArRrX6QMp5gWog5BioOD/e4XwOIVkICRGyAO5aVD Jh2whx364QCF6DwjNBAKRwTB9SbIxAe6hEve8Z4GU1eXdI0vbx8I4QgbQRjDLON9kapN6uLkAQ+k jjj0A8MMsaCq5D0pesoCIuTkGEThAf/RjkO84eOMmEQnJHGJTQwkBV/CgVhh8F9jdA7gEuMBRu1N i1sk1y0eJZGcxW9TYUmAmMyBxjR2YY1XUNWf4EhKVOmPh5lLYA4TeEr9tRKAfAQlEv7oRCUKSnvT wmUfDwLFASEKWy+swDNgE53ZfPBLCEBfJIsSOy9akoMppF0DVkTFZFbCk1mQJeVM2adS+nCVNWSl KlE5PHJ+U49pG6cq86hAbcayd4Cs5S3b6c5sFBJb4hHQd27zSEck41w1gtqKANC3La6FmJfxCvzo A45GiimRlDjDF+o5BW4yyVSiPJtFywnOc45zf8P7qDnrCFKRQrB3T6DlbqZHz4vtch7/1/qlBlcm zMGEcDBbu0kCjqmiBijToC9DzlvWk0LqVEgAFqgAmIJJJvUERKJaoKgUMHovqpZTcr9r3pJAVNId 5s+jAewqAfHEVbjVcgoq1dAR13pWhaAHQCiaYgUY5Dp/dhGgZVRUPwsayQn4AwIHy1qQwtE1nDnj mGYc4/vEBQ0RYjNpKPUd9Cb7zY2eE4/+0ypYOfrVsXK2syQdaWghK1VdwlOebbWlnV4qDy7JdEAN OEddeWXXUVSyHzyVAEEhGclDJYBBGMDAmoYpH7qYY6d5PdkLi9RBpzb2mlIoLRSsmlnKbvayRKzu Z0Ur1tGicwhu9Cpom9U21Ua2CWnt/xxbV5tahGwgit8BJtVmaxn1kTG5LPppI7JCoxtVYHzfia1y JkFUMZojoFDzADR/ZdhFCve5gUDvee9UL6FV2JviHW93n1fZsGq4o3L8sISlm17GmbZzJ0XxiU2s EQ7EdYoMaN1a6opT29Isfg6VgDVfh5WPYKBwCLrABSXwnbna9VzGBR9+bXSzw/nIsOECnHN1EeGQ TRheo7Rwlq/qYRFrVrvY/S6I77hhP7Y3pe2Np4rNu2bWwsO1+TQjALzFEBrX+D3wc6hPD7Dfg0mS WOEyg3fC9WB/FrccSs4xk+MHvjAOLlz5CC4GKEBpSlf5nYNcAwK5fFEMexezefoySf+JRl06iphz ZzZzqNTM4hS3esWZnsyQwwNRx3rEznfejBgd+hW64rpwGFiIcMZ1ZE0BAHyoo+avavRCTDms15QO bri+gqZPtdQNm77slrXd5TJz93ij7va3RdvDU5uVxGlGLXvXfeV3LGDILBKwretcqS7C79g9RaF9 +FzX2BxAmFgjNmboc7jVydk2uGW2s3M2aQz818ndSo1f9NXun9lwvFEq65iZUOpPb/zjHAazHDVe XpaiNd0rTe16K66N9yaYZVgBKq4tNZ3j7lRFyTwAuJixmqoxbAJZQYpNmfkQmwmr4I1UcH0mcGzk xrYwNGv4tO8NafX05MRvKGJ3w7n/XW+LOtTi7jjkpituipe2xLFeeZtT3Vp4f8DIQJ1xbbvoZNWp 6L9m9NcHdqxzgNDEEVabRWYo2ZkeoY7WHDwJsp9+WwxYAANVpDqhd3ZtbO8RnVwPs5jHDWpvgxvs Xed42Vv6aiSiXK0qT710fcGlBO847gft59YQ3Wh/ONRFCACBBoT8epxS2aAIi9i6WKg6hQMLLi9c 7jgo8N+GgdGwncS65ZWHceyaFORf93x2wx16Pml+lm4G/6rVHTe1l56XCHA9X2FfbwL8F8Cla7bq bl+BSqQm8OjgWyRjFrYkF7+MwCIRO+V0lJRU51A4tfNk1IZG0jd9H3VxGLc8Yhdy/9zXdWI3dk5Q Xmy2ZuLnarFGemmneuXHdvEAZ0QGdDzGfj43GBWAYLQmf4ZXOuEiVJNyAOOSBiBAdERCGyoUg7EV FuDQdMbnDBSAAQ0QHzfWgytUbWwGB5eHeeKFVSHVZZblcSDHeVGggRt4fmY3SGjXhWvHbhxoECY4 HgcDeyPEK4eiaADIQjh2d4CXFcykf2mIUzvYFPGDdFUUhIlGRQJAAQSDhElYeLlTAeQhEKuXhdS3 dVGoUVlFhY/oYeI0esljbqj2UmVhcrAWgmJYeuH3DhqAIiyCgmhYh4eiMmU0IwgXPyrSOkYhh0G3 V3VoWzxILHlYfA+DCwN4eGb0W/8Y4AGLNIiEWIgSl4hkJ1JPCIWgFlrZt3Xbh0PXN4Xdh2mnlYnV sy8eKH4jaIywUEilszOlmIZGeDK0JiBjVBu2xyJ7gwdzuFc0hmdcU3eKNRKSkACJFVCog0Iz8hzG VXfNgCbcaDlfl2GutE6QyGla9koGGYnfR1qsVjbTsz1bqI1hyHItt4ZZFI5pCADmmGBG1Y+aJAF/ yI7taIMyY2g1c4uo8zDE8gz2mFhlZEaAiCv8eIs9cgGG6AABmYEmdUrLCIHaZ2505F1DaYkjJkgQ iZQsZn4fCGuEdEF7B4saaQEOwJG8mFxzNnwE10h75hFF4XcHIAD/IEld9GxOlkj/NxEOLxmTqQiI EuErYFR3CSBkhriTTeCTjOh97BSUQVmUPwmUWuiBTQSCTASGniiCY4gQoRhjKViKBGAbMXkBDsAA FwAuwqI+heciBfB3ihNYj9SS/mQOCIMTA2h4/6Aci7SWbPlbR6hIwiiXdIkAdil6A4mB1YeXzQiF QHmb1BeYhJlLhlmYIEiRhzmbw3AoMDKVgVUhzOYBMfJjl0lMBKdJDbCOxQA7Ybkgj6BJjjeatONB hkcwBEZcLphXwnSa7GFfSng4dGmcemmFY2abRRBeZEWBGjefkrhHGSeBBrR51DOYxClB5FeRBMqF CXFPBaKRPkYsZYQ66sF0kmKD/w+hIJCpWzvCZzJxGBFqgxy5W96Jh/KXOvlnks9QAGzJlsJ0gJjx NcPYaDF2Ae5ZCIvYBlRyn4qIl/UzT5cYo5IBRdUZjiBBLDWCICxYU3uVNbfIInahDBm6bzvSoTXh FMmHOuLJb8lRj0l3osIkO+VydOHZaADAo3Izpuj3HWkoHA/6SMu5UwsyTIAneMTypdzSAYmDQuzB X8WyMJKgD6VJpUeYJrABG/bIIlFjI3Tqprl2hwVXe2JKpo4aD96IALCYHlFEUxWBf4sxopAkobZY fB+kdLtSFKVgg0V4IwTWZDvlp7/1d6ABDrklAQLGpYlqbF+6T436qLiqDbuXkf9UCZVU+mRwdzAQ CpY/FXyJ4acC5QF2oRT8lhXNN3u0h6wyRpWkikLTtCixWguzqqipyqgWmavg6hKL6azhcZ6G2IK3 IULZOV/ooxWdao+HpyirCgEdMGnX+Xi4khydkaUoiqHUyismyigKJkzaKntFh6qq+h23Gq4My3rp N1coshr/MI5792Pg2KS4EkIrGDHzF69gAhD2ihX6tqz4wJGECiaXagZzQpUBqyi0pqLtYYfcmrAM sLANe7Ou8G4M0ILJtCACshod4K9BRzO7clPREa2vSmSkGnxHtTeEgW8nejKbmaEyMQAFcK0uq2DD FLMF1qKNZpwk6BiZlphV8In/uISzBzpofUBQDGAoO/tjwkUMGhppKGmLAuh0OeayglWvLdMWzMmv bEkwGJoHsnC1AgurW2uwXctov1qz36pqZIsXCqQ5ZmugaGtPlTmae6Ya1vkytogzrrGD7gevSXsy cehnSIpcJ9pIf6U4CnMGrpq3H6uns+ql3RpfMWq5hpAlkfuf7WR6l3ugksqyOSehK9sIdqsMclIL lkkAO0G6WEsrO/OOPKJYjKusgkuVSMVfYolfisJYinuwXou7j4tmZ5sX6FsQj2ENjIN6JoZS7tC+ 6xuCtlS/oEO/C8S+6os96jUo+hu8nuAXZ6iGOFKH/bCktyGIKUEAwGiiDRom/47kZ+QiERQ6EuoS W/w2tWH5t6xDu7XLuM2WuxQ0QVs4wul7whhRYk5pvw7UhPdLcRP5EyS8Yg0IwJsgwJ4ptDmCMNqJ Eg4jLrcBk1HLKBXgc4lrQn9TLLtAhCbZD7K7Ir7ItTQHwv4gwroEQS3sv/rrhWO7v9bDwkrkkFd8 xUu5v03ZwlgMw0mZxqoFxltsw6tgCRI8b3jgfpyycArifv9GMM25urSidHJiaO9hEr2Gr34gLElb nR48xZ5qq+VrZmeLxueLv10soHyEZlysxpR8btaYwvQbyVnMv3A8DFXLfvSqE+AzdfZ4JukRW+U5 xGCyVFQ0nd36f/9gAdr5mP+I9sTAqKnhm4S3ywAJYMVu3MVgXL/vy79aHLnyq8nO7JDJLMOffMxb LM2jzArsJ7e45RmGM7CZgberm1emE7hgGoC1Q4hU+od5+q4x+SWI+su407hh+sgSBsrFTM1eLMmG ScOQpc/IvMn9HEuhDMP2/M8vfM3YvMOTkoNDe0ndnKfvhyj4GM7keI8rBB9E+2wUAQFew0K8eHcE Vl8zCz7z3Ltla8KTO9CTm8yodskBjc8wbaCvxtJl7M//69IIHccKrc3TsaVs2gG+aBsTTc7hLH8/ Uq8JldQTUxj39n8SEMWy57SYOYzmQMwsrdKRHM1fbMzG/NLL3MZkfMb+bM//Ny3JNQ2Rx5zTnLDT oHAY4EKvFMF0vyWWu2xGRC3EDXrRsppr5WLB51x4zLbI0knLwlzSuvufTkTTIlPG0tzYkRXN82vJ L02Y+JxyTnnYap0I9VDK6hBcfoArO1EBPlLUfoqsRv2Wgs3XCfV8eEh7EHOkMruDjWzYYo0FLKXY 1ohpJ0VP9Vx5u13W4KeNBr3PKe3CmJ3Z3NBnNAawcxVcdA0uA/vA5FzaCocp7GFTbFFfjLxcUjpg Ub01tvurNtvbyF3ea3Br9NXZ9Rpto3uu8RW49/irX2rdC/OmNyXSHcAm8t0mUgzegC3e9DxRtW3e BF4GV/NcIOHZleZw/8U1/6S936maeHzrjul934m6nsi1wN/t30IN4CbtLgNe4CJeBVXbWPYQQpBX GOcq2sdm1/ENg7mTrxpb4bQVEnTK2gNYYzYu27U8zAHuBcc94kLeBCXe2d7SrBu8pYYILgjQ4tMN 4eiCCzdI4+0X23eoQv1tbx3+QuM95F7eBugdtzXIqYI4HE7+4rW3UOC7qVS+4TWpOr5cbDzu4UH+ 5XaeCXXcMjXu3Dn5c03OAMxG3THeYAnTmG3+y4OYqnH+wSrpuB9+55B+CTg8E3N8pTMzbYCO5oPO XLJq6BXutDpuKWAEjNiN6MQX4V0e6areBZXOHMsRM38u6IO+1Ii6foJxPv93ptoNk5nL6uYly7iO XuerPuxbkhrDtgfHDhiqIdqyroBVJOUUXrVasYK5HrriqzoaXuqi3oOpk+rE/u1M4+rG3reCx+zN fjsSUuiBV+MW7uvbzgypwxbvzmjBHuLgfu+GEIvILgp70OQwju7pXt9j7uq33hpdimjzCupdgTvF 5+34/vBSQJXjbmjgEkY9HfDpqe6fjuvyjhmxU3gbvvDh7eOPDvEmfwcDQIMK834sP4iu6fHRzu4z zvGq/cE7leXii871fvI8HxOTYJl9vtrQbu0hHfPa3u7anX9lCe+LPu956PA9H/VJ8K++JnhDVe3I ENW4NvM0b/Cxjcjeva3/DN8jUC/1Zl8EM8H1MovzsG20FH7oc6flguvrr0n2P372eH8Vek7txqvt UmzfgE/lM/dI4H3ASU8zCEvywp73jE8Pey8Y73zib8/xxSr4ki/qRBryzgeSZd/4Z78Bn17rkq/2 QzfH7Qr3tSuaBo/4qKr49u75sM/qPpf2oj/6an/6uL/xCp/zq69rPdj5sR/1/1rlFF7qt7/ulj/t Xa/lh4/4v3/3wR/9jDALg6+xk6/8yJ/8fC/nwtL8iV7F0C/94k8EqEv61s/1uY/e2n/5ItEM3l8m 8QP844/vy430XZ/+lY//uh/b7g8EByGESDBOkAJloQBwJhIPqRRUtV6x/1ntltv1fsFh8ZhcNp/R afWa3Xa/4WHLgF4f2u9CvL4+9/cB9wIF+fKKkgAKDI+SlpianqKmHuIqLS8xMzU3OTs9P9UIC0dJ B/9MT0VVFxEVhw4ZHR8jJylBb3FzdXd5e30vV0uF8VJRiweDYQWYXpUbl2ehJKd+q62vsbO1t72O k4ORw8W/m5GYm51lI6epuN3f4ePl57/Ahwm984nH0dHNXcvFUkdrEj2DBxEmVKgJH799xvQ1dOjv 3550A6HUWriRY0ePHudIFOkwIkmL/Q6do/gMGqSMBT/GlDmTpq+RN8eVzEkuJcCVz5gQpFaTaFGj R9c8VLoUYtOQO5MdWv/GSiBGdraQZtW6NevTAV6ZQgXrh2xZnSdRmiMyqmpLoe24xpU7VyFYe06/ njU7EeVaZX5/NnJ5lW5hw4e12cWJ99hex47R9iUgAHDggRoRZ9a8MUBnz59BhxY9mnRp06dRp1a9 mnXr0bVcx5Y9m3Zt27dx59a9m3dv37+BBxcuG/Zw48eRJ1e+nHlz58+h7y4enXp169exZw+w+SNm 7t/Bhxffxvt48+fRpy+fnn1793TXv5c/n37M+PXx59f/7v5+//8BxKW/AAks0EA3BjxQwQUZ7CLB BiGM8MAHJazQwvwovFDDDdWD6Qu4QADRPqwOEtEKErEw0ZIMO1KxDBT/OcyFRRBd5KhGhW7kJEea dvwQxhhvmZFEuGrBikYjMzzyRO+U9IIKD0Msr8glo+xRxHamXPLKLKuAMsoqh6Smxy+z4PLJoXz0 cosziaQESi7BJLNJMNtkEchKhMySRir5nJOLJgENM80+BSWzS1vQ3BHLQw0Nscwfa9wSSUYP/THF IhEt1FBFhwQj0UkpDVRLSkPVtNE7g1RzTVMr5bNUOFe9AstC/YyVUD0xJfVULRY9FU1XZbXUV1pZ /RPGOYX11EpNLRWV0GB1fRRVXYSEtlVHn402jFmB5RZYW0sF91JrHUT01S6lTZdXFJ2tcttjmTVj qGS7NVJcb8PNVtxp/z+pVl9stTR1zDeJHdXJNnXFV85i13VTYXjXjXZLcgsaGGJX6Y34RGVBBXhc fedFMlNyF+bXE39JzZXkSn/18VGCz3QZ5l/NZFjdOmHClN1PcV35W2Mb5vlFWCP2sOWAj4yZ5U3j U9XkS+z8ZcwJO11o6qe1irqXq6l2eh6usT5K613ADhubss2uaey02W6bP6/djlvut4+e2+67z4Yb 7735BmXtvgEPfI2/BS/c8HfrPlzxxYdOnPHHIV/V8cgpj5zwyjG/W+uMyUC7RHXtg+Nyay6WN/Oo PTfMxNS3Yf1jj1bnXOPK85zZ4oltnzT3YHdHmnOVv+w9TZ4dFvlTa//ZNH5y3lvmGs6a2fSdSr1Z Pl544B9HvfRdgeb9X4TzDR/gdrmf3eCSfwYd1JHJn7Xj8u/NlGj1R86WfWLfL/fl71+nXHv6xTCx f6VIck1L2s7mZ76EyU9762NU++q3wDH4yXnNU1mvkpczm4FOgpfa2emo57Na6Y9kCiOgAr3nsfOh LXbIk50H0RWqBxbsexs03wgRlz45zTB+7wLgtT6Iuf+hT1vdq1cHVXjERr3vYbLzFgRdtjEZBo+G 7lpiFY14xQli8Yk8rKEPiRjGILoubZujWZIuyCwmueh50DtjCAOmRDo5sWfYct8bHYbEpXHMgp2T 0hpjeEfwFbGAcsT/XpwsB8fMLZJvo2PkI8PmSEhOclqSpOQlOWRJTG6yQprk5CcZ5ElQjrJAoiTl Kf1jSlSusj6qZOUr3eNKWM7yPLKk5S3BY0tc7jIzuuTlL+GjyBa9sHHL02PWjAm7NJARb768BjN/ SEJCIgWa7khdNeeGMqYZzYYzRJjw4tRE6Y0ThdGsGcXQiE5u+ixoLVyZIJmovN+NEZDc/OPM4Oc/ OEJRiwfrGPjaFTIXDvRnydRZwpSIw/6Js5/STKIA7yerhHZzh1SU6LUaOtHzPVKbDFVoCe11wwiK caTM89LURni8W1GInx9tGAcxiEBDJnOKkpLjrg6aUUbaCV/8dCiR/3rYT/Kxk6giNVgVy9ZTLs7T XP2rqPtiKL6Ndq9+87qpO6PJUWESjKBWLNc/g1qnlHmUoj8dKQIFRkcKRtCYe3KquwQqxTje1FjF Q6gen4hUbMrNjC/DYz69KbICHnCbeaxemNSEUjWuJ3ZbhRc+l4WZnDLNd0E0KR0xVkeJ4ZGwe43b EDHhWfOIllrEBGZpaQpY8pgWQ6y1pmtPmyqakvatVBtRbDmxAd3qVl7CxO1vQbLbBQxXuLxFHG2B m9xqFHcDVmDucPkIW+VO1x3FBQFvn2vdryKXut31hHaxy9wqCHe70vXueXuxWyyoN7zGVW9duYte +cJBu85tbn3tC/9f886Xv7kFL3nDm4X3+nW//TWwJcQ73udet7kCNq4H43tgCcvhvwpuMIO3MGCk TZjDuliwhd374PVquHqdW63UOKgGzxY4b6nlhdPY6FsCs5g+H14wie1LYtCqmMaD256P4xDhk/XY b6ZlpksPlF0QN5i8Dm7yhqN7wGUh8rAzDSHwkndZZVF5jlo+bIHbuE4dQliAYByrmMPlWL+WM4EH uxB7L/ze9mYYv3TaYlYlx78OIrmgAKWoSn2qWjOTdIBhPaRRharGMad4s5oV9FQh9GEGyxnHk9Yt Bwh854VmLKWDXFib3xooUO8Zy3WD5kmxt8+0alp8DE1iAJsFqcf/8pTI77mxBXCN6yVrobgcuHCJ YY1nRFtRr2fAahgHbcKXFhUNKi3klukaRU+7WroxRqHnhPyd7OZa15b+9YgZ7Gsya9rVWXwYhEEK RrIyG6Pr1mizl1roYT+aeeneplyHti9t8flO2eXAvx3g625X2tL//rYZpTxPdaJ6xluctjy3DE6i ybjh5OQ3rJI6687Kz4+4amM7iZntzQj3AB2IQAZEE4EIdAAC3eb1pQ0+7g6LrtannQMGKpABlJNG 5xGogAMs8HKYi9ukM3+DyFdpAQwAYOepUUAGOjCAEQtXA5iW+X4uACGko3IAGDi5a1Te8hxfuuqZ 9k/Wjf7mDmRA/wFgV/nKpX5fshO96GlvkM7wnne9753vfff73wGPqQs0vTVvV7kihAtwvts9lIF3 /OMhH3nJ4z0CbXe74X2eF7IvnvFdm/znQR960V/A8pc3fAYqkGsOaOACnO98KUUfe9nPvu+lb00G MP921ON69a3f++sNRHvhD1/4F5hN7lWucwAMQPGuBz6AJgvlq3uZzXqvN7CvT2V77h3ltl8N8k+u 8wqsXgN9fz6BDr3HNT+7nHNkLM7yrP7t5934pImAacDf8wwkAAOsN//5oS9BHGdyBlBY8g6GMEqk 0mrv8A//kK/nFKABLsD/nA8A9eP9XidpNop40Mz9jsbThuVbcP+G/krj/hwQ83RO556OAcrv/yxw P+5psVbojCpLsL7sA+MJWSyr7zrD+zpD5UwD93JP/xQgAluwAvUrrmiu4qos2oINQVxLkcoMyHjM xUin5vLNzpqQsmbQ2W4GsdLvnwBps2qwFggvNEywBB8wBRXAACTQ7/yotpapj77IjqYJ2k7M2F5o CnmsD++wdbAwDrWwy6aJA8csUvBOrsSwA5uKzARPDU9jDdnQDf9OEKeHs0JuB5VqffYryyyueHQH ExnNVqqqnv5qBEMRBCcqeuZwnSAL4gKL+ghxaQTpE9lvDNvP+qJq4cTqhC4LUxIAEtVwCNmwDRmg Elmt3c5qD8f/CH0Mi904pg65ENCqBhr7xIvOJXyUkAuR7d1KKhmhShupjRO7iohChgPzB/twMfrK 0AvPTGh8sR2loP6Ojxgn0QB8zwUHLdFG7Z3cJM3IkApfhUmCKoWssaaekdD4kSBzkYa+EdYczd1S Br4ckaz+CmOyj6tuEN90EafA0CDx7QYn4Qw/w/BO8PRSMAMMYCUBzxJJDd4Q8NPeTQ/LMR7tjdhG Mc+2USK7MSR1yFkech9nUiFfLSatbaUsa6wM8o1qsF4miw5F0KZ+cRJIz/7ScBhRMgVX8hiR8QmH UrE2DYkwCCalMdbI0Sevxs/KcRPF0ojY8qnS0axeEojiBdEC/wqevioq8xJcJAV6YrKdQJL7RgMI U0MIdS8l2xAfWzIZG6ofPZCcZpHfzA0WvQpacoeBrmwRvRD+UBHSpC+cqkopHW4zjaewepEJZxE0 v+wWr4Qi+bIvty/7HDEw864CrJI1slLnVtIAAu8FobAw2HEQ3wTk3BIT4e8zV3MD884HY6PtDBMx 27ABetM3BXIuiO86sfPvEoA5S9IkQ6MIPePpUpLtEjMf4ZA6/TCYsnM92dMMB/MBT6MIx7MIDcAD HA89W6s99TM7GcAqDfPtSqMIBRQxt/I+8bOV9jNBh68qufMHUTA8ezAA2k5A5VMFWdJAD3Q+FHRD Z48BGtQz/v8TQiVUQim0RMmzPh8vQxGUQ1lU8gYPPE8jBUU0PEsUPNmuQDFUReWjRXn08dIQRp2O REm0Ris0MSFPR41OSJ/uQ0UDSCe0REl0JRGAuAhuEJFUwjZgQCM0QEd0Qke0B2u0Pz/AAFiwzqbv Sg1sAYi0S5s0QqH0SekTPI1R4KrUStG0vzRAQL9UTkHjSbtUPonUAIrwAwLgAxRgSqnUn7buTicp T9+0S9nOTSNVTok0TumzTBO1vBj1wBxVT/3US8G0Umt0N1dyTC+ATkUMMPEwE7AJxnIyLnSJuyiu GhY1Kzq1Ur+0BydVVNuwVwVVUBH1yQZLKFcEC1Xk2IAzEMn/Rll1hFkPQ01FdecsD04DVUB/lVQx tU6xz80Y0bw8cQtTs9FcURRtEZx6S/tAURa5J8zIVf3KtV37bFYvMeFksWIosz6ylFe3dEhFVVAT k1QVgAGoNFVVdVBazVvVUs/YqbHq0K1EUzLjjxstUrLiTaemMBzFCKbKqq4aVq+WUT9UUl+7r1pX 0ldJdTc/IFi11U4n85hcEp4YtraOTdn2xyc3kiwnct4aa412dl8CLQH3zQoNzeModuH+QwNKljx5 lWT/9V93cwIHNrqS7SxxtieBiNFmNihx0mbpbVWBSmd/bNn+MiAP9qhyUmjDsnyOMmidVSuy9Fc7 w1+t1VJ//zVOd9NpUbbqonZ41MopwaxiHTZ98motz+qihM3hMBJsf+hnL/Zjl0hjb9JrHfcuHTc/ LqBk5VZue5VufRVvTzZbV5ZlYyWxWEwHL/Nm56oxY/AcB6sT0xVoIXNdVxcMUbEzxZJo5y8po+gd 6TWObFc/1BRg/bVu7xZzT/Z4S1VvzbRg01NDatUonldDEMB4i5d4r/V6kbc+VTZ0RTcLM6lt5SJ6 NWQDGEB4qTd70bc+oXZ5h7V5N0R8eQR8sWYDxhR5PTd9sVV5hVVR5XdTR2kByhd/BVgC1Fd/uXdb /TdNOSCABRh5CbiADXi8IBJ+E5iROGB6H7iBDeCBJYABEP9Ab1G1mPq3gkFpAzSAASQghfH3gT/A gzXghVGVYPmWhLF00lhvTAk4hzd4hyWghRHggw1YhqWWhrGU6k74Aj4giZOYAS7AhWHY12IY3tCW iHGr18jvhbEY4P4tir+t4yiYiiuH257L4Aa2jK+rCr8YjCOnvbbtxlZritU4tto4wY5OXsWGtQzQ WXFnhN2MV7TBjkPLmRBDjJusi+sYjnOJj51KaQCRG9LYCQ2nWsx1dK0HXtn1my5yXuXpI2czFqWN h7p1dweSsH7xuDD54bzyXTdOlfM4kWYrYf/QqwaJJ8dRL5dygxpXGT+ZiqhWtWLqcWU2Ew2XGg8y BG8FZGr/mW316ZUJV5S/dsaO8xD7+Kpa2d747Jd/VmNKCgfbz2ATrZhz+ZuRMlGm2ZUtppnL+Znl 8Jb/pJwzChHT9uJYUQdjGS6vNpg7LqrouWvDmXIL0Z2zR9XQeS83xdAGml6kUpxtuWwFt5dJORp3 Emu1tluouYLiebEMC1lAqaPuFWjsqXXrlWdBjltIt3Ypc61mp9z4WTPP8f1uR4P8cYJzF5J/lwAV +UIE+VUbWSYemVVvmqJ5KafX2ZF/2qezQnwdk5SEupiv8Laoqaipa6njOO2keqpnrqqtmsOwOqsl bKu52sC8+qv5K6zFWr7IuqzP66zRurvU+pVE4wre2go+/wOuQSMMtiML7hoE5lquQ4Ou67oKOmML AlsLBluIANnACluv8zqx6RqwF/uxwYCxB3uyIZuvLVuw8xoLGPuyaeew+yuxC3uzFbuxR5uzucAz +Ho7QPuuV9u08TqzSfu1DRuRDyy0M7uvHZu0W9sLAlu1R3u3bduvUVu2CRu2XZtx2pqVcPu4FRu3 d7sLJju3gfuvmVuzjTu3i3uZe/qUgpu5pzu2T5u1pfu2WbuysTu8MTu9tRuqb+m5Rfu7zxu6YZuy z9u9r7u6Rbu01/tA7fuvp3uvv0CyH/u59Tuu4xu8ERxyknutefu+8zu/kduzGfz5FnzCcavCLfy0 MByUtAmjw5c7w6k4CAAAOw== ------=_NextPart_000_0003_01C87BDA.033AF9C3-- From 9wu2bo4hbryreit9xx@dell.com Thu Mar 6 00:34:55 2008 Return-Path: <9wu2bo4hbryreit9xx@dell.com> X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E4FC3A6D66; Thu, 6 Mar 2008 00:34:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -79.53 X-Spam-Level: X-Spam-Status: No, score=-79.53 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DATE_IN_FUTURE_12_24=2.189, FH_RELAY_NODNS=1.451, GB_CHAT_1=5, HELO_EQ_IP_ADDR=1.119, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, RELAY_IS_220=2.118, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FUV1dNkm8hLw; Thu, 6 Mar 2008 00:34:51 -0800 (PST) Received: from [220.248.229.205] (unknown [220.248.229.205]) by core3.amsl.com (Postfix) with ESMTP id 133BF28C263; Thu, 6 Mar 2008 00:34:48 -0800 (PST) Received: from [220.248.229.205] by smtp.ins.dell.com; Thu, 7 Mar 2008 16:34:38 +0800 From: "Kathleen Perry" <9wu2bo4hbryreit9xx@dell.com> To: Subject: I saw your pic Date: Thu, 7 Mar 2008 16:34:38 +0800 Message-ID: <01c88071$22966300$cde5f8dc@9wu2bo4hbryreit9xx> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 Importance: Normal Hello! I am tired this afternoon. I am nice girl that would like to chat with you. Email me at Madeleine@GreatGolovaSite.com only, because I am using my friend's email to write this. I want to show you some pictures. From kcaj7@att.com Thu Mar 6 16:52:11 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8124428C91E for ; Thu, 6 Mar 2008 16:52:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.192 X-Spam-Level: X-Spam-Status: No, score=-8.192 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DATE_IN_PAST_96_XX=1.69, DOS_OE_TO_MX=2.75, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, GB_ROLEX=5, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=1, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_SC_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rmkl7zK0NuCm for ; Thu, 6 Mar 2008 16:52:10 -0800 (PST) Received: from c-76-124-11-226.hsd1.nj.comcast.net (c-76-124-11-226.hsd1.nj.comcast.net [76.124.11.226]) by core3.amsl.com (Postfix) with ESMTP id 82D413A6B94 for ; Thu, 6 Mar 2008 16:52:10 -0800 (PST) Message-ID: <000601c7611b$01ccef33$72bf99bb@thboc> From: "bernard alok" To: Subject: Perfectly crafted luxury timepieces Date: Wed, 07 Mar 2007 23:04:14 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C7611B.01CC027D" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C7611B.01CC027D Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Prestige replicas Most popular watches Rolex Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob & Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design =20 Most popular TIFFANY & CO. JEWERLY Tiffany & CO Bracelets=95Tiffany & CO = Necklace=95Tiffany & CO Earings Most popular PENS Mont Blanc Ballpoint=95Louis Vuitton Rollerball=95St Dupont = Fountain=95Mont Blanc Rollerball=95Gucci Roller=95St Dupont = Ballpoint=95Louis Vuitton Ballpoint=95St Dupont Roller Click here =20 ------=_NextPart_000_0003_01C7611B.01CC027D Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Prestige
replicas

