From aland@deployingradius.com Tue May 1 03:41:59 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E59EA21F875B for ; Tue, 1 May 2012 03:41:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.292 X-Spam-Level: X-Spam-Status: No, score=-102.292 tagged_above=-999 required=5 tests=[AWL=0.307, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W0Ex69iIB2Qq for ; Tue, 1 May 2012 03:41:58 -0700 (PDT) Received: from liberty.deployingradius.com (liberty.deployingradius.com [88.191.76.128]) by ietfa.amsl.com (Postfix) with ESMTP id EA47F21F875A for ; Tue, 1 May 2012 03:41:57 -0700 (PDT) Message-ID: <4F9FBDD8.2090203@deployingradius.com> Date: Tue, 01 May 2012 12:41:28 +0200 From: Alan DeKok User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228) MIME-Version: 1.0 To: Sam Hartman References: In-Reply-To: X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: emu@ietf.org Subject: Re: [Emu] draft-ietf-emu-chbind and username X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2012 10:41:59 -0000 Sam Hartman wrote: > I'd like to take a step back and ask why you'd ever want to channel-bind > user-name in the first place? I guess the theory is that your EAP > method supports channel binding but does not have a well-defined concept > of peer ID or support identity protection/transporting method-specific > identity? I think that situation isn't widely used. > My proposal is that we stop recommending channel binding to user-name > rather than documenting the issues associated with doing so. I would document why channel binding User-Name is a bad idea. Or, why it's useful only in certain limited circumstances. Alan DeKok. From hartmans@painless-security.com Tue May 1 05:25:20 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C1BB21F8A54 for ; Tue, 1 May 2012 05:25:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.264 X-Spam-Level: X-Spam-Status: No, score=-2.264 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wz8KDQ-Xan77 for ; Tue, 1 May 2012 05:25:20 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 0163221F8A0C for ; Tue, 1 May 2012 05:25:19 -0700 (PDT) Received: from [25.154.127.194] (md02436d0.tmodns.net [208.54.36.208]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by mail.suchdamage.org (Postfix) with ESMTPSA id BDDA9201CB; Tue, 1 May 2012 08:21:15 -0400 (EDT) References: <4F9FBDD8.2090203@deployingradius.com> User-Agent: K-9 Mail for Android In-Reply-To: <4F9FBDD8.2090203@deployingradius.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----D2UMZ76ULENER4S2MIQZ9CUQO8TGBY" From: Sam Hartman Date: Tue, 01 May 2012 08:24:49 -0400 To: Alan DeKok , Sam Hartman Message-ID: <2cf30dad-3181-49be-824f-e96b5bb7e816@email.android.com> X-Mailman-Approved-At: Tue, 01 May 2012 08:02:04 -0700 Cc: emu@ietf.org Subject: Re: [Emu] draft-ietf-emu-chbind and username X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2012 12:25:20 -0000 ------D2UMZ76ULENER4S2MIQZ9CUQO8TGBY Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I have no problemdocumenting why we do not do so as an example of privacy in sec cons -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. Alan DeKok wrote: Sam Hartman wrote: > I'd like to take a step back and ask why you'd ever want to channel-bind > user-name in the first place? I guess the theory is that your EAP > method supports channel binding but does not have a well-defined concept > of peer ID or support identity protection/transporting method-specific > identity? I think that situation isn't widely used. > My proposal is that we stop recommending channel binding to user-name > rather than documenting the issues associated with doing so. I would document why channel binding User-Name is a bad idea. Or, why it's useful only in certain limited circumstances. Alan DeKok. ------D2UMZ76ULENER4S2MIQZ9CUQO8TGBY Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit I have no problemdocumenting why we do not do so as an example of privacy in sec cons
--
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

Alan DeKok <aland@deployingradius.com> wrote:
Sam Hartman wrote:
> I'd like to take a step back and ask why you'd ever want to channel-bind
> user-name in the first place?  I guess the theory is that your EAP
> method supports channel binding but does not have a well-defined concept
> of peer ID or support identity protection/transporting method-specific
> identity?

  I think that situation isn't widely used.

> My proposal is that we stop recommending channel binding to user-name
> rather than documenting the issues associated with doing so.

  I would document why channel binding User-Name is a bad idea.  Or, why
it's useful only in certain limited circumstances.

  Alan DeKok.

------D2UMZ76ULENER4S2MIQZ9CUQO8TGBY-- From internet-drafts@ietf.org Mon May 14 12:06:43 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 023F621F890C; Mon, 14 May 2012 12:06:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.521 X-Spam-Level: X-Spam-Status: No, score=-102.521 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KSZfZ6dMvN3w; Mon, 14 May 2012 12:06:42 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E4EF21F88BD; Mon, 14 May 2012 12:06:42 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.02 Message-ID: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> Date: Mon, 14 May 2012 12:06:42 -0700 Cc: emu@ietf.org Subject: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 19:06:43 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the EAP Method Update Working Group of th= e IETF. Title : Channel Binding Support for EAP Methods Author(s) : Sam Hartman T. Charles Clancy Katrin Hoeper Filename : draft-ietf-emu-chbind-15.txt Pages : 33 Date : 2012-05-14 This document defines how to implement channel bindings for Extensible Authentication Protocol (EAP) methods to address the lying Network Access Service (NAS) as well as the lying provider problem. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-emu-chbind-15.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-emu-chbind-15.txt The IETF datatracker page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-emu-chbind/ From hartmans@mit.edu Mon May 14 12:10:45 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 807F321F889D for ; Mon, 14 May 2012 12:10:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.98 X-Spam-Level: X-Spam-Status: No, score=-101.98 tagged_above=-999 required=5 tests=[AWL=-1.204, BAYES_05=-1.11, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a5Nq6TPHOmRE for ; Mon, 14 May 2012 12:10:45 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 1643B21F889B for ; Mon, 14 May 2012 12:10:45 -0700 (PDT) Received: from carter-zimmerman.suchdamage.org (carter-zimmerman.suchdamage.org [69.25.196.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 96C7D203C0 for ; Mon, 14 May 2012 15:06:28 -0400 (EDT) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id C5F4644B4; Mon, 14 May 2012 15:10:25 -0400 (EDT) From: Sam Hartman To: emu@ietf.org Cc: References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> Date: Mon, 14 May 2012 15:10:25 -0400 In-Reply-To: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> (internet-drafts@ietf.org's message of "Mon, 14 May 2012 12:06:42 -0700") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 19:10:45 -0000 This version includes a large number of changes mostly to respond to the secdir review. I'm not entirely sure that Stephen Hanna will be happy with the changes in section 9, but I'd like to start there and see where we are. I think it's a good idea for WG members to review these changes. From jsalowey@cisco.com Tue May 15 07:59:30 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D609921F8936 for ; Tue, 15 May 2012 07:59:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tm00bWTW-1LN for ; Tue, 15 May 2012 07:59:30 -0700 (PDT) Received: from mtv-iport-2.cisco.com (mtv-iport-2.cisco.com [173.36.130.13]) by ietfa.amsl.com (Postfix) with ESMTP id 411E421F889C for ; Tue, 15 May 2012 07:59:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=jsalowey@cisco.com; l=566; q=dns/txt; s=iport; t=1337093970; x=1338303570; h=subject:mime-version:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=gNIBtdNgtWhi9dPAhAzlSOJTdaijlHUmsNkZCzjmGI0=; b=QqAcwV5wXox+9glqWWdzCY4CSaQMzoKRXSIRlxo+7ihY7F+ulFjbmh2W DshgGtuF4Zpmlct8vXVWjkVQExLk3B8nHf2bLCjWfpkZdy6uoHA46OppA ijnd3/PiZ/p/VME/mA4ITguXiPg1WqcxEvS9KEtJF4MdZB2PPgHsylJBA Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AjYFAGBusk+rRDoH/2dsb2JhbABEgx6wW4EHghUBAQEDAQEBAQ8BJzQLEAtGJzAZIodnBAyaZaAVBIscglqCQ2MEiGSNGYV1iGKBaYMJ X-IronPort-AV: E=Sophos;i="4.75,595,1330905600"; d="scan'208";a="44874463" Received: from mtv-core-2.cisco.com ([171.68.58.7]) by mtv-iport-2.cisco.com with ESMTP; 15 May 2012 14:59:30 +0000 Received: from [10.33.251.111] ([10.33.251.111]) by mtv-core-2.cisco.com (8.14.3/8.14.3) with ESMTP id q4FExTBl026014; Tue, 15 May 2012 14:59:29 GMT Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Joe Salowey In-Reply-To: Date: Tue, 15 May 2012 07:59:32 -0700 Content-Transfer-Encoding: 7bit Message-Id: References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> To: emu@ietf.org X-Mailer: Apple Mail (2.1084) Cc: Sam Hartman Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 May 2012 14:59:31 -0000 Please respond on the list by May 25, 2012. Thanks, Joe On May 14, 2012, at 12:10 PM, Sam Hartman wrote: > > > This version includes a large number of changes mostly to respond to the > secdir review. > > I'm not entirely sure that Stephen Hanna will be happy with the changes > in section 9, but I'd like to start there and see where we are. I think > it's a good idea for WG members to review these changes. > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu From zhou.sujing@zte.com.cn Tue May 15 19:00:44 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7450D21F86F0; Tue, 15 May 2012 19:00:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -95.82 X-Spam-Level: X-Spam-Status: No, score=-95.82 tagged_above=-999 required=5 tests=[AWL=-0.599, BAYES_40=-0.185, HTML_MESSAGE=0.001, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lPbMbB5mDSbL; Tue, 15 May 2012 19:00:43 -0700 (PDT) Received: from mx5.zte.com.cn (mx6.zte.com.cn [95.130.199.165]) by ietfa.amsl.com (Postfix) with ESMTP id BA42121F86F1; Tue, 15 May 2012 19:00:42 -0700 (PDT) Received: from [10.30.17.100] by mx5.zte.com.cn with surfront esmtp id 286202676637534; Wed, 16 May 2012 09:16:33 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.16] with StormMail ESMTP id 84044.5059664521; Wed, 16 May 2012 10:00:25 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q4G20LI1077737; Wed, 16 May 2012 10:00:21 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Joe Salowey MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Wed, 16 May 2012 10:00:13 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-16 10:00:22, Serialize complete at 2012-05-16 10:00:22 Content-Type: multipart/alternative; boundary="=_alternative 000B0DD048257A00_=" X-MAIL: mse01.zte.com.cn q4G20LI1077737 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 May 2012 02:00:44 -0000 This is a multipart message in MIME format. --=_alternative 000B0DD048257A00_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 SGmjrGFsbA0KDQogSW4gc2VjdGlvbiA5LjEgo6wgobBPbmUgYXR0cmFjdGl2ZSBpbXBsZW1lbnRh dGlvbiBzdHJhdGVneSBmb3IgY2hhbm5lbCANCmJpbmRpbmcgaXMgdG8gYWRkDQogICBjaGFubmVs IGJpbmRpbmcgc3VwcG9ydCB0byBhIHR1bm5lbCBtZXRob2Qgd2hpY2ggY2FuIHR1bm5lbCBhbiBp bm5lcg0KICAgRUFQIGF1dGhlbnRpY2F0aW9uLqGxd2FzIGV4cGVjdGVkIHRvIGludHJvZHVjaW5n IGltcGxlbWVudGluZyBjaGFubmVsIA0KYmluZGluZyBvbiB0dW5uZWwsDQogIGJ1dCB3YXMgc3Vk ZGVuIHRvIHR1cm4gdG8gY3J5cHRvZ3JhcGhpYyBiaW5kaW5nIGJ5ICIiIFR1bm5lbCBtZXRob2Rz IA0Kc29tZXRpbWVzIHVzZQ0KICAgY3J5cHRvZ3JhcGhpYyBiaW5kaW5nLCIgYW5kIGJlZ2FuIG9u IHdlYWtuZXNzIG9mIHR1bm5lbCBtZXRob2Qgd2l0aCANCmNyeXB0b2dyYXBoaWMgYmluZGluZywN CiAgIGVzcGVjaWFsbHkgb24gYSBzcGVjaWZpYyAob3IgdHlwaWNhbCkgaW1wbGVtZW50YXRpb24g d2l0aCBNU0suDQoNCiBJbiBteSBvcGluaW9uLCB0aGVzZSBhcmUgdHdvIGRpZmZlcmVudCB0b3Bp YywgYmV0dGVyIGluIHNlcGFyYXRlIA0KcGFyYWdyYWdoczsNCiBhbmQgdGhlIGZpcnN0IHRvcGlj IG5lZWRzIHNvbWUgZXhwbGFuYXRpb24sIHByb3MgYW5kIGNvbnMsIHdoeSBub3QgYWRvcHQgDQp0 aGF0IGltcGxlbWVudGF0aW9uIA0Kc2luY2UgaXQgaXMgYXR0cmFjdGl2ZS4NCg0KDQpBbHNvLCBv biB0dW5uZWwgbWV0aG9kIHdpdGggY2hhbm5lbCBiaW5kaW5nLCBJIHRoaW5rIHRoZXJlIGlzIHNv bWUgcG9pbnQgDQp1bmNsZWFyLg0KDQpBY2NvcmRpbmcgdG8NCg0Kc2VjdGlvbiAgNC4yICJUaGUg Y2hhbm5lbCBiaW5kaW5ncyBNVVNUIGJlIHRyYW5zcG9ydGVkIHdpdGggaW50ZWdyaXR5IA0KcHJv dGVjdGlvbg0KICAgYmFzZWQgb24gYSBrZXkga25vd24gb25seSB0byB0aGUgcGVlciBhbmQgRUFQ IHNlcnZlci4gIiANCnNlY3Rpb24gNiAgIlRoZSBjaGFubmVsIGJpbmRpbmcgcHJvdG9jb2wgZGVm aW5lZCBpbiB0aGlzIGRvY3VtZW50IG11c3QgYmUgDQp0cmFuc3BvcnRlZCANCmFmdGVyIGtleWlu ZyBtYXRlcmlhbCBoYXMgYmVlbiBkZXJpdmVkIGJldHdlZW4gdGhlIEVBUCBwZWVyIGFuZCBzZXJ2 ZXIsIA0KYW5kIGJlZm9yZSB0aGUgcGVlciB3b3VsZCANCnN1ZmZlciBhZHZlcnNlIGFmZmVjdHMg ZnJvbSBqb2luaW5nIGFuIGFkdmVyc2FyaWFsIG5ldHdvcmsuIg0KDQpUbyBteSB1bmRlcnN0YW5k aW5nLCBjaGFubmVsIGJpbmRpbmcgZXhjaGFuZ2UgaGFwcGVucyANCmFmdGVyIGEgTVNLIGlzIGRl cml2ZWQgIGJldHdlZW4gRUFQIHBlZXIgYW5kIEVBUCBzZXJ2ZXIsDQphbmQgYmVmb3JlIE1TSyBp cyB0cmFuc3BvcnRlZCB0byBhdXRoZW50aWNhdG9yLiANCg0KSWYgbm90LCBmb3IgZXhhbXBsZSwg YWZ0ZXIgTVNLIGlzIHRyYW5zcG9ydGVkIHRvIGF1dGhlbnRpY2F0b3IsDQpvZiBjb3Vyc2UgIGF1 dGhlbnRpY2F0b3IgY2FuIGNvbnRyb2wgdGhlIGNoYW5uZWwgYmluZGluZyBleGNoYW5nZS4NCg0K SSB0aGluayB0aGF0IGlzIHdoeSB0aGUgRUFQIGNyeXB0b2dyYWhpYyBiaW5kaW5nIGRyYWZ0IHdh cyBwdXQgZm9yd2FyZC4NCklmIGl0IGlzIG1hZGUgY2xlYXIgYW5kIE1VU1QgdGhhdCAiIE1TSyB0 cmFuc3BvcnRhdGlvbiB0byBhdXRoZW50aWNhdG9yIiANCmhhcHBlbnMgDQphZnRlciBjaGFubmVs IGJpbmRpbmcgZXhjaGFuZ2UgZmluaXNoZXMsIEkgZG9uJ3QgdGhpbmsgYW4gZXh0cmEgY3J5cHRv IA0KYmluZGluZyBpcyBuZWNlc3NhcnkuDQoNCmFuZCB0byBtYWtlIGl0IGNsZWFyo6wgSSBzdWdn ZXN0IEVBUCBzZXJ2ZXIgdHJhbnNwb3J0IE1TSyBhZnRlciBpdCBoYXMgDQpvYnRhaW5lZCBleHBs aWNpdCByZXNwb25zZSANCmZyb20gRUFQIHBlZXIgdG8gYXV0aG9yaXplIHRoZSBhY3Rpb24uDQoN Cg0KDQoNClJlZ2FyZHN+fn4NCg0KLVNvcGhpYSwgU3VqaW5nIFpob3UNCg0KDQoNCkpvZSBTYWxv d2V5IDxqc2Fsb3dleUBjaXNjby5jb20+IA0Kt6K8/sjLOiAgZW11LWJvdW5jZXNAaWV0Zi5vcmcN CjIwMTItMDUtMTUgMjI6NTkNCg0KytW8/sjLDQplbXVAaWV0Zi5vcmcNCrOty80NClNhbSBIYXJ0 bWFuIDxoYXJ0bWFucy1pZXRmQG1pdC5lZHU+DQrW98ziDQpSZTogW0VtdV0gSS1EIEFjdGlvbjog ZHJhZnQtaWV0Zi1lbXUtY2hiaW5kLTE1LnR4dA0KDQoNCg0KDQoNCg0KUGxlYXNlIHJlc3BvbmQg b24gdGhlIGxpc3QgYnkgTWF5IDI1LCAyMDEyLg0KDQpUaGFua3MsDQoNCkpvZQ0KDQpPbiBNYXkg MTQsIDIwMTIsIGF0IDEyOjEwIFBNLCBTYW0gSGFydG1hbiB3cm90ZToNCg0KPiANCj4gDQo+IFRo aXMgdmVyc2lvbiBpbmNsdWRlcyBhIGxhcmdlIG51bWJlciBvZiBjaGFuZ2VzIG1vc3RseSB0byBy ZXNwb25kIHRvIHRoZQ0KPiBzZWNkaXIgcmV2aWV3Lg0KPiANCj4gSSdtIG5vdCBlbnRpcmVseSBz dXJlIHRoYXQgU3RlcGhlbiBIYW5uYSB3aWxsIGJlIGhhcHB5IHdpdGggdGhlIGNoYW5nZXMNCj4g aW4gc2VjdGlvbiA5LCBidXQgSSdkIGxpa2UgdG8gc3RhcnQgdGhlcmUgYW5kIHNlZSB3aGVyZSB3 ZSBhcmUuICBJIHRoaW5rDQo+IGl0J3MgYSBnb29kIGlkZWEgZm9yIFdHIG1lbWJlcnMgdG8gcmV2 aWV3IHRoZXNlIGNoYW5nZXMuDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+IEVtdSBtYWlsaW5nIGxpc3QNCj4gRW11QGlldGYub3JnDQo+IGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQoNCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpFbXUgbWFpbGluZyBsaXN0DQpFbXVAaWV0 Zi5vcmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZW11DQoNCg0KDQo= --=_alternative 000B0DD048257A00_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkhpo6xhbGw8L2ZvbnQ+DQo8YnI+ DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwO0luIHNlY3Rpb24gOS4x IKOsIKGwT25lIGF0dHJhY3RpdmUNCmltcGxlbWVudGF0aW9uIHN0cmF0ZWd5IGZvciBjaGFubmVs IGJpbmRpbmcgaXMgdG8gYWRkPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNl cmlmIj4mbmJzcDsgJm5ic3A7Y2hhbm5lbCBiaW5kaW5nIHN1cHBvcnQNCnRvIGEgdHVubmVsIG1l dGhvZCB3aGljaCBjYW4gdHVubmVsIGFuIGlubmVyPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBm YWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7RUFQIGF1dGhlbnRpY2F0aW9uLqGxd2FzDQpl eHBlY3RlZCB0byBpbnRyb2R1Y2luZyBpbXBsZW1lbnRpbmcgY2hhbm5lbCBiaW5kaW5nIG9uIHR1 bm5lbCw8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwOyBi dXQgd2FzIHN1ZGRlbiB0byB0dXJuIHRvIGNyeXB0b2dyYXBoaWMNCmJpbmRpbmcgYnkgJnF1b3Q7 JnF1b3Q7IFR1bm5lbCBtZXRob2RzIHNvbWV0aW1lcyB1c2U8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6 ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwOyAmbmJzcDtjcnlwdG9ncmFwaGljIGJpbmRpbmcs JnF1b3Q7DQphbmQgYmVnYW4gb24gd2Vha25lc3Mgb2YgdHVubmVsIG1ldGhvZCB3aXRoIGNyeXB0 b2dyYXBoaWMgYmluZGluZyw8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2Vy aWYiPiZuYnNwOyAmbmJzcDtlc3BlY2lhbGx5IG9uIGEgc3BlY2lmaWMNCihvciB0eXBpY2FsKSBp