Most=20 popular watches

Rolex=20 Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob &=20 Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design=20

Most popular=20 TIFFANY & CO. JEWERLY

Tiffany & CO=20 Bracelets=95Tiffany & CO Necklace=95Tiffany & CO = Earings

Most popular=20 PENS

Mont Blanc=20 Ballpoint=95Louis Vuitton Rollerball=95St Dupont Fountain=95Mont = Blanc=20 Rollerball=95Gucci Roller=95St Dupont Ballpoint=95Louis Vuitton = Ballpoint=95St=20 Dupont Roller

Click here=20
------=_NextPart_000_0003_01C7611B.01CC027D-- From kccouple@att.com Mon Mar 10 09:46:03 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7FB923A695A for ; Mon, 10 Mar 2008 09:46:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -36.595 X-Spam-Level: X-Spam-Status: No, score=-36.595 tagged_above=-999 required=5 tests=[BAYES_95=3, HELO_EQ_DE=0.35, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, SARE_ADLTSUB2=1.23, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SC_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AvLhegGJ0WWZ for ; Mon, 10 Mar 2008 09:46:02 -0700 (PDT) Received: from sign-4db69e95.pool.einsundeins.de (sign-4db69e95.pool.einsundeins.de [77.182.158.149]) by core3.amsl.com (Postfix) with ESMTP id 4BAA13A6CAD for ; Mon, 10 Mar 2008 09:26:58 -0700 (PDT) Date: Mon, 10 Mar 2008 14:36:55 +0000 From: "ben ssu" X-Mailer: The Bat! (v3.99.27) UNREG X-Priority: 3 (Normal) Message-ID: <03496361.20080310162418@lists.ietf.org> To: "Melissa Smiley" Subject: Enlarge At Home Today MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Gain An Amazing 1 to 3 full Inches! VPXL Has Worked For THOUSANDS of Clients. http://burtieoae.com/ From kruse_hans@att.com Mon Mar 10 09:46:07 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD44C3A6CE3 for ; Mon, 10 Mar 2008 09:46:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -53.008 X-Spam-Level: X-Spam-Status: No, score=-53.008 tagged_above=-999 required=5 tests=[BAYES_99=3.5, BODY_ENHANCEMENT2=0.001, HELO_EQ_DE=0.35, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, SARE_ADLTSUB2=1.23, SARE_ADULT2=1.42, SARE_SUB_PENIS=1.666, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_RHS_DOB=1.083, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P7dRMemu4jMR for ; Mon, 10 Mar 2008 09:46:04 -0700 (PDT) Received: from sign-4db69e95.pool.einsundeins.de (sign-4db69e95.pool.einsundeins.de [77.182.158.149]) by core3.amsl.com (Postfix) with ESMTP id 0709D3A6E2F for ; Mon, 10 Mar 2008 09:27:12 -0700 (PDT) Date: Mon, 10 Mar 2008 14:37:09 +0000 From: "ezri therese" X-Mailer: The Bat! (v3.99.27) UNREG X-Priority: 3 (Normal) Message-ID: <02785826.20080310162432@megatron.ietf.org> To: "Joanne Bravo" Subject: Penis Enlargement Liquid MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Gain An Amazing 1 to 3 full Inches! VPXL Has Worked For THOUSANDS of Clients. http://jurieaot.com/ From kyqelapsefex@elapse.org Mon Mar 10 16:19:16 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9BCD93A69CE; Mon, 10 Mar 2008 16:19:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.861 X-Spam-Level: **** X-Spam-Status: No, score=4.861 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DATE_IN_FUTURE_12_24=2.189, FH_RELAY_NODNS=1.451, HELO_EQ_IP_ADDR=1.119, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KyhgGc58R+lJ; Mon, 10 Mar 2008 16:19:16 -0700 (PDT) Received: from [41.252.234.79] (unknown [41.252.234.79]) by core3.amsl.com (Postfix) with ESMTP id 5510D3A6D1E; Mon, 10 Mar 2008 16:19:14 -0700 (PDT) Received: from [41.252.234.79] by mx.elapse.org; Tue, 12 Mar 2008 01:16:54 +0200 Date: Tue, 12 Mar 2008 01:16:54 +0200 From: "Kelsey Fowler" X-Mailer: The Bat! (v2.00.3) Educational Reply-To: kyqelapsefex@elapse.org X-Priority: 3 (Normal) Message-ID: <585939605.44836972294661@elapse.org> To: disman-owner@ietf.org Subject: Software MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------BB4F0CAB48D38D3" ------------BB4F0CAB48D38D3 Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit Looking for the best pricein software abatements? Right now you will catch the opportunity to use the softwares you dreamt of for a long time. And the best thing for you is, all softs are exceedingly cheap. Check it out by yourself and get the softwares for lowest rates ever seen! http://grqfaucobx12.blogspot.com ------------BB4F0CAB48D38D3 Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit
Looking for the best pricein software abatements?
Right now you will catch the opportunity to use the softwares you dreamt of for a long time.
And the best thing for you is, all softs are exceedingly cheap.
Check it out by yourself and get the softwares for lowest rates ever seen!
http://grqfaucobx12.blogspot.com ------------BB4F0CAB48D38D3-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Tue Mar 11 12:06:47 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7AA8428C285 for ; Tue, 11 Mar 2008 12:06:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.522 X-Spam-Level: X-Spam-Status: No, score=-1.522 tagged_above=-999 required=5 tests=[AWL=1.077, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 05PAnzFf0IWP for ; Tue, 11 Mar 2008 12:06:42 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id ABC4528C507 for ; Tue, 11 Mar 2008 12:03:56 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 8C02D322B49A for ; Tue, 11 Mar 2008 12:01:37 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id D402D4A4037 for ; Tue, 11 Mar 2008 12:01:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id B46161843B90 for ; Tue, 11 Mar 2008 12:01:14 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 1C6341843B7D for ; Tue, 11 Mar 2008 12:01:13 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from colo.trepanning.net (colo.trepanning.net [69.55.226.174]) by hermes.tigertech.net (Postfix) with ESMTP for ; Tue, 11 Mar 2008 12:01:11 -0700 (PDT) Received: from www.trepanning.net (localhost [127.0.0.1]) by colo.trepanning.net (Postfix) with ESMTP id 13C4D10224074; Tue, 11 Mar 2008 12:01:11 -0700 (PDT) Received: from 130.129.19.249 (SquirrelMail authenticated user dharkins@lounge.org) by www.trepanning.net with HTTP; Tue, 11 Mar 2008 12:01:11 -0700 (PDT) Message-ID: <02eba29ca4fd7f3cd1daa18be2c0466f.squirrel@www.trepanning.net> In-Reply-To: <47D6B516.4020100@gmx.net> References: <27382.216.31.249.246.1202512996.squirrel@www.trepanning.net> <47D6B516.4020100@gmx.net> Date: Tue, 11 Mar 2008 12:01:11 -0700 (PDT) From: "Dan Harkins" To: "Hannes Tschofenig" User-Agent: SquirrelMail/1.4.14 [SVN] MIME-Version: 1.0 X-Priority: 3 (Normal) Importance: Normal X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: eap@frascone.com, emu@ietf.org Subject: Re: [eap] [Emu] new I-D on password-authenticated EAP method X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Hi Hannes, I'm sorry the draft does not meet your expectations with respect to usage as compared to other EAP methods. I actually didn't think such verbage was actually needed. A brief scan of a recent EAP method that was advanced as RFC5106 shows that it too lacks a description of its use with respect to other (pre-existing) EAP methods so I'm not sure such a thing is strictly necessary but if you can provide suggested text I'm willing to consider including them in the draft. I do not want to channel Bernard but if text requested in (a) is either not needed or provided by you it then your comment in (c) is not valid, correct? regards, Dan. On Tue, March 11, 2008 9:36 am, Hannes Tschofenig wrote: > To continue on the previous discussions about this subject (with a > different subject): > > a) I believe the document does not do a good job in describing where you > plan to use this method in comparison to the already ongoing work on > tunneled mechanisms. > > To quote Bernard on a previous mailing list thread (see mail thread > about "Thoughts on Password-based EAP Methods" from March 2007, at > http://www.ietf.org/mail-archive/web/emu/current/msg00476.html) > " > > I am concerned that by defining yet another password-based > > authentication mechanism, > > " > > I understood that Bernard has a different opinion now and maybe his > comment was influenced in other ways back then in the style of > "... there we discussed tunneled methods and not password based methods in > general ..." > > > b) Assuming that bullet (a) provides a reasonable argument I believe > that the suggested approach is wrong. > > Ciao > Hannes > > Dan Harkins wrote: >> Hello, >> >> There's a new I-D in the Internet-Drafts database called >> draft-harkins-emu-eap-pwd-00.txt. It describes a new method >> for authentication using only a password. It provides resistance >> to active attack, passive attack, and dictionary attack. It >> also provides forward secrecy and an authenticated key (not just >> a shared key between authenticated entities). >> >> Please take a look and send comments to the authors. >> >> regards, >> >> Dan. >> >> >> >> _______________________________________________ >> Emu mailing list >> Emu@ietf.org >> http://www.ietf.org/mailman/listinfo/emu >> > > _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From krishnam@att.com Tue Mar 11 12:48:01 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC78C3A6C47 for ; Tue, 11 Mar 2008 12:48:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.415 X-Spam-Level: X-Spam-Status: No, score=-0.415 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, GB_ROLEX=5, HELO_EQ_AT=0.424, HOST_EQ_AT=0.745, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_SC_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RjuhNkJIpM3w for ; Tue, 11 Mar 2008 12:48:01 -0700 (PDT) Received: from chello080108017072.36.11.vie.surfer.at (chello080108017072.36.11.vie.surfer.at [80.108.17.72]) by core3.amsl.com (Postfix) with ESMTP id D2F3228C497 for ; Tue, 11 Mar 2008 12:47:56 -0700 (PDT) Message-ID: <000a01c883b0$023a6892$54ce16bd@aerbaw> From: =?iso-8859-1?B?YWx2aW4gbm/rbA==?= To: Subject: Perfectly crafted luxury timepieces Date: Tue, 11 Mar 2008 17:58:05 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C883B0.0237B595" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C883B0.0237B595 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Prestige replicas Most popular watches Rolex Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob & Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design =20 Most popular TIFFANY & CO. JEWERLY Tiffany & CO Bracelets=95Tiffany & CO = Necklace=95Tiffany & CO Earings Most popular PENS Mont Blanc Ballpoint=95Louis Vuitton Rollerball=95St Dupont = Fountain=95Mont Blanc Rollerball=95Gucci Roller=95St Dupont = Ballpoint=95Louis Vuitton Ballpoint=95St Dupont Roller Click here =20 ------=_NextPart_000_0007_01C883B0.0237B595 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Prestige
replicas

Most=20 popular watches

Rolex=20 Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob &=20 Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design=20

Most popular=20 TIFFANY & CO. JEWERLY

Tiffany & CO=20 Bracelets=95Tiffany & CO Necklace=95Tiffany & CO = Earings

Most popular=20 PENS

Mont Blanc=20 Ballpoint=95Louis Vuitton Rollerball=95St Dupont Fountain=95Mont = Blanc=20 Rollerball=95Gucci Roller=95St Dupont Ballpoint=95Louis Vuitton = Ballpoint=95St=20 Dupont Roller

Click here=20
------=_NextPart_000_0007_01C883B0.0237B595-- From ifsalamone@att.com Wed Mar 12 01:50:28 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B63E628C56D for ; Wed, 12 Mar 2008 01:50:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -22.413 X-Spam-Level: X-Spam-Status: No, score=-22.413 tagged_above=-999 required=5 tests=[BAYES_99=3.5, BODY_ENHANCEMENT=0.309, DOS_OE_TO_MX=2.75, FB_ADD_INCHES=2.131, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, FM_SEX_HELODDDD=10.357, FM_SEX_HOSTDDDD=10.357, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, J_CHICKENPOX_83=0.6, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_ADULT2=1.42, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pWBzKSu3prD0 for ; Wed, 12 Mar 2008 01:50:26 -0700 (PDT) Received: from ppp-58-9-68-217.revip2.asianet.co.th (ppp-58-9-68-217.revip2.asianet.co.th [58.9.68.217]) by core3.amsl.com (Postfix) with ESMTP id 689BD28C57D for ; Wed, 12 Mar 2008 01:50:19 -0700 (PDT) Message-ID: <000701c8841d$04d61168$86a9fdbb@dhrdxww> From: "hartwell raid" To: Subject: Watch her come over and over again Date: Wed, 12 Mar 2008 07:00:36 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C8841D.04D05807" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0004_01C8841D.04D05807 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Voted the #1 most effective male enlargement supplement by FHM readers: = V_P_X_L is guaranteed to add inches within just a few short weeks. In = addition to permanent, massive gains to length, you can also expect: 1. up to 20-30% gains in girth 2. Longer sex, never subside penis 3. More volume of ejaculate Satisfaction and results are absolutely guaranteed. Why hesitate?Try the = only Doctor endorsed Herbal enlargement supplement today! Click here: http://efecticoon.com ------=_NextPart_000_0004_01C8841D.04D05807 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Voted the #1 most effective male enlargement supplement by FHM = readers:=20 V_P_X_L is guaranteed to add inches within just a few short weeks. In = addition to permanent, massive gains to length, you=20 can also expect:

1. up to 20-30% gains in girth

2. Longer sex, never subside penis

=20

3. More volume of ejaculate

Satisfaction and results are absolutely guaranteed. Why hesitate? Try the only Doctor endorsed Herbal enlargement supplement today!

Click here: http://efecticoon.com

=20 ------=_NextPart_000_0004_01C8841D.04D05807-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Wed Mar 12 07:50:09 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F6573A6E63 for ; Wed, 12 Mar 2008 07:50:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.668 X-Spam-Level: X-Spam-Status: No, score=-0.668 tagged_above=-999 required=5 tests=[AWL=1.430, BAYES_00=-2.599, HTML_MESSAGE=0.001, RAZOR2_CHECK=0.5] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8s5qaARAOZy for ; Wed, 12 Mar 2008 07:50:07 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id C7A2B3A67FE for ; Wed, 12 Mar 2008 07:50:07 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 58684322B088 for ; Wed, 12 Mar 2008 07:47:49 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id 8C02B4A4069 for ; Wed, 12 Mar 2008 07:47:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 6CDC51C4050D for ; Wed, 12 Mar 2008 07:47:14 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 100C6433F9A for ; Wed, 12 Mar 2008 07:47:13 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from blu139-omc3-s15.blu139.hotmail.com (blu139-omc3-s15.blu139.hotmail.com [65.55.175.215]) by hermes.tigertech.net (Postfix) with ESMTP for ; Wed, 12 Mar 2008 07:47:12 -0700 (PDT) Received: from BLU137-DS3 ([65.55.162.189]) by blu139-omc3-s15.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 12 Mar 2008 07:47:11 -0700 X-Originating-IP: [130.129.19.169] X-Originating-Email: [bernard_aboba@hotmail.com] Message-ID: From: To: "Jari Arkko" , "'eap-WG'" , , , , "Tim.Polk@nist.gov" , "Sam Hartman" , Date: Wed, 12 Mar 2008 07:47:23 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal Importance: Normal X-Mailer: Microsoft Windows Live Mail 12.0.1606 X-MIMEOLE: Produced By Microsoft MimeOLE V12.0.1606 X-OriginalArrivalTime: 12 Mar 2008 14:47:11.0918 (UTC) FILETIME=[F47D14E0:01C8844F] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Subject: [eap] Re-review of draft-ietf-hokey-erx-13.txt X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0044278070==" Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com This is a multi-part message in MIME format. --===============0044278070== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0028_01C88415.4ED969B0" This is a multi-part message in MIME format. ------=_NextPart_000_0028_01C88415.4ED969B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Re-Review of draft-ietf-hokey-erx-13.txt I went through the draft again. Note that these comments only reflect my own review; the author still needs to follow up with other = reviewers.=20 Here are some overall comments: 1. I think you need to deal with the potential fraud issues in the document. This would involve describing the precautions that a AAA server should take in authorizing domains to receive DSRKs, and=20 validating subsequent accounting records.=20 2. I think you need to specify the applicability of this specification. I'm still somewhat uncertain about whether we're talking about intra-media, inter-media, inter-domain (with some meaning of=20 domain), etc. Please clear this up.=20 Some details: Note that this may introduce some delay in starting EAP. In some lower layers, the delay can be minimized or even avoided by the peer initiating EAP by sending messages such as EAPoL-Start in the IEEE 802.1X specification [10]. [BA] Since ERX is not compatible with IEEE 802.1X (whose state machine doesn't support peer-initiated messages) I don't see how this is=20 possible. It might be better to omit the reference.=20 When the EAP-Request/Identity times out, the authenticator MUST NOT close connection if an ERP exchange is in progress or has already succeeded in establishing a reauthentication MSK. [BA] What does "close connection" mean? Is the document making normative statements about link layers specified outside the IETF?=20 The authenticator uses the realm in the keyName-NAI [4] field to send the message to the appropriate ER server. [BA] Do you really mean that the authenticator is using the realm to=20 determine the IP address of the ER server? Or is the keyname-NAI field=20 just copied into the User-Name attribute so that routing happens normally? =20 The local ER server SHALL request the home AAA server for the DSRK by sending the domain name in the AAA message that carries the EAP-Initiate/Reauth bootstrap message. The local ER server MUST be in the path from the peer to the home ER server. If it is not, it cannot request the DSRK. [BA] Since the local ER server does not determine whether it is on the path how is "path pinning" to be achieved? How does the AAA server know whether an ER server is on the path or not?=20 What does it do if it is not on the path? In other words, what does the MUST imply? =20 Also, how is the mapping from domain name to IP address to be achieved? Is this via an A/AAAA RR? A SRV RR lookup?=20 Section 4.3 In case of ERP with the home ER server, the peer uses the realm from its original NAI; in case of a local ER server, the peer uses the domain name received at the lower layer or through a ERP bootstrapping exchange. [BA] Which "original NAI" are we talking about? The NAI used in the EAP-Response/Identity in the original EAP conversation? The NAI in the Peer-Id? The NAI in the ERX conversation? Section 5.1 o In addition, the rMSK is sent along with the EAP-Finish/Re-auth message, in a AAA attribute [12]. [BA] Transport of the MSK is already specified in existing AAA = documents, such as RFC 4072 (Diameter EAP). Why is reference 12 being given here rather than those existing documents? This document does not update those specifications.=20 Section 8 Authenticate all parties The EAP Re-auth protocol provides mutual authentication of the peer and the server. Both parties need to possess the keying material that resulted from a previous EAP exchange in order to successfully derive the required keys. Also, both the EAP re- authentication Response and the EAP re-authentication Information messages are integrity protected so that the peer and the server can verify each other. When the ERP exchange is executed with a local ER server, the peer and the local server mutually authenticate each other via that exchange in the same manner. The peer and the authenticator authenticate each other in the secure association protocol executed by the lower layer just as in the case of a regular EAP exchange. [BA] I think you mean "ERX" not "EAP re-authentication" or ERP, right?=20 One thing that is left out here is authentication between the ERX local server and the ERX home server. This exists if they are one hop apart, but otherwise not. So I think there is an assumption that the ERX = server is only willing to provide keys to domains that it is explicitly authorized to deal with.=20 It is RECOMMENDED that the AAA protocol be protected using IPsec or TLS so that the keys are protected in transit. Note however that keys may be exposed to AAA proxies along the way and compromise of any of those proxies may result in compromise of keys being transported through them. [BA] I think you just want to say "It is RECOMMENDED that the AAA = protocol protect the keys in transit. This can be accomplished via transmission layer security (IPsec or TLS), or via an application-layer mechanism." Confidentiality of identity Deployments where privacy is a concern may find the use of rIKname-NAI to route ERP messages serves their privacy requirements. Note that it is plausible to associate multiple runs of ERP messages since the rIKname is not changed as part of the ERP protocol. There was no consensus for that requirement at the time of development of this specification. If the rIKname is not used and the Peer-ID is used instead, the ERP exchange will reveal the Peer-ID over the wire. [BA] The rest of the spec does not talk about use of the Peer-Id. Since not all EAP method deriving keys have a Peer-Id, do you really want this mentioned here?=20 To prevent such DoS attacks, an ERP failure should not result in deletion of any authorization state established by a full EAP exchange. =20 [BA] Is this purely up to this specification to determine? Typically the lower layer defines the authorization state and how it is = installed/removed. This may not necessarily involve EAP (e.g. 802.11 4-way handshake).=20 ------=_NextPart_000_0028_01C88415.4ED969B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Re-Review of=20 draft-ietf-hokey-erx-13.txt
 
I went through the draft again.  = Note that=20 these comments only reflect
my own review;  the author still = needs to=20 follow up with other reviewers.
 
Here are some overall = comments:
 
1.  I think you need to deal with = the=20 potential fraud issues in the
document.  This would involve = describing=20 the precautions that a AAA
server should take in authorizing domains = to=20 receive DSRKs, and
validating subsequent accounting records. =
 
2. I think you need to specify the = applicability of=20 this specification.
I'm still somewhat uncertain about whether we're = talking=20 about
intra-media, inter-media, inter-domain (with some meaning of=20
domain), etc.  Please clear this up.
 
Some details:
 
   Note that this may = introduce some=20 delay in starting EAP.  In some
   lower layers, the = delay can=20 be minimized or even avoided by the peer
   initiating EAP = by=20 sending messages such as EAPoL-Start in the IEEE
   802.1X=20 specification [10].
 
[BA] Since ERX is not compatible with = IEEE 802.1X=20 (whose state machine
doesn't support peer-initiated messages) I don't = see how=20 this is
possible.  It might be better to omit the reference.=20
 
   When the = EAP-Request/Identity times=20 out, the authenticator
   MUST NOT close connection if an = ERP=20 exchange is in progress or has
   already succeeded in = establishing=20 a reauthentication MSK.
 
[BA] What does "close connection" = mean?  Is=20 the document making
normative statements about link layers specified = outside=20 the IETF?
 
   The authenticator uses the = realm in=20 the keyName-NAI [4] field to send
   the message to the = appropriate=20 ER server.
 
[BA] Do you really mean that the = authenticator is=20 using the realm to
determine the IP address of the ER server?  = Or is=20 the keyname-NAI field
just copied into the User-Name attribute so = that=20 routing happens
normally? 
 
   The local ER server SHALL=20 request
   the home AAA server for the DSRK by sending the = domain=20 name in the
   AAA message that carries the = EAP-Initiate/Reauth=20 bootstrap message.
   The local ER server MUST be in the = path from=20 the peer to the home ER
   server.  If it is not, it = cannot=20 request the DSRK.
 
[BA] Since the local ER server does not = determine
whether it is on the path how is "path pinning" to be = achieved?=20 How
does the AAA server know whether an ER server is on the path or = not?=20
What does it do if it is not on the path?  In other words, what = does
the MUST imply? 
 
Also, how is the mapping from domain = name to IP=20 address
to be achieved?  Is this via an A/AAAA RR?  A SRV = RR=20 lookup?
 
Section 4.3
 
   In case of ERP with=20 the
   home ER server, the peer uses the realm from its = original=20 NAI; in
   case of a local ER server, the peer uses the = domain name=20 received at
   the lower layer or through a ERP = bootstrapping=20 exchange.
 
[BA] Which "original NAI" are we = talking=20 about?  The NAI used in the
EAP-Response/Identity in the = original EAP=20 conversation?  The NAI
in the Peer-Id?  The NAI in the ERX=20 conversation?
 
Section 5.1
 
   o  In addition, the = rMSK is sent=20 along with the EAP-Finish/Re-auth
      = message, in=20 a AAA attribute [12].
 
[BA] Transport of the MSK is already = specified in=20 existing AAA documents,
such as RFC 4072 (Diameter EAP).  Why is = reference 12 being given here
rather than those existing = documents? =20 This document does not update
those specifications.
 
Section 8
 
      = Authenticate all=20 parties
 
        =20 The EAP Re-auth protocol provides mutual authentication of=20 the
         peer and the=20 server.  Both parties need to possess the=20 keying
         material that = resulted from a previous EAP exchange in order=20 to
         successfully = derive the=20 required keys.  Also, both the EAP=20 re-
         authentication = Response=20 and the EAP=20 re-authentication
        =20 Information messages are integrity protected so that the=20 peer
         and the server = can=20 verify each other.  When the ERP exchange=20 is
         executed with a = local ER=20 server, the peer and the local=20 server
         mutually = authenticate=20 each other via that exchange in the=20 same
         manner.  = The peer=20 and the authenticator authenticate each=20 other
         in the secure=20 association protocol executed by the lower=20 layer
         just as in the = case of=20 a regular EAP exchange.
 
[BA] I think you mean "ERX" not "EAP=20 re-authentication" or ERP, right?
One thing that is left out here is = authentication between the ERX local
server and the ERX home = server. =20 This exists if they are one hop apart,
but otherwise not.  So I = think=20 there is an assumption that the ERX server
is only willing to provide = keys to=20 domains that it is explicitly
authorized to deal with.
 
         It=20 is RECOMMENDED that the AAA protocol be protected=20 using
         IPsec or TLS = so that=20 the keys are protected in transit. =20 Note
         however that = keys may=20 be exposed to AAA proxies along the=20 way
         and compromise = of any of=20 those proxies may result in=20 compromise
         of keys = being=20 transported through them.
 
[BA] I think you just want to say "It = is=20 RECOMMENDED that the AAA protocol
protect the keys in transit.  = This can=20 be accomplished via transmission
layer security (IPsec or TLS), or = via an=20 application-layer mechanism."
 