bXBsZW1lbnRhdGlvbiB3aXRoIE1TSy48L2ZvbnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yIGZh Y2U9InNhbnMtc2VyaWYiPiZuYnNwO0luIG15IG9waW5pb24sIHRoZXNlIGFyZSB0d28gZGlmZmVy ZW50DQp0b3BpYywgYmV0dGVyIGluIHNlcGFyYXRlIHBhcmFncmFnaHM7PC9mb250Pg0KPGJyPjxm b250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDthbmQgdGhlIGZpcnN0IHRvcGljIG5l ZWRzIHNvbWUNCmV4cGxhbmF0aW9uLCBwcm9zIGFuZCBjb25zLCB3aHkgbm90IGFkb3B0IHRoYXQg aW1wbGVtZW50YXRpb24gJm5ic3A7PC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5z LXNlcmlmIj5zaW5jZSBpdCBpcyBhdHRyYWN0aXZlLjwvZm9udD4NCjxicj4NCjxicj4NCjxicj48 Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+QWxzbywgb24gdHVubmVsIG1ldGhvZCB3aXRo IGNoYW5uZWwNCmJpbmRpbmcsIEkgdGhpbmsgdGhlcmUgaXMgc29tZSBwb2ludCB1bmNsZWFyLjwv Zm9udD4NCjxicj4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+QWNjb3JkaW5n IHRvPC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj5zZWN0 aW9uICZuYnNwOzQuMiAmcXVvdDtUaGUgY2hhbm5lbA0KYmluZGluZ3MgTVVTVCBiZSB0cmFuc3Bv cnRlZCB3aXRoIGludGVncml0eSBwcm90ZWN0aW9uPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBm YWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7YmFzZWQgb24gYSBrZXkga25vd24gb25seQ0K dG8gdGhlIHBlZXIgYW5kIEVBUCBzZXJ2ZXIuICZxdW90OyA8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6 ZT0yIGZhY2U9InNhbnMtc2VyaWYiPnNlY3Rpb24gNiAmbmJzcDsmcXVvdDtUaGUgY2hhbm5lbCBi aW5kaW5nDQpwcm90b2NvbCBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQgbXVzdCBiZSB0cmFuc3Bv cnRlZCA8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPmFmdGVyIGtl eWluZyBtYXRlcmlhbCBoYXMgYmVlbiBkZXJpdmVkDQpiZXR3ZWVuIHRoZSBFQVAgcGVlciBhbmQg c2VydmVyLCBhbmQgYmVmb3JlIHRoZSBwZWVyIHdvdWxkIDwvZm9udD4NCjxicj48Zm9udCBzaXpl PTIgZmFjZT0ic2Fucy1zZXJpZiI+c3VmZmVyIGFkdmVyc2UgYWZmZWN0cyBmcm9tIGpvaW5pbmcN CmFuIGFkdmVyc2FyaWFsIG5ldHdvcmsuJnF1b3Q7PC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNp emU9MiBmYWNlPSJzYW5zLXNlcmlmIj5UbyBteSB1bmRlcnN0YW5kaW5nLCBjaGFubmVsIGJpbmRp bmcNCmV4Y2hhbmdlIGhhcHBlbnMgPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5z LXNlcmlmIj5hZnRlciBhIE1TSyBpcyBkZXJpdmVkICZuYnNwO2JldHdlZW4NCkVBUCBwZWVyIGFu ZCBFQVAgc2VydmVyLDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+ YW5kIGJlZm9yZSBNU0sgaXMgdHJhbnNwb3J0ZWQgdG8gYXV0aGVudGljYXRvci4NCjwvZm9udD4N Cjxicj4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+SWYgbm90LCBmb3IgZXhh bXBsZSwgYWZ0ZXIgTVNLIGlzIHRyYW5zcG9ydGVkDQp0byBhdXRoZW50aWNhdG9yLDwvZm9udD4N Cjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+b2YgY291cnNlICZuYnNwO2F1dGhl bnRpY2F0b3IgY2FuIGNvbnRyb2wNCnRoZSBjaGFubmVsIGJpbmRpbmcgZXhjaGFuZ2UuPC9mb250 Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj5JIHRoaW5rIHRoYXQg aXMgd2h5IHRoZSBFQVAgY3J5cHRvZ3JhaGljDQpiaW5kaW5nIGRyYWZ0IHdhcyBwdXQgZm9yd2Fy ZC48L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPklmIGl0IGlzIG1h ZGUgY2xlYXIgYW5kIE1VU1QgdGhhdCAmcXVvdDsNCk1TSyB0cmFuc3BvcnRhdGlvbiB0byBhdXRo ZW50aWNhdG9yJnF1b3Q7IGhhcHBlbnMgPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJz YW5zLXNlcmlmIj5hZnRlciBjaGFubmVsIGJpbmRpbmcgZXhjaGFuZ2UgZmluaXNoZXMsDQpJIGRv bid0IHRoaW5rIGFuIGV4dHJhIGNyeXB0byBiaW5kaW5nIGlzIG5lY2Vzc2FyeS48L2ZvbnQ+DQo8 YnI+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPmFuZCB0byBtYWtlIGl0IGNs ZWFyo6wgSSBzdWdnZXN0IEVBUA0Kc2VydmVyIHRyYW5zcG9ydCBNU0sgYWZ0ZXIgaXQgaGFzIG9i dGFpbmVkIGV4cGxpY2l0IHJlc3BvbnNlIDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0i c2Fucy1zZXJpZiI+ZnJvbSBFQVAgcGVlciB0byBhdXRob3JpemUgdGhlIGFjdGlvbi48L2ZvbnQ+ DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2Vy aWYiPlJlZ2FyZHN+fn48YnI+DQo8YnI+DQotU29waGlhLCBTdWppbmcgWmhvdTwvZm9udD4NCjxi cj4NCjxicj4NCjxicj4NCjx0YWJsZSB3aWR0aD0xMDAlPg0KPHRyIHZhbGlnbj10b3A+DQo8dGQg d2lkdGg9MjElPjxmb250IHNpemU9MSBmYWNlPSJzYW5zLXNlcmlmIj48Yj5Kb2UgU2Fsb3dleSAm bHQ7anNhbG93ZXlAY2lzY28uY29tJmd0OzwvYj4NCjwvZm9udD4NCjxicj48Zm9udCBzaXplPTEg ZmFjZT0ic2Fucy1zZXJpZiI+t6K8/sjLOiAmbmJzcDtlbXUtYm91bmNlc0BpZXRmLm9yZzwvZm9u dD4NCjxwPjxmb250IHNpemU9MSBmYWNlPSJzYW5zLXNlcmlmIj4yMDEyLTA1LTE1IDIyOjU5PC9m b250Pg0KPHRkIHdpZHRoPTc4JT4NCjx0YWJsZSB3aWR0aD0xMDAlPg0KPHRyIHZhbGlnbj10b3A+ DQo8dGQ+DQo8ZGl2IGFsaWduPXJpZ2h0Pjxmb250IHNpemU9MSBmYWNlPSJzYW5zLXNlcmlmIj7K 1bz+yMs8L2ZvbnQ+PC9kaXY+DQo8dGQ+PGZvbnQgc2l6ZT0xIGZhY2U9InNhbnMtc2VyaWYiPmVt dUBpZXRmLm9yZzwvZm9udD4NCjx0ciB2YWxpZ249dG9wPg0KPHRkPg0KPGRpdiBhbGlnbj1yaWdo dD48Zm9udCBzaXplPTEgZmFjZT0ic2Fucy1zZXJpZiI+s63LzTwvZm9udD48L2Rpdj4NCjx0ZD48 Zm9udCBzaXplPTEgZmFjZT0ic2Fucy1zZXJpZiI+U2FtIEhhcnRtYW4gJmx0O2hhcnRtYW5zLWll dGZAbWl0LmVkdSZndDs8L2ZvbnQ+DQo8dHIgdmFsaWduPXRvcD4NCjx0ZD4NCjxkaXYgYWxpZ249 cmlnaHQ+PGZvbnQgc2l6ZT0xIGZhY2U9InNhbnMtc2VyaWYiPtb3zOI8L2ZvbnQ+PC9kaXY+DQo8 dGQ+PGZvbnQgc2l6ZT0xIGZhY2U9InNhbnMtc2VyaWYiPlJlOiBbRW11XSBJLUQgQWN0aW9uOiBk cmFmdC1pZXRmLWVtdS1jaGJpbmQtMTUudHh0PC9mb250PjwvdGFibGU+DQo8YnI+DQo8dGFibGU+ DQo8dHIgdmFsaWduPXRvcD4NCjx0ZD4NCjx0ZD48L3RhYmxlPg0KPGJyPjwvdGFibGU+DQo8YnI+ DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5QbGVhc2UgcmVzcG9uZCBvbiB0aGUgbGlzdCBi eSBNYXkgMjUsIDIwMTIuPGJyPg0KPGJyPg0KVGhhbmtzLDxicj4NCjxicj4NCkpvZTxicj4NCjxi cj4NCk9uIE1heSAxNCwgMjAxMiwgYXQgMTI6MTAgUE0sIFNhbSBIYXJ0bWFuIHdyb3RlOjxicj4N Cjxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFRoaXMgdmVyc2lvbiBpbmNsdWRlcyBh IGxhcmdlIG51bWJlciBvZiBjaGFuZ2VzIG1vc3RseSB0byByZXNwb25kDQp0byB0aGU8YnI+DQom Z3Q7IHNlY2RpciByZXZpZXcuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEknbSBub3QgZW50aXJlbHkg c3VyZSB0aGF0IFN0ZXBoZW4gSGFubmEgd2lsbCBiZSBoYXBweSB3aXRoIHRoZSBjaGFuZ2VzPGJy Pg0KJmd0OyBpbiBzZWN0aW9uIDksIGJ1dCBJJ2QgbGlrZSB0byBzdGFydCB0aGVyZSBhbmQgc2Vl IHdoZXJlIHdlIGFyZS4gJm5ic3A7SQ0KdGhpbms8YnI+DQomZ3Q7IGl0J3MgYSBnb29kIGlkZWEg Zm9yIFdHIG1lbWJlcnMgdG8gcmV2aWV3IHRoZXNlIGNoYW5nZXMuPGJyPg0KJmd0OyBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZndDsgRW11IG1h aWxpbmcgbGlzdDxicj4NCiZndDsgRW11QGlldGYub3JnPGJyPg0KJmd0OyBodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2VtdTxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KRW11IG1haWxpbmcgbGlzdDxicj4N CkVtdUBpZXRmLm9yZzxicj4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v ZW11PGJyPg0KPGJyPg0KPC9mb250PjwvdHQ+DQo8YnI+DQo= --=_alternative 000B0DD048257A00_=-- From hartmans@mit.edu Wed May 16 05:27:01 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 165AF21F86AD; Wed, 16 May 2012 05:27:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.66 X-Spam-Level: X-Spam-Status: No, score=-102.66 tagged_above=-999 required=5 tests=[AWL=-0.395, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ztivqe6pseSh; Wed, 16 May 2012 05:27:00 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 6AA9C21F86A8; Wed, 16 May 2012 05:27:00 -0700 (PDT) Received: from carter-zimmerman.suchdamage.org (carter-zimmerman.suchdamage.org [69.25.196.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 9EC25204AB; Wed, 16 May 2012 08:22:41 -0400 (EDT) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id 16CD044B1; Wed, 16 May 2012 08:26:40 -0400 (EDT) From: Sam Hartman To: zhou.sujing@zte.com.cn References: Date: Wed, 16 May 2012 08:26:40 -0400 In-Reply-To: (zhou sujing's message of "Wed, 16 May 2012 10:00:13 +0800") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Sam Hartman , emu-bounces@ietf.org, emu@ietf.org Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 May 2012 12:27:01 -0000 >>>>> "zhou" == zhou sujing writes: zhou> Hi all zhou> In section 9.1 One attractive implementation strategy for zhou> channel binding is to add channel binding support to a tunnel zhou> method which can tunnel an inner EAP authentication. was zhou> expected to introducing implementing channel binding on zhou> tunnel, but was sudden to turn to cryptographic binding by "" zhou> Tunnel methods sometimes use cryptographic binding," and began zhou> on weakness of tunnel method with cryptographic binding, zhou> especially on a specific (or typical) implementation with MSK. zhou> In my opinion, these are two different topic, better in zhou> separate paragraghs; and the first topic needs some zhou> explanation, pros and cons, why not adopt that implementation zhou> since it is attractive. I appreciate your desire to analyze the proes and cons of of tunnel methods. I'm nervous about expanding the scope of this document to do that because I believe it would add delay. Also, I'm confused about whether a general discussion of tunnel methods and channel bindings belongs in the security considerations section of this document. The explicit structure of that paragraph was called out for WG review prior to IETF last call; also that structure was present in IETF last call. I do not wish to wait to reach consensus on general comments about proes/cons of implementing channel binding with tunnel methods prior to approval of this document. Thus I prefer the current text. zhou> Also, on tunnel method with channel binding, I think there is zhou> some point unclear. zhou> According to zhou> section 4.2 "The channel bindings MUST be transported with zhou> integrity protection based on a key known only to the peer and zhou> EAP server. " section 6 "The channel binding protocol defined zhou> in this document must be transported after keying material has zhou> been derived between the EAP peer and server, and before the zhou> peer would suffer adverse affects from joining an adversarial zhou> network." zhou> To my understanding, channel binding exchange happens after a zhou> MSK is derived between EAP peer and EAP server, and before MSK zhou> is transported to authenticator. Channel binding can happen before or after the MSK is generated, but effectively needs to happen after some key is generated. zhou> If not, for example, after MSK is transported to zhou> authenticator, of course authenticator can control the channel zhou> binding exchange. I would expect that the key used for channel binding integrity would be cryptographically independent of the MSK. I've not analyzed a method where the MSK is used for channel binding but this is done prior to transport to the authenticator. That's probably safe, but it seems like a bad design strategy because it seems needlessly fragile. So, I'd be nervous about that strategy and would recommend independent keys for channel binding. zhou> I think that is why the EAP cryptograhic binding draft was put zhou> forward. If it is made clear and MUST that " MSK zhou> transportation to authenticator" happens after channel binding zhou> exchange finishes, I don't think an extra crypto binding is zhou> necessary. I disagree. I'd ask you to take a look at the slides I presented at IETF 83. I think they are more clear than draft-hartman-emu-mutual-crypto-binding at the moment, although obviously we will update that draft in the near future to reflect your comments and those of others. zhou> and to make it clear I suggest EAP server transport MSK after zhou> it has obtained explicit response from EAP peer to authorize zhou> the action. That would be a change to existing EAP methods in some cases. That sort of change is out of scope for draft-ietf-emu-chbind. It's true that channel binding benefits from protected success indications and the current draft-ietf-emu-chbind does discuss that. From zhou.sujing@zte.com.cn Wed May 16 18:05:25 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D49511E8091; Wed, 16 May 2012 18:05:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.086 X-Spam-Level: X-Spam-Status: No, score=-96.086 tagged_above=-999 required=5 tests=[AWL=1.549, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gq8pZ97mJ4xP; Wed, 16 May 2012 18:05:24 -0700 (PDT) Received: from mx5.zte.com.cn (mx5.zte.com.cn [63.217.80.70]) by ietfa.amsl.com (Postfix) with ESMTP id CF38C11E8073; Wed, 16 May 2012 18:05:23 -0700 (PDT) Received: from [10.30.17.99] by mx5.zte.com.cn with surfront esmtp id 621292676637534; Thu, 17 May 2012 09:02:25 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.15] with StormMail ESMTP id 60658.5059664521; Thu, 17 May 2012 09:05:14 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q4H151uY053684; Thu, 17 May 2012 09:05:01 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Sam Hartman MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Thu, 17 May 2012 09:04:50 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-17 09:05:02, Serialize complete at 2012-05-17 09:05:02 Content-Type: multipart/alternative; boundary="=_alternative 0005FCBB48257A01_=" X-MAIL: mse01.zte.com.cn q4H151uY053684 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2012 01:05:25 -0000 This is a multipart message in MIME format. --=_alternative 0005FCBB48257A01_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 U2FtIEhhcnRtYW4gPGhhcnRtYW5zLWlldGZAbWl0LmVkdT4g0LTT2iAyMDEyLTA1LTE2IDIwOjI2 OjQwOg0KPiANCj4gVGhlIGV4cGxpY2l0IHN0cnVjdHVyZSBvZg0KPiB0aGF0IHBhcmFncmFwaCB3 YXMgY2FsbGVkIG91dCBmb3IgV0cgcmV2aWV3IHByaW9yIHRvIElFVEYgbGFzdCBjYWxsOw0KPiBh bHNvIHRoYXQgc3RydWN0dXJlIHdhcyBwcmVzZW50IGluIElFVEYgbGFzdCBjYWxsLiAgSSBkbyBu b3Qgd2lzaCB0bw0KPiB3YWl0IHRvIHJlYWNoIGNvbnNlbnN1cyBvbiBnZW5lcmFsIGNvbW1lbnRz IGFib3V0IHByb2VzL2NvbnMgb2YNCj4gaW1wbGVtZW50aW5nIGNoYW5uZWwgYmluZGluZyB3aXRo IHR1bm5lbCBtZXRob2RzIHByaW9yIHRvIGFwcHJvdmFsIG9mDQo+IHRoaXMgZG9jdW1lbnQuDQoN CldlbGyjrG5vIG1hdHRlciB3aGF0J3MgdGhlIHJlc3VsdCwgSSBkb24ndCBsaWtlIHRoZSBsb2dp YyBpbiB0aGUgY3VycmVudCANCnRleHQsDQppdCBpcyBub3QgY2xlYXIgYW5kIGVhc3kgdG8gY29u ZnVzaW5nIHRoZSB0d28gYmluZGluZ3MuIA0KDQo+IFRodXMgSSBwcmVmZXIgdGhlIGN1cnJlbnQg dGV4dC4NCj4gDQo+IENoYW5uZWwgYmluZGluZyBjYW4gaGFwcGVuIGJlZm9yZSBvciBhZnRlciB0 aGUgTVNLIGlzIGdlbmVyYXRlZCwgYnV0DQo+IGVmZmVjdGl2ZWx5IG5lZWRzIHRvIGhhcHBlbiBh ZnRlciBzb21lIGtleSBpcyBnZW5lcmF0ZWQuDQo+IA0KPiBJIHdvdWxkIGV4cGVjdCB0aGF0IHRo ZSBrZXkgdXNlZCBmb3IgY2hhbm5lbCBiaW5kaW5nIGludGVncml0eSB3b3VsZCBiZQ0KPiBjcnlw dG9ncmFwaGljYWxseSBpbmRlcGVuZGVudCBvZiB0aGUgTVNLLg0KPiBJJ3ZlIG5vdCBhbmFseXpl ZCBhIG1ldGhvZCB3aGVyZSB0aGUgTVNLIGlzIHVzZWQgZm9yIGNoYW5uZWwgYmluZGluZyBidXQN Cj4gdGhpcyBpcyBkb25lIHByaW9yIHRvIHRyYW5zcG9ydCB0byB0aGUgYXV0aGVudGljYXRvci4N Cj4gVGhhdCdzIHByb2JhYmx5IHNhZmUsIGJ1dCBpdCBzZWVtcyBsaWtlIGEgYmFkIGRlc2lnbiBz dHJhdGVneSBiZWNhdXNlIGl0DQo+IHNlZW1zIG5lZWRsZXNzbHkgZnJhZ2lsZS4NCj4gU28sIEkn ZCBiZSBuZXJ2b3VzIGFib3V0IHRoYXQgc3RyYXRlZ3kgYW5kIHdvdWxkIHJlY29tbWVuZCBpbmRl cGVuZGVudA0KPiBrZXlzIGZvciBjaGFubmVsIGJpbmRpbmcuDQoNCklmIHRoZXJlIGlzIGFub3Ro ZXIga2V5IGF2YWlsYWJsZSwgaXQgd2lsbCBiZSBncmVhdCwgDQpFTVNLPyBJdCBoYXMgYmVlbiBz dWdnZXN0ZWQgZm9yIGNyeXB0b2dyYXBoaWMgYmluZGluZy4NCg0KDQoNCj4gDQo+IEkgZGlzYWdy ZWUuDQo+IEknZCBhc2sgeW91IHRvIHRha2UgYSBsb29rIGF0IHRoZSBzbGlkZXMgSSBwcmVzZW50 ZWQgYXQgSUVURiA4My4gSSB0aGluaw0KPiB0aGV5IGFyZSBtb3JlIGNsZWFyIHRoYW4gZHJhZnQt aGFydG1hbi1lbXUtbXV0dWFsLWNyeXB0by1iaW5kaW5nIGF0IHRoZQ0KPiBtb21lbnQsIGFsdGhv dWdoIG9idmlvdXNseSB3ZSB3aWxsIHVwZGF0ZSB0aGF0IGRyYWZ0IGluIHRoZSBuZWFyIGZ1dHVy ZQ0KPiB0byByZWZsZWN0IHlvdXIgY29tbWVudHMgYW5kIHRob3NlIG9mIG90aGVycy4NCg0KSWYg RU1TSyBpcyB1c2VkIGluIGNoYW5uZWwgYmluZGluZywgaXMgY3J5cHRvcGhpYyBiaW5kaW5nIHVz aW5nIEVNU0sgc3RpbGwgDQpuZWNjZXNhcnk/DQo+IA0KPiBUaGF0IHdvdWxkIGJlIGEgY2hhbmdl IHRvIGV4aXN0aW5nIEVBUCBtZXRob2RzIGluIHNvbWUgY2FzZXMuDQo+IFRoYXQgc29ydCBvZiBj aGFuZ2UgaXMgb3V0IG9mIHNjb3BlIGZvciBkcmFmdC1pZXRmLWVtdS1jaGJpbmQuDQo+IEl0J3Mg dHJ1ZSB0aGF0IGNoYW5uZWwgYmluZGluZyBiZW5lZml0cyBmcm9tIHByb3RlY3RlZCBzdWNjZXNz DQo+IGluZGljYXRpb25zIGFuZCB0aGUgY3VycmVudCBkcmFmdC1pZXRmLWVtdS1jaGJpbmQgZG9l cyBkaXNjdXNzIHRoYXQuDQoNCklmIEVNU0sgaXMgdXNlZCwgdGhlbiBubyBjaGFuZ2UgdG8gZXhp c3RpbmcgRUFQIG1ldGhvZHMgd2lsbCBiZSBtYWRlLg0KVGhhdCB3aWxsIGJlIGZpbmUuDQogDQoN Cg== --=_alternative 0005FCBB48257A01_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TYW0gSGFydG1hbiAmbHQ7aGFydG1hbnMtaWV0ZkBtaXQu ZWR1Jmd0OyDQtNPaIDIwMTItMDUtMTYNCjIwOjI2OjQwOjxicj4NCiZndDsgPGJyPg0KJmd0OyBU aGUgZXhwbGljaXQgc3RydWN0dXJlIG9mPGJyPg0KJmd0OyB0aGF0IHBhcmFncmFwaCB3YXMgY2Fs bGVkIG91dCBmb3IgV0cgcmV2aWV3IHByaW9yIHRvIElFVEYgbGFzdCBjYWxsOzxicj4NCiZndDsg YWxzbyB0aGF0IHN0cnVjdHVyZSB3YXMgcHJlc2VudCBpbiBJRVRGIGxhc3QgY2FsbC4gJm5ic3A7 SSBkbyBub3QNCndpc2ggdG88YnI+DQomZ3Q7IHdhaXQgdG8gcmVhY2ggY29uc2Vuc3VzIG9uIGdl bmVyYWwgY29tbWVudHMgYWJvdXQgcHJvZXMvY29ucyBvZjxicj4NCiZndDsgaW1wbGVtZW50aW5n IGNoYW5uZWwgYmluZGluZyB3aXRoIHR1bm5lbCBtZXRob2RzIHByaW9yIHRvIGFwcHJvdmFsDQpv Zjxicj4NCiZndDsgdGhpcyBkb2N1bWVudC48YnI+DQo8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPldlbGyjrG5vIG1hdHRlciB3aGF0J3MgdGhlIHJlc3VsdCwgSSBkb24ndCBsaWtl IHRoZQ0KbG9naWMgaW4gdGhlIGN1cnJlbnQgdGV4dCw8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPml0IGlzIG5vdCBjbGVhciBhbmQgZWFzeSB0byBjb25mdXNpbmcgdGhlIHR3byBi aW5kaW5ncy4NCjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+PGJyPg0KJmd0OyBU aHVzIEkgcHJlZmVyIHRoZSBjdXJyZW50IHRleHQuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IENoYW5u