      = Confidentiality of=20 identity
 
        =20 Deployments where privacy is a concern may find the use=20 of
         rIKname-NAI to = route ERP=20 messages serves their=20 privacy
         = requirements. =20 Note that it is plausible to associate=20 multiple
         runs of ERP = messages since the rIKname is not changed as=20 part
         of the ERP=20 protocol.  There was no consensus for=20 that
         requirement at = the time=20 of development of this=20 specification.
         If = the=20 rIKname is not used and the Peer-ID is used instead,=20 the
         ERP exchange = will reveal=20 the Peer-ID over the wire.
 
[BA] The rest of the spec does not talk = about use=20 of the Peer-Id.  Since
not all EAP method deriving keys have a = Peer-Id,=20 do you really want this
mentioned here?
 
   To prevent such DoS = attacks, an ERP=20 failure should not result in
   deletion of any = authorization state=20 established by a full EAP
   exchange. 
 
[BA] Is this purely up to this = specification to=20 determine?  Typically
the lower layer defines the authorization = state=20 and how it is installed/removed.
This may not necessarily involve EAP = (e.g.=20 802.11 4-way handshake).
 
 
------=_NextPart_000_0028_01C88415.4ED969B0-- --===============0044278070== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap --===============0044278070==-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Wed Mar 12 14:45:47 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C325F3A6AA6 for ; Wed, 12 Mar 2008 14:45:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.863 X-Spam-Level: X-Spam-Status: No, score=-0.863 tagged_above=-999 required=5 tests=[AWL=1.235, BAYES_00=-2.599, HTML_MESSAGE=0.001, RAZOR2_CHECK=0.5] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bmja+PPmwiNY for ; Wed, 12 Mar 2008 14:45:46 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id 0C45A3A699C for ; Wed, 12 Mar 2008 14:45:46 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id D530E322B02F for ; Wed, 12 Mar 2008 14:43:27 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id EBF574A4069 for ; Wed, 12 Mar 2008 14:42:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 1411F3228322 for ; Wed, 12 Mar 2008 14:42:55 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 9DE44322AEE3 for ; Wed, 12 Mar 2008 14:42:53 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from blu139-omc3-s12.blu139.hotmail.com (blu139-omc3-s12.blu139.hotmail.com [65.55.175.212]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Wed, 12 Mar 2008 14:42:52 -0700 (PDT) Received: from BLU137-DS3 ([65.55.162.187]) by blu139-omc3-s12.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 12 Mar 2008 14:42:51 -0700 X-Originating-IP: [130.129.19.169] X-Originating-Email: [bernard_aboba@hotmail.com] Message-ID: From: To: "'eap-WG'" , , Date: Wed, 12 Mar 2008 14:43:03 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal Importance: Normal X-Mailer: Microsoft Windows Live Mail 12.0.1606 X-MIMEOLE: Produced By Microsoft MimeOLE V12.0.1606 X-OriginalArrivalTime: 12 Mar 2008 21:42:51.0574 (UTC) FILETIME=[05AE9560:01C8848A] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Subject: [eap] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0974695142==" Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com This is a multi-part message in MIME format. --===============0974695142== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0142_01C8844F.60346B30" This is a multi-part message in MIME format. ------=_NextPart_000_0142_01C8844F.60346B30 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable During the HOKEY WG meeting today we got into a discussion of fraud protection and potential issues relating to that within ERX.=20 Since I mentioned the fraud issue in my O&M review, and since this issue has been brought up by other reviewers as well as in Sam's DISCUSS, I thought I'd send a more=20 detailed description of my perception of the problem to the list, in order to fully describe what I think the issue is, and how it has been introduced.=20 At its core, I believe that the problem has been created by the introduction of a short cut that in practice will provide little in the way of handoff latency reduction,=20 namely the piggybacking of DSRK provisioning on the initial EAP authentication (e.g. EAP boostrapping).=20 The shortcut is immaterial to performance because the additional=20 latency involved in providing proper peer authorization for DSRK provisioning would be amortized across the=20 user's connection time within the new domain and thus would not constitute a burden. This optimization is problematic from a security perspective because it not only enables new avenues for fraud when ERX is used, but it also negatively affects the security of EAP as it is currently deployed, by providing keying material to an entity that the EAP peer=20 has not authorized, and may not even be familiar with,=20 even when the peer does not support ERX.=20 How has the use of EAP boostrapping within the ERX design=20 introduced new avenues for fraud?=20 There are several properties of AAA protocols that are very useful for automated anti-fraud protection:=20 1. Correlation of Accounting Records to a corresponding authentication record;=20 2. Linkage of authentication records to a user whose authentication can be verified (and is immune to replay).=20 Property 1 is provided by the Class Attribute, which can be provided within an Access-Accept and subsequently echoed to an Accounting-Start, as well as via the Acct-Multi-Session Attribute, which can be used to correlate Accounting-Start packets issued within a single session of a user handing off between access points.=20 Property 2 is provided by the requirement that a RADIUS Access-Request provide either a State Attribute, =20 user authentication attributes or other evidence that demonstrates that the Access-Request represents an interaction with a user that at one point was demonstrated to be live (e.g. not a replay).=20 Properties 1 and 2 together limit the opportunities for fraud. While it is possible for an operator to "imbelish" accounting records for valid sessions,=20 potentially expanding the charges, it is typically not possible to invent sessions to which fictious charges can then be attached.=20 The difference may seem subtle, but in practice, it is important. As an analogy, it is the difference between being overcharged for a purchase that you did make, and having an unknown item show up on your credit card that was purchased at an unfamiliar location.=20 To date, fast handoff proposals (such as 11r) have stretched, but not broken the anti-fraud protections provided by AAA protocols: 1. While the user may move between authenticators, migration of the authorization parameters between authenticators has enabled correlation of accounting records both with each other (e.g. same Multi-Session-Id) and with the corresponding authentication record (via the Class Attribute).=20 2. While the fast handoffs do not generate=20 authentication attempts for each new authenticator, accounting records can only originate from the administrative domain within which the original authentication attempt occurred. =20 For example, within IEEE 802.11r, the user may only successfully complete a fast BSS transition within the Mobility Domain. As a result, if the home accounting server were to receive an Accounting-Start from a different Mobility Domain that did not correspond to an authentication attempt originating from within that Mobility Domain, then the Accounting-Start can be flagged as fraudulent. What has ERX done with EAP boostrapping that is so=20 different from existing schemes?=20 As I see it, the fundamental problem is that EAP boostrapping changes the AAA protocol model in a=20 fundamental way by allowing an ERX server on the=20 path to request a key, without providing proof=20 that the user authorized that key request, thereby=20 bypassing AAA protocol anti-fraud protections.=20 As it stands, the ERX-13 document does not specify checks that the AAA server should perform before issuing the requested DSRK. For example, the ERX server need not necessarily be only a single hop from the AAA server, and thus may not be authenticated to the AAA server, violating the requirements of RFC 4962. If the ERX server is allowed to exist multiple hops from the AAA server, this also implies that the ERX server need not necessarily exist within the local domain which the user has connected to.=20 The result of this is that a home AAA server=20 providing a DSRK to an ERX server via EAP boostrapping will not necessarily be able=20 to link accounting records received from=20 that server to the original EAP authentication,=20 or to a subsequent ERX authentication=20 terminating at the home server.=20 =20 What can be done to address the problems? The most satisfying solution from a security perspective would be to eliminate the piggybacking of DSRK provisioning on top of legacy EAP exchanges. Providing an explicit request from the peer to the server for provisioning of the DSRK would provide the server with proof of client liveness within the domain which subsequently will issue accounting records, closing the fraud loophole, as well as removing the RFC 4962 "authenicate all parties" problem, and any security impact on legacy EAP deployments.=20 Another potential approach would be to=20 introduce authorization checks on the AAA server. For example, the AAA server could require that the ERX server be only one hop away, thereby addressing the "authenticate the parties" issue.=20 Also, the ERX server could now be=20 guaranteed to be in the same domain as the user, limiting the potential for fraud to roughly the same magnitude as existing fast handoff proposals such as 11r. ------=_NextPart_000_0142_01C8844F.60346B30 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
During the HOKEY WG meeting today we = got into a=20 discussion of
fraud protection and potential issues relating to = that=20 within ERX.
 
Since I mentioned the fraud issue in my = O&M=20 review, and
since this issue has been brought up by other = reviewers
as=20 well as in Sam's DISCUSS, I thought I'd send a more
detailed = description of=20 my perception of the problem to the list,
in order to fully describe = what I=20 think the issue is, and how
it has been introduced.
 
At its core, I believe that the problem = has been=20 created
by the introduction of a = short cut=20 that in practice will
provide little in the way of handoff latency = reduction,=20
namely the piggybacking of DSRK provisioning on the initial
EAP=20 authentication (e.g. EAP boostrapping).
 
The shortcut is immaterial to = performance because=20 the additional
latency involved in providing proper peer=20 authorization
for DSRK provisioning would be amortized across the =
user's=20 connection time within the new domain and thus
would not constitute a = burden.
 
This optimization is problematic = from
a security=20 perspective because it not only enables new
avenues for fraud when = ERX is=20 used, but it also negatively
affects the security of EAP as it is = currently=20 deployed, by
providing keying material to an entity that the EAP peer =
has=20 not authorized, and may not even be familiar with,
even when the = peer does=20 not support ERX.
 
How has the use of EAP boostrapping = within the ERX=20 design
introduced new avenues for fraud?
 
There are several properties of AAA = protocols that=20 are very
useful for automated anti-fraud protection:
 
1. Correlation of Accounting Records to = a=20 corresponding
authentication record;
 
2. Linkage of authentication records to = a user=20 whose
authentication can be verified (and is immune to replay). =
 
Property 1 is provided by the Class = Attribute,=20 which can
be provided within an Access-Accept and subsequently = echoed
to=20 an Accounting-Start, as well as via the Acct-Multi-Session
Attribute, = which=20 can be used to correlate Accounting-Start
packets issued within a = single=20 session of a user handing
off between access points.
 
Property 2 is provided by the = requirement that a=20 RADIUS
Access-Request provide either a State Attribute,  =
user=20 authentication attributes or other evidence
that demonstrates that = the=20 Access-Request
represents an interaction with a user that at = one
point was=20 demonstrated to be live (e.g. not a replay).
 
Properties 1 and 2 together limit the=20 opportunities
for fraud.  While it is possible for an operator=20 to
"imbelish" accounting records for valid sessions,
potentially=20 expanding the charges, it is typically not
possible to invent = sessions to=20 which fictious
charges can then be attached.
 
The difference may seem subtle, but in = practice,=20 it
is important.  As an analogy, it is the
difference between = being=20 overcharged for a purchase
that you did make, and having an unknown = item show=20 up on
your credit card that was purchased at an = unfamiliar
location.=20
 
To date, fast handoff proposals (such = as 11r)=20 have
stretched, but not broken the anti-fraud protections
provided = by AAA=20 protocols:
 
1. While the user may move between=20 authenticators,
migration of the authorization parameters=20 between
authenticators has enabled correlation of = accounting
records both=20 with each other (e.g. same
Multi-Session-Id) and with the=20 corresponding
authentication record (via the Class Attribute). =
 
2. While the fast handoffs do not = generate=20
authentication attempts for each new authenticator,
accounting = records=20 can only originate from the
administrative domain within which the=20 original
authentication attempt occurred. 
 
For example, within IEEE 802.11r, the = user=20 may
only successfully complete a fast BSS transition
within the = Mobility=20 Domain.  As a result, if
the home accounting server were to = receive=20 an
Accounting-Start from a different Mobility Domain
that did not=20 correspond to an authentication attempt
originating from within that = Mobility=20 Domain, then the
Accounting-Start can be flagged as = fraudulent.
 
What has ERX done with EAP boostrapping = that is so=20
different from existing schemes?
 
As I see it, the fundamental problem is = that=20 EAP
boostrapping changes the AAA protocol model in a
fundamental = way by=20 allowing an ERX server on the
path to request a key, without = providing proof=20
that the user authorized that key request, thereby
bypassing AAA = protocol anti-fraud protections.
 
As it stands, the ERX-13 document does = not=20 specify
checks that the AAA server should perform before
issuing = the=20 requested DSRK.  For example, the
ERX server need not = necessarily be=20 only a single
hop from the AAA server, and thus may not = be
authenticated=20 to the AAA server, violating
the requirements of RFC 4962.  If = the=20 ERX
server is allowed to exist multiple hops from
the AAA server, = this=20 also implies that the ERX
server need not necessarily exist = within
the=20 local domain which the user has connected
to.
 
The result of this is that a home AAA = server=20
providing a DSRK to an ERX server via EAP
boostrapping will not=20 necessarily be able
to link accounting records received from =
that server=20 to the original EAP authentication,
or to a subsequent ERX = authentication=20
terminating at the home server.
 
What can be done to = address=20 the problems?
The most satisfying solution from a = security
perspective=20 would be to eliminate the piggybacking
of DSRK provisioning on top of = legacy=20 EAP
exchanges.  Providing an explicit request
from the peer = to the=20 server for provisioning
of the DSRK would provide the server = with
proof of=20 client liveness within the domain
which subsequently will issue=20 accounting
records, closing the fraud loophole, as well = as
removing the=20 RFC 4962 "authenicate all
parties" problem, and any security = impact
on=20 legacy EAP deployments.
 
Another potential approach would be to=20
introduce authorization checks on the
AAA server.  For = example, the=20 AAA server
could require that the ERX server be
only one hop away, = thereby=20 addressing
the "authenticate the parties" issue.
Also, the ERX = server=20 could now be
guaranteed to be in the same domain
as the user, = limiting=20 the potential
for fraud to roughly the same magnitude
as existing = fast=20 handoff proposals
such as 11r.
------=_NextPart_000_0142_01C8844F.60346B30-- --===============0974695142== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap --===============0974695142==-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Wed Mar 12 22:50:45 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0A1853A6A10 for ; Wed, 12 Mar 2008 22:50:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.72 X-Spam-Level: X-Spam-Status: No, score=-1.72 tagged_above=-999 required=5 tests=[AWL=0.879, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxhlt5M7YAkn for ; Wed, 12 Mar 2008 22:50:43 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id B000A3A67B2 for ; Wed, 12 Mar 2008 22:50:43 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id C0B05322B4C8 for ; Wed, 12 Mar 2008 22:48:25 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id 7DD254A40B6 for ; Wed, 12 Mar 2008 22:48:03 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 3C02E1C407D2 for ; Wed, 12 Mar 2008 22:48:03 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 5BF4A1C407AD for ; Wed, 12 Mar 2008 22:48:02 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from wolverine01.qualcomm.com (wolverine01.qualcomm.com [199.106.114.254]) by hermes.tigertech.net (Postfix) with ESMTP for ; Wed, 12 Mar 2008 22:48:01 -0700 (PDT) X-IronPort-AV: E=McAfee;i="5100,188,5250"; a="1261241" Received: from pdmz-ns-mip.qualcomm.com (HELO ithilien.qualcomm.com) ([199.106.114.10]) by wolverine01.qualcomm.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 12 Mar 2008 22:47:48 -0700 Received: from hamtaro.qualcomm.com (hamtaro.qualcomm.com [129.46.61.157]) by ithilien.qualcomm.com (8.14.2/8.14.2/1.0) with ESMTP id m2D5lmPe025861 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 12 Mar 2008 22:47:48 -0700 Received: from [10.50.72.120] (qconnect-10-50-72-120.qualcomm.com [10.50.72.120]) by hamtaro.qualcomm.com (8.14.2/8.14.2/1.0) with ESMTP id m2D5lioS023072 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 12 Mar 2008 22:47:45 -0700 (PDT) Message-ID: <47D8C000.4080504@qualcomm.com> Date: Wed, 12 Mar 2008 22:47:44 -0700 From: Lakshminath Dondeti User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) MIME-Version: 1.0 To: Bernard_Aboba@hotmail.com References: In-Reply-To: X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: Tim Polk , hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Hi Bernard, Thank you for clearly explaining the problem. I appreciate it. I have even read Acct-Multi-Session-Id thing now and I wonder perhaps it makes sense to tie the "domain" definition to that attribute. Let me try to respond to your notes below: On 3/12/2008 2:43 PM, Bernard_Aboba@hotmail.com wrote: > During the HOKEY WG meeting today we got into a discussion of > fraud protection and potential issues relating to that within ERX. > > Since I mentioned the fraud issue in my O&M review, and > since this issue has been brought up by other reviewers > as well as in Sam's DISCUSS, I thought I'd send a more > detailed description of my perception of the problem to the list, > in order to fully describe what I think the issue is, and how > it has been introduced. > > At its core, I believe that the problem has been created > by the introduction of a short cut that in practice will > provide little in the way of handoff latency reduction, > namely the piggybacking of DSRK provisioning on the initial > EAP authentication (e.g. EAP boostrapping). Again, thanks for pointing out the specific issue here. It is very helpful. > > The shortcut is immaterial to performance because the additional > latency involved in providing proper peer authorization > for DSRK provisioning would be amortized across the > user's connection time within the new domain and thus > would not constitute a burden. The shortcut helps. After full EAP authentication, the next AP the peer attaches to (we don't know how fast the handover happens) would have to run ERP bootstrapping exchange instead of ERP with the local ER server. We should avoid that when possible. Implicit bootstrapping is a SHOULD. Implicit bootstrapping is also possible only if the peer can learn the domain name from the authenticator. Thus, there is a way for the peer and the server to establish that they are communicating with entities that advertise the same domain name. Now as long as we require all acct records from the same domain to use the Acct-Multi-Session-Id, we would have mitigated the fraud. thanks, Lakshminath > > This optimization is problematic from > a security perspective because it not only enables new > avenues for fraud when ERX is used, but it also negatively > affects the security of EAP as it is currently deployed, by > providing keying material to an entity that the EAP peer > has not authorized, and may not even be familiar with, > even when the peer does not support ERX. > > How has the use of EAP boostrapping within the ERX design > introduced new avenues for fraud? > > There are several properties of AAA protocols that are very > useful for automated anti-fraud protection: > > 1. Correlation of Accounting Records to a corresponding > authentication record; > > 2. Linkage of authentication records to a user whose > authentication can be verified (and is immune to replay). > > Property 1 is provided by the Class Attribute, which can > be provided within an Access-Accept and subsequently echoed > to an Accounting-Start, as well as via the Acct-Multi-Session > Attribute, which can be used to correlate Accounting-Start > packets issued within a single session of a user handing > off between access points. > > Property 2 is provided by the requirement that a RADIUS > Access-Request provide either a State Attribute, > user authentication attributes or other evidence > that demonstrates that the Access-Request > represents an interaction with a user that at one > point was demonstrated to be live (e.g. not a replay). > > Properties 1 and 2 together limit the opportunities > for fraud. While it is possible for an operator to > "imbelish" accounting records for valid sessions, > potentially expanding the charges, it is typically not > possible to invent sessions to which fictious > charges can then be attached. > > The difference may seem subtle, but in practice, it > is important. As an analogy, it is the > difference between being overcharged for a purchase > that you did make, and having an unknown item show up on > your credit card that was purchased at an unfamiliar > location. > > To date, fast handoff proposals (such as 11r) have > stretched, but not broken the anti-fraud protections > provided by AAA protocols: > > 1. While the user may move between authenticators, > migration of the authorization parameters between > authenticators has enabled correlation of accounting > records both with each other (e.g. same > Multi-Session-Id) and with the corresponding > authentication record (via the Class Attribute). > > 2. While the fast handoffs do not generate > authentication attempts for each new authenticator, > accounting records can only originate from the > administrative domain within which the original > authentication attempt occurred. > > For example, within IEEE 802.11r, the user may > only successfully complete a fast BSS transition > within the Mobility Domain. As a result, if > the home accounting server were to receive an > Accounting-Start from a different Mobility Domain > that did not correspond to an authentication attempt > originating from within that Mobility Domain, then the > Accounting-Start can be flagged as fraudulent. > > What has ERX done with EAP boostrapping that is so > different from existing schemes? > > As I see it, the fundamental problem is that EAP > boostrapping changes the AAA protocol model in a > fundamental way by allowing an ERX server on the > path to request a key, without providing proof > that the user authorized that key request, thereby > bypassing AAA protocol anti-fraud protections. > > As it stands, the ERX-13 document does not specify > checks that the AAA server should perform before > issuing the requested DSRK. For example, the > ERX server need not necessarily be only a single > hop from the AAA server, and thus may not be > authenticated to the AAA server, violating > the requirements of RFC 4962. If the ERX > server is allowed to exist multiple hops from > the AAA server, this also implies that the ERX > server need not necessarily exist within > the local domain which the user has connected > to. > > The result of this is that a home AAA server > providing a DSRK to an ERX server via EAP > boostrapping will not necessarily be able > to link accounting records received from > that server to the original EAP authentication, > or to a subsequent ERX authentication > terminating at the home server. > > What can be done to address the problems? > The most satisfying solution from a security > perspective would be to eliminate the piggybacking > of DSRK provisioning on top of legacy EAP > exchanges. Providing an explicit request > from the peer to the server for provisioning > of the DSRK would provide the server with > proof of client liveness within the domain > which subsequently will issue accounting > records, closing the fraud loophole, as well as > removing the RFC 4962 "authenicate all > parties" problem, and any security impact > on legacy EAP deployments. > > Another potential approach would be to > introduce authorization checks on the > AAA server. For example, the AAA server > could require that the ERX server be > only one hop away, thereby addressing > the "authenticate the parties" issue. > Also, the ERX server could now be > guaranteed to be in the same domain > as the user, limiting the potential > for fraud to roughly the same magnitude > as existing fast handoff proposals > such as 11r. > > > ------------------------------------------------------------------------ > > _______________________________________________ > HOKEY mailing list > HOKEY@ietf.org > https://www.ietf.org/mailman/listinfo/hokey _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From eap-bounces+eap-archive=lists.ietf.org@frascone.com Thu Mar 13 02:08:02 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 722713A692C for ; Thu, 13 Mar 2008 02:08:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qlViuDNGCWaR for ; Thu, 13 Mar 2008 02:08:00 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id 4AA1D28C70B for ; Thu, 13 Mar 2008 02:08:00 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id 8276B430E6A for ; Thu, 13 Mar 2008 02:05:42 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id DA2244A4037 for ; Thu, 13 Mar 2008 02:05:33 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id AA683430D44 for ; Thu, 13 Mar 2008 02:05:33 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 2906C430D60 for ; Thu, 13 Mar 2008 02:05:32 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from deployingradius.com (www.deployingradius.com [216.240.42.17]) by hermes.tigertech.net (Postfix) with ESMTP for ; Thu, 13 Mar 2008 02:05:31 -0700 (PDT) Received: from [10.0.1.49] (alexander.quiconnect.net [213.30.156.62]) by deployingradius.com (Postfix) with ESMTP id 39CC5A704E; Thu, 13 Mar 2008 02:05:21 -0700 (PDT) Message-ID: <47D8ED8A.8000403@deployingradius.com> Date: Thu, 13 Mar 2008 10:02:02 +0100 From: Alan DeKok User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Bernard_Aboba@hotmail.com References: In-Reply-To: X-Enigmail-Version: 0.95.0 X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Bernard_Aboba@hotmail.com wrote: > Properties 1 and 2 together limit the opportunities > for fraud. While it is possible for an operator to > "imbelish" accounting records for valid sessions, > potentially expanding the charges, it is typically not > possible to invent sessions to which fictious > charges can then be attached. One caveat: Yes, for EAP sessions. For hotspot or dial-up, the passwords are sent in clear-text. This gives the visited operators the ability to invent sessions. > 2. While the fast handoffs do not generate > authentication attempts for each new authenticator, > accounting records can only originate from the > administrative domain within which the original > authentication attempt occurred. Hokey restricts ERX to within one domain (I think Glen said that in the meeting), so the above restriction will apply to Hokey, too. This means that the only vulnerability Hokey has to fraudulent operators is their ability to use ERX to generate *multiple* authentications for the same user. This fraud can be detected and prevented if Hokey ties each ERX session to the original EAP session. (It's not immediately obvious from a scan of ERX-13 how this happens). i.e. Any accounting stream from an ERX authentication should be tied to the original EAP authentication. The home server can then validate that it is receiving one, and only one, accounting stream that results from an EAP authentication. > As I see it, the fundamental problem is that EAP > boostrapping changes the AAA protocol model in a > fundamental way by allowing an ERX server on the > path to request a key, without providing proof > that the user authorized that key request, thereby > bypassing AAA protocol anti-fraud protections. Largely, yes. The above analysis does some risk mitigation on subsequent activity. > As it stands, the ERX-13 document does not specify > checks that the AAA server should perform before > issuing the requested DSRK. ... If the ERX > server is allowed to exist multiple hops from > the AAA server, this also implies that the ERX > server need not necessarily exist within > the local domain which the user has connected > to. I think that the ERX server MUST be within the same domain as the AAA server: the visited domain. > Also, the ERX server could now be > guaranteed to be in the same domain > as the user, limiting the potential > for fraud to roughly the same magnitude > as existing fast handoff proposals > such as 11r. That would be best, I think. Alan DeKok. _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From lareuramedicscyg@euramedics.com Thu Mar 13 04:46:03 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C35B228C75B; Thu, 13 Mar 2008 04:46:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.791 X-Spam-Level: **** X-Spam-Status: No, score=4.791 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_DYNAMIC_DHCP=1.398, HELO_EQ_TR=0.935, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eLC2tz8gviVJ; Thu, 13 Mar 2008 04:46:03 -0700 (PDT) Received: from dsl88.230-39665.ttnet.net.tr (unknown [88.230.154.241]) by core3.amsl.com (Postfix) with ESMTP id 5665C3A6E11; Thu, 13 Mar 2008 04:46:01 -0700 (PDT) Received: from [88.230.154.241] by pop.scarlet.be; Thu, 13 Mar 2008 13:43:43 +0200 Date: Thu, 13 Mar 2008 13:43:43 +0200 From: "Marci Lowe" X-Mailer: The Bat! (v3.60.07) Home Reply-To: lareuramedicscyg@euramedics.com X-Priority: 3 (Normal) Message-ID: <933254502.80769086488539@euramedics.com> To: discuss-admin@ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------42C8B6EC842CF8B" ------------42C8B6EC842CF8B Content-Type: text/plain; charset=iso-8859-2 Content-Transfer-Encoding: 7bit Our goal is to assure PC and Macintosh lawful software and computer solutions of low price to suit any budget. Whether you're a corporate customer, a small business possessor, or go shopping for your own personal computer, we believe we'll help you. HERE IS A LIST OF OUR SOFTWARE! http://kimberlycoleman887759.blogspot.com ------------42C8B6EC842CF8B Content-Type: text/html; charset=iso-8859-2 Content-Transfer-Encoding: 7bit Our goal is to assure PC and Macintosh lawful software and computer solutions of low price to suit any budget.
Whether you're a corporate customer, a small business possessor,
or go shopping for your own personal computer, we believe we'll help you.
HERE IS A LIST OF OUR SOFTWARE!
http://kimberlycoleman887759.blogspot.com
------------42C8B6EC842CF8B-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Thu Mar 13 07:23:36 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 469C028C64F for ; Thu, 13 Mar 2008 07:23:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.038 X-Spam-Level: X-Spam-Status: No, score=-1.038 tagged_above=-999 required=5 tests=[AWL=1.060, BAYES_00=-2.599, HTML_MESSAGE=0.001, RAZOR2_CHECK=0.5] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d4aehRQF+C2q for ; Thu, 13 Mar 2008 07:23:35 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id 9466A3A6E6B for ; Thu, 13 Mar 2008 07:23:22 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id ADD9C19AC0CF for ; Thu, 13 Mar 2008 07:21:04 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 4F5DA4A4037 for ; Thu, 13 Mar 2008 07:20:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 13851322B3B4 for ; Thu, 13 Mar 2008 07:20:30 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 258AC322B3AD for ; Thu, 13 Mar 2008 07:20:29 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from blu139-omc2-s20.blu139.hotmail.com (blu139-omc2-s20.blu139.hotmail.com [65.55.175.190]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Thu, 13 Mar 2008 07:20:26 -0700 (PDT) Received: from BLU137-W34 ([65.55.162.186]) by blu139-omc2-s20.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 13 Mar 2008 07:20:25 -0700 Message-ID: X-Originating-IP: [130.129.20.161] From: Bernard Aboba To: Alan DeKok Date: Thu, 13 Mar 2008 07:20:25 -0700 Importance: Normal In-Reply-To: <47D8ED8A.8000403@deployingradius.com> References: <47D8ED8A.8000403@deployingradius.com> MIME-Version: 1.0 X-OriginalArrivalTime: 13 Mar 2008 14:20:25.0596 (UTC) FILETIME=[61758BC0:01C88515] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0175868372==" Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com --===============0175868372== Content-Type: multipart/alternative; boundary="_c8d6ec3d-b615-4b60-b3f3-7eafd34ca75b_" --_c8d6ec3d-b615-4b60-b3f3-7eafd34ca75b_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable > For hotspot or dial-up, the passwords are sent in clear-text. This > gives the visited operators the ability to invent sessions. [BA] Fair enough.=20 =20 > Hokey restricts ERX to within one domain (I think Glen said that in > the meeting), so the above restriction will apply to Hokey, too. This > means that the only vulnerability Hokey has to fraudulent operators is > their ability to use ERX to generate *multiple* authentications for the > same user. [BA] This is where I get confused. As far as I can tell, the DSRK request can be inserted by *any* proxy on the path. So I'm not sure how the restrictions is implemented in practice.=20 > This fraud can be detected and prevented if Hokey ties each ERX > session to the original EAP session. (It's not immediately obvious from > a scan of ERX-13 how this happens). i.e. Any accounting stream from an > ERX authentication should be tied to the original EAP authentication. > The home server can then validate that it is receiving one, and only > one, accounting stream that results from an EAP authentication. [BA] It would certainly help for the subsequent ERX accounting records to be tied to the original EAP session (e.g. via use of the same Multi-Session= -Id).=20 But it would still be necessary to tie the ERX accounting records to an authentication that terminates at the home ERX server, not just the local ERX server.=20 > I think that the ERX server MUST be within the same domain as the AAA > server: the visited domain. [BA] If the ERX server and AAA server are both in the visited domain, why r= efer to a "local" ERX server and a "home" ERX server? I thought that the=20 applicability statement proposed refers to inter-domain use.=20 > That would be best, I think. [BA] I agree that the restrictions you describe would address the issue, but I'm still confused as to whether the solution scope includes those restrictions or not.=20 --_c8d6ec3d-b615-4b60-b3f3-7eafd34ca75b_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable > For hotspot or dial-up, the passwords are sent in clear-text. This<= br>> gives the visited operators the ability to invent sessions.

= [BA] Fair enough.
 
> Hokey restricts ERX to within one do= main (I think Glen said that in
> the meeting), so the above restrict= ion will apply to Hokey, too. This
> means that the only vulnerabili= ty Hokey has to fraudulent operators is
> their ability to use ERX to= generate *multiple* authentications for the
> same user.

[BA]= This is where I get confused.  As far as I can tell, the DSRK request=
can be inserted by *any* proxy on the path.  So I'm not sure how t= he
restrictions is implemented in practice.

> This fraud ca= n be detected and prevented if Hokey ties each ERX
> session to the o= riginal EAP session. (It's not immediately obvious from
> a scan of = ERX-13 how this happens). i.e. Any accounting stream from an
> ERX a= uthentication should be tied to the original EAP authentication.
> Th= e home server can then validate that it is receiving one, and only
> = one, accounting stream that results from an EAP authentication.

[BA]= It would certainly help for the subsequent ERX accounting records to
be= tied to the original EAP session (e.g. via use of the same Multi-Session-I= d).
But it would still be necessary to tie the ERX accounting records t= o
an authentication that terminates at the home ERX server, not just
= the local ERX server.

> I think that the ERX server MUST be wi= thin the same domain as the AAA
> server: the visited domain.

= [BA] If the ERX server and AAA server are both in the visited domain, why r= efer
to a "local" ERX server and a "home" ERX server?  I thought th= at the
applicability statement proposed refers to inter-domain use.
> That would be best, I think.