ZWwgYmluZGluZyBjYW4gaGFwcGVuIGJlZm9yZSBvciBhZnRlciB0aGUgTVNLIGlzIGdlbmVyYXRl ZCwgYnV0PGJyPg0KJmd0OyBlZmZlY3RpdmVseSBuZWVkcyB0byBoYXBwZW4gYWZ0ZXIgc29tZSBr ZXkgaXMgZ2VuZXJhdGVkLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJIHdvdWxkIGV4cGVjdCB0aGF0 IHRoZSBrZXkgdXNlZCBmb3IgY2hhbm5lbCBiaW5kaW5nIGludGVncml0eSB3b3VsZA0KYmU8YnI+ DQomZ3Q7IGNyeXB0b2dyYXBoaWNhbGx5IGluZGVwZW5kZW50IG9mIHRoZSBNU0suPGJyPg0KJmd0 OyBJJ3ZlIG5vdCBhbmFseXplZCBhIG1ldGhvZCB3aGVyZSB0aGUgTVNLIGlzIHVzZWQgZm9yIGNo YW5uZWwgYmluZGluZw0KYnV0PGJyPg0KJmd0OyB0aGlzIGlzIGRvbmUgcHJpb3IgdG8gdHJhbnNw b3J0IHRvIHRoZSBhdXRoZW50aWNhdG9yLjxicj4NCiZndDsgVGhhdCdzIHByb2JhYmx5IHNhZmUs IGJ1dCBpdCBzZWVtcyBsaWtlIGEgYmFkIGRlc2lnbiBzdHJhdGVneSBiZWNhdXNlDQppdDxicj4N CiZndDsgc2VlbXMgbmVlZGxlc3NseSBmcmFnaWxlLjxicj4NCiZndDsgU28sIEknZCBiZSBuZXJ2 b3VzIGFib3V0IHRoYXQgc3RyYXRlZ3kgYW5kIHdvdWxkIHJlY29tbWVuZCBpbmRlcGVuZGVudDxi cj4NCiZndDsga2V5cyBmb3IgY2hhbm5lbCBiaW5kaW5nLjxicj4NCjwvZm9udD48L3R0Pg0KPGJy Pjx0dD48Zm9udCBzaXplPTI+SWYgdGhlcmUgaXMgYW5vdGhlciBrZXkgYXZhaWxhYmxlLCBpdCB3 aWxsIGJlIGdyZWF0LA0KPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5FTVNLPyBJ dCBoYXMgYmVlbiBzdWdnZXN0ZWQgZm9yIGNyeXB0b2dyYXBoaWMgYmluZGluZy48L2ZvbnQ+PC90 dD4NCjxicj4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPjxicj4NCjxicj4NCiZndDsgPGJyPg0KJmd0 OyBJIGRpc2FncmVlLjxicj4NCiZndDsgSSdkIGFzayB5b3UgdG8gdGFrZSBhIGxvb2sgYXQgdGhl IHNsaWRlcyBJIHByZXNlbnRlZCBhdCBJRVRGIDgzLiBJDQp0aGluazxicj4NCiZndDsgdGhleSBh cmUgbW9yZSBjbGVhciB0aGFuIGRyYWZ0LWhhcnRtYW4tZW11LW11dHVhbC1jcnlwdG8tYmluZGlu ZyBhdA0KdGhlPGJyPg0KJmd0OyBtb21lbnQsIGFsdGhvdWdoIG9idmlvdXNseSB3ZSB3aWxsIHVw ZGF0ZSB0aGF0IGRyYWZ0IGluIHRoZSBuZWFyIGZ1dHVyZTxicj4NCiZndDsgdG8gcmVmbGVjdCB5 b3VyIGNvbW1lbnRzIGFuZCB0aG9zZSBvZiBvdGhlcnMuPGJyPg0KPC9mb250PjwvdHQ+DQo8YnI+ PGZvbnQgc2l6ZT0yPklmIEVNU0sgaXMgdXNlZCBpbiBjaGFubmVsIGJpbmRpbmcsIGlzIGNyeXB0 b3BoaWMgYmluZGluZw0KdXNpbmcgRU1TSyBzdGlsbCBuZWNjZXNhcnk/PC9mb250Pg0KPGJyPjx0 dD48Zm9udCBzaXplPTI+Jmd0OyA8YnI+DQomZ3Q7IFRoYXQgd291bGQgYmUgYSBjaGFuZ2UgdG8g ZXhpc3RpbmcgRUFQIG1ldGhvZHMgaW4gc29tZSBjYXNlcy48YnI+DQomZ3Q7IFRoYXQgc29ydCBv ZiBjaGFuZ2UgaXMgb3V0IG9mIHNjb3BlIGZvciBkcmFmdC1pZXRmLWVtdS1jaGJpbmQuPGJyPg0K Jmd0OyBJdCdzIHRydWUgdGhhdCBjaGFubmVsIGJpbmRpbmcgYmVuZWZpdHMgZnJvbSBwcm90ZWN0 ZWQgc3VjY2Vzczxicj4NCiZndDsgaW5kaWNhdGlvbnMgYW5kIHRoZSBjdXJyZW50IGRyYWZ0LWll dGYtZW11LWNoYmluZCBkb2VzIGRpc2N1c3MgdGhhdC48L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPjxicj4NCklmIEVNU0sgaXMgdXNlZCwgdGhlbiBubyBjaGFuZ2UgdG8gZXhpc3Rp bmcgRUFQIG1ldGhvZHMgd2lsbCBiZSBtYWRlLjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBz aXplPTI+VGhhdCB3aWxsIGJlIGZpbmUuPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9 Mj4mbmJzcDs8YnI+DQo8L2ZvbnQ+PC90dD4NCg== --=_alternative 0005FCBB48257A01_=-- From zhou.sujing@zte.com.cn Wed May 16 21:06:24 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CBA111E808F; Wed, 16 May 2012 21:06:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.602 X-Spam-Level: X-Spam-Status: No, score=-96.602 tagged_above=-999 required=5 tests=[AWL=1.032, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jIbGr3iFgf67; Wed, 16 May 2012 21:06:23 -0700 (PDT) Received: from mx5.zte.com.cn (mx5.zte.com.cn [63.217.80.70]) by ietfa.amsl.com (Postfix) with ESMTP id 3A71011E8089; Wed, 16 May 2012 21:06:20 -0700 (PDT) Received: from [10.30.17.99] by mx5.zte.com.cn with surfront esmtp id 621292676637534; Thu, 17 May 2012 12:03:21 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.15] with StormMail ESMTP id 60658.5059664521; Thu, 17 May 2012 09:05:14 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q4H151uY053684; Thu, 17 May 2012 09:05:01 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Sam Hartman MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Thu, 17 May 2012 09:04:50 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-17 09:05:02, Serialize complete at 2012-05-17 09:05:02 Content-Type: multipart/alternative; boundary="=_alternative 0005FCBB48257A01_=" X-MAIL: mse01.zte.com.cn q4H151uY053684 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2012 04:06:25 -0000 This is a multipart message in MIME format. --=_alternative 0005FCBB48257A01_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 U2FtIEhhcnRtYW4gPGhhcnRtYW5zLWlldGZAbWl0LmVkdT4g0LTT2iAyMDEyLTA1LTE2IDIwOjI2 OjQwOg0KPiANCj4gVGhlIGV4cGxpY2l0IHN0cnVjdHVyZSBvZg0KPiB0aGF0IHBhcmFncmFwaCB3 YXMgY2FsbGVkIG91dCBmb3IgV0cgcmV2aWV3IHByaW9yIHRvIElFVEYgbGFzdCBjYWxsOw0KPiBh bHNvIHRoYXQgc3RydWN0dXJlIHdhcyBwcmVzZW50IGluIElFVEYgbGFzdCBjYWxsLiAgSSBkbyBu b3Qgd2lzaCB0bw0KPiB3YWl0IHRvIHJlYWNoIGNvbnNlbnN1cyBvbiBnZW5lcmFsIGNvbW1lbnRz IGFib3V0IHByb2VzL2NvbnMgb2YNCj4gaW1wbGVtZW50aW5nIGNoYW5uZWwgYmluZGluZyB3aXRo IHR1bm5lbCBtZXRob2RzIHByaW9yIHRvIGFwcHJvdmFsIG9mDQo+IHRoaXMgZG9jdW1lbnQuDQoN CldlbGyjrG5vIG1hdHRlciB3aGF0J3MgdGhlIHJlc3VsdCwgSSBkb24ndCBsaWtlIHRoZSBsb2dp YyBpbiB0aGUgY3VycmVudCANCnRleHQsDQppdCBpcyBub3QgY2xlYXIgYW5kIGVhc3kgdG8gY29u ZnVzaW5nIHRoZSB0d28gYmluZGluZ3MuIA0KDQo+IFRodXMgSSBwcmVmZXIgdGhlIGN1cnJlbnQg dGV4dC4NCj4gDQo+IENoYW5uZWwgYmluZGluZyBjYW4gaGFwcGVuIGJlZm9yZSBvciBhZnRlciB0 aGUgTVNLIGlzIGdlbmVyYXRlZCwgYnV0DQo+IGVmZmVjdGl2ZWx5IG5lZWRzIHRvIGhhcHBlbiBh ZnRlciBzb21lIGtleSBpcyBnZW5lcmF0ZWQuDQo+IA0KPiBJIHdvdWxkIGV4cGVjdCB0aGF0IHRo ZSBrZXkgdXNlZCBmb3IgY2hhbm5lbCBiaW5kaW5nIGludGVncml0eSB3b3VsZCBiZQ0KPiBjcnlw dG9ncmFwaGljYWxseSBpbmRlcGVuZGVudCBvZiB0aGUgTVNLLg0KPiBJJ3ZlIG5vdCBhbmFseXpl ZCBhIG1ldGhvZCB3aGVyZSB0aGUgTVNLIGlzIHVzZWQgZm9yIGNoYW5uZWwgYmluZGluZyBidXQN Cj4gdGhpcyBpcyBkb25lIHByaW9yIHRvIHRyYW5zcG9ydCB0byB0aGUgYXV0aGVudGljYXRvci4N Cj4gVGhhdCdzIHByb2JhYmx5IHNhZmUsIGJ1dCBpdCBzZWVtcyBsaWtlIGEgYmFkIGRlc2lnbiBz dHJhdGVneSBiZWNhdXNlIGl0DQo+IHNlZW1zIG5lZWRsZXNzbHkgZnJhZ2lsZS4NCj4gU28sIEkn ZCBiZSBuZXJ2b3VzIGFib3V0IHRoYXQgc3RyYXRlZ3kgYW5kIHdvdWxkIHJlY29tbWVuZCBpbmRl cGVuZGVudA0KPiBrZXlzIGZvciBjaGFubmVsIGJpbmRpbmcuDQoNCklmIHRoZXJlIGlzIGFub3Ro ZXIga2V5IGF2YWlsYWJsZSwgaXQgd2lsbCBiZSBncmVhdCwgDQpFTVNLPyBJdCBoYXMgYmVlbiBz dWdnZXN0ZWQgZm9yIGNyeXB0b2dyYXBoaWMgYmluZGluZy4NCg0KDQoNCj4gDQo+IEkgZGlzYWdy ZWUuDQo+IEknZCBhc2sgeW91IHRvIHRha2UgYSBsb29rIGF0IHRoZSBzbGlkZXMgSSBwcmVzZW50 ZWQgYXQgSUVURiA4My4gSSB0aGluaw0KPiB0aGV5IGFyZSBtb3JlIGNsZWFyIHRoYW4gZHJhZnQt aGFydG1hbi1lbXUtbXV0dWFsLWNyeXB0by1iaW5kaW5nIGF0IHRoZQ0KPiBtb21lbnQsIGFsdGhv dWdoIG9idmlvdXNseSB3ZSB3aWxsIHVwZGF0ZSB0aGF0IGRyYWZ0IGluIHRoZSBuZWFyIGZ1dHVy ZQ0KPiB0byByZWZsZWN0IHlvdXIgY29tbWVudHMgYW5kIHRob3NlIG9mIG90aGVycy4NCg0KSWYg RU1TSyBpcyB1c2VkIGluIGNoYW5uZWwgYmluZGluZywgaXMgY3J5cHRvcGhpYyBiaW5kaW5nIHVz aW5nIEVNU0sgc3RpbGwgDQpuZWNjZXNhcnk/DQo+IA0KPiBUaGF0IHdvdWxkIGJlIGEgY2hhbmdl IHRvIGV4aXN0aW5nIEVBUCBtZXRob2RzIGluIHNvbWUgY2FzZXMuDQo+IFRoYXQgc29ydCBvZiBj aGFuZ2UgaXMgb3V0IG9mIHNjb3BlIGZvciBkcmFmdC1pZXRmLWVtdS1jaGJpbmQuDQo+IEl0J3Mg dHJ1ZSB0aGF0IGNoYW5uZWwgYmluZGluZyBiZW5lZml0cyBmcm9tIHByb3RlY3RlZCBzdWNjZXNz DQo+IGluZGljYXRpb25zIGFuZCB0aGUgY3VycmVudCBkcmFmdC1pZXRmLWVtdS1jaGJpbmQgZG9l cyBkaXNjdXNzIHRoYXQuDQoNCklmIEVNU0sgaXMgdXNlZCwgdGhlbiBubyBjaGFuZ2UgdG8gZXhp c3RpbmcgRUFQIG1ldGhvZHMgd2lsbCBiZSBtYWRlLg0KVGhhdCB3aWxsIGJlIGZpbmUuDQogDQoN Cg== --=_alternative 0005FCBB48257A01_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TYW0gSGFydG1hbiAmbHQ7aGFydG1hbnMtaWV0ZkBtaXQu ZWR1Jmd0OyDQtNPaIDIwMTItMDUtMTYNCjIwOjI2OjQwOjxicj4NCiZndDsgPGJyPg0KJmd0OyBU aGUgZXhwbGljaXQgc3RydWN0dXJlIG9mPGJyPg0KJmd0OyB0aGF0IHBhcmFncmFwaCB3YXMgY2Fs bGVkIG91dCBmb3IgV0cgcmV2aWV3IHByaW9yIHRvIElFVEYgbGFzdCBjYWxsOzxicj4NCiZndDsg YWxzbyB0aGF0IHN0cnVjdHVyZSB3YXMgcHJlc2VudCBpbiBJRVRGIGxhc3QgY2FsbC4gJm5ic3A7 SSBkbyBub3QNCndpc2ggdG88YnI+DQomZ3Q7IHdhaXQgdG8gcmVhY2ggY29uc2Vuc3VzIG9uIGdl bmVyYWwgY29tbWVudHMgYWJvdXQgcHJvZXMvY29ucyBvZjxicj4NCiZndDsgaW1wbGVtZW50aW5n IGNoYW5uZWwgYmluZGluZyB3aXRoIHR1bm5lbCBtZXRob2RzIHByaW9yIHRvIGFwcHJvdmFsDQpv Zjxicj4NCiZndDsgdGhpcyBkb2N1bWVudC48YnI+DQo8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPldlbGyjrG5vIG1hdHRlciB3aGF0J3MgdGhlIHJlc3VsdCwgSSBkb24ndCBsaWtl IHRoZQ0KbG9naWMgaW4gdGhlIGN1cnJlbnQgdGV4dCw8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPml0IGlzIG5vdCBjbGVhciBhbmQgZWFzeSB0byBjb25mdXNpbmcgdGhlIHR3byBi aW5kaW5ncy4NCjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+PGJyPg0KJmd0OyBU aHVzIEkgcHJlZmVyIHRoZSBjdXJyZW50IHRleHQuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IENoYW5u ZWwgYmluZGluZyBjYW4gaGFwcGVuIGJlZm9yZSBvciBhZnRlciB0aGUgTVNLIGlzIGdlbmVyYXRl ZCwgYnV0PGJyPg0KJmd0OyBlZmZlY3RpdmVseSBuZWVkcyB0byBoYXBwZW4gYWZ0ZXIgc29tZSBr ZXkgaXMgZ2VuZXJhdGVkLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJIHdvdWxkIGV4cGVjdCB0aGF0 IHRoZSBrZXkgdXNlZCBmb3IgY2hhbm5lbCBiaW5kaW5nIGludGVncml0eSB3b3VsZA0KYmU8YnI+ DQomZ3Q7IGNyeXB0b2dyYXBoaWNhbGx5IGluZGVwZW5kZW50IG9mIHRoZSBNU0suPGJyPg0KJmd0 OyBJJ3ZlIG5vdCBhbmFseXplZCBhIG1ldGhvZCB3aGVyZSB0aGUgTVNLIGlzIHVzZWQgZm9yIGNo YW5uZWwgYmluZGluZw0KYnV0PGJyPg0KJmd0OyB0aGlzIGlzIGRvbmUgcHJpb3IgdG8gdHJhbnNw b3J0IHRvIHRoZSBhdXRoZW50aWNhdG9yLjxicj4NCiZndDsgVGhhdCdzIHByb2JhYmx5IHNhZmUs IGJ1dCBpdCBzZWVtcyBsaWtlIGEgYmFkIGRlc2lnbiBzdHJhdGVneSBiZWNhdXNlDQppdDxicj4N CiZndDsgc2VlbXMgbmVlZGxlc3NseSBmcmFnaWxlLjxicj4NCiZndDsgU28sIEknZCBiZSBuZXJ2 b3VzIGFib3V0IHRoYXQgc3RyYXRlZ3kgYW5kIHdvdWxkIHJlY29tbWVuZCBpbmRlcGVuZGVudDxi cj4NCiZndDsga2V5cyBmb3IgY2hhbm5lbCBiaW5kaW5nLjxicj4NCjwvZm9udD48L3R0Pg0KPGJy Pjx0dD48Zm9udCBzaXplPTI+SWYgdGhlcmUgaXMgYW5vdGhlciBrZXkgYXZhaWxhYmxlLCBpdCB3 aWxsIGJlIGdyZWF0LA0KPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5FTVNLPyBJ dCBoYXMgYmVlbiBzdWdnZXN0ZWQgZm9yIGNyeXB0b2dyYXBoaWMgYmluZGluZy48L2ZvbnQ+PC90 dD4NCjxicj4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPjxicj4NCjxicj4NCiZndDsgPGJyPg0KJmd0 OyBJIGRpc2FncmVlLjxicj4NCiZndDsgSSdkIGFzayB5b3UgdG8gdGFrZSBhIGxvb2sgYXQgdGhl IHNsaWRlcyBJIHByZXNlbnRlZCBhdCBJRVRGIDgzLiBJDQp0aGluazxicj4NCiZndDsgdGhleSBh cmUgbW9yZSBjbGVhciB0aGFuIGRyYWZ0LWhhcnRtYW4tZW11LW11dHVhbC1jcnlwdG8tYmluZGlu ZyBhdA0KdGhlPGJyPg0KJmd0OyBtb21lbnQsIGFsdGhvdWdoIG9idmlvdXNseSB3ZSB3aWxsIHVw ZGF0ZSB0aGF0IGRyYWZ0IGluIHRoZSBuZWFyIGZ1dHVyZTxicj4NCiZndDsgdG8gcmVmbGVjdCB5 b3VyIGNvbW1lbnRzIGFuZCB0aG9zZSBvZiBvdGhlcnMuPGJyPg0KPC9mb250PjwvdHQ+DQo8YnI+ PGZvbnQgc2l6ZT0yPklmIEVNU0sgaXMgdXNlZCBpbiBjaGFubmVsIGJpbmRpbmcsIGlzIGNyeXB0 b3BoaWMgYmluZGluZw0KdXNpbmcgRU1TSyBzdGlsbCBuZWNjZXNhcnk/PC9mb250Pg0KPGJyPjx0 dD48Zm9udCBzaXplPTI+Jmd0OyA8YnI+DQomZ3Q7IFRoYXQgd291bGQgYmUgYSBjaGFuZ2UgdG8g ZXhpc3RpbmcgRUFQIG1ldGhvZHMgaW4gc29tZSBjYXNlcy48YnI+DQomZ3Q7IFRoYXQgc29ydCBv ZiBjaGFuZ2UgaXMgb3V0IG9mIHNjb3BlIGZvciBkcmFmdC1pZXRmLWVtdS1jaGJpbmQuPGJyPg0K Jmd0OyBJdCdzIHRydWUgdGhhdCBjaGFubmVsIGJpbmRpbmcgYmVuZWZpdHMgZnJvbSBwcm90ZWN0 ZWQgc3VjY2Vzczxicj4NCiZndDsgaW5kaWNhdGlvbnMgYW5kIHRoZSBjdXJyZW50IGRyYWZ0LWll dGYtZW11LWNoYmluZCBkb2VzIGRpc2N1c3MgdGhhdC48L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPjxicj4NCklmIEVNU0sgaXMgdXNlZCwgdGhlbiBubyBjaGFuZ2UgdG8gZXhpc3Rp bmcgRUFQIG1ldGhvZHMgd2lsbCBiZSBtYWRlLjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBz aXplPTI+VGhhdCB3aWxsIGJlIGZpbmUuPC9mb250PjwvdHQ+DQo8YnI+PHR0Pjxmb250IHNpemU9 Mj4mbmJzcDs8YnI+DQo8L2ZvbnQ+PC90dD4NCg== --=_alternative 0005FCBB48257A01_=-- From hartmans@mit.edu Thu May 17 05:47:27 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48FF421F84D5; Thu, 17 May 2012 05:47:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.644 X-Spam-Level: X-Spam-Status: No, score=-102.644 tagged_above=-999 required=5 tests=[AWL=-0.379, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IiIxFMHTadTx; Thu, 17 May 2012 05:47:26 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id B9D6221F84CE; Thu, 17 May 2012 05:47:18 -0700 (PDT) Received: from carter-zimmerman.suchdamage.org (carter-zimmerman.suchdamage.org [69.25.196.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id C591220383; Thu, 17 May 2012 08:42:58 -0400 (EDT) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id 9AE2044B1; Thu, 17 May 2012 08:46:55 -0400 (EDT) From: Sam Hartman To: zhou.sujing@zte.com.cn References: Date: Thu, 17 May 2012 08:46:55 -0400 In-Reply-To: (zhou sujing's message of "Thu, 17 May 2012 09:04:50 +0800") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: Re: [Emu] I-D Action: draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2012 12:47:27 -0000 >>>>> "zhou" == zhou sujing writes: zhou> If there is another key available, it will be great, EMSK? It zhou> has been suggested for cryptographic binding. I'm expecting that most EAP methods will use a key internal to their heirarchy above both the MSK and EMSK. For example I'd expect that TLS-based tunnels would use the TLS integrity and confidentiality keys for channel binding. From zhou.sujing@zte.com.cn Thu May 17 17:17:00 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60FD221F876D; Thu, 17 May 2012 17:17:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.538 X-Spam-Level: X-Spam-Status: No, score=-94.538 tagged_above=-999 required=5 tests=[AWL=-1.748, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tvWvq2Zoak83; Thu, 17 May 2012 17:17:00 -0700 (PDT) Received: from mx5.zte.com.cn (mx6.zte.com.cn [95.130.199.165]) by ietfa.amsl.com (Postfix) with ESMTP id 5FF8621F8736; Thu, 17 May 2012 17:16:59 -0700 (PDT) Received: from [10.30.17.100] by mx5.zte.com.cn with surfront esmtp id 286202676637534; Fri, 18 May 2012 07:32:42 +0800 (CST) Received: from [10.30.3.21] by [192.168.168.16] with StormMail ESMTP id 61163.5059664521; Fri, 18 May 2012 08:16:39 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q4I0Glwg085843; Fri, 18 May 2012 08:16:47 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Sam Hartman MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Fri, 18 May 2012 08:16:32 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-18 08:16:48, Serialize complete at 2012-05-18 08:16:48 Content-Type: multipart/alternative; boundary="=_alternative 0001927D48257A02_=" X-MAIL: mse02.zte.com.cn q4I0Glwg085843 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: [Emu] =?gb2312?b?tPC4tDogUmU6ICBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWVt?= =?gb2312?b?dS1jaGJpbmQtMTUudHh0?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2012 00:17:00 -0000 This is a multipart message in MIME format. --=_alternative 0001927D48257A02_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 UmVnYXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KU2FtIEhhcnRtYW4gPGhhcnRtYW5zLWlldGZA bWl0LmVkdT4g0LTT2iAyMDEyLTA1LTE3IDIwOjQ2OjU1Og0KDQo+ID4+Pj4+ICJ6aG91IiA9PSB6 aG91IHN1amluZyA8emhvdS5zdWppbmdAenRlLmNvbS5jbj4gd3JpdGVzOg0KPiANCj4gDQo+ICAg ICB6aG91PiBJZiB0aGVyZSBpcyBhbm90aGVyIGtleSBhdmFpbGFibGUsIGl0IHdpbGwgYmUgZ3Jl YXQsIEVNU0s/IEl0DQo+ICAgICB6aG91PiBoYXMgYmVlbiBzdWdnZXN0ZWQgZm9yIGNyeXB0b2dy YXBoaWMgYmluZGluZy4NCj4gDQo+IEknbSBleHBlY3RpbmcgdGhhdCBtb3N0IEVBUCBtZXRob2Rz IHdpbGwgdXNlIGEga2V5IGludGVybmFsIHRvIHRoZWlyDQo+IGhlaXJhcmNoeSBhYm92ZSBib3Ro IHRoZSBNU0sgYW5kIEVNU0suIEZvciBleGFtcGxlIEknZCBleHBlY3QgdGhhdA0KPiBUTFMtYmFz ZWQgdHVubmVscyB3b3VsZCB1c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0 eSBrZXlzDQo+IGZvciBjaGFubmVsIGJpbmRpbmcuDQo+IA0Kd2hhdCBpZiB0aGVyZSBpcyBub3Qg c3VjaCBhbiBpbnRlcm5hbCBrZXkgb3RoZXIgdGhhbiBNU0sgYW5kIEVNU0sgZm9yIGEgDQpFQVAg bWV0aG9kPw0KDQoNCg0K --=_alternative 0001927D48257A02_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlJlZ2FyZHN+fn48YnI+DQo8YnI+ DQotU3VqaW5nIFpob3U8L2ZvbnQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TYW0gSGFy dG1hbiAmbHQ7aGFydG1hbnMtaWV0ZkBtaXQuZWR1Jmd0OyDQtNPaIDIwMTItMDUtMTcNCjIwOjQ2 OjU1Ojxicj4NCjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsgJnF1b3Q7emhvdSZxdW90 OyA9PSB6aG91IHN1amluZyAmbHQ7emhvdS5zdWppbmdAenRlLmNvbS5jbiZndDsNCndyaXRlczo8 YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IElm IHRoZXJlIGlzIGFub3RoZXIga2V5IGF2YWlsYWJsZSwgaXQgd2lsbA0KYmUgZ3JlYXQsIEVNU0s/ IEl0PGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IGhhcyBiZWVuIHN1Z2dlc3RlZCBm b3IgY3J5cHRvZ3JhcGhpYyBiaW5kaW5nLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJJ20gZXhwZWN0 aW5nIHRoYXQgbW9zdCBFQVAgbWV0aG9kcyB3aWxsIHVzZSBhIGtleSBpbnRlcm5hbCB0byB0aGVp cjxicj4NCiZndDsgaGVpcmFyY2h5IGFib3ZlIGJvdGggdGhlIE1TSyBhbmQgRU1TSy4gRm9yIGV4 YW1wbGUgSSdkIGV4cGVjdCB0aGF0PGJyPg0KJmd0OyBUTFMtYmFzZWQgdHVubmVscyB3b3VsZCB1 c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0eQ0Ka2V5czxicj4NCiZndDsg Zm9yIGNoYW5uZWwgYmluZGluZy48YnI+DQomZ3Q7IDxicj4NCndoYXQgaWYgdGhlcmUgaXMgbm90 IHN1Y2ggYW4gaW50ZXJuYWwga2V5IG90aGVyIHRoYW4gTVNLIGFuZCBFTVNLIGZvciBhDQpFQVAg bWV0aG9kPzwvZm9udD48L3R0Pg0KPGJyPg0KPGJyPg0KPGJyPg0K --=_alternative 0001927D48257A02_=-- From zhou.sujing@zte.com.cn Thu May 17 21:34:32 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9007F21F869F; Thu, 17 May 2012 21:34:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.438 X-Spam-Level: X-Spam-Status: No, score=-94.438 tagged_above=-999 required=5 tests=[AWL=-1.648, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xHwXliwoK8U8; Thu, 17 May 2012 21:34:25 -0700 (PDT) Received: from mx5.zte.com.cn (mx5.zte.com.cn [63.217.80.70]) by ietfa.amsl.com (Postfix) with ESMTP id 49E7B21F8687; Thu, 17 May 2012 21:34:21 -0700 (PDT) Received: from [10.30.17.99] by mx5.zte.com.cn with surfront esmtp id 621292676637534; Fri, 18 May 2012 12:31:00 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.15] with StormMail ESMTP id 33453.5059664521; Fri, 18 May 2012 12:34:17 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q4I4YCaD000634; Fri, 18 May 2012 12:34:12 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Sam Hartman MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Fri, 18 May 2012 12:33:57 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-18 12:34:13, Serialize complete at 2012-05-18 12:34:13 Content-Type: multipart/alternative; boundary="=_alternative 001915B748257A02_=" X-MAIL: mse01.zte.com.cn q4I4YCaD000634 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: [Emu] =?gb2312?b?tPC4tDogUmU6ICBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLWVt?= =?gb2312?b?dS1jaGJpbmQtMTUudHh0?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2012 04:34:32 -0000 This is a multipart message in MIME format. --=_alternative 001915B748257A02_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 UmVnYXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KU2FtIEhhcnRtYW4gPGhhcnRtYW5zLWlldGZA bWl0LmVkdT4g0LTT2iAyMDEyLTA1LTE3IDIwOjQ2OjU1Og0KDQo+ID4+Pj4+ICJ6aG91IiA9PSB6 aG91IHN1amluZyA8emhvdS5zdWppbmdAenRlLmNvbS5jbj4gd3JpdGVzOg0KPiANCj4gDQo+ICAg ICB6aG91PiBJZiB0aGVyZSBpcyBhbm90aGVyIGtleSBhdmFpbGFibGUsIGl0IHdpbGwgYmUgZ3Jl YXQsIEVNU0s/IEl0DQo+ICAgICB6aG91PiBoYXMgYmVlbiBzdWdnZXN0ZWQgZm9yIGNyeXB0b2dy YXBoaWMgYmluZGluZy4NCj4gDQo+IEknbSBleHBlY3RpbmcgdGhhdCBtb3N0IEVBUCBtZXRob2Rz IHdpbGwgdXNlIGEga2V5IGludGVybmFsIHRvIHRoZWlyDQo+IGhlaXJhcmNoeSBhYm92ZSBib3Ro IHRoZSBNU0sgYW5kIEVNU0suIEZvciBleGFtcGxlIEknZCBleHBlY3QgdGhhdA0KPiBUTFMtYmFz ZWQgdHVubmVscyB3b3VsZCB1c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0 eSBrZXlzDQo+IGZvciBjaGFubmVsIGJpbmRpbmcuDQo+IA0Kd2hhdCBpZiB0aGVyZSBpcyBub3Qg c3VjaCBhbiBpbnRlcm5hbCBrZXkgb3RoZXIgdGhhbiBNU0sgYW5kIEVNU0sgZm9yIGEgDQpFQVAg bWV0aG9kPyANCg== --=_alternative 001915B748257A02_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlJlZ2FyZHN+fn48YnI+DQo8YnI+ DQotU3VqaW5nIFpob3U8L2ZvbnQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TYW0gSGFy dG1hbiAmbHQ7aGFydG1hbnMtaWV0ZkBtaXQuZWR1Jmd0OyDQtNPaIDIwMTItMDUtMTcNCjIwOjQ2 OjU1Ojxicj4NCjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsgJnF1b3Q7emhvdSZxdW90 OyA9PSB6aG91IHN1amluZyAmbHQ7emhvdS5zdWppbmdAenRlLmNvbS5jbiZndDsNCndyaXRlczo8 YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IElm IHRoZXJlIGlzIGFub3RoZXIga2V5IGF2YWlsYWJsZSwgaXQgd2lsbA0KYmUgZ3JlYXQsIEVNU0s/ IEl0PGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IGhhcyBiZWVuIHN1Z2dlc3RlZCBm b3IgY3J5cHRvZ3JhcGhpYyBiaW5kaW5nLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJJ20gZXhwZWN0 aW5nIHRoYXQgbW9zdCBFQVAgbWV0aG9kcyB3aWxsIHVzZSBhIGtleSBpbnRlcm5hbCB0byB0aGVp cjxicj4NCiZndDsgaGVpcmFyY2h5IGFib3ZlIGJvdGggdGhlIE1TSyBhbmQgRU1TSy4gRm9yIGV4 YW1wbGUgSSdkIGV4cGVjdCB0aGF0PGJyPg0KJmd0OyBUTFMtYmFzZWQgdHVubmVscyB3b3VsZCB1 c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0eQ0Ka2V5czxicj4NCiZndDsg Zm9yIGNoYW5uZWwgYmluZGluZy48YnI+DQomZ3Q7IDxicj4NCndoYXQgaWYgdGhlcmUgaXMgbm90 IHN1Y2ggYW4gaW50ZXJuYWwga2V5IG90aGVyIHRoYW4gTVNLIGFuZCBFTVNLIGZvciBhDQpFQVAg bWV0aG9kPzwvZm9udD48L3R0Pjxmb250IHNpemU9MyBmYWNlPSJzYW5zLXNlcmlmIj4gPC9mb250 Pg0K --=_alternative 001915B748257A02_=-- From zhou.sujing@zte.com.cn Thu May 17 21:59:07 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 264FF21F85E3; Thu, 17 May 2012 21:59:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -94.108 X-Spam-Level: X-Spam-Status: No, score=-94.108 tagged_above=-999 required=5 tests=[AWL=-1.319, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93rlNskC5dOg; Thu, 17 May 2012 21:59:03 -0700 (PDT) Received: from mx5.zte.com.cn (mx5.zte.com.cn [63.217.80.70]) by ietfa.amsl.com (Postfix) with ESMTP id 5E18B21F85C9; Thu, 17 May 2012 21:59:02 -0700 (PDT) Received: from [10.30.17.99] by mx5.zte.com.cn with surfront esmtp id 621292676637534; Fri, 18 May 2012 12:55:59 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.15] with StormMail ESMTP id 33453.3709821989; Fri, 18 May 2012 12:58:59 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q4I4wpBi017168; Fri, 18 May 2012 12:58:51 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) From: zhou.sujing@zte.com.cn In-Reply-To: MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 X-TNEFEvaluated: 1 To: , , Message-ID: Sender: zhou.sujing@zte.com.cn Date: Fri, 18 May 2012 12:58:36 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-18 12:58:52, Serialize complete at 2012-05-18 12:58:52 Content-Type: multipart/mixed; boundary="===============3653526846918421584==" X-MAIL: mse01.zte.com.cn q4I4wpBi017168 Cc: emu-bounces@ietf.org, Sam Hartman , emu@ietf.org Subject: [Emu] =?gb2312?b?ILTwuLQ6IFJlOiAgSS1EIEFjdGlvbjogZHJhZnQtaWV0Zi1l?= =?gb2312?b?bXUtY2hiaW5kLTE1LnR4dA==?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2012 04:59:07 -0000 This is a multipart message in MIME format. --===============3653526846918421584== Content-Type: multipart/alternative; boundary="=_alternative 001915B748257A02_=" This is a multipart message in MIME format. --=_alternative 001915B748257A02_= Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="GB2312" UmVnYXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KU2FtIEhhcnRtYW4gPGhhcnRtYW5zLWlldGZA bWl0LmVkdT4g0LTT2iAyMDEyLTA1LTE3IDIwOjQ2OjU1Og0KDQo+ID4+Pj4+ICJ6aG91IiA9PSB6 aG91IHN1amluZyA8emhvdS5zdWppbmdAenRlLmNvbS5jbj4gd3JpdGVzOg0KPiANCj4gDQo+ICAg ICB6aG91PiBJZiB0aGVyZSBpcyBhbm90aGVyIGtleSBhdmFpbGFibGUsIGl0IHdpbGwgYmUgZ3Jl YXQsIEVNU0s/IEl0DQo+ICAgICB6aG91PiBoYXMgYmVlbiBzdWdnZXN0ZWQgZm9yIGNyeXB0b2dy YXBoaWMgYmluZGluZy4NCj4gDQo+IEknbSBleHBlY3RpbmcgdGhhdCBtb3N0IEVBUCBtZXRob2Rz IHdpbGwgdXNlIGEga2V5IGludGVybmFsIHRvIHRoZWlyDQo+IGhlaXJhcmNoeSBhYm92ZSBib3Ro IHRoZSBNU0sgYW5kIEVNU0suIEZvciBleGFtcGxlIEknZCBleHBlY3QgdGhhdA0KPiBUTFMtYmFz ZWQgdHVubmVscyB3b3VsZCB1c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0 eSBrZXlzDQo+IGZvciBjaGFubmVsIGJpbmRpbmcuDQo+IA0Kd2hhdCBpZiB0aGVyZSBpcyBub3Qg c3VjaCBhbiBpbnRlcm5hbCBrZXkgb3RoZXIgdGhhbiBNU0sgYW5kIEVNU0sgZm9yIGEgDQpFQVAg bWV0aG9kPyANCg== --=_alternative 001915B748257A02_= Content-Transfer-Encoding: base64 Content-Type: text/html; charset="GB2312" DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlJlZ2FyZHN+fn48YnI+DQo8YnI+ DQotU3VqaW5nIFpob3U8L2ZvbnQ+DQo8YnI+DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5TYW0gSGFy dG1hbiAmbHQ7aGFydG1hbnMtaWV0ZkBtaXQuZWR1Jmd0OyDQtNPaIDIwMTItMDUtMTcNCjIwOjQ2 OjU1Ojxicj4NCjxicj4NCiZndDsgJmd0OyZndDsmZ3Q7Jmd0OyZndDsgJnF1b3Q7emhvdSZxdW90 OyA9PSB6aG91IHN1amluZyAmbHQ7emhvdS5zdWppbmdAenRlLmNvbS5jbiZndDsNCndyaXRlczo8 YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IElm IHRoZXJlIGlzIGFub3RoZXIga2V5IGF2YWlsYWJsZSwgaXQgd2lsbA0KYmUgZ3JlYXQsIEVNU0s/ IEl0PGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7IHpob3UmZ3Q7IGhhcyBiZWVuIHN1Z2dlc3RlZCBm b3IgY3J5cHRvZ3JhcGhpYyBiaW5kaW5nLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJJ20gZXhwZWN0 aW5nIHRoYXQgbW9zdCBFQVAgbWV0aG9kcyB3aWxsIHVzZSBhIGtleSBpbnRlcm5hbCB0byB0aGVp cjxicj4NCiZndDsgaGVpcmFyY2h5IGFib3ZlIGJvdGggdGhlIE1TSyBhbmQgRU1TSy4gRm9yIGV4 YW1wbGUgSSdkIGV4cGVjdCB0aGF0PGJyPg0KJmd0OyBUTFMtYmFzZWQgdHVubmVscyB3b3VsZCB1 c2UgdGhlIFRMUyBpbnRlZ3JpdHkgYW5kIGNvbmZpZGVudGlhbGl0eQ0Ka2V5czxicj4NCiZndDsg Zm9yIGNoYW5uZWwgYmluZGluZy48YnI+DQomZ3Q7IDxicj4NCndoYXQgaWYgdGhlcmUgaXMgbm90 IHN1Y2ggYW4gaW50ZXJuYWwga2V5IG90aGVyIHRoYW4gTVNLIGFuZCBFTVNLIGZvciBhDQpFQVAg bWV0aG9kPzwvZm9udD48L3R0Pjxmb250IHNpemU9MyBmYWNlPSJzYW5zLXNlcmlmIj4gPC9mb250 Pg0K --=_alternative 001915B748257A02_=-- --===============3653526846918421584== Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline _______________________________________________ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu --===============3653526846918421584==-- From hartmans@mit.edu Fri May 18 04:50:18 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6D0421F867A; Fri, 18 May 2012 04:50:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.486 X-Spam-Level: X-Spam-Status: No, score=-102.486 tagged_above=-999 required=5 tests=[AWL=-0.521, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBW2tj4CtBE3; Fri, 18 May 2012 04:50:18 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 68A8B21F858F; Fri, 18 May 2012 04:50:18 -0700 (PDT) Received: from carter-zimmerman.suchdamage.org (carter-zimmerman.suchdamage.org [69.25.196.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 586172014F; Fri, 18 May 2012 07:45:57 -0400 (EDT) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id B61074151; Fri, 18 May 2012 07:49:52 -0400 (EDT) From: Sam Hartman To: zhou.sujing@zte.com.cn References: Date: Fri, 18 May 2012 07:49:52 -0400 In-Reply-To: (zhou sujing's message of "Fri, 18 May 2012 12:58:36 +0800") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: emu-bounces@ietf.org, hartmans-ietf@mit.edu, emu@ietf.org Subject: Re: [Emu] =?iso-8859-1?q?=F0=B4=3A_Re=3A__I-D_Action=3A_draft-ietf-em?= =?iso-8859-1?q?u-chbind-15=2Etxt?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2012 11:50:18 -0000 >>>>> "zhou" == zhou sujing writes: I don't really understand how that would be possible. If a fresh MSK and EMSK are generated per session, which we'd expect in a good EAP method, they need to be generated from something. So, I'd need to better understand what was happening if we had an EAP method that only had an MSK and EMSK internally. However, if that were the case I'd consider something EMSK-based while also considering whether it really made sense to add channel binding to that EAP method. From shanna@juniper.net Fri May 18 15:10:49 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE2AB21F85F1; Fri, 18 May 2012 15:10:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.11 X-Spam-Level: X-Spam-Status: No, score=-105.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oH4uhsP9CzOK; Fri, 18 May 2012 15:10:49 -0700 (PDT) Received: from exprod7og123.obsmtp.com (exprod7og123.obsmtp.com [64.18.2.24]) by ietfa.amsl.com (Postfix) with ESMTP id 816F321F85ED; Fri, 18 May 2012 15:10:48 -0700 (PDT) Received: from P-EMHUB03-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob123.postini.com ([64.18.6.12]) with SMTP ID DSNKT7bI5/jbxGJGM/l/+O0I/EVnjsyuF7+l@postini.com; Fri, 18 May 2012 15:10:49 PDT Received: from p-emfe01-wf.jnpr.net (172.28.145.24) by P-EMHUB03-HQ.jnpr.net (172.24.192.37) with Microsoft SMTP Server (TLS) id 8.3.213.0; Fri, 18 May 2012 15:10:21 -0700 Received: from EMBX01-WF.jnpr.net ([fe80::1914:3299:33d9:e43b]) by p-emfe01-wf.jnpr.net ([fe80::d0d1:653d:5b91:a123%11]) with mapi; Fri, 18 May 2012 18:10:20 -0400 From: Stephen Hanna To: Sam Hartman , "emu@ietf.org" Date: Fri, 18 May 2012 18:10:19 -0400 Thread-Topic: Updated secdir review of draft-ietf-emu-chbind-15.txt Thread-Index: Ac0yBUYMaadU2/1USxesme5e9bVqqQDOFijw Message-ID: References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "ietf@ietf.org" , "secdir@ietf.org" Subject: [Emu] Updated secdir review of draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2012 22:10:49 -0000 The changes in draft-ietf-emu-chbind-15.txt satisfactorily address almost all of the comments in my April 13, 2012 secdir review. I do have one remaining substantive comment on this latest draft and two non-substantive ones. Substantive Comment ------------------- The last paragraph of section 9.1 points out a security problem with implementing channel bindings using EAP tunnel methods. If the EAP tunnel method terminates on the authenticator, the channel bindings can easily be defeated by the authenticator. While that's true, nobody terminates the EAP tunnel method on the authenticator today. In the EAP model, the authenticator is not trusted so terminating the EAP tunnel method on the authenticator is a bad idea for many reasons. For example, the authenticator would then have the ability to bypass protected result indications and to bypass all the cryptographic protections provided by the tunnel. Sometimes there is value in having the inner and outer methods terminate on different servers but both servers must be trusted. The authenticator is not. So there is no big security hole here, unless you have already opened an enormous security hole. It's ironic that this document which attempts to close vulnerabilities caused by malicious authenticators ends up subtly suggesting that people open a much larger vulnerability! I would recommend deleting the end of this paragraph, starting with the sentence that starts "Even when cryptographic binding". If you choose to keep this strange text, I suggest that you at least note that terminating an EAP tunnel method on the authenticator is unusual. For example, you could add a parenthetical comment like "(rare)" after the clause "if the outer method tunnel terminates on the authenticator". Non-Substantive Comments ------------------------ In the first paragraph of section 3, an extraneous numeral 3 was somehow added to the end of the second sentence. T. Charles Clancy's address in the Authors' Addresses section now reads: T. Charles Clancy Virginia Tech Virginia Tech Arlington, VA 22203 USA The duplication of Virginia Tech should be removed from this address. I appreciate the hard work of the document editors to address my many earlier comments. I hope that these new comments will also be useful. Thanks, Steve From zhou.sujing@zte.com.cn Fri May 18 18:48:46 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 333CE21F863E; Fri, 18 May 2012 18:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -92.79 X-Spam-Level: X-Spam-Status: No, score=-92.79 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, SARE_SUB_ENC_GB2312=1.345, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oAy2CkJTgyuZ; Fri, 18 May 2012 18:48:45 -0700 (PDT) Received: from mx5.zte.com.cn (mx6.zte.com.cn [95.130.199.165]) by ietfa.amsl.com (Postfix) with ESMTP id B40F121F863C; Fri, 18 May 2012 18:48:44 -0700 (PDT) Received: from [10.30.17.100] by mx5.zte.com.cn with surfront esmtp id 286203063883180; Sat, 19 May 2012 09:04:15 +0800 (CST) Received: from [10.30.3.21] by [192.168.168.16] with StormMail ESMTP id 61163.4283112824; Sat, 19 May 2012 09:48:20 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse02.zte.com.cn with ESMTP id q4J1mVee009060; Sat, 19 May 2012 09:48:31 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: To: Stephen Hanna MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Sat, 19 May 2012 09:48:13 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-05-19 09:48:32, Serialize complete at 2012-05-19 09:48:32 Content-Type: multipart/alternative; boundary="=_alternative 0009F8CB48257A03_=" X-MAIL: mse02.zte.com.cn q4J1mVee009060 Cc: emu-bounces@ietf.org, "secdir@ietf.org" , Sam Hartman , "emu@ietf.org" , "ietf@ietf.org" Subject: [Emu] =?gb2312?b?tPC4tDogIFVwZGF0ZWQgc2VjZGlyIHJldmlldyBvZiBkcmFm?= =?gb2312?b?dC1pZXRmLWVtdS1jaGJpbmQtMTUudHh0?