[BA] I agree that the restr= ictions you describe would address the issue,
but I'm still confused as = to whether the solution scope includes those
restrictions or not.
= --_c8d6ec3d-b615-4b60-b3f3-7eafd34ca75b_-- --===============0175868372== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap --===============0175868372==-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Thu Mar 13 08:05:56 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49D923A6CD1 for ; Thu, 13 Mar 2008 08:05:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.736 X-Spam-Level: X-Spam-Status: No, score=-1.736 tagged_above=-999 required=5 tests=[AWL=0.863, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xSiRZu1bXrTf for ; Thu, 13 Mar 2008 08:05:51 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id D964F3A6C30 for ; Thu, 13 Mar 2008 08:05:51 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id D11B21C40EAC for ; Thu, 13 Mar 2008 08:03:33 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id C54594A4037 for ; Thu, 13 Mar 2008 08:03:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id B3C1B1C407D0 for ; Thu, 13 Mar 2008 08:03:24 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 3AE951C407B2 for ; Thu, 13 Mar 2008 08:03:23 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from deployingradius.com (www.deployingradius.com [216.240.42.17]) by hermes.tigertech.net (Postfix) with ESMTP for ; Thu, 13 Mar 2008 08:03:21 -0700 (PDT) Received: from [10.0.1.49] (alexander.quiconnect.net [213.30.156.62]) by deployingradius.com (Postfix) with ESMTP id 5E4E0A704E; Thu, 13 Mar 2008 08:03:17 -0700 (PDT) Message-ID: <47D9416A.8000709@deployingradius.com> Date: Thu, 13 Mar 2008 15:59:54 +0100 From: Alan DeKok User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Bernard Aboba References: <47D8ED8A.8000403@deployingradius.com> In-Reply-To: X-Enigmail-Version: 0.95.0 X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Bernard Aboba wrote: > [BA] This is where I get confused. As far as I can tell, the DSRK request > can be inserted by *any* proxy on the path. So I'm not sure how the > restrictions is implemented in practice. A proxy inserting a DSRK for the purposes of faking authentication would presumably do so without the cooperation of the visited network. The proxy would then have to filter the accounting traffic from the visited network. This is where a 3 party *reconciliation* protocol would be beneficial. If the visitied network, proxies, and home network all share their accounting data, fraud is easier to detect. > [BA] It would certainly help for the subsequent ERX accounting records to > be tied to the original EAP session (e.g. via use of the same > Multi-Session-Id). Not many systems implement Multi-Session-Id. It may be simpler just to require the accounting records for the visited network to be consistent. i.e. when a user moves to a new NAS, the records could be sent through the visited network AAA server, which could do the necessary data massaging to create a canonical accounting stream. > [BA] If the ERX server and AAA server are both in the visited domain, > why refer > to a "local" ERX server and a "home" ERX server? I thought that the > applicability statement proposed refers to inter-domain use. I think the "home" ERX server just complicates the issue. > [BA] I agree that the restrictions you describe would address the issue, > but I'm still confused as to whether the solution scope includes those > restrictions or not. Reviews && feedback are being solicited... Alan DeKok. _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From fisexprotechzob@exprotech.net Thu Mar 13 10:32:54 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D03F03A6BE3; Thu, 13 Mar 2008 10:32:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.384 X-Spam-Level: **** X-Spam-Status: No, score=4.384 tagged_above=-999 required=5 tests=[BAYES_50=0.001, HELO_EQ_CZ=0.445, HOST_EQ_CZ=0.904, HTML_MESSAGE=0.001, RCVD_IN_XBL=3.033] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AR84Obxaqhzb; Thu, 13 Mar 2008 10:32:49 -0700 (PDT) Received: from panelak.asysijd.cz (panelak.asysijd.cz [193.85.145.197]) by core3.amsl.com (Postfix) with ESMTP id 0732D28C245; Thu, 13 Mar 2008 10:32:39 -0700 (PDT) Received: from [193.85.145.197] by exprotech.net; Thu, 13 Mar 2008 18:30:25 +0100 Date: Thu, 13 Mar 2008 18:30:25 +0100 From: "Ariel Singh" X-Mailer: The Bat! (v3.51) Home Reply-To: fisexprotechzob@exprotech.net X-Priority: 3 (Normal) Message-ID: <970948999.67923336724307@exprotech.net> To: dinaras@ietf.org Subject: Software MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------5B6E54096796E5" ------------5B6E54096796E5 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Are you looking for the better costs in software rebates? This time you will find the chance to use the software equipment you wanted for a long time. And the best matter for you is, all softwares are of terribly low value. Check it up by yourself and get the softwares for cheapest value ever seen! http://briannabrooks363561.blogspot.com ------------5B6E54096796E5 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 7bit
Are you looking for the better costs in software rebates?
This time you will find the chance to use the software equipment you wanted for a long time.
And the best matter for you is, all softwares are of terribly low value.
Check it up by yourself and get the softwares for cheapest value ever seen!
http://briannabrooks363561.blogspot.com ------------5B6E54096796E5-- From fisexcitemediazob@excitemedia.com Thu Mar 13 13:58:48 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E89193A6981; Thu, 13 Mar 2008 13:58:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.577 X-Spam-Level: *** X-Spam-Status: No, score=3.577 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_IP_ADDR=1.119, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Q-cMpP0Alih; Thu, 13 Mar 2008 13:58:48 -0700 (PDT) Received: from [41.250.13.71] (unknown [41.250.13.71]) by core3.amsl.com (Postfix) with ESMTP id 503D128C1A6; Thu, 13 Mar 2008 13:58:46 -0700 (PDT) Received: from [41.250.13.71] by mail.karcom.net; Thu, 13 Mar 2008 20:56:29 +0000 Date: Thu, 13 Mar 2008 20:56:29 +0000 From: "Ella Tidwell" X-Mailer: The Bat! (v3.0.1.33) Professional Reply-To: fisexcitemediazob@excitemedia.com X-Priority: 3 (Normal) Message-ID: <151719595.73543013752005@excitemedia.com> To: dinaras@ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------A3ECF8BD3E5BDAA" ------------A3ECF8BD3E5BDAA Content-Type: text/plain; charset=windows-1250 Content-Transfer-Encoding: 7bit Our main aim is to present low cost PC and Macintosh legal software and computer solutions for any budget. Whether you're a corporate purchaser, a small business owner, or shopping for your own home PC, we believe that we'll assist you. CHECK WHAT WE GOT TO OFFER! http://annabarnes775381.blogspot.com ------------A3ECF8BD3E5BDAA Content-Type: text/html; charset=windows-1250 Content-Transfer-Encoding: 7bit Our main aim is to present low cost PC and Macintosh legal software and computer solutions for any budget.
Whether you're a corporate purchaser, a small business owner,
or shopping for your own home PC, we believe that we'll assist you.
CHECK WHAT WE GOT TO OFFER!
http://annabarnes775381.blogspot.com
------------A3ECF8BD3E5BDAA-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Thu Mar 13 16:06:26 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5769D28C759 for ; Thu, 13 Mar 2008 16:06:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.493 X-Spam-Level: X-Spam-Status: No, score=-0.493 tagged_above=-999 required=5 tests=[AWL=0.440, BAYES_00=-2.599, SARE_HEAD_XUNSENT=1.666] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ngtqaYhbqG-f for ; Thu, 13 Mar 2008 16:06:25 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id A4A1228C94A for ; Thu, 13 Mar 2008 16:05:45 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id 65D441C40E8B for ; Thu, 13 Mar 2008 16:03:28 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 4635D4ECEF3 for ; Thu, 13 Mar 2008 16:03:20 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 11F49322B3AD for ; Thu, 13 Mar 2008 16:03:20 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 7A94A322B390 for ; Thu, 13 Mar 2008 16:03:18 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from blu139-omc2-s20.blu139.hotmail.com (blu139-omc2-s20.blu139.hotmail.com [65.55.175.190]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Thu, 13 Mar 2008 16:03:17 -0700 (PDT) Received: from BLU137-DS3 ([65.55.162.185]) by blu139-omc2-s20.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 13 Mar 2008 16:03:16 -0700 X-Originating-IP: [130.129.20.161] X-Originating-Email: [bernard_aboba@hotmail.com] Message-ID: From: In-Reply-To: <47D8ED8A.8000403@deployingradius.com> <47D9416A.8000709@deployingradius.com> To: "Alan DeKok" References: <47D8ED8A.8000403@deployingradius.com> <47D9416A.8000709@deployingradius.com> X-Unsent: 1 Date: Thu, 13 Mar 2008 16:03:28 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal Importance: Normal X-Mailer: Microsoft Windows Live Mail 12.0.1606 X-MimeOLE: Produced By Microsoft MimeOLE V12.0.1606 X-OriginalArrivalTime: 13 Mar 2008 23:03:16.0613 (UTC) FILETIME=[6C0ADB50:01C8855E] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com > A proxy inserting a DSRK for the purposes of faking authentication > would presumably do so without the cooperation of the visited network. > The proxy would then have to filter the accounting traffic from the > visited network. [BA] Ah... so you are saying that the forgery can be detected by looking for overlap in the time sequence of user activity? This seems like a fairly intensive check, though. > This is where a 3 party *reconciliation* protocol would be beneficial. > If the visited network, proxies, and home network all share their > accounting data, fraud is easier to detect. [BA] I was looking for something simpler, such as a mechanism that would enable checking of a ERX auth exchange with the home server against subsequent accounting records sent by the local ERX server. For example, if the peer were to use ERX to tell the home server what local domain it is in, then the home server could ensure that it only accepts accounting records from that domain, and no other ones. >> [BA] It would certainly help for the subsequent ERX accounting records to >> be tied to the original EAP session (e.g. via use of the same >> Multi-Session-Id). > > Not many systems implement Multi-Session-Id. It may be simpler just > to require the accounting records for the visited network to be > consistent. i.e. when a user moves to a new NAS, the records could be > sent through the visited network AAA server, which could do the > necessary data massaging to create a canonical accounting stream. [BA] That would be fine too, as long as the home server knows what visited network the accounting data is supposed to come from. _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From roqfasciaworldfis@fasciaworld.com Fri Mar 14 01:07:45 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0BA13A6F4C; Fri, 14 Mar 2008 01:07:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.552 X-Spam-Level: ** X-Spam-Status: No, score=2.552 tagged_above=-999 required=5 tests=[BAYES_60=1, FH_RELAY_NODNS=1.451, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FHGJRpEb12Cv; Fri, 14 Mar 2008 01:07:41 -0700 (PDT) Received: from tader.optical01.tvk.lt (unknown [213.226.177.65]) by core3.amsl.com (Postfix) with ESMTP id 503BC3A6F4A; Fri, 14 Mar 2008 01:07:10 -0700 (PDT) Received: from [213.226.177.65] by mx01.schlund.de; Fri, 14 Mar 2008 00:04:54 -0800 Date: Fri, 14 Mar 2008 00:04:54 -0800 From: "Darcy Green" X-Mailer: The Bat! (v2.00) Personal Reply-To: roqfasciaworldfis@fasciaworld.com X-Priority: 3 (Normal) Message-ID: <513081283.39700250815356@fasciaworld.com> To: disman-owner@ietf.org Subject: Software MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------E829E8297B80513" ------------E829E8297B80513 Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit Are you looking for the better price in discount software? Right now you'll catch the chance to use the software equipment you wanted long since. And the best matter for you is, all softwares are awfully cheap. Check it up by yourself & take the softwares for lowest rates! http://michellehernandez359164.blogspot.com ------------E829E8297B80513 Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit
Are you looking for the better price in discount software?
Right now you'll catch the chance to use the software equipment you wanted long since.
And the best matter for you is, all softwares are awfully cheap.
Check it up by yourself & take the softwares for lowest rates!
http://michellehernandez359164.blogspot.com ------------E829E8297B80513-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Fri Mar 14 02:58:59 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 560863A6802 for ; Fri, 14 Mar 2008 02:58:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.746 X-Spam-Level: X-Spam-Status: No, score=-1.746 tagged_above=-999 required=5 tests=[AWL=0.853, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4uNESsuDEX8P for ; Fri, 14 Mar 2008 02:58:50 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id 43A9028C88E for ; Fri, 14 Mar 2008 02:58:50 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 5C477322B895 for ; Fri, 14 Mar 2008 02:56:33 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 5C0794A4037 for ; Fri, 14 Mar 2008 02:56:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 26BBA322B4A0 for ; Fri, 14 Mar 2008 02:56:10 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id A9C90322B49B for ; Fri, 14 Mar 2008 02:56:08 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from deployingradius.com (www.deployingradius.com [216.240.42.17]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Fri, 14 Mar 2008 02:56:06 -0700 (PDT) Received: from [10.0.1.49] (alexander.quiconnect.net [213.30.156.62]) by deployingradius.com (Postfix) with ESMTP id DDF7BA704E; Fri, 14 Mar 2008 02:55:56 -0700 (PDT) Message-ID: <47DA4AE5.8050009@deployingradius.com> Date: Fri, 14 Mar 2008 10:52:37 +0100 From: Alan DeKok User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Bernard_Aboba@hotmail.com References: <47D8ED8A.8000403@deployingradius.com> <47D9416A.8000709@deployingradius.com> In-Reply-To: X-Enigmail-Version: 0.95.0 X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Bernard_Aboba@hotmail.com wrote: > [BA] Ah... so you are saying that the forgery can be detected by looking > for overlap in the time sequence of user activity? This seems like a > fairly intensive check, though. I'm saying that the home AAA server can detect multiple accounting streams for one user, and conclude that fraud is involved. The visited network is therefore required (somewhat logically) to generate only one accounting stream for a user, independent of how many times ERX is used. i.e. if the visited network permits the user to move between AP's, it should be required to bear the burden of ensuring that the accounting stream it generates is sane. Since we assume only one accounting stream from visited AAA to home AAA, the fraud issue is limited. Most networks bill on the basis of time, and one stream can't have multiple start/stop times. Other networks bill on the basis of data usage, and visited networks can already claim inflated numbers. (i.e. it isn't a problem.) > [BA] I was looking for something simpler, such as a mechanism that > would enable checking of a ERX auth exchange with the home server > against subsequent accounting records sent by the local ERX server. > For example, if the peer were to use ERX to tell the home server what > local domain it is in, then the home server could ensure that it only > accepts accounting records from that domain, and no other ones. Since ERX is not for intra-domain handovers, I think it's best to leave this as a requirement on the visited AAA server, as below: > [BA] That would be fine too, as long as the home server knows what > visited network the accounting data is supposed to come from. The accounting stream is tied to the original EAP authentication, which must carry information about the visited domain. This information doesn't have to be generated by the NAS. It can be generated by the visited domain, or by server (proxy/home) that accepts AAA traffic from the visited domain. Alan DeKok. _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From eap-bounces+eap-archive=lists.ietf.org@frascone.com Fri Mar 14 05:00:16 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EACB93A6F11 for ; Fri, 14 Mar 2008 05:00:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.068 X-Spam-Level: X-Spam-Status: No, score=-1.068 tagged_above=-999 required=5 tests=[AWL=1.030, BAYES_00=-2.599, HTML_MESSAGE=0.001, RAZOR2_CHECK=0.5] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DXstrkU2k1gJ for ; Fri, 14 Mar 2008 05:00:15 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id EB19F28C37E for ; Fri, 14 Mar 2008 05:00:15 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 0451B322B632 for ; Fri, 14 Mar 2008 04:57:59 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 372CA4A4037 for ; Fri, 14 Mar 2008 04:57:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id E830C322B533 for ; Fri, 14 Mar 2008 04:57:36 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 262C4322A9A3 for ; Fri, 14 Mar 2008 04:57:35 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from blu139-omc2-s24.blu139.hotmail.com (blu139-omc2-s24.blu139.hotmail.com [65.55.175.194]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Fri, 14 Mar 2008 04:57:34 -0700 (PDT) Received: from BLU137-W53 ([65.55.162.185]) by blu139-omc2-s24.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 14 Mar 2008 04:57:34 -0700 Message-ID: X-Originating-IP: [130.129.20.161] From: Bernard Aboba To: Alan DeKok Date: Fri, 14 Mar 2008 04:57:33 -0700 Importance: Normal In-Reply-To: <47DA4AE5.8050009@deployingradius.com> References: <47D8ED8A.8000403@deployingradius.com> <47D9416A.8000709@deployingradius.com> <47DA4AE5.8050009@deployingradius.com> MIME-Version: 1.0 X-OriginalArrivalTime: 14 Mar 2008 11:57:34.0112 (UTC) FILETIME=[96DEA200:01C885CA] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0362523527==" Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com --===============0362523527== Content-Type: multipart/alternative; boundary="_87a1e66f-8fdd-4385-a35c-fcdc94aa87da_" --_87a1e66f-8fdd-4385-a35c-fcdc94aa87da_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable > Since we assume only one accounting stream from visited AAA to home > AAA, the fraud issue is limited. Most networks bill on the basis of > time, and one stream can't have multiple start/stop times. Other > networks bill on the basis of data usage, and visited networks can > already claim inflated numbers. (i.e. it isn't a problem.) [BA] By a "stream" you mean Accounting-Requests from a single NAS, right? As the user moves between NASes, Accounting-Requests will be generated, with Start/Stop to mark the beginning and end of a session on a particular NAS.=20 > Since ERX is not for intra-domain handovers, I think it's best to > leave this as a requirement on the visited AAA server, as below: [BA] So with ERX it is necessary to do a full EAP authentication every tim= e a peer enters a new domain? I guess that this is a consequence of not being able to assume EMSK caching within the AAA server.=20 =20 > The accounting stream is tied to the original EAP authentication, > which must carry information about the visited domain. =20 [BA] How is information about the visited domain encoded by the NAS? =20 Looking at the document, it appears that the DSRK can be requested by any ERX proxy along the path. Does the AAA server assume that whatever ERX proxy has submitted the request is valid before delivering the key? Or is there information provided by the NAS that it is supposed to check against? For example, does it do a reverse PTR RR query on the NAS-IP-Address Attribute and check that the proxy submitting the DSRK request is within the same domain?=20 --_87a1e66f-8fdd-4385-a35c-fcdc94aa87da_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable > Since we assume only one accounting stream from visited AAA to home<= br>> AAA, the fraud issue is limited. Most networks bill on the basis o= f
> time, and one stream can't have multiple start/stop times. Other=
> networks bill on the basis of data usage, and visited networks can=
> already claim inflated numbers. (i.e. it isn't a problem.)
[BA] By a "stream" you mean Accounting-Requests from a single NAS, right?<= br>As the user moves between NASes, Accounting-Requests will be generated,<= br>with Start/Stop to mark the beginning and end of a session on a particul= ar
NAS.

> Since ERX is not for intra-domain handovers, I th= ink it's best to
> leave this as a requirement on the visited AAA ser= ver, as below:

[BA]  So with ERX it is necessary to do a full E= AP authentication every time
a peer enters a new domain? I guess that th= is is a consequence of not
being able to assume EMSK caching within the = AAA server.
 
> The accounting stream is tied to the origi= nal EAP authentication,
> which must carry information about the visi= ted domain.

[BA] How is information about the visited domain encod= ed by the NAS? 
Looking at the document, it appears that the DSRK = can be requested
by any ERX proxy along the path.  Does the AAA ser= ver assume that
whatever ERX proxy has submitted the request is valid be= fore delivering
the key? Or is there information provided by the NAS tha= t it is supposed
to check against?  For example, does it do a rever= se PTR RR query
on the NAS-IP-Address Attribute and check that the proxy= submitting
the DSRK request is within the same domain?
= --_87a1e66f-8fdd-4385-a35c-fcdc94aa87da_-- --===============0362523527== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap --===============0362523527==-- From eap-bounces+eap-archive=lists.ietf.org@frascone.com Fri Mar 14 05:34:38 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 843813A6F46 for ; Fri, 14 Mar 2008 05:34:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[AWL=0.849, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E1nUE-SdTtxX for ; Fri, 14 Mar 2008 05:34:37 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id AA8053A6F42 for ; Fri, 14 Mar 2008 05:34:37 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id E6C5B433CCE for ; Fri, 14 Mar 2008 05:32:20 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 9406E4A4037 for ; Fri, 14 Mar 2008 05:32:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 485E4322B5D8 for ; Fri, 14 Mar 2008 05:32:12 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id C5F44322B511 for ; Fri, 14 Mar 2008 05:32:10 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from deployingradius.com (www.deployingradius.com [216.240.42.17]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Fri, 14 Mar 2008 05:32:09 -0700 (PDT) Received: from [10.0.1.49] (alexander.quiconnect.net [213.30.156.62]) by deployingradius.com (Postfix) with ESMTP id DCCAAA704E; Fri, 14 Mar 2008 05:32:06 -0700 (PDT) Message-ID: <47DA6F7B.4030302@deployingradius.com> Date: Fri, 14 Mar 2008 13:28:43 +0100 From: Alan DeKok User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: Bernard Aboba References: <47D8ED8A.8000403@deployingradius.com> <47D9416A.8000709@deployingradius.com> <47DA4AE5.8050009@deployingradius.com> In-Reply-To: X-Enigmail-Version: 0.95.0 X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, 'eap-WG' Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Bernard Aboba wrote: > [BA] By a "stream" you mean Accounting-Requests from a single NAS, right? Yes and no. From the point of view of the home server, there is *one* user login. This *should* translate into one accounting stream. Which NAS(es) generate that stream is a separate issue. > As the user moves between NASes, Accounting-Requests will be generated, > with Start/Stop to mark the beginning and end of a session on a particular > NAS. Yes. These packets go through the visited AAA server, which talks to the visited ERX server. That visited AAA server SHOULD be made responsible for reconciling accounting streams from disparate NASes in it's local network. > [BA] So with ERX it is necessary to do a full EAP authentication every time > a peer enters a new domain? I guess that this is a consequence of not > being able to assume EMSK caching within the AAA server. That's my interpretation of what was said in Hokey. >> The accounting stream is tied to the original EAP authentication, >> which must carry information about the visited domain. > > [BA] How is information about the visited domain encoded by the NAS? It doesn't need to be. The proxy knows about the visited domain, and can add that information to the AAA packet stream. This may require policy changes on those proxies, and maybe a new AAA attribute. But it won't require code changes. > Looking at the document, it appears that the DSRK can be requested > by any ERX proxy along the path. Yes. I'm not sure I understand that part. If the visited domain implements ERX, it can terminate the ERX requests. If it doesn't implement ERX, then it can't proxy those requests. i.e. the only thing that makes sense to me is that the ERX proxies (if any) are all within the visited domain. > Does the AAA server assume that > whatever ERX proxy has submitted the request is valid before delivering > the key? Or is there information provided by the NAS that it is supposed > to check against? For example, does it do a reverse PTR RR query > on the NAS-IP-Address Attribute and check that the proxy submitting > the DSRK request is within the same domain? Not really sure... Alan DeKok. _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From eap-bounces+eap-archive=lists.ietf.org@frascone.com Fri Mar 14 09:15:41 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AFF473A6F41 for ; Fri, 14 Mar 2008 09:15:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vTk3s5tYJdeX for ; Fri, 14 Mar 2008 09:15:36 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id 74BA43A6AB4 for ; Fri, 14 Mar 2008 09:15:36 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id C015419AD8A5 for ; Fri, 14 Mar 2008 09:13:19 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id F13434A4037 for ; Fri, 14 Mar 2008 09:12:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id C6C941C402FD for ; Fri, 14 Mar 2008 09:12:47 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id CF8EF1C40456 for ; Fri, 14 Mar 2008 09:12:45 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from toshi17.tari.toshiba.com (mgw.toshibaamericaresearch.com [165.254.55.12]) by hermes.tigertech.net (Postfix) with ESMTP for ; Fri, 14 Mar 2008 09:12:44 -0700 (PDT) Received: from steelhead.localdomain (tarij-98.tari.toshiba.com [172.30.24.201] (may be forged)) by toshi17.tari.toshiba.com (8.13.1/8.13.1) with ESMTP id m2EGCglj022116; Fri, 14 Mar 2008 11:12:42 -0500 (EST) (envelope-from yohba@tari.toshiba.com) Received: from ohba by steelhead.localdomain with local (Exim 4.69) (envelope-from ) id 1JaCWQ-0003LD-Ct; Fri, 14 Mar 2008 12:12:42 -0400 Date: Fri, 14 Mar 2008 12:12:42 -0400 From: Yoshihiro Ohba To: Lakshminath Dondeti Message-ID: <20080314161242.GA11981@steelhead.localdomain> References: <47D8C000.4080504@qualcomm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <47D8C000.4080504@qualcomm.com> User-Agent: Mutt/1.5.17+20080114 (2008-01-14) X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: Bernard_Aboba@hotmail.com, Tim Polk , 'eap-WG' , radiusext@ops.ietf.org, hokey@ietf.org Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com On Wed, Mar 12, 2008 at 10:47:44PM -0700, Lakshminath Dondeti wrote: > Hi Bernard, > > Thank you for clearly explaining the problem. I appreciate it. I have > even read Acct-Multi-Session-Id thing now and I wonder perhaps it makes > sense to tie the "domain" definition to that attribute. I am not sure how this can solve the problem. How this provides an evidence that the peer has requested DSRK? Yoshihiro Ohba > > Let me try to respond to your notes below: > > On 3/12/2008 2:43 PM, Bernard_Aboba@hotmail.com wrote: > > During the HOKEY WG meeting today we got into a discussion of > > fraud protection and potential issues relating to that within ERX. > > > > Since I mentioned the fraud issue in my O&M review, and > > since this issue has been brought up by other reviewers > > as well as in Sam's DISCUSS, I thought I'd send a more > > detailed description of my perception of the problem to the list, > > in order to fully describe what I think the issue is, and how > > it has been introduced. > > > > At its core, I believe that the problem has been created > > by the introduction of a short cut that in practice will > > provide little in the way of handoff latency reduction, > > namely the piggybacking of DSRK provisioning on the initial > > EAP authentication (e.g. EAP boostrapping). > > Again, thanks for pointing out the specific issue here. It is very helpful. > > > > > The shortcut is immaterial to performance because the additional > > latency involved in providing proper peer authorization > > for DSRK provisioning would be amortized across the > > user's connection time within the new domain and thus > > would not constitute a burden. > > The shortcut helps. After full EAP authentication, the next AP the peer > attaches to (we don't know how fast the handover happens) would have to > run ERP bootstrapping exchange instead of ERP with the local ER server. > We should avoid that when possible. Implicit bootstrapping is a > SHOULD. Implicit bootstrapping is also possible only if the peer can > learn the domain name from the authenticator. Thus, there is a way for > the peer and the server to establish that they are communicating with > entities that advertise the same domain name. Now as long as we require > all acct records from the same domain to use the Acct-Multi-Session-Id, > we would have mitigated the fraud. > > thanks, > Lakshminath > > > > > This optimization is problematic from > > a security perspective because it not only enables new > > avenues for fraud when ERX is used, but it also negatively > > affects the security of EAP as it is currently deployed, by > > providing keying material to an entity that the EAP peer > > has not authorized, and may not even be familiar with, > > even when the peer does not support ERX. > > > > How has the use of EAP boostrapping within the ERX design > > introduced new avenues for fraud? > > > > There are several properties of AAA protocols that are very > > useful for automated anti-fraud protection: > > > > 1. Correlation of Accounting Records to a corresponding > > authentication record; > > > > 2. Linkage of authentication records to a user whose > > authentication can be verified (and is immune to replay). > > > > Property 1 is provided by the Class Attribute, which can > > be provided within an Access-Accept and subsequently echoed > > to an Accounting-Start, as well as via the Acct-Multi-Session > > Attribute, which can be used to correlate Accounting-Start > > packets issued within a single session of a user handing > > off between access points. > > > > Property 2 is provided by the requirement that a RADIUS > > Access-Request provide either a State Attribute, > > user authentication attributes or other evidence > > that demonstrates that the Access-Request > > represents an interaction with a user that at one > > point was demonstrated to be live (e.g. not a replay). > > > > Properties 1 and 2 together limit the opportunities > > for fraud. While it is possible for an operator to > > "imbelish" accounting records for valid sessions, > > potentially expanding the charges, it is typically not > > possible to invent sessions to which fictious > > charges can then be attached. > > > > The difference may seem subtle, but in practice, it > > is important. As an analogy, it is the > > difference between being overcharged for a purchase > > that you did make, and having an unknown item show up on > > your credit card that was purchased at an unfamiliar > > location. > > > > To date, fast handoff proposals (such as 11r) have > > stretched, but not broken the anti-fraud protections > > provided by AAA protocols: > > > > 1. While the user may move between authenticators, > > migration of the authorization parameters between > > authenticators has enabled correlation of accounting > > records both with each other (e.g. same > > Multi-Session-Id) and with the corresponding > > authentication record (via the Class Attribute). > > > > 2. While the fast handoffs do not generate > > authentication attempts for each new authenticator, > > accounting records can only originate from the > > administrative domain within which the original > > authentication attempt occurred. > > > > For example, within IEEE 802.11r, the user may > > only successfully complete a fast BSS transition > > within the Mobility Domain. As a result, if > > the home accounting server were to receive an > > Accounting-Start from a different Mobility Domain > > that did not correspond to an authentication attempt > > originating from within that Mobility Domain, then the > > Accounting-Start can be flagged as fraudulent. > > > > What has ERX done with EAP boostrapping that is so > > different from existing schemes? > > > > As I see it, the fundamental problem is that EAP > > boostrapping changes the AAA protocol model in a > > fundamental way by allowing an ERX server on the > > path to request a key, without providing proof > > that the user authorized that key request, thereby > > bypassing AAA protocol anti-fraud protections. > > > > As it stands, the ERX-13 document does not specify > > checks that the AAA server should perform before > > issuing the requested DSRK. For example, the > > ERX server need not necessarily be only a single > > hop from the AAA server, and thus may not be > > authenticated to the AAA server, violating > > the requirements of RFC 4962. If the ERX > > server is allowed to exist multiple hops from > > the AAA server, this also implies that the ERX > > server need not necessarily exist within > > the local domain which the user has connected > > to. > > > > The result of this is that a home AAA server > > providing a DSRK to an ERX server via EAP > > boostrapping will not necessarily be able > > to link accounting records received from > > that server to the original EAP authentication, > > or to a subsequent ERX authentication > > terminating at the home server. > > > > What can be done to address the problems? > > The most satisfying solution from a security > > perspective would be to eliminate the piggybacking > > of DSRK provisioning on top of legacy EAP > > exchanges. Providing an explicit request > > from the peer to the server for provisioning > > of the DSRK would provide the server with > > proof of client liveness within the domain > > which subsequently will issue accounting > > records, closing the fraud loophole, as well as > > removing the RFC 4962 "authenicate all > > parties" problem, and any security impact > > on legacy EAP deployments. > > > > Another potential approach would be to > > introduce authorization checks on the > > AAA server. For example, the AAA server > > could require that the ERX server be > > only one hop away, thereby addressing > > the "authenticate the parties" issue. > > Also, the ERX server could now be > > guaranteed to be in the same domain > > as the user, limiting the potential > > for fraud to roughly the same magnitude > > as existing fast handoff proposals > > such as 11r. > > > > > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > HOKEY mailing list > > HOKEY@ietf.org > > https://www.ietf.org/mailman/listinfo/hokey > _________________________________________________________________ > To unsubscribe or modify your subscription options, please visit: > http://lists.frascone.com/mailman/listinfo/eap > > Arhives: http://lists.frascone.com/pipermail/eap > _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From eap-bounces+eap-archive=lists.ietf.org@frascone.com Sun Mar 16 15:33:37 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCB723A6A97 for ; Sun, 16 Mar 2008 15:33:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.487 X-Spam-Level: X-Spam-Status: No, score=-1.487 tagged_above=-999 required=5 tests=[AWL=1.112, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MCHXIB8hqqjS for ; Sun, 16 Mar 2008 15:33:35 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id 7DBFB3A6E1F for ; Sun, 16 Mar 2008 15:31:35 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id DEB5B1C40F15 for ; Sun, 16 Mar 2008 15:19:47 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by fry.tigertech.net (Postfix) with ESMTP id 98F6F4A4037 for ; Sun, 16 Mar 2008 15:19:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 1F3694304CC for ; Sun, 16 Mar 2008 15:19:35 -0700 (PDT) Received: from hermes.tigertech.net (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id B3B481C407AC for ; Sun, 16 Mar 2008 15:19:33 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from mail.arubanetworks.com (mail.arubanetworks.com [216.31.249.253]) by hermes.tigertech.net (Postfix) with SMTP for ; Sun, 16 Mar 2008 15:19:32 -0700 (PDT) Received: from aruba-mx1.arubanetworks.com ([10.1.1.17]) by mail.arubanetworks.com with Microsoft SMTPSVC(6.0.3790.3959); Sun, 16 Mar 2008 15:19:31 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Sun, 16 Mar 2008 15:19:31 -0700 Message-ID: In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [HOKEY] ERX fraud issue Thread-Index: AciEihE4elMOL53rRHWrrzAwVW0zxAC9h3sA References: From: "Glen Zorn" To: X-OriginalArrivalTime: 16 Mar 2008 22:19:31.0990 (UTC) FILETIME=[CEE26B60:01C887B3] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: hokey@ietf.org, radiusext@ops.ietf.org, eap-WG Subject: Re: [eap] [HOKEY] ERX fraud issue X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com Bernard_Aboba@hotmail.com <> scribbled on Wednesday, March 12, 2008 5:43 PM: > During the HOKEY WG meeting today we got into a discussion of > fraud protection and potential issues relating to that within ERX. > > Since I mentioned the fraud issue in my O&M review, and since > this issue has been brought up by other reviewers as well as > in Sam's DISCUSS, I thought I'd send a more detailed > description of my perception of the problem to the list, in > order to fully describe what I think the issue is, and how it > has been introduced. > > At its core, I believe that the problem has been created by > the introduction of a short cut that in practice will provide > little in the way of handoff latency reduction, namely the > piggybacking of DSRK provisioning on the initial EAP > authentication (e.g. EAP boostrapping). > > The shortcut is immaterial to performance because the > additional latency involved in providing proper peer > authorization for DSRK provisioning would be amortized across > the user's connection time within the new domain and thus > would not constitute a burden. This assertion seems to rely upon two assumptions. The first is that the users connection time will necessarily be significantly longer than the hand-over latency (true for 802.11 if the user is walking, more problematic if the user is inside (or _is_) a moving vehicle. The second (and more obviously) false assumption is that the absolute length of time taken by a hand-over is irrelevant because it will be "amortized across the user's (sic) connection time". Leaving aside the questionable concepts of time mortgages (is there a time bank? I want to borrow a couple of hundred years ;-) connection time divination (how do you know that the _future_ connection time will be long enough to "amortize" anything?), this implies that it is only the ratio of hand-over latency to connection time that is important. If the connection time is 6 months, is it OK for hand-over to take 10 minutes? Obviously not, but that's what you seem to be saying... > > This optimization is problematic from > a security perspective because it not only enables new avenues > for fraud when ERX is used, but it also negatively affects the > security of EAP as it is currently deployed, by providing > keying material to an entity that the EAP peer has not > authorized, and may not even be familiar with, even when the > peer does not support ERX. > > How has the use of EAP boostrapping within the ERX design > introduced new avenues for fraud? > > There are several properties of AAA protocols that are very > useful for automated anti-fraud protection: I find it difficult to reconcile the descriptions given below with any known definition of the term "property", most especially with the definition that seems to be implied, that of a quality that is inherently present in another thing (see further comments on the individual 'properties'). > > 1. Correlation of Accounting Records to a corresponding > authentication record; > > 2. Linkage of authentication records to a user whose > authentication can be verified (and is immune to replay). > > Property 1 is provided by the Class Attribute, which can be > provided within an Access-Accept and subsequently echoed to an > Accounting-Start, This is what RFC 2865 says about the Class attribute: 5.25. Class Description This Attribute is available to be sent by the server to the client in an Access-Accept and SHOULD be sent unmodified by the client to the accounting server as part of the Accounting-Request packet if accounting is supported. The client MUST NOT interpret the attribute locally. A summary of the Class Attribute format is shown below. The fields are transmitted from left to right. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | Type | Length | String ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Type 25 for Class. Length >= 3 String The String field is one or more octets. The actual format of the information is site or application specific, and a robust implementation SHOULD support the field as undistinguished octets. The codification of the range of allowed usage of this field is outside the scope of this specification. There is just one more thing that RFC 2865 mention WRT this attribute: it is listed as optional in Access-Accept messages but in an interesting way: zero or more are allowed. RFC 2866 says this about the Class attribute: "A forwarding server MUST not modify existing Proxy-State or Class attributes present in the packet." It also allows zero or more Class attributes in Accounting-Request packets. Neither RFC 3579 nor RFC 3748 even mention the Class attribute, nor does the Internet-Draft describing the RADIUS design guidelines. So one of the attributes upon which the property in question depends appears to be a) practically speaking undefined and b) strictly optional. This begs the question: Where does this 'property of AAA protocols' come from? It's one thing to claim that AAA protocols _should_ have certain properties, but entirely another to claim that they already do: for the latter, one would imagine that some supporting evidence would need to be present in the relevant standards but that doesn't appear to be the case. > as well as via the Acct-Multi-Session > Attribute, which can be used to correlate Accounting-Start > packets issued within a single session of a user handing off between > access points. Leaving aside the technical problems with using an attribute intended for usage with multilink PPP to track hand-offs, we need to ask how the various access points obtain the correct value for the Acct-Multi-Session-Id attribute and why those same techniques would be unusable with hokey. BTW, while the Acct-Multi-Session-Id attribute is considerably more completely defined than the Class attribute (at least in the context of its intended usage with MLPP), it, too, is completely optional & more than one may be included in an Accounting-Request. > > Property 2 is provided by the requirement that a RADIUS > Access-Request provide either a State Attribute, user > authentication attributes or other evidence that demonstrates > that the Access-Request represents an interaction with a user > that at one point was demonstrated to be live (e.g. not a replay). > > Properties 1 and 2 together limit the opportunities for fraud. > While it is possible for an operator to "imbelish" accounting > records for valid sessions, potentially expanding the charges, > it is typically not possible to invent sessions to which > fictious charges can then be attached. Since Property 1 has been shown to be non-existent (at least as a "property of AAA protocols") and Property 2 essentially does nothing to prohibit the invention of new accounting sessions from whole cloth, this is quite simply nonsense. If you want to standardize the usage of the Class attribute to provide the behavior you want, please try, but don't claim that it already exists without any backup from at least some RFC. ... > > What has ERX done with EAP boostrapping that is so different > from existing schemes? > > As I see it, the fundamental problem is that EAP boostrapping > changes the AAA protocol model in a fundamental way by > allowing an ERX server on the path to request a key, without > providing proof that the user authorized that key request, > thereby bypassing AAA protocol anti-fraud protections. And now, for something completely different ;-). Since the user is _always_ unaware of the very existence of AAA (let alone the particular attributes in a AAA message or the keys requested in it), how, exactly does the AAA protocol provide "proof that the user authorized" _any_ key request? ... _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From nirgaytonajyl@gaytona.com Mon Mar 17 08:48:40 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D75C228C433; Mon, 17 Mar 2008 08:48:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.577 X-Spam-Level: *** X-Spam-Status: No, score=3.577 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_IP_ADDR=1.119, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EhjIuEMuXZlI; Mon, 17 Mar 2008 08:48:40 -0700 (PDT) Received: from [41.249.35.48] (unknown [41.249.35.48]) by core3.amsl.com (Postfix) with ESMTP id 2F15A28C41E; Mon, 17 Mar 2008 08:48:38 -0700 (PDT) Received: from [41.249.35.48] by mxvm2.mail.yahoo.com; Mon, 17 Mar 2008 15:46:22 +0000 Date: Mon, 17 Mar 2008 15:46:22 +0000 From: "Bryant Donovan" X-Mailer: The Bat! (v3.81.14 Beta) Home Reply-To: nirgaytonajyl@gaytona.com X-Priority: 3 (Normal) Message-ID: <019189189.43180575374607@gaytona.com> To: dinaras@ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------888FB2525252C6E" ------------888FB2525252C6E Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Our purpose is to render PC and Macintosh legal software and computer solutions of low cost for anyone's budget. Whether you're a corporate buyer, a holder of small-scale enterprise, or shopping for your own PC, we believe we'll assist you. HERE IS A LIST OF OUR SOFTWARE! http://lindseywiseuo726.blogspot.com ------------888FB2525252C6E Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Our purpose is to render PC and Macintosh legal software and computer solutions of low cost for anyone's budget.
Whether you're a corporate buyer, a holder of small-scale enterprise,
or shopping for your own PC, we believe we'll assist you.
HERE IS A LIST OF OUR SOFTWARE!
http://lindseywiseuo726.blogspot.com
------------888FB2525252C6E-- From kchetram@att.com Wed Mar 19 11:39:04 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B68963A69A9 for ; Wed, 19 Mar 2008 11:39:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -19.345 X-Spam-Level: X-Spam-Status: No, score=-19.345 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, FH_RELAY_NODNS=1.451, HELO_EQ_DYNAMIC=1.144, HELO_EQ_TR=0.935, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sSHMsPhk-TeD for ; Wed, 19 Mar 2008 11:39:03 -0700 (PDT) Received: from dsl.dynamic85968039.ttnet.net.tr (unknown [85.96.80.39]) by core3.amsl.com (Postfix) with ESMTP id 6A61C3A68FA for ; Wed, 19 Mar 2008 11:39:03 -0700 (PDT) Message-ID: <000801c889f0$05e40eb6$dda2e7ae@bpmrww> From: "hewitt keshav" To: "Imelda Reeves" Subject: Unique Gift Ideas Date: Wed, 19 Mar 2008 16:49:25 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Find great holiday gift... Quality watches at affordable price. All top brands! http://stipedeyshh.com/ From BertreaganZimmerman@foodnetwork.com Wed Mar 19 12:12:13 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B826528C3A5; Wed, 19 Mar 2008 12:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.583 X-Spam-Level: X-Spam-Status: No, score=-15.583 tagged_above=-999 required=5 tests=[BAYES_99=3.5, BODY_ENHANCEMENT2=0.001, HELO_LH_HOME=3.714, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, SARE_ADULT2=1.42, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eticrVAL-GNp; Wed, 19 Mar 2008 12:12:10 -0700 (PDT) Received: from homepc.home (Z805f.z.pppool.de [89.61.128.95]) by core3.amsl.com (Postfix) with SMTP id D99E128C3E1; Wed, 19 Mar 2008 12:12:08 -0700 (PDT) Received: from 16946114368836690.19424853491202565.16109252230003735.12859895101411168 (HELO localhost.localdomain) (19152516910273330.14410599833783593.12990937768702741.19091910717998132) by 18345677820798349.16886264249535131.17988809756005156.14225589329025322 with SMTP; Wed, 19 Mar 2008 20:09:32 -0100 Date: Wed, 19 Mar 2008 20:09:32 -0100 Message-Id: <1IX863EJXVWDA738@foodnetwork.com> X-Mailer: MIME::Lite 3.01 (F2.72; A1.62; B3.01; Q3.01) X-Header-CompanyDBUserName: hpccm X-Header-MasterId: 380113 X-Header-Versions: Hewlett-Packard.3t5bn1nd8.fk@us.newsgram.hp.com X-FID: 58E88DBC-6544-45AF-B8E4-84CDEA58DCB7 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Cc: , , , From: "Erick Roy" Subject: Gain 3+ Inches In Length. 3.5" Penis Enlargement in weeks. See my pictures as proof. http://Beenboisters.com/ From eap-bounces+eap-archive=lists.ietf.org@frascone.com Wed Mar 19 15:51:00 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 815813A6C86 for ; Wed, 19 Mar 2008 15:51:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.523 X-Spam-Level: X-Spam-Status: No, score=-2.523 tagged_above=-999 required=5 tests=[AWL=0.076, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eZj1AE8uXtHA for ; Wed, 19 Mar 2008 15:50:56 -0700 (PDT) Received: from mx2.tigertech.net (mx2.tigertech.net [64.62.209.32]) by core3.amsl.com (Postfix) with ESMTP id 2982C3A6A24 for ; Wed, 19 Mar 2008 15:50:56 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hermes.tigertech.net (Postfix) with ESMTP id 329EF1C40E7C for ; Wed, 19 Mar 2008 15:48:39 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by fry.tigertech.net (Postfix) with ESMTP id 767654A403E for ; Wed, 19 Mar 2008 15:48:31 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 460D7322B409 for ; Wed, 19 Mar 2008 15:48:31 -0700 (PDT) Received: from hgblob.tigertech.net (localhost [127.0.0.1]) by hgblob.tigertech.net (Postfix) with ESMTP id 4CB3B322837A for ; Wed, 19 Mar 2008 15:48:30 -0700 (PDT) X-TigerTech-Content-Filter: Clean X-TigerTech-Spam-Status: Level 1 (Low); Accepted (Neutral) Received: from smtp.piuha.net (p130.piuha.net [193.234.218.130]) by hgblob.tigertech.net (Postfix) with ESMTP for ; Wed, 19 Mar 2008 15:48:29 -0700 (PDT) Received: from smtp.piuha.net (localhost [127.0.0.1]) by smtp.piuha.net (Postfix) with ESMTP id 4F44119875F; Thu, 20 Mar 2008 00:48:24 +0200 (EET) Received: from [127.0.0.1] (unknown [IPv6:2001:14b8:400::130]) by smtp.piuha.net (Postfix) with ESMTP id E6B4219866E; Thu, 20 Mar 2008 00:48:23 +0200 (EET) Message-ID: <47E19837.3060508@piuha.net> Date: Thu, 20 Mar 2008 00:48:23 +0200 From: Jari Arkko User-Agent: Thunderbird 1.5.0.14ubu (X11/20080306) MIME-Version: 1.0 To: ietf@ietf.org References: <20080319221403.66CF03A6A62@core3.amsl.com> In-Reply-To: <20080319221403.66CF03A6A62@core3.amsl.com> X-Virus-Scanned: ClamAV using ClamSMTP X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at tigertech.net Cc: emu@ietf.org, eap-WG Subject: Re: [eap] Last Call: draft-funk-eap-ttls-v0 (EAP Tunneled TLS Authentication Protocol Version 0 (EAP-TTLSv0)) to Informational RFC X-BeenThere: eap@frascone.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Discussion list for EAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: eap-bounces+eap-archive=lists.ietf.org@frascone.com > The IESG has received a request from an individual submitter to consider > the following document: > > - 'EAP Tunneled TLS Authentication Protocol Version 0 (EAP-TTLSv0) ' > as an Informational RFC > > The IESG plans to make a decision in the next few weeks, and solicits > final comments on this action. Please send substantive comments to the > ietf@ietf.org mailing lists by 2008-04-16. Exceptionally, > comments may be sent to iesg@ietf.org instead. In either case, please > retain the beginning of the Subject line to allow automated sorting. > Some additional background is needed here. This document is being AD sponsored to Informational RFC. The document describes what the widely deployed EAP TTLS protocol does. The specification should be as accurate representation of the deployed implementations as possible, including its limitations, which in some cases are rather severe (lack of crypto binding etc). Last call comments are solicited in particular from people who have implemented this and can spot deviations between implementations and this spec. Comments are also solicited from the security community in an effort to be as accurate about the security properties of this method as possible. We are publishing this in an effort to document existing EAP protocol mechanisms. Previously, a large fraction of all deployed EAP usage ran on vendor-specific, undocumented, or poor/outdated/unstable specifications. Many such methods were introduced prior to the adoption of the new IANA rules in RFC 3748. At this time, high-quality standards track specifications for EAP methods are also expected to come out of the EMU WG. It is my belief that the EAP user community will benefit from the documentation of both of these categories of methods. Jari _________________________________________________________________ To unsubscribe or modify your subscription options, please visit: http://lists.frascone.com/mailman/listinfo/eap Arhives: http://lists.frascone.com/pipermail/eap From jrhaas@att.com Thu Mar 20 15:47:56 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDF733A6C63 for ; Thu, 20 Mar 2008 15:47:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -30.72 X-Spam-Level: X-Spam-Status: No, score=-30.72 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, FH_HELO_EQ_D_D_D_D=1.597, FH_RELAY_NODNS=1.451, GB_ROLEX=5, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_TELESP=1.245, HELO_MISMATCH_BR=2.4, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RDNS_NONE=0.1, SARE_RECV_SPAM_DOMN02=1.666, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uwXmKZCR0vkZ for ; Thu, 20 Mar 2008 15:47:56 -0700 (PDT) Received: from 189-78-141-52.dsl.telesp.net.br (unknown [189.78.141.52]) by core3.amsl.com (Postfix) with ESMTP id 51A033A69EE for ; Thu, 20 Mar 2008 15:47:31 -0700 (PDT) Message-ID: <000a01c88adc$05fee24e$a97d0fa2@pmvye> From: "joseph percival" To: Subject: Perfectly crafted luxury timepieces Date: Thu, 20 Mar 2008 20:58:05 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C88ADC.05F93559" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C88ADC.05F93559 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Prestige replicas Most popular watches Rolex Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob & Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design =20 Most popular TIFFANY & CO. JEWERLY Tiffany & CO Bracelets=95Tiffany & CO = Necklace=95Tiffany & CO Earings Most popular PENS Mont Blanc Ballpoint=95Louis Vuitton Rollerball=95St Dupont = Fountain=95Mont Blanc Rollerball=95Gucci Roller=95St Dupont = Ballpoint=95Louis Vuitton Ballpoint=95St Dupont Roller Click here =20 ------=_NextPart_000_0007_01C88ADC.05F93559 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Prestige
replicas