= X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 May 2012 01:48:46 -0000 This is a multipart message in MIME format. --=_alternative 0009F8CB48257A03_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 ZW11LWJvdW5jZXNAaWV0Zi5vcmcg0LTT2iAyMDEyLTA1LTE5IDA2OjEwOjE5Og0KDQo+IFRoZSBs YXN0IHBhcmFncmFwaCBvZiBzZWN0aW9uIDkuMSBwb2ludHMgb3V0IGEgc2VjdXJpdHkgcHJvYmxl bQ0KPiB3aXRoIGltcGxlbWVudGluZyBjaGFubmVsIGJpbmRpbmdzIHVzaW5nIEVBUCB0dW5uZWwg bWV0aG9kcy4gSWYNCj4gdGhlIEVBUCB0dW5uZWwgbWV0aG9kIHRlcm1pbmF0ZXMgb24gdGhlIGF1 dGhlbnRpY2F0b3IsIHRoZSBjaGFubmVsDQo+IGJpbmRpbmdzIGNhbiBlYXNpbHkgYmUgZGVmZWF0 ZWQgYnkgdGhlIGF1dGhlbnRpY2F0b3IuIFdoaWxlIHRoYXQncw0KPiB0cnVlLCBub2JvZHkgdGVy bWluYXRlcyB0aGUgRUFQIHR1bm5lbCBtZXRob2Qgb24gdGhlIGF1dGhlbnRpY2F0b3INCj4gdG9k YXkuIEluIHRoZSBFQVAgbW9kZWwsIHRoZSBhdXRoZW50aWNhdG9yIGlzIG5vdCB0cnVzdGVkIHNv DQo+IHRlcm1pbmF0aW5nIHRoZSBFQVAgdHVubmVsIG1ldGhvZCBvbiB0aGUgYXV0aGVudGljYXRv ciBpcyBhIGJhZA0KPiBpZGVhIGZvciBtYW55IHJlYXNvbnMuIEZvciBleGFtcGxlLCB0aGUgYXV0 aGVudGljYXRvciB3b3VsZCB0aGVuDQo+IGhhdmUgdGhlIGFiaWxpdHkgdG8gYnlwYXNzIHByb3Rl Y3RlZCByZXN1bHQgaW5kaWNhdGlvbnMgYW5kIHRvDQo+IGJ5cGFzcyBhbGwgdGhlIGNyeXB0b2dy YXBoaWMgcHJvdGVjdGlvbnMgcHJvdmlkZWQgYnkgdGhlIHR1bm5lbC4NCj4gU29tZXRpbWVzIHRo ZXJlIGlzIHZhbHVlIGluIGhhdmluZyB0aGUgaW5uZXIgYW5kIG91dGVyIG1ldGhvZHMNCj4gdGVy bWluYXRlIG9uIGRpZmZlcmVudCBzZXJ2ZXJzIGJ1dCBib3RoIHNlcnZlcnMgbXVzdCBiZSB0cnVz dGVkLg0KPiBUaGUgYXV0aGVudGljYXRvciBpcyBub3QuIFNvIHRoZXJlIGlzIG5vIGJpZyBzZWN1 cml0eSBob2xlIGhlcmUsDQo+IHVubGVzcyB5b3UgaGF2ZSBhbHJlYWR5IG9wZW5lZCBhbiBlbm9y bW91cyBzZWN1cml0eSBob2xlLiBJdCdzDQo+IGlyb25pYyB0aGF0IHRoaXMgZG9jdW1lbnQgd2hp Y2ggYXR0ZW1wdHMgdG8gY2xvc2UgdnVsbmVyYWJpbGl0aWVzDQo+IGNhdXNlZCBieSBtYWxpY2lv dXMgYXV0aGVudGljYXRvcnMgZW5kcyB1cCBzdWJ0bHkgc3VnZ2VzdGluZyB0aGF0DQo+IHBlb3Bs ZSBvcGVuIGEgbXVjaCBsYXJnZXIgdnVsbmVyYWJpbGl0eSENCj4gDQo+IEkgd291bGQgcmVjb21t ZW5kIGRlbGV0aW5nIHRoZSBlbmQgb2YgdGhpcyBwYXJhZ3JhcGgsIHN0YXJ0aW5nDQo+IHdpdGgg dGhlIHNlbnRlbmNlIHRoYXQgc3RhcnRzICJFdmVuIHdoZW4gY3J5cHRvZ3JhcGhpYyBiaW5kaW5n Ii4NCj4gSWYgeW91IGNob29zZSB0byBrZWVwIHRoaXMgc3RyYW5nZSB0ZXh0LCBJIHN1Z2dlc3Qg dGhhdCB5b3UgYXQNCj4gbGVhc3Qgbm90ZSB0aGF0IHRlcm1pbmF0aW5nIGFuIEVBUCB0dW5uZWwg bWV0aG9kIG9uIHRoZQ0KPiBhdXRoZW50aWNhdG9yIGlzIHVudXN1YWwuIEZvciBleGFtcGxlLCB5 b3UgY291bGQgYWRkIGENCj4gcGFyZW50aGV0aWNhbCBjb21tZW50IGxpa2UgIihyYXJlKSIgYWZ0 ZXIgdGhlIGNsYXVzZSAiaWYgdGhlDQo+IG91dGVyIG1ldGhvZCB0dW5uZWwgdGVybWluYXRlcyBv biB0aGUgYXV0aGVudGljYXRvciIuDQoNCkNhbm4ndCBiZSBtb3JlIGFncmVlLg0KVGhlIGxvZ2lj IGFuZCBnb2FsIG9mIHRoZSBsYXN0IHBhcmFncmFwaCBpcyBzdXNwaWNpb3VzLg0KSXQgZ2l2ZXMg YW4gaW1wcmVzc2lvbiB0aGF0IGNoYW5uZWwgYmluZGluZyBvbiB0dW5uZWwgbWV0aG9kIGlzIA0K bm90IGFwcGxpY2FibGUganVzdCBiZWNhdXNlIHRoZSBzcGVjaWZpYyAocmFyZSkgZXhhbXBsZSAg c2hvd24gaXMgDQpubyBnb29kLg0KV2hhdCBhYm91dCBhIGdvb2QgY3J5cHRvIGJpbmRpbmcgaW4g dHVubmVsIG1ldGhvZD8NCg0KDQo= --=_alternative 0009F8CB48257A03_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PHR0Pjxmb250IHNpemU9Mj5lbXUtYm91bmNlc0BpZXRmLm9yZyDQtNPaIDIwMTItMDUt MTkgMDY6MTA6MTk6PGJyPg0KPGJyPg0KJmd0OyBUaGUgbGFzdCBwYXJhZ3JhcGggb2Ygc2VjdGlv biA5LjEgcG9pbnRzIG91dCBhIHNlY3VyaXR5IHByb2JsZW08YnI+DQomZ3Q7IHdpdGggaW1wbGVt ZW50aW5nIGNoYW5uZWwgYmluZGluZ3MgdXNpbmcgRUFQIHR1bm5lbCBtZXRob2RzLiBJZjxicj4N CiZndDsgdGhlIEVBUCB0dW5uZWwgbWV0aG9kIHRlcm1pbmF0ZXMgb24gdGhlIGF1dGhlbnRpY2F0 b3IsIHRoZSBjaGFubmVsPGJyPg0KJmd0OyBiaW5kaW5ncyBjYW4gZWFzaWx5IGJlIGRlZmVhdGVk IGJ5IHRoZSBhdXRoZW50aWNhdG9yLiBXaGlsZSB0aGF0J3M8YnI+DQomZ3Q7IHRydWUsIG5vYm9k eSB0ZXJtaW5hdGVzIHRoZSBFQVAgdHVubmVsIG1ldGhvZCBvbiB0aGUgYXV0aGVudGljYXRvcjxi cj4NCiZndDsgdG9kYXkuIEluIHRoZSBFQVAgbW9kZWwsIHRoZSBhdXRoZW50aWNhdG9yIGlzIG5v dCB0cnVzdGVkIHNvPGJyPg0KJmd0OyB0ZXJtaW5hdGluZyB0aGUgRUFQIHR1bm5lbCBtZXRob2Qg b24gdGhlIGF1dGhlbnRpY2F0b3IgaXMgYSBiYWQ8YnI+DQomZ3Q7IGlkZWEgZm9yIG1hbnkgcmVh c29ucy4gRm9yIGV4YW1wbGUsIHRoZSBhdXRoZW50aWNhdG9yIHdvdWxkIHRoZW48YnI+DQomZ3Q7 IGhhdmUgdGhlIGFiaWxpdHkgdG8gYnlwYXNzIHByb3RlY3RlZCByZXN1bHQgaW5kaWNhdGlvbnMg YW5kIHRvPGJyPg0KJmd0OyBieXBhc3MgYWxsIHRoZSBjcnlwdG9ncmFwaGljIHByb3RlY3Rpb25z IHByb3ZpZGVkIGJ5IHRoZSB0dW5uZWwuPGJyPg0KJmd0OyBTb21ldGltZXMgdGhlcmUgaXMgdmFs dWUgaW4gaGF2aW5nIHRoZSBpbm5lciBhbmQgb3V0ZXIgbWV0aG9kczxicj4NCiZndDsgdGVybWlu YXRlIG9uIGRpZmZlcmVudCBzZXJ2ZXJzIGJ1dCBib3RoIHNlcnZlcnMgbXVzdCBiZSB0cnVzdGVk Ljxicj4NCiZndDsgVGhlIGF1dGhlbnRpY2F0b3IgaXMgbm90LiBTbyB0aGVyZSBpcyBubyBiaWcg c2VjdXJpdHkgaG9sZSBoZXJlLDxicj4NCiZndDsgdW5sZXNzIHlvdSBoYXZlIGFscmVhZHkgb3Bl bmVkIGFuIGVub3Jtb3VzIHNlY3VyaXR5IGhvbGUuIEl0J3M8YnI+DQomZ3Q7IGlyb25pYyB0aGF0 IHRoaXMgZG9jdW1lbnQgd2hpY2ggYXR0ZW1wdHMgdG8gY2xvc2UgdnVsbmVyYWJpbGl0aWVzPGJy Pg0KJmd0OyBjYXVzZWQgYnkgbWFsaWNpb3VzIGF1dGhlbnRpY2F0b3JzIGVuZHMgdXAgc3VidGx5 IHN1Z2dlc3RpbmcgdGhhdDxicj4NCiZndDsgcGVvcGxlIG9wZW4gYSBtdWNoIGxhcmdlciB2dWxu ZXJhYmlsaXR5ITxicj4NCiZndDsgPGJyPg0KJmd0OyBJIHdvdWxkIHJlY29tbWVuZCBkZWxldGlu ZyB0aGUgZW5kIG9mIHRoaXMgcGFyYWdyYXBoLCBzdGFydGluZzxicj4NCiZndDsgd2l0aCB0aGUg c2VudGVuY2UgdGhhdCBzdGFydHMgJnF1b3Q7RXZlbiB3aGVuIGNyeXB0b2dyYXBoaWMgYmluZGlu ZyZxdW90Oy48YnI+DQomZ3Q7IElmIHlvdSBjaG9vc2UgdG8ga2VlcCB0aGlzIHN0cmFuZ2UgdGV4 dCwgSSBzdWdnZXN0IHRoYXQgeW91IGF0PGJyPg0KJmd0OyBsZWFzdCBub3RlIHRoYXQgdGVybWlu YXRpbmcgYW4gRUFQIHR1bm5lbCBtZXRob2Qgb24gdGhlPGJyPg0KJmd0OyBhdXRoZW50aWNhdG9y IGlzIHVudXN1YWwuIEZvciBleGFtcGxlLCB5b3UgY291bGQgYWRkIGE8YnI+DQomZ3Q7IHBhcmVu dGhldGljYWwgY29tbWVudCBsaWtlICZxdW90OyhyYXJlKSZxdW90OyBhZnRlciB0aGUgY2xhdXNl ICZxdW90O2lmDQp0aGU8YnI+DQomZ3Q7IG91dGVyIG1ldGhvZCB0dW5uZWwgdGVybWluYXRlcyBv biB0aGUgYXV0aGVudGljYXRvciZxdW90Oy48YnI+DQo8L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZv bnQgc2l6ZT0yPkNhbm4ndCBiZSBtb3JlIGFncmVlLjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9u dCBzaXplPTI+VGhlIGxvZ2ljIGFuZCBnb2FsIG9mIHRoZSBsYXN0IHBhcmFncmFwaCBpcyBzdXNw aWNpb3VzLjwvZm9udD48L3R0Pg0KPGJyPjx0dD48Zm9udCBzaXplPTI+SXQgZ2l2ZXMgYW4gaW1w cmVzc2lvbiB0aGF0IGNoYW5uZWwgYmluZGluZyBvbiB0dW5uZWwNCm1ldGhvZCBpcyA8L2ZvbnQ+ PC90dD4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPm5vdCBhcHBsaWNhYmxlIGp1c3QgYmVjYXVzZSB0 aGUgc3BlY2lmaWMgKHJhcmUpIGV4YW1wbGUNCiZuYnNwO3Nob3duIGlzIDwvZm9udD48L3R0Pg0K PGJyPjx0dD48Zm9udCBzaXplPTI+bm8gZ29vZC48L2ZvbnQ+PC90dD4NCjxicj48dHQ+PGZvbnQg c2l6ZT0yPldoYXQgYWJvdXQgYSBnb29kIGNyeXB0byBiaW5kaW5nIGluIHR1bm5lbCBtZXRob2Q/ PC9mb250PjwvdHQ+DQo8YnI+DQo8YnI+DQo= --=_alternative 0009F8CB48257A03_=-- From jsalowey@cisco.com Mon May 21 14:01:27 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA5DB21F8557 for ; Mon, 21 May 2012 14:01:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7rwHj-wchdvB for ; Mon, 21 May 2012 14:01:26 -0700 (PDT) Received: from mtv-iport-2.cisco.com (mtv-iport-2.cisco.com [173.36.130.13]) by ietfa.amsl.com (Postfix) with ESMTP id 20FAB21F8551 for ; Mon, 21 May 2012 14:01:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=jsalowey@cisco.com; l=1765; q=dns/txt; s=iport; t=1337634086; x=1338843686; h=from:content-transfer-encoding:subject:date:references: to:message-id:mime-version; bh=0xhPMIDIq1GcQiFjoWf2Ls3nGemw8nxcGc+U1n5nxOE=; b=OEYtPwAWPuzozUzbc3pC3UD/nJWoGlXcGKJl2uV6yyfhrN2wAN3rc3o6 s0xsp6OXlGut0MivYNZFYqs5aBTMHNuK9xOs6eyefRZdeG2TjxLaMrDr+ Yj8X5S+N9bHuUEjhL8nUey7LnIlmFqqf2PCyKrIHA6c6HZNKiZrbrgKy/ 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AisFADSsuk+rRDoJ/2dsb2JhbABEgx2wfYEHghUBAQEDAQEBAQ8BJzQQCxwDAQIvJyYCCBkJGYdnBAyfE6AHiwWCHoI8YgOIQoxZhU+IPYFkgwk X-IronPort-AV: E=Sophos;i="4.75,633,1330905600"; d="scan'208";a="45769524" Received: from mtv-core-4.cisco.com ([171.68.58.9]) by mtv-iport-2.cisco.com with ESMTP; 21 May 2012 21:01:25 +0000 Received: from [10.33.251.111] ([10.33.251.111]) by mtv-core-4.cisco.com (8.14.3/8.14.3) with ESMTP id q4LL1OQ0014769 for ; Mon, 21 May 2012 21:01:24 GMT From: Joe Salowey Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Mon, 21 May 2012 14:01:30 -0700 References: <20120515153614.23260.30775.idtracker@ietfa.amsl.com> To: emu@ietf.org Message-Id: Mime-Version: 1.0 (Apple Message framework v1084) X-Mailer: Apple Mail (2.1084) Subject: [Emu] Fwd: [Nea] I-D Action: draft-ietf-nea-pt-eap-02.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 May 2012 21:01:27 -0000 The NEA working group has produced a draft for carrying NEA posture = methods within EAP. It would be helpful if some EMU working group = members reviewed the draft. Please send your comments to the EMU list = by June 4, 2012. Thanks, Joe Begin forwarded message: > From: internet-drafts@ietf.org > Date: May 15, 2012 8:36:14 AM PDT > To: i-d-announce@ietf.org > Cc: nea@ietf.org > Subject: [Nea] I-D Action: draft-ietf-nea-pt-eap-02.txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. This draft is a work item of the Network Endpoint = Assessment Working Group of the IETF. >=20 > Title : PT-EAP: Posture Transport (PT) Protocol For = EAP Tunnel Methods > Author(s) : Nancy Cam-Winget > Paul Sangster > Filename : draft-ietf-nea-pt-eap-02.txt > Pages : 20 > Date : 2012-05-15 >=20 > This document specifies PT-EAP, an EAP based Posture Transport (PT) > protocol designed to be used only inside a TLS protected tunnel > method. The document also describes the intended applicability of > PT-EAP. >=20 >=20 > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-nea-pt-eap-02.txt >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > This Internet-Draft can be retrieved at: > ftp://ftp.ietf.org/internet-drafts/draft-ietf-nea-pt-eap-02.txt >=20 > The IETF datatracker page for this Internet-Draft is: > https://datatracker.ietf.org/doc/draft-ietf-nea-pt-eap/ >=20 > _______________________________________________ > Nea mailing list > Nea@ietf.org > https://www.ietf.org/mailman/listinfo/nea From hartmans@mit.edu Mon May 21 14:51:13 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 178B621F84D9; Mon, 21 May 2012 14:51:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X5NvhxAskfQy; Mon, 21 May 2012 14:51:12 -0700 (PDT) Received: from permutation-city.suchdamage.org (permutation-city.suchdamage.org [69.25.196.28]) by ietfa.amsl.com (Postfix) with ESMTP id 7954721F8493; Mon, 21 May 2012 14:51:12 -0700 (PDT) Received: from carter-zimmerman.suchdamage.org (unknown [217.28.191.162]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 2982420463; Mon, 21 May 2012 17:51:04 -0400 (EDT) Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id E1BC44151; Mon, 21 May 2012 17:50:57 -0400 (EDT) From: Sam Hartman To: Stephen Hanna References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> Date: Mon, 21 May 2012 17:50:57 -0400 In-Reply-To: (Stephen Hanna's message of "Fri, 18 May 2012 18:10:19 -0400") Message-ID: User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: "ietf@ietf.org" , Sam Hartman , "emu@ietf.org" , "secdir@ietf.org" Subject: Re: [Emu] Updated secdir review of draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 May 2012 21:51:13 -0000 >>>>> "Stephen" == Stephen Hanna writes: Stephen> The changes in draft-ietf-emu-chbind-15.txt satisfactorily Stephen> address almost all of the comments in my April 13, 2012 Stephen> secdir review. I do have one remaining substantive comment Stephen> on this latest draft and two non-substantive ones. Stephen> Substantive Comment ------------------- Stephen> The last paragraph of section 9.1 points out a security Stephen> problem with implementing channel bindings using EAP tunnel Stephen> methods. If the EAP tunnel method terminates on the Stephen> authenticator, the channel bindings can easily be defeated Stephen> by the authenticator. While that's true, nobody terminates Stephen> the EAP tunnel method on the authenticator today. In the Stephen> EAP model, the authenticator is not trusted so terminating Stephen> the EAP tunnel method on the authenticator is a bad idea Stephen> for many reasons. For example, the authenticator would then Stephen> have the ability to bypass protected result indications and Stephen> to bypass all the cryptographic protections provided by the Stephen> tunnel. Sometimes there is value in having the inner and Stephen> outer methods terminate on different servers but both Stephen> servers must be trusted. The authenticator is not. So Stephen> there is no big security hole here, unless you have already Stephen> opened an enormous security hole. It's ironic that this Stephen> document which attempts to close vulnerabilities caused by Stephen> malicious authenticators ends up subtly suggesting that Stephen> people open a much larger vulnerability! Stephen> I would recommend deleting the end of this paragraph, Stephen> starting with the sentence that starts "Even when Stephen> cryptographic binding".> I disagree very strongly with this proposed change. It's possible that the text is not clear and I'd be happy to work for a round or two to see if we can clarify the text, but ending the paragraph as you propose would defeate the point of text we added after a WG consensus call. I agree with you that authenticators are not trusted. The issue is that you cannot trust attackers to act within a specification. If an attacker can gain benefit from doing something, they may do so. So, if an attacker can create a tunnel terminating at an authenticator and gain advantage from doing so, then they will do so. Remember that we're talking about crypto binding. If crypto binding is relevant for confirming there are no extra servers, then we're in a threat model space where we're trusting the inner method to authenticate the server, not the outer method. You can't say "you should only establish trusted tunnels," because we're hoping that crypto binding will give us that trust. So, the issue here is that once you add channel bindings and the associated changes to the threat model to EAP, an authenticator can gain advantage through convincing a client to trust a tunnel that terminates at an authenticator. That is, an authenticator can mount an attack. Yes, the authenticator needs to convince the peer to trust the extra tunnel. However, as I discuss in draft-hartman-emu-mutual-crypto-binding and in my presentation at last IETF, that's often fairly easy. So, how can we make the text more clear? From shanna@juniper.net Tue May 22 13:03:55 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B589421F869E; Tue, 22 May 2012 13:03:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.252 X-Spam-Level: X-Spam-Status: No, score=-105.252 tagged_above=-999 required=5 tests=[AWL=1.347, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AkDmDKxL08d2; Tue, 22 May 2012 13:03:55 -0700 (PDT) Received: from exprod7og109.obsmtp.com (exprod7og109.obsmtp.com [64.18.2.171]) by ietfa.amsl.com (Postfix) with ESMTP id 44F0D21F86A3; Tue, 22 May 2012 13:03:52 -0700 (PDT) Received: from P-EMHUB03-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob109.postini.com ([64.18.6.12]) with SMTP ID DSNKT7vxJ+TDYVW/wC+63FzmvM056h/Z6qAp@postini.com; Tue, 22 May 2012 13:03:53 PDT Received: from p-emfe02-wf.jnpr.net (172.28.145.25) by P-EMHUB03-HQ.jnpr.net (172.24.192.37) with Microsoft SMTP Server (TLS) id 8.3.213.0; Tue, 22 May 2012 13:00:21 -0700 Received: from EMBX01-WF.jnpr.net ([fe80::1914:3299:33d9:e43b]) by p-emfe02-wf.jnpr.net ([fe80::c126:c633:d2dc:8090%11]) with mapi; Tue, 22 May 2012 16:00:20 -0400 From: Stephen Hanna To: Sam Hartman Date: Tue, 22 May 2012 16:00:19 -0400 Thread-Topic: Updated secdir review of draft-ietf-emu-chbind-15.txt Thread-Index: Ac03m9Vz0ExW5KUcShO4ogGhcZvyUgAAFxvw Message-ID: References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "ietf@ietf.org" , "emu@ietf.org" , "secdir@ietf.org" Subject: Re: [Emu] Updated secdir review of draft-ietf-emu-chbind-15.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 May 2012 20:03:55 -0000 Sam, I see now that you are concerned not with circumstances where the NAS terminates the tunnel by design but rather with times when the NAS is maliciously terminating the tunnel. I'm glad that we both agree that having the NAS terminate the tunnel is highly undesirable. That did not come through in the draft. I'm much relieved to learn that nobody is suggesting this as a desirable outcome. I agree that it's an attack scenario that must be considered and carefully addressed. Maybe we can resolve this issue by clarifying the text to say more clearly that we're dealing with an attack scenario here. For example, we could add a sentence before the words "Tunnel methods sometimes use" saying something like "However, this is not secure if the NAS can terminate the tunnel (a highly undesirable situation)." Then you can mention several countermeasures against such an attack: mutual cryptographic bindings (still just a -00 individual draft), carefully checking the EAP server's identity, etc. We might also take this opportunity to split this long paragraph into two: one that includes the first three sentences (describing how EAP tunnel methods can support channel binding) and another describing the attack scenario and countermeasures. Thanks, Steve > -----Original Message----- > From: Sam Hartman [mailto:hartmans-ietf@mit.edu] > Sent: Monday, May 21, 2012 5:51 PM > To: Stephen Hanna > Cc: Sam Hartman; emu@ietf.org; secdir@ietf.org; ietf@ietf.org > Subject: Re: Updated secdir review of draft-ietf-emu-chbind-15.txt > Importance: High >=20 > >>>>> "Stephen" =3D=3D Stephen Hanna writes: >=20 > Stephen> The changes in draft-ietf-emu-chbind-15.txt satisfactorily > Stephen> address almost all of the comments in my April 13, 2012 > Stephen> secdir review. I do have one remaining substantive comment > Stephen> on this latest draft and two non-substantive ones. >=20 > Stephen> Substantive Comment ------------------- >=20 > Stephen> The last paragraph of section 9.1 points out a security > Stephen> problem with implementing channel bindings using EAP > tunnel > Stephen> methods. If the EAP tunnel method terminates on the > Stephen> authenticator, the channel bindings can easily be defeated > Stephen> by the authenticator. While that's true, nobody terminates > Stephen> the EAP tunnel method on the authenticator today. In the > Stephen> EAP model, the authenticator is not trusted so terminating > Stephen> the EAP tunnel method on the authenticator is a bad idea > Stephen> for many reasons. For example, the authenticator would > then > Stephen> have the ability to bypass protected result indications > and > Stephen> to bypass all the cryptographic protections provided by > the > Stephen> tunnel. Sometimes there is value in having the inner and > Stephen> outer methods terminate on different servers but both > Stephen> servers must be trusted. The authenticator is not. So > Stephen> there is no big security hole here, unless you have > already > Stephen> opened an enormous security hole. It's ironic that this > Stephen> document which attempts to close vulnerabilities caused by > Stephen> malicious authenticators ends up subtly suggesting that > Stephen> people open a much larger vulnerability! >=20 > Stephen> I would recommend deleting the end of this paragraph, > Stephen> starting with the sentence that starts "Even when > Stephen> cryptographic binding".