Most=20 popular watches

Rolex=20 Datejusts=95Cartier=95Hublot=95Panerai=95Rolex Sports = Models=95Chanel=95Jacob &=20 Co=95Patek=95Philippe=95Alain = Silberstein=95Chopard=95Jaeger=95LeCoutrePorsche=95Design=20

Most popular=20 TIFFANY & CO. JEWERLY

Tiffany & CO=20 Bracelets=95Tiffany & CO Necklace=95Tiffany & CO = Earings

Most popular=20 PENS

Mont Blanc=20 Ballpoint=95Louis Vuitton Rollerball=95St Dupont Fountain=95Mont = Blanc=20 Rollerball=95Gucci Roller=95St Dupont Ballpoint=95Louis Vuitton = Ballpoint=95St=20 Dupont Roller

Click here=20
------=_NextPart_000_0007_01C88ADC.05F93559-- From jr.stewart@ieee.org Thu Mar 20 23:32:43 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2600A3A6BCF for ; Thu, 20 Mar 2008 23:32:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -39.407 X-Spam-Level: X-Spam-Status: No, score=-39.407 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DATE_IN_FUTURE_03_06=0.274, FB_WITHOUT_PRESC=2.998, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, HTML_MESSAGE=0.001, INVALID_DATE=1.245, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, SARE_ADULT2=1.42, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XXl97eV0wioH for ; Thu, 20 Mar 2008 23:32:41 -0700 (PDT) Received: from semi.org (unknown [121.247.65.249]) by core3.amsl.com (Postfix) with SMTP id 92B333A6978 for ; Thu, 20 Mar 2008 23:32:38 -0700 (PDT) Received: from 140.98.193.224 (HELO hormel.ieee.org) by lists.ietf.org with ESMTP (TIBQWXBCABP NXLSK) id DCTdJG-PyUFIG-Sl for eap-archive@lists.ietf.org; Fri, 21 Mar 2008 12:00:21 +06-30 Message-ID: From: "Tracey Morin" To: "Eliseo Gillespie" Subject: My friends pressured me into it. Date: Fri, 21 Mar 2008 12:00:21 +06-30 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_44876_AFB6_01C88B4B.238843C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 This is a multi-part message in MIME format. ------=_NextPart_44876_AFB6_01C88B4B.238843C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable WonderCum Doubles, Triples, Quadruples and MORE! =2E=2E=2E not just volume of ejaculate, but intensity and power of orgas= ms=2E "IT WILL ABSOLUTELY BLOW YOUR MIND" Get it now without a prescription http://enoughisten.com/ ------=_NextPart_44876_AFB6_01C88B4B.238843C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
WonderCum Double= s, Triples, Quadruples and MORE!
=2E=2E=2E not just volume of ejaculate, but intensity and power of orgas= ms=2E
"IT WILL ABSOLUTELY BLOW YOUR MIND"
Get it now without a prescription http://enoughisten=2Ecom/ ------=_NextPart_44876_AFB6_01C88B4B.238843C0-- From CesarquinceAguilar@craigslist.org Fri Mar 21 13:15:11 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EBD5128C1C5; Fri, 21 Mar 2008 13:15:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -18.312 X-Spam-Level: X-Spam-Status: No, score=-18.312 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_DK=1.009, HOST_EQ_BROADBND=1.118, MONEY_BACK=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RJjv2fbYWT+L; Fri, 21 Mar 2008 13:15:11 -0700 (PDT) Received: from dit228a265386a.opasia.dk (0x5737303e.nfnqu2.broadband.tele.dk [87.55.48.62]) by core3.amsl.com (Postfix) with SMTP id 16E923A6BCD; Fri, 21 Mar 2008 13:15:09 -0700 (PDT) Received: from 10714875466722654.15904983184387914.19963039538634839.11896967216556537 (HELO localhost.localdomain) (10884976438865034.14053664908542318.12801312740834083.12286984568209567) by 15898412280162486.19661921296035508.11816333755313280.14668621319482355 with SMTP; Fri, 21 Mar 2008 21:12:31 -0100 Date: Fri, 21 Mar 2008 21:12:31 -0100 Message-Id: <1IX306EJXVWDA633@craigslist.org> X-Mailer: MIME::Lite 3.01 (F2.72; A1.62; B3.01; Q3.01) X-Header-CompanyDBUserName: hpccm X-Header-MasterId: 324243 X-Header-Versions: Hewlett-Packard.9t8bn9nd7.fk@us.newsgram.hp.com X-FID: 87E68DBC-9328-23AF-B4E1-92CDEA68DCB2 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: , , , , From: "Blake Stevenson" Subject: 100% Money Back Guarantee. Gain An Amazing 1 to 3 full Inches... See my pictures as proof!!! http://Mevelatones.com/ From Service@Amazon.com Sat Mar 22 16:40:43 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B705E3A69AD for ; Sat, 22 Mar 2008 16:40:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -86.031 X-Spam-Level: X-Spam-Status: No, score=-86.031 tagged_above=-999 required=5 tests=[AV:HTML.Phishing.Auction-44=0.1, AWL=-0.126, BAYES_50=0.001, FH_HOST_EQ_D_D_D_D=0.765, FORGED_MUA_OUTLOOK=3.116, FORGED_OUTLOOK_HTML=0.001, FORGED_OUTLOOK_TAGS=0.001, HELO_MISMATCH_COM=0.553, HOST_EQ_STATICB=1.372, HOST_MISMATCH_NET=0.311, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, SARE_FORGED_AMAZON=3, SARE_UN7=0.917, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmsiiYRcdLOP for ; Sat, 22 Mar 2008 16:40:43 -0700 (PDT) Received: from klamp-fs1.local.klamplaw.com (static-70-21-120-23.res.east.verizon.net [70.21.120.23]) by core3.amsl.com (Postfix) with ESMTP id 85CBC3A6B90 for ; Sat, 22 Mar 2008 16:40:31 -0700 (PDT) Received: from User ([64.219.187.65]) by klamp-fs1.local.klamplaw.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 22 Mar 2008 19:38:12 -0400 Reply-To: From: "Service@Amazon.com" Subject: Account Restriction Date: Sat, 22 Mar 2008 18:36:17 -0500 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-ID: X-OriginalArrivalTime: 22 Mar 2008 23:38:12.0679 (UTC) FILETIME=[CB1CE570:01C88C75] X-TM-AS-Product-Ver: SMEX-7.5.0.1243-5.0.1023-15804.001 X-TM-AS-Result: No-1.075100-5.000000-31 X-TM-AS-User-Approved-Sender: No X-TM-AS-User-Blocked-Sender: No To: undisclosed-recipients:; amazon.com Update Dear Amazon Member:

Due to recent account takeovers and unauthorized listings, Amazon is introducing a new account verification method. From time to time, randomly selected accounts are subjected to an advanced verification process based on our merchant accounts/bank relations and customer debit card.
Your account is not suspended, but if in 48 hours after you receive this message your account is not confirmed, we reserve the right to suspend you Amazon registration.
amazone is committed to assist law enforcement with any inquires related to attempts to misappropiate personal information with the intent to commit fraud or theft.

To confirm your identity with us click here.
Please do not respond to this confirmation e-mail.

Sincerely,
amazon Online Services. From alomp@att.com Sat Mar 22 17:36:32 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 553713A6B8E for ; Sat, 22 Mar 2008 17:36:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -44.711 X-Spam-Level: X-Spam-Status: No, score=-44.711 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, HELO_EQ_DSL=1.129, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NbFYkdYB-vjc for ; Sat, 22 Mar 2008 17:36:31 -0700 (PDT) Received: from evk200.neoplus.adsl.tpnet.pl (evk200.neoplus.adsl.tpnet.pl [83.20.208.200]) by core3.amsl.com (Postfix) with ESMTP id 8BAD13A69BD for ; Sat, 22 Mar 2008 17:36:28 -0700 (PDT) Message-ID: <000701c88c7d$05a282f9$226106a5@mghdqp> From: "berkeley larry" To: "Dallas Jamison" Subject: Creative Gifts Date: Sat, 22 Mar 2008 22:46:43 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Find great holiday gift... Quality watches at affordable price. All top brands! http://volaressawoke.com/ From kyvintrowheelsdez@introwheels.com Tue Mar 25 07:46:38 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93F3428C443; Tue, 25 Mar 2008 07:46:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.577 X-Spam-Level: *** X-Spam-Status: No, score=3.577 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_IP_ADDR=1.119, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GkXDcEgPnxSR; Tue, 25 Mar 2008 07:46:37 -0700 (PDT) Received: from [85.110.148.86] (unknown [85.110.148.86]) by core3.amsl.com (Postfix) with ESMTP id C3EBD28C173; Tue, 25 Mar 2008 07:46:36 -0700 (PDT) Received: from [85.110.148.86] by mail.introwheels.com; Tue, 25 Mar 2008 16:44:18 +0200 Date: Tue, 25 Mar 2008 16:44:18 +0200 From: "Ward Fontenot" X-Mailer: The Bat! (v2.00.0) Business Reply-To: kyvintrowheelsdez@introwheels.com X-Priority: 3 (Normal) Message-ID: <307006749.79296983886231@introwheels.com> To: dinaras@ietf.org Subject: Legal software sales MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------C4092CBD3AE1DAE" ------------C4092CBD3AE1DAE Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Our purpose is to guarantee low cost PC and Macintosh lawful soft and computer solutions for anyone's budget. Whether you're a corporate client, an owner of small business, or go shopping for your own personal computer, we suppose that we will help you. VIEW WHAT WE HAVE TO PROPOSE! http://josefalynkko879.blogspot.com ------------C4092CBD3AE1DAE Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Our purpose is to guarantee low cost PC and Macintosh lawful soft and computer solutions for anyone's budget.
Whether you're a corporate client, an owner of small business,
or go shopping for your own personal computer, we suppose that we will help you.
VIEW WHAT WE HAVE TO PROPOSE!
http://josefalynkko879.blogspot.com
------------C4092CBD3AE1DAE-- From bk@suse.de Sat Mar 29 14:21:53 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C90A3A6CF6 for ; Sat, 29 Mar 2008 14:21:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.123 X-Spam-Level: X-Spam-Status: No, score=-7.123 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DOS_OE_TO_MX=2.75, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RDNS_DYNAMIC=0.1, SARE_SPEC_REPLICA_OBFU=1.812, SARE_SPEC_ROLEX_NOV5A=1.062, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id msen4WgJ3csn for ; Sat, 29 Mar 2008 14:21:52 -0700 (PDT) Received: from ip-89-168-75-181.cust.homechoice.net (ip-89-168-75-181.cust.homechoice.net [89.168.75.181]) by core3.amsl.com (Postfix) with ESMTP id AFBF528C3DB for ; Sat, 29 Mar 2008 14:21:34 -0700 (PDT) Message-ID: <000601c891e2$078444ea$c865e0ac@cdtalo> From: "Cartier Watches" To: "Replicae" Subject: My watch arrived today Date: Sat, 29 Mar 2008 19:33:54 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C891E2.0783B5A7" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C891E2.0783B5A7 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable NEW WATCH SHOP! The time is NOW to get YOUR replica watches that are famous around the = world.=20 These affordable imitations make you look rich at a fraction of the = cost.=20 Choose from any of the following replica watches=20 AUDEMARS PIGUET, EBERHARD and CO, BAUME and MERCIER, BREITLING,=20 BVLGARI, CARTIER, CHOPARD, FRANK MULLER, IWC, PANERAI, PATEK PHILIPPE,=20 TAG HEUER, TECHNOMARINE AND VACHERON. Enter our shop! ------=_NextPart_000_0003_01C891E2.0783B5A7 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

NEW WATCH SHOP!

The time is NOW to get YOUR = replica watches that are famous around the world.
These affordable = imitations make you look rich at a fraction of the cost.
Choose = from any of the following replica watches
AUDEMARS PIGUET, = EBERHARD and CO, BAUME and MERCIER, BREITLING,
BVLGARI, CARTIER, = CHOPARD, FRANK MULLER, IWC, PANERAI, PATEK PHILIPPE,
TAG HEUER, = TECHNOMARINE AND VACHERON.

Enter our = shop!

------=_NextPart_000_0003_01C891E2.0783B5A7-- From xml-bounces+eap-archive=lists.ietf.org@frascone.com Tue Apr 1 05:58:07 2008 Return-Path: X-Original-To: ietfarch-eap-archive@core3.amsl.com Delivered-To: ietfarch-eap-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 14CE728CAB2 for ; Tue, 1 Apr 2008 05:58:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[AWL=-0.745, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i2rfUxVA5pcE for ; Tue, 1 Apr 2008 05:58:06 -0700 (PDT) Received: from mx1.tigertech.net (mx1.tigertech.net [64.62.209.31]) by core3.amsl.com (Postfix) with ESMTP id C53E128C8F0 for ; Tue, 1 Apr 2008 05:30:45 -0700 (PDT) Received: from fry.tigertech.net (fry.tigertech.net [64.62.209.19]) by hgblob.tigertech.net (Postfix) with ESMTP id 4279B322B452 for ; Tue, 1 Apr 2008 05:30:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: frascone.com mailing list memberships reminder From: xml-owner@frascone.com X-No-Archive: yes Message-ID: Date: Tue, 01 Apr 2008 05:30:27 -0700 Precedence: bulk X-BeenThere: xml@frascone.com X-Mailman-Version: 2.1.9 List-Id: Diameter XML Dictionary Design Team List -- CLOSED -- ARCHIVES ONLY X-List-Administrivia: yes To: eap-archive@lists.ietf.org Errors-To: xml-bounces+eap-archive=lists.ietf.org@frascone.com This is a monthly reminder about your frascone.com mailing list memberships. It shows the lists you are subscribed to, your passwords, and a Web page URL you can use to manage your subscriptions. Visit the Web page URL shown below to unsubscribe, change your e-mail address, temporarily disable your subscription for a vacation, set digest-style delivery, and so on. You can also use e-mail to make changes. For more info, send a message to the '-request' address of the list (for example, xml-request@frascone.com) containing just the word 'help' in the message body. An e-mail message will be sent to you with instructions. Here is the subscription information for eap-archive@lists.ietf.org: List Password // URL ---- -------- eap@frascone.com bibeos http://lists.frascone.com/mailman/options/eap/eap-archive%40lists.ietf.org