> >=20 > I disagree very strongly with this proposed change. It's possible that > the text is not clear and I'd be happy to work for a round or two to > see > if we can clarify the text, but ending the paragraph as you propose > would defeate the point of text we added after a WG consensus call. >=20 > I agree with you that authenticators are not trusted. > The issue is that you cannot trust attackers to act within a > specification. > If an attacker can gain benefit from doing something, they may do so. >=20 > So, if an attacker can create a tunnel terminating at an authenticator > and gain advantage from doing so, then they will do so. >=20 > Remember that we're talking about crypto binding. If crypto binding is > relevant for confirming there are no extra servers, then we're in a > threat model space where we're trusting the inner method to > authenticate > the server, not the outer method. You can't say "you should only > establish trusted tunnels," because we're hoping that crypto binding > will give us that trust. So, the issue here is that once you add > channel bindings and the associated changes to the threat model to EAP, > an authenticator can gain advantage through convincing a client to > trust > a tunnel that terminates at an authenticator. That is, an > authenticator > can mount an attack. Yes, the authenticator needs to convince the peer > to trust the extra tunnel. However, as I discuss in > draft-hartman-emu-mutual-crypto-binding and in my presentation at last > IETF, that's often fairly easy. >=20 > So, how can we make the text more clear? From internet-drafts@ietf.org Thu May 24 03:41:00 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB69621F863E; Thu, 24 May 2012 03:41:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.524 X-Spam-Level: X-Spam-Status: No, score=-102.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hTrhEOP2aNVe; Thu, 24 May 2012 03:41:00 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8211E21F8606; Thu, 24 May 2012 03:41:00 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.02 Message-ID: <20120524104100.26389.88959.idtracker@ietfa.amsl.com> Date: Thu, 24 May 2012 03:41:00 -0700 Cc: emu@ietf.org Subject: [Emu] I-D Action: draft-ietf-emu-chbind-16.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 May 2012 10:41:01 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the EAP Method Update Working Group of th= e IETF. Title : Channel Binding Support for EAP Methods Author(s) : Sam Hartman T. Charles Clancy Katrin Hoeper Filename : draft-ietf-emu-chbind-16.txt Pages : 33 Date : 2012-05-24 This document defines how to implement channel bindings for Extensible Authentication Protocol (EAP) methods to address the lying Network Access Service (NAS) as well as the lying provider problem. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-emu-chbind-16.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-emu-chbind-16.txt The IETF datatracker page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-emu-chbind/ From shanna@juniper.net Thu May 24 06:10:03 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC28121F852A; Thu, 24 May 2012 06:10:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.701 X-Spam-Level: X-Spam-Status: No, score=-105.701 tagged_above=-999 required=5 tests=[AWL=0.898, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id toA1ntr12YBi; Thu, 24 May 2012 06:10:03 -0700 (PDT) Received: from exprod7og114.obsmtp.com (exprod7og114.obsmtp.com [64.18.2.215]) by ietfa.amsl.com (Postfix) with ESMTP id 6AF3B21F8523; Thu, 24 May 2012 06:10:01 -0700 (PDT) Received: from P-EMHUB01-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob114.postini.com ([64.18.6.12]) with SMTP ID DSNKT74zKPRnXvty282Gmexf/Q9g1Y89DavE@postini.com; Thu, 24 May 2012 06:10:02 PDT Received: from p-emfe02-wf.jnpr.net (172.28.145.25) by P-EMHUB01-HQ.jnpr.net (172.24.192.35) with Microsoft SMTP Server (TLS) id 8.3.213.0; Thu, 24 May 2012 06:07:35 -0700 Received: from EMBX01-WF.jnpr.net ([fe80::1914:3299:33d9:e43b]) by p-emfe02-wf.jnpr.net ([fe80::c126:c633:d2dc:8090%11]) with mapi; Thu, 24 May 2012 09:07:35 -0400 From: Stephen Hanna To: Sam Hartman Date: Thu, 24 May 2012 09:07:33 -0400 Thread-Topic: Updated secdir review of draft-ietf-emu-chbind-16.txt Thread-Index: Ac03m9Vz0ExW5KUcShO4ogGhcZvyUgAAFxvwAIQuNxA= Message-ID: References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "ietf@ietf.org" , "emu@ietf.org" , "secdir@ietf.org" Subject: [Emu] Updated secdir review of draft-ietf-emu-chbind-16.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 May 2012 13:10:04 -0000 Sam, Thanks for addressing my comments in draft-ietf-emu-chbind-16.txt. I'm happy with this version. All my substantive concerns are addressed. I do see two non-substantive issues. These can be addressed in some future version or not at all. 1) The word "subvert" is misspelled as "subvirt" in the new text. 2) Editing Charles Clancy's address in the Authors' Addresses section has apparently caused the list of authors in the top right corner of the first page to revert to this suboptimal form: EMU Working Group S. Hartman, Ed. Internet-Draft Painless Security Intended status: Standards Track T. Clancy Expires: November 25, 2012 Department of Electrical Engineering and Computer Science K. Hoeper Motorola Solutions, Inc. As you can see, Dr. Clancy's affiliation has now changed back to "Department of Electrical Engineering and Computer Science". I guess that whatever tool you're using to create the draft must insist on placing the second line of each author's address on the first page. If that's the case, you might want to change Dr. Clancy's address to T. Charles Clancy Virginia Tech Department of Electrical Engineering and Computer Science Arlington, VA 22203 USA Or perhaps you'll just have to surrender to the flawed tool and leave the credit for Dr. Clancy on the first page as nonsensical. Thanks for your patience in addressing the issues that I raised. I think the document is much better for this attention. Take care, Steve > -----Original Message----- > From: Stephen Hanna > Sent: Tuesday, May 22, 2012 4:00 PM > To: 'Sam Hartman' > Cc: emu@ietf.org; secdir@ietf.org; ietf@ietf.org > Subject: RE: Updated secdir review of draft-ietf-emu-chbind-15.txt >=20 > Sam, >=20 > I see now that you are concerned not with circumstances where > the NAS terminates the tunnel by design but rather with times > when the NAS is maliciously terminating the tunnel. I'm glad > that we both agree that having the NAS terminate the tunnel > is highly undesirable. That did not come through in the draft. > I'm much relieved to learn that nobody is suggesting this > as a desirable outcome. I agree that it's an attack scenario > that must be considered and carefully addressed. >=20 > Maybe we can resolve this issue by clarifying the text to > say more clearly that we're dealing with an attack scenario > here. For example, we could add a sentence before the words > "Tunnel methods sometimes use" saying something like "However, > this is not secure if the NAS can terminate the tunnel (a > highly undesirable situation)." Then you can mention several > countermeasures against such an attack: mutual cryptographic > bindings (still just a -00 individual draft), carefully > checking the EAP server's identity, etc. We might also take > this opportunity to split this long paragraph into two: > one that includes the first three sentences (describing how > EAP tunnel methods can support channel binding) and another > describing the attack scenario and countermeasures. >=20 > Thanks, >=20 > Steve >=20 > > -----Original Message----- > > From: Sam Hartman [mailto:hartmans-ietf@mit.edu] > > Sent: Monday, May 21, 2012 5:51 PM > > To: Stephen Hanna > > Cc: Sam Hartman; emu@ietf.org; secdir@ietf.org; ietf@ietf.org > > Subject: Re: Updated secdir review of draft-ietf-emu-chbind-15.txt > > Importance: High > > > > >>>>> "Stephen" =3D=3D Stephen Hanna writes: > > > > Stephen> The changes in draft-ietf-emu-chbind-15.txt > satisfactorily > > Stephen> address almost all of the comments in my April 13, 2012 > > Stephen> secdir review. I do have one remaining substantive > comment > > Stephen> on this latest draft and two non-substantive ones. > > > > Stephen> Substantive Comment ------------------- > > > > Stephen> The last paragraph of section 9.1 points out a security > > Stephen> problem with implementing channel bindings using EAP > > tunnel > > Stephen> methods. If the EAP tunnel method terminates on the > > Stephen> authenticator, the channel bindings can easily be > defeated > > Stephen> by the authenticator. While that's true, nobody > terminates > > Stephen> the EAP tunnel method on the authenticator today. In the > > Stephen> EAP model, the authenticator is not trusted so > terminating > > Stephen> the EAP tunnel method on the authenticator is a bad idea > > Stephen> for many reasons. For example, the authenticator would > > then > > Stephen> have the ability to bypass protected result indications > > and > > Stephen> to bypass all the cryptographic protections provided by > > the > > Stephen> tunnel. Sometimes there is value in having the inner > and > > Stephen> outer methods terminate on different servers but both > > Stephen> servers must be trusted. The authenticator is not. So > > Stephen> there is no big security hole here, unless you have > > already > > Stephen> opened an enormous security hole. It's ironic that this > > Stephen> document which attempts to close vulnerabilities caused > by > > Stephen> malicious authenticators ends up subtly suggesting that > > Stephen> people open a much larger vulnerability! > > > > Stephen> I would recommend deleting the end of this paragraph, > > Stephen> starting with the sentence that starts "Even when > > Stephen> cryptographic binding".> > > > > I disagree very strongly with this proposed change. It's possible > that > > the text is not clear and I'd be happy to work for a round or two to > > see > > if we can clarify the text, but ending the paragraph as you propose > > would defeate the point of text we added after a WG consensus call. > > > > I agree with you that authenticators are not trusted. > > The issue is that you cannot trust attackers to act within a > > specification. > > If an attacker can gain benefit from doing something, they may do so. > > > > So, if an attacker can create a tunnel terminating at an > authenticator > > and gain advantage from doing so, then they will do so. > > > > Remember that we're talking about crypto binding. If crypto binding > is > > relevant for confirming there are no extra servers, then we're in a > > threat model space where we're trusting the inner method to > > authenticate > > the server, not the outer method. You can't say "you should only > > establish trusted tunnels," because we're hoping that crypto binding > > will give us that trust. So, the issue here is that once you add > > channel bindings and the associated changes to the threat model to > EAP, > > an authenticator can gain advantage through convincing a client to > > trust > > a tunnel that terminates at an authenticator. That is, an > > authenticator > > can mount an attack. Yes, the authenticator needs to convince the > peer > > to trust the extra tunnel. However, as I discuss in > > draft-hartman-emu-mutual-crypto-binding and in my presentation at > last > > IETF, that's often fairly easy. > > > > So, how can we make the text more clear? From turners@ieca.com Fri May 25 05:57:43 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3063D21F8690 for ; Fri, 25 May 2012 05:57:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.207 X-Spam-Level: X-Spam-Status: No, score=-102.207 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id djV4wdi-gvXo for ; Fri, 25 May 2012 05:57:42 -0700 (PDT) Received: from gateway09.websitewelcome.com (gateway09.websitewelcome.com [67.18.22.68]) by ietfa.amsl.com (Postfix) with ESMTP id 5626D21F8687 for ; Fri, 25 May 2012 05:57:42 -0700 (PDT) Received: by gateway09.websitewelcome.com (Postfix, from userid 507) id CAC146FB30B48; Fri, 25 May 2012 07:57:41 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway09.websitewelcome.com (Postfix) with ESMTP id BD2A16FB30B28 for ; Fri, 25 May 2012 07:57:41 -0500 (CDT) Received: from [96.231.123.235] (port=35380 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.77) (envelope-from ) id 1SXu5M-0005cW-TS; Fri, 25 May 2012 07:57:41 -0500 Message-ID: <4FBF81C4.7050503@ieca.com> Date: Fri, 25 May 2012 08:57:40 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Stephen Hanna References: <20120514190642.11168.14882.idtracker@ietfa.amsl.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [96.231.123.235]:35380 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 5 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: "secdir@ietf.org" , Sam Hartman , "ietf@ietf.org" , "emu@ietf.org" Subject: Re: [Emu] Updated secdir review of draft-ietf-emu-chbind-16.txt X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 May 2012 12:57:43 -0000 Steve/Sam, I've gone ahead and entered fixes for these two as RFC editor notes to ensure we won't forget them. Thanks for working through this! spt On 5/24/12 9:07 AM, Stephen Hanna wrote: > Sam, > > Thanks for addressing my comments in draft-ietf-emu-chbind-16.txt. > I'm happy with this version. All my substantive concerns are addressed. > > I do see two non-substantive issues. These can be addressed in some > future version or not at all. > > 1) The word "subvert" is misspelled as "subvirt" in the new text. > > 2) Editing Charles Clancy's address in the Authors' Addresses section > has apparently caused the list of authors in the top right corner of > the first page to revert to this suboptimal form: > > EMU Working Group S. Hartman, Ed. > Internet-Draft Painless Security > Intended status: Standards Track T. Clancy > Expires: November 25, 2012 Department of Electrical > Engineering and Computer Science > K. Hoeper > Motorola Solutions, Inc. > > As you can see, Dr. Clancy's affiliation has now changed back to > "Department of Electrical Engineering and Computer Science". I guess > that whatever tool you're using to create the draft must insist on > placing the second line of each author's address on the first page. > If that's the case, you might want to change Dr. Clancy's address to > > T. Charles Clancy > Virginia Tech > Department of Electrical Engineering and Computer Science > Arlington, VA 22203 > USA > > Or perhaps you'll just have to surrender to the flawed tool and > leave the credit for Dr. Clancy on the first page as nonsensical. > > Thanks for your patience in addressing the issues that I raised. > I think the document is much better for this attention. > > Take care, > > Steve > >> -----Original Message----- >> From: Stephen Hanna >> Sent: Tuesday, May 22, 2012 4:00 PM >> To: 'Sam Hartman' >> Cc: emu@ietf.org; secdir@ietf.org; ietf@ietf.org >> Subject: RE: Updated secdir review of draft-ietf-emu-chbind-15.txt >> >> Sam, >> >> I see now that you are concerned not with circumstances where >> the NAS terminates the tunnel by design but rather with times >> when the NAS is maliciously terminating the tunnel. I'm glad >> that we both agree that having the NAS terminate the tunnel >> is highly undesirable. That did not come through in the draft. >> I'm much relieved to learn that nobody is suggesting this >> as a desirable outcome. I agree that it's an attack scenario >> that must be considered and carefully addressed. >> >> Maybe we can resolve this issue by clarifying the text to >> say more clearly that we're dealing with an attack scenario >> here. For example, we could add a sentence before the words >> "Tunnel methods sometimes use" saying something like "However, >> this is not secure if the NAS can terminate the tunnel (a >> highly undesirable situation)." Then you can mention several >> countermeasures against such an attack: mutual cryptographic >> bindings (still just a -00 individual draft), carefully >> checking the EAP server's identity, etc. We might also take >> this opportunity to split this long paragraph into two: >> one that includes the first three sentences (describing how >> EAP tunnel methods can support channel binding) and another >> describing the attack scenario and countermeasures. >> >> Thanks, >> >> Steve >> >>> -----Original Message----- >>> From: Sam Hartman [mailto:hartmans-ietf@mit.edu] >>> Sent: Monday, May 21, 2012 5:51 PM >>> To: Stephen Hanna >>> Cc: Sam Hartman; emu@ietf.org; secdir@ietf.org; ietf@ietf.org >>> Subject: Re: Updated secdir review of draft-ietf-emu-chbind-15.txt >>> Importance: High >>> >>>>>>>> "Stephen" == Stephen Hanna writes: >>> >>> Stephen> The changes in draft-ietf-emu-chbind-15.txt >> satisfactorily >>> Stephen> address almost all of the comments in my April 13, 2012 >>> Stephen> secdir review. I do have one remaining substantive >> comment >>> Stephen> on this latest draft and two non-substantive ones. >>> >>> Stephen> Substantive Comment ------------------- >>> >>> Stephen> The last paragraph of section 9.1 points out a security >>> Stephen> problem with implementing channel bindings using EAP >>> tunnel >>> Stephen> methods. If the EAP tunnel method terminates on the >>> Stephen> authenticator, the channel bindings can easily be >> defeated >>> Stephen> by the authenticator. While that's true, nobody >> terminates >>> Stephen> the EAP tunnel method on the authenticator today. In the >>> Stephen> EAP model, the authenticator is not trusted so >> terminating >>> Stephen> the EAP tunnel method on the authenticator is a bad idea >>> Stephen> for many reasons. For example, the authenticator would >>> then >>> Stephen> have the ability to bypass protected result indications >>> and >>> Stephen> to bypass all the cryptographic protections provided by >>> the >>> Stephen> tunnel. Sometimes there is value in having the inner >> and >>> Stephen> outer methods terminate on different servers but both >>> Stephen> servers must be trusted. The authenticator is not. So >>> Stephen> there is no big security hole here, unless you have >>> already >>> Stephen> opened an enormous security hole. It's ironic that this >>> Stephen> document which attempts to close vulnerabilities caused >> by >>> Stephen> malicious authenticators ends up subtly suggesting that >>> Stephen> people open a much larger vulnerability! >>> >>> Stephen> I would recommend deleting the end of this paragraph, >>> Stephen> starting with the sentence that starts "Even when >>> Stephen> cryptographic binding".> >>> >>> I disagree very strongly with this proposed change. It's possible >> that >>> the text is not clear and I'd be happy to work for a round or two to >>> see >>> if we can clarify the text, but ending the paragraph as you propose >>> would defeate the point of text we added after a WG consensus call. >>> >>> I agree with you that authenticators are not trusted. >>> The issue is that you cannot trust attackers to act within a >>> specification. >>> If an attacker can gain benefit from doing something, they may do so. >>> >>> So, if an attacker can create a tunnel terminating at an >> authenticator >>> and gain advantage from doing so, then they will do so. >>> >>> Remember that we're talking about crypto binding. If crypto binding >> is >>> relevant for confirming there are no extra servers, then we're in a >>> threat model space where we're trusting the inner method to >>> authenticate >>> the server, not the outer method. You can't say "you should only >>> establish trusted tunnels," because we're hoping that crypto binding >>> will give us that trust. So, the issue here is that once you add >>> channel bindings and the associated changes to the threat model to >> EAP, >>> an authenticator can gain advantage through convincing a client to >>> trust >>> a tunnel that terminates at an authenticator. That is, an >>> authenticator >>> can mount an attack. Yes, the authenticator needs to convince the >> peer >>> to trust the extra tunnel. However, as I discuss in >>> draft-hartman-emu-mutual-crypto-binding and in my presentation at >> last >>> IETF, that's often fairly easy. >>> >>> So, how can we make the text more clear? > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > From iesg-secretary@ietf.org Fri May 25 13:39:19 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4E8F21F87EE; Fri, 25 May 2012 13:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.415 X-Spam-Level: X-Spam-Status: No, score=-102.415 tagged_above=-999 required=5 tests=[AWL=0.184, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WdU6pEpfwlsf; Fri, 25 May 2012 13:39:19 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3243E21F87F2; Fri, 25 May 2012 13:39:19 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 4.02 Message-ID: <20120525203919.12631.2129.idtracker@ietfa.amsl.com> Date: Fri, 25 May 2012 13:39:19 -0700 Cc: emu mailing list , emu chair , RFC Editor Subject: [Emu] Protocol Action: 'Channel Binding Support for EAP Methods' to Proposed Standard (draft-ietf-emu-chbind-16.txt) X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 May 2012 20:39:20 -0000 The IESG has approved the following document: - 'Channel Binding Support for EAP Methods' (draft-ietf-emu-chbind-16.txt) as Proposed Standard This document is the product of the EAP Method Update Working Group. The IESG contact persons are Sean Turner and Stephen Farrell. A URL of this Internet Draft is: http://datatracker.ietf.org/doc/draft-ietf-emu-chbind/ Technical Summary This document defines how to implement channel bindings for Extensible Authentication Protocol (EAP) methods to address the lying NAS as well as the lying provider problem. Working Group Summary This document has had extensive review in the EMU working group. The document has clear applicability in ABFAB and Network Access use cases. Document Quality Project Moonshot, an ABFAB implementation, is working on an implementation of this document. Personnel Joe Salowey (jsalowey@cisco.com), EMU working group co-chair, is the Working Group Shepherd for this document. Sean Turner (turners@ieca.com) is the responsible AD. RFC Editor Note Two things: 1) s9.1: r/subvirt/subvert 2) Title page (xml2rfc fun on the title page): OLD: T. Clancy Department of Electrical Engineering and Computer Science NEW: T. Clancy Virginia Tech From zhou.sujing@zte.com.cn Thu May 31 19:12:17 2012 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AB1011E80E0 for ; Thu, 31 May 2012 19:12:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -95.212 X-Spam-Level: X-Spam-Status: No, score=-95.212 tagged_above=-999 required=5 tests=[AWL=2.422, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RCVD_DOUBLE_IP_LOOSE=0.76, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dCoTx2fakaq9 for ; Thu, 31 May 2012 19:12:16 -0700 (PDT) Received: from mx5.zte.com.cn (mx6.zte.com.cn [95.130.199.165]) by ietfa.amsl.com (Postfix) with ESMTP id 5B11B11E8072 for ; Thu, 31 May 2012 19:12:15 -0700 (PDT) Received: from [10.30.17.100] by mx5.zte.com.cn with surfront esmtp id 286201794749335; Fri, 1 Jun 2012 10:12:12 +0800 (CST) Received: from [10.30.3.20] by [192.168.168.16] with StormMail ESMTP id 93950.1794749335; Fri, 1 Jun 2012 10:11:54 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse01.zte.com.cn with ESMTP id q512C3CN059896 for ; Fri, 1 Jun 2012 10:12:03 +0800 (GMT-8) (envelope-from zhou.sujing@zte.com.cn) In-Reply-To: <20120525203919.12631.2129.idtracker@ietfa.amsl.com> To: emu@ietf.org MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.6 March 06, 2007 Message-ID: From: zhou.sujing@zte.com.cn Date: Fri, 1 Jun 2012 10:11:48 +0800 X-MIMETrack: Serialize by Router on notes_smtp/zte_ltd(Release 8.5.1FP4|July 25, 2010) at 2012-06-01 10:12:04, Serialize complete at 2012-06-01 10:12:04 Content-Type: multipart/alternative; boundary="=_alternative 000C20BF48257A10_=" X-MAIL: mse01.zte.com.cn q512C3CN059896 Subject: [Emu] reference Information about channel binding and crypto binding X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jun 2012 02:12:17 -0000 This is a multipart message in MIME format. --=_alternative 000C20BF48257A10_= Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: base64 SSBmb3VuZCAzIHJlZmVyZW5jZXMgbWF5IGJlIGhlbHBmdWw6DQoNCjEuIGh0dHA6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LW9oYmEtZWFwLWNoYW5uZWwtYmluZGluZy0wMg0KDQpbRUFQLUNI QU5ORUxdICBPaGJhLCBZLiwgUGFydGhhc3JhdGh5LCBNLiwgYW5kIE0uIFlhbmFnaXlhLCAiQ2hh bm5lbA0KICAgICAgICAgICAgICAgICAgQmluZGluZyBNZWNoYW5pc20gQmFzZWQgb24gUGFyYW1l dGVyIEJpbmRpbmcgaW4gS2V5DQogICAgICAgICAgICAgICAgICBEZXJpdmF0aW9uIiwgDQoNCiAg IEluIHRoaXMgYXBwcm9hY2ggdGhlICBFQVAgbWV0aG9kIGluY2x1ZGVzIGNoYW5uZWwgYmluZGlu ZyBwYXJhbWV0ZXJzIGluIA0KdGhlIGNhbGN1bGF0aW9uIG9mDQogICBleHBvcnRlZCBFQVAga2V5 aW5nIG1hdGVyaWFsLCBtYWtpbmcgaXQgaW1wb3NzaWJsZSBmb3IgdGhlIHBlZXIgYW5kDQogICBh dXRoZW50aWNhdG9yIHRvIGNvbXBsZXRlIHRoZSBTZWN1cmUgQXNzb2NpYXRpb24gUHJvdG9jb2wg aWYgdGhlcmUgaXMNCiAgIGEgbWlzbWF0Y2ggaW4gdGhlIGNoYW5uZWwgYmluZGluZyBwYXJhbWV0 ZXJzLiAgSG93ZXZlciwgdGhpcyBhcHByb2FjaA0KICAgY2FuIG9ubHkgYmUgYXBwbGllZCB3aGVy ZSBtZXRob2RzIGdlbmVyYXRpbmcgRUFQIGtleWluZyBtYXRlcmlhbCBhcmUNCiAgIHVzZWQgYWxv bmcgd2l0aCBsb3dlciBsYXllcnMgdGhhdCB1dGlsaXplIEVBUCBrZXlpbmcgbWF0ZXJpYWwuICBG b3INCiAgIGV4YW1wbGUsIHRoaXMgbWVjaGFuaXNtIHdvdWxkIG5vdCBlbmFibGUgdmVyaWZpY2F0 aW9uIG9mIGNoYW5uZWwNCiAgIGJpbmRpbmcgb24gd2lyZWQgSUVFRSA4MDIgbmV0d29ya3MgdXNp bmcgW0lFRUUtODAyLjFYXS4NCg0KSXQgdGFsa2VkIGFib3V0IHRlY2huaXF1ZSBtZW50aW9uZWQg aW4gY3VycmVudCBjaGFubmVsIGJpbmRpbmcuDQoNCg0KMi4gaW4gcmZjIDUyNDcgc2VjdGlvbiAg NS4zLjQuICBNdXR1YWwgQXV0aGVudGljYXRpb24NCiAgVXNpbmcgRU1TSyBpbiBjcnlwdG8gYmlu ZGluZyB3YXMgbWVudGlvbmVkLCBtYXliZSBoZWxwZnVsIGluIGN1cnJlbnQgDQpjcnlwdG8gYmlu ZGluZw0KIA0KICAiU2luY2UgIHRoZSBjb21wb3VuZCBrZXkgTVVTVCBOT1QgYmUga25vd24gdG8g YW4gYXR0YWNrZXIgcG9zaW5nIGFzIGFuDQogICBhdXRoZW50aWNhdG9yLCBhbmQgeWV0IG11c3Qg YmUgZGVyaXZlZCBmcm9tIEVBUCBrZXlpbmcgbWF0ZXJpYWwsIGl0DQogICBNQVkgYmUgZGVzaXJh YmxlIHRvIGRlcml2ZSB0aGUgY29tcG91bmQga2V5IGZyb20gYSBwb3J0aW9uIG9mIHRoZQ0KICAg RU1TSy4gIFdoZXJlIHRoaXMgaXMgZG9uZSwgaW4gb3JkZXIgdG8gcHJvdmlkZSBwcm9wZXIga2V5 IGh5Z2llbmUsIGl0DQogICBpcyBSRUNPTU1FTkRFRCB0aGF0IHRoZSBjb21wb3VuZCBrZXkgdXNl ZCBmb3IgbWFuLWluLXRoZS1taWRkbGUNCiAgIHByb3RlY3Rpb24gYmUgY3J5cHRvZ3JhcGhpY2Fs bHkgc2VwYXJhdGUgZnJvbSBvdGhlciBrZXlzIGRlcml2ZWQgZnJvbQ0KICAgdGhlIEVNU0suIg0K DQozLiBhbHNvIGluIHJmYyA1MjQ3DQogDQogICBURUtzIGFyZSBvdXRwdXQgZnJvbSBFQVAgbWV0 aG9kcyBhbmQgd2VyZSBkZXNpZ25lZCB0byBzZWN1cmUgdGhlIA0KY2hhbm5lbCwNCiAgIGNvdWxk bid0IHRoZXkgYmUgdXNlZCBpbiBjaGFubmVsIGJpbmRpbmcgb3IgY3J5cHRvIGJpbmRpbmc/IA0K IA0KICAiVHJhbnNpZW50IEVBUCBLZXlzIChURUtzKQ0KICAgICAgU2Vzc2lvbiBrZXlzIHRoYXQg YXJlIHVzZWQgdG8gZXN0YWJsaXNoIGEgcHJvdGVjdGVkIGNoYW5uZWwNCiAgICAgIGJldHdlZW4g dGhlIEVBUCBwZWVyIGFuZCBzZXJ2ZXIgZHVyaW5nIHRoZSBFQVAgYXV0aGVudGljYXRpb24NCiAg ICAgIGV4Y2hhbmdlLiAgVGhlIFRFS3MgYXJlIGFwcHJvcHJpYXRlIGZvciB1c2Ugd2l0aCB0aGUg Y2lwaGVyc3VpdGUNCiAgICAgIG5lZ290aWF0ZWQgYmV0d2VlbiBFQVAgcGVlciBhbmQgc2VydmVy IGZvciB1c2UgaW4gcHJvdGVjdGluZyB0aGUNCiAgICAgIEVBUCBjb252ZXJzYXRpb24uICBUaGUg VEVLcyBhcmUgc3RvcmVkIGxvY2FsbHkgYnkgdGhlIEVBUCBtZXRob2QNCiAgICAgIGFuZCBhcmUg bm90IGV4cG9ydGVkLiAgTm90ZSB0aGF0IHRoZSBjaXBoZXJzdWl0ZSB1c2VkIHRvIHNldCB1cA0K ICAgICAgdGhlIHByb3RlY3RlZCBjaGFubmVsIGJldHdlZW4gdGhlIEVBUCBwZWVyIGFuZCBzZXJ2 ZXIgZHVyaW5nIEVBUA0KICAgICAgYXV0aGVudGljYXRpb24gaXMgdW5yZWxhdGVkIHRvIHRoZSBj aXBoZXJzdWl0ZSB1c2VkIHRvDQogICAgICBzdWJzZXF1ZW50bHkgcHJvdGVjdCBkYXRhIHNlbnQg YmV0d2VlbiB0aGUgRUFQIHBlZXIgYW5kDQogICAgICBhdXRoZW50aWNhdG9yLg0KIg0KKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsgICAg ICAgICAtLS0rDQp8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAgICAgICAgIF4NCnwgICAgICAgICAgICAgICAgRUFQIE1ldGhvZCAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgfA0KfCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAg ICB8DQp8ICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rICAgKy0rLSstKy0rLSst Ky0rICAgfCAgICAgICAgICAgIHwNCnwgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICB8ICAgICAgICAgICAgIHwgICB8ICAgICAgICAgICAgfA0KfCB8ICAgICAgIEVBUCBNZXRo b2QgS2V5ICAgICAgICAgICAgfDwtPnwgTG9uZy1UZXJtICAgfCAgIHwgICAgICAgICAgICB8DQp8 IHwgICAgICAgICBEZXJpdmF0aW9uICAgICAgICAgICAgICB8ICAgfCBDcmVkZW50aWFsICB8ICAg fCAgICAgICAgICAgIHwNCnwgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICB8 ICAgICAgICAgICAgIHwgICB8ICAgICAgICAgICAgfA0KfCB8ICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICstKy0rLSstKy0rLSstKyAgIHwgIExvY2FsIHRvICB8DQp8IHwgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgfCAgICAg ICBFQVAgIHwNCnwgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsgICAgICAgICAg ICAgICAgICAgICB8ICAgICBNZXRob2QgfA0KfCAgIHwgICAgICAgICAgICAgfCAgICAgICAgICAg ICAgIHwgICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICB8DQp8ICAgfCAgICAgICAg ICAgICB8ICAgICAgICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAg IHwNCnwgICB8ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICAgICAg ICAgICB8ICAgICAgICAgICAgfA0KfCAgIHwgICAgICAgICAgICAgfCAgICAgICAgICAgICAgIHwg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgICB8DQp8ICAgfCAgICAgICAgICstKy0r LSstKy0rLSsgKy0rLSstKy0rLSstKyArLSstKy0rLSstKy0rLSsgfCAgICAgICAgICAgIHwNCnwg ICB8ICAgICAgICAgfCBURUsgICAgICAgfCB8TVNLLCBFTVNLICB8IHxJViAgICAgICAgICAgfCB8 ICAgICAgICAgICAgfA0KfCAgIHwgICAgICAgICB8RGVyaXZhdGlvbiB8IHxEZXJpdmF0aW9uIHwg fERlcml2YXRpb24gICB8IHwgICAgICAgICAgICB8DQp8ICAgfCAgICAgICAgIHwgICAgICAgICAg IHwgfCAgICAgICAgICAgfCB8KERlcHJlY2F0ZWQpIHwgfCAgICAgICAgICAgIHwNCnwgICB8ICAg ICAgICAgKy0rLSstKy0rLSstKyArLSstKy0rLSstKy0rICstKy0rLSstKy0rLSstKyB8ICAgICAg ICAgICAgfA0KfCAgIHwgICAgICAgICAgICAgICBeICAgICAgICAgICAgIHwgICAgICAgICAgICAg ICB8ICAgICAgIHwgICAgICAgICAgICB8DQp8ICAgfCAgICAgICAgICAgICAgIHwgICAgICAgICAg ICAgfCAgICAgICAgICAgICAgIHwgICAgICAgfCAgICAgICAgICAgIFYNCistKy18LSstKy0rLSst Ky0rLSstfC0rLSstKy0rLSstKy18LSstKy0rLSstKy0rLSstfC0rLSstKy0rICAgICAgICAgLS0t Kw0KICAgIHwgICAgICAgICAgICAgICB8ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICB8ICAg ICAgICAgICAgICAgICAgICBeDQogICAgfCAgICAgICAgICAgICAgIHwgICAgICAgICAgICAgfCAg ICAgICAgICAgICAgIHwgICAgICAgICAgIEV4cG9ydGVkIHwNCiAgICB8IFBlZXItSWQocyksICAg fCBjaGFubmVsICAgICB8IE1TSyAoNjQrQikgICAgfCBJViAoNjRCKSAgICAgIGJ5ICAgfA0KICAg IHwgU2VydmVyLUlkKHMpLCB8IGJpbmRpbmdzICAgIHwgRU1TSyAoNjQrQikgICB8IChPcHRpb25h bCkgICAgRUFQICB8DQogICAgfCBTZXNzaW9uLUlkICAgIHwgJiBSZXN1bHQgICAgfCAgICAgICAg ICAgICAgIHwgICAgICAgICAgICAgTWV0aG9kIHwNCiAgICBWICAgICAgICAgICAgICAgViAgICAg ICAgICAgICBWICAgICAgICAgICAgICAgViAgICAgICAgICAgICAgICAgICAgVg0KDQoNCg0KUmVn YXJkc35+fg0KDQotU3VqaW5nIFpob3UNCg0KZW11LWJvdW5jZXNAaWV0Zi5vcmcg0LTT2iAyMDEy LTA1LTI2IDA0OjM5OjE5Og0KDQo+IFRoZSBJRVNHIGhhcyBhcHByb3ZlZCB0aGUgZm9sbG93aW5n IGRvY3VtZW50Og0KPiAtICdDaGFubmVsIEJpbmRpbmcgU3VwcG9ydCBmb3IgRUFQIE1ldGhvZHMn DQo+ICAgKGRyYWZ0LWlldGYtZW11LWNoYmluZC0xNi50eHQpIGFzIFByb3Bvc2VkIFN0YW5kYXJk DQo+IA0KPiBUaGlzIGRvY3VtZW50IGlzIHRoZSBwcm9kdWN0IG9mIHRoZSBFQVAgTWV0aG9kIFVw ZGF0ZSBXb3JraW5nIEdyb3VwLg0KPiANCj4gVGhlIElFU0cgY29udGFjdCBwZXJzb25zIGFyZSBT ZWFuIFR1cm5lciBhbmQgU3RlcGhlbiBGYXJyZWxsLg0KPiANCj4gQSBVUkwgb2YgdGhpcyBJbnRl cm5ldCBEcmFmdCBpczoNCj4gaHR0cDovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1p ZXRmLWVtdS1jaGJpbmQvDQo+IA0KPiANCj4gDQo+IA0KPiBUZWNobmljYWwgU3VtbWFyeQ0KPiAN Cj4gICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIGhvdyB0byBpbXBsZW1lbnQgY2hhbm5lbCBiaW5k aW5ncyBmb3INCj4gICAgRXh0ZW5zaWJsZSBBdXRoZW50aWNhdGlvbiBQcm90b2NvbCAoRUFQKSBt ZXRob2RzIHRvIGFkZHJlc3MNCj4gICAgdGhlIGx5aW5nIE5BUyBhcyB3ZWxsIGFzIHRoZSBseWlu ZyBwcm92aWRlciBwcm9ibGVtLg0KPiANCj4gV29ya2luZyBHcm91cCBTdW1tYXJ5DQo+IA0KPiAg ICBUaGlzIGRvY3VtZW50IGhhcyBoYWQgZXh0ZW5zaXZlIHJldmlldyBpbiB0aGUgRU1VIHdvcmtp bmcNCj4gICAgZ3JvdXAuIFRoZSBkb2N1bWVudCBoYXMgY2xlYXIgYXBwbGljYWJpbGl0eSBpbiBB QkZBQiBhbmQNCj4gICAgTmV0d29yayBBY2Nlc3MgdXNlIGNhc2VzLg0KPiANCj4gRG9jdW1lbnQg UXVhbGl0eQ0KPiANCj4gICAgUHJvamVjdCBNb29uc2hvdCwgYW4gQUJGQUIgaW1wbGVtZW50YXRp b24sIGlzIHdvcmtpbmcgb24gYW4NCj4gICAgaW1wbGVtZW50YXRpb24gb2YgdGhpcyBkb2N1bWVu dC4gDQo+IA0KPiBQZXJzb25uZWwNCj4gDQo+ICAgSm9lIFNhbG93ZXkgKGpzYWxvd2V5QGNpc2Nv LmNvbSksIEVNVSB3b3JraW5nIGdyb3VwIGNvLWNoYWlyLCBpcyB0aGUNCj4gICBXb3JraW5nIEdy b3VwIFNoZXBoZXJkIGZvciB0aGlzIGRvY3VtZW50Lg0KPiAgIFNlYW4gVHVybmVyICh0dXJuZXJz QGllY2EuY29tKSBpcyB0aGUgcmVzcG9uc2libGUgQUQuDQo+IA0KPiBSRkMgRWRpdG9yIE5vdGUN Cj4gDQo+IFR3byB0aGluZ3M6DQo+IA0KPiAxKSBzOS4xOiByL3N1YnZpcnQvc3VidmVydA0KPiAN Cj4gMikgVGl0bGUgcGFnZSAoeG1sMnJmYyBmdW4gb24gdGhlIHRpdGxlIHBhZ2UpOg0KPiANCj4g T0xEOg0KPiANCj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBULiBD bGFuY3kNCj4gICAgICAgICAgICAgICAgICAgRGVwYXJ0bWVudCBvZiBFbGVjdHJpY2FsDQo+IEVu Z2luZWVyaW5nIGFuZCBDb21wdXRlciBTY2llbmNlDQo+IA0KPiBORVc6DQo+IA0KPiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFQuIENsYW5jeQ0KPiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFZpcmdpbmlhIFRlY2gNCj4gDQo+IA0KPiANCj4gX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gRW11IG1haWxp bmcgbGlzdA0KPiBFbXVAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9lbXUNCj4gDQoNCg== --=_alternative 000C20BF48257A10_= Content-Type: text/html; charset="GB2312" Content-Transfer-Encoding: base64 DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkkgZm91bmQgMyByZWZlcmVuY2Vz IG1heSBiZSBoZWxwZnVsOjwvZm9udD4NCjxicj4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fu cy1zZXJpZiI+MS4gaHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtb2hiYS1lYXAtY2hh bm5lbC1iaW5kaW5nLTAyPC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5z LXNlcmlmIj5bRUFQLUNIQU5ORUxdICZuYnNwO09oYmEsIFkuLCBQYXJ0aGFzcmF0aHksDQpNLiwg YW5kIE0uIFlhbmFnaXlhLCAmcXVvdDtDaGFubmVsPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBm YWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw Ow0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgQmluZGluZyBNZWNoYW5pc20gQmFzZWQgb24gUGFyYW1l dGVyIEJpbmRpbmcgaW4gS2V5PC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNl cmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgRGVyaXZhdGlvbiZxdW90OywgPC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNp emU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7SW4gdGhpcyBhcHByb2FjaCB0aGUg Jm5ic3A7RUFQDQptZXRob2QgaW5jbHVkZXMgY2hhbm5lbCBiaW5kaW5nIHBhcmFtZXRlcnMgaW4g dGhlIGNhbGN1bGF0aW9uIG9mPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNl cmlmIj4mbmJzcDsgJm5ic3A7ZXhwb3J0ZWQgRUFQIGtleWluZyBtYXRlcmlhbCwNCm1ha2luZyBp dCBpbXBvc3NpYmxlIGZvciB0aGUgcGVlciBhbmQ8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZh Y2U9InNhbnMtc2VyaWYiPiZuYnNwOyAmbmJzcDthdXRoZW50aWNhdG9yIHRvIGNvbXBsZXRlDQp0 aGUgU2VjdXJlIEFzc29jaWF0aW9uIFByb3RvY29sIGlmIHRoZXJlIGlzPC9mb250Pg0KPGJyPjxm b250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7YSBtaXNtYXRjaCBpbiB0 aGUgY2hhbm5lbA0KYmluZGluZyBwYXJhbWV0ZXJzLiAmbmJzcDtIb3dldmVyLCB0aGlzIGFwcHJv YWNoPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5i c3A7Y2FuIG9ubHkgYmUgYXBwbGllZCB3aGVyZQ0KbWV0aG9kcyBnZW5lcmF0aW5nIEVBUCBrZXlp bmcgbWF0ZXJpYWwgYXJlPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlm Ij4mbmJzcDsgJm5ic3A7dXNlZCBhbG9uZyB3aXRoIGxvd2VyIGxheWVycw0KdGhhdCB1dGlsaXpl IEVBUCBrZXlpbmcgbWF0ZXJpYWwuICZuYnNwO0ZvcjwvZm9udD4NCjxicj48Zm9udCBzaXplPTIg ZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwO2V4YW1wbGUsIHRoaXMgbWVjaGFuaXNtDQp3 b3VsZCBub3QgZW5hYmxlIHZlcmlmaWNhdGlvbiBvZiBjaGFubmVsPC9mb250Pg0KPGJyPjxmb250 IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7YmluZGluZyBvbiB3aXJlZCBJ RUVFIDgwMg0KbmV0d29ya3MgdXNpbmcgW0lFRUUtODAyLjFYXS48L2ZvbnQ+DQo8YnI+DQo8YnI+ PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPkl0IHRhbGtlZCBhYm91dCB0ZWNobmlxdWUg bWVudGlvbmVkDQppbiBjdXJyZW50IGNoYW5uZWwgYmluZGluZy48L2ZvbnQ+DQo8YnI+DQo8YnI+ DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPjIuIGluIHJmYyA1MjQ3IHNlY3Rp b24gJm5ic3A7NS4zLjQuDQombmJzcDtNdXR1YWwgQXV0aGVudGljYXRpb248L2ZvbnQ+DQo8YnI+ PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwOyBVc2luZyBFTVNLIGluIGNyeXB0 byBiaW5kaW5nDQp3YXMgbWVudGlvbmVkLCBtYXliZSBoZWxwZnVsIGluIGN1cnJlbnQgY3J5cHRv IGJpbmRpbmc8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNw OyA8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwOyAmcXVv dDtTaW5jZSAmbmJzcDt0aGUgY29tcG91bmQNCmtleSBNVVNUIE5PVCBiZSBrbm93biB0byBhbiBh dHRhY2tlciBwb3NpbmcgYXMgYW48L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMt c2VyaWYiPiZuYnNwOyAmbmJzcDthdXRoZW50aWNhdG9yLCBhbmQgeWV0DQptdXN0IGJlIGRlcml2 ZWQgZnJvbSBFQVAga2V5aW5nIG1hdGVyaWFsLCBpdDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIg ZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwO01BWSBiZSBkZXNpcmFibGUgdG8gZGVyaXZl DQp0aGUgY29tcG91bmQga2V5IGZyb20gYSBwb3J0aW9uIG9mIHRoZTwvZm9udD4NCjxicj48Zm9u dCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwO0VNU0suICZuYnNwO1doZXJl IHRoaXMNCmlzIGRvbmUsIGluIG9yZGVyIHRvIHByb3ZpZGUgcHJvcGVyIGtleSBoeWdpZW5lLCBp dDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNw O2lzIFJFQ09NTUVOREVEIHRoYXQgdGhlDQpjb21wb3VuZCBrZXkgdXNlZCBmb3IgbWFuLWluLXRo ZS1taWRkbGU8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNw OyAmbmJzcDtwcm90ZWN0aW9uIGJlIGNyeXB0b2dyYXBoaWNhbGx5DQpzZXBhcmF0ZSBmcm9tIG90 aGVyIGtleXMgZGVyaXZlZCBmcm9tPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5z LXNlcmlmIj4mbmJzcDsgJm5ic3A7dGhlIEVNU0suJnF1b3Q7PC9mb250Pg0KPGJyPg0KPGJyPjxm b250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4zLiBhbHNvIGluIHJmYyA1MjQ3PC9mb250Pg0K PGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7PC9mb250Pg0K PGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7VEVLcyBhcmUg b3V0cHV0IGZyb20gRUFQDQptZXRob2RzIGFuZCB3ZXJlIGRlc2lnbmVkIHRvIHNlY3VyZSB0aGUg Y2hhbm5lbCw8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNw OyAmbmJzcDtjb3VsZG4ndCB0aGV5IGJlIHVzZWQgaW4NCmNoYW5uZWwgYmluZGluZyBvciBjcnlw dG8gYmluZGluZz8gJm5ic3A7ICZuYnNwOzwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0i c2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwOyA8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9 InNhbnMtc2VyaWYiPiZuYnNwOyAmcXVvdDtUcmFuc2llbnQgRUFQIEtleXMgKFRFS3MpPC9mb250 Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyBTZXNzaW9uIGtleXMgdGhhdA0KYXJlIHVzZWQgdG8gZXN0YWJsaXNoIGEgcHJvdGVjdGVkIGNo YW5uZWw8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZuYnNwOyAm bmJzcDsgJm5ic3A7IGJldHdlZW4gdGhlIEVBUA0KcGVlciBhbmQgc2VydmVyIGR1cmluZyB0aGUg RUFQIGF1dGhlbnRpY2F0aW9uPC9mb250Pg0KPGJyPjxmb250IHNpemU9MiBmYWNlPSJzYW5zLXNl cmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyBleGNoYW5nZS4gJm5ic3A7VGhlDQpURUtzIGFyZSBh cHByb3ByaWF0ZSBmb3IgdXNlIHdpdGggdGhlIGNpcGhlcnN1aXRlPC9mb250Pg0KPGJyPjxmb250 IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyBuZWdvdGlhdGVk IGJldHdlZW4NCkVBUCBwZWVyIGFuZCBzZXJ2ZXIgZm9yIHVzZSBpbiBwcm90ZWN0aW5nIHRoZTwv Zm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsgRUFQIGNvbnZlcnNhdGlvbi4NCiZuYnNwO1RoZSBURUtzIGFyZSBzdG9yZWQgbG9jYWxs eSBieSB0aGUgRUFQIG1ldGhvZDwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1z ZXJpZiI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgYW5kIGFyZSBub3QgZXhwb3J0ZWQuDQombmJzcDtO b3RlIHRoYXQgdGhlIGNpcGhlcnN1aXRlIHVzZWQgdG8gc2V0IHVwPC9mb250Pg0KPGJyPjxmb250 IHNpemU9MiBmYWNlPSJzYW5zLXNlcmlmIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyB0aGUgcHJvdGVj dGVkIGNoYW5uZWwNCmJldHdlZW4gdGhlIEVBUCBwZWVyIGFuZCBzZXJ2ZXIgZHVyaW5nIEVBUDwv Zm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsgYXV0aGVudGljYXRpb24NCmlzIHVucmVsYXRlZCB0byB0aGUgY2lwaGVyc3VpdGUgdXNl ZCB0bzwvZm9udD4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0ic2Fucy1zZXJpZiI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsgc3Vic2VxdWVudGx5IHByb3RlY3QNCmRhdGEgc2VudCBiZXR3ZWVuIHRoZSBF QVAgcGVlciBhbmQ8L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPiZu YnNwOyAmbmJzcDsgJm5ic3A7IGF1dGhlbnRpY2F0b3IuPC9mb250Pg0KPGJyPjxmb250IHNpemU9 MiBmYWNlPSJzYW5zLXNlcmlmIj4mcXVvdDs8L2ZvbnQ+DQo8YnI+PHR0Pjxmb250IHNpemU9Mz4r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Kw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IC0tLSs8YnI+DQp8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0K Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7 Xjxicj4NCnwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwO0VBUCBNZXRob2QgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5i c3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxi cj4NCnwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOw0K Jm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KfCArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKyAmbmJzcDsgKy0rLSstKy0rLSstKy0rICZuYnNwOyB8ICZuYnNwOw0KJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyB8ICZuYnNwOyAmbmJz cDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCnwgfCAmbmJzcDsgJm5ic3A7ICZuYnNw OyBFQVAgTWV0aG9kIEtleSAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJz cDt8Jmx0Oy0mZ3Q7fCBMb25nLVRlcm0gJm5ic3A7IHwgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7fDxicj4NCnwgfCAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgRGVyaXZhdGlvbiAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAm bmJzcDsgJm5ic3A7fCAmbmJzcDsgfCBDcmVkZW50aWFsICZuYnNwO3wgJm5ic3A7IHwgJm5ic3A7 ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCnwgfCAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7IHwg Jm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7IHwgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KfCB8ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsg Ky0rLSstKy0rLSstKy0rICZuYnNwOw0KfCAmbmJzcDtMb2NhbCB0byAmbmJzcDt8PGJyPg0KfCB8 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRUFQICZuYnNwO3w8YnI+DQp8 ICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJz cDsgJm5ic3A7IE1ldGhvZCB8PGJyPg0KfCAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw Ow0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwO3w8YnI+DQp8ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7fDxicj4NCnwgJm5ic3A7IHwgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNw Ow0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDt8PGJyPg0KfCAmbmJzcDsg fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJz cDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsNCiZuYnNwO3w8YnI+DQp8 ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyArLSstKy0rLSstKy0rICstKy0r LSstKy0rLSsgKy0rLSstKy0rLSstKy0rDQp8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7fDxicj4NCnwgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 IHwgVEVLICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgfE1TSywNCkVNU0sgJm5ic3A7fCB8SVYgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsN CiZuYnNwOyAmbmJzcDsgJm5ic3A7fDxicj4NCnwgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7IHxEZXJpdmF0aW9uIHwgfERlcml2YXRpb24gfCB8RGVyaXZhdGlvbg0KJm5ic3A7 IHwgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZu YnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsNCnwgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwg fChEZXByZWNhdGVkKSB8IHwgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7fDxicj4NCnwgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICstKy0rLSst Ky0rLSsgKy0rLSstKy0rLSstKyArLSstKy0rLSstKy0rLSsNCnwgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt8PGJyPg0KfCAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgXiAmbmJzcDsgJm5ic3A7DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOw0KJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3w8YnI+DQp8ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsNCiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7DQombmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Vjxicj4NCistKy18LSstKy0rLSstKy0rLSstfC0r LSstKy0rLSstKy18LSstKy0rLSstKy0rLSstfC0rLSstKy0rICZuYnNwOyAmbmJzcDsNCiZuYnNw OyAmbmJzcDsgLS0tKzxicj4NCiAmbmJzcDsgJm5ic3A7fCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgfCAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJz cDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwO148YnI+DQogJm5ic3A7ICZuYnNwO3wgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7DQombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IHwgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyB8ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgRXhwb3J0ZWQgfDxicj4NCiAmbmJzcDsgJm5ic3A7fCBQZWVyLUlkKHMpLCAmbmJzcDsgfCBj aGFubmVsICZuYnNwOyAmbmJzcDsgfCBNU0sgKDY0K0IpDQombmJzcDsgJm5ic3A7fCBJViAoNjRC KSAmbmJzcDsgJm5ic3A7ICZuYnNwO2J5ICZuYnNwOyB8PGJyPg0KICZuYnNwOyAmbmJzcDt8IFNl cnZlci1JZChzKSwgfCBiaW5kaW5ncyAmbmJzcDsgJm5ic3A7fCBFTVNLICg2NCtCKSAmbmJzcDsN CnwgKE9wdGlvbmFsKSAmbmJzcDsgJm5ic3A7RUFQICZuYnNwO3w8YnI+DQogJm5ic3A7ICZuYnNw O3wgU2Vzc2lvbi1JZCAmbmJzcDsgJm5ic3A7fCAmYW1wOyBSZXN1bHQgJm5ic3A7ICZuYnNwO3wg Jm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB8ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyBNZXRob2QgfDxicj4NCiAmbmJz cDsgJm5ic3A7ViAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgViAmbmJzcDsNCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgViAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7IFYgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNw O1Y8YnI+DQo8YnI+DQo8L2ZvbnQ+PC90dD4NCjxicj4NCjxicj48Zm9udCBzaXplPTIgZmFjZT0i c2Fucy1zZXJpZiI+UmVnYXJkc35+fjxicj4NCjxicj4NCi1TdWppbmcgWmhvdTwvZm9udD4NCjxi cj4NCjxicj48dHQ+PGZvbnQgc2l6ZT0yPmVtdS1ib3VuY2VzQGlldGYub3JnINC009ogMjAxMi0w NS0yNiAwNDozOToxOTo8YnI+DQo8YnI+DQomZ3Q7IFRoZSBJRVNHIGhhcyBhcHByb3ZlZCB0aGUg Zm9sbG93aW5nIGRvY3VtZW50Ojxicj4NCiZndDsgLSAnQ2hhbm5lbCBCaW5kaW5nIFN1cHBvcnQg Zm9yIEVBUCBNZXRob2RzJzxicj4NCiZndDsgJm5ic3A7IChkcmFmdC1pZXRmLWVtdS1jaGJpbmQt MTYudHh0KSBhcyBQcm9wb3NlZCBTdGFuZGFyZDxicj4NCiZndDsgPGJyPg0KJmd0OyBUaGlzIGRv Y3VtZW50IGlzIHRoZSBwcm9kdWN0IG9mIHRoZSBFQVAgTWV0aG9kIFVwZGF0ZSBXb3JraW5nIEdy b3VwLjxicj4NCiZndDsgPGJyPg0KJmd0OyBUaGUgSUVTRyBjb250YWN0IHBlcnNvbnMgYXJlIFNl YW4gVHVybmVyIGFuZCBTdGVwaGVuIEZhcnJlbGwuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEEgVVJM IG9mIHRoaXMgSW50ZXJuZXQgRHJhZnQgaXM6PGJyPg0KJmd0OyBodHRwOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtZW11LWNoYmluZC88YnI+DQomZ3Q7IDxicj4NCiZndDsg PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgVGVjaG5pY2FsIFN1bW1hcnk8YnI+DQom Z3Q7IDxicj4NCiZndDsgJm5ic3A7ICZuYnNwO1RoaXMgZG9jdW1lbnQgZGVmaW5lcyBob3cgdG8g aW1wbGVtZW50IGNoYW5uZWwgYmluZGluZ3MNCmZvcjxicj4NCiZndDsgJm5ic3A7ICZuYnNwO0V4 dGVuc2libGUgQXV0aGVudGljYXRpb24gUHJvdG9jb2wgKEVBUCkgbWV0aG9kcyB0byBhZGRyZXNz PGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7dGhlIGx5aW5nIE5BUyBhcyB3ZWxsIGFzIHRoZSBseWlu ZyBwcm92aWRlciBwcm9ibGVtLjxicj4NCiZndDsgPGJyPg0KJmd0OyBXb3JraW5nIEdyb3VwIFN1 bW1hcnk8YnI+DQomZ3Q7IDxicj4NCiZndDsgJm5ic3A7ICZuYnNwO1RoaXMgZG9jdW1lbnQgaGFz IGhhZCBleHRlbnNpdmUgcmV2aWV3IGluIHRoZSBFTVUgd29ya2luZzxicj4NCiZndDsgJm5ic3A7 ICZuYnNwO2dyb3VwLiBUaGUgZG9jdW1lbnQgaGFzIGNsZWFyIGFwcGxpY2FiaWxpdHkgaW4gQUJG QUINCmFuZDxicj4NCiZndDsgJm5ic3A7ICZuYnNwO05ldHdvcmsgQWNjZXNzIHVzZSBjYXNlcy48 YnI+DQomZ3Q7IDxicj4NCiZndDsgRG9jdW1lbnQgUXVhbGl0eTxicj4NCiZndDsgPGJyPg0KJmd0 OyAmbmJzcDsgJm5ic3A7UHJvamVjdCBNb29uc2hvdCwgYW4gQUJGQUIgaW1wbGVtZW50YXRpb24s IGlzIHdvcmtpbmcNCm9uIGFuPGJyPg0KJmd0OyAmbmJzcDsgJm5ic3A7aW1wbGVtZW50YXRpb24g b2YgdGhpcyBkb2N1bWVudC4gPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFBlcnNvbm5lbDxicj4NCiZn dDsgPGJyPg0KJmd0OyAmbmJzcDsgSm9lIFNhbG93ZXkgKGpzYWxvd2V5QGNpc2NvLmNvbSksIEVN VSB3b3JraW5nIGdyb3VwIGNvLWNoYWlyLA0KaXMgdGhlPGJyPg0KJmd0OyAmbmJzcDsgV29ya2lu ZyBHcm91cCBTaGVwaGVyZCBmb3IgdGhpcyBkb2N1bWVudC48YnI+DQomZ3Q7ICZuYnNwOyBTZWFu IFR1cm5lciAodHVybmVyc0BpZWNhLmNvbSkgaXMgdGhlIHJlc3BvbnNpYmxlIEFELjxicj4NCiZn dDsgPGJyPg0KJmd0OyBSRkMgRWRpdG9yIE5vdGU8YnI+DQomZ3Q7IDxicj4NCiZndDsgVHdvIHRo aW5nczo8YnI+DQomZ3Q7IDxicj4NCiZndDsgMSkgczkuMTogci9zdWJ2aXJ0L3N1YnZlcnQ8YnI+ DQomZ3Q7IDxicj4NCiZndDsgMikgVGl0bGUgcGFnZSAoeG1sMnJmYyBmdW4gb24gdGhlIHRpdGxl IHBhZ2UpOjxicj4NCiZndDsgPGJyPg0KJmd0OyBPTEQ6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOw0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO1QuDQpDbGFuY3k8YnI+DQomZ3Q7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 IERlcGFydG1lbnQNCm9mIEVsZWN0cmljYWw8YnI+DQomZ3Q7IEVuZ2luZWVyaW5nIGFuZCBDb21w dXRlciBTY2llbmNlPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IE5FVzo8YnI+DQomZ3Q7IDxicj4NCiZn dDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7VC4NCkNsYW5jeTxicj4NCiZndDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7VmlyZ2luaWEgVGVjaDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IDxicj4NCiZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQomZ3Q7IEVtdSBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7IEVtdUBpZXRmLm9yZzxicj4N CiZndDsgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9lbXU8YnI+DQomZ3Q7 IDxicj4NCjwvZm9udD48L3R0Pg0K --=_alternative 000C20BF48257A10_=--